HACKING PROJECT · wireless · Advanced
Enterprise 802.1X Lab
Deploy a production-grade enterprise Wi-Fi authentication stack using 802.1X/EAP-TLS with RADIUS and PKI.
Pre-shared-key Wi-Fi (WPA2/3-Personal) does not scale securely for enterprises: a single leaked passphrase compromises everyone, there is no per-user accountability, and no device-posture gating. Yet many teams never learn to deploy 802.1X/EAP correctly, leading to weak PEAP-MSCHAPv2 setups vulnerable to credential relay and evil-twin harvesting. The gap is hands-on competence in building a robust, certificate-based enterprise authentication stack.
**What you'll build**
Stand up a full 802.1X lab with FreeRADIUS as the authentication server, an internal PKI/CA issuing device and server certificates, EAP-TLS (and comparative EAP-TTLS/PEAP) configurations, dynamic VLAN assignment via RADIUS attributes, and integration with an LDAP/AD identity store. Include a demonstration of why EAP-TLS resists the credential-theft attacks that plague PEAP-MSCHAPv2, plus RADIUS accounting and CoA.
**Objective** — Deploy a production-grade enterprise Wi-Fi authentication stack using 802.1X/EAP-TLS with RADIUS and PKI.
**Expected outcome** — A working 802.1X lab with FreeRADIUS, a functioning CA, EAP-TLS auth, dynamic VLAN assignment, and documented comparison of EAP methods.
**Difficulty** — Advanced — requires RADIUS, PKI/certificate lifecycle, EAP internals, and switch/WLC integration working end-to-end.
**Primary category** — IAM / Network Access Control; Secondary = Wireless Security, PKI, SOC
**Security domains** — Primary = Blue Team / Network Security; Secondary = IAM, GRC, DevSecOps, Cloud Security
**Technical focus** — 802.1X, EAP-TLS/TTLS/PEAP, RADIUS (auth/accounting/CoA), PKI/certificate management, dynamic VLAN, LDAP/AD integration, supplicant configuration, NAC
**Core technologies** — Languages: Bash, Python; Frameworks/Libraries: FreeRADIUS modules, OpenSSL; Security Tools: FreeRADIUS, OpenSSL/EasyRSA/step-ca, eapol_test, hostapd; Cloud/Infra: Linux servers, managed switch/WLC or hostapd AP, VMs/containers; AI/Data: N/A; Databases: OpenLDAP/Active Directory, MySQL/PostgreSQL (RADIUS backend)
**Where it's valued** — Enterprise IT, education, healthcare, government, finance, any org with managed Wi-Fi
**Careers it builds toward** — Network Security Engineer, IAM Engineer, Identity/PKI Engineer, Wireless Engineer, Security Architect
**Framework alignment**
• MITRE ATT&CK: Defends against Credential Access T1110/T1557 (EAP relay harvesting), Valid Accounts T1078, Lateral Movement T1021 via strong per-user auth and segmentation
• NIST CSF 2.0: Protect (PR.AA authentication/identity, PR.AC access control), Identify, Govern
• OWASP: N/A (network authentication); ASVS authentication verification concepts apply
• CIS Controls v8: Control 6 (Access Control Management), Control 12 (Network Infrastructure), Control 4 (Secure Configuration), Control 16 (Application/Identity), Control 1 (Asset Inventory)
**Innovation** — Existing Idea — 802.1X is standard enterprise practice; value is educational and skills-building rather than novel. Scores: Innovation 3/10, Startup 3/10, Enterprise-Readiness 7/10, Patent = No.