12: Securing a Wireless Network in Objective-C

Drawer ECC200 in Objective-C 12: Securing a Wireless Network

NOTE: 802.1x is a highly secure wireless protocol typically found in larger network infrastructures. If your network can leverage this technology, check out our section on integrating 802.1x into your environment in 10.

Over the years, Apple has released a variety of products in its family of WAPs, typically referred to as Apple AirPorts (see Table 12 1).

AirPort (graphite) AirPort Extreme (snow)

The original gray AirPort. This AirPort ran at 802.11b. This AirPort ran at 802.11g and included a pair of Ethernet interfaces (one LAN and one WAN) and a USB port for printer sharing across a network. This is the first device Apple released with the ability to communicate with audio equipment. The AirPort Express has only one network connection and is limited to ten users, making it perfect for a home or small office. This square white AirPort is the latest and greatest. It incorporates the newest 802.11 protocol, 802.11n, and also facilitates file sharing for smaller networks.

AirPort Extreme (N)

The AirPort supports a variety of encryption protocols that can be used to secure the wireless network. Encryption protocols that are specific to wireless networking include the following: WPA2: Also known as 802.11i, WPA2 uses the AES block cipher to make cracking keys difficult. Unless you have a RADIUS server, WPA2 is the best form of encryption to use on an AirPort with Apple clients. WPA2 Enterprise: Similar to WPA2 in supported encryption standards, WPA2 Enterprise also adds support for usernames, which can be obtained using a RADIUS server, such as FreeRadius, Mac OS X 10.5 or 10.6 Server, and Microsoft Windows Active Directory servers. WEP: This is the weakest of the security features supported by Apple AirPort. Windows computers need to use the hex equivalent to log into the network. This can be found using the Equivalent Network Password option in the Edit menu of the AirPort Utility or AirPort Admin Utility.

The Apple AirPort devices were designed to be easy to use. In many environments, the Apple AirPort will work right out of the box. However convenient this may be, the default settings are widely known, so an AirPort left with the default settings running represents a considerable security risk for any network. TIP: AirPorts do not always need an Ethernet cable connection to become part of the network. If there are other AirPorts on the network, it is possible to use the wireless network of an existing AirPort network as the network connection that the AirPort will use. This is what is known as a wireless distribution system (WDS) cloud. A WDS network can allow you to extend a wireless network for great distances, and create a wireless network that goes far beyond the 300-foot limitation documented by Apple.

The first generation of Apple AirPorts, the AirPort (graphite), the AirPort Extreme (snow), and the AirPort Express, shipped with the AirPort Admin Utility. To configure an AirPort using the AirPort Admin Utility, open the application from /Applications/Utilities, and select the AirPort to configure from the list of AirPorts the computer can detect (see Figure 12 1).

To add basic security using the AirPort Admin Utility, start by entering the appropriate contact information in the fields supplied (see Figure 12 2).

The most important setting to change on the older AirPorts is the password to configure the device. The default password for an AirPort base station is public, and it is fairly common for users to leave the password set to this. You should always change this by clicking the Change Password button and entering a new one. To set the form of encryption on an Apple AirPort using the AirPort Admin Utility, click the Wireless Options button. On the next screen (shown in Figure 12 3), select the form of security you want using the Wireless Security option. Then enter the password and click OK. NOTE: If you are changing the form of encryption on a network with WDS enabled, you will likely break the WDS network and need to set it up again. The WDS protocol requires all AirPorts to use the same security settings.