Automating Enterprise Wireless Deployments

Macsysadmin 2013

Zack Smith@acidprime

Thursday, September 19, 13

Thanks to:

Andrew Seago @andrewseago

Arek Sokol @macbrained

Matt Johnson@macitmatt

Jason Bush@jhbush1973

(Some other people at Apple)Thursday, September 19, 13

Why wireless security?

Wireless standards

•WEP (Why bother)

•WPA/WPA2 (Personal)

•WPA/WPA2 (Enterprise)

Manual Entry Sucks

networksetup differences # Leopard Code if osVersion['minor'] == LEOP: leopardRemoveWireless(network) # Snow Leopard Code if osVersion['minor'] == SNOW: snowLeopardRemoveWireless(network) # Lion code if osVersion['minor'] == LION: lionRemoveWireless(network) # Mountain Lion Code if osVersion['minor'] == MLION: lionRemoveWireless(network)

Remove or Add Networks wifiutil --plist="settings.plist"

Passwords are a problem not a solution

Three A’s

•Authentication

•Authorization

•Auditing

Usernames and Passwords

WPA2 Example wifiutil --username=zsmith --password='d0gc4t' --plist=settings.plist

10.5 / 10.6 Plist Manipulation/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist

plist['KnownNetworks'][guid]['SSID_STR'] = networkDict['ssid'] plist['KnownNetworks'][guid]['SecurityType'] = networkDict['sect']

10.7 + Profiles

if networkDict['type'] == 'WPA2 Enterprise': # Generate the profile exportLionProfile = genLionProfile(networkDict) arguments = [ profiles, "-I", "-v", "-f", '-F', exportLionProfile ] profilesExecute(arguments) # Removing the temp profile os.remove(exportLionProfile)

Demo: Self Service Portal

Demo: PasswordUtility

Issues with User authentication

•Password rotation

•Help Desk password changes

•Mass password changes

Using Machine Password

dsconfigad -passinterval 0Thursday, September 19, 13

Auto Enrollment

Certificite Authority Web Enrollment

Windows Integrated Authentication

• SPNEGO

• Kerberos

• curl --negotiate

Windows Integrated Authentication

• SPNEGO

• Kerberos

• curl --negotiate

SPNEGO Negotiation

•reverse DNS

•time

•Able to contact KDC

curl win-7po3b92m2fp.wallcity.org

ca.ad.com/certsrv

Certificate templates

• http://technet.microsoft.com/en-us/library/cc730826(v=ws.10).aspx

Certificate templates

• http://technet.microsoft.com/en-us/library/cc730826(v=ws.10).aspx

RADIUS Testing

• radtest user password rad.ad.com 0 sharedscret

• radtest -t mschap user password rad.ad.com 0 sharedscret

Access Certificate Templates

• Replicated via Active Directory

• Access control lists for Certificate Templates ( different then RADIUS)

Machine vs User template

curl -d "CertAttrib=CertificateTemplate:User%20Certificate"...

Machine vs User template

curl -d "CertAttrib=CertificateTemplate:User%20Certificate"...

Submit a CSR

curl -d "CertRequest=${ENCODED_CSR}"...

Submit a CSR

curl -d "CertRequest=${ENCODED_CSR}"...

Machine TGT

/usr/bin/kinit -k M-084737$Thursday, September 19, 13

TGTHTTP

TGT HTTP

TGTcurl

curlHTTP

Request ID

• "${CA_URL}/certnew.cer?ReqID=${REQ_ID}&Enc=b64"

• curl --negotiate -u:

• reverse DNS required for Kerberos Service Ticket

• replication of Domain Contollers

curl HTTP

userCertificate attribute

dscl localhost read /Search/Computers/M-938747$ userCertificate

Convert from DER to PEM

•openssl

•dscl

•xxd or just binascii in python

LDAPdscl

security

ADCertificatePayloadPlugin

• Introduces on 10.7

• Supports Machine TGT style authentication

• Limited scope of OS Support deprecated in favor of DCE/RPC

DCE/RPC Distributed Computing Environment / Remote Procedure Call

•wifiutil --autoenroll curl

•wifiutil --autoenroll profile

Common Issues

• Machine joins with same Mac Address (join existing account)

• Certificate Expiration (set by template)

• eapolclient needs keychain ACL set in older operating systems

• security -k not honored in 10.7 or 10.8 ( Keys exportable )

Debugging

/System/Library/C/S/airport debug +AllUserland

LogLevel in com.apple.eap.profiles.plist

/var/log/eapolclient

http://pastie.org/pastes/265251

Open Source Solutions

• openssl command line ( or I guess the Certificate Assistant)

• IPA - (389 Directory Server, MIT Kerberos, NTP, DNS, Dogtag certificate system, SSSD and others.)

• http://www.freeipa.org

Puppet as a Certificate Authority

• puppet agent -t (submits the certificate signing request)

•puppet cert --sign agent.puppetlabs.com

•puppet cert --generate ipad.puppetlabs.com

StrongSWAN

Network Device Enrollment

WirelessConfighttp://tinyurl.com/bananas13

Automating Enterprise Wireless Deployments

windows integrated authentication

add networks wifiutil

spnego kerberos curl

user authentication

auto enrollment

certificate templates

user 20certificate

certattrib certificatetemplate

Technology

COMP-14: Automating your deployments using ANT Gary S Clink....

TME Lab_Insight Issue 65_ Moving IT Forward_4G Wireless...

Scaling Enterprise Wireless LAN Deployments · Aruba...

Evolved MVNO Architectures for Converged Wireless...

Automating IPv6 Deployments - go6.si · Automating IPv6...

Automating sleep stage classification using wireless ...

(DVO306) AWS CodeDeploy: Automating Your Software...

Bluetooth Low Energy in Wireless PKI deployments

Microso Stack Automating Database - Redgate€¦ ·...

Self-Management in Chaotic Wireless...

Experiences and Challenges in Campaign Style Deployments...

VMworld 2013: Vapp6124 automating v mware cloud and...

Automating Wireless Sensor Network Deployment and ...

Wireless Collaboration in Enterprise Environments ·...

Open Virtualized WiMAX Base Station Node for GENI Wide-Area....

Kluwer - Wireless Network Deployments