Re: EBTables and 802.1X Authentication...

Op wo, 19-10-2005 te 22:41 -0500, schreef Grant Taylor:
> Is there any thing in place that will allow EBTables to use 802.1X
> Port Authentication?  It would be nice to be able to set up a Linux
> box with EBTables to only pass traffic from a particular MAC on one
> interface out one or more other interfaces if it has been
> authenticated via the 802.1X port authentication protocol (EAP).
> Traditionally 802.1X is meant to either logically enable or disable a
> switch port that a client connects to.  However 802.1X has been
> extended, namely in access points, to only forward traffic for a given
> MAC from the wireless side in to the wired side only if the source MAC
> has been authenticated.
> 
> As I understand it, the way that 802.1X works is by having the access
> point / bridge deny all traffic from the client (supplicant) to the
> network except for Extensible Authentication Protocol (EAP).  The
> access point / bridge will then check the returning EAP traffic to see
> if the MAC in question properly authenticated to the authenticator
> (authentication server).  Technicaly EAP works by the client
> (supplicant) sending an EAP authentication request to the
> authenticator (or device acting as an authenticator) which will then
> query its configured authentication source.  Usually the authenticator
> uses a RADIUS back end authentication source.
> 
> IMHO 802.1X support would not be that difficult to handle in EBTables
> with the support of a user space daemon or the likes.  There could
> easily be a default policy to drop any traffic that is not explicitly
> allowed from the MAC of an authenticated client.  I would think that
> the EAP traffic would be DNATed to the MAC of the authenticator which
> would be runing the EAP daemon.  Said EAP daemon would then receive
> the EAP traffic and handle it and query the back end authentication
> system.  If the client was authenticated the MAC of the client would
> be added to an explicitly allowed (authenticated) table.  If the
> client was not authenticated then the daemon would close out the EAP
> session and consider it's job done.  Any subsequent EAP attempts would
> be treated as new EAP sessions and handled as such save for any brute
> force logging logic in the EAP daemon.

Your solution sounds very doable but I don't know of any readily
available tool that already does the job for you.

cheers,
Bart




-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc.
Get Certified Today * Register for a JBoss Training Course
Free Certification Exam for All Training Attendees Through End of 2005
Visit http://www.jboss.com/services/certification for more information