Question

The owner of a hotel has contracted with you to implement a wireless network to provide internet access for guests.

The owner has asked that you implement security controls so that only paying guests are allowed to use the wireless network. She wants guests to be presented with a login page when they initially connect to the wireless network. After entering a code provided by the concierge at check-in, guests should then be allowed full access to the internet. If a user does not provide the correct code, he or she should not be allowed to access the internet.

What should you do?

answer

Implement MAC address filtering


Implement 802.1x authentication using a RADIUS server


Implement a captive portal


Implement pre-shared key authentication

Answer 1

Implement a captive portal.

Reason: a captive portal presents a web login page on first connection where guests can enter the code the concierge gives them; the portal validates the code and then allows or blocks Internet access accordingly.

Why not the others:
- MAC filtering is easily spoofed and doesn’t present a login page.
- 802.1X (RADIUS) is for per-device/supplicant-based enterprise authentication and isn’t practical for casual guest web-based logins.
- A pre-shared key does not provide individualized guest login pages or per-guest code validation.

Notes/tips: tie the portal to a backend (database or RADIUS) to validate codes, enforce session timeouts and bandwidth limits, and make sure the portal handles HTTPS redirection properly to avoid user confusion.