EAP Hardening
Enterprise Wi-Fi — certificate validation, EAP-TLS, no cred capture on rogue twins.
Visual · t15_eap_hardening
EAP = enterprise Wi-Fi auth. Original Cyberlium.
Enterprise Wi-Fi fails when users click through cert warnings on evil twins.
802.1X EAP methods range from PEAP/MSCHAPv2 (password) to EAP-TLS (client certs). Harden with cert pinning, disable weak methods, use RADIUS with strong policies, and train users never to accept rogue portal certs. Defenders monitor NAC logs and duplicate SSID events. Lab literacy on YOUR test RADIUS if brief provides — never harvest enterprise creds on public twins.
1. Strong methods
Prefer EAP-TLS with device/user certs over password-only PEAP where feasible.
Disable EAP-MD5 and legacy inner methods on RADIUS.
Command guide
Try these commands — Strong methods
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
802.1X/EAP — https://www.wi-fi.org/discover-wi-fi/security Wi-Fi Alliance WPA3 — https://www.wi-fi.org/discover-wi-fi/security
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install network-manager
macOS: Use airport / System Settings
Windows: Use netsh wlan (built-in)
═══ LINUX / macOS ═══
Command — copy this
nmcli -f SSID,SECURITY device wifi list 2>/dev/null | grep -iE '802.1X|enterprise|eap' | head -5 || echo 'Enterprise EAP literacy on YOUR org lab only' grep LAB_SSID "$HOME/cyberlium-lab/t15-wifi/roe.txt" 2>/dev/null
Primary tools to practice this lesson: nmcli, grep. Reference sites: 802.1X/EAP (https://www.wi-fi.org/discover-wi-fi/security); Wi-Fi Alliance WPA3 (https://www.wi-fi.org/discover-wi-fi/security). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Client validation
Distribute CA cert to managed devices; block anonymous outer identities where policy allows.
Users must not bypass cert warnings — twin defense.
3. Monitoring
RADIUS failure spikes, same username from many BSSIDs, geolocation anomalies.
Pair with rogue AP detection from Module 7.
4. What you ship: EAP hardening bullets
EAP-TLS preference + cert validation + RADIUS monitoring ideas.
5. What you record before the next lesson
EAP hardening list.
6. Wrong vs right: stranger SSIDs vs YOUR lab AP
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Stand up twin corp SSID to phish employee passwords.
- Right: EAP hardening listed. Next: AP checklist.
Mission: EAP hardening list
1) Compare PEAP vs EAP-TLS in one line each. 2) Write cert warning policy. 3) Name two RADIUS monitoring ideas.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Why EAP-TLS beats PEAP on twins?”
APPLY: EAP-TLS uses:
APPLY: True or False: Cert warning bypass helps evil twins.
APPLY: Disable on RADIUS: