Bring head revision up to date with cabal (try #3)
This commit is contained in:
Ivo Timmermans
parent
d3ea434b36
commit
30df5e95db
35 changed files with 3091 additions and 2267 deletions
|
|
@ -1,11 +1,13 @@
|
|||
## Process this file with automake to get Makefile.in
|
||||
|
||||
SUBDIRS = es
|
||||
|
||||
info_TEXINFOS = tinc.texi
|
||||
|
||||
dyn_MANS = tincd.8
|
||||
dyn_MANS =
|
||||
man_aux = $(dyn_MANS:.8=.x)
|
||||
|
||||
man_MANS = tinc.conf.5 genauth.8 $(dyn_MANS)
|
||||
man_MANS = tincd.8 tinc.conf.5 genauth.8 $(dyn_MANS)
|
||||
|
||||
PERL = @PERL@
|
||||
HELP2MAN = help2man
|
||||
|
|
|
|||
121
doc/tinc.conf.5
121
doc/tinc.conf.5
|
|
@ -59,67 +59,104 @@ one space character.
|
|||
.PP
|
||||
.SH "VARIABLES"
|
||||
.PP
|
||||
Here are all valid variables, listed in alphabetical order:
|
||||
Here are all valid variables, listed in alphabetical order. The default
|
||||
value, required or optional is given between parentheses.
|
||||
.TP
|
||||
\fBConnectPort = \fIport\fR
|
||||
Connect to the upstream host (given with the \fBConnectTo\fR
|
||||
directive) on port \fIport\fR. \fIport\fR may be given in decimal
|
||||
(default), octal (when preceded by a single zero) or hexadecimal
|
||||
(prefixed with \fB0x\fR). \fIport\fR is the port number for both the
|
||||
UDP and the TCP (meta) connections.
|
||||
\fBConnectPort\fR = <\fIport\fR> (655)
|
||||
Connect to the upstream host (given with the \fBConnectTo\fR directive) on
|
||||
port \fIport\fR. port may be given in decimal (default), octal (when preceded
|
||||
by a single zero) or hexadecimal (prefixed with 0x). \fIport\fR is the port
|
||||
number for both the UDP and the TCP (meta) connections.
|
||||
.TP
|
||||
\fBConnectTo = \fB(\fIIP address\fB|\fIhostname\fB)\fR
|
||||
Specifies which host to connect to on startup. If the
|
||||
\fBConnectPort\fR variable is omitted, then tinc will try to connect
|
||||
to port 655.
|
||||
\fBConnectTo\fR = <\fIIP address|hostname\fR> (optional)
|
||||
Specifies which host to connect to on startup. Multiple \fBConnectTo\fR variables
|
||||
may be specified, if connecting to the first one fails then tinc will try
|
||||
the next one, and so on. It is possible to specify hostnames for dynamic IP
|
||||
addresses (like those given on dyndns.org), tinc will not cache the resolved
|
||||
IP address.
|
||||
|
||||
If you don't specify a host with \fBConnectTo\fR, tinc won't connect
|
||||
at all, and will instead just listen for incoming connections. Only
|
||||
the initiator of a tinc VPN should need this.
|
||||
If you don't specify a host with \fBConnectTo\fR, regardless of whether a
|
||||
value for \fBConnectPort\fR is given, tinc won't connect at all, and will
|
||||
instead just listen for incoming connections.
|
||||
.TP
|
||||
\fBKeyExpire = \fIs\fR
|
||||
The secret (and public) key expires after \fIs\fR seconds. The default
|
||||
is 3600 seconds, or one hour.
|
||||
\fBHostnames\fR = <\fIyes|no\fR> (no)
|
||||
This option selects whether IP addresses (both real and on the VPN) should
|
||||
be resolved. Since DNS lookups are blocking, it might affect tinc's
|
||||
efficiency, even stopping the daemon for a few seconds everytime it does
|
||||
a lookup if your DNS server is not responding.
|
||||
|
||||
If you make it shorter, a lot of time and bandwidth is spent
|
||||
negotiating over the new keys. If you make it longer, you make
|
||||
yourself more vulnerable to crackers, because they have more data to
|
||||
work with. The best value depends on the speed of the link, and the
|
||||
amount of data that goes over it.
|
||||
This does not affect resolving hostnames to IP addresses from the configuration
|
||||
file.
|
||||
.TP
|
||||
\fBListenPort = \fIport\fR
|
||||
Listen on local port \fIport\fR. The computer connecting to this
|
||||
daemon should use this number as the argument for his
|
||||
\fBConnectPort\fR. Again, the default is 655.
|
||||
\fBIndirectData\fR = <\fIyes|no\fR> (no)
|
||||
This option specifies whether other tinc daemons besides the one you
|
||||
specified with \fBConnectTo\fR can make a direct connection to you. This is
|
||||
especially useful if you are behind a firewall and it is impossible
|
||||
to make a connection from the outside to your tinc daemon. Otherwise,
|
||||
it is best to leave this option out or set it to no.
|
||||
.TP
|
||||
\fBMyOwnVPNIP = \fInetwork address\fR[\fB/\fImaskbits\fR]
|
||||
The \fInetwork address\fR is the number that the daemon will propagate
|
||||
to other daemons on the network when it is identifying itself. Hence
|
||||
this will be the file name of the passphrase file that the other end
|
||||
expects to find the passphrase in.
|
||||
\fBInterface\fR = <\fIdevice\fR> (optional)
|
||||
If you have more than one network interface in your computer, tinc will by
|
||||
default listen on all of them for incoming connections. It is possible to
|
||||
bind tinc to a single interface like eth0 or ppp0 with this variable.
|
||||
.TP
|
||||
\fBInterfaceIP\fR = <\fIlocal address\fR> (optional)
|
||||
If your computer has more than one IP address on a single interface (for example
|
||||
if you are running virtual hosts), tinc will by default listen on all of them for
|
||||
incoming connections. It is possible to bind tinc to a single IP address with
|
||||
this variable. It is still possible to listen on several interfaces at the same
|
||||
time though, if they share the same IP address.
|
||||
.TP
|
||||
\fBKeyExpire\fR = <\fIseconds\fR> (3600)
|
||||
This option controls the time the encryption keys used to encrypt the data
|
||||
are valid. It is common practice to change keys at regular intervals to
|
||||
make it even harder for crackers, even though it is thought to be nearly
|
||||
impossible to crack a single key.
|
||||
.TP
|
||||
\fBListenPort\fR = <\fIport\fR> (655)
|
||||
Listen on local port \fIport\fR. The computer connecting to this daemon should
|
||||
use this number as the argument for his \fBConnectPort\fR.
|
||||
.TP
|
||||
\fBMyOwnVPNIP\fR = <\fIlocal address[/maskbits]\fR> (required)
|
||||
The \fIlocal address\fR is the number that the daemon will propagate to
|
||||
other daemons on the network when it is identifying itself. Hence this
|
||||
will be the file name of the passphrase file that the other end expects
|
||||
to find the passphrase in.
|
||||
|
||||
The local address is the IP address of the tap device, not the real IP
|
||||
address of the host running tincd. Due to changes in recent kernels, it
|
||||
is also necessary that you make the ethernet (also known as MAC) address
|
||||
equal to the IP address (see the example).
|
||||
|
||||
\fImaskbits\fR is the number of bits set to 1 in the netmask part.
|
||||
.TP
|
||||
\fBMyVirtualIP = \fInetwork address\fR[\fB/\fImaskbits\fR]
|
||||
\fBMyVirtualIP\fR = <\fIlocal address[/maskbits]>
|
||||
This is an alias for \fBMyOwnVPNIP\fR.
|
||||
.TP
|
||||
\fBPassphrases = \fIdirectory\fR
|
||||
The directory where tinc will look for passphrases when someone tries
|
||||
to cennect. Please see the manpage for \fBgenauth\fR(8) for more
|
||||
information about passphrases as used by tinc.
|
||||
\fBPassphrases\fR = <\fIdirectory\fR> (/etc/tinc/NETNAME/passphrases)
|
||||
The directory where tinc will look for passphrases when someone tries to
|
||||
connect. Please see the manpage for genauth(8) for more information
|
||||
about passphrases as used by tinc.
|
||||
.TP
|
||||
\fBPingTimeout = \fInumber\fR
|
||||
The number of seconds of inactivity that tinc will wait before sending
|
||||
a probe to the other end. If that other end doesn't answer within that
|
||||
\fBPingTimeout\fR = <\fIseconds\fR> (5)
|
||||
The number of seconds of inactivity that tinc will wait before sending a
|
||||
probe to the other end. If that other end doesn't answer within that
|
||||
same amount of seconds, the connection is terminated, and the others
|
||||
will be notified of this.
|
||||
.TP
|
||||
\fBTapDevice = \fIdevice\fR
|
||||
\fBTapDevice\fR = <\fIdevice\fR> (/dev/tap0)
|
||||
The ethertap device to use. Note that you can only use one device per
|
||||
daemon. The info pages of the tinc package contain more information
|
||||
about configuring an ethertap device for linux.
|
||||
about configuring an ethertap device for Linux.
|
||||
.TP
|
||||
\fBNetMask = \fImask\fR
|
||||
\fBTCPonly\fR = <\fIyes|no\fR> (no, experimental)
|
||||
If this variable is set to yes, then the packets are tunnelled over a TCP
|
||||
connection instead of a UDP connection. This is especially useful for those
|
||||
who want to run a tinc daemon from behind a masquerading firewall, or if
|
||||
UDP packet routing is disabled somehow. This is experimental code,
|
||||
try this at your own risk.
|
||||
.TP
|
||||
\fBVpnMask\fR = <\fImask\fR> (optional)
|
||||
The mask that defines the scope of the entire VPN. This option is not used
|
||||
by the tinc daemon itself, but can be used by startup scripts to configure
|
||||
the ethertap devices correctly.
|
||||
|
|
|
|||
585
doc/tinc.texi
585
doc/tinc.texi
|
|
@ -1,4 +1,5 @@
|
|||
\input texinfo @c -*-texinfo-*-
|
||||
@c $Id: tinc.texi,v 1.9 2000/10/18 20:12:06 zarq Exp $
|
||||
@c %**start of header
|
||||
@setfilename tinc.info
|
||||
@settitle tinc Manual
|
||||
|
|
@ -12,40 +13,45 @@
|
|||
|
||||
This is the info manual for tinc, a Virtual Private Network daemon.
|
||||
|
||||
Copyright 1998,199,2000 Ivo Timmermans <itimmermans@@bigfoot.com>
|
||||
Copyright @copyright{} 1998,199,2000 Ivo Timmermans
|
||||
<itimmermans@@bigfoot.com>, Guus Sliepen <guus@@sliepen.warande.net> and
|
||||
Wessel Dankers <wsl@@nl.linux.org>.
|
||||
|
||||
Permission is granted to make and distribute verbatim
|
||||
copies of this manual provided the copyright notice and
|
||||
this permission notice are preserved on all copies.
|
||||
$Id: tinc.texi,v 1.9 2000/10/18 20:12:06 zarq Exp $
|
||||
|
||||
Permission is granted to copy and distribute modified
|
||||
versions of this manual under the conditions for
|
||||
verbatim copying, provided
|
||||
that the entire resulting derived work is distributed
|
||||
under the terms of a permission notice identical to this
|
||||
one.
|
||||
Permission is granted to make and distribute verbatim copies of this
|
||||
manual provided the copyright notice and this permission notice are
|
||||
preserved on all copies.
|
||||
|
||||
Permission is granted to copy and distribute modified versions of this
|
||||
manual under the conditions for verbatim copying, provided that the
|
||||
entire resulting derived work is distributed under the terms of a
|
||||
permission notice identical to this one.
|
||||
|
||||
@end ifinfo
|
||||
|
||||
@titlepage
|
||||
@title tinc Manual
|
||||
@subtitle Setting up a Virtual Private Network with tinc
|
||||
@author Ivo Timmermans <itimmermans@@bigfoot.com>
|
||||
@author Ivo Timmermans and Guus Sliepen
|
||||
|
||||
@page
|
||||
@vskip 0pt plus 1filll
|
||||
Copyright @copyright{} 1998,1999,2000 Ivo Timmermans <itimmermans@@bigfoot.com>
|
||||
@cindex copyright
|
||||
Copyright @copyright{} 1998,1999,2000 Ivo Timmermans
|
||||
<itimmermans@@bigfoot.com>, Guus Sliepen <guus@@sliepen.warande.net> and
|
||||
Wessel Dankers <wsl@@nl.linux.org>.
|
||||
|
||||
Permission is granted to make and distribute verbatim
|
||||
copies of this manual provided the copyright notice and
|
||||
this permission notice are preserved on all copies.
|
||||
$Id: tinc.texi,v 1.9 2000/10/18 20:12:06 zarq Exp $
|
||||
|
||||
Permission is granted to copy and distribute modified
|
||||
versions of this manual under the conditions for
|
||||
verbatim copying, provided
|
||||
that the entire resulting derived work is distributed
|
||||
under the terms of a permission notice identical to this
|
||||
one.
|
||||
Permission is granted to make and distribute verbatim copies of this
|
||||
manual provided the copyright notice and this permission notice are
|
||||
preserved on all copies.
