University LAN, I dont want to log in!

(This post serves in three ways: a short story, some interesting info and finally a quick question)

Right now I'm currently attending college and it seems like I’m the only student(even among CIS students) who has Linux running on his laptop or even desktop for that matter. So the problem lies in the schools newly developed Active Directory Domain this yr. From what I learned, there is no AD4UNIX implemented on the AD(since Linux is rare around here) so it is not possible to use resources on the domain from my Linux laptop. (or so I think? any more info/links about this?)

Every computer owned by the school along with student computers that are brought in, need to be logged into the domain, via a student username and password(Yes, SSN's mostly), in order to access the Internet, print, etc.

(The last 2 paragraphs were for background information, the real problem/my question is below)

On top of this, as a security feature, before any student can access the Internet, they are forwarded to a Univ. run webpage where you sign in w/ your account credentials. This boils down to assigning your computer with the appropriate network information, IP, DNS, GW, etc, upon successful login. Well I dont want to log in.

Before I continue, I found out that this isn't used to log and track students, it is just to insure that the public can not use(steal) the University's internet. Well thankfully, I'm a student. (Outside of this, if you make them mad, they will ban your MAC. Good thing I have "macchanger")

Well I want to learn something, so I found out you can bypass this weblogon in two ways. Steal an existing computers network info, specifically the computers MAC address(though knocking that computer offline) or just assigning yourself w/ the appropriate DNS, valid IP and gateway.

However oddly enough, every 15 minutes the DHCP server kicks me off of the network and gives me a garbage IP. An IP that does nothing but lead me back to the Sign in Webpage that I mentioned above. (But thankfully i just rerun my script to get me back onto the appropriate network w/o having to log into the annoying Web Login)

But since I have static network information that I assigned myself, who needs this pesky DHCP server anyway. So I used iptables to block all traffic going to or from ports 67 and 68 in hope of staying on the network a little longer. But no dice!

It seems, from ethereal logs(which I can post if anyone wants to see them), that my computer initiates the dhcp request for a new IP. How can this be? Why the short lease time from the DHCP, if that’s the case? Can i change this?(dhcp.leases maybe, haven't looked into it yet) And I'm positive my iptable entries were correct, why can't they stop the traffic? I know these questions are vague, but I'll try to be as helpful for any future questions.

As with the AD problem, thats another story/issue.

Cheers

Fusion

P.S.
I hope you have noticed, I have clear/white/curious intentions. Please don’t start flaming me. In order to learn you have to cross the boundary every once in a while.

Quote:

---

Outside of this, if you make them mad, they will ban your MAC. Good thing I have "macchanger"

---

So why the worry about logging in. Assign yourself a fake MAC, (not one stolen from the network), priot to logging in. If you peeve the admins and they block your MAC change it to a different one..... I don't see the point of jumping through any other hoops.

Very true TigerShark

But I'm trying to jump through more hoops, just for the sake of learning something. This might make me reckless or stupid, but what else am I going to do between classes.

I'll keep your comment in mind, because I do log in occasionally w/o trying to mess with everything. And spoofing my MAC couldn't hurt. (While keeping in mind, I AM trying to stay out of trouble here, not do anything stupid)

Thanks for the quick reply.

Fusion

Silly question.....

If you fake a "legal" MAC, login, do ifconfig and set the information as fixed rather than DHCPed does it still fail out every 15 minutes?

hmmm....

I'll get back to you on that one, good idea.

just don't run dhclient...
kill it if it's running and remove it from your hostname.if (or where ever it's assigned in linux).

and FYI, the reason dhclient still works even with your IPtables is that dhclient uses BPF (Berkeley Packet Filters) to communicate, thus bypassing network filters...


Ammo

Hey Hey,

Even if there's no AD4Unix implementation have you tried joining your computer to the domain using samba? It supports joining the Domain... and does work...

Anyways.. I'm too lazy to type out an explanation (in case you have tried it)... if you haven't let me know and I'll give you more details.


Peace,
HT

Hello fusion!
Firstly i will be not of much use to you here, but i want to know from where did u get "MACCHANGER", as even i want one for myself, and how do we use it.

Thanks
Harbir

There are freeware like smac which you can download from internet.
Or go to network neigh. and try with windows 2000 you can assign a mac value yourself, you dont need a tool.

I appreciate everyone’s quick responses. I was expecting to get flamed for my post and I’m glad I didn't.

To ammo, great idea. I had no idea and never heard of BPF. I'll be sure to try shutting down dhclient next time.


HTRegz: Ive used samba plenty of times before, but I'm not aware on how to connect to a Domain with it. I'm sure it can be too hard, and I'm going to try to look more into it. However if you have any helpful advice on the topic or links, let me know. Help would be appreciated.


Thanks and Cheers

Fusion

I take it fixing the IP Address doesn't help then?

Authenticating Linux against Active Directory
http://www.windowsnetworking.com/art...Directory.html

Quote:

---

Originally posted here by br_fusion
Very true TigerShark

But I'm trying to jump through more hoops, just for the sake of learning something. This might make me reckless or stupid, but what else am I going to do between classes.

