Slashdot Mirror

← Back to Domains

Domain: ssh.com

Stories and comments across the archive that link to ssh.com.

Comments · 78

  1. Re:ssh = somewhat secure shell by hettb · · Score: -1 · on SSH, The Secure Shell
    Bzzz, wrong!

    Those security holes you are speaking of are only found in the free software version of SSH, OpenSSH, hacked together by Theo de Rat and his National Socialist friends.

    The commercial version of SSH by Tatu Ylönen, OTOH, is completely secure and bugfree.

    If only the rest of the world realized this and used commercial software instead of open source...

  2. Re:Use IPSEC or Kerberos with *at least* 1024-bit by undie · · Score: 1 · on Building a Wireless Network for an Apartment Complex?


    True AP mode with Orinoco cards under Linux? Can't be done as far as I know. You must be in ad-hoc mode. FYI actual AP mode with an Orinoco can be done in Windows with the Lucent driver and some undocumented registry settings - for details look here

    The only cards that will do actual Access Point mode under Linux are based on Prism2. The HostAP driver provides full AP mode including offloading WEP to the CPU (128 bit WEP on a 40 bit card!), MAC filtering, and lots of other fun stuff. Works beautifully. Check it out here

  3. Re:PF for bridging. by G+Money · · Score: 0, Offtopic · on OpenBSD 3.1 Released

    If you want to get a PrismII based wireless card for your Linux box, you can make a Linux based AP. I use it and it works great for me. It might not be much cheaper than just using a regular access point, but you do gain quite a bit more control over what's going on.

  4. Since linux devices gets /.'ed rather easily- by CmdrTaco+(editor) · · Score: -1, Redundant · on Musenki's Linux-Based AP Ships To Beta Customers
    by Rick Lehrbaum (April 12, 2002)

    Back in November of 2000, Jim Thompson, Kem McClelland, Brad Martin, and Jamie Thompson started brainstorming about the idea creating a company to specialize on the emerging market for publicly accessible wireless access points. They reasoned that there would soon be a significant opportunity to supply devices to public access "hot-spot" providers, wireless ISP/infrastructure providers (WISPs), and various value added resellers (VARs).

    Thompson and McClelland were both senior managers at WapPort, where they had both been frustrated by the inability to convince existing access point providers to modify their products for "hot-spot" features, or even to allow Wayport to have access to their source code so that Wayport could make the necessary modifications. So the two, joined by Brad Martin and Jamie Thompson, decided to have a go at it on their own.

    "My original frustration when I was at Wayport, was that we couldn't get any of the existing access point manufacturers (Cisco, Lucent, Symbol, etc) to embed the features we needed to deploy an 802.11-based "Hot Spot" service," recalls Musenki CTO and founder Jim Thompson.

    Roughly 18 months later, Austin, TX based Musenki ("musenki" means "small wireless gadget" in Japanese) is poised to ship beta units of its first product -- the M-1 wireless access point. The devices, which are scheduled to ship to customers next Monday (April 15, 2002), will be sent to developers, strategic technology partners, VARs who want to start integrating their own features, and some prospective major customers. Among the significant customer prospects being sent beta units are several regional wireless ISPs and mobile operators, according to McClelland.

    McClelland describes Musenki as a developer of "secure, open-source wireless networking products" whose "software and high-performance equipment enable open development, bringing expandability and customization to the wireless LAN market." Indeed, the company's first device packs a lot of computing power in a very small space, by taking advantage of some of Motorola's highly integrated PowerPC-based system-on-chip processors running at speeds ranging from 200 to 400 MHz, along with high density RAM, built-in solid state disk (Flash memory), and internal expansion based on "miniPCI" modules. The use of built-in PCI expansion allows Musenki to configure its access points for a variety of wireless interfaces -- an important factor in an emerging technology-based market that has a long way to go before stabilizing.

