Podobne
- Strona startowa
- Microsoft Press Microsoft Encyclopedia of Security
- Redhat Linux 7.2 Bible
- Configuring Windows 2000 Server Security
- Linux Administration Security Guide
- Auel Jean M Rzeka powrotu
- 681
- Christie Agata Karty na stol (2)
- Jones James Stad do wiecznosci
- P.D. James Czarna wieza
- Christie Agatha Rendez vous ze smiercia
- zanotowane.pl
- doc.pisz.pl
- pdf.pisz.pl
- zuzanka005.pev.pl
Cytat
Do celu tam się wysiada. Lec Stanisław Jerzy (pierw. de Tusch-Letz, 1909-1966)
A bogowie grają w kości i nie pytają wcale czy chcesz przyłączyć się do gry (. . . ) Bogowie kpią sobie z twojego poukładanego życia (. . . ) nie przejmują się zbytnio ani naszymi planami na przyszłość ani oczekiwaniami. Gdzieś we wszechświecie rzucają kości i przypadkiem wypada twoja kolej. I odtąd zwyciężyć lub przegrać - to tylko kwestia szczęścia. Borys Pasternak
Idąc po kurzych jajach nie podskakuj. Przysłowie szkockie
I Herkules nie poradzi przeciwko wielu.
Dialog półinteligentów równa się monologowi ćwierćinteligenta. Stanisław Jerzy Lec (pierw. de Tusch - Letz, 1909-1966)
[ Pobierz całość w formacie PDF ]
.Also, you can name one or more specific interfaces to be used byFreeS/WAN.For example:interfaces="ipsec0=eth0"interfaces="ipsec0=eth0 ipsec1=ppp0"Both set the eth0 interface as ipsec0.The second one, however, also supports IPSEC over aPPP interface.If the default setting interfaces=%defaultroute is not used, then the specifiedinterfaces will be the only ones this gateway machine can use to communicate with other IPSECgateways.klipsdebug=noneThis option specifies the debugging output for KLIPS (the kernel IPSEC code).The default valuenone, means no debugging output and the value all means full output.plutodebug=noneThis option specifies the debugging output for the Pluto key.The default value, none, means nodebugging output, and the value all means full output.plutoload=%searchThis option specifies which connections (by name) to load automatically into memory when Plutostarts.The default is none and the value %search loads all connections with auto=add orauto=start.plutostart=%searchThis option specifies which connections (by name) to automatically negotiate when Pluto starts.The default is none and the value %search starts all connections with auto=start.conn deep-mailThis option specifies the name given to identify the connection specification to be made usingIPSEC.It s a good convention to name connections by their ends to avoid mistakes.For example,the link between deep.openna.com and mail.openna.com gateways server can be named "deep-mail", or the link between your Montreal and Paris offices, "montreal-paris".Note that the names deep-mail or whatever you have chosen should be the same in the ipsec.conf file on both gateways.In other words, the only change you should make in the /etc/ipsec.conf file on the second gateway is changing the interfaces= line to match theinterface the second gateway uses for IPSEC connection, if, of course, it s different from the firstgateway.For example, if the interface eth0 is used on the both gateways for IPSEC311Copyright 1999 - 2000 Gerhard Mourani, Open Network Architecture ® and OpenDocs Publishing Server Software (Encrypting Network Services) 1CHAPTER 6communication, you don t need to change the line interfaces= on the second gateway.On theother hand, if the first gateway use eth0 and the second use eth1, you must change the line interfaces= on the second gateway to match the interface eth1.left=208.164.186.1This option specifies the IP address of the gateway's external interface used to talk to the othergateway.leftsubnet=192.168.1.0/24This option specifies the IP network or address of the private subnet behind the gateway.leftnexthop=205.151.222.250This option specifies the IP address of the first router in the appropriate direction or ISP router.right=208.164.186.2This is the same explanation as left= but for the right destination.rightsubnet=192.168.1.0/24This is the same explanation as leftsubnet= but for the right destination.rightnexthop=205.151.222.251This is the same explanation as leftnexthop= but for the right destination.keyingtries=0This option specifies how many attempts (an integer) should be made in (re)keying negotiations.The default value 0 (retry forever) is recommended.auth=ahThis option specifies whether authentication should be done separately using AH (AuthenticationHeader), or be included as part of the ESP (Encapsulated Security Payload) service.This ispreferable when the IP headers are exposed to prevent man-in-the-middle attacks.auto=startThis option specifies whether automatic startup operations should be done at IPSEC startup.NOTE: A data mismatch anywhere in this configuration ipsec.conf will cause FreeS/WAN to failand to log various error messages.Configure the /etc/ipsec.secrets fileThe file ipsec.secrets stores the secrets used by the pluto daemon to authenticatecommunication between both gateways.Two different kinds of secrets can be configured in thisfile, which are preshared secrets and RSA private keys.You must check the modes andpermissions of this file to be sure that the super-user root owns the file, and its permissions areset to block all access by others.Step 1An example secret is supplied in the ipsec.secrets file by default.You should change it bycreating your own.With automatic keying you may have a shared secret up to 256 bits, which isthen used during the key exchanges to make sure a man in the middle attack does not occur." To create a new shared secret, use the following commands:[root@deep /]# ipsec ranbits 256 > tempNew, random keys are created with the ranbits(8) utility in the file named temp .The ranbitsutility may pause for a few seconds if not enough entropy is available immediately.312Copyright 1999 - 2000 Gerhard Mourani, Open Network Architecture ® and OpenDocs Publishing Server Software (Encrypting Network Services) 1CHAPTER 6NOTE: Don t forget to delete the temporary file as soon as you are done with it.Step 2Now that our new shared secret key has been created in the temp file, we must put it in the /etc/ipsec.secrets file.When editing the ipsec.secrets file, you should see something like thefollowing appearing in your text editor.Each line has the IP addresses of the two gateways plusthe secret.It should look something like this:# This file holds shared secrets which are currently the only inter-Pluto# authentication mechanism.See ipsec_pluto(8) manpage.Each secret is# (oversimplifying slightly) for one pair of negotiating hosts.# The shared secrets are arbitrary character strings and should be both# long and hard to guess.# Note that all secrets must now be enclosed in quotes, even if they have# no white space inside them.10.1 11.1 "jxVS1kVUTTulkVRRTnTujSm444jRuU1mlkklku2nkW3nnVuV2WjjRRnulmlkmU1Run5VSnnRT"Edit the ipsec.secrets file (vi /etc/ipsec.secrets) and change the default secrets keys:10.1 11.1 " jxVS1kVUTTulkVRRTnTujSm444jRuU1mlkklku2nkW3nnVuV2WjjRRnulmlkmU1Run5VSnnRT "To read:208.164.186.1 208.164.186.2"0x9748cc31_2e99194f_d230589b_cd846b57_dc070b01_74b66f34_19c40a1a_804906ed"Where 208.164.186.1" and 208.164.186.2" are the IP addresses of the two gateways and"0x9748cc31_2e99194f_d230589b_cd846b57_dc070b01_74b66f34_19c40a1a_804906ed" (notethat the quotes are required) is the shared secret we have generated above with the command ipsec ranbits 256 > temp in the temp file.Step 3The files ipsec.conf , and ipsec.secrets must be copied to the second gateway machine so asto be identical on both ends.The only exception to this is the ipsec.conf file, which must have init a section labeled by the line config setup with the correct interface settings for the secondgateway, if they differ from the first.The ipsec
[ Pobierz całość w formacie PDF ]