I'll keep your comment in mind, because I do log in occasionally w/o trying to mess with everything. And spoofing my MAC couldn't hurt. (While keeping in mind, I AM trying to stay out of trouble here, not do anything stupid)

Thanks for the quick reply.

Fusion

---

in your *quest* to *learn* something, there is a very real possibility that you are causing connectivity issues, outge issues somewhere else on the network. meaning someone else is getting real pissed off with the system and getting real pissed off the with admins. the admins are getting extra work trying to figure out what is causing the problem. not a good thing. put yourself in their shoes. (you did say you have good intentions?? i dont see it!)

bottom line - it'a not good to experiment with real live production systems. you could cause problems you are not aware of that you could cause. there are tons of tools out there that can help you experiment (emulatos, VR Systems) without it affecting other peoples productivity. if you get caught - you will be reprimanaded.

Quote:

---

This might make me reckless or stupid, but what else am I going to do between classes.

---

if you have the luxury of free time and a healthy curiosity --> you are trying to integrate linux into an unfriendly windows environment, right? have you considerd working on a prog./system/method/tool/whatever that will help others integrate their *nix boxs into windows? there is always a better way of doing things - you just have to find it. plus the effort might result in money or at the very least something nice to put on a resume.

Thanks for the link secure_lockdown, it was really easy to follow.

As far as your *advice* and *pissing* people off. I’ve made sure from the start that the network settings I assign myself are not in use elsewhere, such as MAC and IP. So I don't see anyone getting disconnected in that way. As far as introducing a linux client in an AD environment, I really haven’t attempted anything that would cause network problems(besides the initial discovery). And while I plan on attempting to join the domain with linux, I try to use reliable resources/links(such as the one you sent me) as a guideline where they have yet to mention any apparent network problems.

You are right for what you said, but I try to keep all that into consideration already. And anytime someone wants to learn something these days, there will always be possibilities for problems, but that’s what learning is about. I’m young, I can’t afford half of the software on the net or any more test stations. I carefully make do as I go along. So until "emulatos, VR Systems" become a reasonable price, I'll continue to outweigh the risk and learn from the network here at school. Keeping in mind any problems I should stay clear from causing.

I just want to let you know that I"m somewhat aware of my actions and I'm not just recklessly connecting around a network.

Cheers

Fusion

First off, tyring to break into a schools network is grounds for expulsion and mass fees if you get caught. Universities are no longer taking this stuff lightly. At the university I work for we have a very similar security scheme, including the banning of macs, only we track which users use which mac. So if you spoof your mac eventually they will realise it and then ban your username. The schools computers macs are kept in a DB so they are not effected byt this. BUt every "non-school" computer that logs in gets copied down then the username gets stored with it. If we see an "out of the ordinary" number of different macs with one log in name the name gets added to a list of "suspects" if any other of those suspects have any other suspicious activity, as in frequent logging in or out, like an obscene amount of times in a day, or hour, or something they ban the name in case itis a "virus" and anytime they try log in it takes them to a page that says to visit any of the ICS labs, where they now have the right to remove any programs that can be "harmful" to the network before they un ban you. Remember, youre on their network, youre playing by their rules. Of course all of this stuff is published and in the agreement you sign when applying for your log in name...so its not a secret. This is just a warning, you should be careful, most school admins arent as stupid as they seem.

First off, I can see where you’re coming from. I almost have no room to talk because I don't know what you deal with on a daily basis. But here goes anyway...

You should have read my posts more closely before you gave me such a strict/unpleasant response. I wouldn't constitute my actions as breaking into the schools network. This sounds a little harsh to me. As for my attentions, I stated that the logging in is not used to track people, so it is not like I am trying to hide my actions. And when I do assign my own network information without logging in, my actions do not consist of any suspicious activity, this I can assure you. What I'm doing is to learn, I'm not trying to DoS their systems or anything. So yet what I'm doing may be some wrong doing, but by your grounds it makes it seem like I'm a criminal.

Again, you work for a University and might deal with some very malicious users. I just hope you don’t get their intentions confused with the innocent ones all the time. Or see the outcome of every user’s actions as always being malicious.

Cheers again

Fusion

br_fusion, if you are playing with hacking tools - you probably don't want to play with them hooked up to a network with other people on it - regardless of how much you think you know. based on your original post, it sounds like you are just getting familiar with this stuff. even the SANS guys play around with this stuff in a *controled* environment.

I in no way meant to say that you were being malicious. But from the eyes of the network admin if you are using any tools to mask who you are (macchanger) or are doing anything that is different from the norm it can and probably will be looked at as suspicious activity, reguardless of your intention. By assigning your self a static IP on a DHCP network you can cause problems, yea they are small, but problems none the less. If you are that interested in the workings of the network, go talk to the admin. There are student jobs as network staff at most universities, and when most admins see a person so eagerly wanting to learn, especially at a university, they are willing to give them a chance. I was just giving you a warning about the trouble you can get it, computer crimes are being taken very seriously, especially after incidents like the break in at berkley, network staff are on alert.

