Date: Sat, 21 Aug 1999 00:16:37 +0300 From: Evren Yurtesen <yurtesen@ispro.net.tr> To: Chris Malayter <mustang@TeraHertz.Net> Cc: jay d <service_account@yahoo.com>, "Rodney W. Grimes" <freebsd@gndrsh.dnsmgr.net>, freebsd-security@FreeBSD.ORG Subject: Re:(2) multiple machines in the same network Message-ID: <37BDC5B5.581082F7@ispro.net.tr> References: <Pine.BSF.4.05.9908201432350.86219-100000@saturn.terahertz.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Thanks for all the answers they have very valuable information but also I need documentation about how I can do the things you are suggesting to me. I did not do this kind of thing before so I am not an expert at this so far. well, I have a cisco catalyst switch here, I am able to define static mac addresses. would it be enough for not letting people sniff passwords? also where can I find information about mac addresses? I wonder what would happen if I enable security features on my switch and define static MAC entries for ports and I have 2 machines with the same ip address ? and other security related stuff about what I am trying to do here? is there any web addresses you may suggest? Evren Chris Malayter wrote: > > Care to elaborate on that? I'm in a colocated facility with multiple > boxes that I am sure our root comprimised, if in fact you can sniff on a > switched network, I'de like to know how you protect yourself against that? > > Chris Malayter > > Mustang@TeraHertz.Net > > ------------------------------------------------------------------------- > Administrator, TeraHertz Communications | | > | InterNIC CM3647 | > Chief Engineer - 95.1 WVUR - Valparaiso,Indiana | | > ------------------------------------------------------------------------- > > "Behavior is hard to change...but character is nearly impossible" > > > On Fri, 20 Aug 1999, jay d wrote: > > > What you really want is a VLAN capable switch. VLAN switches simply > > designate what ports on a switch can see what other ports on the same > > switch. I have to correct you though, Rodney, as sniffing is currently > > possible through switches. > > > > Jay > > > > --- "Rodney W. Grimes" <freebsd@gndrsh.dnsmgr.net> wrote: > > > > Hello, > > > > > > > > We are an ISP and we want to let our customers to > > > put their own hardware > > > > into our network. But the thing we are concerned > > > about is security of > > > > course. How can we protect our system from > > > customers' machines? > > > > > > I would strongly suggest that you place your > > > customers on a ethernet > > > switch. Any of the modern 10/100 switches work well > > > for this. Each > > > customer gets 1 port on the switch, if they have > > > more than 1 machine > > > they install thier own hub connected to the switch. > > > This prevents > > > them from sniffing other customers traffic. Then > > > you need to setup > > > a router between this switch and your DMZ with a > > > firewall rule set > > > that stops all the nasty stuff like RFC1918 nets, > > > smurf amplifier (block > > > the broadcast addresses to all known subnets), etc. > > > > > > > > > > > I have heard about somehthing called "virtual > > > network" but I am not sure > > > > of what it means and even if it is the thing I am > > > searching for ? > > > > > > You don't need VLAN's for this, it's overkill. > > > > > > -- > > > Rod Grimes - KD7CAX - (RWG25) > > > rgrimes@gndrsh.dnsmgr.net > > > > > > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > > > with "unsubscribe freebsd-security" in the body of > > > the message > > > > > > > > > > __________________________________________________ > > Do You Yahoo!? > > Bid and sell for free at http://auctions.yahoo.com > > > > > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > > with "unsubscribe freebsd-security" in the body of the message > > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?37BDC5B5.581082F7>