Securing Wireless LANs with PEAP and Passwords
Chapter 5: Building the Wireless LAN Security Infrastructure
On This PageOverviewThis chapter provides guidance on the installation and configuration of Internet Authentication Service (IAS) to provide Remote Access Dial-In User Service (RADIUS) services to a wireless local area network (WLAN), and the configuration of wireless access points (APs) to use the IAS RADIUS services. The principal topics in the chapter are as follows:
The procedures in this chapter are less automated than the procedures in the earlier chapters. Although IAS is configurable programmatically, many settings cannot be configured using Windows Scripting Host or available command-line tools. Compiled application code is usually less accessible to non-developers than scripts. So, where a procedure was not scriptable, the manual steps to complete that procedure were used. If you want to automate the configuration of IAS using the Server Data Objects interface, refer to MSDN at http://msdn2.microsoft.com/default.aspx. For the exact location of the information on the subject, see the references at the end of this chapter. The configuration steps in this chapter are largely manual; however, there are some positive aspects to this. First, the IAS administration interface is easy to use and is often driven by configuration wizards. Second, you will normally perform the configuration steps only on one server and then replicate these settings to the other IAS servers using simple commands. Third, performing these steps manually helps you to learn more about the installation and configuration of IAS. This last point is more relevant here than for the other components of the solution. IAS is the hub around which the rest of the solution revolves, so it is desirable to have some experience of administering and configuring it. Chapter PrerequisitesBefore implementing the instructions provided in this chapter, you should have read and implemented the procedures in Chapter 3, "Preparing Your Environment" and Chapter 4, "Building a Network Certification Authority." You should have also read Chapter 2, "Planning a Wireless LAN Security Implementation," and understood the architecture and design of this solution. In addition, it will help if you are familiar with following topics:
Preparing for ImplementationPermissions NeededTo carry out the procedures in this chapter, you need to log on with an account that is a member of the Administrators group for the domain into which you are installing the IAS servers. Note: If you are not installing IAS on domain controllers, you will only need to be a member of the local Administrators group on each IAS server to install and configure IAS. You will also need to have permissions to modify the membership of the RAS and IAS Servers group for the domain into which you are installing IAS server. Tools NeededThe following tools are needed to perform the procedures in this chapter. Table 5.1: Tools Needed
IAS ParametersThe following table lists the main parameters used in the installation and configuration of the IAS server. Table 5.2: IAS Server Configuration Parameters
Important: These settings were used in the internal testing of this solution and are known to work as documented. Although many of these can be set to other values, you should do this only if you are confident that you fully understand the purpose of a particular setting and the implications of changing it. Checking Readiness for InstallationIAS is dependent on correct network and Active Directory configuration and connectivity. Several tools are required for the successful installation and maintenance of IAS. Validating the IAS EnvironmentBefore installing IAS on the server, you must run a series of checks to ensure that a domain controller is contactable and that all the required tools have been installed as per the procedures described in Chapter 3, "Preparing Your Environment." The following procedure uses a script to perform these checks automatically for you. To check the IAS environment
Verifying DHCP SettingsDynamic Host Configuration Protocol (DHCP) will be used to assign IP addresses to the WLAN clients automatically. Ensure that the DHCP scopes assigned at each site have enough IP addresses to cover the maximum number of WLAN clients that may be active at the site. If the scope is shared with wired clients, it must be large enough to accommodate both sets of clients. Organizations with large numbers of WLAN clients or which have WLAN clients that regularly move from site to site, should configure separate scopes for WLAN clients. Having separate scopes allows you to specify very short lease times for these clients (for example, eight hours or less) and hence helps prevent transient WLAN clients quickly exhausting the available IP addresses. To do this, place the WLAN clients on a separate subnet from the rest of the site network, and configure a router or layer 3 switch to connect the subnets. For smaller or relatively static environments, sharing an IP subnet and a single DHCP scope between wired and WLAN clients is quite acceptable. For more information, see the "Deploying a Wireless LAN" chapter of the Windows Server 2003 Deployment Kit. The reference for this is given at the end of this chapter. Installing IASThis section describes how to install IAS on your server. Installing the IAS Software ComponentsYou can install the IAS software components using a script provided with this guidance. This script uses the Windows Optional Components Installation Manager to install IAS, and builds all the required configuration files as it runs. To install IAS
