Watch 802.1X decide whether a port may join

short · 50 min · Objective 4.1

Task

Set up a RADIUS server and an 802.1X supplicant, then watch a port move from unauthorised to authorised on the basis of a credential. Port-based network access control is the mechanism behind most enterprise wired and wireless authentication, and it is much clearer as a sequence than as a definition.

Steps

  1. On Host B, add a test user to /etc/freeradius/3.0/users: labuser Cleartext-Password := "labpass". Add Host A as a client in clients.conf with a shared secret. Restart and run sudo freeradius -X in the foreground so you can watch the exchange.
  2. Test authentication directly before involving 802.1X: radtest labuser labpass 127.0.0.1 0 testing123. An Access-Accept means the server works; fix this before going further.
  3. On Host A, write a wpa_supplicant configuration for wired 802.1X with EAP-PEAP or EAP-TTLS, the identity labuser, and the password.
  4. Run sudo wpa_supplicant -i eth0 -D wired -c /etc/wpa_supplicant.conf -d and watch the log. Identify the three roles as they appear: the supplicant (Host A), the authenticator (the switch — here the bridge), and the authentication server (Host B).
  5. Now fail it deliberately. Change the password in the supplicant config and watch the server return Access-Reject. Note what the client does next.

Verify

radtest labuser labpass 127.0.0.1 0 testing123
radtest labuser wrongpass 127.0.0.1 0 testing123; echo "reject exit $?"
sudo grep -aE "Access-(Accept|Reject)" /var/log/freeradius/radius.log | tail -4

The first radtest must return Access-Accept and the second Access-Reject. The log must show both, and the pair is what proves the server is deciding rather than defaulting.

Notes

The three-role vocabulary is examinable and is the part worth memorising: supplicant is the device asking, authenticator is the switch or access point that holds the port closed, authentication server is RADIUS. The authenticator makes no decision of its own; it relays EAP and enforces the answer.

That relaying is why 802.1X works the same on wired and wireless, and it is why WPA2-Enterprise from the wireless lesson is simply 802.1X over the air.

Two related protocols the exam names. RADIUS is the open standard, uses UDP, and encrypts only the password field. TACACS+ is Cisco's, uses TCP, encrypts the whole payload, and separates authentication from authorization — which is why it is preferred for device administration where you want per-command authorization.

The other half of this objective is authorization: what an authenticated user may do. RBAC assigns permissions to roles rather than to people, and the principle of least privilege says the role gets the minimum that works. Those two ideas together answer most authorization questions on the exam.