A rogue machine plugged into an empty office wall jack can compromise an entire corporate subnet in seconds. Here is how to lock down physical ports using hostapd and RADIUS on Linux bridges to enforce strict Layer 2 access control.