On 02/23/2018 03:22 AM, hw wrote:
I´m not sure how to imagine it. It would be nice if every device
connecting to
the network, wirelessly or otherwise, had to be authenticated --- and
not only
the device, but also the user(s) using it.
https://www.networkworld.com/article/2940463/it-skills-training/machine-authentication-and-user-authentication.html
I've never seen anyone actually do this, but there's an article
discussing it. It is noteworthy that this requires enforcement in the
client OS, as well as the switch.
There are devices that are using PXE-boot and require access to the
company LAN.
If I was to allow PXE-boot for unauthenticated devices, the whole
thing would be
pointless because it would defeat any security advantage that could be
gained by
requiring all devices and users to be authenticated: Anyone could
bring a device
capable of PXE-booting and get network access.
You don't seem to understand the suggestions you're being given.
An unauthenticated device should be placed on a VLAN with appropriate
access. If you have devices that need to PXE boot before
authenticating, then you should have a VLAN that gives them DHCP
service, DNS, and tftp to boot an OS. That VLAN shouldn't have access
to the protected company resources, and it doesn't have to have Internet
access either.
Once the system boots, the users can authenticate themselves, which will
move the device onto a VLAN with access appropriate for an authenticated
user.
Well, I guess I'm confused because having explained where you'd find
the interface in which users will provide their RADIUS username and
password, you think this process is unfeasible. Perhaps you could
explain what you're looking for, more precisely?
As a customer visting a store, would you go to the lengths of
configuring your
cell phone (or other wireless device) to authenticate with a RADIUS
server in
order to gain internet access through the wirless network of the store?
Where do your hypothetical customers in a store get the user credentials
that you want to authenticate via RADIUS?
I'm not sure I understand the use case you're describing. I'm not sure
you do, either.
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
https://lists.centos.org/mailman/listinfo/centos
