Bobby Janow wrote:our
year, is there anything else I can do to increase security from outside
Yes. Lose the wireless. Or else make sure
_everything_ it does is encrypted.
I have a question about WEP. There is no wep enabled on these base stations and I'm wondering if it's really necessary. Remember, I'm dealing with a teacher and a lot of middle school students. The only traffic that would be sniffed is internet web stuff and maybe a term paper or two. Each laptop would need to enter the wep key meaning possible phone calls to me when they can't connect. Your thoughts?
and I'm wondering if it's really necessary. Remember, I'm dealing with a teacher and a lot of middle school students. The only traffic that would be sniffed is internet web stuff and maybe a term paper or two. Each laptop
Bobby Janow wrote:
and I'm wondering if it's really necessary. Remember, I'm dealing with a
teacher and a lot of middle school students. The only traffic that would be >> sniffed is internet web stuff and maybe a term paper or two. Each laptop
If I were in your position, I would not be
concerned about that being stolen. Passwords,
though, allowing one bad-attitude student to
trash another's work some night.....
I did use a Cisco VPN to connect to my employer's intranet.
It was quite easy to set up the OS X end. But I know nothing
about what they did on the other end.
I've been put in charge of entering 75 iBook mac addresses into 7 airport base stations. I have been given all the addresses on a spreadsheet (excel). Is there a way to input all those addresses in one fell swoop on each of the airports? Bear with me here people, I'm a PC guy but have a decent working knowledge of OSX and 9.X. The iBook given to me has 10.2 on it. I can
connect to the base stations with no problem.
One reason this task was given to me was because I would like to secure the internal network a bit. The teacher refuses to do the work (union
complaints) but I won't go down that road. Considering the size of the task and the fact that 12-14 year olds will be using the iBooks during the school year, is there anything else I can do to increase security from outside our network. We are natted to an internal 10. network with a firewall blocking most incoming ports. We use a DHCP server.
I have a question about WEP. There is no wep enabled on these base stations and I'm wondering if it's really necessary. Remember, I'm dealing with a teacher and a lot of middle school students.
Using Apple's "Airport Admin Utility" application, you can save base
station configurations to a file, or upload a saved configuration. You
could enter the addresses in one base station, save the result, and then upload it to the others.
On Mon, 07 Jul 2003 15:58:21 -0500,
Wesley Groleau (wesgroleau@despammed.com) wrote:
I did use a Cisco VPN to connect to my employer's intranet.
It was quite easy to set up the OS X end. But I know nothing
about what they did on the other end.
There are situations where VPNs create security risks. Let me
describe a situation to you. My PC and Mac at home are behind a
NAT'ing router. I have SMB turned on both so that they can
file share with each other. The computers are on a private LAN so
computers on the internet cannot see them (non-routable addresses)
This weekend I VPNed into University's VPN concentrator. This
gives my Mac an IP address that is no longer a non-routable address,
but one that can be seen on the Internet. I left to prepare lunch,
came back 30 minutes later, and ran 'netstat -p tcp -n' in a Terminal
window -- lo and behold someone from an Italian DSL site had connected
to the SMB server on my Mac (under OS X), and was trying to login ....
So that's a situation where by being VPNed into the Univ's network,
I made my Mac *less* secure than just being behind a NATed router.
On Mon, 07 Jul 2003 15:58:21 -0500,
Wesley Groleau (wesgroleau@despammed.com) wrote:
I did use a Cisco VPN to connect to my employer's intranet.
It was quite easy to set up the OS X end. But I know nothing
about what they did on the other end.
There are situations where VPNs create security risks. Let me
describe a situation to you. My PC and Mac at home are behind a
NAT'ing router. I have SMB turned on both so that they can
file share with each other. The computers are on a private LAN so
computers on the internet cannot see them (non-routable addresses)
This weekend I VPNed into University's VPN concentrator. This
gives my Mac an IP address that is no longer a non-routable address,
but one that can be seen on the Internet. I left to prepare lunch,
came back 30 minutes later, and ran 'netstat -p tcp -n' in a Terminal
window -- lo and behold someone from an Italian DSL site had connected
to the SMB server on my Mac (under OS X), and was trying to login ....
