ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/README
(Generate patch)

Comparing gvpe/README (file contents):
Revision 1.2 by pcg, Sun Mar 23 14:58:21 2003 UTC vs.
Revision 1.3 by pcg, Tue Mar 25 18:11:58 2003 UTC

… …
41 41
42 42
43==== PROGRAMS ==== 43==== PROGRAMS ====
44 44
45 Vpe comes with two programs: one daemon (``vped'') and one control 45 Vpe comes with two programs: one daemon (``vped'') and one control
46 program ``vpectrl''). 46 program (``vpectrl'').
47 47
48: vpectrl 48: vpectrl
49 Is used to generate the keys and give an overview of the 49 Is used to generate the keys, check and give an overview of of the
50 configuration. 50 configuration and contorl the daemon (restarting etc.).
51 51
52: vped 52: vped
53 Is the daemon used to establish and maintain conenctions to the 53 Is the daemon used to establish and maintain conenctions to the
54 other network members. It should be run on the gateway machine. 54 other network members. It should be run on the gateway machine.
55 55
56 56
57==== CONFIGURING VPE ==== 57==== COMPILETIME CONFIGURATION ====
58 58
59 Here are a few recipes for configuring your vpe: 59 Here are a few recipes for compiling your vpe:
60 60
61 61
62== AS LOW PACKET OVERHEAD AS POSSIBLE == 62== AS LOW PACKET OVERHEAD AS POSSIBLE ==
63 63
64 ./configure --enable-hmac-length=4 --enable-rand-length=0 64 ./configure --enable-hmac-length=4 --enable-rand-length=0
65 65
66 Minimize the header overhead of VPN packets. 66 Minimize the header overhead of VPN packets (the above will result in
67 only 4 bytes of overhead over the raw ethernet frame).
67 68
68 69
69== MINIMIZE CPU TIME REQUIRED == 70== MINIMIZE CPU TIME REQUIRED ==
70 71
71 ./configure --enable-cipher=bf --enable-digest=md4 72 ./configure --enable-cipher=bf --enable-digest=md4
72 73
73 Use the fastest cipher and digest algorithms. 74 Use the fastest cipher and digest algorithms currently available in vpe.
74 75
75 76
76== MAXIMIZE SECURITY == 77== MAXIMIZE SECURITY ==
77 78
78 ./configure --enable-hmac-length=16 --enable-rand-length=8 --enable-digest=sha1 79 ./configure --enable-hmac-length=16 --enable-rand-length=8 --enable-digest=sha1
80
81 This uses a 16 byte HMAC checksum to authenticate packets (I guess 8-12
82 would also be pretty secure ;) and will additionally prefix each packet
83 with 8 bytes of random data.
79 84
80 In general, remember that AES-128 seems to be more secure and faster 85 In general, remember that AES-128 seems to be more secure and faster
81 than AES-192 or AES-256, more randomness and longer hmac is more secure, 86 than AES-192 or AES-256, more randomness helps against sniffing and a
82 MD4 is a fast digest, SHA1 or RIPEMD160 are better, and Blowfish is a 87 longer HMAC helps against spoofing. MD4 is a fast digest, SHA1 or
83 fast and so-far quite secure cipher. 88 RIPEMD160 are better, and Blowfish is a fast cipher (and also quite
89 secure).
84 90
85 91
86==== HOW TO SET UP A SIMPLE VPN ==== 92==== HOW TO SET UP A SIMPLE VPN ====
87 93
88 In this section I will describe how to get a simple VPN consisting of 94 In this section I will describe how to get a simple VPN consisting of
… …
96 you configured vpe, and can be overwritten using the ``-c'' commandline 102 you configured vpe, and can be overwritten using the ``-c'' commandline
97 switch. 103 switch.
98 104
99 Put the following lines into ``/etc/vpe/vped.conf'': 105 Put the following lines into ``/etc/vpe/vped.conf'':
100 106
101 udp-port = 50000 # the external port to listen on (configure your firewall) 107 udp-port = 50000 # the external port to listen on (configure your firewall)
102 mtu = 1400 # minimum MTU of all outgoing interfaces on all hosts 108 mtu = 1400 # minimum MTU of all outgoing interfaces on all hosts
103 ifname = vpn0 # the local network device name 109 ifname = vpn0 # the local network device name
104 110
105 node = first # just a nickname 111 node = first # just a nickname
106 hostname = first.example.net # the DNS name or IP address of the host 112 hostname = first.example.net # the DNS name or IP address of the host
107 113
108 node = second 114 node = second
109 hostname = 133.55.82.9 115 hostname = 133.55.82.9
110 116
111 node = third 117 node = third
112 hostname = third.example.net 118 hostname = third.example.net
113 119
114 The only other file neccessary if the ``if-up'' script that initializes 120 The only other file neccessary if the ``if-up'' script that initializes
115 the local ethernet interface. Put the following lines into 121 the local ethernet interface. Put the following lines into
116 ``/etc/vpe/if-up'' and make it execute (``chmod 755 /etc/vpe/if-up''): 122 ``/etc/vpe/if-up'' and make it execute (``chmod 755 /etc/vpe/if-up''):
117 123
118 #!/bin/sh 124 #!/bin/sh
119 ip link set $IFNAME address $MAC mtu $MTU up 125 ip link set $IFNAME address $MAC mtu $MTU up
