Replacing WEP with IPsec on OpenBSD, Windows XP

BSD Forums writes "WEP has been proven insecure and is thus inadequate for protecting a wireless network from eavesdropping or abuse. IPsec can be used as a replacement to WEP in the following scenarios. Joshua Stein has implemented IPsec on OpenBSD with manual keying between a router and a client as a replacement. Also, Thomas Walpuski describes in detail the configuration of an IPsec Host-to-Host connection between OpenBSD and Windows XP Professional with Authentication via X.509v3 Certificates."

Comments

Forget WEP, go to WPA

[jrpascucci]

WPA, which stands for 'Wi-Fi Protected Access', is the replacement for WEP. It does a prima facia good job making up for WEP's flaws. Several companies have firmware updates and drivers to enable WPA. More are coming.

If you want strong protection, use it in combination with 802.1x authentication with a TLS (and accept the infrastructure problem), PEAP (and choose between the incompatible v1 or v2 versions of it, and I personally can never remember which it is MS supports), or TTLS.

For even stronger protection, turn on 'session resumption' on your .1X client (if you can), and return a Session-Timeout of a few minutes. You'll effectively completely rekey (start from new material, in addition to the rekeying WPA provides.

Re:Does it mater all that much?

[darthtuttle]

Yes, it does matter.

Not only can it affect what someone can "hear" when they listen to your wireless, it's access control. If I'm a terrorist and I want to post something to the internet for my friends somewhere else to get, I'm going to find an open wireless access point, since that's easiest, but lacking one of those, I can just listen for any, and once I've found one using WEP only for security I can crack it and use it.

What's your point? The point is, if the "evildoers" use your wireless access point to transmit information guess who's hosue the Department of Homeland Security shows up at. Even if they don't haul you off to jail, having them show up at your house is not fun.

There is a misconception that because your not a large company or other visable target that your not going to be targeted. The problem is that people don't have to target you to abuse your network. They simply look for any network easy to abuse, and there's enough people looking to abuse networks that someone will stumble on to yours given enough time and a pringles can.

This is the same as companies I've been to who feel they aren't an "eBusiness company" and their access to the Internet is not public (there's no public website) so they aren't going to get hacked. They got hacked.

W2K?

[iamr00t]

This is a very good paper, assuming it works.
Also, it looks like W2K has all same functionality (besides security monitor, which i assume is just that - monitor). Can it be used for that?

Also, what about denying non-ipsec protocol over the server interface that is connected to access point?

Good WPA article here

[gad_zuki!]

Short but decent read without getting too technical.

http://www.nwfusion.com/research/2003/0331wpa.html ?page=1

Cool, but does Airport/OS X support this?

[psxndc]

I use an OpenBSD firewall/gateway as my wireless access point and my iBook as the client. Does anyone know how I'd do this under OS X? The last time I looked, the built-in IPSec implementation was not really user accessible.

psxndc