Download presentation
Presentation is loading. Please wait.
Published byGervase Lloyd Modified over 9 years ago
1
802.1X in Windows Tom Rixom Alfa & Ariss
2
Overview 802.1X/EAP 802.1X in Windows Tunneled Authentication Certificates in Windows WIFI Client in Windows (WZC) Configuration examples Questions?
3
802.1X/EAP Port Based Network Access Control Authenticated/Unauthenticated Port Supplicant/Authenticator/Authentication Server Uses EAP (Extensible Authentication Protocol) Allows authentication based on user credentials
4
EAP over LAN(EAPOL)
5
802.1X Client 802.1X Protocol Driver (EAPOL Driver) –Handles all EAPOL communication –Extracts EAP messages from EAPOL which can be read by applications –Inserts EAP messages into EAPOL that applications wish to send 802.1X Client Application –Uses Driver to send and receive EAP messages –Handles EAP messages accordingly
6
802.1X Client in Windows Implements 802.1X Driver (NDIS) and Application Uses Microsoft EAP API to handle the EAP communication Controls user interaction (Balloon) User/Computer context
7
EAP in Windows Microsoft EAP API An EAP Module is “Microsoft DLL” that implements Microsoft EAP API 802.1X Client calls modules using EAP API to handle authentication Other example is the Microsoft VPN Client
8
EAP Modules EAP-MD5 (Built-in) –Username/password EAP-TLS (Built-in) –Client/server certificates (PKI) EAP-MSCHAPV2 (Built-in) –Username/password (Windows credentials) Protected EAP (PEAP) (Built-in) –Server certificate –Tunneled EAP Authentication –EAP-MD5,EAP-MSCHAPV2, EAP-… EAP-TTLS –Server certificate –Tunneled Diameter Authentication –Diameter (PAP/CHAP/…), EAP
9
Tunneled Authentication (TTLS/PEAP) Uses TLS tunnel to protect data –The TLS tunnel is established using the Server certificate automatically authenticating the server and preventing man-in-the-middle attacks Allows use of dynamic session keys for line encryption
10
PEAP? PEAP –Version 1, 2 –Supported by Cisco, Apple OS X Panther –http://www.ietf.org/internet-drafts/draft-josefsson-pppext-eap-tls- eap-07.txt Microsoft PEAP (Windows XP SP1) –Version 0 No headers –Implemented by Microsoft PEAP module –http://www.ietf.org/internet-drafts/draft-kamath-pppext-peapv0- 00.txt
11
Certificates in Windows PEAP (Built-in) and SecureW2 use the windows certificate trust Certificate (Chain) of Authentication server must be installed on local computer Certificate stores: –User Each user has own user store in which the user can install certificates and build certificate trusts Certificates visible only to the store owner (User) –System Only Administrators and system applications can install certificates in system store Certificates can be used by all applications and users
12
WIFI Client in Windows Wireless Zero Config (WZC) Generic interface for configuring wireless connections Compatibility –Wireless Ethernet Driver must be compatible with WZC to enable 802.1X Windows XP –WPA Windows Mobile Pocket PC 2003 Windows 2000 requires 3 rd Party WIFI Client
13
EAPOL Key
14
802.1X WIFI Scenario The WIFI Client associates with the Access Point (SSID) The Access Point requires 802.1X and sets the Clients “port” to the “Unauthenticated” state. The Access Point then starts EAPOL communication by sending the EAPOL-Identity message to the Client The 802.1X Client picks up the EAPOL communication and calls the appropriate EAP module to handle the EAP authentication After successful authentication the EAP RADIUS Server and Client generate the MPPE keys (based on the TLS tunnel) The RADIUS Server sends the MPPE keys (with the Access Accept) to the Access Point The Access Point sets the Clients “port” to the “Authenticated state” allowing the client to communicate with the Intranet The Access Point then uses the MPPE keys to encode a WEP key in an EAPOL key message The Access Point sends the EAPOL key to the Client The Client decodes the WEP key in the EAPOL key message using the MPPE keys it generated and sets the WEP key WIFI Client takes over to setup rest of the connection (DHCP)
15
Configuration example #1 EAP-TTLS/SecureW2 (Windows XP, Wireless) Step 1 Connection properties
16
Configuration example #1 EAP-TTLS/SecureW2 (Windows XP, Wireless) Step 1 Connection properties
17
Configuration example #1 EAP-TTLS/SecureW2 (Windows XP, Wireless) Step 2 Wireless Networks
18
Configuration example #1 EAP-TTLS/SecureW2 (Windows XP, Wireless) Step 2 Wireless Networks
19
Configuration example #1 EAP-TTLS/SecureW2 (Windows XP, Wireless) Step 3 Wireless Networks properties
20
Configuration example #1 EAP-TTLS/SecureW2 (Windows XP, Wireless) Step 3 Wireless Networks properties
21
Configuration example #1 EAP-TTLS/SecureW2 (Windows XP, Wireless) Step 4 Wireless Networks properties (Authentication)
22
Configuration example #1 EAP-TTLS/SecureW2 (Windows XP, Wireless) Step 4 Wireless Networks properties (Authentication)
23
Configuration example #1 EAP-TTLS/SecureW2 (Windows XP, Wireless) Step 5 SecureW2 properties
24
Configuration example #2 PEAP (Wired, Windows 2K) Step 1 Start Wireless Configuration service
25
Configuration example #2 PEAP (Wired, Windows 2K) Step 1 Start Wireless Configuration service
26
Configuration example #2 PEAP (Wired, Windows 2K) Step 2 Connection properties
27
Configuration example #2 PEAP (Wired, Windows 2K) Step 2 Connection properties
28
Configuration example #2 PEAP (Wired, Windows 2K) Step 3 Authentication properties
29
Configuration example #2 PEAP (Wired, Windows 2K) Step 3 Authentication properties
30
Configuration example #2 PEAP (Wired, Windows 2K) Step 4 PEAP properties
31
Configuration example #2 PEAP (Wired, Windows 2K) Step 4 Configure 3 rd Party WIFI Client –Some client support dynamic WEP keys –Other clients not supporting dynamic WEP keys can be tricked: “Fake WEP Key”
32
Questions? …
Similar presentations
© 2024 SlidePlayer.com. Inc.
All rights reserved.