Wireless Authentication

[codecref]

Hi guys
I basically try to establish a very small ISP for my own area which there's no Broadband internet and only modem access.

I have advantage of being on the montain with at least 200 meters of height and the tower with 21 levels (about 95 metters) tall and I have very wide coverage and clear line of sight to 20 KM distance (I am living in Kuala lumpur)

there's many issues that I am concern to setup my Redhat linux server.

here's some info about the Wireless Client Bridge that my clients will use:

-Using 802.11b or 802.11g
-Support Radius and WPA, WEP, WKIP
-Support MAC address cloning on both wireless and Ethernet port
-Provide WDS (talk to other APs to improve my coverage)
-Ethernet Port and web-based configuration.

My plan is to give 24/7 connected access to internet but I want my clients do LESS possible configuration setup (which means less headache for me in technical support), I am not really interested in 802.1x authentication but I've installed my FreeRADIUS on my redhat but do not even know how to test it.

so my questions are in this line:
-If I use Web-Based authentication the connection won't disable after client close Internet Explorer Window? if it does how to avoid it?

-Whats the best way to check if its a real user or he just hijack someone else MAC and IP address? best solution? for that instance I have plan to put this as a policy that client must not turn off the bridge (and I plan to install it directly to powerline) but I know it is not best idea.

-Is it reliable to use SSL as encryption for password transmission ? is there any hack or crack for it out there?

-Is it a good idea to make a third party encryption software running on windows and disable WEP, which this software will change key from a CD given to each client every minutes or house or day and will have different key set for each client generated by computer and also server will have a copy of it to decrypt, and also this software will do the authentication?

Please shoot whatever idea you have.
your help is highly appreciated

Seyed.

 

[ericbrunson]

Hmmmm, interesting problem...

Here's some thoughts:

a) SSL is weak
b) 40 bit WEP is weak and can be circumvented, 128 bit WEP is better, but I'm don't know enough about it to be able to recommend it
c) MACs can be snooped and cloned

The most secure solution I can think of is to use VPN clients to make a connection from the remote site to some machine on the other side of your access point, then route from there.

 

[codecref]

Thanks for you reply

- How about third party software I can make by own and change the key frequently just like I mentioned already and each user will have seperate keys and servers will have the copy of that and will decrypt them by key id based on either time or traffic transmission?

- What about Web-Based Logins? is it gonna still work after closing IE?

Thanks again

 

[ericbrunson]

IPSec VPN software would be exactly what you describe.

I don't know anything about web based logins.

 

[DeepWoods]

You might take a look at

http://nocat.net/wiki/

and see if it might be what you're looking for. Also, here's a howto to make you're own AP with RH9.

http://oob.freeshell.org/nzwireless/LWAP-HOWTO.html

It lacks a little to be finished but it should get you started if that's the route you choose. Good luck and let us know how it turns out?

Rob