Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have configured a DHCP server on Linux. My goal is to map client IP address with their MAC address in such a way that no "unregistered" client machine gets a response from the DHCP server. That is, I would like to give them Internet access one by one through IP and MAC binding.

share|improve this question
2  
Please clarify: are you saying that you want your DHCP server to only answer requests from clients with known MAC addresses? Do you need this to work with ISC dhcpd (shipped with RHEL), or are you willing to try a third-party server if that's what's needed to make this work? Also, why are you doing this? If it's for security, it's not going to help much; it's way too easy to defeat. –  Warren Young Dec 9 '10 at 7:30
1  
@Warren: considering user2914's posting history, this is homework. @user2914: Homework questions are ok here (at least they're ok on Stack Overflow and I don't see why this site should be different), but you shouldn't try to hide it, that won't help you get better replies (it's usually obvious anyway and seeing that you tried to hide it makes people less willing to help you). –  Gilles Dec 9 '10 at 18:32
    
@Warren Young My main purpose is to map client IP address with their MAC address in such a way that no client machine get IP from DHCP server. this means that I would like to give them Internet access one by one through IP and MAC binding. Moreover, without mac binding no system should get IP from DHCP server. The client machine whose MAC address is not enterd in server, should not get ip address from DHCP server. So how can I implement this in Linux (RHEL 5 ) machine? –  user2914 Jan 19 '11 at 0:50

2 Answers 2

As noted by Warren and Shawn, your question seems to imply that preventing address assignment to unregistered machines is intended to keep them off the net.

You cannot increase security this way as an machine can either:

  1. find a "trusted" MAC address and pretend to have that MAC to get an IP address from the DHCP server, or
  2. Just pick its own IP address and skip DHCP completely

More generally, you cannot enforce exclusion at the IP layer as it has no mechanism designed to do this. If you really need to enforce exclusion at the Internet Layer you need to use something like IPSec which is far more complicated than DHCP.

Far more common is to secure access at the Session Layer or above; for example SSH.

share|improve this answer
    
I worked in a place where this policy was mandated for about 50 machines and the IP addresses were "managed" with a spreadsheet. I can't even being to describe what a clusterf*ck it was. ++ msm for giving The Right Answer. –  kce May 16 '11 at 21:43

The dhcp.conf file has the ability to specify group parameters. In this group you can specify specific hardware addresses.

From the man page:

group {
  filename "Xncd19r";
  next-server ncd-booter;
  host ncd1 { hardware ethernet 0:c0:c3:49:2b:57; }
  host ncd4 { hardware ethernet 0:c0:c3:80:fc:32; }
  host ncd8 { hardware ethernet 0:c0:c3:22:46:81; }
}
share|improve this answer
    
Hi Shawn J. Goff, please I have clarify my problem in "2 Answer" PLZ check it and let me know?? –  user2914 Dec 9 '10 at 12:45
1  
@user2914: If you learn anything here, learn to read a man page. The answer to your question is in the paragraph just below the example Shawn quoted. –  Gilles Dec 9 '10 at 18:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.