Slashdot Mirror
Replacing WEP with IPsec on OpenBSD, Windows XP
BSD Forums writes "WEP has been proven insecure and is thus inadequate for protecting a wireless network from eavesdropping or abuse. IPsec can be used as a replacement to WEP in the following scenarios. Joshua Stein has implemented IPsec on OpenBSD with manual keying between a router and a client as a replacement. Also, Thomas Walpuski describes in detail the configuration of an IPsec Host-to-Host connection between OpenBSD and Windows XP Professional with Authentication via X.509v3 Certificates."
WPA, which stands for 'Wi-Fi Protected Access', is the replacement for WEP. It does a prima facia good job making up for WEP's flaws. Several companies have firmware updates and drivers to enable WPA. More are coming.
.1X client (if you can), and return a Session-Timeout of a few minutes. You'll effectively completely rekey (start from new material, in addition to the rekeying WPA provides.
If you want strong protection, use it in combination with 802.1x authentication with a TLS (and accept the infrastructure problem), PEAP (and choose between the incompatible v1 or v2 versions of it, and I personally can never remember which it is MS supports), or TTLS.
For even stronger protection, turn on 'session resumption' on your
Yes, it does matter.
Not only can it affect what someone can "hear" when they listen to your wireless, it's access control. If I'm a terrorist and I want to post something to the internet for my friends somewhere else to get, I'm going to find an open wireless access point, since that's easiest, but lacking one of those, I can just listen for any, and once I've found one using WEP only for security I can crack it and use it.
What's your point? The point is, if the "evildoers" use your wireless access point to transmit information guess who's hosue the Department of Homeland Security shows up at. Even if they don't haul you off to jail, having them show up at your house is not fun.
There is a misconception that because your not a large company or other visable target that your not going to be targeted. The problem is that people don't have to target you to abuse your network. They simply look for any network easy to abuse, and there's enough people looking to abuse networks that someone will stumble on to yours given enough time and a pringles can.
This is the same as companies I've been to who feel they aren't an "eBusiness company" and their access to the Internet is not public (there's no public website) so they aren't going to get hacked. They got hacked.
Darthtuttle
Thought Architect
This is a very good paper, assuming it works.
Also, it looks like W2K has all same functionality (besides security monitor, which i assume is just that - monitor). Can it be used for that?
Also, what about denying non-ipsec protocol over the server interface that is connected to access point?
Short but decent read without getting too technical.
l ?page=1
http://www.nwfusion.com/research/2003/0331wpa.htm
psxndc
The emacs religion: to be saved, control excess.
[ed. note: in the following text, former FreeBSD developer Mike Smith gives his reasons for abandoning FreeBSD]
When I stood for election to the FreeBSD core team nearly two years ago, many of you will recall that it was after a long series of debates during which I maintained that too much organisation, too many rules and too much formality would be a bad thing for the project.
Today, as I read the latest discussions on the future of the FreeBSD project, I see the same problem; a few new faces and many of the old going over the same tired arguments and suggesting variations on the same worthless schemes. Frankly I'm sick of it.
FreeBSD used to be fun. It used to be about doing things the right way. It used to be something that you could sink your teeth into when the mundane chores of programming for a living got you down. It was something cool and exciting; a way to spend your spare time on an endeavour you loved that was at the same time wholesome and worthwhile.
It's not anymore. It's about bylaws and committees and reports and milestones, telling others what to do and doing what you're told. It's about who can rant the longest or shout the loudest or mislead the most people into a bloc in order to legitimise doing what they think is best. Individuals notwithstanding, the project as a whole has lost track of where it's going, and has instead become obsessed with process and mechanics.
So I'm leaving core. I don't want to feel like I should be "doing something" about a project that has lost interest in having something done for it. I don't have the energy to fight what has clearly become a losing battle; I have a life to live and a job to keep, and I won't achieve any of the goals I personally consider worthwhile if I remain obligated to care for the project.
Discussion
I'm sure that I've offended some people already; I'm sure that by the time I'm done here, I'll have offended more. If you feel a need to play to the crowd in your replies rather than make a sincere effort to address the problems I'm discussing here, please do us the courtesy of playing your politics openly.
From a technical perspective, the project faces a set of challenges that significantly outstrips our ability to deliver. Some of the resources that we need to address these challenges are tied up in the fruitless metadiscussions that have raged since we made the mistake of electing officers. Others have left in disgust, or been driven out by the culture of abuse and distraction that has grown up since then. More may well remain available to recruitment, but while the project is busy infighting our chances for successful outreach are sorely diminished.
There's no simple solution to this. For the project to move forward, one or the other of the warring philosophies must win out; either the project returns to its laid-back roots and gets on with the work, or it transforms into a super-organised engineering project and executes a brilliant plan to deliver what, ultimately, we all know we want.
Whatever path is chosen, whatever balance is struck, the choosing and the striking are the important parts. The current indecision and endless conflict are incompatible with any sort of progress.
Trying to dissect the above is far beyond the scope of any parting shot, no matter how distended. All I can really ask of you all is to let go of the minutiae for a moment and take a look at the big picture. What is the ultimate goal here? How can we get there with as little overhead as possible? How would you like to be treated by your fellow travellers?
Shouts
To the Slashdot "BSD is dying" crowd - big deal. Death is part of the cycle; take a look at your soft, pallid bodies and consider that right this very moment, parts of you are dying. See? It's not so bad.
To the bulk of the FreeBSD committerbase and the developer community at large - keep your eyes on the real goals. I