In article <slrnbgjpls.mai.bevakupf@ebv.mimnet.northwestern.edu>,
"Bev A. Kupf" <bevakupf@ebv.mimnet.northwestern.edu> wrote:
Well, that's VPN all right. Connecting via VPN makes you part of the
remote network you're connecting to, and renders you as safe-- or threatened-- as that network. Most companies would have had some kind
of firewall to prevent such access to their internal machines, and would therefore have avoided this problem. I'm not sure that VPN is even
useful on a network that's already as open as the one you describe.
Bobby Janow <bjanow@msn.com> wrote:
In Excel, arrange the columns with the MAC addresses (in hexadecimal
format with five colons -- one between each hexadecimal pair) in the
first column and the names of the machines in the second column. To
create a tab-delimited text file, either copy the range of cells and
paste them into your text editor or use Excel's "Save As..." command (in
the File menu) to export the entire file as a tab-delimited text file.
A poorly chosen password for filesharing will give one student access to
the other's iBook irrespective of whether they say each other over a
WLAN or an ethernet LAN.
Bev
--
Bev A. Kupf
Bev's House of Pancakes
I'm really not that concerned about filesharing at the school. I was more concerned about a roaming user driving by and attaching to the internal network due to the fact that there is a dhcp server there. There are student records that can be accessed if a user is sophisticated enough and I just want to prevent some of those potential breaches if possible.
On Mon, 07 Jul 2003 23:09:27 GMT,
If this is a concern, you should do two things:
a) implement WEP
b)
This weekend I VPNed into University's VPN concentrator. This
gives my Mac an IP address that is no longer a non-routable address,
but one that can be seen on the Internet. I left to prepare lunch,
came back 30 minutes later, and ran 'netstat -p tcp -n' in a Terminal
window -- lo and behold someone from an Italian DSL site had connected
to the SMB server on my Mac (under OS X), and was trying to login ....
So that's a situation where by being VPNed into the Univ's network,
I made my Mac *less* secure than just being behind a NATed router.
On Mon, 07 Jul 2003 16:28:47 -0600,
Tom Harrington (tph@pcisys.no.spam.dammit.net) wrote:
Well, that's VPN all right. Connecting via VPN makes you part of the >>remote network you're connecting to, and renders you as safe-- or >>threatened-- as that network.
Precisely my point ...
Most companies would have had some kind
of firewall to prevent such access to their internal machines, and would >>therefore have avoided this problem. I'm not sure that VPN is even
useful on a network that's already as open as the one you describe.
And most Universities don't. The one thing that VPN lets me do is literature searches for research articles from home. The database
that Northwestern subscribes to (Ovid) is access limited to IP addresses
from the Northwestern campus (129.105.0.0 and 165.124.0.0). Without
VPN I couldn't access this research resource from home.
Bev
Bev A. Kupf wrote:
This weekend I VPNed into University's VPN concentrator. This
gives my Mac an IP address that is no longer a non-routable address,
but one that can be seen on the Internet. I left to prepare lunch,
came back 30 minutes later, and ran 'netstat -p tcp -n' in a Terminal window -- lo and behold someone from an Italian DSL site had connected
to the SMB server on my Mac (under OS X), and was trying to login ....
So that's a situation where by being VPNed into the Univ's network,
I made my Mac *less* secure than just being behind a NATed router.
Hmmm. That couldn't happen with the setup we had.
When I fired up the "connect to office" script,
the VPN KEXT began encrypting ALL ip packets, and
only the concentrator in Boston (or Dallas) could
decrypt them. Effectively, I was inside the company's
firewall, and could not talk to my own ISP even though
they were passing the packets to the concentrator for me.
company's network. What's described above is a case where the remote network-- in your case, I guess a company-- is not firewalled from the internet. By becoming part of that network, you become as secure or insecure as that network, and if the firewall's remote or ineffective, you're as vulnerable as the rest of the network.
| Sysop: | Gate Keeper |
|---|---|
| Location: | Shelby, NC |
| Users: | 790 |
| Nodes: | 20 (0 / 20) |
| Uptime: | 39:42:16 |
| Calls: | 12,115 |
| Calls today: | 5 |
| Files: | 5,294 |
| D/L today: |
72 files (9,959K bytes) |
| Messages: | 564,927 |