The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Stefan Winter <stefan.winter AT restena.lu>]

Hello,

I would appreciate if you would take that page down.

This tool is accessible to end users, who we inform NEVER to put their
eduroam credentials on a web site. There is even an advisory on the main
eduroam website from 2009(!) warning users to never do this:

https://www.eduroam.org/2009/02/03/warning-do-not-use-web-logins-for-eduroam/

Your tool also doesn't cover any security-relevant checks on the server
side (you do not ask for the expected server certificate details, and so
can't validate them).

There are tools to achieve this without compromising user passwords to a
third-party (and yes, your web server is a third-party compared to the
Identity Provider READIUS server, the only place where passwords belong).

- In the CAT admin area, there is a tool available only to
administrators where they themselves can enter a credential to be
tested. The tool advises the admins to only use test accounts for that
test ("Test realm reachability" -> "Live login test").

- In CAT user area, there is a new diagnostics tool which merely asks
the user for his *realm* (not an actual username, not a password) which
then does the same checks as the "Static connectivity test" in the admin
area, and informs the user if there is any reason to suspect that a
piece of roaming infrastructure or the IdP's server itself has failed.
The tool can be found on the start page under Help -> Diagnostics (it is
still under further development; expect more features to be added next
year).

Greetings,

Stefan Winter


Am 14.12.18 um 03:46 schrieb Andre Forigato:
> Hi,
> 
> 
> You can use the following url to test Eduroam authentication from the 
> Brazilian Federation.
> Many people need this test to know if their institution is having problems 
> or not in authenticating their users.
> Use inside and outside Brazil.
> 
> 
> https://eduroam-cp.rnp.br/eduroam-test/
> 
> 
> Authentication is secure, the only log we have is the IP of the machine 
> that accessed the site for the tests.
> 
> 
> If you have suggestions feel free to give us your suggestions on improving 
> the site.
> 
> ----------
> 
> 
> Caros,
> 
> 
> Vocês podem utilizar a seguinte url para testar a autenticação Eduroam a 
> partir da federação Brasileira.
> Muitas pessoas precisam deste teste para saber se sua instituição está com 
> problemas ou não na autenticação de seus usuários.
> Utilize dentro e fora do Brasil.
> 
> 
> https://eduroam-cp.rnp.br/eduroam-test/
> 
> A autenticação é segura, o único log(registro) que temos é o IP da máquina 
> que acessou o site para os testes.
> 
> 
> Se tiverem sugestões fiquem a vontade para que eu possa melhorar o site.
> 
> 
> Abraços,
> 
> Att,
> André Luis Forigato 
> Analista de Tecnologia da Informação 
> GTI - Gerência de Tecnologia da Informação - Diretoria de Engenharia e 
> Redes 
> RNP – Rede Nacional de Ensino e Pesquisa - http://www.rnp.br 
> Tel: +55 (19) 3787-3300 - Voip (19) 1010-1101 andre.forigato AT rnp.br 
> QR-CODE : http://qr.ai/q0wv6
> 
> ----- Mensagem original -----
>> De: "Andre Forigato" <andre.forigato AT rnp.br>
>> Para: "Joaquim De Jesus Soares" <joaquim.soares AT ufra.edu.br>
>> Cc: cat-users AT lists.geant.org
>> Enviadas: Quinta-feira, 13 de dezembro de 2018 11:32:27
>> Assunto: Re: [[cat-users]] Reinstalação eduroam
> 
>> Joaquim,
>>
>> A sua instituição não está cadastrada em http://eduroam.br/institution.xml
>>
>> Favor abrir chamado com sd AT rnp.br informando este problema para 
>> analisarmos.
>>
>> Att,
>> André Luis Forigato
>> Analista de Tecnologia da Informação
>> GTI - Gerência de Tecnologia da Informação - Diretoria de Engenharia e 
>> Redes
>> RNP – Rede Nacional de Ensino e Pesquisa - http://www.rnp.br
>> Tel: +55 (19) 3787-3300 - Voip (19) 1010-1101 andre.forigato AT rnp.br
>> QR-CODE : http://qr.ai/q0wv6
>>
>> ----- Mensagem original -----
>>> De: "Stefan Winter" <stefan.winter AT restena.lu>
>>> Para: "Joaquim De Jesus Soares" <joaquim.soares AT ufra.edu.br>,
>>> cat-users AT lists.geant.org
>>> Enviadas: Quinta-feira, 13 de dezembro de 2018 10:43:58
>>> Assunto: Re: [[cat-users]] Reinstalação eduroam
>>
>>> Hello,
>>>
>>>> to tentando fazer uma nova instalação do eduroam  no site a minha
>>>> instituição não ta cadastrada como devo proceder  ?
>>>>  no site diz " O que devo fazer para ter a minha instituição listada?
>>>> contact eduroam® administrators "   bme qual o telefone email de
>>>> contacto ???
>>>
>>> The message is actually "Contact eduroam® administrators within your
>>> organisation". That's why you are asking at the wrong spot here.
>>>
>>> We can't help you in identifying the person or department in your
>>> organisation which deals with IT in general or eduroam specifically. We
>>> obviously aren't in touch with them because our website doesn't know
>>> anything about them.
>>>
>>> Maybe browsing the university website and looking for an IT support of
>>> any kind might help.
>>>
>>> Greetings,
>>>
>>> Stefan Winter
>>>
>>> --
>>> Stefan WINTER
>>> Ingenieur de Recherche
>>> Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
>>> de la Recherche
>>> 2, avenue de l'Université
>>> L-4365 Esch-sur-Alzette
>>>
>>> Tel: +352 424409 1
>>> Fax: +352 422473
>>>
>>> PGP key updated to 4096 Bit RSA - I will encrypt all mails if the
>>> recipient's key is known to me
>>>
>>> http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66
>> To unsubscribe, send this message:
>> mailto:sympa AT lists.geant.org?subject=unsubscribe%20cat-users
>> Or use the following link: 
>> https://lists.geant.org/sympa/sigrequest/cat-users
> To unsubscribe, send this message: 
> mailto:sympa AT lists.geant.org?subject=unsubscribe%20cat-users
> Or use the following link: 
> https://lists.geant.org/sympa/sigrequest/cat-users
> 


-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
de la Recherche
2, avenue de l'Université
L-4365 Esch-sur-Alzette

Tel: +352 424409 1
Fax: +352 422473

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the
recipient's key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

Attachment: 0xC0DE6A358A39DC66.asc
Description: application/pgp-keys

Attachment: signature.asc
Description: OpenPGP digital signature