securing wireless network

[adamyoung]

We now have about 10+ access points over our site and they are all unsecure. What would be the best way to secure them, the teachers all use them for their laptops. They are 3com OfficeConnect boxes of various speeds.

[Geoff]

WPA-EAP if your WAP's support it.

[woody]

I've heard from a reliable source that both WEP and WPA can be cracked with various tools readily available on t'internet. Dynamic WEP is probably best since it changes the key regularly enough to stop hackers getting the full key. However, I doubt your APs will support it. It's only the higher end of APs that do.

 

We are currently looking at putting flood fill wireless in the whole school. As well as looking at doing the job ourselves, we are getting some quotes from a few suppliers. One has come up with a fairly pricey system called Madge. But you can see why. All the APs have two radios in them. The APs connect to a central rackmount server where you can configure groups of APs with ease. If you get a new AP, you just plug it in, the server picks it up, and you add the AP to a pre-defined group. It immediately inherits all settings and is ready to go.

 

For security, you can use Mac-address filtering, dynamic WEP, and certificates. It will be lovely if the school can cough up the cash for all that!

[ajbritton]

Most decent APs support 802.1x (even old ones). This enables the use of a RADIUS server to authenticate computers onto the LAN using either certificates or a shared password.

[adamyoung]

Ive heard about RADIUS is it part of win server 2003 or something else?

[Geoff]

Yes, you need to install it though. Its called 'Internet Access and Authentication Services'

[russdev]

@geoff

 

what is radius alt on linux and any good guides on setting it up

 

russ

[ChrisH]

A search of debian packages brings up "free radius" .

[Geoff]

http://www.freeradius.org/

 

Then for setup, consult Linux Journal.

 

http://www.linuxjournal.com/article/8017

http://www.linuxjournal.com/article/8095

http://www.linuxjournal.com/article/8151

[E1uSiV3]

I had 10 Cisco AP1200s running WPA with radius, you will need to install a certificate authority with IAS so PEAP will work, it ran beautifully, shame most my clients dont support WPA yet :'(

[adamyoung]

Can anyone give some step by step talkthrough on using RADIUS to control wireless laptop access to the network

 

Thanks!

[Geoff]

Assuming your using a Windows 2003 server, there's some white papers on the Microsoft site about it.

 

http://www.microsoft.com/windowsserver2003/technologies/networking/wifi/default.mspx

 

If your using Linux, see my previous post above.

[DMcCoy]

Assuming your using a Windows 2003 server, there's some white papers on the Microsoft site about it.

 

http://www.microsoft.com/windowsserver2003/technologies/networking/wifi/default.mspx

 

If your using Linux, see my previous post above.

 

It will take you hours to get the point that it tell you to create some new certificate templates. These can only be created with Enterprise edition, I gave up at this point after about 6 hours. I only wanted to use a radius server for wpa2 :/

[Geoff]

Then use the linux approach. Any old linux box can be used as a CA to generate your certs. Just install OpenSSL.

[DaveT]

We just use MAC Addresses to authenticate, its a little unsettling to see 'unsecured network' plastered all over the laptopa, i was under the impression that this was because windows doesnt pick up on the MAC address security.

 

is this considered to be a secure setup or should we be looking at adding more measures to tighten things up?

 

Cheers

 

Dave

[ajbritton]

It depends how secure you want it. I don't think MAC address filtering is generally considered to be highly secure as any MAC address can be spoofed. A determined hacker should be able to get past MAC address filtering without much trouble. Having said that, it might slow down and possibly deter the casual opportunist.

 

There's really no excuse for not using the highest level of WEP encryption available on you APs and Laptops. WEP adds another layer which, although no longer considered secure, will deter all but the serious hacker.

[indie]

If you're just using MAC address authentication on your wireless LAN the packets can still be sniffed with something like Ethereal as they are being transmitted unencrypted. This means all manner of data could be looked at by anyone! Yes MAC addresses can be spoofed fairly easily, but remember the attacker needs to know the MAC addresses on the allowed list first.

 

At the very least I would encrypt the Wireless LAN with WEP and use MAC filtering!

 

WEP does have weaknesses though, with enough time the key can be cracked, the last time I tried it though it took almost 2 weeks of packet sniffing! Still it is possible, look at what other encryption methods your AP's offer, something like WPA2 would be better as long as all your clients support it!

[Geoff]

WEP decryption with the newest version of the (Linux!) cracking tools takes around an hour or a few million packets. Which ever comes first.

[ajbritton]

WEP decryption with the newest version of the (Linux!) cracking tools takes around an hour or a few million packets. Which ever comes first.

 

Right... at which point you get the WEP key. So now you can sniff packets and get free Internet and potentially use password cracking tools.

 

My point being that there is (or at least should be) a whole lot more security still to get through if you are after the serious data (pupil files, financial info). I think I'm right in saying that Windows passwords no longer travel across the wire unencrypted, so it should not be a trivial matter to obtain a password. I also believe it is possible to encrypt all network traffic using IPSec between Windows clients and servers. Doing that would mean that even if the wireless network was compromised, the data on the network and servers should still be safe. Don't know what kind of hit this would have on performance though. I assume encryption would be done symmetrically (same key to encrypt/decrypt) and key exchange using some form of public key transfer. (Bit out of my depth here!!)

[_Bob_]

I managed to get radius workin with a standard windows 2003 server domain. Its a bit of a pain tho' as you have to find AP and cards that support it (ours are a bit old and naff). The only thing you can't do without enterprise is automatic user certificate enrollment. So again, slight PITA cos you have to manually install user certs. on client machines.

[Geoff]

I also believe it is possible to encrypt all network traffic using IPSec between Windows clients and servers. Doing that would mean that even if the wireless network was compromised, the data on the network and servers should still be safe.

 

Well, access to the internet bandwidth is an end in itself.

 

Even so, that doesn't protect you against people brute forcing account passwords. While passwords do use NTLMv2, usernames generally fly around in cleartext. Once you have a list of usernames to work with its much easier to find the ones with bad passwords. Once you have "Domain User" access you can thing about cracking Admin.

 

Hopefully your IDS would of detected the intrusion long before things got to point though.

 

Remeber not to discount other attack vectors though. Print Servers, Routers, Managed Switches, Standalone PCs not on the domain and Systems running other OS's need to be audited too as they are perfectly valid targets for an intruder.

 

I prefer not letting people in in the first place. WPA with RADIUS is the way forward I think.

 

One thing with your Certificate server. Its good practice to have it on a small laptop or other form of portable so you can physically lock it in your schools fireproof safe. Physical access to this machine basically gives full access over your entire network infrastructure.

[u8dmtm]

It is quite easy to spoof a MAC address - pretend to be something on your allowed list but is better than nothing. Couldn't you also use WEP / WPA or 802.11.x? WEP will work most widely but is the least secure. WPA requires that all your clients support it.

[Geoff]

Yes, I think really the only way forward is to phase out your older equipment that won't do WPA/WPA2 and only buy new stuff that will.