thelinuxlink.net

I am looking for some advice from some of you guys. I have decided to get into this century and go wireless in my home. I am tired of being restricted on my laptop. Running Kubuntu Edgy on the laptop Kubuntu on a P4, and Slackware on a P111. Any suggestions on wireless routers and cards that work well on Linux? I will be checking out the HCL, but I was looking for some of the suggestions on what you are using and any issues that you have come across.

Also, I am not much of a security expert, are there any articles or how-tos for wireless security that anyone can point me to. Any help would be appreciated.

shopRatt wrote:I am looking for some advice from some of you guys. I have decided to get into this century and go wireless in my home. I am tired of being restricted on my laptop. Running Kubuntu Edgy on the laptop Kubuntu on a P4, and Slackware on a P111. Any suggestions on wireless routers and cards that work well on Linux? I will be checking out the HCL, but I was looking for some of the suggestions on what you are using and any issues that you have come across.

Also, I am not much of a security expert, are there any articles or how-tos for wireless security that anyone can point me to. Any help would be appreciated.

Any wireless router or access point should work fine. Try and get a network card that uses the prism chipset as opposed to the broadcom one, however, I hear that most broadcom will work with the NDISWrapper. As for wireless security, it depends on how far you want to take things. The only thing I do is use mac address filtering, and I have never had a problem. Other people suggest varying degrees of encryption, but as far as I am concerned, that just slows things down

shopRatt wrote:Any suggestions on wireless routers and cards that work well on Linux? I will be checking out the HCL, but I was looking for some of the suggestions on what you are using and any issues that you have come across.

This is where we turn to the OpenBSD guys, they're experts in this area!
I would say you can't go wrong if you can find a card that uses an Ralink chipset, because they not only have released free drivers, they have also given out documentation to folks like the OpenBSD developers (Without NDA!). However, the drivers for cards based on the latest chipset from Ralink (RT2600) are still beta quality as far as I know, however the previous one (RT2500) should be usable.

The Atheros chipset is a solid chipset, really good, and there are efforts to port OpenBSD's OpenHAL to be usable with the Linux Madwifi drivers, however it currently only works with an older version of Madwifi. Just so you know (The following is only for informational purposes, not an "endorsement" on my part), Madwifi by default uses a binary-blob HAL (hardware abstraction layer).

If you want an Atheros-based card, a D-Link AirPlus Xtreme G DWL G650 (PCMCIA) and D-Link AirPlus Xtreme G DWL G520 (PCI) are good choices. Since I don't use WiFi I can't tell you whether this would work with OpenHAL under Linux.

shopRatt wrote:Also, I am not much of a security expert, are there any articles or how-tos for wireless security that anyone can point me to. Any help would be appreciated.

I'm fairly good at this stuff. WPA encryption with a good passphrase (And that's key!) is pretty much a silver bullet on this. WPA using TKIP (Which uses RC4, and does it the right way) is not very burdensome on your system, especially on newer systems. With WPA you can also use AES encryption, however that is pretty hairy-ass encryption, and that can put some load on your CPU.

I'm personally extremely paranoid about security (You should know from my signature, I use OpenBSD, darn it!), so what I would do if I were to get WiFi is to build my own router, divide my network into zones, and put a WiFi access point into a zone from where NOTHING can either access my own internal network nor access the internet, the only thing somebody would be able to do is use VPN to log into my network and then you're, this is after authenticating with WPA with a Steve Gibson-style passphrase (http://grc.com/pass. But that's just my absolutely insane, totally over the top, extreme paranoid method, but I thought I'd throw this in here to scare the cheese out of you!!

Linc wrote:Any wireless router or access point should work fine.

Definitely, because the router, unless it's using some proprietary WiFi protocol, is using a standard communication protocol, the weak-point is the wireless network adapter.

Linc wrote:Try and get a network card that uses the prism chipset as opposed to the broadcom one, however, I hear that most broadcom will work with the NDISWrapper.

