Lowe D. Networking For Dummies

Подождите немного. Документ загружается.

Book V

Chapter 2

Securing a

Wireless Network

427

Securing Your Wireless Network

✦ Disable guest mode. Many access points have a guest mode feature that

enables client computers to specify a blank SSID or to specify “any” as

the SSID. If you want to ensure that only clients that know the SSID can

join the network, you must disable this feature.

Enabling WEP

WEP stands for wired equivalent privacy and is designed to make wireless

transmission as secure as transmission over a network cable. WEP encrypts

your data by using either a 40-bit key or a 128-bit key. Keep in mind that 40-bit

encryption is faster than 128-bit encryption and is adequate for most purposes.

So I suggest that you enable 40-bit encryption unless you work for the CIA.

Note that in order to use WEP, both the client and the server must know the

encryption keys being used. So a client that doesn’t know the access point’s

encryption keys won’t be able to join the network.

You can specify encryption keys for WEP in two ways. The first is to create

the ten-digit key manually by making up a random number. The second

method, which I prefer, is to use a passphrase, which can be any word or

combination of numerals and letters that you want. WEP automatically con-

verts the passphrase to the numeric key used to encrypt data. If the client

knows the passphrase used to generate the keys on the access point, the

client will be able to access the network.

As it turns out, security experts have identified a number of flaws with WEP

that compromise its effectiveness. As a result, with the right tools, a sophis-

ticated intruder can get past WEP. So although it’s a good idea to enable

WEP, you shouldn’t count on it for complete security.

Besides just enabling WEP, you should take two steps to increase its

effectiveness:

✦ Make WEP mandatory. Some access points have a configuration setting

that enables WEP but makes it optional. This may prevent eavesdrop-

pers from viewing the data transmitted on WEP connections, but it

doesn’t prevent clients that don’t know your WEP keys from accessing

your network.

✦ Change the encryption keys. Most access points come preconfigured

with default encryption keys that make it easy for even casual hackers

to defeat your WEP security. You should change the default keys either

by using a passphrase or by specifying your own keys. Figure 2-2 shows

the WEP key configuration page for a typical access point (in this case, a

Linksys BEFW11).

38_625873-bk05ch02.indd 42738_625873-bk05ch02.indd 427 9/21/10 10:32 PM9/21/10 10:32 PM

428

Securing Your Wireless Network

Figure 2-2:

Changing

the WEP

settings on

a Linksys

wireless

router.

Using WPA

WPA, which stands for Wi-Fi Protected Access, is a new and improved form

of security for wireless networks that’s designed to plug some of the holes

of WEP. WPA is similar in many ways to WEP. But the big difference is that

when you use WPA, the encryption key is automatically changed at regular

intervals, thus thwarting all but the most sophisticated efforts to break the

key. Most newer wireless devices support WPA. If your equipment supports

it, I suggest you use it.

Here are a few additional things to know about WPA:

✦ A small office and home version of WPA, called WPA-PSK, bases its

encryption keys on a passkey value that you supply. However, true WPA

devices rely on a special authentication server to generate the keys.

✦ Windows XP with Service Pack 2 has built-in support for WPA, as does

Windows Vista.

✦ The official IEEE standard for WPA is 802.11i. However, WPA devices

were widely available before the 802.11i standard was finalized. As a

result, not all WPA devices implement every aspect of 802.11i. In Wi-Fi

circles, the 802.11i standard is sometimes called WPA2.

38_625873-bk05ch02.indd 42838_625873-bk05ch02.indd 428 9/21/10 10:32 PM9/21/10 10:32 PM

Book V

Chapter 2

Securing a

Wireless Network

429

Securing Your Wireless Network

Using MAC address filtering

MAC address filtering allows you to specify a list of MAC addresses for the

devices that are allowed to access the network. If a computer with a differ-

ent MAC address tries to join the network via the access point, the access

point will deny access.

MAC address filtering is a great idea for wireless networks with a fixed

number of clients. For example, if you set up a wireless network at your

office so that a few workers can connect their notebook computers, you

can specify the MAC addresses of those computers in the MAC filtering

table. Then, other computers won’t be able to access the network via the

access point.

Unfortunately, it isn’t difficult to configure a computer to lie about its MAC

address. Thus, after a potential intruder determines that MAC filtering is

being used, he or she can just sniff packets to determine an authorized MAC

address and then configure his or her computer to use that address. (This is

called MAC spoofing.) So you shouldn’t rely on MAC address filtering as your

only means of security.

Figure 2-3 shows the screen used to edit the MAC address table for a Linksys

wireless access point.

Figure 2-3:

A MAC

address

table for

a Linksys

wireless

router.

38_625873-bk05ch02.indd 42938_625873-bk05ch02.indd 429 9/21/10 10:32 PM9/21/10 10:32 PM

430

Securing Your Wireless Network

Placing your access points outside the firewall

The most effective security technique for wireless networking is to place all

your wireless access points outside of your firewall. That way, all network

traffic from wireless users will have to travel through the firewall to access

the network.