|
||||
|
||||
Permission is granted to copy and distribute modified versions of this
|
||||
manual under the conditions for verbatim copying, provided that the
|
||||
entire resulting derived work is distributed under the terms of a
|
||||
permission notice identical to this one.
|
||||
|
||||
@end titlepage
|
||||
|
||||
|
|
@ -54,8 +60,8 @@ Copyright @copyright{} 1998,1999,2000 Ivo Timmermans <itimmermans@@bigfoot.com>
|
|||
|
||||
@menu
|
||||
* Introduction:: Introduction
|
||||
* Configuring a Linux system:: Before compiling tinc
|
||||
* Installing tinc::
|
||||
* Installing tinc - preparations::
|
||||
* Installing tinc - installation::
|
||||
* Configuring tinc::
|
||||
* Running tinc::
|
||||
* Technical information::
|
||||
|
|
@ -63,12 +69,14 @@ Copyright @copyright{} 1998,1999,2000 Ivo Timmermans <itimmermans@@bigfoot.com>
|
|||
* Concept Index:: All used terms explained
|
||||
@end menu
|
||||
|
||||
|
||||
@contents
|
||||
|
||||
@c ==================================================================
|
||||
@node Introduction, Configuring a Linux system, Top, Top
|
||||
@node Introduction, Installing tinc - preparations, Top, Top
|
||||
@chapter Introduction
|
||||
|
||||
@c straight from the www page
|
||||
|
||||
@cindex tinc
|
||||
tinc is a Virtual Private Network (VPN) daemon that uses tunneling and
|
||||
encryption to create a secure private network between hosts on the
|
||||
Internet.
|
||||
|
|
@ -86,12 +94,14 @@ process of tinc itself.
|
|||
@menu
|
||||
* VPNs:: Virtual Private Networks in general
|
||||
* tinc:: about tinc
|
||||
* Supported platforms::
|
||||
@end menu
|
||||
|
||||
@c ==================================================================
|
||||
@node VPNs, tinc, Introduction, Introduction
|
||||
@section Virtual Private Networks
|
||||
|
||||
@cindex VPN
|
||||
A Virtual Private Network or VPN is a network that can only be accessed
|
||||
by a few elected computers that participate. This goal is achievable in
|
||||
more than just one way.
|
||||
|
|
@ -100,7 +110,7 @@ more than just one way.
|
|||
Private networks can consist of a single stand-alone ethernet LAN. Or
|
||||
even two computers hooked up using a null-modem cable. In these cases,
|
||||
it is
|
||||
obvious that the network is @emph{private}, noone can access it from the
|
||||
obvious that the network is @emph{private}, no one can access it from the
|
||||
outside. But if your computers are linked to the internet, the network
|
||||
is not private anymore, unless one uses firewalls to block all private
|
||||
traffic. But then, there is no way to send private data to trusted
|
||||
|
|
@ -131,9 +141,11 @@ that flows over the network.
|
|||
|
||||
|
||||
@c ==================================================================
|
||||
@node tinc, , VPNs, Introduction
|
||||
@node tinc, Supported platforms, VPNs, Introduction
|
||||
@section tinc
|
||||
|
||||
@cindex vpnd
|
||||
@cindex ethertap
|
||||
I really don't quite remember what got us started, but it must have been
|
||||
Guus' idea. He wrote a simple implementation (about 50 lines of C) that
|
||||
used the @emph{ethertap} device that Linux knows of since somewhere
|
||||
|
|
@ -158,23 +170,101 @@ available too.
|
|||
|
||||
|
||||
@c ==================================================================
|
||||
@node Configuring a Linux system, Installing tinc, Introduction, Top
|
||||
@chapter Configuring a Linux system
|
||||
@node Supported platforms, , tinc, Introduction
|
||||
@section Supported platforms
|
||||
|
||||
This chapter contains information on how a Linux system is configured
|
||||
for the use of tinc.
|
||||
tinc works on Linux, FreeBSD and Solaris. These are the three platforms
|
||||
that are supported by the universial TUN/TAP device driver, so if
|
||||
support for other operating systems is added to this driver, perhaps
|
||||
tinc will run on them as well. Without this driver, tinc will most
|
||||
likely compile and run, but it will not be able to send or receive data
|
||||
packets.
|
||||
|
||||
@c ==================================================================
|
||||
@subsection Linux
|
||||
|
||||
tinc was first written for Linux running on an intel x86 processor, so
|
||||
this is the best supported platform. The protocol however, and actually
|
||||
anything about tinc, has been rewritten to support random byte ordering
|
||||
and arbitrary word length. So in theory it should run on other
|
||||
processors that Linux runs on. Take care however, we haven't been able
|
||||
to really test it yet. If you want to run tinc on another platform than
|
||||
x86, and want to tell us how it went, please do so.
|
||||
|
||||
tinc uses the ethertap device that is provided in the standard kernel
|
||||
since version 2.1.60, so anything above that (2.2.x, 2.3.x, and the
|
||||
2.4.0-testx (which is current at the time of this writing) kernel
|
||||
versions) is able to support tinc.
|
||||
|
||||
|
||||
@c ==================================================================
|
||||
@subsection FreeBSD
|
||||
|
||||
tinc on FreeBSD relies on the universial TUN/TAP driver for its data
|
||||
acquisition from the kernel. Therefore, tinc suports the same platforms
|
||||
as this driver. These are: FreeBSD 3.x, 4.x, 5.x.
|
||||
|
||||
|
||||
@c ==================================================================
|
||||
@subsection Solaris
|
||||
|
||||
tinc on Solaris relies on the universial TUN/TAP driver for its data
|
||||
acquisition from the kernel. Therefore, tinc suports the same platforms
|
||||
as this driver. These are: Solaris, 2.1.x.
|
||||
|
||||
|
||||
@c
|
||||
@c
|
||||
@c
|
||||
@c
|
||||
@c
|
||||
@c
|
||||
@c Preparing your system
|
||||
@c
|
||||
@c
|
||||
@c
|
||||
@c
|
||||
@c
|
||||
|
||||
@c ==================================================================
|
||||
@node Installing tinc - preparations, Installing tinc - installation, Introduction, Top
|
||||
@chapter Installing tinc: preparations
|
||||
|
||||
This chapter contains information on how to prepare your system to
|
||||
support tinc.
