ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/doc/gvpe.5
(Generate patch)

Comparing gvpe/doc/gvpe.5 (file contents):
Revision 1.13 by root, Wed Mar 30 04:02:50 2016 UTC vs.
Revision 1.14 by root, Wed Nov 2 07:06:38 2016 UTC

… …
131.\} 131.\}
132.rm #[ #] #H #V #F C 132.rm #[ #] #H #V #F C
133.\" ======================================================================== 133.\" ========================================================================
134.\" 134.\"
135.IX Title "GVPE 5" 135.IX Title "GVPE 5"
136.TH GVPE 5 "2015-10-31" "2.25" "GNU Virtual Private Ethernet" 136.TH GVPE 5 "2016-11-02" "2.25" "GNU Virtual Private Ethernet"
137.\" For nroff, turn off justification. Always turn off hyphenation; it makes 137.\" For nroff, turn off justification. Always turn off hyphenation; it makes
138.\" way too many mistakes in technical documents. 138.\" way too many mistakes in technical documents.
139.if n .ad l 139.if n .ad l
140.nh 140.nh
141.SH "NAME" 141.SH "NAME"
… …
192which virtually removes all possibilities of buffer overflows, as there is 192which virtually removes all possibilities of buffer overflows, as there is
193only a single type of buffer and it's always of fixed length. 193only a single type of buffer and it's always of fixed length.
194.IP "\s-1EASY TO SETUP\s0" 4 194.IP "\s-1EASY TO SETUP\s0" 4
195.IX Item "EASY TO SETUP" 195.IX Item "EASY TO SETUP"
196A few lines of config (the config file is shared unmodified between all 196A few lines of config (the config file is shared unmodified between all
197hosts) and a single run of \f(CW\*(C`gvpectrl\*(C'\fR to generate the keys suffices to 197hosts) and generating an \s-1RSA\s0 key-pair on each node suffices to make it
198make it work. 198work.
199.IP "MAC-BASED \s-1SECURITY\s0" 4 199.IP "MAC-BASED \s-1SECURITY\s0" 4
200.IX Item "MAC-BASED SECURITY" 200.IX Item "MAC-BASED SECURITY"
201Since every host has it's own private key, other hosts cannot spoof 201Since every host has it's own private key, other hosts cannot spoof
202traffic from this host. That makes it possible to filter packet by \s-1MAC\s0 202traffic from this host. That makes it possible to filter packet by \s-1MAC\s0
203address, e.g. to ensure that packets from a specific \s-1IP\s0 address come, in 203address, e.g. to ensure that packets from a specific \s-1IP\s0 address come, in
… …
308.PP 308.PP
309By enabling routing on the gateway host that runs \f(CW\*(C`gvpe\*(C'\fR all nodes will 309By enabling routing on the gateway host that runs \f(CW\*(C`gvpe\*(C'\fR all nodes will
310be able to reach the other nodes. You can, of course, also use proxy \s-1ARP\s0 310be able to reach the other nodes. You can, of course, also use proxy \s-1ARP\s0
311or other means of pseudo-bridging, or (best) full routing \- the choice is 311or other means of pseudo-bridging, or (best) full routing \- the choice is
312yours. 312yours.
313.SS "\s-1STEP 2:\s0 create the \s-1RSA\s0 key pairs for all hosts" 313.SS "\s-1STEP 2:\s0 create the \s-1RSA\s0 key pair for each node"
314.IX Subsection "STEP 2: create the RSA key pairs for all hosts" 314.IX Subsection "STEP 2: create the RSA key pair for each node"
315Run the following command to generate all key pairs for all nodes (that 315Next you have to generate the \s-1RSA\s0 keys for the nodes. While you can set
316might take a while): 316up \s-1GVPE\s0 so you can generate all keys on a single host and centrally
317distribute all keys, it is safer to generate the key for each node on the
318node, so that the secret/private key does not have to be copied over the
319network.
317.PP 320.PP
321To do so, run the following command to generate a key pair:
322.PP
318.Vb 1 323.Vb 1
319\& gvpectrl \-c /etc/gvpe \-g 324\& gvpectrl \-c /etc/gvpe \-g nodekey
320.Ve 325.Ve
321.PP 326.PP
322This command will put the public keys into \f(CW\*(C`/etc/gvpe/pubkeys/\f(CInodename\f(CW\*(C'\fR and the private keys into \f(CW\*(C`/etc/gvpe/hostkeys/\f(CInodename\f(CW\*(C'\fR. 327This will create two files, \fInodekey\fR and \fInodekey.privkey\fR. The former
328should be copied to \fI/etc/gvpe/pubkey/\fInodename\fI\fR on the host where
329your config file is (you will have to create the \fIpubkey\fR directory
330first):
331.PP
332.Vb 1
333\& scp nodekey confighost:/etc/gvpe/pubkey/nodename
334.Ve
335.PP
336The private key \fInodekey.privkey\fR should be moved to \fI/etc/gvpe/hostkey\fR:
