Chapter 8

Creating Virtual

Private Networks

Solutions in this chapter:

■Secure Tunneling with VPNs

■Explaining the IP Security Architecture

■Creating a VPN by Using FreeS/WAN

;Summary

;Solutions Fast Track

;Frequently Asked Questions

391

392 Chapter 8 • Creating Virtual Private Networks

Introduction

In previous chapters, you have discovered how you can enhance authentication by using third-party open source software, such as Kerberos,“one-time passwords in everything” (OPIE), and the public-key cryptography methods of Open Secure Shell (OpenSSH).You also learned how to employ encryption between hosts by using the application-layer security methods of OpenSSH. In this chapter, you will go a step further to deploy secure authentication and strong encryption at the network layer to establish network security by using virtual private networks (VPNs).VPNs offer certain advantages over other network security protocols, as you will find in this chapter.You will learn about the many solutions provided by VPNs in today’s Internet workplace, such as providing secure transmissions between two hosts, routers, or both.We explain the Internet Protocol Security Architecture (IPSec), which is quickly becoming the standard protocol for VPNs.You will finish up the chapter by creating your own VPN by using Free Secure Wide Area Network (FreeS/WAN).

Secure Tunneling with VPNs

A VPN provides a private data network over public telecommunication infrastructures, such as the Internet. It provides both secure authentication and encryption. It creates a data “tunnel” between devices so that all data transmitted between the devices is secure, regardless of what programs the devices are running.After a secure tunnel is established, data can be transmitted securely between the hosts.

Three basic types of VPN solutions exist: telecommuter, router-to-router, and host-to-host. A telecommuter VPN can be used to securely connect a host to a network from any Internet connection and is ideal for traveling workers. A router-to-router VPN is used to create a secure transmission tunnel between two networks, such as two company sites in different locations. A host-to-host VPN creates a secure transmission tunnel between any two hosts. A VPN implementation named FreeS/WAN, which you will implement in this chapter, can provide all three solutions.

Telecommuter VPN Solution

Telecommuters can use VPNs to log in to their company network from home or from the road. Any location with Internet access can be used.The telecommuter must ensure that the laptop, desktop, or handheld system contains VPN client software and the address of the company’s VPN server.The telecommuter then

www.syngress.com

accesses the Internet through normal access methods, such as a dial-up, a Digital Subscriber Line (DSL), or a cable network connection. After access to the Internet is achieved, the telecommuter opens a VPN client to log on to the company VPN server—once logged on, the telecommuter has access to the company network. She receives the same user rights and privileges on the company network as if she were physically logged in at a company workstation. If the telecommuter has a fast Internet connection, she will be unable to tell the difference between physically working at the company location and working through the VPN.The VPN concept is shown in Figure 8.1.

Figure 8.1 Telecommuting Using a VPN

After the VPN tunnel has been established, the telecommuter can run any application as if he were at a company workstation, provided he has the appropriate client. All of these applications will run over the tunnel, and the applications themselves are not required to be secure, because they are transmitted through the VPN tunnel.The VPN tunnel encrypts the data, so any captured data (regardless of the program that generated that data) will be useless.The tunnel concept is displayed in Figure 8.2.

Figure 8.2 Secure Transmission of Data across the Internet Using a VPN Tunnel

Internet

Secure VPN Tunnel

Laptop Computer

Company VPN Server

(VPN Client)

www.syngress.com

394 Chapter 8 • Creating Virtual Private Networks

VPNs can also be used by corporate partners. For instance, the customer database displayed in Figure 8.1 could be available for a sales team at another company.The sales team could receive accounts on your network with access to the customer database only.

Router-to-Router VPN Solution

VPNs are a cost-effective way to create a wide area network (WAN) for connecting company satellite offices and corporate offices. In the past, a company leased expensive dedicated lines from phone companies to connect each location. VPNs allow companies to create a router-to-router VPN over the Internet instead.

In order to implement a VPN, you must ensure that each gateway router to your network supports the VPN implementation you choose at each location. These routers are located on the edge of your network and are the end-to-end points for your VPN tunnel.They are responsible for encapsulating the traffic as it leaves the network and removing the capsule as it arrives between your satellite and corporate offices. All router vendors offer VPN functionality. For instance, Cisco offers the Cisco 1600 series of routers that offer a VPN option.

VPNs can connect your corporate networks for a fraction of the cost of leasing dedicated lines. A corporate WAN using VPN-enabled routers is displayed in Figure 8.3.

Figure 8.3 Creating a Corporate Router-to-Router VPN

www.syngress.com

Host-to-Host VPN Solution

VPNs can also securely connect two hosts over the Internet or any unsecured network. Each host is the tunnel endpoint.The only difference is that a separate network does not exist on the other side of the hosts, so no gateway is required with IP forwarding enabled. If you can create a tunnel between two hosts, you can expand your knowledge in an enterprise environment to accommodate both telecommuter and router-to-router VPN solutions.The host-to-host VPN solution is shown in Figure 8.4.

Figure 8.4 Creating a Host-to-Host VPN

Tunneling Protocols

As mentioned previously, a “tunnel” is created between VPN hosts to ensure that all traffic between them is secure.The tunnel is created with a tunneling protocol.These protocols are responsible for encapsulating a data packet before a host transmits it. After the data is encapsulated, it is sent over the Internet until it arrives at its destination.When it arrives, the capsule is removed, and the data is processed by the destination host.

IP tunneling protocols are particularly powerful because they can transmit foreign protocols over the Internet. For instance, a Novell NetWare host can send an Internetwork Packet Exchange/Sequenced Packet Exchange (IPX/SPX) packet over the Internet by encapsulating it in an IP packet, then transmitting it using Transmission Control Protocol/IP (TCP/IP).When it arrives at its destination, the IP packet is stripped off, and the IPX/SPX packet is processed.

The next generation protocol, IPv6, has a test bed called the 6bone (www.6bone.net).The 6bone is a virtual network that uses IPv6-over-IPv4 tunneling.The IPv6 networks, called islands, are connected over the Internet using IPv4 tunnels.The IPv6 packets are encapsulated by an IPv4 packet and sent over the Internet.When they arrive at the destination, the IPv4 packet is removed, and

www.syngress.com

396 Chapter 8 • Creating Virtual Private Networks

the IPv6 packet is processed on the IPv6 network.The leading VPN tunneling protocols are listed in Table 8.1.

Table 8.1 The Leading VPN Tunneling Protocols

Explaining the IP Security Architecture

IP has been a low-cost, efficient protocol for several decades. However, it has always suffered from security vulnerabilities that have required users and businesses to use other methods to ensure data confidentiality across the Internet. A new protocol, IP Security Architecture (IPSec), is designed to add authentication and encryption to IP when needed.

IPSec is an Internet Engineering Task Force (IETF) security protocol that is becoming a standard component of VPN tunneling protocols. As the name suggests, it was designed for IP, and IPSec has gained wide industry support. For instance, Cisco already supports IPSec in its routers and is one of the leading supporters for IPSec standardization. IPSec is currently a proposed standard (Request

www.syngress.com

for Comments [RFC] 2401) within the IETF.The IPSec charter Web page, shown in Figure 8.5, is maintained by the IETF IPSec working group.The URL is www.ietf.org/html.charters/ipsec-charter.html.This site is ideal for monitoring the progress of IPSec and the numerous implementations for the IPSec standard.

Figure 8.5 IETF IPSec Charter

IPSec provides secure authentication and encryption over a network by securing all packets at Layer 3, the network layer, of the Open System Interconnection (OSI) reference model. Layer 3 security is significant because Layer 3 is responsible for IP addressing and routing over the Internet. Security at this layer ensures that everything on the network is secure.

