Re: DHCP and secondaries

[Mike Carney - Sun BOS Software <[e-mail]>]

> >  I would like to require that the
> > users of our dhcp service register the hardware addresses
> > of their NIC cards before the server allows the client to
> > be services from either an automatic or dynamic pool.
> 
> I'd be curious to know why.  The authentication proposal
> you mention allows clients to be assured that the DHCP
> responses are from legitimate servers.  However, if a 
> server refuses to serve a particular client, that client
> can still commandeer an IP address that the server "owns."
> If a rogue client has physical access to the lan, there's 
> really no way to prevent it from claiming addresses from
> either one of your address pools.  (Oh, perhaps with a sniffer 
> or similar tool you can detect the rogue and on TR send it 
> KILL frames or some such.  There's also been talk
> about how to manage this problem with internal fire walls,
> but those are all ways to react to the problem, not how
> to prevent it.)
> 
> Are you assuming a physically secure lan, and a group of
> users who all "play nice" together?  If so, I can see how
> the registration might be useful for accounting and other
> administrivia.
> 
> Edie
> 

Hi Edie,

        I feel the same way about DHCP authentication. Without link-level 
(or IP level (SKIP)) security, anyone can connect to your lan, and snoop to 
discover the network address and subnetmask, then use arp to find one not 
in use. You could even snoop for DHCP packets, and find out about name 
services, etc.

        The only way DHCP could have strong authentication would be to add 
a public key/secret key arrangement, which would require the secret key to 
be stored on the client. Anytime you have to store IP configuration info on 
the client (even the secret key), you lose, since the whole idea of DHCP is 
to provide a central store for this information.

        Using SKIP or link-level security is the only way to protect your 
data and your network, since it's all encrypted.
Mike Carney
SunSoft PC Networking
Chelmsford, MA