RE: [fw-wiz] Link level security with static arp tables

From: Ben Nagy (ben_at_iagu.net)
Date: 10/15/03

  • Next message: R. DuFresne: "RE: [fw-wiz] Link level security with static arp tables" 
    To: <firewall-wizards@honor.icsalabs.com>
Date: Wed, 15 Oct 2003 16:11:56 +0200

    > -----Original Message-----
    [Magosanyi Arpad]

    > If real authentication, integrity and confidentality is needed,
    > I would do IPSEC. Any other (or same) ideas?

    [This is Paul]

    [Strong reservations expressed, but IPSec is]
    > a viable alternative, as is a gateway between
    > user segments
    > and backbones simlar to those found in airports and coffee
    > shops isn't all
    > that bad an idea (or an authenticating firewall...)

    I know....how about SOCKS!

    Seriously, we're just indulging in over-engineering here. However, if I were
    doing it for a strong security environment I have grave concerns about
    IPSec. Hard to install, hard to maintain, ugly protocol at the best of times
    and at the basic level it only does machine-level authentication.

    The Microsoft IPSec/Kerberos implementation is a better approach, but we all
    know there are lots of interop and fast-and-loose standards problems. At
    least it tries to authenticate the user and the station, which is a big step
    in the right direction.

    Frankly, in a real world environment that needed strong security along these
    lines I would apply a combination of good physical security, no active
    unused wall-points and the switch Port/MAC thing. All external access would
    be via a proxy which can authenicate each user. A circuit level gateway
    really is a good match for this problem. If only SOCKS didn't suck. :)

    If I can't have any physical security I vote for 802.1x over IPSec. The
    problem with the IPSec thing is that the attacker is physically able to see
    and interfere with traffic and we rely on our technical controls to deal
    with it from there. 802.1x starts with the port in a null VLAN where the
    attacker sees nothing.

    I am not aware of how PEAP is "known broken" for this kind of application
    (assuming one takes just a little care), and I'm not sure it will go away.
    If anyone has any good stuff to point me at I'd be interested in discussing
    this aspect further. I am, of course, familiar with the IETF draft. [1] I
    agree that I much prefer EAP-TTLS [2], since it's a cleaner design, but
    "word on the street" has it that PEAP is looking more likely to emerge as
    market victor.

    ben

    [1] http://www.ietf.org/internet-drafts/draft-puthenkulam-eap-binding-03.txt
    [2] http://www.ietf.org/internet-drafts/draft-ietf-pppext-eap-ttls-03.txt

    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: R. DuFresne: "RE: [fw-wiz] Link level security with static arp tables"

    Relevant Pages

    • Re: MSFT Bans insecure hashes - was"Passwords with Lan Manager (LM) under Windows"
      ... After I pointed out that "IPsec based auth" is not a basic netlogon ... authentication protocol like Kerberos, LM, NTLM and NTLMv2, you said I was ... based auth" to authenticate the request as opposed to LM, NTLM, or NTLMv2. ... Up to 75% of cyber attacks are launched on shopping carts, forms, ...
      (Pen-Test)
    • RE: Passwords with Lan Manager (LM) under Windows
      ... A device's security associations are contained in its Security Association Database ... Internet Protocol Security (IPSec) provides application-transparent encryption services for IP network traffic as well as other network access protections for the Windows 2000 operating system. ... As for "article you reference does indeed use the phrase "IPSec Authentication," but as any who reads it ...
      (Pen-Test)
    • Re: Kerberos machine authentication - apparent authentication fail
      ... as the case may be) which will delay authentication until ... I also have an Intel network adapter and WAP that does not have this> problem and even works well with 802.1X EAP-TLS for domain logon. ... In> most cases [ipsec a possible exception] kerberos authentication is not> needed to access domain resources as long as the client and server use a> common authentication method for lm/ntlm/ntlmv2. ... The main issue is to> NEVER include an ISP dns server in the preferred server list in the tcp/ip> properties or DHCP scope of any domain computer or any computer you want to> join to the domain in which case your computers may be trying to locate the> domain _srv records on the ISP dns server and fail. ...
      (microsoft.public.windows.server.security)
    • Re: IPsec - restrict communcation
      ... IPsec can use three different methods to initially authenticate machines: ... permit, block, or negotiate security, as well as authentication methods ... you don't need the communications to be private. ...
      (microsoft.public.security)
    • Re: Attacks on IPsec
      ... The real problem seems to be not the IPSec protocol, ... RFC 2406 says that encryption without authentication ... This cipher can be used in an ESP ...
      (sci.crypt)