NOTE

Another benefit of IPSec is that it already supports the next generation Internet Protocol, IP version 6 (IPv6). IPSec will be a requirement for IPv6 implementation.

Layer 3 security is in contrast to methods that provide only encryption and authentication to higher-level protocols, such as SSH (you learned about SSH in the last chapter).

www.syngress.com

398 Chapter 8 • Creating Virtual Private Networks

Programs such as SSH for remote login, Secure Hypertext Transfer Protocol (SHTTP) and Secure Socket Layer (SSL) for Web applications, and Pretty Good Privacy (PGP) for e-mail secure data between two applications using Layer 4 mechanisms.This method works extremely well but is limited because only the data between the program’s associated ports is encrypted. IPSec secures all data, regardless of the program running between the hosts.To demonstrate the limitations of security protocols such as SSH, SHTTP, and SSL, recall the implementation of SSH in the last chapter. First, you captured packets that were unencrypted, shown in Figure 8.6.

Figure 8.6 Unencrypted Packets

Next, you captured packets between two SSH hosts that used encryption.The application layer data was encrypted, but the Layer 4 (the transport layer) port numbers could be viewed, so you could easily determine the service running.You discovered that the SSH remote host listens and transmits on TCP port 22.The SSH client used TCP port 1023. Figure 8.7 shows the captured SSH traffic. SHTTP and SSL traffic displays in a similar manner when captured, except different port numbers are displayed.

IPSec is different from SSH and other application-based encryption protocols because an IPsec tunnel encrypts data at the Layer 3 (the network layer) so that no transport layer (Layer 4) data is displayed, which reduces security vulnerabilities. Figure 8.8 displays a packet capture of IPSec packets transmitted through a tunnel. Note that the amount of useful information is significantly reduced. For instance,

www.syngress.com

Figure 8.7 Packet Capture of SSH Session Displaying TCP Port Data

Figure 8.8 Packet Capture of IPSec Session

all transport layer data in the figure is encrypted by an Encapsulating Security Payload (ESP) header, which renders the packet and its contents useless if captured by a hacker. ESP encrypts the packet at the network layer, so even the port information is encrypted. So as you can see, this is an improvement over applicationbased encryption protocols, such as SSH, which display the transport-layer data.

www.syngress.com

400 Chapter 8 • Creating Virtual Private Networks

The packets captured in Figure 8.8 are from a VPN tunnel using IPsec.This tunnel was set up between two hosts (a host-to-host solution), and the tunnel endpoints encrypted all traffic between the two hosts, regardless of the applications running between them. IPsec is used by many VPN implementations.You will learn about these implementations and how they use IPsec in the next section.

Using IPSec with a VPN Tunneling Protocol

IPSec is used as an authentication and encryption standard for VPNs. As you learned in Table 8.1, several tunneling protocols exist, such as PPTP and L2TP. You learned that both PPTP and L2TP are extensions of PPP. One of IPSec’s functions within L2TP is to encapsulate the PPP data and encrypt the data at the network layer (Layer 3) of the OSI model. Figures 8.9 through 8.11 display a graphic that displays how IPSec encapsulation works with one type of L2TP implementation.

First of all, a PPP frame is created.This frame contains the IP packet created from the TCP/IP stack on your system with a PPP header attached. It contains data from your system that would normally be sent across the wire.The PPP frame is displayed in Figure 8.9.

Figure 8.9 Starting Out with a PPP Frame

Next, the L2TP and User Datagram Protocol (UDP) headers are added to the PPP frame, as shown in Figure 8.10.

Figure 8.10 Adding an L2TP and UDP Header to a PPP Frame

Last, the IPSec encapsulation is implemented. IPSec adds an IPSec ESP header and trailer. It also adds an IPSec Authentication trailer for message authentication and integrity.The L2TP packet is encrypted by IPSec, which uses the encryption keys that were generated form the authentication process.

www.syngress.com

During this process, the standard IP header is added to the packet.The IP source address is the VPN client (which is sending this packet).The IP destination address is the VPN server that will receive this packet.The IPSec packet is displayed in Figure 8.11.

Figure 8.11 Adding IPSec Mechanisms to an L2TP Packet

When the packet arrives at the VPN server, the VPN server will strip the IP, IPSec, UDP, L2TP, and PPP headers from the packet to discover the original data sent from the VPN client.

Internet Key Exchange Protocol

IPSec is often used in conjunction with the Internet Key Exchange (IKE) protocol. IKE is a key management protocol standard that enhances IPSec, such as providing a simpler IPSec configuration, flexibility, and more features. IKE is not required to run IPSec, but it enhances the standard.

IKE is a hybrid protocol. It implements three security protocols:

■Internet Security Association and Key Management Protocol (ISAKMP)

■Oakley key exchange

■Skeme key exchange

IKE uses the ISAKMP framework to run the Oakley and Skeme key exchange mechanisms.The combination of these three security protocols provides authentication using digital signature and public key encryption.

IKE allows dynamic authentication of hosts, provides anti-replay services, and can change encryption keys during an IPSec session. It allows IPSec to operate without requiring an administrator to manually configure all of the IPSec security parameters between two hosts, and it negotiates IPSec security associations (SAs) automatically. IKE also allows Certification Authority (CA) support and permits lifetime specifications from IPSec security associations.

www.syngress.com

402 Chapter 8 • Creating Virtual Private Networks

To learn more about IKE, read the RFC 2409 proposed standard on the Internet at www.ietf.org/rfc/rfc2409.txt.

Creating a VPN by Using FreeS/WAN

Free Secure WAN (FreeS/WAN) is a Linux VPN implementation that uses IPSec and IKE. IPSec and IKE were discussed in the previous sections and are used to provide secure authentication and encryption of data between two hosts at Layer 3 (network layer) of the OSI model. FreeS/WAN creates a secure VPN tunnel between the hosts.The FreeS/WAN project goal is to provide freely available source code to promote IPSec and allow it to run on many different machines. It also avoids export restrictions and attempts to interoperate with all VPNs that use IPSec.The FreeS/WAN project is based at www.freeswan.org/intro.html (shown in Figure 8.12).

Figure 8.12 Home of the FreeS/WAN Project

Because FreeS/WAN uses IPSec, it can be implemented on any system that performs IP networking.This includes routers, PCs, laptops, firewalls, and application servers such as Web, mail, and database servers. FreeS/WAN uses three IPSec protocols, shown in Table 8.2.

www.syngress.com

Damage & Defense…

The Need for VPN Interoperability

Interoperability is a major concern with S/WAN and VPNs in general. Currently, almost all firewalls and security software available today offers IPSec support. It is the goal of S/WAN developers for all S/WAN implementations to interoperate, no matter what device they are installed on. This goal is shared by many manufacturers and is spearheaded by the VPN Consortium (VPNC). The VPNC is an international trade association for manufacturers in the VPN market.

The VPNC goal is to show manufacturers where their VPN products interoperate, so that the manufacturers can more easily provide interoperability with other VPN implementations. They also publicize and provide support for testing events for VPN interoperability. By providing a forum for all VPN manufacturers to communicate, the Internet may eventually use one VPN standard, and all vendor VPN products may be able to communicate with one another.

To learn more about VPN interoperability efforts, visit the VPNC Web site at www.vpnc.org.

These IPSec protocols are implemented in FreeS/WAN by using two programs and a variety of scripts, as shown in Table 8.3.

www.syngress.com

404 Chapter 8 • Creating Virtual Private Networks

Table 8.3 FreeS/WAN Implementation of IPSec Protocols

NOTE

In order to add IPSec to the system, FreeS/WAN installs IPSec into the Linux IPv4 TCP/IP stack. This step is necessary because IPSec is not required for IPv4. However, it is required for IPv6.

