MAC address filtering in Slackware?

houler · 04-13-2005, 03:05 AM

Basically I want to add a mac address filter for a dhcp server in my network. Like I want there to be an access list with mac addresses inside and whatever mac address that isn't on the list will be denied dhcp service.

I'm using dhcpd from isc.org.

OS: SLackware 10
kernel: 2.6.11.7

Any ideas on how to accomplish this?

scuzzman · 04-13-2005, 03:59 AM

This should provide some information

Code:

iptables -m mac help

chrisfirestar · 04-13-2005, 04:09 AM

I suggest you use IPTABLES for this, you can use the following:

$IPTABLES -A INPUT -m mac --mac-source 08:00:46:99:CB:96 -j ACCEPT

this way it will not be able to access any services, not just DHCP

fr_laz · 04-13-2005, 04:11 AM

Hi,

2 ways : you can use "hardware address" entries in dhcpd.conf :

Code:

host lazarus {
  hardware ethernet 00:0C:6E:8D:F3:49;
  fixed-address lazarus;
  option broadcast-address 192.168.0.255;
  option routers aracaju;
}

But then you'll have an entry per host on your network... a bit complicated for a daily admin task

Or you can use iptables :
Write a mac-address per line in a file that I've called in this sample mac-list and then

Code:

for MAC in $(cat mac-list) ; do
iptables -A INPUT -p udp --dport 67 -m mac --mac-source $MAC -j ACCEPT
done
iptables -A INPUT -p udp --dport 67 -j DROP

Thus you only disallow dhcp

houler · 04-13-2005, 04:27 AM

Thanks for help

I think I'll do the iptables approach.

Hangdog42 · 04-13-2005, 08:37 AM

Just be aware that it is pretty trivial to spoof a MAC address, so don't rely on this for any serious level of security.

GATTACA · 05-11-2006, 08:32 PM

Quote:

Originally Posted by Hangdog42

Just be aware that it is pretty trivial to spoof a MAC address, so don't rely on this for any serious level of security.

I'm trying to do something similar. I want to restrict SSH access into my slackware box to just one computer (my laptop). I was going to use the laptop's mac address for this but you suggest this doesn't provide enough/much security. I would have thought it was relatively difficult to guess the correct mac address to connect to a machine. (I don't know much about security so if this is a dumb question I apollogize.)

theoffset · 05-12-2006, 01:17 AM

Quote:

I'm trying to do something similar. I want to restrict SSH access into my slackware box to just one computer (my laptop). I was going to use the laptop's mac address for this but you suggest this doesn't provide enough/much security. I would have thought it was relatively difficult to guess the correct mac address to connect to a machine. (I don't know much about security so if this is a dumb question I apollogize.)

This is indeed too insecure. Anyone sniffing your network could get your mac address (since that's public information). You could try "tcpdump -e" (Has to be run as root. You may need some other flags. Tcpdump is included in Slackware) and you'll see it by your self.

Why don't simply use a good old password? or a ssh-key which is only being kept in your laptop?

GATTACA · 05-12-2006, 07:15 AM

Quote:

Originally Posted by theoffset

This is indeed too insecure. Anyone sniffing your network could get your mac address (since that's public information). You could try "tcpdump -e" (Has to be run as root. You may need some other flags. Tcpdump is included in Slackware) and you'll see it by your self.

Why don't simply use a good old password? or a ssh-key which is only being kept in your laptop?

I intend to use a good password too. I was looking for extra security measures.
Although I didn't think of the SSH key idea.

Hangdog42 · 05-12-2006, 08:34 AM

I second the key idea (have a read through this for good instrucions). Using keys would restrict access to only those machines that have the appropriate counterpart, so if you have a private key on your laptop and the public key on the server, only your laptop can gain access.

Provided you keep your private key private.