Wireless networking has great potential for improving access to services at Rutgers. For this reason, it has been spreading rapidly around the campus. Unfortunately, many implementations are being done without attention to issues of security and authentication. As a result, most wireless networks at Rutgers are set up so that anyone with proper equipment can access the Rutgers network, even from outside the building. Anyone with the proper equipment can also spy on traffic. They can see users' passwords as well as other data. As Rutgers moves more and more services online, the amount of damage that can be done by having unauthorized people who learn passwords of Rutgers users is increasing.
These dangers are not just theoretical. Tools to tap nearby wireless networks are widely available, even for palmtop devices. A whole subculture has sprung up of people going around, scanning for open wireless nodes, and publicizing them to people who want free wireless access.
WPA and WEP
WPA and WEP are technologies that "encrypt" the traffic on your network. That is, they scramble it so that an attacker can't make any sense of it. To unscramble it at the other end, all systems using it must know a "key" or password.Note that WPA is now in a second generation, referred to as WPA2. Unless otherwise specified, this document uses "WPA" to refer to both.
WPA and WEP provide both access control and privacy. Privacy comes from the encryption. Access control comes from the fact that someone must know the password to use your network.
For this reason, for small networks, using WPA is enough to meet the requirements of the Wireless policy. However you will still want to make sure that any services that use a password or other private information use SSL or some other type of end to end encryption.
WEP is significantly less secure than WPA, but can be used until your equipment can be upgraded to support WPA. While WEP is widely regarded as insecure, it is still a lot better than nothing.
WPA has two modes, personal and enterprise. For small installations you'll want to use personal mode. It just requires a password. Enterprise mode is for larger installations, that have a Radius server that will support WPA.
The primary problem with WPA in personal mode is that it has a single password, which you must tell to all users. That becomes impractical for larger installations.
WPA in enterprise mode requires each user to login with their own username and password. That simplifies management in large installations, because you don't have to distribute a common password to all your users. However it is a bit more complex to implement:
- Each user's system must have special software to let the user login to the network. This software is referred to as an "802.1x supplicant".
- The access point must support WPA enterprise mode. The access point is configured to talk to a RADIUS server, which is a central server that actually checks the password.
- You must have a RADIUS server that supports WPA enterprise mode. While the RADIUS server may have its own list of usernames and passwords, it would be more common for it to talk to an LDAP or Active Directory server, so that users login to the network with the same password that they use for other services.
