The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Stefan Winter <address@concealed>]

Hello,

> home. After analyze the problem we discovered that the profile eduroam> for 
> iOS phones  installed from cat.eduroam.org
<http://cat.eduroam.org>> has the proxy HTTP activated in mode Auto.
This activate the WPAD> protocol and delays all the connections because
it try to discovered the> proxy http server . Also, WPAD is considered a
vulnerable protocol and> it's recommended disabled it in public networks.

It is correct that proxy discovery is set to "Automatic" in the
profiles. The profiles also are set to fall back to no-proxy if no WPAD
file is found. This usually takes only a fraction of a second. If this
takes very long, there may be a DHCP or DNS problem.

I am not aware of any other proxy discovery mechanism that could be
used/configured on iOS.

And as it happens, a number of eduroam hotspots makes use of HTTP
proxies. If we were to disable the auto-discovery, users would not be
able to use those hotspots - effectively leading to a DoS situation.

> https://auth0.com/blog/heads-up-https-is-not-enough-when-using-wpad/
> 
> Is it possible disabled the proxy HTTP in the CAT installer for iOS devices?

No. As alluded to above, the configurations are created to work on all
hotspots world-wide; some of which do have a web proxy. Turning the
feature off might look like it fixes a problem for local use, but will
create problems when roaming.

I also contemplate that only very requests like this one have arrived
over a long time, with hundreds of thousands of downloads for iOS. This
suggests that it is not a systematic problem that such long discovery
pauses are seen.

As an admin, one suggestion would be set up a WPAD entry for the hotspot
where you observe this; and to set the content of the WPAD file to "no
proxy in place". Having such a "dummy" WPAD entry in your domain also
mitigates some of the weaknesses described for WPAD discovery.

Greetings,

Stefan Winter


-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
de la Recherche
2, avenue de l'Université
L-4365 Esch-sur-Alzette

Tel: +352 424409 1
Fax: +352 422473

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the
recipient's key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

Attachment: 0xC0DE6A358A39DC66.asc
Description: application/pgp-keys

Attachment: signature.asc
Description: OpenPGP digital signature