Re: RFC: standardized network provisioning

[Dan Williams <dcbw redhat com>]

On Thu, 2014-06-12 at 23:22 +0200, Mark Elkins wrote:
> I hear that the latest Apple IOS uses a random MAC address when scanning
> local wifi hotspots - so "people" can not track the device so easily...
> seems like a good addition.
>
> It would also be interesting if I could automatically change my MAC
> address every so many configurable minutes - both on wifi and wired
> interfaces... a bit like I can do with my IPv6 address...

We've been discussing this upstream with kernel developers too.  The
short answer is that yes, it can happen, but it'll take some work in the
kernel and wpa_supplicant to make that happen.  Once that's done,
NetworkManager can use it.

Note that this behavior is only for randomized MAC addresses when
*scanning*.  The device must still use a stable MAC address when it
connects to a network, and that address cannot change during the
connection without breaking the connection entirely and reconnecting.
And that wouldn't work well for hotspots, since they often cache your
"logged-in" status based on your MAC address.  For wired it would
probably greatly confuse switches and bridges, and would trigger
re-authentications for 802.1x-enabled switches.

So yeah, randomized MAC when scanning is coming.  But randomized MAC
every few minutes wouldn't work well in many normal WiFi and ethernet
cases, so that's probably not going to happen soon (if ever)...

(note that even though the MAC is randomized when scanning, tracker
devices could use timing and IE heuristics to detect your MAC address
with some > 50% probability, if you stay in the same place long enough.)

Dan

> On Thu, 2014-06-12 at 15:24 -0500, Dan Williams wrote:
> > On Wed, 2014-06-11 at 12:12 -0400, Chuck Anderson wrote:
> > > Has any thought been given to implementing standardized network
> > > provisioning similar to how Apple's .mobileconfig works?
> > >
> > > We are using CloudPath XpressConnect to provision Windows, Mac, Linux,
> > > Android, iOS, etc. with our WPA-Enterprise EAP-TLS configuration &
> > > certificates.  XpressConnect's Linux support uses a native Linux
> > > binary and relies on communication with the NetworkManager DBUS API.
> > > The rapid changes in this API and other system components on Linux
> > > cause this to break frequently.  For example, XpressConnect works on a
> > > freshly installed Fedora 20, but not one updated with the latest
> > > package updates.
> > >
> > > XpressConnect for iOS just generates a .mobileconfig file server-side,
> > > and the client downloads that and installs it to configure- the network
> > > settings, install certificates, etc.  There is no client-side code at
> > > all.
> > >
> > > It would be nice if NetworkManager supported a similar methodolgy for
> > > standardized network configuration provisioning.
> >
> > That would be nice, and if the .mobileconfig is well-formed enough we
> > might as well just use that format.  It might not be too hard to create
> > an importer (similar to the VPN plugin importers) that could just be run
> > client-side that would send all this to NetworkManager.
> >
> > I've filed:
> >
> > https://bugzilla.gnome.org/show_bug.cgi?id=731596
> >
> > and this would be a great standalone project for anyone that wants to
> > help out or get into NM development!
> >
> > Dan
> >
> > _______________________________________________
> > networkmanager-list mailing list
> > networkmanager-list gnome org
> > https://mail.gnome.org/mailman/listinfo/networkmanager-list
>
> _______________________________________________
> networkmanager-list mailing list
> networkmanager-list gnome org
> https://mail.gnome.org/mailman/listinfo/networkmanager-list