In the following sections, you will download, install, and configure FreeS/WAN. After you install it, you will capture a variety of unencrypted application packets, then implement FreeS/WAN and ensure that all packets transmitted through the VPN are secure.

Downloading and Unpacking FreeS/WAN

FreeS/WAN is not included with all Red Hat Linux distributions. Many countries have restriction laws that forbid the export or import of strong encryption. Therefore, your version of Red Hat Linux most likely does not include FreeS/WAN.

These installation instructions are written for freeswan-1.9 (this tarball is available on the CD accompanying this book [freeswan-1.9.tar.gz ]) and Red Hat Linux 7.0 using the linux-2.2.16 kernel, which will be upgraded to the linux- 2.4.3 kernel (this kernel is also included on the CD [linux-2.4.3.tar.gz]). A custom installation of Linux with “everything” was installed.

The program is downloaded as a TAR file that contains the source code and documentation, as well as any patches.To download and install FreeS/WAN complete the following steps:

1. Log in as root.

www.syngress.com

2.Access the FreeS/WAN download site at www.freeswan.org/ download.html.You can also obtain the necessary files from the CD accompanying this book.

3.Scroll down to the Latest Release section, as shown in Figure 8.13.

Figure 8.13 Accessing the Latest Release of FreeS/WAN

SECURITY ALERT!

Do not download the installation files from the “Today’s Snapshot” section. The snapshots are experimental versions, and you may have difficulty implementing them. The “Latest Release” versions have been tested on Red Hat Linux and have a better change of working correctly on your system.

4.In this example, the latest release can be downloaded from Europe via FTP by selecting the ftp.xs4all.nl link. Select the corresponding link in your browser.

5.At the FTP site, view the FreeS/WAN files that are listed. For instance, the Europe FTP site is shown in Figure 8.14.You would need to download at least the freeswan-1.9.tar.gz file (your version may differ) to your system. Although not all the files are required to run FreeS/WAN, you

www.syngress.com

406 Chapter 8 • Creating Virtual Private Networks

may find them useful. For instance, the RFCs that FreeS/WAN is based are included in the RFCs.tar.gz file.The files you can download are as follows (these files are also located on the CD accompanying this book):

■RFCs.tar.gz

■freeswan-1.9.tar.gz

■freeswan-1.9.tar.gz.sig

■freeswan-sigkey.asc

Figure 8.14 Downloading the FreeS/WAN TAR File(s)

NOTE

You can also access the freeswan-1.9.tar.gz tarball from the supplemental CD included with this book and copy it to your /root directory. This lab is written for version 1.9, which is the version on the CD.

6.Download the FreeS/WAN file(s) to your /root directory.

7.Access the download directory by entering.

cd /root

www.syngress.com

NOTE

If you have already compiled your kernel in the past (you have a .config file in your /usr/src/linux directory), then download and unpack the files in your /usr/src/ directory (but not in the linux directory).

8.The filename will look like this: freeswan-1.9.tar.gz.

9.In the /root directory, unpack the image by entering:

tar -zxvf freeswan-1.9.tar.gz

This will create a /root/freeswan-1.9 directory.

Compiling the Kernel to Run FreeS/WAN

Now you need to configure the Linux kernel to run FreeS/WAN.The FreeS/WAN code must be added to the kernel. Before you configure FreeS/WAN, you must configure, build, and test a system kernel.This must be done before installing FreeS/WAN because the program uses the results of compiled kernel to make the necessary modifications.

The following tools must be installed before you begin the kernel configuration for FreeS/WAN. If you completed a “Custom” Red Hat Linux installation with “everything” installed, you can skip this warning—all of the required Red Hat Package Manager (RPM) packages are already installed (you may need to update them later in this section).

To check if an RPM is installed, enter rpm -qa | grep rpm_name. To install an RPM, enter rpm -i rpm_name_version. Access the RPMs from the Red Hat installation CD /RedHat/RPMS directory, as shown in the following Kernel source code item:

1.Kernel source code The Linux kernel source RPM must be installed to configure the kernel.To find out if it is installed, enter rpm -qa | grep kernel-source. If you do not receive a reply, access your Red Hat installation CD and install the kernel-source and kernel-headers RPMs (your versions may vary) from the /RedHat/RPMS directory.

2.Tools A GNU C compiler RPM must be installed—either gcc or egcs works. Development tools, including make and patch must be installed.

www.syngress.com

408Chapter 8 • Creating Virtual Private Networks

3.Libraries The glibc, GMP (required for Pluto’s public key calculations), and ncurses (if you use menuconfig) RPMs must be installed.

NOTE

The following demonstration is safe and will upgrade your Linux kernel. You will always have the old kernel on your system, so you can switch back if a problem arises. Recompiling the kernel is required to support many new devices in Linux.

If you have already compiled your kernel in the past (you have a

.config file in your /usr/src/linux directory), then you can skip this section. Go to the “Configuring FreeS/WAN” section. Please note that you will NOT have to reconfigure the FreeS/WAN Makefile.

4.Revisit www.freeswan.org/download.html (shown in Figure 8.13) to determine if your system’s Red Hat Linux version and kernel are supported.

5.For this demonstration, the Linux kernel will be upgraded to linux- 2.4.3, and then FreeS/WAN will be compiled.

6.Access the kernel source code from the anonymous FTP site located at ftp://ftp.kernel.org/pub/linux/kernel/.

7.Open the v2.4 directory (or the latest supported by FreeS/WAN) to access the Linux 2.4 kernel versions. Locate the linux-2.4.3.tar.gz file. It is located in the middle of the screen, shown in Figure 8.15.

NOTE

You can also access the linux-2.4.3.tar.gz tarball from the CD included with this book and copy it to your /root directory. This lab is written for Linux 2.4.3, which is the version on the CD.

8.Download the kernel to your home directory, such as /root as shown in Figure 8.16.You can download and unpack the kernel in any directory in which you have permissions, such as your home directory. In this demonstration, the /root directory is used.

www.syngress.com

Figure 8.15 Locating the linux-2.4.3.tar.gz Kernel

Figure 8.16 Downloading Kernel to Your Home (/root) Directory

9. On your system, access the /root directory by entering the following:

cd /root

10. Unpack the downloaded kernel by entering the following:

gzip –cd linux-2.4.3.tar.gz | tar xvf -

A /root/linux/ directory is created.

11.To remove stale .o files and dependencies, access the new linux directory and run the make mrproper command. Enter the following commands:

cd /root/linux

make mrproper

www.syngress.com

410 Chapter 8 • Creating Virtual Private Networks

NOTE

View the README file included with the unpacked kernel. The file explains in detail the processes for installing the 2.4 kernel, which are slightly different from previous releases. For instance, the Linux kernel was unpacked in your home directory, not the /usr/src/ directory. In this example, read the /root/linux/README file. This process will also ensure that you do not overwrite your current system kernel.

12.Open the /root/linux/documentation/changes file and see which updated packages are required to run the linux-2.4.3 kernel. For instance, if you are upgrading from linux-2.2.16-22, you will need to upgrade the following packages to these minimum versions:

■util-linux 2.10o

■modutils 2.4.2

■e2fsprogs 1.19

■pppd 2.4.0

■reiserfsprogs 3.x.0j-1

13.Download the required RPMs at the RPM repository (http://rpmfind

.net/linux/RPM).These RPMs are also available on the CD accompanying this book.

14.The RPM repository is shown in Figure 8.17. Search for the required RPM by entering its name in the Search field, and clicking the Search button.

