bind the MAC with IP address?

Question

I have configured a DHCP server on Linux. My goal is to map client IP address with their MAC address in such a way that no "unregistered" client machine gets a response from the DHCP server. That is, I would like to give them Internet access one by one through IP and MAC binding.

Answer 1

As noted by Warren and Shawn, your question seems to imply that preventing address assignment to unregistered machines is intended to keep them off the net.

You cannot increase security this way as an machine can either:

1. find a "trusted" MAC address and pretend to have that MAC to get an IP address from the DHCP server, or
2. Just pick its own IP address and skip DHCP completely

More generally, you cannot enforce exclusion at the IP layer as it has no mechanism designed to do this. If you really need to enforce exclusion at the Internet Layer you need to use something like IPSec which is far more complicated than DHCP.

Far more common is to secure access at the Session Layer or above; for example SSH.

Answer 2

The dhcp.conf file has the ability to specify group parameters. In this group you can specify specific hardware addresses.

From the man page:

group {
  filename "Xncd19r";
  next-server ncd-booter;
  host ncd1 { hardware ethernet 0:c0:c3:49:2b:57; }
  host ncd4 { hardware ethernet 0:c0:c3:80:fc:32; }
  host ncd8 { hardware ethernet 0:c0:c3:22:46:81; }
}