    According to McClelland, Musenki has incorporated several features into its wireless access points that are crucial to success in the public access market. These include tie-ins with external authentication and billing systems, roaming across various service provider networks, the ability to slot-in additional network-layer functionality such as VPN and protocol translation, and functions that enable the management of a large number of these devices disbursed over a large number of locations.

    What's on the drawing board after the M-1 and M-3 wireless access points have made it into full production? According to McClelland, Musenki's plans include a number of technology and interface enhancements and upgrades, including . . .
    • Client side devices (miniPCI/PC cards, particularly GPRS/802.11 combo cards)
    • Mesh networking technology
    • Technology for enabling seamless roaming, by means of cellular and WLAN networks
    • Additional security features
    • Integration with innovative antenna technologies
    • Expansion of the platform beyond the WLAN market
    Many of these will be accomplished through strategic technology partnerships.

    Building in power and flexibility

    Jim Thompson characterizes Musenki's first product as a Linux-powered 802.11 access point: "Its open, so the customer can make it do what they want" So flexible, in fact that you could use it for other things. "Like a sexy small, high-performance router," according to Thompson. "Take the 802.11b NIC out and install one of several available miniPCI modules with crypto/compression chips, and now you've got a VPN router -- with compression -- that will run at 100Mbps."


    Prototype of the M-1 access point

    Here is a summary of the features of the embedded computers that are built into the M-1 and M-3 . . .

    M-1 specs . . .
    • Processor: Motorola MPC8241 running at 200MHz
    • RAM: 32MB (default), 64MB, or 128MB of SDRAM
    • Flash: 8MB (default) or 16MB
    • 1 x Davicom DM9102AF (tulip-clone) 10/100 Ethernet on RJ45
    • 1 x miniPCI socket (comes filled with a 802.11b NIC and "AP" software)
    • miniPCI socket has the pins for V.90 modem and 10/100 Ethernet brought out to a second RJ45
    • 1 x Smart Card (SIM form-factor)
    • I2C header
    • 3.5 x 3.6 in. (smaller than PC/104 form-factor)

    M-3 specs . . .
    • Processor: Motorola MPC8245 running 333MHz
    • RAM: 1 x SODIMM socket, usable with up to 512MB (off-the-shelf modules)
    • Flash: up to 32MB
    • 2 x Davicom DM9102AF (tulip-clone) 10/100 Ethernet on RJ45s
    • 2 x miniPCI socket
      • first slot comes filled with a 802.11b NIC and "AP" software);
      • first miniPCI socket has the pins for V.90 modem and 10/100 Ethernet brought out to a second RJ45
    • 1 x full PCI slot (more Ethernet, T1, T3, additional 802.11a/b/g NIC, etc.)
    • 1 x Smart Card (SIM form-factor)
    • I2C header
    • Size: 6.0 x 7.0 in.


    Closeup of the M-1's internal single-board computer

    "We feel that the additional CPU and the large memory resources are going to be more and more important as 802.11x (x = a, b, g) becomes the predominant method of client connectivity," points out Thompson. "In addition, as other 802.11 standards mature -- for example 802.11e Quality of Service, 802.11i security, 802.11f Inter Access Point Protocol, 802.11h Dynamic Frequency Selection (DFS), and Transmit Power Control (TPC) -- we will have the CPU power and architecture to allow us to incorporate these improvements, as well as the future increased bit-rates planned for 802.11a."

    "Also, the minute you start thinking about 'mesh' routing, you need lots of memory and CPU resources," Thompson adds. "Consider a medium-sized city with 40,000 houses, all connected to each other via a wireless 'fabric' at 20Mbps or more."

    "One could run an 802.11b (or 802.11g) NIC in one slot and an 802.11a NIC in the second slot and have a 'dual-mode' AP, with all the gateway features still enabled," explains Thompson. "Or you could use all three slots -- one slot of 802.11b for older clients, one slot of 802.11g for those clients, and one slot 802.11a. Or you could cover a coffee shop with 802.11b/802.11a and still bring a DSL, Cable, or T1 connection or even 802.11 'back-haul' out with one box, AND run the 'captive portal' on the same box."

