Remote access software

Kerberos

Strictly speaking, Kerberos is an authentication system. As a side effect, it exchanges one time secret keys that can be used to encrypt communications. It was designed to provide security in an open, hostile environment, like a University campus. Unfortunately, this makes it "allergic" to firewalls, NAT, split DNS, and many other security techniques that most everyone uses.

Heimdahl is a European reverse engineering of Kerberos (to get around the US crypto restrictions) that addresses some of these issues.

A number of applications like telnet, ftp, rsh and friends, and popper have been kerberized. Also Socks may be compiled with Kerberos.

SASL - new security layer (like gssapi) see www.cyrus.com (cyris?) AFS - new PD version ARLA

ssh

Secure Shell uses public key cryptography to provide rsh, rcp, and rlogin services over encrypted channels. It does not send passwords across the net in the clear, even when it has to fall back to rsh. It can also be used to forward X11 and arbitrary ports. This version of ssh can be compiled with socks to traverse firewalls.

Openssh is a re-implementation of ssh to, among other things, avoid certain annoyances with the licensing of version 2. It comes from the OpenBSD project, and uses OpenSSL to provide the encryption code. Since the project is based in Canada, it also avoids the US encryption nonsense.

Free Virtual Private Networks

From the Linux VPN mini-HOWTO: ssh and ppp

This solution is a classic example of the UNIX way of doing things, take two existing tools, a couple of scripts, and solve a new problem!

Secure Shell, besides being a secure replacement for the Berkeley r-commands, can also tunnel X and other protocols through it's encrypted connection. In this case, the protocol we choose is PPP. We can now setup a point-to-point link between any two hosts on the Internet, and since PPP presents a network interface at both ends, you can do all the normal routing and firewalling, just as if you had a leased line between the two hosts.

The downside with this method is that when packets get lost, the whole link can pause while they are re-transmitted and the connection re-synced. Other methods that encrypt at the packet level or tunnel over UDP handle packet loss more gracefully. Another problem is that you need to monitor the link and restart it if it fails.

How To set it up

  1. Compile and install SSH and sudo on both boxes.
  2. Use the following /etc/sshd_config file:
    # This is ssh server systemwide configuration file.
    
    Port 22
    ListenAddress 0.0.0.0
    HostKey /etc/ssh_host_key
    RandomSeed /etc/ssh_random_seed
    ServerKeyBits 768
    LoginGraceTime 600
    KeyRegenerationInterval 3600
    PermitRootLogin no
    IgnoreRhosts yes
    StrictModes yes
    QuietMode no
    X11Forwarding yes
    X11DisplayOffset 10
    FascistLogging yes
    PrintMotd yes
    KeepAlive yes
    SyslogFacility DAEMON
    RhostsAuthentication no
    RhostsRSAAuthentication no
    RSAAuthentication yes
    PasswordAuthentication no
    PermitEmptyPasswords no
    UseLogin no
    	
  3. Designate one host as master, this host will originate the connections. The other will be the slave.
  4. On the slave, create a user called vpn, set it up so that root on the master can run 'ssh -lvpn uname -a' without a password. To do this, both root on the master and vpn on the slave must be setup to run ssh. Login as these users and run ssh-keygen. Make sure that you give it an empty pass-phrase. Add the public key from root on the master to the file authorized_keys in vpn's .ssh directory. Make sure all files in .ssh on both hosts are mode 0600.
  5. Add the entry
    vpn ALL=NOPASSWD: /usr/sbin/pppd
    	
    to the /etc/sudoers file on the slave.
  6. There are two script files, ssh-ppp, originally by Olaf Titz, July 1996, which I modified to take some extra parameters, and keepalive-ssh-ppp, which monitors the link and restarts it when necessary. On the master, edit the file /etc/vpn.conf, this contains a number of lines of the form
    slave.host.name 192.168.50.1:192.168.50.2
    	
    Where slave.host.name is the slave's Internet name and the address pair is the addresses to use for the PPP link.
  7. Add a keepalive-ssh-ppp to root's crontab on the master, and that's it.

