Tag Info

Hot answers tagged

23

VPN means "Virtual Private Network". It is a generic concept which designates a part of a bigger network (e.g. the Internet at large) which is logically isolated from the bigger network through non-hardware means (that's what "virtual" means): it is not that we are using distinct cables and switches; rather, isolation is performed through use of ...


19

The cryptography involved in the VPN is designed precisely to keep your data safe even in the situation of an attacker who can intercept all traffic; the best an attacker could do in that situation is to disrupt traffic (namely, cutting off the wires). Both SSL, and IPsec-with-IKE, use cryptography in proper ways, so there should be no qualitative ...


12

I think the biggest impacts will be on the public relations side. On the plus side (from OpenBSD maintainers point of view), the idea that the FBI deemed OpenBSD important enough, back in 2000, to warrant money-backed insertion of backdoors, is a sure ego inflater. This alone could be a motive for public allegations of backdoors, whether they exist or not. ...


11

IPsec is actually a family of protocols, it has several sub-protocols that could be used or not used, and the overall security depends on each of these in turn and how they're configured: IKE for protocol negotiation and key management AH for authentication, integrity and I think some protocol protection ESP for encryption and then some. Advantages: ...


9

Both have security issues if not configured correctly. But first lets start with some definitions: Cisco have a good definition of a VPN: VPN can take several forms. A VPN can be between two end systems, or it can be between two or more networks. A VPN can be built using tunnels or encryption (at essentially any layer of the protocol stack), or both, or ...


8

L2TP/IPSEC wraps a simulated data link layer in IPSEC. Plain IPSEC just encrypts the network layer. If you want hosts to think they're on the same LAN, use L2TP/IPSEC; if you'd rather skip the extra bandwidth and processing overhead, use IPSEC.


8

Let's clear up some confusion here first. Internet Key Exchange (IKE) is a hybrid protocol, it consists of 3 "protocols" ISAKMP: It's not a key exchange protocol per se, it's a framework on which key exchange protocols operate. Oakley: Describes the "modes" of key exchange (e.g. perfect forward secrecy for keys, identity protection, and authentication) ...


8

No, you can't. You can't ssh to folders, only to accounts. You might be able to mount the /tmp folder on another machine without a password if the server is running NFS or Samba and has fairly relaxed permissions.


7

The data bits which flow one machine to the other must travel in some way, over wires, optic fiber, radio waves or some other medium. At any point, information can be eavesdropped. The very low-grade attackers will eavesdrop where it is easiest, i.e. close to either end. This is made easy with many WiFi hotspots; it can also be done with wired Ethernet by ...


7

There are two main usage modes for IPsec: AH and ESP. AH is only for authentication, so I suppose that you are talking about an ESP tunnel between the two servers. All IP packets get encrypted and authenticated, including some header details such as the source and target ports. There are several encryption and MAC algorithms which can be used with IPsec; AES ...


6

To protect packet destinations, you need to abstract the network layer entirely - which usually means some form of encrypted VPN. This would mean no hardware on the local network would know what packets are being transmitted, where to or what they contain. Unfortunately, this doesn't solve the real problem, just moves it upstream. Your VPN/encrypted link ...


6

Check out Practical Cryptography: http://www.amazon.com/Practical-Cryptography-Niels-Ferguson/dp/0471223573/ref=sr_1_1?s=books&ie=UTF8&qid=1304454787&sr=1-1 Written by Niels Ferguson, lead cryptographer for Counterpane, Bruce Schneier's security company, and Bruce Schneier himself, this is the much anticipated follow-up book to Schneier's ...


6

I think it's referring to "hub" as the center of a hub-and-spoke VPN architecture, as shown in this diagram. Later on in the document you linked to, it says: Dynamic—Dynamic crypto maps can only be used in a hub-and-spoke VPN topology. Dynamic crypto map policies allow remote peers to exchange IPsec traffic with a local hub, even if the hub does not ...


