<HTML dir=ltr><HEAD><TITLE>Re: [GLLUG] Meeting Thursday, Dec 6, 2007</TITLE> <META http-equiv=Content-Type content="text/html; charset=unicode"> <META content="MSHTML 6.00.6000.16544" name=GENERATOR></HEAD> <BODY> <DIV id=idOWAReplyText94447 dir=ltr> <DIV dir=ltr><FONT face=Arial color=#000000 size=2>A few random thoughts on the wireless security thing..</FONT></DIV> <DIV dir=ltr><FONT face=Arial color=#000000 size=2></FONT> </DIV> <DIV dir=ltr><FONT face=Arial color=#000000 size=2>If you add a layer of authentication, and use specific short-lived ID's for guests, you can do pretty well.  Alternately put wireless on a DMZ and have them go through a VPN termination device to get to anything of value.  A lot of times folks will use basic wireless security for guest Internet (most visitors just want to get their webmail) but then require VPN (maybe SSL clientless VPN) and authentication to get to internal resources.  Or maybe try out FreeNAC (<A href="http://freenac.net/">http://freenac.net/</A>) though I confess I've only used commercial NAC products..  Another idea is to put in a wireless IDS type system to detect tom-foolery.</FONT></DIV> <DIV dir=ltr><FONT face=Arial size=2></FONT> </DIV></DIV> <DIV id=idSignature77727 dir=ltr> <DIV><FONT face=Arial color=#000000 size=2><FONT face="Times New Roman"> <DIV><FONT size=2>Mark Lachniet<BR>Solutions Architect - Security<BR>Analysts International</FONT></DIV> <DIV><FONT size=2>3101 Technology Blvd. Suite A<BR>Lansing, MI 48910<BR>(517) 336-1004 (voice)<BR><A href="mailto:mlachniet@analysts.com">mailto:mlachniet@analysts.com</A><BR> </FONT> </DIV></FONT></FONT></DIV></DIV> <DIV dir=ltr><BR> <HR tabIndex=-1> <FONT face=Tahoma size=2><B>From:</B> linux-user-bounces@egr.msu.edu on behalf of Andy Lee<BR><B>Sent:</B> Tue 12/4/2007 1:09 PM<BR><B>To:</B> linux-user@egr.msu.edu<BR><B>Subject:</B> Re: [GLLUG] Meeting Thursday, Dec 6, 2007<BR></FONT><BR></DIV> <DIV> <P><FONT size=2>>>> "Steven Sayers" <sjsayers93@gmail.com> 12/4/2007 7:11 AM >>><BR>>From what I concurred at the meeting talking to Karl it was a lets-hack-wep<BR>over how do we prevent this, however I'm sure karl has a good side when it<BR>comes to routing.<BR><BR>What I'm looking for is a discussion of just how secure a secured network is, and what the truly best way to go is. To give a benchmark, the current setup is non-broadcast SSID, MAC access list, and WPA. My understanding is that all of these can be defeated without much difficulty, and I'm still hesitant to flip the switch to move this into a production environment, but users are getting to the point of expecting this convenience.<BR><BR><BR>_______________________________________________<BR>linux-user mailing list<BR>linux-user@egr.msu.edu<BR><A href="http://mailman.egr.msu.edu/mailman/listinfo/linux-user">http://mailman.egr.msu.edu/mailman/listinfo/linux-user</A><BR></FONT></P></DIV></BODY></HTML>