EAPlab the ultimate EAP testing facility developed within the SENSE project

Transcription

1 EAPlab the ultimate EAP testing facility developed within the SENSE project Tomasz Wolniewicz (PSNC & Nicolaus Copernicus University) TF-MNM 16 Apr 2015

2 EAPlab what is it? Testing environment for simple experimenting with EAP supplicants Wireless client devices New implementation of supplicants Wireless NAS devices (access-point, controllers) Tool for spreading knowledge about proper and secure configuration of EAP bases environments Support for admin training Verifying reported bugs in supplicants 2

3 EAPlab what does it do? Provides a RADIUS server accessible by everyone Perfect, imperfect and broken server configurations available at a click of the mouse User credentials: username/password and personal certificate Access to packet listing and full server debug log Helps to keep track of your tests Allows to make your test results available to others 3

4 EAPlab how does it work? one proxy server at the front server routes packets to backend servers routing is realm-based and is directed by 4

5 EAPlab how does it work? one proxy server at the front server routes packets to back-end servers routing is realm-based and is directed by 5

6 EAPlab how does it work? RADIUS servers run in debug mode Output is filtered per realm Output can be presented as packet listing and saved to the disk Full debug output can be downloaded 6

7 EAPlab usage scenarios Device testing Check if a device can be configured for 802.1X authentication Check device resilience against credential theft attacks Check if the device can handle expired and revoked certificates Device has problems connecting to your local network? Try if it connects at EAPlab. Supplicant development and testing Did you implement everything correctly? Test against more then one RADIUS implementation Did you consider all threats and made your supplicant safe? 7

8 EAPlab usage scenarios Wireless training Organise a wireless equipment configuration course Direct your access points/controllers to EAPlab RADIUS server Each course participant configures an individual EAPlab account Anything else needed? VLAN setting in user's profile? EAPlab is not a RADIUS lab but it's capabilities may just be enough 8

9 EAPlab a glance through pages Fixed configs Three configurations differing by server certificates One username for authentication (password and certificate based) No scenario switching No server output Useful for bug reporting 9

10 EAPlab a glance through pages User account configuration EAPlab is registered in edugain so for login you can use a federated account You can also use a Google account 10

11 EAPlab a glance through pages User EAP-TLS certificate configuration 11

12 EAPlab a glance through pages User devices Define a device Set a device as selected Selected device is used for notes taken from the console 12

13 EAPlab the testing fun console User-specific configurations an individual realm Two server implementations Single CA and CA chain signing the server certificate Support for PEAP, TTLS (PAP and MSCHAPv2), FAST, PWD and TLS access to 72 RADIUS server configurations a username of choice user certificates (three types) CAT installers available directly from EAPlab a database for storing test results 13

14 EAPlab the testing fun console 18 test scenarios 14

15 EAPlab the built-in CAT CAT configurations are generated automatically CAT downloads are available directly form EAPlab The CAT 1.1 user API works behind the scenes Generic eapconfig profiles are available 15

16 EAPlab the built-in CAT CAT admin interface is available if advanced testing is required A Custom profile is preconfigured tom make manipulation even easier The user can delete the entire IdP and then regenerate it from the console with a single click 16

17 EAPlab taking notes The device test comments shows description status Blue no comments Orange some comments present Green - complete 17

18 EAPlab taking notes RADIUS result available directly from the notes interface Go to the next test without leaving the notes 18

19 EAPlab publishing results Public devices section See results from your own devices and those published by other users 19

20 EAPlab summary Expand device test results 20

21 EAPlab summary Expand each test Move to the next and previous test 21

22 EAPlab the team Tomasz Wolniewicz Maja Górecka-Wolniewicz Consulting Jędrzej Jajor Backend servers design and configuration, CA configuration and automation, consulting Stefan Winter EAPlab concept, user interface design and programming Automatic CAT IdP and profile generation Łukasz Zygmański User certificates interface 22

23 HAVE FUN Thank you!