15.For instance, if you are upgrading from linux-2.2.16.22, you need to download the following RPMs, which are also available on the CD accompanying this book:

■util-linux-2.10s-12.i386.rpm

■modutils-2.4.2-5.i386.rpm

■e2fsprogs-1.19-4.i386.rpm

■ppp-2.4.0-2.i386.rpm

www.syngress.com

Figure 8.17 Searching for RPMs at the RPM Repository on rpmfind.net

16.Install each RPM using the rpm -U command. For instance, to install the RPMs listed in the previous step, you would enter the following:

rpm –U util-linux-2.10s-12.i386.rpm

rpm –U modutils-2.4.2-5.i386.rpm

rpm –U e2fsprogs-1.19-4.i386.rpm

rpm –U ppp-2.4.0-2.i386.rpm

17.After updating the required RPMs, you are ready to compile the kernel. The easiest way to configure the kernel is to enter X Windows. If you are not already in X Windows, enter the following:

startx

18.Access the new linux directory, which is the required location for this kernel configuration. Enter the following:

cd /root/linux

www.syngress.com

412 Chapter 8 • Creating Virtual Private Networks

19.Open the Linux Kernel Configuration GUI.This program allows you to choose kernel options for your system. Open it by entering the following:

make xconfig

The Linux Kernel Configuration GUI appears, as shown in

Figure 8.18.

Figure 8.18 Configuring the Linux Kernel by Using xconfig

20.Click the Loadable module support button.

21.The Loadable module support configuration screen appears. Select Y for all three options, as shown in Figure 8.19. If they are already selected, then you do not have to change the configuration options.

Figure 8.19 Configuring Loadable Module Support in the Linux Kernel

22.Click the Main Menu button to return to the Linux Kernel Configuration screen.

23.Select the Processor type and features button. In the Processor family drop-down menu, select the process type running on your system. For the first time, modern PC processors are listed, such as the Pentium III and IV, as well as the AMD Athlon/K7. Many times,

Linux installs using the i386 processor, even though your system may be

www.syngress.com

running a more modern processor. Selecting the correct processor type will increase system performance.The Processor type and features screen is shown in Figure 8.20.

Figure 8.20 Configuring Processor Type

24.Click the Main Menu button to return to the Linux Kernel Configuration screen.

25.Click the Network device support button and select the Ethernet (10 or 100Mbit) option. Select your NIC from the list of available options.The PCI NE2000 and clones support usually works for PCI cards that are not specifically listed. If this is what you require, select Y, as shown in Figure 8.21.

Figure 8.21 Selecting the PCI NE2000 and Clones NIC

www.syngress.com

414Chapter 8 • Creating Virtual Private Networks

26.Click the OK button and then the Main Menu button.

27.Make any additional changes required for your system. For instance, if you want printer support, you must activate Parallel port support from the Main Menu and select the Y option.

28.Click the Save and Exit button.You will receive a message stating “End of Linux kernel configuration.” Click the OK button.

29.The kernel configurations are saved in the file /root/linux/.config.

30.Continue to run commands from the /root/linux directory.

31.Run the make dep command, which finds dependencies between the files. Enter the following:

make dep

32.Run the make bzImage command, which builds a loadable image of the kernel. It compresses the image with bzip. Enter the following:

make bzImage

33.The bzImage file is created and placed in /linux/arch/i386/boot/ bzImage.

NOTE

At the end of the make bzImage process, you may receive a warning (especially if you have installed a large number of kernel options) stating “warning: kernel is too big for standalone boot from floppy.” If you receive this warning, you need to copy the image to the hard drive and boot up with lilo.

34.Continue to run commands from the /root/linux directory.

35.Run the command make install by entering the following:

make install

36.Now that you have made a kernel, create the modules by entering the following:

make modules

www.syngress.com

37. To install the modules in the proper subdirectories, enter the following:

make modules_install

38. To boot into the new kernel, you must copy the kernel image to either a floppy disk or to your hard drive.This depends on how you usually boot up Linux.

39.If you use a boot disk, then copy the image to a new floppy disk.The floppy disk must be high density.Then create a boot disk, insert a new HD floppy disk, and enter the following:

cp /root/linux/arch/i386/boot/bzImage /dev/fd0

Leave the floppy boot disk in your system and reboot the system from the floppy boot disk.

40.If you boot from your hard drive, your system uses lilo.The lilo configurations are specified in /etc/lilo.conf.The lilo.conf file specifies kernel images that are located in the /boot directory. During the installation process, the bzImage file was copied to the /boot directory and renamed vmlinuz-2.4.3. It can be named anything you want, as long as you specify the name and location in the lilo.conf file (which you will do in Step 42).

41.To specify your new image in the /etc/lilo.conf file, enter the following:

vi /etc/lilo.conf

42.Press I to insert text. Insert the following text at the end of the file to identify the new kernel image (your entry may vary due to different partitions):

image=/boot/vmlinuz-2.4.3

label=linux-2.4.3

read-only

root=/dev/hda5

Your lilo.conf file should resemble Figure 8.22.

43.Press ESC to exit insert mode.Write and quit the file by entering the following:

:wq

www.syngress.com

416 Chapter 8 • Creating Virtual Private Networks

Figure 8.22 Configuring /etc/lilo.conf to Access the New

Kernel Image

44. To load your lilo.conf changes, enter the following command:

lilo

You should receive the following response:

Added linux *

Added linux-2.4.3

45.You are ready to reboot the system and test to see if the new kernel works.

46.Reboot the system.

47.At the lilo prompt, the kernel image labels are presented. If not, select the TAB key.Two options will be available to you: the original linux kernel and the new linux-2.4.3 kernel you just configured. Select the linux-2.4.3 kernel.

48.The system should boot properly. If you receive errors when booting the new kernel, reboot using the old kernel image and access the /root/ linux/README file.To find out more about kernel configuration commands and troubleshooting problems, visit www.linuxdoc.org/ HOWTO/Kernel-HOWTO.html (be aware, however, that the HOWTO documents are not always up-to-date).

49.Log in as root.You should be successful.

www.syngress.com

Recompiling FreeS/WAN into the New Kernel

Congratulations! You have successfully created and tested a new kernel image for your system.This will make any troubleshooting of FreeS/WAN much easier, because you know that the compiled kernel works. If you skipped the last section because you compiled your kernel in the past (you have a .config file in your /usr/src/linux directory), then you do not have to reconfigure the FreeS/WAN Makefile. Skip to Step 7 in the following demonstration and use /usr/src/ freeswan-1.9 instead of the /root/freeswan-1.9 directory for the remainder of the section.

1.Reboot the system and log in to the original kernel as root. Do not use the new kernel for the following steps.

2.Access the freeswan directory by entering the following (your version may vary):

cd root/freeswan-1.9

3.Open the /root/freeswan/Makefile by entering the following:

vi Makefile

4.You need to change the kernel source location where FreeS/WAN looks for the kernel. By default, FreeS/WAN looks in the /usr/src/linux directory. However, you compiled your new kernel in /root/linux. Therefore, you need to change the Makefile to reflect your kernel source location.To change the kernel source location, scroll down the file and locate the following comment:

# kernel location, and location of kernel patches in the

distribution

KERNELSRC=/usr/src/linux

5.Change the kernel source location by pressing I to enter vi’s insert mode, then change the location to the following:

KERNELSRC=/root/linux

Your file should resemble Figure 8.23.