120 [ $NODENAME = first ] && ip addr add 10.0.1.1 dev $IFNAME 126 [ $NODENAME = first ] && ip addr add 10.0.1.1 dev $IFNAME
121 [ $NODENAME = second ] && ip addr add 10.0.2.1 dev $IFNAME 127 [ $NODENAME = second ] && ip addr add 10.0.2.1 dev $IFNAME
122 [ $NODENAME = third ] && ip addr add 10.0.3.1 dev $IFNAME 128 [ $NODENAME = third ] && ip addr add 10.0.3.1 dev $IFNAME
123 ip route add 10.0.0.0/16 dev $IFNAME 129 ip route add 10.0.0.0/16 dev $IFNAME
124 130
125 This script will give each node a different IP address in the 131 This script will give each node a different IP address in the
126 ``10.0/16'' network. The internal network (e.g. the ``eth0'' interface) 132 ``10.0/16'' network. The internal network (e.g. the ``eth0'' interface)
127 should then be set to a subset of that network, e.g. ``10.0.1.0/24'' on 133 should then be set to a subset of that network, e.g. ``10.0.1.0/24'' on
128 node ``first'', ``10.0.2.0/24'' on node ``second'', and so on. 134 node ``first'', ``10.0.2.0/24'' on node ``second'', and so on.
… …
136== STEP 2: create the RSA key pairs for all hosts == 142== STEP 2: create the RSA key pairs for all hosts ==
137 143
138 Run the following command to generate all key pairs (that might take a 144 Run the following command to generate all key pairs (that might take a
139 while): 145 while):
140 146
141 vpectrl -c /etc/vpe -g 147 vpectrl -c /etc/vpe -g
142 148
143 This command will put the public keys into 149 This command will put the public keys into
144 ``/etc/vpe/pubkeys/*nodename*'' and the private keys into 150 ``/etc/vpe/pubkeys/*nodename*'' and the private keys into
145 ``/etc/vpe/hostkeys/*nodename*''. 151 ``/etc/vpe/hostkeys/*nodename*''.
146 152
… …
151 in two steps, since the private keys should not be distributed. The 157 in two steps, since the private keys should not be distributed. The
152 example uses rsync-over-ssh 158 example uses rsync-over-ssh
153 159
154 First all the config files without the hostkeys should be distributed: 160 First all the config files without the hostkeys should be distributed:
155 161
156 rsync -avzessh /etc/vpe first.example.net:/etc/. --exclude hostkeys 162 rsync -avzessh /etc/vpe first.example.net:/etc/. --exclude hostkeys
157 rsync -avzessh /etc/vpe 133.55.82.9:/etc/. --exclude hostkeys 163 rsync -avzessh /etc/vpe 133.55.82.9:/etc/. --exclude hostkeys
158 rsync -avzessh /etc/vpe third.example.net:/etc/. --exclude hostkeys 164 rsync -avzessh /etc/vpe third.example.net:/etc/. --exclude hostkeys
159 165
160 Then the hostkeys should be copied: 166 Then the hostkeys should be copied:
161 167
162 rsync -avzessh /etc/vpe/hostkeys/first first.example.net:/etc/hostkey 168 rsync -avzessh /etc/vpe/hostkeys/first first.example.net:/etc/hostkey
163 rsync -avzessh /etc/vpe/hostkeys/second 133.55.82.9:/etc/hostkey 169 rsync -avzessh /etc/vpe/hostkeys/second 133.55.82.9:/etc/hostkey
164 rsync -avzessh /etc/vpe/hostkeys/third third.example.net:/etc/hostkey 170 rsync -avzessh /etc/vpe/hostkeys/third third.example.net:/etc/hostkey
165 171
166 You should now check the configration by issuing the command ``vpectrl 172 You should now check the configration by issuing the command ``vpectrl
167 -c /etc/vpe -s'' on each node and verify it's output. 173 -c /etc/vpe -s'' on each node and verify it's output.
168 174
169 175
170== STEP 4: starting vped == 176== STEP 4: starting vped ==
171 177
172 You should then start vped on each node by issuing a command like: 178 You should then start vped on each node by issuing a command like:
173 179
174 vped -D -linfo first # first is the nodename 180 vped -D -linfo first # first is the nodename
175 181
176 This will make the vped stay in foreground. You should then see 182 This will make the vped stay in foreground. You should then see
177 "connection established" messages. If you don't see them check your 183 "connection established" messages. If you don't see them check your
178 firewall and routing (use tcpdump ;). 184 firewall and routing (use tcpdump ;).
179 185
… …
182 188
183 To make vped run more permanently you can either run it as a daemon (by 189 To make vped run more permanently you can either run it as a daemon (by
184 starting it without the ``-D'' switch), or, much better, from your 190 starting it without the ``-D'' switch), or, much better, from your
185 inittab. I use a line like this on my systems: 191 inittab. I use a line like this on my systems:
186 192
187 t1:2345:respawn:/opt/vpe/sbin/vped -D -L first >/dev/null 2>&1 193 t1:2345:respawn:/opt/vpe/sbin/vped -D -L first >/dev/null 2>&1
188 194
189 195
190== STEP 5: enjoy == 196== STEP 5: enjoy ==
191 197
192 ... and play around. Sending a -HUP (``vpectrl -kHUP'') to the daemon 198 ... and play around. Sending a -HUP (``vpectrl -kHUP'') to the daemon

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines