The curious case of the Raspberry Pi in the network closet (2019)

Re:The curious case of the Raspberry Pi in the network close... by more_corn on Monday January 17, 2022 @11:33AM (#29968280)

1) 802.1x certificate based network security (The MDM configures each approved network device with a certificate so rogue devices can't get on the network) 2) Periodic security review (look at attached network devices and determine an owner and purpose for each one). 3) Configure SIEM to alert on long-lived outbound connections.

[ Parent | on HN ]

Re:The curious case of the Raspberry Pi in the network close... by ianai on Monday January 17, 2022 @12:00PM (#29968611)

Can that (1) be done with windows/Mac clients?

[ Parent | on HN ]

Re:The curious case of the Raspberry Pi in the network close... by ianai on Monday January 17, 2022 @12:11PM (#29968768)

Answering myself: yes, is industry standard, definitely a little odd to not have it configured on a corporate network past a handful of employees.

[ Parent | on HN ]

Re:The curious case of the Raspberry Pi in the network close... by jaywalk on Monday January 17, 2022 @01:00PM (#29969406)

There's a decent amount of infrastructure involved in getting 802.1x authentication up and running in an efficient manner. While it does provide very good security, it's not widely used because of that.

[ Parent | on HN ]

Re:The curious case of the Raspberry Pi in the network close... by ianai on Monday January 17, 2022 @01:07PM (#29969491)

Any idea on a good, at-home or small network alternative?

[ Parent | on HN ]

Re:The curious case of the Raspberry Pi in the network close... by jaywalk on Monday January 17, 2022 @02:28PM (#29970700)

There really isn't one. 802.1x is the wired security standard, and almost never worth the hassle for home or small business networks unless you are really interested in learning the ins and outs.

[ Parent | on HN ]

Re:The curious case of the Raspberry Pi in the network close... by nitrogen on Monday January 17, 2022 @01:10PM (#29969549)

Having a list of allowed MAC addresses, enforced per-port by a managed switch (or at least by the DHCP server and router), is a first step, though naturally it's easy to spoof a MAC address.

[ Parent | on HN ]

Re:The curious case of the Raspberry Pi in the network close... by bigiain on Monday January 17, 2022 @07:33PM (#29973403)

> though naturally it's easy to spoof a MAC address.

I used to live in an apartment that was within high gain antenna range of the local McDonalds Free WiFi. I had a antenna/wifi adaptor set up in promiscuous mode to listen to all traffic on their network, looking for MAC addresses that connected for a while, then stopped connecting. It'd then switch to that MAC address and BitTorrent until the 500MB daily cap per device ran out, then go back to monitoring mode looking for someone else who'd agreed to the captive portal T&Cs had their MAC address whitelisted and then left. I think I got pretty much all of Game Of Thrones that way...

For a little while, I was monitoring my own home network, and one thing I tried was running map against any reconnection of a known/allowed MAC address, to try and confirm it at least looked like the same device. A RaspberryPi connecting using the MAC address of a phone or a MacBook stood out like a sore thumb. That never turned out useful enough for me to bother wrapping it up into a project I kept running or would have shared.

[ Parent | on HN ]

Re:The curious case of the Raspberry Pi in the network close... by jaywalk on Monday January 17, 2022 @02:32PM (#29970751)

MAC address filtering isn't a first step towards 802.1x, precisely because of the reason you mentioned. It's damn near pointless for all but the most basic security scenarios.

[ Parent | on HN ]

Re:The curious case of the Raspberry Pi in the network close... by nitrogen on Monday January 17, 2022 @03:17PM (#29971226)

Obviously it's not a first step toward certificates, but it is a first step away from "anyone can casually plug in a hidden Pi."

[ Parent | on HN ]

Re:The curious case of the Raspberry Pi in the network close... by genera1 on Monday January 17, 2022 @05:05PM (#29972204)

Anyone who knows how to setup that RPi to do anything meaningful knows how to spoof mac

[ Parent | on HN ]

Re:The curious case of the Raspberry Pi in the network close... by ianai on Monday January 17, 2022 @09:11PM (#29974141)

But would they be able to figure out a MAC to spoof without significant amounts of time in the data center/switch?

[ Parent | on HN ]