Replacing WEP with IPsec on OpenBSD, Windows XP 47
BSD Forums writes "WEP has been proven insecure and is thus inadequate for protecting a wireless network from eavesdropping or abuse. IPsec can be used as a replacement to WEP in the following scenarios. Joshua Stein has implemented IPsec on OpenBSD with manual keying between a router and a client as a replacement. Also, Thomas Walpuski describes in detail the configuration of an IPsec Host-to-Host connection between OpenBSD and Windows XP Professional with Authentication via X.509v3 Certificates."
No it doesn't (Score:2, Insightful)
Encrypting the physical layer is just silly. If you want your packets to stay private, use the appropriate encryption on proper level.
Re:No it doesn't (Score:2)
Leaving anyone with a pringles can and a bit of know-how able to use your internet connection to post child porn, contact terrorist cells, or hack into a corporate server. Smart!
Re:No it doesn't (Score:1)
Re:No it doesn't (Score:2)
Spoofing a MAC address is as easy as changing the value of a registry entry in Windows. All you'd need to do is sniff a MAC address off the network with the aforementioned pringles can. An unsecured physical layer is rife with possibilities for exploitation.
Re:Does it mater all that much? (Score:2)
Re:Does it mater all that much? (Score:5, Interesting)
Not only can it affect what someone can "hear" when they listen to your wireless, it's access control. If I'm a terrorist and I want to post something to the internet for my friends somewhere else to get, I'm going to find an open wireless access point, since that's easiest, but lacking one of those, I can just listen for any, and once I've found one using WEP only for security I can crack it and use it.
What's your point? The point is, if the "evildoers" use your wireless access point to transmit information guess who's hosue the Department of Homeland Security shows up at. Even if they don't haul you off to jail, having them show up at your house is not fun.
There is a misconception that because your not a large company or other visable target that your not going to be targeted. The problem is that people don't have to target you to abuse your network. They simply look for any network easy to abuse, and there's enough people looking to abuse networks that someone will stumble on to yours given enough time and a pringles can.
This is the same as companies I've been to who feel they aren't an "eBusiness company" and their access to the Internet is not public (there's no public website) so they aren't going to get hacked. They got hacked.
Re:Does it mater all that much? (Score:1)
Forget WEP, go to WPA (Score:5, Interesting)
If you want strong protection, use it in combination with 802.1x authentication with a TLS (and accept the infrastructure problem), PEAP (and choose between the incompatible v1 or v2 versions of it, and I personally can never remember which it is MS supports), or TTLS.
For even stronger protection, turn on 'session resumption' on your
Good WPA article here (Score:5, Interesting)
http://www.nwfusion.com/research/2003/0331wpa.htm
Links links links (Score:5, Informative)
W2K? (Score:2, Interesting)
Also, it looks like W2K has all same functionality (besides security monitor, which i assume is just that - monitor). Can it be used for that?
Also, what about denying non-ipsec protocol over the server interface that is connected to access point?
Re:W2K? (Score:2)
Cool, but does Airport/OS X support this? (Score:3, Interesting)
psxndc
Re:Cool, but does Airport/OS X support this? (Score:5, Informative)
No, but the machine past your Airport does.
Run WEPless and use IPSec to the house server.
VaporSec is a pretty GUI to setup racoon and IPSec on your OS X box. (see also netbsd ipsec docs; be neat if apple's userland utilities would keep up with BSDs post 2000 - FreeBSD 4.x and 5.x userlands are far more advanced).
If WEP is good enough then just turn it off. The WEP emporer is naked. Hell, just print out your squid logs and put them up on your door and your website. Unless you're spinning new keys every couple thousand packets, you're easy to watch. It's not even hard to break - mom can bring up a stumbler program and just leave it on for a couple hours.
Re:Cool, but does Airport/OS X support this? (Score:4, Informative)
Sorry I wasn't clear enough. My setup is more like this:
Internet -- OpenBSD firewall -- OpenBSD WAP/Firewall -- iBook w/ Airport card.
I don't have an airport base station, only the airport card. I'll look into VaporSec though. Thanks.
If WEP is good enough then just turn it off
I completely disagree with this statement. Yes, WEP is very weak, but if there are 5 WEP networks in the area and 25 networks with no WEP, guess which ones I'm going to try and connect to. If someone wants to break in, sure they can. But having WEP will discourage the casual intruder since there are so many other non-WEPed networks out there. WEP is good enough until you can set up IPSEC. Once that's up, sure, turn off WEP.
psxndc
Re:PPTP (Score:5, Informative)
If I SSH to everything, do I still need IPsec? (Score:2)
So - pretty much anything that I wouldn't want sniffed is going through SSH2 anyway.
Do I still need wep or ipsec? Is it more to protect the host (firewall+WAP), client (my laptop), or the stuff exchanged inbetween?
Re:If I SSH to everything, do I still need IPsec? (Score:3, Insightful)
False sense of security (Score:3, Informative)
There's only one way to be secure and that's to use strong, end-to-end encryption. Anything which encrypts only the wireless portion is borderline snake-oil - not only does it not protect your data but it actually makes the problem worse since people see all of the cryptogeekery and assume that it's secure - after all, they didn't understand any of what they had to do to use it! All of this hassle merely gets you an insecure network which is now hard to use, less reliable and slower.
I've taken the opposite approach [improbable.org] - my access points are wide-open (=easy to use) because all that gets you is access behind a firewall which allows HTTP to a squid proxy, SSH, HTTPS/IMAPS/POP3S/SMTPS, IM and DNS. (When IPSec is more widely available I plan to replace this with something which blocks almost all non-IPSec traffic. I'd be less surprised to find everything running over SSL a decade or more before near universal IPSec deployment)
This approach encourages better practices because it makes people aware that they're doing something risky - many people have no idea that anyone along the way could capture their password during one of the 5,000 times their email client sends it in cleartext during a given week. One of these days I'd like to hack together a script with ettercap's password collector which would periodically send someone's password to them in a warning and set the expired password flag on their account.
Developer despairs: What Killed FreeBSD (Score:1, Interesting)
[ed. note: in the following text, former FreeBSD developer Mike Smith gives his reasons for abandoning FreeBSD]
When I stood for election to the FreeBSD core team nearly two years ago, many of you will recall that it was after a long series of debates during which I maintained that too much organisation, too many rules and too much formality would be a bad thing for the project.
Today, as I read the latest discussions on the future of the FreeBSD project, I see the same problem; a few