Always on needs locked, Lan to net conection, remote access too

canton_kid · Post by **canton_kid** » Wed Jan 05, 2005 3:25 am

I am gonna start using my office again. Haven't been there much since about last may

SO, my office is setup in an open room in the back of the ISP and I have a lan connection direct to the net servers there. What I want to do is leave my system running so I can connect through the net to it, also run programs like bidding stuff for ebay. Just rented a large Rock house and won't have net service at home (there) for a long time I think. So I need to set it up at the office and let it run while I am away, and also connect to it from my regular house where I do have modem connection to the net.

Since this is an unsecured area and just anyone can walk by at anytime basically what are my best options to keep the quicky novice types out of the system. Mostly kids and snoops poking around, I actually am not worried about anyone around there being smart enough to actually break/hack into it. Those that are smart enough to know how also know it's not got anything worth messing with in it anyway and wouldn't waste their time

I thought about password locked screen saver, wireless keyboard and mouse (locked in cabnet when I leave) and the system has one of those cheapy plastic doors with a lock, they would have to break something to get it open in order to get to the reset buttons etc... and they wouldn't go to that trouble.

Mostly the people I would be worried about messing with it are just the nosey types that if they got in wiggling a mouse and pressing a few keys they would poke around dinking with things but that's about all they would "Probably " try. Though we had one "DORK" hanging around that bragged alot about hacking into stuff alot, I think he was all smoke though. He was all excited once about a program he found for hacking into something (forgot what BBS maybe). I knew of that program in 1999 myself and I am not even a real hacker in that sence

The other thing is the lan connection to the net. This is a biggie here. I have Tiny firewall installed and it pops up all the time with connection attemps. I will also want to play with WIFI again soon. The rock house I rented is longdistance to the ISP, so even if I got a phone I still have to go to a different ISP that's looking close to $40 a month here (crappy service too). If I can get over the trees and hills I might be able to shoot the distance from ISP to Rock house with Wifi, if so I have 2 other people I could provide service to already.

Since my WIFI router will be on a wired connection to the ISP servers, I am thinking my systems are out of the picture basically. The incomming wireless will go directly to the ISP servers, so whats the danger of system hacks?? Same as coming off the wired connection? At the office I will have my system on wires to the wifi router, and at home not sure if I will run the wire or mount the router near the external anntena and shoot wifi to it also myself.

The ISP was going to put in wireless over a year ago, but nothing ever came of it, so I may take that area over myself if I get mine working. They're problem was lazy help basically just never doing anything, just bench work stuff, I want this out to both my houses myself though!!

I have a linksys G router, I think what they had was Buffalo G routers. They have some anntennas (Short range basically) So I may do a couple hops to get over a hill if I need to with my longe range Anntena's.
What's the best security options now for wifi (preferrably free). Just upgrade to new firmware and use WEP? Use Mac addressing etc...
Anything I specaill I need to worry about with the wired systems on the same wifi routers?

I learned a ton on all this WIFI around a year ago, but since the ISP was supposed to go WIFI I didn't do anything with it, know I forgot about half or more what I had figured out.

Starting over is so much fun

Post by **FlyingPenguin** » Wed Jan 05, 2005 9:22 am

If it's WinXP then just password protect the user accounts (don't forget to password protect the admin account or they can just reboot into safemode and get in).

Setup your screen saver for password lockout BUT don't rely on it. Screen savers don't always kick on reliably. ALWAYS lock the system when you leave (disable the stupid XP Welcome Screen and just CTRL+ALT+DEL then click on "Lock Computer").

Busby · Post by **Busby** » Wed Jan 05, 2005 10:26 am

Or for a quick way to lock the computer press the Start/Windows key and L and it will lock the computer.

As for wireless security, WEP generally slows down a system and will not achieve maximum throughput. MAC Filtering is always an option on either the gateway or for a physical DHCP server. People may be able to attach but it won't do much good since their MAC ID isn't allowed to do anything. Also, disabling SSID broadcast cuts down on the casual leecher. I know if I don't see a SSID then I just don't attach to anybody's network.

Post by **FlyingPenguin** » Wed Jan 05, 2005 6:02 pm

NICE BUSBY! Never knew about that one.

canton_kid · Post by **canton_kid** » Wed Jan 05, 2005 7:49 pm

Ok.
With XP I can lock the system, how about with 2K pro? Same thing? Tried the Ctrl Alt Delete and it has the lock computer option, can't get the Windows Start L thing to work yet though.
I had never actually noticed the lock in 2K before since I never needed it for anything. So this should keep the average snoops at bay and still provide full function of the system remotely for me?

A question on this then is how does that work with the monitor when I log in remotely? WIll it still have the screen saver or LOCK display locally or will it work as if I was running locally and show everything I am doing on the local monitor too??

When I was going to do this before I downloaded a remote program that was recomended for this, but then never got it working as plans changed back then. Not sure the name on it, Does VNC sound correct?

Thanks for the info's. The casaul leecher I am not all that concerned about really, it's mostly I don't want to find my system has been hacked and reformatted overnight or something! Also since I am thinking of running remotely system to system over the WIFI (if it works) security in passwords for things like my e-mail accounts, E-bay, Paypal, online shopping like Newegg etc.. are a major concern too.

If some-one breaks into the system and downloads a few songs from P2P or something ain't too bad, though I'd like to avoid that also.

Post by **FlyingPenguin** » Wed Jan 05, 2005 8:16 pm

Yes, works the same in 2K except for the Windows Key+L shortcut.

As long as your remote software is configured to "Run as a service" (the default setting for VNC and PCAnywhere) then even if the system is locked you'll be able to access it. You will have to log on and type your password as if you were there.

I would recommend configuring your remote access software to blank the local monitor while it's being remotely accessed (PCAnywhere can do this - not sure about VNC).

Always remember to lock the computer when you finish a remote session (your remote software will have a method to send a CTRL+ALT+DEL so you can lock it).

Be advised, if you're behind a router then you need to configure port forwarding on the router. That will require that you configure the workstation for a static IP on the LAN and (for VNC) forward port number 5900 to it.

canton_kid · Post by **canton_kid** » Thu Jan 06, 2005 3:51 am

I just got the wireless working at house 1 again now, hadn't been using it, just wired.
So with VNC blank the monitor and pass the port. Now probably a silly question, if I log in remotely and some-one were poking around the office, will the keyboard/mouse be dead, and monitor stay blanked. Is the system still locked locally?
Or if say the wife were accessing the system remotely, and I were at the office, could we do both at the same time? I dought that would happen, wondering though. Her logged in remotely as her account and me locally as the administrator account?

I'll be working on this alot over the next week. Most likely set up the systems at home and get them working in the same room then take one to the office. That's a kinda big problem when you don't know what your doing and the systems are far apart, can't see both at the same time.

I wonder how they ever got radio to work?? How did they actually KNOW if the transmitter was not sending correctly or if the receiver was not receiveing??

Post by **FlyingPenguin** » Thu Jan 06, 2005 8:46 am

I don't think VNC is that sophisticated. There are other versions that might have the ability to lock the keyboard and blank the monitor. For instance TightVNC.

I know PCAnywhere will lock the disktop while it's being remoted, but that's not a free app.

Busby · Post by **Busby** » Thu Jan 06, 2005 5:11 pm

VNC can lock the keyboard and mouse locally if I remember correctly. However, only one person at a time can control it and if you try to do local + remote at the same time it doesn't work well. It's not a virtual desktop space. You could try different users running VNC servers as a user on different ports.

canton_kid · Post by **canton_kid** » Fri Jan 07, 2005 8:26 am

I installed tight VNC and got it working, was using it at home last night on the local network.
Should do me ok, I may need to look for something else though too. Don't think I like the idea any one could be looking at my monitor at the office and watch me what I am doing. I don't think it's that big a worry really, but still don't like the idea.

It does lock the local keyboard mouse well and resets to locked on last users logoff as opitons.

MegaVectra · Post by **MegaVectra** » Wed Jan 26, 2005 12:15 am

Originally posted by Busby
As for wireless security, WEP generally slows down a system and will not achieve maximum throughput. MAC Filtering is always an option on either the gateway or for a physical DHCP server. People may be able to attach but it won't do much good since their MAC ID isn't allowed to do anything. Also, disabling SSID broadcast cuts down on the casual leecher. I know if I don't see a SSID then I just don't attach to anybody's network.

Nice tip, Thanks!

Pages load a little quicker now.

MegaVectra · Post by **MegaVectra** » Wed Jan 26, 2005 9:37 am

Busby, what's to keep someone from spoofing a MAC?

http://www.klcconsulting.net/smac/#Download

TheManiacal1 · Post by **TheManiacal1** » Mon Mar 14, 2005 1:03 pm

there is nothing to keep from MAC spoofing. anyone snorting the air can probably find out any and all active MAC addresses in their snort-able area. there are a few ways to try to avoid this:

1) use 802.11a equipment... yuck, i know... but there's far less support for it
2) decrease the power of your wlan equipment to limit the physical area that it can tranceive to/from
3) use alternate IP addressing schemes, elminate any standard routing between subnets, and require VPN connections (PITA to configure IMO, but it works)

if you like tightVNC, you might want to give UltraVNC a shot as well. if you're running a windows network, you can enforce directory authentication. works more securely than just single password authentication.

b-man1 · Post by **b-man1** » Mon Mar 14, 2005 1:26 pm

set up IPSec between the two pcs via VPN...beyond something like that, if the people are that good they are going to get your data anyway.