|
||||
|
||||
@menu
|
||||
* Configuring the kernel::
|
||||
* Files Needed::
|
||||
* Setting up the devices::
|
||||
* Libraries::
|
||||
@end menu
|
||||
|
||||
|
||||
@c ==================================================================
|
||||
@node Configuring the kernel, Files Needed, Configuring a Linux system, Configuring a Linux system
|
||||
@node Configuring the kernel, Libraries, Installing tinc - preparations, Installing tinc - preparations
|
||||
@section Configuring the kernel
|
||||
|
||||
If you are running Linux, chances are good that your kernel already
|
||||
supports all the devices that tinc needs for proper operation. For
|
||||
example, the standard kernel from Redhat Linux already has support for
|
||||
ethertap and netlink compiled in. Debian users can use the modconf
|
||||
utility to select the modules. If your Linux distribution supports this
|
||||
method of selecting devices, look out for something called `ethertap',
|
||||
and `netlink_dev'. You need both these devices.
|
||||
|
||||
If you can install these devices in a similar manner, you may skip this
|
||||
section.
|
||||
|
||||
@menu
|
||||
* Configuration of the Linux kernel::
|
||||
* Configuration of the FreeBSD kernel::
|
||||
* Configuration of the Solaris kernel::
|
||||
@end menu
|
||||
|
||||
|
||||
@c ==================================================================
|
||||
@node Configuration of the Linux kernel, Configuration of the FreeBSD kernel, Configuring the kernel, Configuring the kernel
|
||||
@subsection Configuring the Linux kernel
|
||||
|
||||
Since this particular implementation only runs on 2.1 or higher Linux
|
||||
kernels, you should grab one (2.2 is current at this time). A 2.0 port
|
||||
is not really possible, unless someone tells me someone ported the
|
||||
|
|
@ -185,9 +275,11 @@ new kernel, you should read the
|
|||
@uref{http://howto.linuxberg.com/LDP/HOWTO/Kernel-HOWTO.html, Kernel
|
||||
HOWTO} first. Do that now!
|
||||
|
||||
Here are the options you have to turn on/off when configuring a new
|
||||
Here are the options you have to turn on when configuring a new
|
||||
kernel.
|
||||
|
||||
For kernel 2.2.x:
|
||||
|
||||
@example
|
||||
Code maturity level options
|
||||
[*] Prompt for development and/or incomplete code/drivers
|
||||
|
|
@ -198,6 +290,19 @@ Network device support
|
|||
<*> Ethertap network tap
|
||||
@end example
|
||||
|
||||
For kernel 2.3.x and 2.4.x:
|
||||
|
||||
@example
|
||||
Code maturity level options
|
||||
[*] Prompt for development and/or incomplete code/drivers
|
||||
Networking options
|
||||
[*] Kernel/User netlink socket
|
||||
<*> Netlink device emulation
|
||||
Network device support
|
||||
<*> Universal TUN/TAP device driver support
|
||||
@end example
|
||||
|
||||
|
||||
Any other options not mentioned here are not relevant to tinc. If you
|
||||
decide to build any of these as dynamic kernel modules, it's a good idea
|
||||
to add these lines to @file{/etc/modules.conf}.
|
||||
|
|
@ -207,34 +312,179 @@ alias tap0 ethertap
|
|||
alias char-major-36 netlink_dev
|
||||
@end example
|
||||
|
||||
If you have a 2.4 kernel, you can also choose to use the `Ethertap
|
||||
network tap' device. This is marked obsolete, because the universal
|
||||
TUN/TAP driver is a newer implementation that is supposed to be used in
|
||||
favor of ethertap. For tinc, it doesn't really matter which one you
|
||||
choose; based on the device file name, tinc will make the right choice
|
||||
about what protocol to use.
|
||||
|
||||
Finally, after having set up other options, build the kernel and boot
|
||||
it. Unfortunately it's not possible to insert these modules in a running
|
||||
kernel.
|
||||
it. Unfortunately it's not possible to insert these modules in a
|
||||
running kernel.
|
||||
|
||||
|
||||
@c ==================================================================
|
||||
@node Files Needed, Setting up the devices, Configuring the kernel, Configuring a Linux system
|
||||
@section Files Needed
|
||||
@node Configuration of the FreeBSD kernel, Configuration of the Solaris kernel, Configuration of the Linux kernel, Configuring the kernel
|
||||
@subsection Configuring the FreeBSD kernel
|
||||
|
||||
@subsubheading Device files
|
||||
This section will contain information on how to configure your FreeBSD
|
||||
kernel to support the universal TUN/TAP device. For 5.0 and 4.1
|
||||
systems, this is included in the kernel configuration, for earlier
|
||||
systems (4.0 and 3.x), you need to install the universal TUN/TAP driver
|
||||
yourself.
|
||||
|
||||
Unfortunately somebody still has to write the text.
|
||||
|
||||
|
||||
@c ==================================================================
|
||||
@node Configuration of the Solaris kernel, , Configuration of the FreeBSD kernel, Configuring the kernel
|
||||
@subsection Configuring the Solaris kernel
|
||||
|
||||
This section will contain information on how to configure your Solaris
|
||||
kernel to support the universal TUN/TAP device. You need to install
|
||||
this driver yourself.
|
||||
|
||||
Unfortunately somebody still has to write the text.
|
||||
|
||||
|
||||
@c ==================================================================
|
||||
@node Libraries, , Configuring the kernel, Installing tinc - preparations
|
||||
@section Libraries
|
||||
|
||||
@cindex requirements
|
||||
Before you can configure or build tinc, you need to have the OpenSSL
|
||||
library installed on your system. If you try to configure tinc without
|
||||
having installed it, configure will give you an error message, and stop.
|
||||
|
||||
@menu
|
||||
* OpenSSL::
|
||||
@end menu
|
||||
|
||||
|
||||
@c ==================================================================
|
||||
@node OpenSSL, , Libraries, Libraries
|
||||
@subsection OpenSSL
|
||||
|
||||
@cindex OpenSSL
|
||||
For all cryptography-related functions, tinc uses the functions provided
|
||||
by the OpenSSL library. We recommend using version 0.9.5 or 0.9.6 of
|
||||
this library. Other versions may also work, but we can guarantee
|
||||
nothing.
|
||||
|
||||
If this library is not installed, you wil get an error when configuring
|
||||
tinc for build. Support for running tinc without having OpenSSL
|
||||
installed @emph{may} be added in the future.
|
||||
|
||||
You can use your operating system's package manager to install this if
|
||||
available. Make sure you install the development AND runtime versions
|
||||
of this package.
|
||||
|
||||
If you have to install OpenSSL manually, you can get the source code
|
||||
from @url{http://www.openssl.org/}. Instructions on how to configure,
|
||||
build and install this package are included within the package. Please
|
||||
make sure you build development and runtime libraries (which is the
|
||||
default).
