Ultimate S-Tier Wifi Security with EAP-TLS Certificates (feat. Smallstep)

Рет қаралды 11,269

apalrd's adventures

Күн бұрын

Пікірлер: 45

@nickjongens2169 8 ай бұрын

Thanks, just saw an ad for smallstep and found this video around the same time. You're an S-Tier presenter :)

@apalrdsadventures 8 ай бұрын

Thanks!

@josealfredfernandes 3 ай бұрын

@@apalrdsadventures 1 question, can i use network security appliance certificate? eg: sophos? since i alredy have the appliance, ill use that certificate instead, it has many years before it expires

@grantwilcox330 10 ай бұрын

thank you for sharing. slowly learning about using security certificates.

@adrianstephens56 10 ай бұрын

Link-level security has its value (such as for identity protection), but you are trusting the AP - this might make sense at home, but not in public. Therefore, end-to-end security is always necessary. I argued this in the 802.11 standards group many years ago in the context of mesh networks, where you might have great link-level encryption, but have to trust an unknown set of intermediate nodes.

@apalrdsadventures 10 ай бұрын

You're not trusting the AP though, you're trusting the RADIUS server. The AP is just facilitating the EAP exchange by passing frames along.

@logicalAllyKat Ай бұрын

Hello, Is there any chance this conflicts with the Windows device guard?

@mjmeans7983 10 ай бұрын

In which use cases would Smallstep not be useful when implementing EAP-TLS? I presume one answer would be when only securing local connections in a network segment that doesn't have internet access at all. Is that correct? Are there other uses cases where Smallstep is not necessary or perhaps even a disadvantage?

@apalrdsadventures 10 ай бұрын

Depends on if you mean Smallstep SaaS or step-ca (the open-source backend). You can use the open-source backend along with FreeRADIUS to implement everything in this video, except generating mobileconfig files. They are just xml though, and step-ca can do the SCEP bit. So Smallstep (SaaS) is adding a GUI in this case, and also doing the job of configuring FreeRADIUS. Step-CA (open-source backend) is adding a ton of plumbing above what OpenSSL would provide as a CA, especially in supporting enrollment protocols like SCEP, ACME, Nebula, and integrating other types of certs like TLS and SSH into the same system.

@williamlew3127 21 күн бұрын

@@apalrdsadventures first, thanks for the very informative video.I was looking into passwordless auth for wifi and found this. i'm getting mixed search results to configure freeradius to do the same as what smallstep does. since most of you videos are about self hosting, would you be consider doing a video to self-host a freeradius server that would replace smallstep?

@apalrdsadventures 21 күн бұрын

Thanks! I can take a look at FreeRADIUS config. I have another video on FreeRADIUS as well (the private pre-shared-keys video), but it's not using TLS specifically either.

@james-cucumber 10 ай бұрын

Super interesting video! (Commenting mostly for the algorithm’)

@apalrdsadventures 10 ай бұрын

Thanks for that!

@grigory559 6 ай бұрын

Excellent video, thank you so much! Have you found any way to automatically distribute generated certificates on iOS devices? I'm pretty sure my wife won't be happy if I ask her to do that every 3 months 😕

@Dogo.R 10 ай бұрын

Why doesnt mac address whitelisting acheive the same thing certificates do?

@gmdc5850 10 ай бұрын

I think it is relatively easy to generate MAC addresses, so you could bypass that security feature

@apalrdsadventures 10 ай бұрын

Yes, devices can easily choose whatever MAC they wish, and MACs are always unencrypted over the air, so it's not hard to find a valid MAC to clone.

@dannylberry 10 ай бұрын

I've just set this up using my own RootCA for the smallstep PKI. anyone happen to know if you stay under the 20 device cap is it still free? I can see my authorities type is Advanced?

@jagdtigger 10 ай бұрын

Id rather not depend on external provider, can i use self signed for this?

@apalrdsadventures 10 ай бұрын

RADIUS-side you can use a single self-signed cert if you want, or it can be issued by an authority clients trust. Client-side you need an authority to issue certs and then the RADIUS server trusts the authority to validate individual certs. OpenSSL can do this (but it's clunky), and step-ca (the open source backend of Smallstep) can also do this self-hosted. FreeRADIUS would then be configured with the eap module and point at the root certificate used by the clients. The authority doesn't need to be public, but you really do need an authority somewhere.

@jagdtigger 10 ай бұрын

@@apalrdsadventures Great 👍, thanks. Id rather spend a few hours figuring this out and writing rudimentary bash scripts to automate it with cron than to scramble when the external provider goes under......

@mjmeans7983 10 ай бұрын

Camera security? Are you aware of any open-source camera firmware that supports EAP-TLS Certificate security so that security cameras can't be eaves-dropped on?

@hasanmujeeb8922 10 ай бұрын

Wow that’s awesome

@hasanmujeeb8922 10 ай бұрын

What’s the firmware?

@mjmeans7983 10 ай бұрын

Okay, so I plan on investigating the github projects ESP32-EAP-TLS-WPA2 and ESP32-CAMERA at some point. Hopefully they will work together well enough to make a much more secure security camera.

@dozerd42 10 ай бұрын

Does your AP support WPA3 Enterprise for Wifi6 clients, but still support WPA2 for WiFi clients? Not all my devices support Wifi6 yet.

@apalrdsadventures 10 ай бұрын

Security / 802.11 settings are separate. You can run in WPA2/3 transition and allow clients of either generation, and separately allow 802.11N/AC/AX (on 5Ghz). In WPA-Enterprise, using WPA2/3 transition doesn't have nearly as many downsides as it does in WPA-PSK.