Is Rendezvous Sharing More Than You'd Like?

Gropo asks: "I just got an email from my father who has just recently upgraded from OS 9 to Mac OS X on his PowerMac. He's connected to the 'net via Adelphia Cable and shares his TCP connection with my Mother's iMac via Software Base Station. He got a call from his neighbor (also running Mac OS X) who noticed 'My Father's Computer' show up on his network. My first thought was: 'He's picking up your AirPort signal' - alas the neighbor has no AirPort card. The neighbor *does* however also have an Adelphia cable modem. I asked him to scan for available afp:// servers and sure enough, a foreign machine showed up. What's the easiest way (if at all possible) to enable auto-detection for the local wireless LAN (useful for file and printer sharing within the household) yet remain invisible to other people also behind the cable companies' local DHCP box?"

Comments

Passwords

[andcarne]

If you really don't want to use a firewall, you can always just give computer a meaningless name, and password protect all users on it.

Re:Passwords

[Llywelyn]

You have no choice under MacOS X but to password protect all users and all connection protocols are turned off by default. You would have to specifically enable sharing and remote login and even then the password is still there.

Services

[rbbs]

In this particular case the problem is appletalk routing. Since you are creating a local subnet using the PowerMac as the router, you probably have appletalk activated on the wrong network interface. It needs to be on the Airport ethernet only and not on the wired connection. It can only be on one at a time so just switch it. - incidentally this won't change your ability to share info with the airported computer. You could also try blocking access to the appletalk port (548 IIRC) on your built in firewall. Alternatively, get a proper hardware firewall and use that to mask your subnet. Ultimately you need to be careful what services you enable on which interface as one of them is visible to the world and one isn't.

Re:Services

[Anonymous Coward]

Afaik, port 548 is what AppleShare uses, not AppleTalk. AppleShare can run over TCP/IP or AppleTalk; but AppleTalk doesn't run on a TCP port because it isn't a TCP service (it's a different transport protocol itself). So if this is an appletalk issue, port 548 has nothing to do with it. I thought it was a rendezvous issue myself; i sometimes forget people still might use appletalk though.

Buy him a router

[sg3000]

Rendezvous is designed to work on a subnet, and likely your dad and his neighbor are on the same subnet, thus the inintended sharing.

Since he has a broadband connection, I'd recommend that you buy him a router, so that all of his Rendezvous packets stay in his house. No muss, no fuss. And routers can be as cheap as $30 -- I just bought a cool NetGear router to replace my LinkSys and it cost about $50. With the router, he can have multiple computers on his network, keep his LAN separate from the WAN, and have some basic security protection above and beyond the built-in firewall in Mac OS X.

Or you can convince him to buy a new AirPort base station that has a built-in router so he can solve his problem as well as allow you to surf the 'Net on your PowerBook while you're over visiting.

To me, it's a short threshold to come up with an excuse to buy sexy new Apple hardware.

Re:Not Rendezvous

[pldms]

PS I don't think this has anything to do with Rendezvous.

Agreed. Rendezvous broadcasts must never be routed, but AppleTalk packets can. Maybe this can be set on the base station?

Any cable modem user would have the same problem

[superposed]

Cable modems are notorious for creating security openings. In many cases, you and all the other computers in your neighborhood are bridged onto a single network. So it's the same as if you were on one big LAN.

This issue affects your dad's computer whether or not your mom's computer is connected via it (the in-house network is just an extra wrinkle).

So you need to do a careful job of insulating your dad's computer from the outside network. Start by turning off all unnecessary services that could be carried on the Ethernet adapter. (i.e., make sure these services are not allowed to communicate over the Ethernet adapter. It's fine to let them run over the Airport adapter if your software base station is configured correctly, but you will have to discriminate between the two). OS X does a pretty good job of not loading too many services in the default configuration. But you can fine tune what's going on using OS X's internal firewall. You should also turn off any file or printer sharing on the Ethernet adapter (using the Sharing preference panel). I'm not sure whether you can turn off Rendezvous on one particular adapter, but if you can, that would be a good idea too.