|
||||
|
||||
|
||||
@c
|
||||
@c
|
||||
@c
|
||||
@c Installing tinc
|
||||
@c
|
||||
@c
|
||||
@c
|
||||
@c
|
||||
|
||||
@c ==================================================================
|
||||
@node Installing tinc - installation, Configuring tinc, Installing tinc - preparations, Top
|
||||
@chapter Installing tinc: installation
|
||||
|
||||
If you use Redhat or Debian, you may want to install one of the
|
||||
precompiled packages for your system. These packages are equipped with
|
||||
system startup scripts and sample configurations.
|
||||
|
||||
If you don't run either of these systems, or you want to compile tinc
|
||||
for yourself, you can use the source. The source is distributed under
|
||||
the GNU General Public License (GPL). Download the source from the
|
||||
@uref{http://tinc.nl.linux.org/download.html, download page}, which has
|
||||
the checksums of these files listed; you may wish to check these with
|
||||
md5sum before continuing.
|
||||
|
||||
tinc comes in a handy autoconf/automake package, which you can just
|
||||
treat the same as any other package. Which is just untar it, type
|
||||
`configure' and then `make'.
|
||||
|
||||
More detailed instructions are in the file @file{INSTALL}, which is
|
||||
included in the source distribution.
|
||||
|
||||
@menu
|
||||
* Building tinc::
|
||||
* System files::
|
||||
* Interfaces::
|
||||
@end menu
|
||||
|
||||
|
||||
@c ==================================================================
|
||||
@node Building tinc, System files, Installing tinc - installation, Installing tinc - installation
|
||||
@section Building tinc
|
||||
|
||||
Detailed instructions on configuring the source and building tinc can be
|
||||
found in the file called @file{INSTALL}.
|
||||
|
||||
|
||||
@c ==================================================================
|
||||
@node System files, Interfaces, Building tinc, Installing tinc - installation
|
||||
@section System files
|
||||
|
||||
Before you can run tinc, you
|
||||
|
||||
@menu
|
||||
* Device files::
|
||||
* Other files::
|
||||
@end menu
|
||||
|
||||
|
||||
@c ==================================================================
|
||||
@node Device files, Other files, System files, System files
|
||||
@subsection Device files
|
||||
|
||||
First, you'll need the special device file(s) that form the interface
|
||||
between the kernel and the daemon.
|
||||
|
||||
The permissions for these files have to be such that only the super user
|
||||
may read/write to this file. You'd want this, because otherwise
|
||||
eavesdropping would become a bit too easy. This does, however, imply
|
||||
that you'd have to run tincd as root.
|
||||
|
||||
If you use the universal TUN/TAP driver, you have to create the
|
||||
following device files (unless they already exist):
|
||||
|
||||
@example
|
||||
mknod -m 600 /dev/... c .. ..
|
||||
chown 0.0 /dev/...
|
||||
@end example
|
||||
|
||||
If you want to have more devices, the device numbers will be .. .. ...
|
||||
|
||||
If you use Linux, and you run the new 2.4 kernel using the devfs
|
||||
filesystem, then the tap device will be automatically generated as
|
||||
@file{/dev/netlink/tap0}.
|
||||
|
||||
If you use Linux and have kernel 2.2.x, you have to make the ethertap
|
||||
devices:
|
||||
|
||||
@example
|
||||
mknod -m 600 /dev/tap0 c 36 16
|
||||
chown 0.0 /dev/tap0
|
||||
@end example
|
||||
|
||||
The permissions now will be such that only the super user may read/write
|
||||
to this file. You'd want this, because otherwise eavesdropping would
|
||||
become a bit too easy. This does, however, imply that you'd have to run
|
||||
tincd as root.
|
||||
Any further ethertap devices have minor device number 16 through 31.
|
||||
|
||||
If you want to, you may also create more device files, which would be
|
||||
numbered 0...15, with minor device numbers 16...31. They all should be
|
||||
owned by root and have permission 600.
|
||||
|
||||
@c ==================================================================
|
||||
@node Other files, , Device files, System files
|
||||
@subsection Other files
|
||||
|
||||
@subsubheading @file{/etc/networks}
|
||||
|
||||
|
|
@ -245,6 +495,9 @@ symbolic name. For example:
|
|||
myvpn 10.0.0.0
|
||||
@end example
|
||||
|
||||
This has nothing to do with the MyVPNIP configuration variable that will be
|
||||
discussed later, it is only to make the output of the route command more
|
||||
legible.
|
||||
|
||||
@subsubheading @file{/etc/services}
|
||||
|
||||
|
|
@ -260,15 +513,15 @@ tinc 655/udp TINC
|
|||
|
||||
|
||||
@c ==================================================================
|
||||
@node Setting up the devices, , Files Needed, Configuring a Linux system
|
||||
@section Setting up the devices
|
||||
@node Interfaces, , System files, Installing tinc - installation
|
||||
@section Interfaces
|
||||
|
||||
Before you can start transmitting data over the tinc tunnel, you must
|
||||
set up the ethertap network devices.
|
||||
|
||||
First, decide which IP addresses you want to have associated with these
|
||||
devices, and what network mask they must have. You also need these
|
||||
numbers when you are going to configure tinc itself. @xref{Configuring
|
||||
devices, and what network mask they must have. You also need these
|
||||
numbers when you are going to configure tinc itself. @xref{Configuring
|
||||
tinc}.
|
||||
|
||||
It doesn't matter much which part you do first, setting up the network
|
||||
|
|
@ -282,42 +535,52 @@ after me:
|
|||
ifconfig tap@emph{n} hw ether fe:fd:@emph{xx}:@emph{xx}:@emph{xx}:@emph{xx}
|
||||
@end example
|
||||
|
||||
The @emph{n} here is the number of the ethertap device you want to
|
||||
use. It should be the same @emph{n} as the one you use for
|
||||
@file{/dev/tap@emph{n}}. The @emph{xx}s are four hexadecimal numbers
|
||||
The @emph{n} here is the number of the ethertap device you want to use.
|
||||
It should be the same @emph{n} as the one you use for
|
||||
@file{/dev/tap@emph{n}}. The @emph{xx}s are four hexadecimal numbers
|
||||
(0--ff). With previous versions of tincd, it didn't matter what they
|
||||
were. But newer kernels require properly set up ethernet addresses.
|
||||
In fact, the old behavior was wrong. It is required that the @emph{xx}s
|
||||
match MyOwnVPNIP.
|
||||
were. But newer kernels require properly set up ethernet addresses. In
|
||||
fact, the old behavior was wrong. It is required that the @emph{xx}s
|
||||
match the numbers of the IP address you will give to the tap device and
|
||||
to the MyOwnVPNIP configuration (which will be discussed later).
