Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have configured a DHCP server on Ubuntu and a fixed IP address for a specific mac, like this:

host client1 {
  hardware ethernet E0:69:95:73:2C:66;
  fixed-address 192.168.0.10;
}

If anyone changes his/her mac to E0:69:95:73:2C:66, they get the 192.168.0.10 IP and now two PCs use the Internet simultaneously on the same IP. How can I protect against this unauthorized access?

share|improve this question

3 Answers 3

up vote 4 down vote accepted

If your switches support it, you can use LAN authentication with 802.1X.

share|improve this answer
    
thanks SvenW, I use a simple switch, are there no alternative ways? –  Jerry Mar 21 '12 at 11:40
    
You could set up a captive portal or a proxy requiring authentication before allowing internet (http) access. This won't restrict the IP assignment though, only limit the use the "attacker" has from his stolen IP address. –  Sven Mar 21 '12 at 11:43
2  
@SvenW: A captive portal won't help if the attacker takes the same MAC address and IP, as the traffic will already have been authorised by the legitimate user. You'd need a fully-authenticating proxy, which rules out and sort of transparent option, and since the attacker is on the LAN, would need to be fully-encrypted. At some point, you just say "stuff it" and either buy a decent switch, or mandate a VPN for everything. –  womble Mar 21 '12 at 11:52

You need a switch that either has 802.1x as was mentioned or the one that lets you assign certain MAC to port. Also you can use VPN to minimize the consequences of spoofing, both users will loose connection though illegitimate user won't be able to access the resources, trafic won't be authenticated automatically.

share|improve this answer

It's not possible. They may both be using the same MAC address (by way of MAC spoofing). But they're not going to have simultaneous internet connectivity. First off, there would be an ip address conflict. Second, the switch wouldn't forward traffic properly as the MAC address would be registered on multiple ports. Third, even if the switch did work properly, traffic flow would be sketchy at best as both computers would answer for ARP requests for the MAC address in question.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.