Campus LAN 802.1X Setup Guide
Uploaded by
tdstanikshCampus LAN 802.1X Setup Guide
Uploaded by
tdstanikshCommon questions
Powered by AIOn Ubuntu, the process involves editing network connection settings via Network Manager, specifying the connection as 'Hostel Authentication', selecting PEAP (MSCHAPv2) as the authentication type, and configuring an optional CA certificate. On Windows, setup includes enabling Wired AutoConfig, setting startup type to automatic, configuring network adapter properties to enable IEEE 802.1X authentication, selecting Microsoft Protected PEAP as the network authentication method, and ensuring that the server certificate is validated with 'IIIT-H Radius CA' .
Disabling the option 'Automatically use my Windows logon name and password' is recommended to ensure that the specific 802.1X network credentials, which are distinct from the regular Windows logon credentials, are used for network authentication. This prevents the unintentional use of incorrect or unauthorized credentials, thereby enhancing security by using credentials specifically intended for network access .
The LDAP password is used as a current password to authenticate users when they generate the 802.1X authentication password. This linkage ensures that only authorized users can generate the network-specific authentication credentials. When resetting the 802.1X password, it's crucial that users verify their identity carefully using LDAP credentials, as incorrect handling may lead to unauthorized access or denial of network service. Additionally, resetting the 802.1X password does not affect the LDAP password used for other services, which ensures continuity in access to non-network related services .
Not using a CA certificate during 802.1X authentication can expose the network to man-in-the-middle attacks, as it allows an attacker to impersonate the authentication server and intercept credentials. The absence of a CA certificate verification creates risks as there is no assurance of the server's identity, potentially compromising the confidentiality and integrity of the login information transmitted over the network .
Renewing a DHCP lease is significant because it ensures that the device receives a new IP address from the network, which may be necessary after configuring the network settings or changing the authentication method. This action refreshes the network connection, helping to resolve connectivity issues and confirming that the changes in authentication settings have been successfully applied .
Using an automatically set up Wired AutoConfig service could simplify the process for users but may also introduce security risks if default configurations are not secure. Manual configuration allows custom security settings like specific authentication methods and server certificate validation, thus offering enhanced security by ensuring that all configurations align with best practices for network security and personal preferences .
On Windows XP, users must follow additional steps to delete cached usernames and passwords as detailed in Microsoft's support articles. This step is necessary to prevent old or incorrect credentials from causing authentication failures. In later Windows versions, the configuration is more integrated with network settings and includes GUI-based configuration options such as enabling and configuring Wired AutoConfig, which simplifies the process .
The primary function of 802.1X authentication in the campus network is to provide secure network access control for devices attempting to connect to the campus LAN, including hostel rooms. It ensures that only authorized users and devices can access the network by requiring a generated 802.1X password authentication step, in addition to the usual LDAP credentials, thus enhancing network security .
To configure Fedora for 802.1X authentication, a student needs to access Network Settings, add a profile under Wired connections, enable 802.1X in the security tab, and provide the necessary credentials starting from entering their email and generated password. Additionally, they might need to edit configuration files within '/etc/sysconfig/network-scripts/' to manually set the IEEE 802.1X password to prevent password prompts at every boot, and then reboot the system .
Challenges on Mac OS X might include the automatic pop-up for 802.1X authentication not appearing, especially in certain campus areas like KCIS. Resolution involves manually updating the network configuration file with the user's email and 802.1X password using a text editor. The user should then import and run this configuration, ensure 802.1X settings are properly listed in Network settings, and connect manually if needed .