|
||||
|
||||
@cindex MAC address
|
||||
@cindex hardware address
|
||||
@strong{Tip}: for finding out what the MAC address of the tap interface
|
||||
should be, you can use the following command:
|
||||
|
||||
@example
|
||||
ifconfig tap@emph{n} @emph{IP} netmask @emph{mask}
|
||||
$ printf 'fe:fd:%02x:%02x:%02x:%02x' 10 1 54 1
|
||||
fe:fd:0a:01:36:01
|
||||
@end example
|
||||
|
||||
This will activate the device with an IP address @emph{IP} with network
|
||||
mask @emph{mask}.
|
||||
@cindex ifconfig
|
||||
To activate the device, you have to assign an IP address to it. To set
|
||||
an IP address @emph{IP} with network mask @emph{mask}, do the following:
|
||||
|
||||
@example
|
||||
ifconfig tap@emph{n} @emph{xx}.@emph{xx}.@emph{xx}.@emph{xx} netmask @emph{mask}
|
||||
@end example
|
||||
|
||||
@cindex netmask
|
||||
The netmask is the mask of the @emph{entire} VPN network, not just your
|
||||
own subnet. It is the same netmask you will have to specify with the
|
||||
VpnMask configuration variable.
|
||||
|
||||
|
||||
|
||||
@c ==================================================================
|
||||
@node Installing tinc, Configuring tinc, Configuring a Linux system, Top
|
||||
@chapter Installing tinc
|
||||
|
||||
First download it. This is the
|
||||
@uref{http://tinc.nl.linux.org/download.html, download
|
||||
page}, which has the checksums of these files listed; you may wish to
|
||||
check these with md5sum before continuing.
|
||||
|
||||
tinc comes in a handy autoconf/automake package, which you can just
|
||||
treat the same as any other package. Which is just untar it, type
|
||||
`configure' and then `make'.
|
||||
|
||||
More detailed instructions are in the file @file{INSTALL}, which is
|
||||
included in the source distribution.
|
||||
@c
|
||||
@c
|
||||
@c
|
||||
@c
|
||||
@c Configuring tinc
|
||||
@c
|
||||
@c
|
||||
@c
|
||||
@c
|
||||
|
||||
|
||||
@c ==================================================================
|
||||
@node Configuring tinc, Running tinc, Installing tinc, Top
|
||||
@node Configuring tinc, Running tinc, Installing tinc - installation, Top
|
||||
@chapter Configuring tinc
|
||||
|
||||
@menu
|
||||
|
|
@ -327,7 +590,6 @@ included in the source distribution.
|
|||
* Example::
|
||||
@end menu
|
||||
|
||||
|
||||
@c ==================================================================
|
||||
@node Multiple networks, How connections work, Configuring tinc, Configuring tinc
|
||||
@section Multiple networks
|
||||
|
|
@ -395,31 +657,67 @@ out, remember to replace it with at least one space character.
|
|||
@node Variables, , Configuration file, Configuration file
|
||||
@subsection Variables
|
||||
|
||||
Here are all valid variables, listed in alphabetical order:
|
||||
Here are all valid variables, listed in alphabetical order. The default
|
||||
value, required or optional is given between parentheses.
|
||||
|
||||
@c straight from the manpage
|
||||
@table @asis
|
||||
@item ConnectPort = port
|
||||
@item ConnectPort = <port> (655)
|
||||
Connect to the upstream host (given with the ConnectTo directive) on
|
||||
port port. port may be given in decimal (default), octal (when preceded
|
||||
by a single zero) or hexadecimal (prefixed with 0x). port is the port
|
||||
number for both the UDP and the TCP (meta) connections.
|
||||
|
||||
@item ConnectTo = (IP address|hostname)
|
||||
Specifies which host to connect to on startup. If the ConnectPort
|
||||
variable is omitted, then tinc will try to connect to port 655.
|
||||
@item ConnectTo = <IP address|hostname> (optional)
|
||||
Specifies which host to connect to on startup. Multiple ConnectTo variables
|
||||
may be specified, if connecting to the first one fails then tinc will try
|
||||
the next one, and so on. It is possible to specify hostnames for dynamic IP
|
||||
addresses (like those given on dyndns.org), tinc will not cache the resolved
|
||||
IP address.
|
||||
|
||||
If you don't specify a host with ConnectTo, regardless of whether a
|
||||
value for ConnectPort is given, tinc won't connect at all, and will
|
||||
instead just listen for incoming connections. Only the initiator of a
|
||||
tinc VPN should need this.
|
||||
instead just listen for incoming connections.
|
||||
|
||||
@item ListenPort = port
|
||||
@item Hostnames = <yes|no> (no)
|
||||
This option selects whether IP addresses (both real and on the VPN) should
|
||||
be resolved. Since DNS lookups are blocking, it might affect tinc's
|
||||
efficiency, even stopping the daemon for a few seconds everytime it does
|
||||
a lookup if your DNS server is not responding.
|
||||
|
||||
This does not affect resolving hostnames to IP addresses from the configuration
|
||||
file.
|
||||
|
||||
@item IndirectData = <yes|no> (no)
|
||||
This option specifies whether other tinc daemons besides the one you
|
||||
specified with ConnectTo can make a direct connection to you. This is
|
||||
especially useful if you are behind a firewall and it is impossible
|
||||
to make a connection from the outside to your tinc daemon. Otherwise,
|
||||
it is best to leave this option out or set it to no.
|
||||
|
||||
@item Interface = <device> (optional)
|
||||
If you have more than one network interface in your computer, tinc will by
|
||||
default listen on all of them for incoming connections. It is possible to
|
||||
bind tinc to a single interface like eth0 or ppp0 with this variable.
|
||||
|
||||
@item InterfaceIP = <local address> (optional)
|
||||
If your computer has more than one IP address on a single interface (for example
|
||||
if you are running virtual hosts), tinc will by default listen on all of them for
|
||||
incoming connections. It is possible to bind tinc to a single IP address with
|
||||
this variable. It is still possible to listen on several interfaces at the same
|
||||
time though, if they share the same IP address.
|
||||
|
||||
@item KeyExpire = <seconds> (3600)
|
||||
This option controls the time the encryption keys used to encrypt the data
|
||||
are valid. It is common practice to change keys at regular intervals to
|
||||
make it even harder for crackers, even though it is thought to be nearly
|
||||
impossible to crack a single key.
|
||||
|
||||
@item ListenPort = <port> (655)
|
||||
Listen on local port port. The computer connecting to this daemon should
|
||||
use this number as the argument for his ConnectPort. Again, the
|
||||
default is 655.
|
||||
use this number as the argument for his ConnectPort.
