1. Michal Procházka, Jan Oppolzer michalp@ics.muni.czmichalp@ics.muni.cz, jan.oppolzer@cesnet.cz CESNET

2. Michal Procházka Senior researcher at Masaryk University Member of AAI department at CESNET Member of AAI TF: ELIXIR, EGI Participating in GEANT GN4p1 projects More than 8 years experiences in IT security and AAI

3. Jan Oppolzer Head of eduID.cz federation operator Deputy of AAI department at CESNET eduGAIN steering group delegate Shibbolethv3 expert

4. Goal of the training At the end of the day Understand how eduroam works What are the benefits How to setup eduroam in your country and institutions Ask questions

5. Outline Survey What is it? How it works? eudoram and NREN eduroam and organization Requirements Production

6. Survey How many NRENs? How many organizations? How many linux administrators?

7. What is it? Global identity federation Provides network access Mainly over the WiFi

8. Benefits Easy roaming Every user is idenfied Useful for auditing and logging Helps in case of security incident Communication is encrypted eduroam requires encrypted communication between client and AP

9. Video https://www.youtube.com/watch?v=0VYp8wZG 43k

10. How it works?

11. RADIUS server University ABC RADIUS server University 123 Roaming Operator Central RADIUS Proxy server WiFi Access Point User DB Visitor VLAN Student VLAN Employee VLAN user@uniabc.aq data signaling From eduroam: The Value of WLAN measurements for the R&E Community presentation

12. Terms RO – Roaming Operator ETLRS – European Top-level RADIUS Servers FLRS – Federation Level RADIUS Server IdP – eduroam Identity Provider SP – eduroam Service Provider NAS – Network Access Element F-Ticks – Federated Ticker System

13. Infrastructure Top level RADIUS server (ETLRS) National RADIUS Proxy (FLRS) Institutional RADIUS (IdP and/or SP) Identity management system (IdM) Access Points, switches (NAS) Clients (Supplicant) Monitoring (F-Ticks)

14. Protocols and security 802.1x Supplicant to AP communication RADIUS protocol NAS to IdP communication EAP protocol Supplicant to IdP communication PAP, CHAP, TLS, TTLS, MS-CHAPv2, … TLS protocol Securing FLRS to ETLRS as well as IdP to FLRS communication

15. Diagram from http://mrncciew.com

16. Authentication Protocols PAP – Password Authentication Protocol CHAP – Challenge-response Authentication Protocol TLS – Transport Layer Security – X.509 authN TTLS – Tunneled TLS with e.g. PAP

17. eduroam and NREN National point to the global eduroam Running FLRS Proxying requests from SPs to IdPs and ETLRS Monitoring infrastructure for IdPs

18. Requirements Digital certificate accepted by eduroam PMA Host with public IP address Ideally two for HA or failover configuration Web server Optionally mailing list system

19. Software for FLRS radsecproxy Proxying RADIUS requests Supports TLS (r)syslog Logging Monitoring eduroam monitoring

20. Process Incoming request is routed to National IdP Routed up to the ETLRS FLRS does not modify RADIUS packets Only filtering is applied (e.g. remove VLANs)

21. F-ticks Federated Ticker System Used to monitor FLRS RADIUS servers Leverage syslog Example of the message: F-TICKS/eduroam/1.0#REALM=%R#VISCOUNTRY=LU# CSI=%{Calling-Station- Id}#RESULT=OK# Solves also privacy issues REALM can be exchanged with undisclosed Second part of the MAC can be hashed

22. Communication channels Web pages Provide information for users and SPs Must be on eduroam.TLD domain Mailing list Global eduroam mailing list Mailing list for national SPs

23. eduroam and institution Processing user authentication Connection to the local IdM User support Usually operates as a SP

24. Technical Terms IdP – eduroam identity provider Supplicant NAS – Network Access Service AP – Access Point switch

25. Identity provider Providing user authentication IdP selects authentication method Proper user registration Ideally connected to the organization IdM IdP must be able to identify the user in person

26. Supplicant Software initiating user authentication (EAP) Creating secured tunnel to the IdP Transferring user credentials to the IdP via selected authN method Securing data transfer from machine to AP Included in Windows, Mac OS, Linux, Android, IOS, …

27. NAS WiFi Access Point/switch Must support 802.1x Communicating with home IdP using RADIUS protocol Shares secret with home IdP WiFi security: WPA2/AES Open ports see 6.3.3 in eduroam Service Definition

28. Requirements Digital certificate accepted by FLRS Access to the IdM system (user authN) Host with public IP address Ideally two hosts for HA or failover Optionally have the access points

29. Communication channels Web pages and contact mail for users Linked from eduroam.TLD Containing information how to join to eduroam Provides information about local restrictions Filtered ports NAT/IP ranges

30. Sources https://www.eduroam.org