As you can imagine, doing this can significantly limit network access for

wireless users. To get around those limitations, you can enable a virtual pri-

vate network (VPN) connection for your wireless users. The VPN will allow

full network access to authorized wireless users.

Obviously, this solution requires a bit of work to set up and can be a little

inconvenient for your users. However, it’s the only way to completely secure

your wireless access points.

Don’t neglect the basics

The security techniques described in this chap-

ter are specific to wireless networks. They

should be used alongside the basic security

techniques that are presented in Book III. In

other words, don’t forget the basics, such as:

✓ Use strong passwords for your user

accounts.

✓ Apply security patches to your servers.

✓ Change default server account information

(especially the administrator password).

✓ Disable unnecessary services.

✓ Regularly check your server logs.

✓ Install virus protection.

✓ Back up!

38_625873-bk05ch02.indd 43038_625873-bk05ch02.indd 430 9/21/10 10:32 PM9/21/10 10:32 PM

Chapter 3: Hotspotting

In This Chapter

✓ Exploring hotspots

✓ Using hotspots safely

✓ Comparing free and fee-based hotspots

✓ Creating your own hotspot

ireless networks aren’t just for private use within your home or at

your place of work. Nowadays, many public places such as airports,

libraries, hotels, restaurants, and coffee houses host public-access wireless

networks, called hotspots. If you visit one of these establishments with a

wireless-equipped laptop computer in tow, you can use these hotspots to

access the Internet.

In this chapter, you read about these public hotspots and find out how to

use them. As you read this chapter, keep in mind that public hotspots use

the same 802.11 technology as private wireless networks described in the

first two chapters of this minibook. So the techniques that you use to con-

nect to a hotspot are the same as those you use to connect to any wireless

network. And the security implications are the same, too.

What Is a Hotspot?

A hotspot is an area that has wireless networking available to the public. The

first public hotspots were in airports and hotels, where business travelers

could connect to the Internet with their laptop computers to pick up e-mail

while on the road. Soon libraries jumped on the bandwagon, providing

Internet access to anyone who brings a wireless-equipped laptop into the

library.

Lately, restaurants and trendy coffee houses have been providing wireless

hotspots so that you can stream music and video or play an online game

while sipping a vanilla latte. Starbucks is probably the best-known trendy

hotspot, but many others are joining in. For example, many Schlotzsky’s

Deli locations have free hotspot access. And even McDonald’s is equipping

many of its restaurants with hotspots. Bookstores like Borders and Barnes

& Noble also provide access.

39_625873-bk05ch03.indd 43139_625873-bk05ch03.indd 431 9/21/10 10:33 PM9/21/10 10:33 PM

432

What’s So Great about Hotspots?

If you’re puzzled about why so many businesses are getting into the hotspot-

ting business, the following paragraphs offer some of the most common

reasons:

✦ To increase traffic and, therefore, business. For example, the CEO of

Schlotzsky’s Deli (www.schlotzskys.com) has said that free Internet

access results in 15,000 additional visits to each store every year. And

those people who come in simply to use the free Internet access usually

buy something, even if it’s just a soda and a bag of chips.

✦ To identify the business as hip or trendy.

✦ To make money directly from the hotspot. Note that just because a

business charges for its wireless access doesn’t mean it is making a sig-

nificant amount of money from it. Some must charge fees to help cover

the costs because they can’t justify the expense of commercial-quality

broadband access simply on the basis of good will and a little increased

traffic.

Safe Hotspotting

To simplify the connection process, most hotspots — both free and fee-

based — disable the security features that are available for wireless net-

works. As a result, you should take some basic precautions when you use a

public hotspot:

✦ Make sure that you have a firewall installed and running. If you don’t

have a separate firewall program, enable the Windows Firewall that’s

built in to Windows.

✦ Disable file sharing on your laptop computer.

✦ Avoid sites that ask for confidential information but don’t use the secure

HTTPS protocol.

✦ Use a VPN if you plan on accessing your company’s network.

✦ Disconnect from the wireless network when you’re finished using it.

Free Hotspots

Many hotspots are free of charge. For example, the hotspots at Schlotzsky’s

Deli are free. And hotspots at libraries are typically free.

39_625873-bk05ch03.indd 43239_625873-bk05ch03.indd 432 9/21/10 10:33 PM9/21/10 10:33 PM

Book V

Chapter 3

Hotspotting

433

Fee-Based Hotspots

To use a free hotspot, all you have to do is turn on your wireless-equipped

laptop computer in the vicinity of the hotspot access point. Then, when you

see the notification bubble in the bottom-right corner indicating that a wire-

less network is in range, click it to connect to the network. You can then fire

up your Web browser to surf the Web.

