problem with script

[blaly]

Hi every one
I have started to deal with Linux from nearly time
I have network can prevent any one to log in if he/she don't register the MAC address
we use snort to protect our network , we use ubuntu 9.10
the problem :- how can i write script to call DHCP to prevent MAC which i will sent for it which make Internal attack , i want it give this MAC IP out of my IPs range to not let for it to access
i can make change on snort source file to get this MAC but i need to send it to DHCP
please any one can help me

[Freston]

Welcome to the forums!

the problem :- how can i write script to call DHCP to prevent MAC which i will sent for it which make Internal attack , i want it give this MAC IP out of my IPs range to not let for it to access

Do I understand correctly, that you want to tie MAC's to IP addresses? I mean, that a certain MAC always gets a certain IP address, and that unknown MAC's get a different address, outside the range of trusted machines?

This is certainly possible, although not inherently safe. You can configure this in the DHCP server configuration file.

[blaly]

thank you so much Freston
yes you anderstand correctly the problem was how to open the ( dhcp.conf ) file and write the instruction on it autmatcilly by using script from anther computer not DHCP server?
on this computer we install snort_inline and configer it to get the MAC which attack the network
please if this isn't inherently could you suggest for me any way to prevent this computer ?
I am very grateful about you opinion
thank you

[crazy01]

Gday blaly,

to manually edit the file you could use Vi , nano or gedit (Gedit requires Gnome to be installed).
eg to use nano something similar to

nano /etc/dhcp3/dhcpd.conf

to edit this file with a script your best bet would be to use something like sed.

you could manually add a comment into your dhcpd.conf file such as :

#Start Blocked Mac Addresses

#End Blocked Mac Addresses

then your script could find the line number of one of those comments and insert above or below.

hope that helps.