Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to make an app that scans the network and gets the names of every PC on the network. If the computer name isn't in the trusted computers list it should disable Internet on the untrusted computer. How can I do this without needing to add software on the untrusted PC?

share|improve this question
    
How are you disabling Internet? –  Joseph Jun 24 '09 at 12:47
2  
I think that you should go the other way. Instead of using a black list, you should use a white list with the computers that can connect to the Internet. –  Cristian Ciupitu Jun 24 '09 at 16:06
    
As you wish to create an app to do this I think you should ask this on stackoverflow. –  John Gardeniers Jul 15 '09 at 2:47

7 Answers 7

I found a program that does what you are looking to do. It's called NIC Padlock.

I've played around with it and it works as advertised. It also has some other nice features:

  • Remotely disable all network adapters
  • Choose to display a message to the user when NIC’s are disabled
  • Remotely enable all network adapters
  • Re-enable the adapters that were disabled after a configurable time period
  • Retrieve a remote computer’s list of auto-run programs

enter image description here

share|improve this answer

What you need to do is block the computer at the point at which it reaches the internet. To get out to the internet, the computer is most likely going through some kind of router/switch/firewall. You'll have to somehow tell your router/switch/firewall to block access from that computer, most likely by blocking its MAC address. You'd probably be better off setting up a hardware firewall between your network and the internet, and telling it to allow only those computers (again by MAC address) which you have specifically decided should be allowed to access the internet. In this case, it's probably much easier to keep track of a white list of the computers that are allowed on the network, than to scan the network trying to get rid of rogue computers.

Also it should be noted that one can change their MAC address, but it's probably the best way that you can distinguish between computers on the network. Computer names, and anything else sent over the network can be changed too.

share|improve this answer

If we're talking Windows and you don't have the option of setting an ACL (which may get very long) or a web-filtering solution in place, one thing you can do is put into place an IPSEC policy, provided you have admin rights on said systems. The IPSEC policy could block any traffic outbound to anything but your private network ranges. This will allow you to still manage the computer on your network but keep it from talking to the Internet. And IPSEC policies aren't something a lot of users (and quite a few admins) are familiar with, meaning even if they have admin rights, they may not know how to undo what you've done. You can do this through the netsh command.

If you don't have admin access, then you're going to need to look at doing the block at the network.

share|improve this answer

I suggest limiting access not only for the PC's but for the users as well. You will need a proxy server like Squid. Make sure users cannot access the web directly, only through the proxy.

You then can implement password protection, so that only authenticated users can access the Internet via Squid. It is possible to make Squid check the passwords against Active Directory (or another LDAP server). Controlling user access to Internet is easy in this case, you just allow access for particular security group. Adding a user to this group enables Internet access for that user.

share|improve this answer

You have several options. However, you can't simply tell the "untrusted pc" to turn off its internet -- This would be a major security breach.

There are several tactics for taking a computer offline. However, they all would involve manipulating the network itself. The proper way to control access to a network is with something like 802.1x. This is probably the only way to stop determined attackers.

MAC address filtering is somewhat effective against non-determined users.

If you're just looking to cause trouble on a network you don't have control over, there are several techniques. ARP Poisoning could potentially be effective, as well as DHCP or DNS interception. I'm not promoting you causing trouble though, so you'll have to figure this out yourself.

share|improve this answer

I think you are going about this the wrong way. This kind of decision making belongs on your gateway to the Internets. Your router should be making this decision, the whole discovery mechanism is flawed on many levels.

What if you have no permissions to access the machine? You leave it with access to the internet.

If you want to do this kind of stuff reliably and securely I would look at implementing something like Cisco NAC

share|improve this answer

If you control the router/proxy you could implement a name or MAC address based blacklist/whitelist there. "Disabling the internet" remotely without any hook into the system seems sketchy at best. Any more information on your infrastructure and situation?

share|improve this answer
    
Yes I Control The Router But im Not Always Around To See Who is connected to my network! –  c_workman29729 Jun 24 '09 at 2:44
1  
+1 MAC address recognition would definitely work for this. Once you enable it on your router only trusted machines can connect. –  cop1152 Jun 24 '09 at 2:53
2  
A list of MAC addresses is good, but we should keep in mind that MACs can be spoofed (in both Windows and Linux). –  Cristian Ciupitu Jun 24 '09 at 16:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.