    Thompson explains that there are varied reasons for the Smart Card. "One of the most interesting is that if you're going to deploy this type of equipment into 'public access' venues, you need a way to both secure the contents against prying eyes -- and people who will dredge through your Flash -- as well as being able to potentially authenticate the equipment back to your billing system, if you're Wayport, Surf-n-Sip, VoiceStream/Mobilestar, Boingo, etc. We use the smart card for both of these, and more. Consider the use of Smart Cards in GSM phone or DBS satellite systems, and then apply same ideas here."

    Embedded Linux inside

    Musenki's wireless access points run a recent version of the Linux kernel (currently 2.4.18), along with other open source software.

    "For Linux, we started with the PowerPC kernel sources from BitKeeper," says Thompson. For the bootloader, for example, they started with ppcboot sources and added 8245 support. "We've given all the code back to the community. Interestingly, I ended up supporting the 'Sandpoint8245' platform in the process."

    "We did it all ourselves, with more than a bit of 'help' from the associated mailing lists," continues Thompson. "Linux mostly just 'runs', other than small bits of effort to get the on-chip serial ports working, and board-specific issues."

    Why Linux?

    "We see open source software as our greatest strategic advantage," says McClelland.

    "Essentially, Linux lets us do what we want to do, because we have source -- stand on the shoulders of giants, and not pay royalties to Wind River," Thompson adds.

    The development process wasn't without its "bumps in the road", explains Thompson. For example, the time he discovered that the Flash memory bus was wired backwards on the 'BBWISP' board. "This is one of the places where 'open source' ruled for us, because I just hacked support in for changing the 'endianess' of the Flash bus to an existing driver for the Flash chip we're using," he adds.

    Thompson claims it took him about half a day to solve the Flash bus problem, thanks to the availability of Linux source code. "I can't imagine having to do that on VxWorks," he says.

    According to Thompson, the following open source projects were valuable to Musenki in the development of its wireless access point products . . . In nearly every case we've had to fix something or add functionality. We always give the changes back.

    How will they cost, and how will they be sold?

    Quantity one pricing for the M-1 (including 802.11b NIC, antenna, power supply, etc) will be $300, and the M-3 (similarly configured) will be $500, with quantity discounts available.

    Beta units of the M-1 will go out on Monday, April 15th. Beta shipments of the M-3 are planned by the beginning of May. General availability of both should be by the end of June.

    Initially, the units are being sold directly by Musenki, but the company is currently developing various sales channel relationships.

    What's next for Musenki?

    Musenki is currently staffed by six people (four founders plus a hardware and software engineer), along with consultants and part-time employees who have contributed to the open source, open architecture approach. Musenki is self-funded to date and is actively discussing additional financing with outside investors.
  5. ssh.com by bwulf · · Score: 3, Informative · on Good SFTP Clients?

    .. has a fine client, which includes a file-transfer function.

    I use it every day to transfer files from/to home and work.

    It does some of the things you mention; easy UI, remote renaming, recursive directory transfers, drag and drop and some other bits.

  6. Re:Commercial SSH by snowpuppy · · Score: 1 · on OpenSSH Local Root Hole

    SSH Communications has it's own security issues.

    Check out: SSH Advisories

    I wonder if they produced a fix as fast as OpenSSH did.