Verifying the InstallationTo verify the installation, click Start, point to All Programs, point to Administrative Tools, and click on Internet Authentication Service. IAS should be shown as installed and running on the server. Registering IAS in Active DirectoryEach IAS server needs to be registered in Active Directory. Registering means adding the IAS server computer account to the RAS and IAS Servers security group, which ensures that IAS servers have permission to read the remote access properties of user and computer accounts in Active Directory. You can register your servers in one of the following ways:
The last method (using Netsh command) is shown here because it is simple to script and allows the server to be registered in other domains. To register IAS in the default domain
If you have multiple domains, perform the following procedure for each domain that has users or computers that will be authenticated by this IAS server. For example, if your IAS servers are installed in domain A and you have WLAN users in domain B, you must register the IAS servers in domain B as well as domain A. To do this, you need to have permission to modify the RAS and IAS Servers group membership in the target domain. To register IAS in domains other than the default domain
Configuring the Primary IAS ServerThis section provides guidance on configuring the first IAS server. Subsequent IAS servers will be configured by replicating the settings from this server using the procedures described later in the chapter. Automatically Enrolling for an IAS Server CertificateChapter 4, "Building the Network Certification Authority," provided the steps for installing a Group Policy object (GPO) to allow members of the RAS and IAS Servers group to enroll computer certificates automatically. The registration of the IAS server in Active Directory causes the server account to be added to this group. However, the server needs to be restarted for the computer to have this group membership added to its logon token and be able to enroll a certificate successfully. Note: Just as with users, computers do not receive changed group membership in their logon session access token until they log on to the domain again. For computers, this occurs at boot time. Before continuing with the next procedure, restart the server. Warning: Before restarting the server, ensure that no tasks are being performed on this server. If the server is a domain controller, ensure that another domain controller is available to users before restarting this one. You should also avoid restarting during a critical system task such as server backup. Verifying IAS Server Certificate DeploymentAfter restarting the server, ensure that the IAS server certificate has been successfully enrolled. To verify the IAS server authentication certificate
Configuring the First IAS ServerThe configuration of all the IAS servers will be largely identical in this solution (though the set of wireless APs installed on each server will usually be different for each server). To keep the configuration synchronized between servers, and to minimize the effort of managing multiple servers, you will perform the majority of configuration tasks on the first installed IAS server and then replicate this server's settings to other IAS servers in the organization. During the procedures in this section, you will configure the following types of setting on the first IAS server:
Later, these settings will be replicated to the other IAS servers. You must also add a RADIUS client entry to IAS for each wireless AP served by that IAS server (this is covered in the "Configuring Wireless Access Points" section, later in this chapter). Configuring Logging to Windows Event LogsIAS logs significant system-level events such as service startup and shutdown and problems such as configuration errors and service failures to the Windows system log. It can also optionally log successful and failed authentication attempts. To enable IAS logging of authentication requests
Configuring Logging of Authentication and Accounting Requests to RADIUS LogsIAS can also log authentication and accounting information to RADIUS logs. IAS does not create RADIUS logs by default and RADIUS logging is not enabled in this solution in order to minimize management overhead. If you require RADIUS logging for security auditing or accounting purposes, either or both types of request logs can be enabled. IAS can write these logs to text files or to a SQL database. You can use these logs as input to security monitoring systems to help you track potential security violations. More rarely, organizations use the accounting logs for billing purposes although this is typically confined to commercial Internet and other Network service providers. If you want to implement RADIUS logging or simply read more about it, see the references at the end of this chapter. Note: You should not enable RADIUS authentication and account logging unless you have a specific need for it. It can degrade server performance and the log files also need regular housekeeping to ensure that they do not fill the server disks. Creating an IAS Remote Access Policy for WLANPerform the following procedure to create a remote access policy on the IAS server. To create a remote access policy in IAS
