RE: [dhcwg] Security Issue about DHCP

-----Original Message-----
From: Hai Xu
Sent: Thursday, January 31, 2002 01:31

I'd like to know whether there are some mechanism to acchieve the following
issues with DHCP:

1. If illegal person set up another DHCP server. Clients will only select
the DHCP server who respond quickly. How to avoid the legal DHCP from being
disturbed by illegal server?

...while it is most common for DHCP clients to select the first server that
responds to a DHCPDISCOVER message, that behavior is not required by RFC
2132:  the client may use any method at its disposal to determine which
server to select.  For example, a client could insist that a DHCP server not
be on the same subnet as the client itself (useful if it is known that
legitimate DHCP servers are on a separate subnet accessible through a router
or relay agent).

RFC3118 specifies the client-server authentication protocol for DHCP:  one
of the stated purposes of this protocol is to prevent illegal DHCP servers
from interfering with the operation of clients.  I'll leave it to vendors to
identify products that implement RFC3118.

2. In an DHCP domain, clients can also configure themselves with static IP.
Can switches refuse those clients to work?

...if I understand your question correctly, to mean can various pieces of
network equipment be prevented from servicing clients who've statically
configured themselves with an IP address, the answer is no:  there is no
means to generally distinguish whether a client has been configured by a
DHCP server.

3. I've been told that DHCP could work with RADIUS to acchieve
authentication before allocating IP address. Are there any mature products
then?

...RADIUS could be used successfully to validate a user (its most common
application) and probably validate a client as well, but I'll leave it to
vendors to reply to this question.

--Barr

_______________________________________________
dhcwg mailing list
dhcwg@ietf.org
https://www1.ietf.org/mailman/listinfo/dhcwg