Configuring 802.1X Wired Authentication on Linux with wpa_supplicant: Locking Down LAN Ports - ITFROMZERO - Share tobe shared! Does plugging in an Ethernet cable grant direct access to your core LAN? Learn how to configure 802.1X wired authentication with wpa_supplicant on Linux (PEAP and EAP-TLS) to block rogue devices.

Table of Contents

Plugging into Ethernet Grants Instant Access to Your Core Network?

Last week, a partner visited our conference room to discuss an upcoming project. While waiting for the presentation slides to load, one of their engineers casually unplugged the LAN cable from our office printer and connected it straight into his personal laptop. Within three seconds, his machine received the IP address 192.168.10.85 from our DHCP server and could ping our entire internal server subnet.

Our office has 50 employees and a small on-premises server cluster. That incident sent chills down my spine. A casual visitor—or someone with malicious intent—could simply find an Ethernet wall jack in an unoccupied corner and run Nmap to scan every internal asset. People often say: “Our Wi-Fi uses WPA3 Enterprise, so what’s there to worry about?” Ironically, our wired network ports were left completely unprotected.

Why Do Switches Allow Any Device to Connect by Default?

An Ethernet wall outlet behaves just like an electrical socket: plug something in, and power flows immediately. Standard Layer 2 switches switch a port to the Forwarding state the moment they detect a link signal from a network card. They immediately relay the DHCP Discover packet without ever verifying whose device it is.

Two fundamental vulnerabilities lie at the heart of this issue:

No physical port authentication: The switch cannot distinguish between a company-issued laptop and an unauthorized rogue machine brought in from outside.
Defending at the wrong layer: Windows passwords and shared folder permissions only defend at Layer 7. Once an attacker lands on the same broadcast domain, they can easily launch ARP spoofing attacks to eavesdrop on network traffic or exploit unpatched SMB vulnerabilities.

Comparing LAN Port Access Control Solutions

Before settling on a solution, sysadmins typically evaluate the following three approaches:

1. MAC-based Port Security

The switch maintains an allowlist of valid MAC addresses. If an unauthorized MAC address is detected, the port immediately trips into an err-disable state.

Pros: Fast switch configuration without modifying client workstations.
Cons: MAC spoofing is trivial. An attacker can simply read the MAC label on the bottom of a printer or run tcpdump for a few seconds to sniff and clone a legitimate address.

2. Guest VLAN Segmentation and Shutting Down Unused Ports

Admins proactively disable unused ports in conference rooms or statically assign them to a Guest VLAN with Internet-only access.

Pros: Quickly isolates high-risk areas.
Cons: High operational overhead whenever employees switch desks. Furthermore, it is completely ineffective if someone unplugs a cable from an employee’s desktop and plugs it into their own laptop.

3. Access Control via IEEE 802.1X

This is the gold standard. When a cable is plugged in, the switch holds the port in an Unauthorized state, dropping all traffic except EAPOL (EAP over LAN) packets. The workstation must submit credentials or digital certificates to a RADIUS server for authentication. Only after RADIUS approves will the switch open the port for regular network traffic.

Deploying 802.1X with wpa_supplicant on Linux

Many believe wpa_supplicant is only for Wi-Fi. In reality, it handles wired networks seamlessly via its wired driver.

Step 1: Install Software Packages

Install the required packages on common Linux distributions:

# On Ubuntu / Debian
sudo apt update && sudo apt install -y wpa_supplicant

# On RHEL / Rocky Linux
sudo dnf install -y wpasupplicant

Verify the actual wired network interface name:

ip -br link

Assuming the wired interface to configure is eth0 (or enp3s0).

Step 2: Create the Authentication Configuration File

Depending on your RADIUS server architecture (FreeRADIUS or Windows NPS), choose one of the two methods below.

Option A: Authentication via Active Directory Account (PEAP/MSCHAPv2)

Create the configuration file at /etc/wpa_supplicant/8021x.conf:

ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=root
ap_scan=0

network={
    key_mgmt=IEEE8021X
    eap=PEAP
    identity="nv_nguyenvana"
    password="SecurePassword123@"
    phase2="auth=MSCHAPV2"
    ca_cert="/etc/ssl/certs/company-ca.pem"
}

Technical note: The ap_scan=0 directive is mandatory for wired networks. It instructs the daemon not to trigger background Wi-Fi scanning.

Option B: Authentication via Client Certificate (EAP-TLS)

EAP-TLS completely eliminates password leakage risks and provides robust protection against Man-in-the-Middle attacks:

ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=root
ap_scan=0

network={
    key_mgmt=IEEE8021X
    eap=TLS
    identity="workstation-dev-01"
    ca_cert="/etc/ssl/certs/company-ca.pem"
    client_cert="/etc/ssl/certs/client.crt"
    private_key="/etc/ssl/private/client.key"
    private_key_passwd="OptionalPassphrase"
}

Restrict file permissions to prevent unauthorized access:

sudo chmod 600 /etc/wpa_supplicant/8021x.conf
sudo chown root:root /etc/wpa_supplicant/8021x.conf

Step 3: Test in Debug Mode

Do not run it in the background just yet. Run it directly from the command line to inspect the detailed EAP handshake:

sudo wpa_supplicant -i eth0 -D wired -c /etc/wpa_supplicant/8021x.conf -d

Command flag breakdown:

-i eth0: The network interface to authenticate.
-D wired: Forces the process to use the wired driver instead of the wireless driver (nl80211).
-c ...: Points to the configuration file created above.
-d: Enables detailed debug logging.

When the console prints CTRL-EVENT-EAP-SUCCESS, the switch has granted network access. Simply open another terminal to request an IP address:

sudo dhclient eth0

Step 4: Configure Automatic Startup with systemd

Create a systemd template service at /etc/systemd/system/[email protected] to automatically authenticate whenever a cable is plugged in:

[Unit]
Description=802.1X Wired Authentication for %I
After=network.target
Before=network-online.target

[Service]
ExecStart=/sbin/wpa_supplicant -c /etc/wpa_supplicant/8021x.conf -D wired -i %I
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target

Enable and start the service for your specific network interface:

sudo systemctl daemon-reload
sudo systemctl enable --now [email protected]

From now on, whenever an Ethernet cable is plugged in, Linux automatically transmits EAPOL frames to open the port. Even if someone unplugs the cable and connects an unauthorized laptop, the switch will instantly isolate the port in a fraction of a second.