trying to get into WiFi for home/work...need some help

[hulkster]

okay, im at work now and i have a pda (ipaq 2215) as does my boss, and i am liking the idea of having wireless access for my pda to of course surf the net, but also to check work email, remote into our servers (im a sys admin) and sync to the desktop via activesync through a wireless connection.

however, ive never dealt with wifi before and need some help doing so.  we already have a wired network at work, and im thinking that all you have to do is connect a wireless access point to the hub, pop in a wifi card into my pda (compact flash card) and bingo...wifi. but that sounds too easy.  am i missing something?  for any of you that know, how is the reception and how far can it go?  does it have to be all out in the open, or can i stick the access point in a closet somewhere next to the hub, close the door, and be able to access the network if i go up a flight of stairs?  also, can i make it so that the wireless access point only recognizes my pda and my boss's?  security is obviously an issue, and i want to make sure that no one else can use it accept for specific devices.  help please!

[GGKoul]

Hey, I have a wireless-g network at home.  And yes its as simple as buying a wireless network hub and plugging it in.  But that is not secure.  As it's very to get in via the default passwords.

Here's a couple of things I've done:

- Created a SSID with encrpytion:  So I have named my wireless and it has a 10 digital password to access the network.

- I don't broadcast my Wireless Network:  There is an option that I use that will not boardcast my Wireless network.   So people outside with not see that I'm running a wireless network.  But that means you need to manually enter in you Wireless Name & Password to access the Wireless Network.  Once this is set up, you can save the configuration on your local machine.

Hope this helps.
-GGKoul

[SirPoonga]

There's a good O'Reilly book on wireless networking.

[hulkster]

well i really dont want to buy a book when i can probably find the same info online somewhere, i just thought someone on this board would be able to direct me in the right path.  thanks ggkoul for the tips....i think i might need to find someone who has one at work though.

[abrannan]

If you set up your wireless network as described above, you're begging to be hacked.  WEP encryption is fairly easily crackable, and MAC filtering is fairly simple to bypass.  Ideally, your wireless connection would connect into a "sandbox" locked down environment outside your corporate firewall.  From there you'd use a VPN client to authenticate and connect through your firewall.  That way, even if someone cracks your WEP encryption and spoofs an unfiltered MAC, they're locked into the "sandbox" environment, and cannot do anything.  IPSEC VPNs are cryptographically secure, so they wouldn't be able to intercept and decrypt your VPN traffic, and you could use your VPN client to connect into your corporate network.  

Granted, that setup is a bit more technically challenging to set up, but it is orders of magnitude more secure than what's been proposed.  Though I'd say the previous method would be sufficient for a home network.  You just don't want to take those chances with a corporate network.  

[abrannan]

Hey, I have a wireless-g network at home.  And yes its as simple as buying a wireless network hub and plugging it in.  But that is not secure.  As it's very to get in via the default passwords.

Here's a couple of things I've done:

- Created a SSID with encrpytion:  So I have named my wireless and it has a 10 digital password to access the network.

- I don't broadcast my Wireless Network:  There is an option that I use that will not boardcast my Wireless network.   So people outside with not see that I'm running a wireless network.  But that means you need to manually enter in you Wireless Name & Password to access the Wireless Network.  Once this is set up, you can save the configuration on your local machine.

Hope this helps.
-GGKoul

Not broadcasting only prevents casual users from finding your wireless network.  Anyone running netstumbler or airsnort will see your wireless network traffic, and since you don't have MAC filtering turned on, they can decrypt your WEP key (Easier than you'd think) and connect right into your network.  Or just capture all of your passwords by listening passively to your traffic.  


Your acces point should have a MAC filtering feature, turn it on and add all of the wireless devices you use.  That's one more layer of security.

[hulkster]

hmm...well i work at a financial institution so i may just hold off on the wifi for now and wait till it becomes as secure as wired...if that ever happens.  thanks for the tips guys.

[GGKoul]

Your acces point should have a MAC filtering feature, turn it on and add all of the wireless devices you use.  That's one more layer of security.

Thats a good tip too.

Regardless of what you do.. if someone to get into your network badly enough, both wired or wireless, they'll probably find a way in somehow.

[abrannan]

hmm...well i work at a financial institution so i may just hold off on the wifi for now and wait till it becomes as secure as wired...if that ever happens.  thanks for the tips guys.

It will never happen, merely by the nature of the communication.  To intercept a wired transmission, you have to have access to the wire.  To intercept a wireless transmission, you have to have an antenna that can pick up the signal.  And with amplifiers, you can pick up the signal from miles away, if you have line of sight.

[Darkstalker]

Exactly.  For secure environments, it's best to seperate the wireless access into a seperate broadcast domain that doesn't have access to your internal servers.

WEP encryption helps, but it's like adding bars made of the strongest marshmellow.  MAC filtering is also useful, but it is very easy to spoof MAC addresses in Linux and break in anyways.  We're talking script kiddie level vulnerabilities here.

WPA is the latest encryption method, but it won't be long before that is broken as well (If it isn't already).  If you really want more information, go pick up the latest copy of PCWorld, they had a nice article on wireless connection and compatibility.