securing wifi suggestions

graysky · 2012-03-02 13:52:44

Been doing some reading about wifi security and wanted to calibrate here with some knowledgeable users. What are best practices for securing a home wifi network?

From what I have read, best practices:
*WPA2/personal with AES encryption.
*Use a strong (mixed alpha/num/sym) 63 character password.
*Use a strong (mixed alpha/num/sym) 63 character SSID. Why? My understanding is that the SSID is used as a component to generate key hashes used for handshakes. Therefore, using a common SSID could mean that there is a set of rainbow tables build off that specific SIDD.

False sense of securities include:
*MAC filtering.
*SSID hiding which is actually a security risk since every device connected to the network will basically scream out 'here I am... where is SSID xxx' when not connected.
*WEP-based encryption.

Last edited by graysky (2012-03-02 14:52:54)

.:B:. · 2012-03-02 14:13:59

As far as wireless itself, there's nothing more you can do besides WPA2. Hidden SSIDs are bogus security measures, MAC filtering easily circumventable. You might even enjoy implementing your own radius server, just for kicks.

For further security you might consider using SSH, HTTPS where possible and VPN connections.

graysky · 2012-03-02 14:19:31

@b - thanks for the reply. the only use of wifi I am considering is for smartphones to access:

1) the internet
2) my mpd server

.:B:. · 2012-03-02 20:33:01

It all boils down to how paranoid you are.

You might want to create a locked down guest network for the smartphones, if you don't want to mess with random 63 char keys .

/dev/zero · 2012-03-02 20:37:10

graysky wrote:

*Use a strong (mixed alpha/num/sym) 63 character password.

I was under the impression it should be four or five words randomly generated out of a dictionary (such as /usr/share/dict/cracklib-small); for so it is written in the gospel according to xkcd.

cfr · 2012-03-03 00:11:10

It's also a balance of security, convenience and whatever else. 63 character random keys and ssids are all very well but I would find them excruciating, error prone and probably end up abandoning any sort of security. Plus I would not wish to be a guest user of somebody whose network used this policy!

I do use WPA2, though. That's easy, much better than WEP. I used to "hide" the network but I don't now - partly for convenience reasons, partly security. (Such networks seem to play poorly with linux...) I use MAC filtering. Sure, it can be spoofed. But it is another step somebody has to take. There are plenty of less secure home networks around me so I figure there are easier pickings. If somebody is determined to target mine for some reason, I am sure they will manage to do so - but I think they will do this no matter how secure I make it since wifi can only ever be so secure.

Maybe I am just not sufficiently paranoid. Of course, if I was a secret agent or something, I'd be rather more concerned. But then I'd probably not be trusting the security of any wireless network. In that case, I'd expect to be targeted by people prepared to make extra efforts to hack my home lan specifically...

.:B:. · 2012-03-03 14:27:35

cfr wrote:

It's also a balance of security, convenience and whatever else. 63 character random keys and ssids are all very well but I would find them excruciating, error prone and probably end up abandoning any sort of security. Plus I would not wish to be a guest user of somebody whose network used this policy!

That's why you'd set up a second SSID for guest users.

And you have no right to complain about a complex WPA key if you use MAC filtering... I'd rather prefer to have to type in a random key than to have the network owner go add my MAC address to his whitelist and restart his wireless.

Last edited by .:B:. (2012-03-03 14:29:42)

KingX · 2012-03-03 16:37:49

Just curious, I use MAC filtering also, where only the mac addresses on the list are allowed to connect to my router. How is it easily circumventable? Is there something that gives it away that the router is using MAC filtering?

hokasch · 2012-03-03 17:51:36

Is there something that gives it away that the router is using MAC filtering?

Not that I'm aware of, but it is trivial enough to capture connected MAC's and change yours accordingly.

.:B:. · 2012-03-03 18:03:26

Yep. MAC addresses just show up when you run wireshark to capture traffic.

Šaran · 2012-03-04 10:22:55

I'm using WPA2 with TKIP+AES encryption and 10 char passphrase, but I will probably switch to radius authentication with seperate and completely isolated psk secured wlan for guests just for fun (router plays nicely with dd-wrt and openwrt).