6. To save and exit the file, press ESC and enter the following:

:wq

www.syngress.com

418 Chapter 8 • Creating Virtual Private Networks

Figure 8.23 Changing the FreeS/WAN Makefile Kernel

Source Location

7.To add the FreeS/WAN default settings into your Linux kernel’s .config file, enter the following command in the /root/freeswan-1.9 directory:

cd /root/freeswan-1.9

make oldgo

This command installs default FreeS/WAN configurations to the linux-2.4.3 kernel you created.To complete the FreeS/WAN kernel configuration, enter the following in the /root/freeswan-1.9 directory:

make kinstall

NOTE

When the make kinstall command is run from the freeswan directory, it performs the same make commands that you usually run from the /linux directory to configure and install your kernel. It runs the equivalent make commands:

make

make install

make modules

make modules_install

www.syngress.com

8.The lilo.conf file already specifies the new kernel image location. However, you can enter the lilo command to ensure that it is up-to-date by entering the following:

lilo

You should receive the following response:

Added linux *

Added linux-2.4.3

9.You are ready to reboot the system and test whether the new kernel works.

10.Reboot the system into the new linux-2.4.3 kernel image.

11.During the reboot, check the messages during boot.You can also check them using dmesg. Look for the following:

■Make sure that you are booting into the new kernel.

■Make sure that a message appears for KLIPS initialization.

■Make sure that a start report appears for Pluto.

■Make sure that “ipsec_setup – Starting FreeS/WAN IPsec 1.9” appears.

12.Log in as root.

13.Test the IPSec commands shown in Table 8.4 (just make sure that you get a response).

Table 8.4 Commands to Test if IPSec Is Working

14.If the FreeS/WAN kernel implementation is successful, you are ready to continue. Please note that you need a second system setup with FreeS/WAN to create a VPN.

15.If you are not successful, please view the Linux FreeS/WAN online documentation at www.freeswan.org/doc.html. It provides a documentation

www.syngress.com

420 Chapter 8 • Creating Virtual Private Networks

tree with a troubleshooting section, as shown in Figure 8.24.The specific address is: www.freeswan.org/freeswan_trees/freeswan-1.9/doc/ trouble.html

Figure 8.24 Troubleshooting Tips for Linux FreeS/WAN

Configuring FreeS/WAN

After you have compiled FreeS/WAN into your Linux kernel and confirmed that IPSec, KLIPS, and Pluto are running, you are ready to configure the program. Any IPSec implementation requires that you first test IP networking on the gateways, or hosts, at each tunnel endpoint.The reason is because IPSec does not work unless a functional IP network is working underneath it.

In this section, you will configure FreeS/WAN between two hosts, which is a host-to-host VPN solution. In an enterprise environment, these hosts would be the VPN gateways into the network. In a telecommuter environment, one host would be the telecommuter, and the other would be the VPN gateway to the company network.

Testing IP Networking

To create a host-to-host VPN solution, both systems must have FreeS/WAN properly installed and tested. Next, you must ensure that IP networking is

www.syngress.com

functioning. For this demonstration, you will also capture HTTP packets between the hosts.This capture will allow you to compare and prove that IPSec is functioning after the tunnel is created between the hosts.

To test IP networking, make sure that each host can ping the others. If successful, access the default Apache Web page on one of the hosts and capture the transmission.View the packet capture to confirm that the packets are not encrypted.This process is documented in the following steps:

1.For this demonstration, we must define our VPN host1 and host2.Write your host1 and host2 in the space provided. From this point forward, the hosts will be referred to as host1 and host2.

host1 = we-24-130-8-170.we.mediaone.net ______________________

host2 = we-24-130-10-205.we.mediaone.net _____________________

2.Confirm that host1 and host2 are booted into the new kernel that is configured with FreeS/WAN.

3.Confirm that host1 and host2 have FreeS/WAN properly installed and tested.

4.Test connectivity between host1 and host2 using ping. For instance, enter the following from host1:

ping host2

From host2, enter:

ping host1

You should be successful. If not, troubleshoot your network until you gain connectivity between the two hosts.

5. Host2: Make sure that Apache is installed by entering the following:

rpm –qa | grep apache

6.Host2:You should receive a response similar to the following if Apache is installed:

apache-manual-1.3.12-25

apache-1.3.12-25

apache-devel-1.3.12-25

www.syngress.com

422Chapter 8 • Creating Virtual Private Networks

7.Host2: If you do not receive a response, then you need to download and install Apache.

8.Host2: After you confirm that Apache is installed and running, you have completed Apache configuration.This is because host1 will access the default Web site that Apache configures automatically upon installation.

9.Host1: Capture HTTP packets between your Web browser and the Apache Web server on Host2.To accomplish this task, you must first set up a packet capture filter between host1 and host2 using Ethereal.To set up the filter, complete the following steps:

10.Host1:Verify that the Ethereal RPM is installed on the system by entering the following:

rpm –qa | grep ethereal

11.Host1: If you do not receive a reply, then you need to download and install Ethereal (www.rpmfind.net).You can also install it from your PowerTools CD that is distributed with Red Hat Linux.

12.Host1: After you have verified that Ethereal is installed, you are ready to capture packets.

13.Host1:To add filters to Ethereal without using host names, open a command interface and enter the following:

ethereal -n

14.Host1: From the Edit menu, choose Filters.The Ethereal: Filters screen appears. Because no filters have been configured, the configuration screen is blank.

15.Host1:To create a filter that allows only traffic between your host and another host, you must add a filter name and a filter string. For instance, to create a filter between two hosts (host1 and host2), enter the filter name HTTP Capture and filter string shown in Figure 8.25. Please note that your IP addresses will not be the same.

16.Host1: After the two fields are complete, you must click the Save button and then click the New button. Click the OK button to exit.

17.Host1:To start a packet capture, simply choose Start from the Capture menu.The Capture Preference screen appears. Click the Filter button and choose the HTTP Capture filter that you created. Click the OK button twice, and the capture starts.

www.syngress.com

Figure 8.25 Creating a Filter between Two Hosts

18.Host1:To generate the HTTP packets, open the browser and access the default Web page on the host2 Web server. For instance, enter the following: http://we-24-130-10-205.we.mediaone.net.

19.Host1:The default Web page on the host2 Web server appears, as shown in Figure 8.26.

Figure 8.26 Accessing the Default Web Page on the host2 Web Server

20.Host1: Close the browser.

21.Host1: Stop the Ethereal packet capture by clicking the Stop button.

www.syngress.com

424Chapter 8 • Creating Virtual Private Networks

22.Host1:The packet capture appears in Ethereal.The transmission is not encrypted. All application data is displayed, as well as the port numbers. Your screen will resemble Figure 8.27, which highlights the first HTTP packet.

23.Host1: Save the packet capture as unsecHTTP and quit Ethereal. A sample unsecHTTP file is included on the CD accompanying this book.

Figure 8.27 Capturing an HTTP Session without FreeS/WAN

You have successfully tested IP networking between the two VPN hosts.You also captured HTTP packets between the two hosts to prove that a VPN tunnel has not yet been configured.When the VPN tunnel is configured, all traffic between the two hosts will be encrypted, regardless of the applications running between the hosts.

Configuring Public Key Encryption for

Secure Authentication of VPN Endpoints

You have tested and confirmed that an HTTP daemon and browser can communication between host1 and host2. Do not proceed in this chapter until this works.

This proves that the hosts can communicate without IPSec and will make troubleshooting any problems far easier.The next goal will be to have host1 and host2 communicate with the FreeS/WAN IPSec implementation.

www.syngress.com

For IPSec to work, you have to set up public key encryption. As you learned in Chapter 7, public key encryption uses private and public keys to ensure authentication.The private key is known only by the host, and the public key is available to everyone else, such as all hosts that the system will communicate with.

