Slashdot Mirror

continuously trying ssh connections

What the heck do you have ssh open to the world for in the first place?

Try this:
http://www.openvpn.org/

I've got customers with Windows and Linux servers running this, and Windows and Linux clients, also. There are at least several pages that I've found with a single Google query on how to install it on OS X.
It will also run on the BSDs.

There really is no excuse to have any management port open to the Internet anymore, on any machine.

It's LZO compressed by default - not to mention encrypted and X509 authenticated - which probably means a net reduction in bandwidth. Go visit their site. It's truly excellent open source software.

But seriously. As a practical matter, anyone stuck behind state censorship can use a friend's OpenVPN and proxy in another country.

There's a project called Anonet that has developed a similar wrapper infrastructure.

Anonet is a "virtual Internet" that utilizes OpenVPN and Quagga to provide a layer of anonymity and deniability on top of the Internet. It uses a chaotic yet cooperative routing scheme which allows any one to use any IP address while still maintaining their existing Internet connection.

It has everything on it that the Internet does: torrent trackers, web servers, FTP servers, DNS infrastructure, PGP keyservers, IM, IRC, streaming audio, game severs, etc. All Internet-aware applications should work fine as Anonet is simply an addition to your operating system's routing table.

Here you go

See the OpenVPN site

Hi,

not sure exactly if you want to go the hardware way,
and not sure if what I mention meets your criteria,
but if you can set up a single linux box as a router
some place, that box can run openvpn (server) while
each client can hook up to it with the openvpn client
software (windoze client too ;)
trivial to set up:
http://www.openvpn.org/

cheers,

j

I finally got around to setting up a KDC for my domains. It's nice to run "kinit" once, and then have full access to every machine I'm supposed to have full access to.

Seeing as I am still working out Linux, and I know my Windows pretty darn well, I did this interesting thing.

The specs:
- Pentium II 233MHz
- Intel Desktop Board (isn't their slogan "built on reliability")
- 96MB RAM
- 3GB Hard Disk
- OS: Windows 2000 Server Standard

For readers to understand fully why I did this, until about a month ago, South Africa had only one decent ADSL account offering, a 3GB account. These 3GB accounts allow you to browse any site at full speed until you generate 3GB of traffic (that's g/bytes), and after the DSLAM kills your session (happens approximately every 24 hours) and you reconnect you get worse than 9600bps modem speeds when connecting to overseas servers/peers, but local speeds are still 100%. At the beginning of each month the counter is reset.

So, what I do is use OpenVPN (http://www.openvpn.org/) to tunnel to my office for the international bandwidth which we get through a 2mbit/s leased line, however, I have managed to configure my box in such a way that local traffic goes straight over the ADSL.

Using Windows 2000 Routing and remote access on my machine at home, I create the tunnel, and also create a ppp connection using RAS PPPoE (http://www.raspppoe.com/) - seeing as Windows 2000 doesn't have it natively. I then set up NAT routing, make the OpenVPN TUN/TAP adapter and the ppp interface external interfaces, and the LAN card the internal interface.

Then for routes, I set my default route to go down the tunnel, and I natuarlly set up the IP address of the remote end of the tunnel to go down the ppp interface. Now, South Africa has relatively few ASNs, so I also manually added a whole lot of those blocks to my routing table to go down the ppp interface. The net result (excuse the pun) was that local traffic went straight over the ADSL, and international traffic via the tunnel.

This all runs perfectly on Windows 2000 Server on that old box. Unlike the author of the article, I don't ever "work" on the machine per se, so for security reason's it does all it's Windows Updates, while I installed no extra services like IIS, I haven't bothered to disable any default services, I have however turned off Active Desktop, sliding menus and the Activity Pane for Windows Explorer, I discovered a long time ago that turning these off was the simplest way to more than double the responsiveness of their systems. What I have also done is enabled Terminal Services in remote administration mode, so the machine needs no screen keyboard and mouse. I add that I am no security expert however, with the box fully patched and a strong password set, I have had NO security incidences, well, at least none that I am aware of, I also do not run any kind of firewall.

Now my routing works well and causes *almost* no problems, it does have issues nevertheless. Because my box has two external IP addresses, certain things have issues, the problem arises when an application registers on an international server, and other peers from South Africa try connecting to my tunnel interface IP address, this doesnt work because my Windows 2000 box ends up trying to send the packets back over the PPP inteface. I notice this the most with Source and Steam. I cannot connect to any local servers when my tunnel IP address is the one registered with the Steam server, it just keeps on asking for my Steam username and password. Top get around this, when I want to play, I merely end up doing a PPPoE direct from my desktop, and while it takes a while for Steam to sign in, it does work. While I know that I could manually setup the steam server IPs to route over the ppp, I just havent bothered, also this way when an update comes down, it always comes down the fastest.

I am experimenting with Linux, and especially along with Soekris (http://www.soekris.com/) boards, to replace this solution, just a little more time and I will have it worked out - but I am not rushed as my Windows 2000 Server solution works just as well - and is up and running already.

I can't quite speak to its security, but there's nothing I've seen that makes me the least bit concerned. Although Peter Gutmann didn't do a real audit of openvpn, he did have this to say about it: "... but a quick look through it indicates that the author knows what he's doing." After you read a few remarks made by cryptographers, something like "this person is not a moron" is exceptionally high praise.

And Gutmann did leave us with this memorable quote: "Whenever someone thinks that they can replace SSL/SSH with something much better that they designed this morning over coffee, their computer speakers should generate some sort of penis-shaped sound wave and plunge it repeatedly into their skulls until they achieve enlightenment."

If you need a vpn solution that Just Works, check out OpenVPN.

Jason.