iOS clients won’t support
MsCHAPv2) unless you manually (via a computer) install a profile.
Windows clients won’t support
EAP-TTLS out-of-box (you’ll need to install a software like secure2w), unless they have Intel wireless cards.
Android support almost all combinations of
Password database restrictions
So, the real problem is how your passwords are stored.
If they are on:
Active Directory, then you’ll can use
EAP-PEAP-MsCHAPv2 (Windows boxes) and
EAP-TTLS-MsCHAPv2 (with iOS clients).
If you store passwords on LDAP, you can use
EAP-TTLS-PAP (Windows boxes) but you will be lost about iOS.
Important Security Concerns
TLS (Transport Layer Security) over
EAP(Extensible Authentication Protocol).
As you may know,
TLS is a newer version of
SSL and works based on certificates signed by a trusted central authority (Certification Authority - CA).
To establish a
TLS tunnel, the client must ensure it is talking to the correct server (In this case, the radius server used to authenticate users). It does that by checking if the server presented a valid certificate, issued by a trusted CA.
Problem is: normally, you won’t have a certificate issued by a trusted CA, but one issued by a ad-hoc CA you made just for this purpose. Operational system will complain to users that it don’t know that CA and users (as oriented by you) will happily accept that.
But this poses a major security risk:
Someone can setup a rogue AP inside your business (in a bag or even on a laptop), configure it to talk to his own radius server (running on his laptop or at the own rogue AP).
If your clientes find this AP to have a stronger signal then your access points, they will try connecting to it. Will see a unknown CA (users accept), will establish a
TLS tunnel, will send authentication information on this tunnel and the rogue radius will log it.
Now the important part: if you are using a plain text authentication scheme (
PAP for example), the rogue radius server will have access to your users passwords.
You can solve that by using a valid certificate issued by a Certification Authority but iOS, Windows (and Android) trust. Or, you can distribute the CA root certificate to your users and inform them to refuse connecting when the see certificate problems (good luck with that).