NOTE

The U.S. patent on the RSA algorithm expired on September 20, 2000. Therefore, RSA is used for the public key encryption in FreeS/WAN and will be incorporated into many additional open source programs as they are developed and new versions are released.

An RSA key pair was created during the FreeS/WAN installation process. The key pair is placed in the /etc/ipsec.secrets file.This file must be kept secure because your private key is listed within it. Only you, the superuser, should have access to this /etc/ipsec.secrets file.

The public key should be placed in the /etc/ipsec.conf file. Because the public key is available to anyone with whom you communicate, security is not as important for the /etc/ipsec.conf file.The private and public key locations for FreeS/WAN are summarized in Table 8.5.

Table 8.5 Location of RSA Key Pair for FreeS/WAN

You will configure these files in the following steps on host1 and host2 so that you can start the tunnel. Complete the following steps to configure your systems for FreeS/WAN. FreeS/WAN and IPSec refer to the VPN endpoints as the “left” and “right” hosts. In this section’s demonstration, host1 is left, and host2 is right.

1.Host1: First, you will configure the /etc/ipsec.secrets file, which lists your system’s public and private keys. Open the file by entering the following:

vi /etc/ipsec.secrets

www.syngress.com

426 Chapter 8 • Creating Virtual Private Networks

Your file will resemble the one shown in Figure 8.28.

Figure 8.28 Configuring the /etc/ipsec.secrets File

2.Host1:You are using public key authentication, so you need to comment out (#) the line indicating the “Shared secret.”To do this, press I and comment out the last line in the second paragraph of the file, as follows (your arbitrary character string may vary):

# Shared secret (an arbitrary character string, which should be

# both long and hard to guess, enclosed in quotes) for a pair

#of negotiating hosts.

#Must be same on both; generate on one and copy to the other.

#10.0.0.1 10.12.12.1 : PSK

#"jxmWkkWmm4uV1m4SW3SuUWU1233Wu5S5U3S…"

3.Host1: Notice the public and private key listed in the file. Pluto, which is the IKE implementation on FreeS/WAN, uses these keys to authenticate hosts with your system.

4.Host1: Press ESC, then write and quit the file by entering the following:

:wq

www.syngress.com

NOTE

IPSec (and FreeS/WAN) use RSA keys by default for authentication between the VPN hosts. Encryption is accomplished by default through 3DES.

5.Host1: Next, you will configure the /etc/ipsec.conf file, which lists the configuration and connection information for IPSec.

6.Host1: Make a backup copy of the /etc/ipsec.conf file and name it ipsec.conf-backup.The ipsec.conf file is actually a sample file that you must configure. Enter the following:

cp /etc/ipsec.conf /etc/ipsec.conf-backup

7.Open the /etc/ipsec.conf file by entering the following:

vi /etc/ipsec.conf

8.Host1:Your file will resemble the file shown in Figure 8.29 (Figure 8.30, displayed later in this section, displays the remainder of the file, which has three main sections).

Figure 8.29 Configuring the /etc/ipsec.conf File

www.syngress.com

428Chapter 8 • Creating Virtual Private Networks

9.Host1: As you can see in Figure 8.29, /etc/ipsec.conf is the main FreeS/WAN IPSec configuration file, which has three parts.The “basic configuration” and “defaults for subsequent connection descriptions” sections are shown in the figure.The “connection” section is discussed after these two sections are completed.

NOTE

For more information on the configuration options for ipsec.conf, see the following documents:

■www.freeswan.org/freeswan_trees/freeswan-1.9/doc/manpage.d/ ipsec.conf.5.html

■man ipsec.conf

■/root/freeswan-1.9/doc/examples

10.Host1: Read the “basic configuration” section as follows.You do not need to make any changes to this section of the file. Additional comments are here for your understanding:

#basic configuration

config setup

#THIS SETTING MUST BE CORRECT or almost nothing will work.

#%defaultroute is okay for most simple cases. This defines the

#interfaces that IPsec uses. For instance, you could add

#"ipsec0=eth0" for the interfaces value as well. interfaces=%defaultroute

#Debug-logging controls: Specifies how much KLIPS and Pluto

#debugging output will be logged. Defaults to "none".

#Enter "none" for (almost) none, "all" for lots. klipsdebug=none

plutodebug=none

#Plutoload specifies a connection name (identified in the third

#section of this file) that will be loaded into the internal

#database at startup. It does not attempt to start the

#connection until summoned.

plutoload=host-to-host

www.syngress.com

# Close down old connection when new one using same

#ID showns up. uniqueids=yes

11.Host1:You must modify the “defaults for subsequent connection descriptions” section.The configurations you enable here will determine how the following “connections” section will behave. Because you are using public key cryptography, you do not require the manual-key testing entries.The section should read as follows (you do not need to enter the comments):

#defaults for subsequent connection descriptions

conn %default

# How persistent to be in (re)keying negotiations (0 means

#very). Keying tries=0

#Indicates that RSA authentication will be used for the VPN

#connection. To generate your public key, open a terminal and

#enter 'ipsec showhostkey'. Copy your public key to the

#leftrsasigkey value. Copy the public key of host2 to the

#rightrsasigkey.

authby=rsasig

leftrsasigkey=

rightrsasigkey=

NOTE

The host1 public key is also listed in the /etc/ipsec.secrets file and begins with #pubkey=0x” (see Figure 8.28). Only the hexadecimal portion is required, not the #pubkey=” portion. You can copy the public key from host1 from this file and paste it into the leftrsasigkey= value. You may want to use a text editor other than vi to copy and paste the public key.

12.Host1:You must modify the “sample connection” section so that it applies to a host-to-host connection.The connection section is shown in Figure 8.30.

www.syngress.com

430 Chapter 8 • Creating Virtual Private Networks

Figure 8.30 Configuring the Connection Section of the /etc/ipsec.conf File

NOTE

If you were configuring VPN gateways for a network, you would enter the “leftsubnet” and “rightsubnet” options (shown in Figure 8.30). These options identify the LAN network address that the gateway is attached to. If you were configuring a VPN involving a telecommuter, you would identify the subnet on only one side, because the telecommuter has no gateway, it is a host.

13.Host1: Modify the connection section for a host-to-host VPN solution. Modify the section as follows (you do not need to enter the comments):

#host-to-host tunnel (no subnets)

#In this demonstration, the hosts talk directly to each other,

#so next-hop settings are not required. The name of this

#connection is "host-to-host."

conn host-to-host

#The left host is the IP address of host1. left=24.130.8.170

#Next hop to reach the right host — no value required because

#hosts are on the same network.

leftnexthop=

#The right host is the IP address of host2 right=24.130.10.205

#Next hop to reach the left host — no value required because

www.syngress.com

# hosts are on the same network.

rightnexthop=

14. Host1: Press ESC, then write and quit the file by entering the following:

:wq

15.Host1: Copy the /etc/ipsec.conf file from host1 and transfer it to host2. Doing so will save you a lot of time and effort.

NOTE

If you have security concerns, you can configure the /etc/ipsec.conf file separately on host2. Then, copy the public key of host1 to a text file and name it host1.pub. (A sample host1.pub file is included on the CD accompanying this book). The public key is the line in the output of the /etc/ipsec.secrets file that begins with #pubkey=0x” (see Figure 8.28). Only the hexadecimal portion is required, not the #pubkey=” portion. Then transfer the host1.pub file to host2 and place it in the /etc/ipsec.conf file. As usual, authentication of public keys is essential to ensure that you are not tricked into accepting a public key from a hacker. Make sure that you are certain the public key is from host1.

16.Host2: Log in to host2 as root using the FreeS/WAN-enabled kernel.