LoBo3268715 · 2012-03-04 13:27:23

Use WPA2, DHCP reservation and configure your DHCP server to only give out as many IPs as needed. Also make sure to tweak the power settings for your routers antenna so you're not broadcasting to the entire neighborhood and check your router logs from time to time.

Last edited by LoBo3268715 (2012-03-04 13:28:39)

graysky · 2012-03-04 13:36:27

LoBo3268715 wrote:

Also make sure to tweak the power settings for your routers antenna so you're not broadcasting to the entire neighborhood and check your router logs from time to time.

I'm running tomatousb - any ideas what variables to tweak and recommended sane values are for the power settings to which you refer?

stealthy · 2012-03-04 14:46:07

You can turn off the DHCP server, which makes it a pain for somebody thats already in (I audit my networks a little)

I'm not claiming this will stop anybody either.

Also, I don't know too much about it, but RADIUS, or WPA2/Enterprise should help too, instead of using PSK (pre shared key, which things like airodump-ng/aireplay-ng/pyrit, use to crack networks)

Last edited by stealthy (2012-03-04 14:49:15)

Mr.Elendig · 2012-03-04 14:50:03

Put a firewall between the wifi and your lan. Use vpn to access the lan.

Last edited by Mr.Elendig (2012-03-04 14:50:30)

LoBo3268715 · 2012-03-04 15:54:01

graysky wrote:

LoBo3268715 wrote:
Also make sure to tweak the power settings for your routers antenna so you're not broadcasting to the entire neighborhood and check your router logs from time to time.
I'm running tomatousb - any ideas what variables to tweak and recommended sane values are for the power settings to which you refer?

I'm sorry but I have no experience with tomatousb you may just have to experiment with power levels until you find the appropriate values for your needs. After some quick digging I found this, scroll down to transmit power. http://tomatousb.org/settings:wireless#toc19

pigiron · 2012-03-05 21:11:20

cfr wrote:

63 character random keys and ssids are all very well but I would find them excruciating, error prone and probably end up abandoning any sort of security.

Call me paranoid, but when I need to create a password for something valuable (like a router), I use a utility created many moons ago by a Gentoo developer:

http://swift.siphos.be/tools-hex2passwd.html

This allows me to only need to remember a super simple word/phrase, but create (and most importantly, recreate) a fairly strong password... while still causing someone on a semi-compromised system some difficulty to recreate even if they found the hex2passwd utility on the box.

I also added the following to my BASH profile:

export HISTCONTROL=ignoreboth

so that when I need to create/recreate a password using the utility, I simply add a space at the beginning of the command line so it won't end up in my BASH history.

It's not a perfect method... but what is?

OBTW: The hex2passwd utility is in the AUR.

tl;dr story...

I set up my neighbor's box so that he could log into my wireless router (he's unemployed) that uses one of these insanely long passwords. Sometime later he tells me a story about how he let a friend try to (manually) copy the password so that she could log her laptop into my router to surf the web during her visit.

While I was somewhat upset that he let her do that, he said he was sure that she never would be able to copy it correctly because it was so damn long and bizarre... and with a big grin, he said he was right.

Arch Linux

#1 2012-03-02 13:52:44

securing wifi suggestions

#2 2012-03-02 14:13:59

Re: securing wifi suggestions

#3 2012-03-02 14:19:31

Re: securing wifi suggestions

#4 2012-03-02 20:33:01

Re: securing wifi suggestions

#5 2012-03-02 20:37:10

Re: securing wifi suggestions

#6 2012-03-03 00:11:10

Re: securing wifi suggestions

#7 2012-03-03 14:27:35

Re: securing wifi suggestions

#8 2012-03-03 16:37:49

Re: securing wifi suggestions

#9 2012-03-03 17:51:36

Re: securing wifi suggestions

#10 2012-03-03 18:03:26

Re: securing wifi suggestions

#11 2012-03-04 10:22:55

Re: securing wifi suggestions

#12 2012-03-04 13:27:23

Re: securing wifi suggestions

#13 2012-03-04 13:36:27

Re: securing wifi suggestions

#14 2012-03-04 14:46:07

Re: securing wifi suggestions

#15 2012-03-04 14:50:03

Re: securing wifi suggestions

#16 2012-03-04 15:54:01

Re: securing wifi suggestions

#17 2012-03-05 21:11:20

Re: securing wifi suggestions

Board footer