Re: Network Security

From: Angelus (no_email_at_address.com)
Date: 03/15/05 

Date: Tue, 15 Mar 2005 13:28:32 GMT

Moe Trin wrote:
> In article <1110800534.6052.0@damia.uk.clara.net>, Tom wrote:
>
>
>>I've been tasked to protect out network from unwanted clients
>>connecting. ie someone brings their laptopn in and plugs it in and can
>>get an IP adress etc.
>
>
> Yes, that's how DHCP works. To prevent this from happening, you can
> configure the DHCP server to only give out addresses to specific MAC
> addresses, which has all the security of a wet paper bag.
>
> If you really do want security, you start by having the "Powers that be"(tm)
> publish a organizational policy notice that everyone sees AND ACKNOWLEDGES
> (in writing if you're serious) that says no visiting computers. Next, you
> post big freakin signs at every entrance that clearly repeat that no
> visiting computers are allowed. When someone disregards this policy, you
> make an example of them - a severed head on a pole out in front of the
> entrance may get the message across.
>
>
>>I have used arpwatch to detect new anc changed mac addresses etc but
>>does anyone know a good to way to stop unauthorised clients from
>>connecting to the network? Is there a way where if your mac address is
>>not 'known' to us then we can stop it getting an IP from the DHCP server?
>
>
> As above - but notice that many network cards can have their hardware
> address set to anything - see the ifconfig man page.

I know the mac address is easily changed on unix machines. But just out
of curiosity, does anyone know if it can be changed that easily on a
windoze box?

>
>>We don't want to not use DHCP
>
>
> Why not? Do you have computers transiting all the time? That's really
> the only valid reason to have DHCP. If the systems are fixed, the only
> benefit you gain is the few seconds of not having to configure the host.
> If you use a fixed MAC to IP address scheme, then you will waste those
> few seconds having to add the MAC address to the DHCP server configuration
> file. If the computers are in fact transients, then your security model
> already has problems.
>
> And yes, I'm riding herd on 2000 computers where corporate policy is "NO
> VISITORS ALLOWED". We use a scheme similar to arpwatch, but also monitor
> the arp caches of the servers and routers trying to catch any idiot that
> feels corporate policy is wrong.
>
> Old guy
>

Relevant Pages

  • Re: Networks
    ... In the light of my last comment above, I had a Mac in 1984, and in 1985 set ... up a network of five Macs by the simple means of plugging a cable into each ... >>> David Kelsey ... although many people seem to think computers should be as easy ...
    (microsoft.public.windowsxp.network_web)
  • Re: Mac Hostname on Network
    ... hostnames to the names of random Windows PCs on the network. ... it looks for a DHCP server, specifying its own name as the DHCP Client ... Along comes your Mac and asks the DHCP server for an IP address. ... name assigned by the network as its hostname. ...
    (comp.sys.mac.system)
  • Re: Unauthorised PCs
    ... IP lease to a mac address of a computers network adapter. ... If your switches can do mac filtering you may want to look at that. ... > Any ideas how I can prevent users picking up a dhcp lease when they plug ...
    (microsoft.public.security)
  • Re: Mac Hostname on Network
    ... hostnames to the names of random Windows PCs on the network. ... it looks for a DHCP server, specifying its own name as the DHCP Client ... if your DNS was configured so that the LAN was called ... Along comes your Mac and asks the DHCP server for an IP address. ...
    (comp.sys.mac.system)
  • Re: dhcp
    ... We have about 10000 computers on the ... How come the network is up and running. ... Basically what I mean is that everything is on the same LAN, ... dhcp server is making the entire network unsecure. ...
    (comp.os.linux.security)