Quote:

---

Originally posted here by br_fusion
And when I do assign my own network information without logging in, my actions do not consist of any suspicious activity, this I can assure you. What I'm doing is to learn, I'm not trying to DoS their systems or anything. So yet what I'm doing may be some wrong doing, but by your grounds it makes it seem like I'm a criminal.

---

Technically, you could be in violation of your school's AUP if it requires you run a specific OS. At any rate, if you asked an admin for help adding your linux box, they will have probably one of two basic responses:
- Here's how to do it
- Get stuffed
Why not ask them first? If they don't want you doing it, they don't want you doing it.
It will look more suspicious if you are avoiding detection/MAC bans than it would if you were up front about it. Honesty doesn't hurt when dealing with other people.

An alternative to logging into AD without installing Windows is to use VMWare and create a Windows VMSession with the appopriate config to authenticate to AD.

At work, they use eDirectory (requires the fat client to login).. so to keep my laptop pristine, I just fire up a VM Image whenever I need to pull something off the corp. network.

And.. as was already pointed out, just disable DHCP and you're set - since you indicated you had a static IP to use.

Quote:

---

I wouldn't constitute my actions as breaking into the schools network.

---

Just because you don't think it's wrong isn't going to help you in the long run.

Try accessing an ATM with a card and pin you made yourself and see how you make out explaining it to the bank. Don't forget to tell them you are just doing it to learn.
;)

Quote:

---

Originally posted here by whatthe
Just because you don't think it's wrong isn't going to help you in the long run.

Try accessing an ATM with a card and pin you made yourself and see how you make out explaining it to the bank. Don't forget to tell them you are just doing it to learn.
;)

---

The problem we have (I think this is in Info Sec. as a whole!) is that people still don't take this stuff seriously enough. I am not saying this is across the board. Banks, Governments e.t.c. are taking information security seriously - but other people and areas are not!

I completely agree with your reply - but i did not take that tone with the original poster because I do believe that this fellow really does believe that he is doing *nothing* wrong. And I see this all the time in the workplace and in private life.

I think the original poster does believe that there is a **HUGE** difference between trying to experiment/learn/break into a bank ATM machine and trying to experiment/learn/break into a university LAN are completely different things and should no be punished in the same way.

Unfortunately I have no good answer or good solution to this line of thinking. Perhaps it's because the personal computer is used for so many other things today other than *serious* stuff (mp3's, games, videos, porno) - people forget that there is real important confidential data (medical info, financial info, personal info, credit card info, ) in computers/networks and accessing it without authorization is a criminal offense that can lead to nasty consequences.

A lot also depends upon whom you run into. For instance, a CSO at a hospital would have you and your entire family burnt at the stake. A sys. admin at a university might not do much. Who knows. It all really depends.

First off, I think you guys are lying if you tell me you have never crossed the line (even if it was just for one minute of your life) in order to find something out or to learn something new.

As far as me not realizing that what I'm doing is wrong, I really wish some of you would read my posts closer:

"So yet what I'm doing may be some wrong doing.."
"I'll continue to outweigh the risk ..."

I know what I'm getting into, and the mentalities of most system admins are very dangerous these days. This is what I keep in mind. This is what XTC46 also pointed out to me. (also sorry XTC46 if I seemed to get defensive after your 1st post, and I appreciate your kind response afterwards.)

I appreciate everyone’s concern for my actions (or rants). I will continue to learn as much as I can without crossing this line. But it’s when users (actually user) quote me as "playing" and using "hacking tools", this is what worries me. I just want advice, leave the rest. (Maybe too much SNL and listening to don’t fear the reaper….)

Ok, this could go on forever, my questions have been answered, let’s let my post die, shall we?

Cheers and peace

Fusion


Also, thanks for the idea utahlanman.

sorry - normally, when someone is very interested in *hiding* their tracks - we usually assume they are up to no good.

good luck.. and remember: don't do unto others what you don't want done to you .. ;-)

When will you learn, I told you to read a little closer before posting.

"Before I continue, I found out that this isn't used to log and track students, it is just to insure that the public can not use(steal) the University's internet. "

Nice try though.


Fusion

Quote:

---

When will you learn, I told you to read a little closer before posting

---

It's all academic, I doubt you will finnish your course.

None of us said we have never crossed that line, and none of us said we were right for doing it. Im just letting you know that sometimes it is not worth the risk, and some times people dont really know the risks. I was just trying to let you know that this type of thing is no longer punished with a slap on the wrist. If you feel it is worth the risk then continue doing it your way, and I wish you the best of luck.

Quote:

---

Before I continue, I found out that this isn't used to log and track students, it is just to insure that the public can not use(steal) the University's internet. "

---

you're kidding right? That specific portion may be used for auth only but im sure they are keeping track of every single person who logs onto their network.