I am reminded of the old acronym K.I.S.S. ...

Odds are if you know very little about wireless, then I am sure you mother
knows even less.  The ideas and suggestions everyone has been tossing around
in response to you message are good and noteworthy.  However, the more
complicated you make you set up for your mom, the more of a headache it will
be for you and her.

I have worked in networking and network security for over 10 years.  I have
seen some nasty hacks and compromised systems and have set up my own
networks and attempted many of the "black arts" in order to learn how to
recognize and defend against the enemy.

When I was working for Cypher42 and we developed airsnort.  It put the proof
in the pudding that WI-FI and WEP were worthless.  I use airsnort to this
day to check my own network and to show clients and unknowing admins that
they need to do more then WEP.  When we released airsnort we did so with the
knowledge that it would be used by sys admins but that it also allowed every
12 yr old with a laptop and the ability to follow directions the ability to
sniff you WEP password and log on to you network.

I live in a multi unit housing development (apartment) and run a wired and
wireless network.  I have a firewall between me and the id10ts out there
(BTW, has anyone else noticed that the little Billy's and Sally's got a
'puter for X-mas and have been doing some X-mas break hacking?)  My firewall
is beefy and ready to do battle with the enemy.  It drops a lot of packets
and keeps adware and spyware at bay while blocking many other IP addresses
i.e.  I know no one in China and therefore do not need their subnets
attempting Micro$oft hacks on my web connected systems.

My home network security is simple and effective.  I use XXX different
layers to protect my data.  1] I use a firewall to protect my wired and
wireless networks.  2]  I only allow connections to my network only from MAC
addresses I have explicitly allowed (yes I know you can fake a MAC, but this
makes it a little harder for little Billy or Sally.  3]  I enforce password
based transactions on all systems.  This took a little getting used to for
my wife. (she hated it at first)  I also follow good user habits like
changing passwords more often than my smoke detector batteries.  4] I check
my logs at least every other day.  I used to import some of the log data
into spreadsheets to look for patterns, but I have not recently because I
need to remake the analyst spreadsheets (low level format of a supposedly
backed up drive...)  And probably the most important 5]  I keep my software
up to date by applying patches.

My wireless access point is a Apple Airport Extreme.  I have the ability
with that AP to have it not broadcast the fact it is a wireless gateway
(called a closed network if I remember correctly).  Yes, this only cuts out
some of the _potential_ war drivers. I also can turn the signal strength
down.  There is no reason for me to be able to connect to my network from
across the court yard, therefore 35% signal is fine for reaching all of my
apt.  I can share ip addresses (DHCP) from the AP, but I cannot log usage so
I do not use it.  Also it does allow for RADIUS authentication if you so
choose.  It allows for separate access and admin passwords and up to a 128
bit WEP key.

I run a unix based firewall and unix based DHCP that also only allows MAC
address registered users connect.  If I have important data to transmit or
even store, I encrypt it or use an encrypted transmission medium (VPN or
SSH).  I run airsnort from time to time to see if there is anyone elese
running a wireless net and have found nothing.  I have spent all but two to
three months of the last 5 years with a broadband flavor of network
connection and many more years of constant dialup connections to my home
network.  I have had a few attempts to break into one or more of my systems
but that is as far as it has ever got.

So in closing, take all that has been said on this issue and digest it.
IMHO if you went to Best Buy and bought a Linksys wireless access point and
some form of firewall software for windows (i.e. Mcaffree makes a windows
firewall). You ensured that your mother's systems were patched and kept up
to date.  You only allowed access by MAC of you mom's computers.  And you
checked on the setup from time to time she would most likely have no
problems.

Hope this helps.

Eric
Network Security For Hire

On 12/29/03 12:37 PM, "The Wandering Dru" <dru at druswanderings.net> wrote:

> My mom is looking to go the wireless route in the near future for her
> laptop.  I know a lot of you that use wireless put the AP on the DMZ of
> your firewall.
> 
> My question is this, do you pinhole the firewall to allow certain
> services(ie, filesharing, printing, etc.) back into the LAN or do you
> just limit the AP to internet access?  Or is there some other fancy way
> to allow these services that I'm not aware of?  I'm mostly just looking
> for a security/convenience trade-off comparison.
> 
> I have nearly no expereince with wireless and would like to come up with
> a plan/cost before I go buying stuff willy-nilly on my mom's bill.


_______________________________________________
TCLUG Mailing List - Minneapolis/St. Paul, Minnesota
http://www.mn-linux.org tclug-list at mn-linux.org
https://mailman.real-time.com/mailman/listinfo/tclug-list