The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Stefan Winter <stefan.winter AT restena.lu>]

Hello,

> Requiring an anonymous outer identity seems to help with this, if your
> RADIUS can be configured to require it.

It only helps to a limited extent.

Because an attacker's "eduroam" will not require an outer identity and
users can send their actual usernames and passwords to it just fine. The
attacker will not complain about the victim's lack of security.

> Many platforms restrict the Wi-Fi connection properties to be very
> simple and do not easily permit entering the outer identity without
> using a configuration file.

This is indeed where things can help a bit. It is a (not so) gentle push
to install a profile because the genuine network won't allow the user in
if insufficiently configured.

This does involve some amount of frustration though; users will first
try an arbitrary number of times without the proper configuration, will
conclude that "eduroam doesn't work" (and generate brand damage on the
global brand eduroam with that) and only if you are lucky they will then
use profiles. Or they use 4G instead and tell everyone that eduroam sucks.

Greetings,

Stefan Winter

> 
> 
> 
> 
> On 3/29/19 10:19 AM, Per Mejdal Rasmussen wrote:
>> At my university many student devices are not configured to verify the
>> radius server certificate, despite we for many years have told the
>> students to use the CAT tool.
>>
>> As a consequence we will make system that generates unique credentials
>> per device. Where each username/password pair is locked to a specific
>> mac address.
>>
>> This will make it impossible to reuse stolen eduroam credentials for
>> other systems, and make it very hard to use stolen credentials on
>> other devices.
>>
>> I was wondering if anyone else has made a similar system, or know of a
>> system you can buy for that purpose?
>>
>> The reason we don't just use device certificates, is that it is not as
>> widely supported as username/password in devices.
>>
>>
> -- 
> 
> John Workman (john.workman AT mnsu.edu) 
> Networking Engineer 
> Information and Technology Services 
> Minnesota State University, Mankato 
> 3010 Memorial Library 
> Mankato, MN  56001 
> Office: 507-389-1337 
> Mobile: 507-514-0604 
> Fax: 507-389-6115
> 
> To unsubscribe, send this message:
> mailto:sympa AT lists.geant.org?subject=unsubscribe%20cat-users
> Or use the following link:
> https://lists.geant.org/sympa/sigrequest/cat-users


-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
de la Recherche
2, avenue de l'Université
L-4365 Esch-sur-Alzette

Tel: +352 424409 1
Fax: +352 422473

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the
recipient's key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

Attachment: 0xC0DE6A358A39DC66.asc
Description: application/pgp-keys

Attachment: signature.asc
Description: OpenPGP digital signature