17.Host2: Make a backup copy of the /etc/ipsec.conf file and name it ipsec.conf-backup.The ipsec.conf file is actually a sample file that you must configure. Enter the following:

cp /etc/ipsec.conf /etc/ipsec.conf-backup

18.Host2: Replace the host2 /etc/ipsec.conf file with the host1 ipsec.conf file.You need to add only the host2 public key to the rightrsasigkey= value, which you will do in the following steps.

19.Host2: Open the /etc/ipsec.secrets file by entering the following:

vi /etc/ipsec.secrets

www.syngress.com

432 Chapter 8 • Creating Virtual Private Networks

20.Host2: Similar to host1, comment out (#) the line indicating the “Shared secret”.To do this, press I and comment out the last line in the second

paragraph of the file, as shown (your arbitrary character string may vary):

# Shared secret (an arbitrary character string, which should be

# both long and hard to guess, enclosed in quotes) for a pair

#of negotiating hosts.

#Must be same on both; generate on one and copy to the other.

#10.0.0.1 10.12.12.1 : PSK

#"jxmWkkWmm4uV1m4SW3SuUWU1233Wu5S5U3S…"

21.Host2: Copy the public key of host2.The public key is the line in the output of the /etc/ipsec.secrets file that begins with #pubkey=0x”. Only the hexadecimal portion is required, not the #pubkey=” portion.

22.Host2: Paste the public key of host2 to the /etc/ipsec.conf rightrsasigkey= value.You may want to use a text editor other than vi to copy and paste the public key. Both public keys for host1 and host2 should now be listed in the file.

23.Host2:Write and quit both the /etc/ipsec.secrets and the /etc/ipsec.conf file.

24.Host2:Transfer the host2 public key to host1. For instance, copy the public key of host2 to a text file and name it host1.pub, (a sample host1.pub file is included on the CD accompanying this book), or copy the /etc/ipsec.conf file to host1.The file will be exactly the same on both hosts, so this method is possible.

25.Host1: Copy the public key of host2 to the /etc/ipsec.conf rightrsasigkey= value.

26.Host1 and Host2:The ipsec.conf file on both host1 and host2 should be identical. Figures 8.31 through 8.33 display the completed ipsec.conf file for the host-to-host tunnel for two mediaone.net endpoints. A sample ipsec.conf file is included on the CD accompanying this book.

www.syngress.com

Figure 8.31 Final Configurations for the “Basic Configuration” Section of the /etc/ipsec.secrets File

Figure 8.32 Final Configurations for the “Defaults for Subsequent Connection Descriptions” Section of the /etc/ipsec.conf File

Figure 8.33 Final Configurations for the “Connection (Host-to-Host Tunnel)” Section of the /etc/ipsec.conf File

www.syngress.com

434 Chapter 8 • Creating Virtual Private Networks

Starting the Tunnel

Congratulations. Both /etc/ipsec.conf and /etc/ipsec.secret files on host1 and host2 are configured with each other’s public keys. Now you must create the tunnel.The commands used to start, stop, and maintain the tunnel are IPSec commands.Table 8.6 displays common IPSec commands.

Table 8.6 Common IPSec Commands

Most IPSec commands have their own man pages. For a listing, visit www.freeswan.org/freeswan_trees/freeswan-1.9/doc/manpages.html.You can also view the IPSec man page. It lists the associated IPSec commands that have their own man pages.

www.syngress.com

The following steps will demonstrate how to start the tunnel using IPSec commands:

1.Host1 and Host2: Reboot the systems and make sure that you load the FreeS/WAN-enabled kernel.The reboot loads your “host-to-host” connection that you specified in the /etc/ipsec.conf file into Pluto’s internal database at startup. Recall the plutoload=host-to-host line.

2.Host1 and Host2: Examine /var/log/messages for any IPSec errors.

3.Host1 and Host2: Check that the following entries exist in /proc/net/ directory:

ipsec_version

ipsec_tncfg

ipsec_eroute

ipsec_spi

ipsec_spigrp

4.Host1 and Host2: Check for the IPSec virtual interface on the host. Enter the following:

cat /proc/net/ipsec_tncfg

5.Host1 and Host2: ipsec0 should be listed. It will point to your physical interface, such as eth0. For instance, it will read as follows:

ipsec0 -> eth0 mtu=16260 -> 0 ipsec1 -> NULL mtu=0 -> 0 ipsec2 -> NULL mtu=0 -> 0 ipsec3 -> NULL mtu=0 -> 0

The ipsec0 pseudo-device uses the FreeS/WAN eroute utility.This routes all connections through this device and encrypts it before sending it to the underlying physical interface.

6. Host1: On one of the hosts, start the tunnel by entering the following:

ipsec auto –-up host-to-host

where host-to-host is the name of the connection you created in the ipsec.conf file.

www.syngress.com

436 Chapter 8 • Creating Virtual Private Networks

7.Host1: If no errors are supported, the VPN tunnel should be established. Enter the following command to observe the connection configuration:

ipsec look

8.The response from both ipsec commands should resemble Figure 8.34. If you receive a similar response, your VPN tunnel is established between the hosts.

Figure 8.34 Starting and Confirming the Establishment of a Host-to-Host VPN Tunnel

Capturing VPN Tunnel Traffic

To ensure that your VPN is actually encrypting traffic between the hosts, you need to capture packets using the HTTP Capture filter you created in the “Testing IP Networking” section of this chapter. Complete the following steps to prove that the VPN is indeed functioning. Any traffic you send between the hosts will be encrypted.

1.Host1: Open Ethereal without using host names, open a command interface, and enter the following:

ethereal -n

2.Host1:To start a packet capture, simply choose Start from the Capture menu.The Capture Preference screen appears. Click the Filter button

www.syngress.com

and choose the “HTTP Capture” filter that you created. Click the OK button twice, and the capture starts.

3.Host1:To generate the HTTP packets, open the browser and access the default Web page on the host2 Web server. For instance, enter the following:

http://we-24-130-10-205.we.mediaone.net

4.Host1:The default Web page on the host2 Web server appears.

5.Host1: Close the browser.

6.Host1: Stop the Ethereal packet capture by clicking the Stop button.

7.Host1:The packet capture appears in Ethereal.The transmission is encrypted. No application data or port numbers are displayed.Your screen will resemble Figure 8.35, which highlights the first encrypted packet. In this case, ESP uses 3DES for packet encryption and MD5 for packet authentication.

Figure 8.35 Capturing an HTTP Session with a FreeS/WAN Host-to-Host VPN

8.Host1: Save the packet capture as tunntraf and quit Ethereal. A sample tunntraf file is included on the CD accompanying this book.

www.syngress.com

438 Chapter 8 • Creating Virtual Private Networks

You have successfully implemented a VPN host-to-host solution over an unsecured network.You captured HTTP packets between the two hosts to prove that a VPN tunnel has not only been configured, but that it works.When the VPN tunnel is configured, all traffic between the two hosts is encrypted, regardless of the applications running between the hosts.

Closing the VPN Tunnel

To close the VPN tunnel, you must close the connection from both endpoints of the tunnel. Even though you started the VPN tunnel from one endpoint, both endpoints must terminate the connection. It can be terminated by completing the following steps:

1. Host1:To close the VPN tunnel from host1, enter the following:

ipsec auto --down host-to-host

2. Host2:To close the VPN tunnel from host2, enter the same command:

ipsec auto --down host-to-host

www.syngress.com

Summary

In this chapter, you learned how it is possible to deploy secure authentication and strong encryption to establish network security using virtual private networks (VPNs). A VPN provides a private data network over public telecommunication infrastructures, such as the Internet. It provides both secure authentication and encryption. It creates a data tunnel between devices so that all data transmitted between the devices is secure, regardless of what programs the devices are running.There are three basic types of VPN solutions: telecommuter, router-to- router, and host-to-host.

