The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Stefan Winter <stefan.winter AT restena.lu>]

Hello,

> Our current production eduroam deployment relies on different RADIUS
> servers (freeRADIUS vs Cisco ISE) and different user authN (TLS with
> in-house user certificate provisioning vs PEAP) than the new deployment
> currently broadcasting eduroam-test. I can't see how CAT installers for
> existing deployment would in any way test installers for a new
> deployment on different hardware using different user authN; and of
> course we can't broadcast both as eduroam. Thus our initial deployment
> and shake-down on a temporary eduroam-test SSID.  I'm happy to be
> enlightened because as it stands, we're looking at disruption of service
> to all our existing eduroam supplicants when we do cut over to new
> servers and authN for eduroam.

In essence, you are testing two things at the same time: whether CAT
works, and whether your new Wi-FI / auth backend setup works.

That's usually a bad idea - if authentication fails you don't have an
easy way to distinguish whether the failure was because CAT did
something wrong or if it's due to your new operational setup.

I'd suggest to first test CAT on the production SSID. If that works, you
can be rather confident that the only changes you'll have to do CAT-side
are the adaptation to the new server certificate and server name; after
all these are the only two properties of your auth backend which are
visible to the outside world, and thus the only thing CAT cares about.

Independently of that, you can test your new equipment using manual
configuration.

In fact, for almost all operating systems CAT installers support more
than one CA and more than one server name. So in theory, *one* installer
could indeed support both the prod and test setup.

The only exception is Android, which only supports one CA and server name.

As the icing on the cake: maybe your two equipment setups are very
different - but if they happen to use the same server certificate from
the same CA, your CAT installer is entirely agnostic of the
infrastructure differences.

Greetings,

Stefan Winter

> 
> David Bantz
> U Alaska
> 
> On Tue, Oct 16, 2018 at 2:35 AM Stefan Winter <stefan.winter AT restena.lu
> <mailto:stefan.winter AT restena.lu>> wrote:
> 
>     ...there is no need for a test SSID.... you don't need a test
>     /network/. You
> 
>     just need to test /devices/ on the existing network...
> 
>     ...have you talked to your network and user support groups about
>     the very real-life risk of credential theft when not verifying that the
>     username and password are sent to the actual, authorised authentication
>     server? 
> 
> To unsubscribe, send this message:
> mailto:sympa AT lists.geant.org?subject=unsubscribe%20cat-users
> Or use the following link:
> https://lists.geant.org/sympa/sigrequest/cat-users


-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
de la Recherche
2, avenue de l'Université
L-4365 Esch-sur-Alzette

Tel: +352 424409 1
Fax: +352 422473

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the
recipient's key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

Attachment: 0xC0DE6A358A39DC66.asc
Description: application/pgp-keys

Attachment: signature.asc
Description: OpenPGP digital signature