Modifying the WLAN Access Policy Profile SettingsThe New Remote Access Policy wizard (as used in the previous procedure) creates a valid remote access policy but the following two settings need to be configured manually. The first setting adds the RADIUS attribute Ignore-User-Dialin-Properties. This tells IAS to ignore the remote access permission setting specified on the Dial-In tab of the Active Directory user object. It also prevents IAS from sending this information in the RADIUS responses to the wireless APs because this can sometimes cause compatibility problems. The second category allows the IAS server to terminate the client connection after a specified time-out and force the client to re-authenticate. These settings are particularly important when using dynamic Wired Equivalent Privacy (WEP) data protection (the default for this solution). The session time-out controls the frequency at which new network data encryption keys are generated. Note: Wi-Fi Protected Access (WPA) has its own mechanism to generate new keys for each transmitted packet. The following discussion is not applicable to WPA WLANs. The session time-out value is a tradeoff between security and reliability. 60 minutes time-out gives adequate security for most circumstances and certainly for 11 Mbps 802.11b networks. Normally, wireless clients will never transmit enough data in 60 minutes to allow a dynamic WEP key to be recovered by an attacker. Faster WLANs using the 802.11a or 802.11g 54 Mbps standards allow more data to be transmitted in a given time; you should consider using a 15 minute time-out for faster WLANs. However, using a shorter value can reduce WLAN reliability and increase the load on the IAS servers. You should read the section "Security Options for Dynamic WEP" in Chapter 2, “Planning a Wireless LAN Security Implementation” for a more detailed discussion on setting the client session time-out. You must configure the value for client session timeout and the Termination-Action attribute of RADIUS to the required value so that the IAS server can force the client to re-authenticate at the required interval. For more information about remote access policy settings, see the "RADIUS Policies" section of Chapter 2, "Planning a Wireless LAN Security Implementation." To modify the wireless access policy profile settings
Verifying the Connection Request Policy for WLANThe default IAS connection request policy is configured to instruct IAS to authenticate users and computers directly against Active Directory. Perform the following steps to verify the configuration of the default connection request policy. To verify configuration of the default connection request policy
Deploying Settings to Multiple IAS ServersAfter configuring the primary IAS server, you can replicate this configuration to the other IAS servers. Follow the procedures earlier in this chapter for "Installing IAS" and "Registering IAS in Active Directory" on each of your additional servers. You should also carry out the procedure for "Verifying IAS Server Certificate Deployment" to ensure that a certificate has been enrolled by each of the new servers. Having done this, you are ready to export the IAS settings from the first server and import them into your other servers as described in the procedures in the following section. Important: You can only replicate settings to other Windows Server 2003 IAS servers. Using these procedures, you cannot replicate settings from Windows Server 2003 to Windows 2000 versions of IAS. Replicating Settings from the First IAS ServerYou can use the Netsh command to export portions of IAS configuration to text files. The scripts used in the following procedures make use of Netsh.exe to export settings from and import them into an IAS server. The following categories of IAS settings can be separately exported from and imported into an IAS server:
Exported settings are stored in text files, however the data is encoded. These text files can be used to transfer common configuration settings across multiple IAS servers to ensure consistent configuration and speedy deployment. Most of the configuration categories will be common to IAS servers in a similar role (the exception typically being the RADIUS clients' category). In this solution, the IAS servers will be authenticating only WLAN clients. If you are planning to use one or more of the IAS servers differently, (for example, to authenticate remote access clients) you need to configure and replicate settings of those servers independently or perform the configuration manually. Otherwise, you risk overwriting and losing policy and other configuration settings. You should perform configuration of the following items only on the first IAS server (as described in the earlier section "Configuring IAS").