    Snowdog

  7. Freedom of the Market by Tazzy531 · · Score: 2 · on Who Is Liable For Software With Security Holes?
    There are a couple points that I want to mention.
    1. NOBODY is EVER forced into buying a particular product. Every product has a competitor that you could go with. Just because the majority of the market uses a certain product doesn't mean that there are no choices. It becomes an argument of the benefits of each product (compatibility, security, features, etc) and what best suits your and your companies needs. If you don't agree, argue with a linux guru that Windows is the ONLY operating system available because 95.9% of the market uses it. If there is a problem with a certain product, you are not bound to it. You are free to choose the alternative.
    2. Liability is always something hard to pinpoint. Every producer is liable for every product that he produces. Just because there is a problem with a product doesn't mean that it is automatic grounds for lawsuits. What is important in the long run is what steps the producer goes about resolving the problem. In the case of the car company that found that it was economically wiser to let a problem exist then resolve it, they are liable for their lack of action in an accident. However, in both Nimbda and Code Red (2 recent events that come to mind), MS has release patches and solutions for it months ahead of time. They followed the correct procedure in these two incidents of identifying the problem, notifying the users of the problem, and producing a fix for the problem. The reason that these vulnerabilities still existed was that the administrators and users ignored the patches and bug reports. How can MS be held liable for the inaction of its customers. It is like saying that Ford should pay for your medical bills because you got into an accident with a car that they recalled months ago. In this case, it is your responsibility to take the car back to get it serviced.
    3. One thing that we all must remember is that a law cannot be created targetted at a specific company. So if any laws are produce regarding liability, the people it would hurt the most are the individual developers and the medium to small companies. Microsoft has a couple billion dollars in the bank. They can easily settle a lawsuit that some of you have talked about. But for smaller companies, it is a major issue. Take for example SSH. In recent months, there was found to be a vulnerability in one of the older SSH clients. If they were held liable for the problem that results into stolen data, it would most likely bankrupt the company or at least cause it to be in a situation where it had to be bought up by a bigger company.
    4. Now this one is a stretch. But seeing the way that Congress has been leaning towards big corporation over the consumers [don't believe me? look at DMCA], they would most likely butcher this law in support of big business. Secondly, there is no reason why a law must be put in place where there is no problem that cannot be resolved by the market. The market and consumers are strong force. They are the ones that can make or break a company. If the security problems of MS was enough of a issue, a big chunk of the market could shift over to a competitor product.
  8. Re:What's wrong with PPTP? by jeremiahstanley · · Score: 2, Informative · on Building Linux Virtual Private Networks

    With Win2k you can get this little patch and then you have a free as in beer IPSec implementation provided by Microsoft under Win2k. It even supports x509 certs. IPSec clients are not that expensive. Look at SSH Sentinal for another option. It even supports the newer AES ciphers (which I don't expect out of Microsoft for a long time)as added security.

    For all of this you have to patch the code to use the newer ciphers. You can get that here and if you need to use x509 certs you can get that stuff here. This is all pretty easy if you have you druthers about compiling new kernels and working with OpenSSL.

    Why this isn't in the kernel to begin with is anybody's guess. I would guess that it has something to do with all those pesky crypto export laws. Just like everything else in the ol US of A we have to sacrifice our freedoms so that we can be safe from the KGB and that one guy from Hackers.

