Re: network rc-scripts

* BeTa [[email protected]] [2003-07-07 13:16 +0200]:

> > somewhat in this vein please see the attatched. I started work on
> > these before leaving Gentoo and so they never were commited, they
> > are now copyright The Zynot Foundation.
> 
> great
> 
> > They are quite useful in wireless situations, infact the inital
> > imputus came from the ORA book '802.11 Security' .. the shell and
> > init are entirely my fault (any improvements welcomed).
> 
> so... I'm not really aware of the wifi technology. Could you explain
> us quickly how does it work ? Why an arm script is needed ? all
> doesn't work directly ?

sure, as the list missed the actual scripts i'll show them breifly,
though in abreviated form (if anyone is interested i can send the
scripts .. i didn't want to spam the list with attactchments)

Basically what we do is this:

GATEWAY="`route -n |awk '{print $2}' |egrep \"^([^A-Za-z|0])\"`"
GATEWAY_MAC="`cat /proc/net/arp |awk '{print $4}' |egrep \"^[^a-z]\"`"

arp -s ${GATEWAY_IP} ${GATEWAY_MAC}

($GATEWAY_IP and $GATEWAY_MAC can be hardcoded if need be)

With this the local machines sets the arp address mapping (client =>
gateway) to be static, and so dimminish the possiblity of arp spoofing,
and by extension connection hijacking.

It's not something specific to wifi, but certainly by the nature of wifi
more of a problem, anyone is the vacinity can associate with the
network. Prehaps opitunistic IPSec would be more useful in this respect,
but in my experience it's rarely available/implimented.

As stated, any improvements/comments welcome.

> > Please feel free to intergrate them into the network rc.scripts if
> > you see the any use for them.
> 
> w/ pleasure

:)

best

cals