freebsd security - Apr 2004 - Controlling access at the Ethernet level

>    What would you recommand ? Are there any other elegant solutions ?
> 
How about using 802.1Q vlan's and dedicate a vlan to each port.
If more than 4000 users then add more gateways.

Just be sure to go for switches that allow you to deny incoming already 
tagged packets on the user side as some switches passes already tagged packets.

For a wireless environment i would suggest PPPoE and VLANs (separating them).
>    I also heard about 802.1x technology and seems to be an 
> interesting and professional alternative; I just don't know 
> how well supported is on the server side, namely FreeBSD.
> 
802.1x is fairly new and not very well supported yet, expect bugs.

_// Sten Daniel S?rsdal

> -----Original Message-----
> From: Adrian Penisoara [mailto:ady@freebsd.ady.ro] 
> Sent: 04 April 2004 19:23
> To: freebsd-security@freebsd.org
> Cc: freebsd-isp@freebsd.org
> Subject: Q: Controlling access at the Ethernet level
> 
> 
>     We are facing service theft through impersonation, either 
> solely IP 
> or both IP and Ethernet MAC address. Securing IP access was solved 
> using a static ARP scheme (we used "staticarp" for the 
> internal gateway 
> interface and tied to it a fixed list of IP/MAC tuples), but some of 
> the clients learnt how to change both the IP and the MAC.
...

This sounds like a university residential halls network, am I right? 

For what it's worth, the university I attend has tried both DHCP by mac
address, static arp and so on. Eventually now they have given up and the
cost of the network connection is simply included in the rent for the room.
That way they do not have to worry about unauthorised access.

Adrian,

    ipfw2 enables you to control access from ether_demux() and
ether_output_frame() [ipfw(8)]. Some ipfw2 options are dst-mac src-mac mac-type.

Regards,
Hernan

----- Original Message ----- 
From: "Adrian Penisoara" <ady@freebsd.ady.ro>
To: <freebsd-security@freebsd.org>
Cc: <freebsd-isp@freebsd.org>
Sent: Sunday, April 04, 2004 3:22 PM
Subject: Q: Controlling access at the Ethernet level

> Hi,
> 
>     I am searching for a solution that will enable me to control the 
> access of clients to a Ethernet network that spans over about an entire 
> quorter; most of the connected stations are running MS Windows.
> 
>     We are facing service theft through impersonation, either solely IP 
> or both IP and Ethernet MAC address. Securing IP access was solved 
> using a static ARP scheme (we used "staticarp" for the internal
gateway
> interface and tied to it a fixed list of IP/MAC tuples), but some of 
> the clients learnt how to change both the IP and the MAC.
> 
>    We have thought about using static MAC entries per port on managed 
> switches installed at the client endpoints, but that would require a 
> overwhelming budget. We are also thinking about L2TP and PPPoE, but I 
> am uncertain about compatibility.
> 
>    What would you recommand ? Are there any other elegant solutions ?
> 
>    I also heard about 802.1x technology and seems to be an interesting 
> and professional alternative; I just don't know how well supported is 
> on the server side, namely FreeBSD.
> 
>   Thank you.
> 
> --
> Ady (@freebsd.ady.ro)
> 
> _______________________________________________
> freebsd-isp@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-isp
> To unsubscribe, send any mail to
"freebsd-isp-unsubscribe@freebsd.org"
>