6

@graham-hill's answer is correct in general but short and pedantically incorrect, so I'll expand upon it. SSH is at the Application level - you can think of it as SSH/TCP/IP, or SSH-over-TCP-over-IP. TCP is the Transport layer in this mix, IP is the Internet layer. Other "Application" protocols include SMTP, Telnet, FTP, HTTP/HTTPS... IPSec is ...


5

By default, strongSwan uses its own implementations for cryptographic algorithms. These are provided by e.g. the aes, sha1 and sha2 plugins. The default implementation for public key cryptography (RSA, DH) is provided by the gmp plugin, which relies on libgmp. Enabling the openssl or gcrypt plugins, while not-building or not-loading the default plugins, ...


5

The IP Authentication Header (AH) is used to provide connectionless integrity and data origin authentication for IP datagrams (hereafter referred to as just "authentication"), and to provide protection against replays. This latter, optional service may be selected, by the receiver, when a Security Association is established. (Although the ...


5

802.1x-2010 will provide authentication to the network switch and encrypt traffic exchanged. Older 802.1x specifications do not encrypt traffic. IPsec can be a useful solution or layer on top of older 802.1x, but the increase in configuration work to allow only desired clients may be notable.


5

Are you looking at these options to create a secure VPN? SSL is generally easier to deploy and better supported for a desktop-to-network type of VPN, such as when an employee at home is connecting to the corporate network. If you're doing a more complex deployment, such as a network-to-network encrypted VPN (e.g., between two different organizations), then ...


5

DNSSEC provides something rather different than IPSec, and either or both may meet your needs. IPSec can encrypt packets and sign them, providing evidence that they come from something you trust, IF you have a PKI (Public Key Infrastructure) you can trust. But that "IF" is a very tall order, especially given the presence these days in most common "trusted" ...


5

It is not that the header has to be encrypted in tunnel mode; rather, if the header is not encrypted, it is not really a tunnel. Tunnel mode is about having two routers linked together with an encrypted tunnel. They exchange packets for other hosts. Schematically, router A is the exit router for network netA, and router B is the exit router for network ...


4

The answer to your question is easy: if anyone hid nasty code in privileged subsystems, the wrong people could have arbitrary control over systems running the code. But note that no evidence has been presented (and Perry should have a lot of that), and he offers no apologies. For more info see an early overview: Deconstructing the OpenBSD IPsec Rumors ...


4

Source IPs - If you connect to a mail server you control, you can configure it to write fake source headers (does it really matter since you'll probably be using private network IP ranges for your senders machines?) - but the upstream mail server will see the real IP address for your immediate mail server. Whether or not it commits that information ...


4

L2TP does not provide any confidentiality or authentication. A common setup is using L2TP along with IPSEC (see RFC 3193). EDIT: L2TP does provide tunnel end-point authentication. It does not provide encryption and message authentication.


4

Much depends on your scenario. If the two hosts collaborate, just have one of the two send its IP to the other. Optionally hash/encrypt it in order to keep protocol rewriting filters (such as ftp-masq) from rewriting not only the header packet IP but the payload too. Then, if the two addresses don't match, NAT must have been at work. If you only have one ...


3

IPsec provides two modes: Authentication Header: each packet has an attached Message Authentication Code which guarantees its integrity; this also includes some protection against replay attacks (when the attacker sends copies of a previously exchanged packet). Encapsulated Security Payload: each packet is encrypted (and also has a MAC); the encryption ...


3

Some very good answers here, I won't repeat what was already said. However, one point I found to be lacking - SSL is a lot easier to setup on an ad-hoc basis, especially if you don't have a requirement for client certificates. IPsec, on the other hand, always requires client certificates (assuming a normal, typical setup), and there are also other ...


3

IPSEC can be configured using multiple authentication methods. I personally prefer using certificates from my internal CA over Kerberos. There are several devices I deal with (Linux, servers in my DMZ, etc) which would be difficult or impossible to set up with Kerberos. An offline IPSEC certificate request is much easier to work with. The request statement ...



Only top voted, non community-wiki answers of a minimum length are eligible