[brlug-general] Wireless security (Not specifically Linux-related)

2007-04-03 Thread Fernando Vilas
El Tuesday 03 April 2007 14:49:21 -ray escribi?: > On Tue, 3 Apr 2007, Joe Fruchey wrote: > > My other RADIUS question: We can have one server to authenticate > > everybody, right? Even though they're on different subnets? > > Yes, however most radius authentication implementations i've seen are >

[brlug-general] Wireless security (Not specifically Linux-related)

2007-04-03 Thread -ray
Not a variable, "802.1X" is the name. Wikipedia defines it as: "IEEE 802.1X is an IEEE standard for port-based Network Access Control;" I guess if we get technical, it should be a capital X. You can use it on wired and wireless networks. The other 802.1 standard i'm familiar with is 802.1Q -

[brlug-general] Wireless security (Not specifically Linux-related)

2007-04-03 Thread Joe Fruchey
Stupid question: Is the 'x' in 802.1x a placeholder/variable, or is it analogous to the letters in 802.11a/b/g/n? On 4/3/07, -ray wrote: > On Tue, 3 Apr 2007, Joe Fruchey wrote: > > > MAC-based? How is that any better than just filtering the MAC address > > at the router? Anybody could just spoof

[brlug-general] Wireless security (Not specifically Linux-related)

2007-04-03 Thread -ray
On Tue, 3 Apr 2007, Joe Fruchey wrote: > MAC-based? How is that any better than just filtering the MAC address > at the router? Anybody could just spoof their MAC address and get in. It's not, but it does give you another layer of defense. And if you're using WPA, just getting the list of "appr

[brlug-general] Wireless security (Not specifically Linux-related)

2007-04-03 Thread Joe Fruchey
MAC-based? How is that any better than just filtering the MAC address at the router? Anybody could just spoof their MAC address and get in. On 4/3/07, -ray wrote: > On Tue, 3 Apr 2007, Joe Fruchey wrote: > > > My other RADIUS question: We can have one server to authenticate > > everybody, right?

[brlug-general] Wireless security (Not specifically Linux-related)

2007-04-03 Thread -ray
On Tue, 3 Apr 2007, Joe Fruchey wrote: > My other RADIUS question: We can have one server to authenticate > everybody, right? Even though they're on different subnets? Yes, however most radius authentication implementations i've seen are mac-based. Users mac addresses stored in radius where you

[brlug-general] Wireless security (Not specifically Linux-related)

2007-04-03 Thread Tim Fournet
As long as your devices can communicate with your RADIUS server somehow, then yes Joe Fruchey wrote: > Good tips, thanks. > > My other RADIUS question: We can have one server to authenticate > everybody, right? Even though they're on different subnets? > > On 4/3/07, Tim Fournet wrote: > >>

[brlug-general] Wireless security (Not specifically Linux-related)

2007-04-03 Thread Joe Fruchey
Good tips, thanks. My other RADIUS question: We can have one server to authenticate everybody, right? Even though they're on different subnets? On 4/3/07, Tim Fournet wrote: > The problem with a single key for everyone is that once it's known to > someone you don't want to know it (disgruntled e

[brlug-general] Wireless security (Not specifically Linux-related)

2007-04-03 Thread Tim Fournet
The problem with a single key for everyone is that once it's known to someone you don't want to know it (disgruntled ex-employee, for example) you have to change it for everyone. This results in a lot of angry calls. One means of mitigating brute-force password attacks for your 4 number passwor

[brlug-general] Wireless security (Not specifically Linux-related)

2007-04-03 Thread Joe Fruchey
OK guys, let me pick your brains... There is interest in setting up Wi-Fi in our system. Since I've been working with it for a while now at home, at others' homes, etc., I get to be "Wi-Fi Guy." Why I take on all these responsibilities for such a meager salary is beyond me. But I digress... I've