Using the procedures in this section will export these settings and replicate them to other IAS servers. Tip: To help you track changes to the IAS configuration, include a version number in the name of the remote access policy. Each time you change the IAS settings, update the name to include a new version number. This will make it is easier to track changes across the IAS servers and see that they are all using the same settings. Designate your first IAS server as the "master" IAS server. Then use the following procedures to replicate the settings from this server to the other IAS servers in your organization. The replication of RADIUS client settings is detailed in the "Replicating RADIUS Client Configuration to Other IAS Servers" section later in this chapter. Note: The "Master" designation has no special meaning to IAS. It is only used to indicate which server you will use to make the initial configuration changes before they are replicated to the other IAS servers. Exporting Settings from the Master IAS ServerThis procedure saves the current IAS server settings to disk files. To export the IAS configuration to disk files
Importing Settings to Other IAS ServersThis procedure uses the settings files exported in the previous procedure to configure other IAS servers with identical settings. This procedure does not import the RADIUS clients, which is covered in a later section. Warning: The import of IAS settings to an IAS server will overwrite all existing IAS settings on that server (with the exception of the RADIUS client information). If you have created different settings on any server (for example, different remote access policies to support virtual private network (VPN) clients), do not use this procedure to import the IAS WLAN settings to that server. Instead, configure the settings manually using the procedures described in the "Configuring the Primary IAS Server” section earlier in this chapter. To import IAS configuration from disk files
You should verify that the settings have been imported correctly by opening the Internet Authentication Service MMC and checking the remote access and connection request policy settings. Configuring Wireless Access PointsThis section describes how to add wireless APs as RADIUS clients of the IAS servers. Adding the Access Points as RADIUS Clients to IASYou must add wireless APs as RADIUS clients to IAS before they are allowed to use RADIUS authentication and accounting services. For more information on how to allocate wireless APs to different IAS servers, see the procedures in Chapter 2, "Planning a Wireless LAN Security Implementation." The wireless APs at a given location will typically be configured to use an IAS server at the same location for their primary RADIUS server and another IAS server at the same or a different location as the secondary RADIUS server. The terms "primary" and "secondary" here do not refer to any hierarchical relationship, or difference in configuration, between the IAS servers themselves. The terms are relevant only to the wireless APs, each of which has a designated primary and secondary (or backup) RADIUS server. Before you configure your wireless APs, you must decide which IAS server will be the primary and which will be the secondary RADIUS server for each wireless AP. The following procedures describe adding RADIUS clients to two IAS servers. During the first procedure, a RADIUS secret is generated for the wireless AP; this secret, or key, will be used by IAS and the AP to authenticate each other. The details of this client along with its secret are logged to a file. This file is used in the second procedure to import the client into the second IAS. Important: You must not use this first procedure to add the same client to two IAS servers. If you do this, the client entries on each server will have different RADIUS secret configured and the wireless AP will not be able to authenticate to both servers. Adding Access Points to the First IAS ServerThis section describes the adding of wireless APs to the first IAS server. A script is supplied to automate the generation of a strong, random RADIUS secret (password) and add the client to IAS. The script also creates a file (defaults to Clients.txt) that logs the details of each wireless AP added. This file records the name, IP address, and RADIUS secret generated for each wireless AP. These will be required when configuring the second IAS server and wireless APs. If you prefer to add the clients manually, follow the "Generating the client's entries for wireless APs" procedure later in this chapter, to generate secrets for the wireless APs. Important: The RADIUS clients are added to IAS as "RADIUS Standard" clients. Although this is appropriate for most wireless APs, some APs may require that you configure vendor–specific attributes (VSA) on the IAS server. You can configure VSAs either by selecting a specific vendor device in the properties of the RADIUS clients in the Internet Authentication Service MMC or (if the device is not listed) by specifying the VSAs in the IAS remote access policy. For more information on configuring VSAs in IAS, see the references at the end of this chapter. In addition, refer to your wireless AP documentation for information regarding VSA requirements on RADIUS servers. To add a RADIUS client to the first IAS server