|
||||
|
||||
@item MyOwnVPNIP = local address[/maskbits]
|
||||
@item MyOwnVPNIP = <local address[/maskbits]> (required)
|
||||
The local address is the number that the daemon will propagate to
|
||||
other daemons on the network when it is identifying itself. Hence this
|
||||
will be the file name of the passphrase file that the other end expects
|
||||
|
|
@ -432,36 +730,45 @@ equal to the IP address (see the example).
|
|||
|
||||
maskbits is the number of bits set to 1 in the netmask part.
|
||||
|
||||
@item MyVirtualIP = local address[/maskbits]
|
||||
@item MyVirtualIP = <local address[/maskbits]>
|
||||
This is an alias for MyOwnVPNIP.
|
||||
|
||||
@item Passphrases = directory
|
||||
@item Passphrases = <directory> (/etc/tinc/NETNAME/passphrases)
|
||||
The directory where tinc will look for passphrases when someone tries to
|
||||
connect. Please see the manpage for genauth(8) for more information
|
||||
about passphrases as used by tinc.
|
||||
|
||||
@item PingTimeout = number
|
||||
@item PingTimeout = <seconds> (5)
|
||||
The number of seconds of inactivity that tinc will wait before sending a
|
||||
probe to the other end. If that other end doesn't answer within that
|
||||
same amount of seconds, the connection is terminated, and the others
|
||||
will be notified of this.
|
||||
|
||||
@item TapDevice = device
|
||||
@item TapDevice = <device> (/dev/tap0)
|
||||
The ethertap device to use. Note that you can only use one device per
|
||||
daemon. The info pages of the tinc package contain more information
|
||||
about configuring an ethertap device for Linux.
|
||||
|
||||
@item VpnMask = mask
|
||||
@item TCPonly = <yes|no> (no, experimental)
|
||||
If this variable is set to yes, then the packets are tunnelled over a TCP
|
||||
connection instead of a UDP connection. This is especially useful for those
|
||||
who want to run a tinc daemon from behind a masquerading firewall, or if
|
||||
UDP packet routing is disabled somehow. This is experimental code,
|
||||
try this at your own risk.
|
||||
|
||||
@item VpnMask = <mask> (optional)
|
||||
The mask that defines the scope of the entire VPN. This option is not used
|
||||
by the tinc daemon itself, but can be used by startup scripts to configure
|
||||
the ethertap devices correctly.
|
||||
@end table
|
||||
|
||||
|
||||
|
||||
@c ==================================================================
|
||||
@node Example, , Configuration file, Configuring tinc
|
||||
@section Example
|
||||
|
||||
|
||||
Imagine the following situation. An A-based company wants to connect
|
||||
three branch offices in B, C and D using the internet. All four offices
|
||||
have a 24/7 connection to the internet.
|
||||
|
|
@ -483,17 +790,19 @@ need to run tincd, but it must do a port forwarding of TCP&UDP on port
|
|||
655 (unless otherwise configured).
|
||||
|
||||
In this example, it is assumed that eth0 is the interface that points to
|
||||
the inner LAN of the office. This could be the same as the interface
|
||||
that leads to the internet.
|
||||
the inner LAN of the office, although this could also be the same as the
|
||||
interface that leads to the internet. The configuration of the real
|
||||
interface is also shown as a comment, to give you an idea of how these
|
||||
example host is set up.
|
||||
|
||||
@subsubheading For A
|
||||
|
||||
@emph{A} would be configured like this:
|
||||
|
||||
@example
|
||||
#ifconfig eth0 10.1.54.1 netmask 255.255.0.0 broadcast 10.1.255.255
|
||||
ifconfig tap0 hw ether fe:fd:0a:01:36:01
|
||||
ifconfig tap0 10.1.54.1 netmask 255.0.0.0
|
||||
ifconfig eth0 10.1.54.1 netmask 255.255.0.0 broadcast 10.1.255.255
|
||||
@end example
|
||||
|
||||
and in /etc/tinc/tinc.conf:
|
||||
|
|
@ -507,9 +816,9 @@ VpnMask = 255.0.0.0
|
|||
@subsubheading For B
|
||||
|
||||
@example
|
||||
#ifconfig eth0 10.2.43.8 netmask 255.255.0.0 broadcast 10.2.255.255
|
||||
ifconfig tap0 hw ether fe:fd:0a:02:01:0c
|
||||
ifconfig tap0 10.2.1.12 netmask 255.0.0.0
|
||||
ifconfig eth0 10.2.43.8 netmask 255.255.0.0 broadcast 10.2.255.255
|
||||
@end example
|
||||
|
||||
and in /etc/tinc/tinc.conf:
|
||||
|
|
@ -528,30 +837,33 @@ connect to this node.
|
|||
@subsubheading For C
|
||||
|
||||
@example
|
||||
#ifconfig eth0 10.3.69.254 netmask 255.255.0.0 broadcast 10.3.255.255
|
||||
ifconfig tap0 hw ether fe:fd:0a:03:45:fe
|
||||
ifconfig tap0 10.3.69.254 netmask 255.0.0.0
|
||||
ifconfig eth0 10.3.69.254 netmask 255.255.0.0 broadcast 10.3.255.255
|
||||
@end example
|
||||
|
||||
and in /etc/tinc/A/tinc.conf:
|
||||
|
||||
@example
|
||||
MyVirtualIP = 10.3.69.254/16
|
||||
TapDevice = /dev/tap1
|
||||
ConnectTo = 1.2.3.4
|
||||
ListenPort = 2000
|
||||
VpnMask = 255.0.0.0
|
||||
@end example
|
||||
|
||||
C already has another daemon that runs on port 655, so they have to
|
||||
reserve another port for tinc. They also use the netname to distinguish
|
||||
reserve another port for tinc. It can connect to other tinc daemons on
|
||||
the regular port though, so no ConnectPort variable is needed.
|
||||
They also use the netname to distinguish
|
||||
between the two. tinc is started with `tincd -n A'.
|
||||
|
||||
@subsubheading For D
|
||||
|
||||
@example
|
||||
#ifconfig tap0 10.4.3.32 netmask 255.255.0.0 broadcast 10.4.255.255
|
||||
ifconfig tap0 hw ether fe:fd:0a:04:03:20
|
||||
ifconfig tap0 10.4.3.32 netmask 255.0.0.0
|
||||
ifconfig tap0 10.4.3.32 netmask 255.255.0.0 broadcast 10.4.255.255
|
||||
@end example
|
||||
|
||||
and in /etc/tinc/tinc.conf:
|
||||
|
|
@ -564,7 +876,8 @@ VpnMask=255.0.0.0
|
|||
@end example
|
||||
|
||||
D will be connecting to C, which has a tincd running for this network on
|
||||
port 2000. Hence they need to put in a ConnectPort.
