DHCP Server and WiFi password

[Supermanpunch786]

I hope someone could help me out here.

 

 

We're currently dealing with an issue where a student uncovered the WiFi password and distributed it to their peers. As a result, we've depleted our available IP addresses. Initially, our DHCP lease duration was set to 1 day, but I've shortened it to 12 hours to ease the strain on IP addresses, especially due to the number of mobile devices connected to the WiFi. I'm considering adjusting the scope to increase the available IP addresses, but I won't proceed with this until the half term break. Do you foresee any potential impacts on our network from these changes?

 

We have over 200 Chromebooks. I'm considering changing the WiFi password, but I've been advised against it. The concern is that changing the password might prevent the Chromebooks from receiving the updated policy along with the new WiFi password because all the Chromebooks need to be switched on when the WiFi password change has been made in Google Admin. I'm curious about the accuracy of this advice.

[FN-GM]

Do not change the password it isn’t good practice to do this in the first place and it will be leaked again. Change to 802.1x this way there is no password to leak.

 

In the short term, what WIFI solution do you use? Can you put a policy in place to only allow ChromeOS devices to connect? Maybe restrict it so only approved MAC addresses are allowed? I know these aren’t security measures but should bring the system to a stable state.

[miloshmedia]

I’d just check your filtering can cover any increase in scope as some solutions have an issue with this. Also could you not make a new SSID on the same VLAN, give that as the preferred network to the chromebooks then once they’re all switched over, delete the existing one?

[speakercon]

I would do what miloshmedia has suggested, new SSID, add to Chrome Networks, give it a while to sync and then disable the old SSID.

 

Do you know how the password got out?

[DEfrostphone]

That is the correct way to do it. I’ve done it a few times myself set up a new SSID with new password. Then added via Google admin console, Give it a week to replicate throughout the network, then turn off compromised SSID. The chrome books will then switch over to the new SSID

[mavhc]

How did they find the password? On Windows you need admin rights for that

[ThatBoringBloke]

The quick fix for this in the short term would be to create a new SSID and then use The Google Admin Console to distribute the new SSID and then once your happy to change disable the old one.

Additionally depending on the wifi system you have in place you may be able to look at what devices are on the network and disable them, we have Meraki and can see which OS is getting an address. If the device isnt recognised by yourself then simply block it and deny the device an IP in DHCP.

[PotNoodleTech]

It sounds like you need MAC address filtering on - export a list of chromebook mac addresses from google to allow access to your new more secure wifi network, and then ban everything else.

[robintech]

Not saying about OP but I think everyone has a password protected SSID as one of their networks and eventually it gets revealed or shared "unofficially" or given out when you're trying to do 100 things at once and don't really care anymore, it should be really unattractive to use though from a filtering point of view , with clients as isolated as possible.

[mavhc]

Step 1: make your password something like C_>z+:G@7<1cGvOuTW7F\l-ZqKVGV(+f6h`XAz"]?t'~{

Step 2: now they're forced to copy and paste

Step 0: The S in PSK means shared, if you want security of wifi switch to not using PSKs

[DrCheese]

Step 1: make your password something like C_>z+:G@7<1cGvOuTW7F\l-ZqKVGV(+f6h`XAz"]?t'~{

Hey how you'd know my password?!

[Norphy]

That’s amazing, I use the same combination for my luggage

[Supermanpunch786]

All good responses.

 

Looking at creating a new SSID and have the Chromebooks sync.

Will look at 802.1x when I have a bit of time over half term.

 

Thank you all for your time and advice.

[k-strider]

whilst not due to a password leak (which we have had) we have had our dhcp scope exausted because of MAC randomization we now have a /20 scope for our ipads even though we dont have anything like that onsite it used to be on a /22 scope and when it (mac randomization) became a thing and before we change the MDM policy it filled up fast before we realized...

 

we try to do 802.1x as best we can but there are still times i cant get devices on... and we have to fall back to psk... :-(

Edited May 13, 2024 by k-strider

[Roberto]

Hey how you'd know my password?!

 

Mine is ******* people will never work it out!

[FN-GM]

whilst not due to a password leak (which we have had) we have had our dhcp scope exausted because of MAC randomization we now have a /20 scope for our ipads even though we dont have anything like that onsite it used to be on a /22 scope and when it (mac randomization) became a thing and before we change the MDM policy it filled up fast before we realized...

 

we try to do 802.1x as best we can but there are still times i cant get devices on... and we have to fall back to psk... :-(

 

DHCP starvation attack. Your wifi solution should have protection for this, it varies by vendor. Physical switch ports are easier to protect, simply limit the number of MAC addresses on a port (2 maybe) using port security. Anything port and it will shutdown.

[mrstrong]

just wondering how you would do this (push out a new ssid before deleting the old one if password leaked) on windows laptops (on prem AD)?

We currently have a script to set up wifi when a laptop is imaged.

 

Would you do via GPO e.g. under Computer Configuration, Windows Settings, Security Settings, and then click Wireless Network (IEEE 802.11) Policies.

 

(https://learn.microsoft.com/en-us/windows-server/networking/core-network-guide/cncg/wireless/e-wireless-access-deployment#bkmk_activate)

[Davit2005]

just wondering how you would do this (push out a new ssid before deleting the old one if password leaked) on windows laptops (on prem AD)?

We currently have a script to set up wifi when a laptop is imaged.

 

Would you do via GPO e.g. under Computer Configuration, Windows Settings, Security Settings, and then click Wireless Network (IEEE 802.11) Policies.

 

(https://learn.microsoft.com/en-us/windows-server/networking/core-network-guide/cncg/wireless/e-wireless-access-deployment#bkmk_activate)

 

This is the way we did it at a previous place. We hid the corporate device owned SSID to stop confusion for end users. The less SSIDs you have the better though 3 max is ideal. So if you say have a org managed SSID and a Guest/BYOD. For instance you could prob put other devices on the org owned such as IOT and have a different vlan given to them based on the radius policies.

[mavhc]

iOS devices should use the same randomised MAC for each network they connect to though, not random every time

[Davit2005]

iOS devices should use the same randomised MAC for each network they connect to though, not random every time

 

Keyword = should :-)