Later, you will use the output file for reference while setting the RADIUS secrets on the wireless APs. For more information, see the "Configuring the Wireless Access Points" section later in this chapter. Important: Do not leave the RADIUS clients output file on the server. It contains the RADIUS client secrets in unencrypted form. After adding the wireless APs, you should move the file to a floppy disk or other writable, removable media and store it in a secure place. The "Adding a RADIUS client to the first IAS server" procedure described above uses a sample tool included with this solution (AddRADIUSClient.exe). This tool is a simple Visual Basic.NET application, which uses the Server Data Objects interface to configure an IAS server. You can use it to write your own script to add clients to IAS server. This tool is not supported by Microsoft and has not been thoroughly tested. However, the source code of this application is included should you need to examine or modify it before using it. Note: Unlike most of the scripts used in the setup procedures, this script does not write progress details to the MSSWLAN-setup.log log file. The reason for this is to prevent the RADIUS client secrets being stored there and posing a security risk. However, the progress details are logged to the screen. Scripting the Addition of Access Points to IAS Server (Alternative Procedure)If you do not want to add the wireless APs to the IAS server interactively using the previous procedure, you can just generate the RADIUS client entries output files for each wireless AP without adding them to IAS. You can then use the "Importing the RADIUS clients to the second IAS server" procedure described later in this section to import the RADIUS client entries into both the first IAS server and the second IAS server. Because you can script this whole operation, you may prefer to add your RADIUS clients this way if you have to add a large number of wireless APs. Important: This procedure is an alternative method for adding RADIUS clients in a scripted rather than an interactive fashion. If you have followed the previous procedure "Adding a RADIUS client to the first IAS server," you do not need to follow this procedure. Use the following procedure to generate strong RADIUS secrets. The script, like the previous procedure, uses a CryptoAPI function to generate a truly random value for each RADIUS secret. This ensures that the values are sufficiently strong to defeat password guessing or dictionary attacks. To generate the clients entries file for wireless APs
Importing the Access Points into the Second IAS ServerAfter adding the wireless APs to the first IAS server, you need to add them to a second server before configuring the wireless APs to use RADIUS. To import the RADIUS clients to the second IAS server
Configuring the Wireless Access PointsHaving added RADIUS clients entries for the wireless APs to IAS, you now need to configure the wireless APs themselves. You must add the IP addresses of the IAS servers and the RADIUS client secrets that each AP will use to communicate securely with the IAS servers. Every wireless AP will be configured with a primary and secondary (or backup) IAS server. You should perform the procedures in this section for the wireless APs at every site in your organization. For more information on how to allocate wireless APs to your IAS servers, please refer to Chapter 2, "Planning a Wireless LAN Security Implementation." The procedure for configuring wireless APs varies depending on the make and model of the device. However, wireless AP vendors normally provide detailed instructions for configuring their devices. Depending on the vendor, these instructions may also be available online. Prior to configuring the security settings for your wireless APs, you must configure the basic network settings. These will include but are not limited to:
This list will include a number of other parameters that affect the deployment of multiple wireless APs: settings that control the correct radio coverage across your site for example, 802.11 Radio Channel, Transmission rate, and Transmission power, and so forth. Discussion of these parameters is outside the scope of this guidance. Use the vendor documentation as a reference when configuring these settings or consult a network services supplier. For more information on deploying wireless APs, see the references at the end of this chapter. The guidance in this chapter assumes that you have set these items correctly and are able to connect to the wireless AP from a WLAN client using an unauthenticated connection. You should test this before configuring the authentication and security parameters listed in the following sections. Enabling Secure WLAN Authentication on Access PointsYou must configure each wireless AP with a primary and a secondary RADIUS server. The wireless AP will normally use the primary server for all authentication requests, and switch over to the secondary server if the primary server is unavailable. As discussed in Chapter 2, "Planning a Wireless LAN Security Implementation," it is important that you plan the allocation of wireless APs and carefully decide which server should be made primary and which should be made secondary. To summarize:
