RE: Dhcp security

Hi Cory,

Just few notes about 802.1x:

* For the wired networks, 802.1x (as implemented by Microsoft and Cisco) just 
enables a switch port after one of the devices connected to the port 
authenticates - because the link between the switch port and the client is sort 
of trusted by 802.1x. As such, this allows to place unauthorised devices on the 
802.1x-enabled network. I have conducted a proof of concept for this:

http://sl.mvps.org/docs/802dot1x.htm

Note that only physical connection is required - all the necessary information 
to create the "shadow host" can be sniffed. Shadow host will receive DHCP 
leases and bypass any MAC controls in place.

* Microsoft has plans to implement NAP for 802.1x, as well as for DHCP and 
IPsec. Choosing IPsec over 802.1x and especially DHCP is a good idea though.

Regards

Slav

> -----Original Message-----
> From: Cory Stoker [mailto:cory@clearnetsec.com]


> 802.1x is a standard of authentication network 
> connections via
> EAP over Ethernet which is not a quarantining method per se 
> but it would
> prevent anyone from connecting to your LAN that does not have 
> a password and
> username....

---------------------------------------------------------------------------
---------------------------------------------------------------------------