Another way to restrict data from being sent over the Ethernet connection out to your neighbors, would be to install firewall or routing hardware between your Dad's computer and the cable modem. Then you won't really have to worry about reconfiguring your dad's computer at all. Anything that is labeled for "cable modem sharing" or "DSL connection sharing" should work fine for you. However, if you're going to get a connection sharing box, you might as well get one that can provide a connection directly to both your dad's computer and your mom's, so hers doesn't have to go through his to get to the Internet. There are plenty of cable modem routers out there that also include 802.11b support, and any of these should solve all your problems at once (i.e., they will hide your computers from your neighbors, and they will allow both of your computers to connect to the Internet independently via Airport or Ethernet). Apple's Airport base station is particularly nice, but there are other boxes in the $100 range that will work fine.

Re:Blah. Stupid. And Blah.

[billDCat]

Take a look at BrickHouse, an interface for configuring the rules for ipfw. It provides a combination of a simple interface that still provides much more flexibility than the interface that Mac OS X gives you, plus conveniently allows you to edit the rules in the configuration file manually if you wish. Yah, you could do this using $EDITOR_OF_CHOICE, but I find this more convenient.

Common problem

[DiSKiLLeR]

This is a common problem, and is not specific to Mac OS X. If your father had been running windows, your neighbour would find your fathers windows shares on his Windows or Mac OS X box.

The solution? Firewall.

Read up on ipfw. Its the nice firewall FreeBSD uses and Darwin/OSX has it too.

A few simple rules (default to deny etc) and you will be locked down tight.

D.

always use a firewall

[fermion]

My understanding is that everyone on a particular cable network, i.e. neighbors, shares the same network and the same pipe. It is one of the major disadvantages of cable. Since the purpose of Rendezvous is to transmit connect information to everyone on the network, this is the expected result. I think it may be a basic security flaw as significant as the Windows problems, especially if the service is turned on by default, shares the resources by default, and uses weak default passwords.

I think we really need to educate everyone that a firewall is always needed between the home computer and broadband connections, even if there is only one computer connected. The ISP are not providing the firewall with the modems because they want to sell that service for more money, if they want to allow it at all.

Of course all the other rules apply. Turn off all services that are not needed. Use good passwords on the services that are. I am afraid that Apple is going down the road of reduced security and feature bloat.

something to try

[Aram Fingal]

One specific thing you may want to try with a firewall is blocking packets to 224.0.0.251. I've been using MacSniffer to monitor the traffic on my own home lan to see what I might need to do security-wise and noticed packets going to this address periodically. After some searching, I found that this is probably Rendezvous activity. See this article.

Airport

[red5]

People above have mentioned using a NAT/firewall. You also mentioned that your dad has a airport base station. AFAIK a Base Station is capable of being a NAT/firewall. So I'd just use that. You won't even need new hardware.

Rendezvous or Appletalk?

[alangmead]

You could check if the problem is Rendezvous by sending your father DockBrowser (perhaps by compiling it up for him first.) This should only show the machines available via Rendezvous.

You could check if it was Appletalk by loading up chooser in Classic mode, perhaps with the Who's There rdev. It should only show machines available via Appletalk

You could disable appletalk in the ethernet interface connnected to the cable modem (Its in the Network pane in the System Preferences app.) and leave it on in the Airport interface.

Nothing to do with Rendez-vous

[ElGanzoLoco]

Cable ISP's sometimes build their networks like LAN's. This aparently fools some macintoshes into thinking that it is, in fact, a LAN. I used to be able to see some macintoshes of my neighbourhood, until they fixed the problem.

Rendezvous traffic should not route off the link

[Simon Spero]

Rendezvous uses Multicast DNS (mDNS) to find and announce services. Multicast DNS uses a link-local multicast address, which means that routers should never forward mDNS packets from one link to another.

Simon