| |
| |
|
|
Learn from the developers of Openswan how to build industry standard, military grade VPNs and connect them with Windows, MacOSX, and other VPN vendors
- Learn everything you need to know about Openswan from its core developers
- Build VPNs that interoperate with Windows, MacOS, and other network vendors
- Build your own secure hotspots
|
|
|
Code download
Request a Review Copy
Send us feedback on this title
Ask a question about this title
Chapter 3: "Building and Installing Openswan" (PDF - 348KB)Table Of Contents
Language English
Paperback 350 pages [197mm x 210mm]
Release date
February 2006
ISBN 1904811256
ISBN 13 978-1-904811-25-1
Author(s)
Paul Wouters, Ken Bantoft
Topics and Technologies
Networking & Telephony, Open Source, Linux Servers
 Building and Integrating Virtual Private Networks with Openswan is written by the Openswan development team.
This
book is a comprehensive guide to using Openswan for building both basic
and industry size, military strength VPNs for medium to very large
organizations. Written by the core developers, this practical book is
all you need to use Openswan to build any VPN infrastructure you may
need. The authors have covered the latest developments and upcoming
issues. This book will not only help you build the VPN you need, but
also save you a lot of time.
TECHNOLOGY
With the widespread use of
wireless and the integration of VPN capabilities in most modern
laptops, PDA's and mobile phones, there is a growing desire for
encrypting more and more communications to prevent eavesdropping. Can
you trust the coffee shop's wireless network? Is your neighbor watching
your wireless? Or are your competitors perhaps engaged in industrial
espionage? Do you need to send information back to your office while on
the road or on board a ship? Or do you just want to securely access
your MP3's at home? IPsec is the industry standard for encrypted
communication, and Openswan is the de-facto implementation of IPsec for
Linux.Whether you are just connecting your home DSL connection with
your laptop when you're on the road to access your files at home, or
you are building an industry size, military strength VPN infrastructure
for a medium to very large organization, this book will assist you in
setting up Openswan to suit those needs. The topics discussed
range from designing, to building, to configuring Openswan as the VPN
gateway to deploy IPsec using Openswan. It not only for Linux clients,
but also the more commonly used Operating Systems such as Microsoft
Windows and MacOSX. Furthermore it discusses common interoperability
examples for third party vendors, such as Cisco, Checkpoint, Netscreen
and other common IPsec vendors. The authors bring you first hand
information, as they are the official developers of the Openswan code.
They have included the latest developments and upcoming issues. With
experience in answering questions on a daily basis on the mailing lists
since the creation of Openswan, the authors are by far the most
experienced in a wide range of successful and not so successful uses of
Openswan by people worldwide. Read the full Table Of Contents for Openswan: Building and Integrating Virtual Private Networks
Chapter 1 presents some historical
context of IPsec and Openswan, and discusses the legal aspects about
using and selling cryptography such as Openswan, and discusses some of
the aspects of weighing encryption privacy and law enforcement.Chapter 2
explains in non-mathematical terms how the IPsec protocols work. It is
written especially with the system administrator in mind, and should
appeal to both experts and beginners in the world of cryptography. Chapter 3
contains all you need to know to install Openswan on your Linux
distribution. It covers installing available binary packages, as well
as how to build Openswan from source. It also guides you through
the options your kernel needs to support, and helps you choose between
the two IPsec stacks that are currently available - KLIPS and
NETKEY.
