I was wondering whether it is possible to ban a PC from LAN or WLAN totally or not? I know that banning according to MAC address is useless, as it can be altered.
P.S: assume that no credentials are required to connect the LAN/WLAN.
6 Answers
It's true that clients can alter their mac addresses, thus rendering any sort of filtering on that more or less useless.
On wired LANs, with the right sort of switches, you can control with MACs are allowed to connect from which ports, and limit the number of MACs that are allowed on a port. This can help, if the clients are always attached and turned on, but someone with the knowledge of what the MAC is on a particular machine could unplug the legit box and change their MAC address to match. Some switches can be configured to block a port if the link goes down, and require administrative intervention, but that doesn't scale well at all.
So, this is exactly the sort of thing that the 802.1x protocol was intended to help with. In brief, it requires that a client present credentials that are authenticated before network access is granted. The wikipedia article on it has a good description of how it works.
As far as I know, without some sort of access credentials, what you're trying to accomplish can't be done. 802.1x at least puts the authentication at the network level, rather than allowing access, and then blocking use of network resources by some other means.
answered Mar 23, 2011 at 21:14
-
might there be other means apart from MAC addr. to fingerprint a client machine?– sterzMar 23, 2011 at 21:59
-
2@sterz - not reliably, as far as I know. Anything above the link layer can be changed pretty easily, or may not even be set when the box connects (think a diskless workstation booting off of the network using bootp/dhcp). MAC is about the only think you can know "for sure" and even that can be changed. Mar 23, 2011 at 22:03
-
These limitations are what NAC solves and why 802.1x is, at best a NAC component– Jim BMar 24, 2011 at 2:44
-
-
That's like asking "aside from the tires, is there anything else you need to make sure your car will run?" The link I provided is an overview of what NAC does and what it requires (which is what I believe he is lookng for). As an example if you implement NAC using Cisco secure services client, you ARE using 802.1x as well as some improvements to prevent DOS vulnerabilities. To get 802.1x close to useful in a public accessable environment (as a NAC solution) you need to also implement IPSEC.– Jim BMar 24, 2011 at 20:50
You are looking for something called Network Access Control. There are all sorts of ways to implement NAC from various vendors. Additionaly in a windows only/mostly environment you can implement domain and server isolation (not that you can't accomplish a similar thing in a *nix environment but it's almost more pain than it's worth). With domain and server isolation while you aren't preventing any access to the network per se, you are preventing access to any of the servers and workstations on it, and if it's a machine you own you can control what servers and workstations that particular server/workstation can talk to.
If physical access to a network (via hardwire or airwaves) is achievable then always assume that the machine can participate at the transport level. What it can do beyond that is what you really should be concerned with and where you should be focusing security efforts.
answered Mar 23, 2011 at 21:03
Depending on the size of your network and type of layer 2 hardware you have, you can permit only the mac addresses that you want.
-
-
5@squillman - blacklisting is useless. Whitelisting macs of known machines might work: even if he hijacks a white-listed mac it would likely end up causing a conflict that ends up with neither machine working. Mar 23, 2011 at 21:06
-
3@Joel Whitelisting is better, true, but it's not a total ban from the network either. Trivial if the true whitelisted machine is powered off or otherwise not present on the network. Mar 23, 2011 at 21:09
How is the PC connecting? wireless? wired? Is that a PC someone brings to work like an employee using his own laptop. In this case you may take legal or internal security measures (mainly if the employee changes his MAC address to connect and hack a whitelist MAC address restriction).
If it's an outside person invading the network like a neighboor using your wifi, I think the best is to never let a wifi connection non password protected and encrypted.
If it is a VPN access... if you use a vpn with certificates like openvpn and if he has one you can ban it using the crl option.
The solutions can be different for each case and not only network or server related.
Now, if it's your CEO using his own laptop full of viruses... good luck ;) but you can offer to clean the thing maybe :)
-
it is more of a university scenario, where many students connect/disconnect continuously to different ports in LAN. as for no credential required WLAN, it is next to impossible i guess.– sterzMar 23, 2011 at 21:56
-
2I would guess, then, that the client is engaging in some sort of behavior that you want to stop. What do you know about the client's behavior? I'm thinking of things like "goes to various websites" or "ping floods some other machine" and the like. That sort of data might give you some sort of hook to at least find the client, even if you can't block it. Mar 23, 2011 at 22:07
-
Yes... I agree, not an easy situation. Maybe you could try to work on the reason you want to ban the PC like filtering internet content or blocking the resources it is using if not already done.– laurentMar 23, 2011 at 22:32
I forget where I read this from before - but if you have a DHCP server you can basically allow it on your network as a reservation for that specific machine, however give it 0.0.0.0 for DNS etc. That is the only way I found how to ban a machine from connection to my wireless network before.
-
3This ain't doin' it. DHCP hands out reservations based on MAC which, as the OP stated, is useless. Mar 23, 2011 at 21:01