Connecting to a free hotspot is easy. The hard part is finding an available

hotspot to connect to, especially a free one. If you happen to live across the

street from a library or a Schlotzsky’s Deli, you’re in luck. Otherwise, you’ll

have to search to find a hotspot. Fortunately, there are several Web sites

you can consult to locate hotspots in your area:

✦ www.freenetworks.org: An organization of free networks around

the world

✦ www.sflan.org: Free networks in the San Francisco area

✦ www.socalfreenet.org: Free networks in Southern California

✦ www.seattlewireless.org: Free networks in the Seattle,

Washington, area

With Google and a little perseverance, you may be able to find a Web site

devoted to your city. Note, however, that you’re much more likely to find

free hotspot access in a big city than in Mayberry.

Fee-Based Hotspots

Although some hotspots are free, most charge a fee. Although some charge

for hourly use, others offer subscriptions that give you unlimited use for a

monthly fee, usually in the neighborhood of $30 per month.

When you connect to a fee-based hotspot, a logon page is displayed. On

this logon page, you can enter your user ID and password if you are already

a subscriber. If not, you can join on the spot — just have your credit card

handy. After you’ve joined and logged on, you can access the Internet by

using your Web browser.

Many fee-based providers have roaming agreements with one another that

effectively increase the number of locations that are available. However, you

may have to pay an additional surcharge if you use roaming.

The following sections describe several well-known wireless service

providers.

39_625873-bk05ch03.indd 43339_625873-bk05ch03.indd 433 9/21/10 10:33 PM9/21/10 10:33 PM

434

Setting Up Your Own Hotspot

T-Mobile

A well-known and widely available subscription hotspot provider is

T-Mobile, which provides the hotspots found in Starbucks, Barnes & Noble,

FedEx/Kinkos, and many other locations. At the time I wrote this (April

2010), T-Mobile had more than 10,000 hotspot locations in the United States

and more than 35,000 additional locations worldwide.

Of course, T-Mobile is also a cell phone company, and like any cell phone

company, it offers a variety of plans you can choose from. If you’re willing

to commit to the service for a year, the monthly fee is $29.95. This gives you

unlimited access to any T-Mobile hotspot within the United States. (If you’re

already a T-Mobile wireless customer, you can add the hotspot service for

just $9.99 per month on top of your T-Mobile bill.) Without the one-year

commitment, the plan costs $39.95 per month. You can also purchase a one-

day pass for $7.99 or pay for the service hourly. The hourly rate is $6 for the

first hour and $0.10 per minute for each additional minute.

For information about T-Mobile’s hotspot subscriptions, visit www.

tmobile.com/hotspot.

Boingo

With more than 125,000 locations worldwide, Boingo Wireless may be the

biggest wireless network on earth. Plus it has the coolest name. Boingo is

designed primarily for business travelers, so most of its hotspots are in

hotels, airports, and business service centers. The basic plan is $9.95 per

month for unlimited access in the United States.

Unlike most other providers, Boingo uses its own software to connect you to

its wireless network. This simplifies the task of connecting to the network.

Boingo’s Wi-Fi software is available for Windows, Macs, and Pocket PCs.

For more information, check out www.boingo.com.

Setting Up Your Own Hotspot

So you own a little café and you think it would be cool to set up a hotspot

for your customers to use, eh? If you want to set up a free hotspot, here’s all

you need:

✦ A reliable broadband Internet connection. DSL, cable, or T-1 will work

nicely.

✦ A wireless access point. For a small hotspot, a simple consumer-grade

access point (like a Linksys wireless router) will do fine.

✦ A sign to tell your customers about the hotspot and how to connect to it.

39_625873-bk05ch03.indd 43439_625873-bk05ch03.indd 434 9/21/10 10:33 PM9/21/10 10:33 PM

Book V

Chapter 3

Hotspotting

435

Setting Up Your Own Hotspot

Of course, there’s a lot more to it than this. Here are a few additional issues

to consider:

✦ You need a firewall to prevent your customers from poking around

inside your private network. The wireless access point should be outside

of the firewall.

✦ No matter how good your sign is, your customers will have questions

about how to connect. So in addition to how to make a mocha latte, you

need to teach your employees how to help customers connect to your

hotspot.

✦ Your broadband provider may not appreciate it if you let the general

public access the Internet through your wireless access point. In fact,

your service contract may prohibit it. As a result, you probably need

to pay a bit more to share your broadband connection with the general

public.

If you want to charge for hotspot access, you’ve got a lot more work to do. In

particular, you need to devise a way to charge your customers. The easiest

way to do this is to purchase a single-box solution that includes the neces-

sary wireless devices as well as software that handles the authentication and

billing.

39_625873-bk05ch03.indd 43539_625873-bk05ch03.indd 435 9/21/10 10:33 PM9/21/10 10:33 PM

436

Book V: Wireless Networking

39_625873-bk05ch03.indd 43639_625873-bk05ch03.indd 436 9/21/10 10:33 PM9/21/10 10:33 PM