337.PP
338.Vb 2
339\& mkdir \-p /etc/gvpe
340\& mv nodekey.privkey /etc/gvpe/hostkey
341.Ve
323.SS "\s-1STEP 3:\s0 distribute the config files to all nodes" 342.SS "\s-1STEP 3:\s0 distribute the config files to all nodes"
324.IX Subsection "STEP 3: distribute the config files to all nodes" 343.IX Subsection "STEP 3: distribute the config files to all nodes"
325Now distribute the config files and private keys to the other nodes. This 344Now distribute the config files and public keys to the other nodes.
326should be done in two steps, since only the private keys meant for a node
327should be distributed (so each node has only it's own private key).
328.PP 345.PP
329The example uses rsync-over-ssh 346The example uses rsync-over-ssh to copy the config file and all the public
330.PP 347keys:
331First all the config files without the hostkeys should be distributed:
332.PP 348.PP
333.Vb 3 349.Vb 3
334\& rsync \-avzessh /etc/gvpe first.example.net:/etc/. \-\-exclude hostkeys 350\& rsync \-avzessh /etc/gvpe first.example.net:/etc/. \-\-exclude hostkey
335\& rsync \-avzessh /etc/gvpe 133.55.82.9:/etc/. \-\-exclude hostkeys 351\& rsync \-avzessh /etc/gvpe 133.55.82.9:/etc/. \-\-exclude hostkey
336\& rsync \-avzessh /etc/gvpe third.example.net:/etc/. \-\-exclude hostkeys 352\& rsync \-avzessh /etc/gvpe third.example.net:/etc/. \-\-exclude hostkey
337.Ve 353.Ve
338.PP 354.PP
339Then the hostkeys should be copied:
340.PP
341.Vb 3
342\& rsync \-avzessh /etc/gvpe/hostkeys/first first.example.net:/etc/hostkey
343\& rsync \-avzessh /etc/gvpe/hostkeys/second 133.55.82.9:/etc/hostkey
344\& rsync \-avzessh /etc/gvpe/hostkeys/third third.example.net:/etc/hostkey
345.Ve
346.PP
347You should now check the configuration by issuing the command \f(CW\*(C`gvpectrl \-c 355You should now check the configuration by issuing the command \f(CW\*(C`gvpectrl
348/etc/gvpe \-s\*(C'\fR on each node and verify it's output. 356\&\-c /etc/gvpe \-s\*(C'\fR on each node and verify it's output.
349.SS "\s-1STEP 4:\s0 starting gvpe" 357.SS "\s-1STEP 4:\s0 starting gvpe"
350.IX Subsection "STEP 4: starting gvpe" 358.IX Subsection "STEP 4: starting gvpe"
351You should then start gvpe on each node by issuing a command like: 359You should then start gvpe on each node by issuing a command like:
352.PP 360.PP
353.Vb 1 361.Vb 1
… …
370.Ve 378.Ve
371.SS "\s-1STEP 5:\s0 enjoy" 379.SS "\s-1STEP 5:\s0 enjoy"
372.IX Subsection "STEP 5: enjoy" 380.IX Subsection "STEP 5: enjoy"
373\&... and play around. Sending a \-HUP (\f(CW\*(C`gvpectrl \-kHUP\*(C'\fR) to the daemon 381\&... and play around. Sending a \-HUP (\f(CW\*(C`gvpectrl \-kHUP\*(C'\fR) to the daemon
374will make it try to connect to all other nodes again. If you run it from 382will make it try to connect to all other nodes again. If you run it from
375inittab, as is recommended, \f(CW\*(C`gvpectrl \-k\*(C'\fR (or simply \f(CW\*(C`killall gvpe\*(C'\fR) will 383inittab \f(CW\*(C`gvpectrl \-k\*(C'\fR (or simply \f(CW\*(C`killall gvpe\*(C'\fR) will kill the daemon,
376kill the daemon, start it again, making it read it's configuration files 384start it again, making it read it's configuration files again.
377again. 385.PP
386To run the \s-1GVPE\s0 daemon permanently from your SysV init, you can add it to
387your \fIinittab\fR, e.g.:
388.PP
389.Vb 1
390\& t1:2345:respawn:/bin/sh \-c "exec nice \-n\-20 /path/to/gvpe \-D node >/var/log/gvpe.log 2>&1"
391.Ve
392.PP
393For systems using systemd, you can use a unit file similar to this one:
394.PP
395.Vb 4
396\& [Unit]
397\& Description=gvpe
398\& After=network.target
399\& Before=remote\-fs.target
400\&
401\& [Service]
402\& ExecStart=/path/to/gvpe \-D node
403\& KillMode=process
404\& Restart=always
405\&
406\& [Install]
407\& WantedBy=multi\-user.target
408.Ve
378.SH "SEE ALSO" 409.SH "SEE ALSO"
379.IX Header "SEE ALSO" 410.IX Header "SEE ALSO"
380\&\fIgvpe.osdep\fR\|(5) for OS-dependent information, \fIgvpe.conf\fR\|(5), \fIgvpectrl\fR\|(8), 411\&\fIgvpe.osdep\fR\|(5) for OS-dependent information, \fIgvpe.conf\fR\|(5), \fIgvpectrl\fR\|(8),
381and for a description of the transports, protocol, and routing algorithm, 412and for a description of the transports, protocol, and routing algorithm,
382\&\fIgvpe.protocol\fR\|(7). 413\&\fIgvpe.protocol\fR\|(7).

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines