Network security, DHCP, and Linux

...

To get to know the pool of IP addresses assigned by DHCP.

M.

Choose a local network. Filter fake traffic away on the zone border. Allow this local network. Configure DHCP so that only addresses of this local network are spread locally.

If you have to control physical access, do so - or use 802.1x or something like that.

Yours, VB.

snipped-for-privacy@iprive.com (06-07-06 10:16:05):

You cannot authenticate users by their IP addresses, as they can be faked easily. Instead, set up OpenVPN [1] and do your DHCP assignments there. Still, every user has their own key, and you can authenticate by that.

Better yet, use real, user-based authentication instead of host-based. That's not only easier to set up, but also more secure and more decentral (users don't have to work on a fixed terminal to do their work; they can switch easily).

Regards, E.S.

You need to determine what your Security Policy needs to achieve, and whether it is affected by the use of DHCP vs static IP addresses.

Until you've done this we cannot help you implement it. Chris

snipped-for-privacy@iprive.com wrote: [...] In future please set FUT field with crosspost!

DHCP is a security nightmare. How can you stop people setting up "rogue" DHCP servers?

Not really, if you control your environment.