The only thing left is to add any routing command to the file /etc/ppp/ip-up or /etc/ppp/ip-up.local on either end.

or get vpnstarter, a daemon for keeping an SSH-PPP tunnel up, or, if you're using a ppp version greater than 2.3.7, try something like

/usr/sbin/pppd pty 'ssh somehost sudo /usr/sbin/pppd nodetach'

CIPE

A lightweight protocol that tunnels encrypted IP packets in UDP packets. It has the look and feel of pppd. It has good docs, too bad it doesn't work.

PPTP

First, you could tunnel this through to an internal NT box and ignore it. Better, IMHO is to use PopTop, a linux pptp server. You do need to patch PPP (and re-compile the kernel) to enable MPPE, but the debugging available make it easier to deal with the broken-ass Microsoft PPTP clients.

The pptp server handles the initial handshake, sets up a GRE tunnel, and then run ppp. If you are using ppp for other things, you may need to differentiate these connections. One trick is:

You include "ipparam pptp" in the options that pptp uses when in runs pppd. Then in ip-up.local, you check the value of $6 (IIRC). You skip the action if $6 is pptp, as it will be, if this is a pptp link coming up.

Windows Clients

Microsoft has yet to release a versions of windows without a totally bolloxed up vpn. Follow these links, or try a search for VPN or DUN on the Microsoft site, and install the patches (I had to install the '95 patch twice for it to take)! Once this is done, look at the install docs for Win 98 NT 4 Win 2k and follow the instructions for your particular flavor of windows.

Additional Configuration

You will probably want to turn off the default gateway. If you don't, then all traffic will be sent through the VPN. Unless your corporate security policy requires this, you can get better performance and fewer problems with this off. Right click on the icon for the connection, and go to Properties->TCP/IP Properties->Advanced and uncheck "Use default gateway on remote network"

You may also need to set the connection specific dns suffix in the same place.

I think that Outlook caches IP addresses when it starts up, so you should re-start outlook when you bring the VPN up or down so it can refresh any addresses that change when you are talking to the internal DNS servers.

Windows VPN encrption patches

You may also need to turn off IP header compression, somewhere in the bowels of the VPN config screens.

Win95
http://www.microsoft.com/NTServer/nts/downloads/recommended/dun13win95/sysreq.asp http://www.microsoft.com/windows95/downloads/contents/WURecommended/S_WUNetworking/vpn/Default.asp http://www.microsoft.com/windows98/downloads/corporate.asp
Win98
It's been reported that you need to remove and re-install the VPN software to make it work right. http://www.microsoft.com/NTServer/nts/downloads/recommended/dun13win98.asp http://www.microsoft.com/windows98/downloads/contents/WURecommended/S_WUNetworking/VPN/Default.asp
Win98SE 128-bit update (not currently available)
http://www.microsoft.com/Windows98/downloads/contents/WURecommended/S_WUNetworking/DUN128/default.asp using FTP search (the file is msdun128.exe, md5sum is 8add40723d652557232a1a09917c924c) http://ftpsearch.lycos.com/cgi-bin/search?type=Case+insensitive+substring+match&query=msdun128&form=medium
128-bit updates (not currently available):
http://support.microsoft.com/Support/NTServer/128Eula.asp
For W2K, there is a "High Encryption Pak"

Troubleshooting

  1. Don't forget to add proxyarp to the pppd options.
  2. nbstat.exe from the resource kit can help to determine who the master brwoser is. You will almost certainly need to use wins to allow browsing.
  3. Setting WINS Scope can interfere with browsing.

IPSEC

For linux, this means FreeSwan, or, if you live in the real world and actually want it to interoperate with other software Super-FreeSwan. This contains a pile of patches, but does tend to lag FreeSwan, sometimes quite a bit. It is Grand-Central station for finding patches to improve FreeSwan. The most important ones are are the X.509 patch for talking to Windows boxes, NAT-T for tunneling IPSEC over udp, the ALG patch for extra algorithms, ...

www.securityfocus.com -> other lists -> vpn mailing list www.icsa.net -> ipsec - compatibility testing results for vendors, maybe free OS soon.

Other Resources


Tony Lill
Last modified: Fri Feb 27 19:37:13 EST 2004