Read chapter 3: "Building and Installing Openswan" (PDF - 348KB) Chapter 4
is a step by step tutorial on how to configure the most common type of
VPN connections using Openswan. These include net-to-net, host-to-net,
roaming users and head office to branch offices. In other words, all
the possible Openswan-to-Openswan connections. It also discusses
commonly deployed third party scenarios, including Cisco
implementations using Aggressive Mode and XAUTH with Openswan as the
IPsec client. Chapter 5 introduces X.509 certificate based
authentication for IPsec. It explains how X.509 certificates work, how
to generate them for Linux, Windows and MacOSX clients, and how to run
your own Certificate Agency. Chapter 6 explains the
Openswan feature called Opportunistic Encryption ("OE"). This method of
allows one to automate host-to-host encryption for machines without any
specific configuration by the end-user. Using OE, anyone can use IPsec
protected connections to your servers without even realizing they are
using IPsec. The goal of OE is to make IPsec the de-facto standard for
all communication on the internet. Chapter 7 goes right
down to the packet level and discusses common problems that you might
face on your IPsec gateway. These include special firewalling rules,
handling broken IPsec implementations and the various MTU related
issues that can come up. Chapter 8 discusses IPsec from
the two most popular end-user Operating Systems: Microsoft Windows and
Apple MacOSX. It helps you decide on whether you would prefer X.509
certificate based IPsec, or the less complex L2TP/IPsec. It has a step
by step guide on how to setup L2TP on your Openswan VPN server. It also
explains how to configure X.509 or L2TP on your Microsoft Windows or
Apple MacOSX clients, and includes all the screenshots to guide your
way. It closes with a description on how to configure commonly used
third-party software packages for Openswan. Chapter 9
deals with getting Openswan to properly interoperate with third party
IPsec VPN servers such as Cisco, Checkpoint, Netscreen, Watchguard and
various DSL based modem/router appliances commonly used by end-users. Chapter 10
explores how to use IPsec to encrypt all traffic between local
machines. It specifically focuses on 802.11 type wireless connections,
but it applies in general to all LAN based computers. It discusses the
Xelerance designed IPsec deployment scenario called WaveSEC: the
implementation used at IETF, BlackHat and DefCon to encrypt their
wireless networks. Chapter 11 discusses the advanced use
of Openswan. It discusses how to setup a proper fail-over VPN server
with Openswan, and discusses large enterprise deployments
bottlenecks, as well as how to deal with BGP and OSPF using IPsec
and Openswan. Chapter 12 is the culmination of two years
of end-user support on the public mailing lists. It discusses the
common mistakes and issues that people who are not working with IPsec
on a daily basis tend to run into. Unless you are doing something
extremely specific to your particular setup, your problem will be shown
in this chapter, along with the explanation of what went wrong and how
to remedy your situation. Appendix A is our last minute
update to the current events of Openswan. It discusses bleeding edge
Linux kernel issues, the latest security vulnerabilities and upcoming
features for end-users and developers that did not exist when the
authors were writing the bulk of this book. It also discusses known but
unsolved bugs existing at the time this book went to the printer.
Network administrators and any one who is
interested in building secure VPNs using Openswan. It presumes basic
knowledge of Linux, but no knowledge of VPNs is required.
Paul Wouters
Paul Wouters has been involved with Linux networking and security since he co-founded the Dutch ISP 'Xtended Internet' back in 1996, where he started working with FreeS/WAN IPsec in 1999 and with DNSSEC for the .nl domain in 2001.
He has been writing since 1997, when his first article about network security was published in LinuxJournal in 1997. Since then, he has written mostly for the Dutch spin-off of the German 'c't magazine', focusing on Linux, networking and the impact of the digital world on society.
He has presented papers at SANS, OSA, CCC, HAL, Blackhat and Defcon, and several other smaller conferences.
He started working for Xelerance in 2003, focusing on IPsec, DNSSEC, Radius and delivering trainings.
Ken Bantoft
Ken Bantoft started programming in 1988, and successfully avoided doing it as a full time job until 2002. He opted instead to focus on Unix, Networking, and Linux integration.
Beginning at OLS2002, he started working alongside the FreeS/WAN project, integrating various patches into his own fork of their code – Super FreeS/WAN, which is now known as Openswan.
He currently lives in Oakville, ON, Canada, with his wife Van, two cats and too many computers.
Ken started working for Xelerance in 2003 where he works mostly on IPsec, BGP/OSPF, Asterisk, LDAP and Radius.
| |
|
