The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Per Mejdal Rasmussen <pmr AT its.aau.dk>]

At our university many student devices are not configured to verify the 
radius server certificate, despite we for many years have told the 
students to use the CAT tool. This makes is possible to steal the 
credential and use them to login eduroam, email and filesystems. I 
suspect this is even greater problem at most institutions that uses 
802.1X on BYOD.

To make it impossible to reuse stolen eduroam credentials for other 
systems, we have made system that generates unique credentials per 
device. Where each username/password pair is locked to the MAC address 
of the device. The MAC address lock is implemented to prevent account 
sharing and to make it harder to use stolen credentials on eduroam.

After eduroam-account creation, the user can download a personal 
installer with the username/password and server certificate included. 
During the first week of this semester start, 4000 users created 6000 
new devices, that logged on to eduroam.

The user does not need to type in the MAC address of the devices. It is 
harvest upon the first login. This allows the device to randomize the 
MAC address per SSID. We had no issues with locking the credential to a 
MAC address.

It is also possible to make guest accounts that only works at our 
university. This is a much more secure solutions that an open network or 
shared PSK.

We are cleaning up the source code, and intent to release it on GitHub.

The reason we don't just use device certificates, is that it is not as 
widely supported as username/password in devices, and installation is 
more difficult. There is a project called GetEduroam that is working on 
device certificates for eduroam.

[unsecure] added to subject to allow sending to mail server that does 
not support TLS.

--
Per Mejdal Rasmussen
http://personprofil.aau.dk/109070