Prism is kind of old these days, should work OK, but it's really really outdated, which means it's range is smaller and the speed is only 11mbit at peak.

Linc wrote:As for wireless security, it depends on how far you want to take things. The only thing I do is use mac address filtering, and I have never had a problem.

Linc, this is in no way meant to mock you (Please don't take this as an offense), but I only need to sniff (Ethereal! ) a single packet going across your wireless network to be able to get around your MAC filtering by spoofing your MAC addresses. This is the case because the MAC address of the machine sending a packet out on the network sits in the top of every network packet, this is needed so that the bottom layer of the networking stack knows where to send stuff to, because Internet Protocol (IP) packets is a layer above the MAC address, which is the physical, ethernet adapter address on the LAN network.
MAC address can be used for like preventing your neighbor from casually joining your network (Windows will connect to the nearest network it can find, and sometimes that's not one's own network), but if you want security with WiFi, then you absolutely cannot depend on MAC address filtering to keep people off, and it would be very very possible for me to sniff your traffic and potentially capture passwords etc. unless you used a solid encryption like WPA, and WEP is not even a very good option, it's just so broken, takes freaking 10 mins. to crack!! Even less if we're talking about a network where one is like watching a YouTube video, which does generate quite a lot of packets to attack.

Linc wrote:Other people suggest varying degrees of encryption, but as far as I am concerned, that just slows things down

As far as I know, unless you have a really really really old router, and a really dusty WiFi card, encryption doesn't produce any noticeable overhead, at all. It's like trying to add more RAM after you already have 8 GBs

I'd have to side with Thor on this one, securitywise. MAC filtering is only good enough to keep total amateurs off your network, and everything is still transferred in the clear. WPA2 is probably "good enough" - especially if this is mostly going to be a surfing access point. Always remember to evaluate risk when looking at security - if your risk is that some d00d/ch1x0r migt steal a little of your throughput and sniff your TLLTS traffic, then you're probably cool with whatever. If your risk is medical records and CC#s, you probably need to be a little more paranoid.

As far as your WAP goes, the old standby is the Linksys wrt54g since it's totally hackable. You can install several linuxy firmwares on it, but the popular standard at this point it OpenWRT. They are solid, cheap, and fun to hack on. What more could you ask for?

Snarkout wrote:I'd have to side with Thor on this one, securitywise.

THOU SHALL NOT DISHONOR THE HAMMER OF THOR!!!

Snarkout wrote:MAC filtering is only good enough to keep total amateurs off your network, and everything is still transferred in the clear.

Well, one could do MAC address filtering in addition to encryption, but it's like putting handcuffs on somebody and putting the key right in front of them, for them to grab and use.

Snarkout wrote:WPA2 is probably "good enough" - especially if this is mostly going to be a surfing access point.

Dude, WPA is really kick-ass security!
So far the only way to defeat it is through a dictionary (Which is why it's important not to use a password like Dann's (Which would be "allansass") ), a brute-force (Would take YEEEAARSSS!!!) or like a rainbow-table attack.

Snarkout wrote:Always remember to evaluate risk when looking at security - if your risk is that some d00d/ch1x0r migt steal a little of your throughput and sniff your TLLTS traffic, then you're probably cool with whatever. If your risk is medical records and CC#s, you probably need to be a little more paranoid.

I think in general it's good to have good security, because you just never know if you make a mistake by accident, or for some other reason sending sensitive data over an insecure network, that any 13-year old 1337h4x0r moron could sniff.

Snarkout wrote:As far as your WAP goes, the old standby is the Linksys wrt54g since it's totally hackable. You can install several linuxy firmwares on it, but the popular standard at this point it OpenWRT. They are solid, cheap, and fun to hack on. What more could you ask for?

This is a very good idea, DD-WRT should also be good (So I hear). Remember to get the WRT54GL model, which you can be absolutely sure will have Linux in it, because it's explicitly made for us geeks/hackers to tinker with (Thank you Linksys).