|
||||
port 2000. Hence they need to put in a ConnectPort, but it doesn't need
|
||||
to have a different ListenPort.
|
||||
|
||||
@subsubheading Authentication
|
||||
|
||||
|
|
@ -572,17 +885,17 @@ A, B, C and D all generate a passphrase with genauth 2048, the output is
|
|||
stored in /etc/tinc/passphrases/local, except for C, where it should be
|
||||
/etc/tinc/A/passphrases/local.
|
||||
|
||||
A stores a copy of B's passphrase in /etc/tinc/passphrases/10.2.0.0
|
||||
A stores a copy of B's passphrase in /etc/tinc/passphrases/10.2.1.12
|
||||
|
||||
A stores a copy of C's passphrase in /etc/tinc/passphrases/10.3.0.0
|
||||
A stores a copy of C's passphrase in /etc/tinc/passphrases/10.3.69.254
|
||||
|
||||
B stores a copy of A's passphrase in /etc/tinc/passphrases/10.1.0.0
|
||||
B stores a copy of A's passphrase in /etc/tinc/passphrases/10.1.54.1
|
||||
|
||||
C stores a copy of A's passphrase in /etc/tinc/A/passphrases/10.1.0.0
|
||||
C stores a copy of A's passphrase in /etc/tinc/A/passphrases/10.1.54.1
|
||||
|
||||
C stores a copy of D's passphrase in /etc/tinc/A/passphrases/10.4.0.0
|
||||
C stores a copy of D's passphrase in /etc/tinc/A/passphrases/10.4.3.32
|
||||
|
||||
D stores a copy of C's passphrase in /etc/tinc/passphrases/10.3.0.0
|
||||
D stores a copy of C's passphrase in /etc/tinc/passphrases/10.3.69.254
|
||||
|
||||
@subsubheading Starting
|
||||
|
||||
|
|
@ -810,16 +1123,47 @@ This chapter is a mixture of ideas, reasoning and explanation, please
|
|||
don't take it too serious.
|
||||
|
||||
@menu
|
||||
* Key Types::
|
||||
* Key Management::
|
||||
* Authentication::
|
||||
* Protection::
|
||||
@end menu
|
||||
|
||||
@c ==================================================================
|
||||
@node Key Types, Key Management, Security, Security
|
||||
@subsection Key Types
|
||||
@c FIXME: check if I'm not talking nonsense
|
||||
|
||||
There are several types of encryption keys. Tinc uses two of them,
|
||||
symmetric private keypairs and public/private keypairs.
|
||||
|
||||
Public/private keypairs are used in public key cryptography. It enables
|
||||
someone to send out a public key with which other people can encrypt their
|
||||
data. The encrypted data now can only be decrypted by the person who has
|
||||
the private key that matches the public key. So, a public key only allows
|
||||
@emph{other} people to send encrypted messages to you. This is very useful
|
||||
in setting up private communications channels. Just send out your public key
|
||||
and other people can talk to you in a secure way. But how can you know
|
||||
the other person is who he says he is?
|
||||
|
||||
For authentication itself tinc uses symmetric private keypairs, referred
|
||||
to as a passphrase. The identity of each tinc daemon is defined by it's
|
||||
passphrase (like you can be identified by your social security number).
|
||||
Every tinc daemon that is allowed to connect to you has a copy of your
|
||||
passphrase (hence symmetrical).
|
||||
|
||||
It would also be possible to use public/private keypairs for authentication,
|
||||
so that you could shout out your public key and don't need to keep it
|
||||
secret (like the passphrase you would have to send to someone else). Also,
|
||||
no one else has to know a private key from you.
|
||||
Both forms have their pros and cons, and at the moment tinc just uses passphrases
|
||||
(which are computationaly more efficient and perhaps in some way more
|
||||
secure).
|
||||
|
||||
@c ==================================================================
|
||||
@node Key Management, Authentication, Security, Security
|
||||
@node Key Management, Authentication, Key Types, Security
|
||||
@subsection Key Management
|
||||
@c FIXME: recheck
|
||||
@c FIXME change for the current protocol
|
||||
|
||||
@cindex Diffie-Hellman
|
||||
You can't just send a private encryption key to your peer, because
|
||||
|
|
@ -840,10 +1184,6 @@ mod p. This is then sent to B; while B computes g^b mod p, and transmits
|
|||
this to A, b being generated by B. Both a and b must be smaller than
|
||||
p-1.
|
||||
|
||||
These private keys are generated upon startup, and they are not changed
|
||||
while the connection exists. A possible feature in the future is to
|
||||
dynamically change the keys, every hour for example.
|
||||
|
||||
Both parties then calculate g^ab mod p = k. k is the new, shared, but
|
||||
still secret key.
|
||||
|
||||
|
|
@ -864,17 +1204,25 @@ system.
|
|||
We will let A transmit a passphrase that is also known to B encrypted
|
||||
with g^a, before A sends this to B. This way, B can check whether A is
|
||||
really A or just someone else.
|
||||
B will never receive the real passphrase though, because it was
|
||||
encrypted using public/private keypairs. This way there is no way an
|
||||
imposter could steal A's passphrase.
|
||||
|
||||
@cindex passphrase
|
||||
@c ehrmz... but we only use 1024 bits passphrases ourselves? [guus]
|
||||
This passphrase should be 2304 bits for a symmetric encryption
|
||||
system. But since an asymmetric system is more secure, we could do with
|
||||
2048 bits. This only holds if the passphrase is very random.
|
||||
|
||||
These passphrases could be stored in a file that is non-readable by
|
||||
anyone else but root; e.g. @file{/etc/vpn/passphrases}.
|
||||
anyone else but root; e.g. @file{/etc/tinc/passphrases} with UID 0
|
||||
and permissions mode 700.
|
||||
|
||||
The only thing that needs to be taken care of is how A announces its
|
||||
passphrase to B.
|
||||
The only thing that needs to be taken care of is how A can securely send
|
||||
a copy of it's passphrase to B if B doesn't have it yet. This could be
|
||||
done via mail with PGP, but you should be really convinced of the
|
||||
identity of the person who owns the email address you are sending this to.
|
||||
Swapping floppy disks in real life might be the best way to do this!
|
||||
|
||||
|
||||
@c ==================================================================
|
||||
|
|
@ -884,6 +1232,7 @@ passphrase to B.
|
|||
Now we have securely hidden our data. But a malicious cracker may still
|
||||
bother you by randomly altering the encrypted data he intercepts.
|
||||
|
||||
@c FIXME what the hell is this all about? remove? IT
|
||||
|
||||
@c ==================================================================
|
||||
@node About us, Concept Index, Technical information, Top
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue