Hot answers tagged wpa
18
My understanding of wireless security protocol strength, starting with most secure:
WPA2-AES
WPA2-TKIP
WPA
WEP
Search for WEP cracking and you'll find plenty of tutorials on cracking it in 10 minutes on common PCs. WPA is significantly more difficult to crack, but each version has its weak points. WPA2-AES is considered top of the line last I heard and ...
14
No.
WEP is trivial to break. MAC addresses aren't secure. They can be trivially spoofed. Take a look at The six dumbest ways to secure a wireless LAN:
MAC filtering: This is like handing a security guard a pad of
paper with a list of names. Then when
someone comes up to the door and wants
entry, the security guard looks at the
person's name tag ...
9
WPA is "pretty secure", while WPA2 is "very secure". There are partial attacks against WPA in the wild already, and more complete attacks are expected to appear over time. WPA2 (using AES rather than TKIP) has no known vulnerabilities yet.
As you said, the decision as to which you choose is mostly up to the value of your data, but my personal suggestion is ...
7
I guess I will update this question with some new information. A new attack can crack WPA with TKIP in a minute. An article regarding this is now on Network World.
It looks like the only secure option is to use WPA2 (WPA with AES).
Update: There is a new report of a vulnerability in WPA2 - http://www.airtightnetworks.com/WPA2-Hole196
To summarize, a ...
5
While there are no known cryptographic attacks against AES,TKIP (which can be used with both WPA and WPA2) has been shown to be vulnerable to some classes of attack. By FAR the primary attack vector for both WPA and WPA2 is the pre-shared key. Attacking a WPA or WPA2 secured network with a weak pre-shared key (aka password) is a very simple matter with ...
5
If you preinstall a shared key on 300+ machines in the hands of users, don't expect it to remain a secret for long.
Even if you don't want to do per-user authentication, you'd be better off going with WPA2-Enterprise (WPA2 with 802.1X authentication) and using EAP-TLS and per-machine certificates. That way, even if someone does manage to export/extract the ...
4
What you're talking about is something we do in several Customer sites (including a school District who appears to be doing exactly what you want).
This isn't a click-for-click guide, but if you don't mind playing around with the tools a bit I think you'll find they're fairly self-explanatory.
The IAS server will need a certificate installed as a ...
4
The short answer is, no, with only the pre-shared key (PSK) you cannot decrypt other user's traffic, but, it is fairly simple to collect the additional information needed. Stations don't directly use the PSK to encrypt packets. Instead, they use the PSK to generate a Pairwise Master Key (PMK) which in turn generates the Pairwise Transient Key (PTK) used for ...
3
WEP is easy to crack (there are videos of it being done in 10 mins, etc) and MAC addresses can be spoofed. However, what are you 'securing'? If this is a business then NO, this is definitely not enough security. If it's your home internet, and your 10 neighbors all leave their wireless open, and you have a software firewall on your computer, then maybe this ...
3
Vista uses the same system as XP SP2, called Windows Connect Now (WCN). The file itself is just an XML file on the USB drive named Wsetting.WFC, usually created with the Wireless Networking Setup Wizard.
It seems to be fairly well known, however I've never run across it being used with Linux or Mac systems...
3
Windows 7 supports a Soft AP mode that can be used to create a more secure sharing environment as it supports WPA2\AES. This works with most WLAN Nics but there may be issues with some older kit.
The steps you need to follow are:
1: Open up an administrator command prompt.
2: Create the SoftAP config:
netsh wlan set hostednetwork mode=allow ...
3
Well, I don't know how to do this with NetworkManager. However, I would like to point you out to my favorite network client - Wicd. Install it, there is CentOS 6 RPM available. Then start its wicd-ncurses interface and you can set it up once and forget about it. When you are done, disable your NetworkManager service and enable the wicd one. No need to touch ...
2
WPA Pre-shared key (PSK) mode, defined in IEEE 802.11i-2004, uses PBKDF2 as described in PKCS #5. While PBKDF2 has no minimum length, the IEEE standard states in H.4 Suggested pass-phrase-to-PSK mapping (which includes a discussion of security considerations):
A pass-phrase is a sequence of between
8 and 63 ASCII-encoded characters. The
limit of 63 ...
2
As long as all of your wireless client devices (phones, laptops, PDAs, etc.) support it, use WPA2 with AES encryption instead of WEP.
If you have users with old driver software, operating systems, and wireless cards, you may be limited in what you can do. Most devices that originally supported only WEP can be upgraded via software to support WPA with TKIP, ...
2
I second womble's assertion that wpa_supplicant is the wrong place to do this. You want to set something up in the /etc/network/ subtree, perhaps as womble suggests by increasing the metric of the wifi route, or perhaps by some other means involving a custom script in /etc/network/if-up.d/ that would take the wifi interface down if the ethernet interface ...
2
I'll try to answer the OpenSSL question here: the short answer is to use FreeRADIUS 2.1.8 or above, which includes OpenSSL. It is available in Ubuntu Lucid and Debian Lenny backports (and will probably end up in Ubuntu Karmic backports too).
Here is the long answer:
Unfortunately, the OpenSSL license used to be (somewhat) incompatible with the FreeRADIUS ...
2
I'll try to answer the LDAP question here.
Here's the short answer: make sure the ldap module is removed from the authenticate section, and make sure the mschap module is present in both the authorize and the authenticate section. And just ignore the 'No "known good" password'.
And now here's the (very) long answer.
How does the ldap module work?
When ...
1
According to the bug report, a simple rebuild of FreeRADIUS should fix the OpenSSH support issue. It only needs to be done once.
I'm not sure what ease of administration has to do with setup. Often, the more involved and detailed the setup, the easier it is to administer, because the setup covered all the bases. Do you mean the configuration has to be ...
1
Directly, no.
In terms of ARP floods or man-in-the-middle attacks (in ARP or at a higher level), these will be prevented by some access points that can be set to disallow direct traffic between wireless clients. ie all clients can see networks on the uplink side of the AP, but traffic addressed from one wireless client to another will be dropped.
1
Thanks to gharper who gave the information that led me to this:
Windows Connect Now, USB Flash Drive (WCN-UFD) is the name Microsoft uses for automatic wireless configuration as part of their Windows Rally suite of wireless configuration technologies.
Windows Connect Now-UFD for Windows XP Specification
Windows Connect Now-UFD and Windows Vista ...
1
Are you sure that wpa_supplicant is what you want to be fiddling with to do this? It's really just for authenticating WPA connections, not doing link status detection and the rest of it.
Personally, I wouldn't even bother disabling the wifi, I'd just have an up action on the wifi interface that gave it's route a higher metric, so that if the wired ...
1
No WEP is not adequate security. Mac addresses are sent as part of the wireless packet and therefore easy to intercept and spoof.
If you need to use WEP you need to install a 3 NAT router setup as shown below.
NAT router 1 (NR1) is connected to the internet on the WAN port.
NAT router 2 (NR2) WAN port is connected to NR1 LAN port.
NAT router 3 (NR3) WAN ...
1
That's a very loaded question. DD-WRT is very poorly supported by their own devs... and is NOT supported by any of the manufactures whose devices it's running on.
That being said... you'll very quickly find that a lot of the wireless functionality is dependent on developers who reverse-engineered 3rd party firmwares in order to produce a mostly-working ...
1
Assuming you have an Active Directory domain, your best bet would be to roll out an SSID with the settings you're looking for to the clients using Group Policy. (You can use netsh to do this via script, but if you've got an AD domain Group Policy is much easier...)
1
(Apologies if this is me being dense)
If you did find a way to deploy the key, surely you would break wireless connectivity for your users since you find yourself in a catch-22 situation.
Example
Old WPA key is abc (which the laptops already have stored). Your script deploys the new key 123. Wireless is now broken because the laptop now thinks the key is ...
Only top voted, non community-wiki answers of a minimum length are eligible