A tunnel is created between VPN hosts to ensure that all traffic between them is secure.The tunnel is created with a tunneling protocol.These protocols are responsible for encapsulating a data packet before a host transmits it. After the data is encapsulated, it is sent over the Internet until it arrives at its destination.When it arrives, the capsule is removed and the destination host processes the data.

IPSec is an Internet Engineering Task Force (IETF) security protocol that is becoming a standard component of VPN tunneling protocols. As the name suggests, it was designed for IP, and it has gained wide industry support. IPSec provides secure authentication and encryption over a network by securing all packets at Layer 3—the network layer—of the Open System Interconnection (OSI) model. Layer 3 security is significant because Layer 3 is responsible for IP addressing and routing over the Internet. Security at this layer ensures that everything on the network is secure.

IPSec is often used in conjunction with the Internet Key Exchange (IKE) protocol. IKE is a key management protocol standard that enhances IPSec, such as providing a simpler IPSec configuration, flexibility, and more features. IKE is not required to run IPSec, but it enhances the standard.

Free Secure Wide Area Network (FreeS/WAN) is a Linux VPN implementation that uses IPSec and IKE. IPSec and IKE are used to provide secure authentication and encryption of data between two hosts at Layer 3 (the network layer) of the OSI model. FreeS/WAN creates a secure VPN tunnel between the hosts. It is the goal of S/WAN developers for all S/WAN implementations to interoperate, no matter what device they are installed on.The FreeS/WAN project goal is to provide freely available source code to promote IPSec and allow it to run on many different machines. It also avoids export restrictions.

Last, you learned how to compile FreeS/WAN into a Linux kernel and discovered how to configure and test a host-to-host VPN.You captured the traffic transmitted in the VPN tunnel and realized that it would be useless to a hacker

www.syngress.com

440 Chapter 8 • Creating Virtual Private Networks

because it is encrypted.When the VPN tunnel is configured, all traffic between the two hosts is encrypted, regardless of the applications running between the hosts.

Solutions Fast Track

Secure Tunneling with VPNs

;VPNs provide a private data network over public telecommunication infrastructures, such as the Internet, by providing authentication and encryption through a data “tunnel” between devices. All data transmitted between the devices through the tunnel is secure, regardless of what programs the devices are running.

;Telecommuter, router-to-router, and host-to-host are three the basic types of VPN solutions.The solution you choose will depend on your specific needs.

;Tunneling protocols are responsible for encapsulating a data packet before a host transmits it.The data is encapsulated and sent over the network to its destination. Upon arrival, the capsule is removed and the data is processed by the destination host. IP tunneling protocols are powerful because they can transmit foreign protocols over the Internet.

Explaining the IP Security Architecture

;IPSec is an Internet Engineering Task Force (IETF) security protocol that is becoming a standard component of VPN tunneling protocols.

;IPSec secures all packets at Layer 3 (the network layer) of the OSI model by providing secure authentication and encryption over a network. Layer 3 security ensures that everything on the network is secure, such as IP addressing and routing over the Internet, as well as all application data.

Creating a VPN by Using FreeS/WAN

; FreeS/WAN is a Linux VPN implementation that uses IPSec and IKE.

;IKE is a key management protocol standard that enhances IPSec. It provides enhancements such as simplifying IPSec configuration and adding

www.syngress.com

flexibility and more features. It is not required for IPSec, but is often used in conjunction with it. FreeS/WAN uses Pluto, which is an IKE daemon.

;The Authentication Header (AH) performs authentication at the packet level in IPSec.The Encapsulating Security Payload (ESP) performs encryption as well as authentication. FreeS/WAN uses the Kernel IPSec (KLIPS) to perform AH and ESP functions.

Frequently Asked Questions

The following Frequently Asked Questions, answered by the authors of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form.

Q:I had great difficulty installing FreeS/WAN. Does a simpler solution exist for an IPSec gateway?

A:The FreeS/WAN program is included in several Linux distributions and various firewall packages. Installation procedures for these products would incorporate FreeS/WAN functionality in your system. Depending on your needs and budget, you may save yourself time and trouble by acquiring FreeS/WAN through one of these alternate sources.

Some available script sets are designed to allow you to manage firewalls that also serve as FreeS/WAN IPSec gateways.You can implement FreeS/WAN through these programs.

Some countries other than the United States have more reasonable encryption laws and thus offer some general-purpose Linux distributions that include FreeS/WAN as well, such as the following:

■Corel Linux (the server edition from Canada)

■Conectiva (from Brazil)

■Polish(ed) Linux Distribution (from Poland)

■SuSE Linux (European versions from Germany)

■Trustix Secure Linux (from Norway)

www.syngress.com

442 Chapter 8 • Creating Virtual Private Networks

You can also use one of the specialized distributions for firewall or router applications.These products offer various alternatives that include FreeS/ WAN. Here are a few:

■Astaro Security Linux This freeS/WAN configuration is included among the Web-based firewall management tools.

■Gibraltar This Debian GNU/Linux-based distribution can be booted from a CD-ROM and can be used without a hard disk.

■Linux Router Project This freeS/WAN packaged for LRP is available from the LRP site hosted by Charles Steinkuehler.This distribution can be booted from a floppy disk.

Q:Can FreeS/WAN interoperate with other versions of IPSec?

A:Any IPSec implementations should be able to communicate with others, because the protocols that support IPSec are designed to allow interoperation. However, IPSec protocols are very complex, and therefore difficulties can arise whenever you attempt interoperation with other programs.

Many IPSec implementations can interoperate with Linux FreeS/WAN; FreeS/WAN can even interoperate with previous versions of itself.You can use existing configuration files for newer FreeS/WAN versions in the same series (for example, all versions 1.x).With the impending release of FreeS/WAN 2.0, you will need to use the new configuration files.Table 8.7 lists IPSec implementations that interoperate well with Linux FreeS/WAN.

Table 8.7 IPSec Implementations that Interoperate with FreeS/WAN

www.syngress.com

Q:When I compile FreeS/WAN, I get the error gmp.h: No such file or directory. Why?

A:The gmp.h error occurs if Pluto cannot locate the GNU Multi-Precision (GMP) library.The GMP library enables Pluto to calculate large numbers for public-key encryption operations. Pluto will not compile until the GMP library is installed.

Two RPMs are usually required for GMP installation: libgmp and libgmp-devel. Most distributions provide the GMP library.You can obtain the RPM files from the vendor’s site if they are not included on your distribution CD-ROMs.

The GMP home page (www.swox.com/gmp) offers the latest version and information regarding the GMP library.

Q: What type of DES encryption does FreeS/WAN offer?

A:The IPSec standard includes DES support, however DES is not considered adequately secure by the developers of the FreeS/WAN program. Because DES methods are not reliable, FreeS/WAN does not use DES to build connections (at the IPSec level) or to negotiate connections (at the IKE level). FreeS/WAN delivers a higher level of security by using the Triple DES (3DES) algorithm instead.

Q: Which versions of Linux are compatible with FreeS/WAN?

A:FreeS/WAN is designed to run on any CPU that Linux supports. Although most distributions will require some minor adjustments for the specific environment, the program is widely adaptable beyond the Red Hat versions

(on which FreeS/WAN is created and tested). As previously discussed in this section, some applications and packages include FreeS/WAN in their distributions.You can visit www.freeswan.org/freeswan_trees/freeswan-1.9/ doc/otherdist to consult the FreeS/WAN compatibility document for more information.

www.syngress.com