Printable View
Yes, this would be the cheapest thing to do since all you will need additionally is a shittly little linux box running free RADIUS. I have this in use now and I haven't had a single issue....yet. :)Quote:
i would suggest looking into (P)EAP if your Cisco based
Cisco's implementation is LEAP, which is very similar to PEAP but unless you are using a Cisco card (Which comes with the ACU) you will need third party software to such as Odyssey Client to make use of LEAP. PEAP however is supported by Microsoft as of Win2K_SP4 and WinXP_SP1 and can also be used to auth against a Radius server, I too would reccomend looking at FreeRadius as TH13 suggested.
-Maestr0
I don't follow your comments Maestr0...are you stating that Cisco doesn't support (P)EAP...or that they had nothing to do w/ it?
I respectively disagee- Cisco co-authored the PEAP specifications w/ MS and RSA to compensate for the dictionary attack vs. EAP/LEAP.
Here's one of the best documents I've ever read re: Wireless Security and clearly supports the above statements:
http://www.cisco.com/en/US/products/...8009c8b3.shtml
FYI-I'm not a Cisco employee :) I just really enjoy their products.
Cheers,
<0
I'm not saying Cisco doesnt support PEAP, I'm saying Microsoft does not support LEAP (not counting the miserable excuse for LEAP/PEAP in the new WinMobile 2003) LEAP is Cisco's EAP protocol, where as PEAP is based on EAP but co-authored by Cisco, Microsoft, RSA and some other chaps and is an open RFC protocol. So you can use LEAP if you have a cisco card and the ACU (Aeronet Client Utility) or you can purchase a 3rd party client(Odyssesy) to allow other wireless cards to negotiate LEAP authentication with Cisco AP's. If you do not intend to use Cisco cards exclusively I would use PEAP which is supported natively now by MS so you dont have to purchase any third party clients.
-Maestr0
Also, you mentioned PEAP was developed in response to the LEAP dictionary attack, this may be true I havent researched that, but I'm fairly certain PEAP was under way long before that vulnerability was disclosed.
Thanks for taking the time to explain your position- your comments are clear to me now. I hope I didn't come across as abrasive as I was simply attempting to interpret your comments.
I agree with your summary. Furthermore, and for clarification on my side, I was under the impression that PEAP was developed to answer possible attack vectors such as the what was eventually proven in the dictionary attack. I didn't intend to potray PEAP as a direct answer to the specific vulnerability announcement. :)
Cheers,
<0
hey,
" Dont go so deep in forest that you loose ur way back " ;-) , Its only abt home security.
-- A Basic 128 bit WEP with TKIP (Cisco) / CKIP (Wi-Fi) is what is common to all devices and
best for home networking.
-- Another Step that can be added is MAC authentication, with the above options is another
outstanding way to defend ur home network.
-- It would be really tough for any one to break into this.
Well nothing is computers is 100% secure no matter whatever u do, but this shud be more than enough to save you from newbies and mid level hackers etc. ( why wud they run after u at the first place ... its ur fear that will kill u no one else.. lol)
That Said there are further standards for Corporate Deployment
-- XEAP , Cisco EAP - TLS, Cisco LEAP , Cisco PEAP, Microsoft Host Based EAP ( same crap as Cisco PEAP) ..... he he he.. not this alone, add this also , if still discontented , then go for certifiacte authentication , use Token RSA Servers (OTP) with Funk Radius, Microsoft IAS, or Cisco ACS. ( just getin senti :-)) etc.
Finally with least cost and normal residential config choose the top options.
To crack them choose the following - Airospeek , Airsnort, Net Stumbler.
Let me know if you need any thing else...
Smile , u never know when someone falls in love with your smile. :)