Slashdot Mirror
Web-Based DHCP Server Frontends?
Strog writes "We are securing our administrative network and one thing we decided to implement is allowing only known MAC addresses get an address from the DHCP server. The techs aren't very Unix-centric so we would prefer to keep them out of the server directly. A web-based admin tool is what we are looking for. I've used webmin for a while but it likes to give each host a nice little icon which wouldn't be so good once we get all ~750 machines entered. Dixie looks good too but leaves a few too many options for techs to look at. I'm in the process of hacking webmin into what I need but wondered if anyone out there has some good options to offer. What we really need is boxes for hostname, MAC address and apply button and a list of current entries and a delete button." This was recently asked on a mailing list, but so far, no answers have been given. Might someone here have experience with such software that they would like to share?
I find it excellent for adding lots of static hosts to DHCP.
ie ya don't want the techies doing it, just admin staff doing the details from a change form.
Most sites I've seen roll their own database for this sort of thing. You get then change management form (signed by the appropriate person) and a non-techie puts in the changes to a little app. The app updates the database and the database updates the DNS/DHCP settings....
Not very helpful, but there you go..
Sounds like a job for a good Perl script using CGI
In Soviet Russia, DHCP serves YOU!
I hope this helps you. If you click on the module config button in webmin, the second option from the top is labled;
Display subnets and hosts as _ Icons _ List
If you set this option to list, webmin wil not display an icon for each host. Further more, if you have a large number of DHCP clients, you may also want to use groups to help organize some of those clients into smaller lists.
::i visited slashdot and all i got was this lousy sig::
I'm assuming this is for some kind of security measure. Have you implimented something like proxy arp so that people can't just listen for arp requests and have a list of valid MACs for use at a later time? It is rather easy to change your MAC on most network cards, especially the popular Realtek 8139s
"What we really need is boxes for hostname, MAC address and apply button and a list of current entries and a delete button... "
;-) .With this thing I'm doing exactly the stuff at home (on a lesser scale of course), which you intend to do at your work....
This just sounds like the dhcp manager (/usr/sadm/admin/bin/dhcpmgr) which ships with Solaris 8/9...but it's a java application and not web based (well ssh X tunneling, exporting Display and xhost + is sort of web based isn't it??
if all that's preventing webmin from serving the purpose you need is an icon for each client, then for pete's sake, modify the source or replace the icon with a 1 pixel jpg or something. that's the whole point of open-source right?
NameSurfer is a web interface for DNS and DHCP.
It's commercial and not exactly cheap, though.
Have we gotten to the stage where regular sysadmins can't code these days?
If you can't do it, go to a secondary school and get someone to write the program for you.
I see two major problems with your authentication scheme.
First off, you have a catch-22 in the assignment system. You don't want to give a DHCP address to a system without its being authenticated, but your system won't be able to hit the net and get to the administrative machine to BE authenticated. Aside from manually typing in the MAC address on the main server, which I think someone would find annoying. I suppose you could DHCP unrecognized machines to an intranet address that's null-routed except for that admin machine, which would ask for a password, sniff the MAC address, and then add it to the DHCP system.
But there's an even larger flaw with your scheme, which is that there's nothing keeping users from turning off DHCP and choosing an unassigned IP, letting anyone with a little know-how hijack your connection without going through your authentication and possibly cause conflicts on your network. DHCP is MEANT to be easy; add complications and you've ruined the whole point of having it.
If you want to have a secure network, you're going to have to use a whole different system, such as using a protocol like PPPoE (unencrypted) or PPTP (encrypted) to log in to a central station and then have that machine handle routing, etc. From an ease-of-use standpoint, this would be a lot simpler, both for end users and your inexpert managers; they add a name and password to the list, and each user needs his name and password to log in. If someone changes hardware, no problem.
NetReg is an automated system that requires an unknown DHCP client to register their hardware before gaining full network access. Through a simple web interface, the client is prompted for their user identification. Powerful scripts then retrieve the client's network fingerprint and store it along with the user's information in a database. The database provides administrators with real-time information for troubleshooting and auditing their networks. The entire system was developed utilizing unmodified, open-source servers and in-house developed CGI programs.
http://www.netreg.org
I've found that it's a bit slow and unstable though. When you get a lot of domains and hosts it's a bit slow. I have 40 remote sites each with many hundres of machines (some with over a thousand) and displaying that many hosts, it gets a bit pokey, even on the console, and scrolling is slow too. I also got a bad taste in my mouth when one of the domain files got messed up a bit (server updated the lease time and it messed something up) and if I clicked on it it would hang the app, I had to delete the file and recreate it. Then Sun patched everything and changed the file format and broke it for me. I switched to ISC's dhcp server. No front end for me though, just vi, but I don't have to edit the file ever now that it's set up. I really liked the sun app though, it got my machines up and running very quickly. I haven't used the newer versions (I stopped using it about 8 months ago) though, and not in Sol9.
-- Chris Martin, System Administrator
DHCP "security" by only giving addresses to known mac addresses doesn't buy you anything. Anyone can still plug in and grab an address statically anyways. The only way to enforce this would be a manual static arp table in every machine (including the router) and disable true arp, and at that point you may as well stop using DHCP too. Even then you still have to take other measures to make it really work.
Just run plain old wide-open DHCP, and implement network policy where it belongs - at the L3 devices like firewalls, L3 switches, routers - and in user AAA, be it windows domain logon, LDAP, or what have you.
11*43+456^2
Our local network only allows authorised MAC addresses to connect, but using the switches rather than a DHCP server. The switches we use only allow x changes before locking out the port, so for most "admin" machines x is set to 1, so only the machine connected at the time the switch is setup/reset is allowed to connect.
There are exceptions to this for development machines etc. so we can swap boxes around etc.
I'm sorry, but either you copied that stuff from their ads, or you get some benefit from people using that program. Let's look at a few of the reasons I think this is the case.
#1: "a simple web interface"
Why not just 'a web interface' ?? Is it really *that* simple? I use web interfaces fairly often, and I don't know anyone that describes them as 'simple' even when they are amazingly simple.
#2:"Powerful scripts"
What is so powerful about them? How many Watts or power do these scripts have? Are they a lot better than weak scripts?
#3:"network fingerprint"
No such thing. If you can send data over the net once, you can replicate it. A fingerprint is unique. This probably is referring to the MAC layer address, which is easily changed/copied. 'network fingerprint' sounds like market-speak.
#4: (no quote, just the 'database' stuff)
If it's stored in a RDBMS, we all know what we can do with it and what we can use the information for. It almost sounds like you are trying to get us to buy a database system here.
All in all, your whole post could be more concise, and less 'buzz'-ridden with a little effort.
P.S. None of my comments have anything to do with the product itself, which may or may not be exactly what the Ask Slashdot question was looking for.
wow, you sure smacked me down. Yes, the post was pasted from their website. No, I don't get any rewards from getting people to use their product. Yes, you need to get a life.
You might as well static the IP addresses and shut the DHCP server down.
-- Argel
This doesn't accomplish much, as a user can just manually assign an ip. Why not turn on port security on your switches and only allow certain MAC addresses on certain ports. Obviously, I don't know what kind of switches you are using, but since most of the world seems to be using Cisco, that's probably what you have and those will do it just fine.
Need Free Juniper/NetScreen Support? JuniperForum