|
i would like to give you an idea how i implemented
a secure authentication with wiress lan and wired lan but i cannot give you the
full details due to some restriction where i work...
i have a server with two nics.. one nic is facing
the internet with a public ip and the other nic is facing the private lan either
wired and wireless lan with *no* ip address assigned to it... therefore all
workstations trying to put a gateway ip address on their network configuration
cant still go out of the network because there is no ip address facing
them...
all access points are connected to a switch where
the ip less nic is also connected... the configuration of all access points are
simply broadcast the service set identifier or SSID without encryption.. purpose
for that is to have a link connectivity between the wireless clients and ip
less nic...
in order for all workstations either wired or
wireless to authenticate and access the outside world... they must use a ppp
dialer and enable mschap version 2 for secure and encrypted authentication... of
course they must use a good lengthy password to prevent from dictionary based
attack... i prefer to use higher layer encryption (eg. mschapv2) than layer 2
encryption used by the wireless vendors to prevent from incompatibilities from
other vendor's layer 2 encryption scheme....
the server is the one communicating with the remote
radius server for its authentication, authorization and accounting (AAA)... if
there is radius therefore you can do a prepaid service... the radius server is
separad from this server to provide another security level.. this server acts
only as remote access point (RAS)...
with this kind of setup... this prepaid card is
extended to not only from a regular dial-up prepaid card but also you can use
this from wired lan (mostly school's laboratory) and wireless hotspots...
therefore its a unified prepaid card...
i prefer to use this kind of setup rather than the
wireless web based authentication because i can easily sabotage any wirelss web
based authentication thru denial of service and man in the
middle attack thru layer 2 attack technique...
fooler.
----- Original Message -----
|
_________________________________________________ Philippine Linux Users' Group (PLUG) Mailing List [email protected] (#PLUG @ irc.free.net.ph) Read the Guidelines: http://linux.org.ph/lists Searchable Archives: http://archives.free.net.ph