The following table lists the settings that you need to configure on your wireless APs. Although the names and descriptions of these settings may vary from one vendor to another, your wireless AP documentation helps you determine those that correspond to the items in the table. Table 5.3: Wireless Access Point Configuration
Important: The Key Refresh Time-out is set to 60 minutes for use with dynamic WEP. The Session Timeout value set in the IAS remote access policy is the same or shorter than this. For more information, see the earlier section "Modifying the WLAN Access Policy Profile Settings." Whichever of these has the lower setting will take precedence, so you only need to modify the setting in IAS. If you are using WPA, you should increase this setting in the AP to eight hours. Consult your vendor's documentation for more information. Use the same RADIUS secrets generated in the "Adding a RADIUS client to the first IAS server" procedure to add wireless APs to IAS. Although you may have not yet configured a secondary IAS server as a backup to the primary server, you can still add the server's IP address to the wireless AP now (to avoid having to reconfigure it later). Configuring additional IAS servers is discussed in a later section of this chapter. Depending on the wireless AP hardware model, you may not have separate configurable entries for Authentication and Accounting RADIUS servers. If you have separate configurable entries, set them both to the same server unless you have a specific reason for doing otherwise. The RADIUS retry limit and timeout values given in the table are common defaults but these values are not mandatory. Note: If you are currently using wireless APs with no security enabled or only static WEP, you need to plan your migration to an 802.1X–based WLAN. For more information about migration from an existing wireless network, see the "Migration from an Existing WLAN" section of Chapter 2, "Planning a Wireless LAN Security Implementation." Additional Settings to Secure Wireless Access PointsIn addition to enabling 802.1X parameters, you should also configure the wireless APs for highest security. Most network hardware is supplied with insecure management protocols enabled and administrator passwords set to well-known defaults, which poses a security risk. You should configure the settings listed in the following table; however, this is not an exhaustive list. You should consult your vendor's documentation for authoritative guidance on this topic. When choosing passwords and community names for Simple Network Management Protocol (SNMP), use complex values that include upper and lowercase letters, numbers, and punctuation characters. Avoid choosing anything that can be guessed easily from information such as your domain name, company name, and site address. Table 5.4: Wireless Access Point Security Configuration
You should not disable SSID (WLAN network name) broadcast since this can interfere with the ability of Windows XP to connect to the right network. Although disabling the SSID broadcast is often recommended as a security measure, it gives little practical security benefit if a secure 802.1X authentication method is being used. Even with SSID broadcast from the AP disabled, it is relatively easy for an attacker to determine the SSID by capturing client connection packets. If you are concerned about broadcasting the existence of your WLAN, you can use a generic name for your SSID, which will not be attributable to your organization. Replicating RADIUS Client Configuration to Other IAS ServersTypically, the wireless APs in a given site are serviced by an IAS server at that site. For example, the site A IAS server services wireless APs in site A, while the site B server services wireless APs in site B and so on. However, other server settings such as the remote access policies will often be common to many IAS servers. For this reason the export and import of RADIUS client information is handled separately by the procedures described in this section. Although you will find relatively few scenarios where replicating RADIUS client information is relevant, it is useful in certain circumstances (for example, where you have two IAS servers on the same site acting as primary and secondary RADIUS servers for all wireless APs on that site). To export the RADIUS client settings to a file
To import RADIUS client settings from a file:
You can create a more flexible method of importing RADIUS clients by using the AddRADIUSClient.exe tool supplied with this solution. This allows you to script the selective addition of RADIUS clients to different servers. SummaryThis chapter provided guidance on the following topics:
You are now ready to configure your WLAN clients. Information on how to accomplish this is covered in Chapter 6, “Configuring the Wireless LAN Clients." You should read Chapter 8, "Maintaining the Secure Wireless LAN Solution." This chapter contains essential information about keeping your RADIUS infrastructure running in a secure and reliable manner. ReferencesThis section provides references to important supplementary information or other background material relevant to the content of this chapter.
|
In This Article
|