  9. First Widener!!! by CmderTaco · · Score: -1 · on Building Linux Virtual Private Networks
    .I .like .wide .pages .I .wish .all .pages .could .be .as .wide .as .this .dont .you .wide .pages .are .much .cooler .than .those .narrow .pages .you .are .used .to .reading .because .you .dont .have .to .worry .about .the .lameness .filter .telling .you .that .you .don't .have .enough .charaters .per .line .that .really .sucks .when .that .happens .and .you .have .to .put .some .lame .lameness .filter .defeater .text .in .there .i .wonder .how .many .people .will .read .this .whole .comment .I .certainly .hope .it .doesnt .annoy .too .many .people .This .is .just .the .beginning .because .PAGE .WIDENING .IS .BACK .I .like .wide .pages .I .wish .all .pages .could .be .as .wide .as .this .dont .you .wide .pages .are .much .cooler .than .those .narrow .pages .you .are .used .to .reading .because .you .dont .have .to .worry .about .the .lameness .filter .telling .you .that .you .don't .have .enough .charaters .per .line .that .really .sucks .when .that .happens .and .you .have .to .put .some .lame .lameness .filter .defeater .text .in .there .i .wonder .how .many .people .will .read .this .whole .comment .I .certainly .hope .it .doesnt .annoy .too .many .people .This .is .just .the .beginning .because .PAGE .WIDENING .IS .BACK .I .like .wide .pages .I .wish .all .pages .could .be .as .wide .as .this .dont .you .wide .pages .are .much .cooler .than .those .narrow .pages .you .are .used .to .reading .because .you .dont .have .to .worry .about .the .lameness .filter .telling .you .that .you .don't .have .enough .charaters .per .line .that .really .sucks .when .that .happens .and .you .have .to .put .some .lame .lameness .filter .defeater .text .in .there .i .wonder .how .many .people .will .read .this .whole .comment .I .certainly .hope .it .doesnt .annoy .too .many .people .This .is .just .the .beginning .because .PAGE .WIDENING .IS .BACK .I .like .wide .pages .I .wish .all .pages .could .be .as .wide .as .this .dont .you .wide .pages .are .much .cooler .than .those .narrow .pages .you .are .used .to .reading .because .you .dont .have .to .worry .about .the .lameness .filter .telling .you .that .you .don't .have .enough .charaters .per .line .that .really .sucks .when .that .happens .and .you .have .to .put .some .lame .lameness .filter .defeater .text .in .there .i .wonder .how .many .people .will .read .this .whole .comment .I .certainly .hope .it .doesnt .annoy .too .many .people .This .is .just .the .beginning .because .PAGE .WIDENING .IS .BACK .I .like .wide .pages .I .wish .all .pages .could .be .as .wide .as .this .dont .you .wide .pages .are .much .cooler .than .those .narrow .pages .you .are .used .to .reading .because .you .dont .have .to .worry .about .the .lameness .filter .telling .you .that .you .don't .have .enough .charaters .per .line .that .really .sucks .when .that .happens .and .you .have .to .put .some .lame .lameness .filter .defeater .text .in .there .i .wonder .how .many .people .will .read .this .whole .comment .I .certainly .hope .it .doesnt .annoy .too .many .people .This .is .just .the .beginning .because .PAGE .WIDENING .IS .BACK .I .like .wide .pages .I .wish .all .pages .could .be .as .wide .as .this .dont .you .wide .pages .are .much .cooler .than .those .narrow .pages .you .are .used .to .reading .because .you .dont .have .to .worry .about .the .lameness .filter .telling .you .that .you .don't .have .enough .charaters .per .line .that .really .sucks .when .that .happens .and .you .have .to .put .some .lame .lameness .filter .defeater .text .in .there .i .wonder .how .many .people .will .read .this .whole .comment .I .certainly .hope .it .doesnt .annoy .too .many .people .This .is .just .the .beginning .because .PAGE .WIDENING .IS .BACK .I .like .wide .pages .I .wish .all .pages .could .be .as .wide .as .this .dont .you .wide .pages .are .much .cooler .than .those .narrow .pages .you .are .used .to .reading .because .you .dont .have .to .worry .about .the .lameness .filter .telling .you .that .you .don't .have .enough .charaters .per .line .that .really .sucks .when .that .happens .and .you .have .to .put .some .lame .lameness .filter .defeater .text .in .there .i .wonder .how .many .people .will .read .this .whole .comment .I .certainly .hope .it .doesnt .annoy .too .many .people .This .is .just .the .beginning .because .PAGE .WIDENING .IS .BACK .I .like .wide .pages .I .wish .all .pages .could .be .as .wide .as .this .dont .you .wide .pages .are .much .cooler .than .those .narrow .pages .you .are .used .to .reading .because .you .dont .have .to .worry .about .the .lameness .filter .telling .you .that .you .don't .have .enough .charaters .per .line .that .really .sucks .when .that .happens .and .you .have .to .put .some .lame .lameness .filter .defeater .text .in .there .i .wonder .how .many .people .will .read .this .whole .comment .I .certainly .hope .it .doesnt .annoy .too .many .people .This .is .just .the .beginning .because .PAGE .WIDENING .IS .BACK .I .like .wide .pages .I .wish .all .pages .could .be .as .wide .as .this .dont .you .wide .pages .are .much .cooler .than .those .narrow .pages .you .are .used .to .reading .because .you .dont .have .to .worry .about .the .lameness .filter .telling .you .that .you .don't .have .enough .charaters .per .line .that .really .sucks .when .that .happens .and .you .have .to .put .some .lame .lameness .filter .defeater .text .in .there .i .wonder .how .many .people .will .read .this .whole .comment .I .certainly .hope .it .doesnt .annoy .too .many .people .This .is .just .the .beginning .because .PAGE .WIDENING .IS .BACK .I .like .wide .pages .I .wish .all .pages .could .be .as .wide .as .this .dont .you .wide .pages .are .much .cooler .than .those .narrow .pages .you .are .used .to .reading .because .you .dont .have .to .worry .about .the .lameness .filter .telling .you .that .you .don't .have .enough .charaters .per .line .that .really .sucks .when .that .happens .and .you .have .to .put .some .lame .lameness .filter .defeater .text .in .there .i .wonder .how .many .people .will .read .this .whole .comment .I .certainly .hope .it .doesnt .annoy .too .many .people .This .is .just .the .beginning .because .PAGE .WIDENING .IS .BACK .I .like .wide .pages .I .wish .all .pages .could .be .as .wide .as .this .dont .you .wide .pages .are .much .cooler .than .those .narrow .pages .you .are .used .to .reading .because .you .dont .have .to .worry .about .the .lameness .filter .telling .you .that .you .don't .have .enough .charaters .per .line .that .really .sucks .when .that .happens .and .you .have .to .put .some .lame .lameness .filter .defeater .text .in .there .i .wonder .how .many .people .will .read .this .whole .comment .I .certainly .hope .it .doesnt .annoy .too .many .people .This .is .just .the .beginning .because .PAGE .WIDENING .IS .BACK .I .like .wide .pages .I .wish .all .pages .could .be .as .wide .as .this .dont .you .wide .pages .are .much .cooler .than .those .narrow .pages .you .are .used .to .reading .because .you .dont .have .to .worry .about .the .lameness .filter .telling .you .that .you .don't .have .enough .charaters .per .line .that .really .sucks .when .that .happens .and .you .have .to .put .some .lame .lameness .filter .defeater .text .in .there .i .wonder .how .many .people .will .read .this .whole .comment .I .certainly .hope .it .doesnt .annoy .too .many .people .This .is .just .the .beginning .because .PAGE .WIDENING .IS .BACK .I .like .wide .pages .I .wish .all .pages .could .be .as .wide .as .this .dont .you .wide .pages .are .much .cooler .than .those .narrow .pages .you .are .used .to .reading .because .you .dont .have .to .worry .about .the .lameness .filter .telling .you .that .you .don't .have .enough .charaters .per .line .that .really .sucks .when .that .happens .and .you .have .to .put .some .lame .lameness .filter .defeater .text .in .there .i .wonder .how .many .people .will .read .this .whole .comment .I .certainly .hope .it .doesnt .annoy .too .many .people .This .is .just .the .beginning .because .PAGE .WIDENING .IS .BACK .I .like .wide .pages .I .wish .all .pages .could .be .as .wide .as .this .dont .you .wide .pages .are .much .cooler .than .those .narrow .pages .you .are .used .to .reading .because .you .dont .have .to .worry .about .the .lameness .filter .telling .you .that .you .don't .have .enough .charaters .per .line .that .really .sucks .when .that .happens .and .you .have .to .put .some .lame .lameness .filter .defeater .text .in .there .i .wonder .how .many .people .will .read .this .whole .comment .I .certainly .hope .it .doesnt .annoy .too .many .people .This .is .just .the .beginning .because .PAGE .WIDENING .IS .BACK .I .like .wide .pages .I .wish .all .pages .could .be .as .wide .as .this .dont .you .wide .pages .are .much .cooler .than .those .narrow .pages .you .are .used .to .reading .because .you .dont .have .to .worry .about .the .lameness .filter .telling .you .that .you .don't .have .enough .charaters .per .line .that .really .sucks .when .that .happens .and .you .have .to .put .some .lame .lameness .filter .defeater .text .in .there .i .wonder .how .many .people .will .read .this .whole .comment .I .certainly .hope .it .doesnt .annoy .too .many .people .This .is .just .the .beginning .because .PAGE .WIDENING .IS .BACK .I .like .wide .pages .I .wish .all .pages .could .be .as .wide .as .this .dont .you .wide .pages .are .much .cooler .than .those .narrow .pages .you .are .used .to .reading .because .you .dont .have .to .worry .about .the .lameness .filter .telling .you .that .you .don't .have .enough .charaters .per .line .that .really .sucks .when .that .happens .and .you .have .to .put .some .lame .lameness .filter .defeater .text .in .there .i .wonder .how .many .people .will .read .this .whole .comment .I .certainly .hope .it .doesnt .annoy .too .many .people .This .is .just .the .beginning .because .PAGE .WIDENING .IS .BACK .I .like .wide .pages .I .wish .all .pages .could .be .as .wide .as .this .dont .you .wide .pages .are .much .cooler .than .those .narrow .pages .you .are .used .to .reading .because .you .dont .have .to .worry .about .the .lameness .filter .telling .you .that .you .don't .have .enough .charaters .per .line .that .really .sucks .when .that .happens .and .you .have .to .put .some .lame .lameness .filter .defeater .text .in .there .i .wonder .how .many .people .will .read .this .whole .comment .I .certainly .hope .it .doesnt .annoy .too .many .people .This .is .just .the .beginning .because .PAGE .WIDENING .IS .BACK .I .like .wide .pages .I .wish .all .pages .could .be .as .wide .as .this .dont .you .wide .pages .are .much .cooler .than .those .narrow .pages .you .are .used .to .reading .because .you .dont .have .to .worry .about .the .lameness .filter .telling .you .that .you .don't .have .enough .charaters .per .line .that .really .sucks .when .that .happens .and .you .have .to .put .some .lame .lameness .filter .defeater .text .in .there .i .wonder .how .many .people .will .read .this .whole .comment .I .certainly .hope .it .doesnt .annoy .too .many .people .This .is .just .the .beginning .because .PAGE .WIDENING .IS .BACK .I .like .wide .pages .I .wish .all .pages .could .be .as .wide .as .this .dont .you .wide .pages .are .much .cooler .than .those .narrow .pages .you .are .used .to .reading .because .you .dont .have .to .worry .about .the .lameness .filter .telling .you .that .you .don't .have .enough .charaters .per .line .that .really .sucks .when .that .happens .and .you .have .to .put .some .lame .lameness .filter .defeater .text .in .there .i .wonder .how .many .people .will .read .this .whole .comment .I .certainly .hope .it .doesnt .annoy .too .many .people .This .is .just .the .beginning .because .PAGE .WIDENING .IS .BACK .I .like .wide .pages .I .wish .all .pages .could .be .as .wide .as .this .dont .you .wide .pages .are .much .cooler .than .those .narrow .pages .you .are .used .to .reading .because .you .dont .have .to .worry .about .the .lameness .filter .telling .you .that .you .don't .have .enough .charaters .per .line .that .really .sucks .when .that .happens .and .you .have .to .put .some .lame .lameness .filter .defeater .text .in .there .i .wonder .how .many .people .will .read .this .whole .comment .I .certainly .hope .it .doesnt .annoy .too .many .people .This .is .just .the .beginning .because .PAGE .WIDENING .IS .BACK .I .like .wide .pages .I .wish .all .pages .could .be .as .wide .as .this .dont .you .wide .pages .are .much .cooler .than .those .narrow .pages .you .are .used .to .reading .because .you .dont .have .to .worry .about .the .lameness .filter .telling .you .that .you .don't .have .enough .charaters .per .line .that .really .sucks .when .that .happens .and .you .have .to .put .some .lame .lameness .filter .defeater .text .in .there .i .wonder .how .many .people .will .read .this .whole .comment .I .certainly .hope .it .doesnt .annoy .too .many .people .This .is .just .the .beginning .because .PAGE .WIDENING .IS .BACK .I .like .wide .pages .I .wish .all .pages .could .be .as .wide .as .this .dont .you .wide .pages .are .much .cooler .than .those .narrow .pages .you .are .used .to .reading .because .you .dont .have .to .worry .about .the .lameness .filter .telling .you .that .you .don't .have .enough .charaters .per .line .that .really .sucks .when .that .happens .and .you .have .to .put .some .lame .lameness .filter .defeater .text .in .there .i .wonder .how .many .people .will .read .this .whole .comment .I .certainly .hope .it .doesnt .annoy .too .many .people .This .is .just .the .beginning .because .PAGE .WIDENING .IS .BACK .I .like .wide .pages .I .wish .all .pages .could .be .as .wide .as .this .dont .you .wide .pages .are .much .cooler .than .those .narrow .pages .you .are .used .to .reading .because .you .dont .have .to .worry .about .the .lameness .filter .telling .you .that .you .don't .have .enough .charaters .per .line .that .really .sucks .when .that .happens .and .you .have .to .put .some .lame .lameness .filter .defeater .text .in .there .i .wonder .how .many .people .will .read .this .whole .comment .I .certainly .hope .it .doesnt .annoy .too .many .people .This .is .just .the .beginning .because .PAGE .WIDENING .IS .BACK .I .like .wide .pages .I .wish .all .pages .could .be .as .wide .as .this .dont .you .wide .pages .are .much .cooler .than .those .narrow .pages .you .are .used .to .reading .because .you .dont .have .to .worry .about .the .lameness .filter .telling .you .that .you .don't .have .enough .charaters .per .line .that .really .sucks .when .that .happens .and .you .have .to .put .some .lame .lameness .filter .defeater .text .in .there .i .wonder .how .many .people .will .read .this .whole .comment .I .certainly .hope .it .doesnt .annoy .too .many .people .This .is .just .the .beginning .because .PAGE .WIDENING .IS .BACK .I .like .wide .pages .I .wish .all .pages .could .be .as .wide .as .this .dont .you .wide .pages .are .much .cooler .than .those .narrow .pages .you .are .used .to .reading .because .you .dont .have .to .worry .about .the .lameness .filter .telling .you .that .you .don't .have .enough .charaters .per .line .that .really .sucks .when .that .happens .and .you .have .to .put .some .lame .lameness .filter .defeater .text .in .there .i .wonder .how .many .people .will .read .this .whole .comment .I .certainly .hope .it .doesnt .annoy .too .many .people .This .is .just .the .beginning .because .PAGE .WIDENING .IS .BACK .I .like .wide .pages .I .wish .all .pages .could .be .as .wide .as .this .dont .you .wide .pages .are .much .cooler .than .those .narrow .pages .you .are .used .to .reading .because .you .dont .have .to .worry .about .the .lameness .filter .telling .you .that .you .don't .have .enough .charaters .per .line .that .really .sucks .when .that .happens .and .you .have .to .put .some .lame .lameness .filter .defeater .text .in .there .i .wonder .how .many .people .will .read .this .whole .comment .I .certainly .hope .it .doesnt .annoy .too .many .people .This .is .just .the .beginning .because .PAGE .WIDENING .IS .BACK .I .like .wide .pages .I .wish .all .pages .could .be .as .wide .as .this .dont .you .wide .pages .are .much .cooler .than .those .narrow .pages .you .are .used .to .reading .because .you .dont .have .to .worry .about .the .lameness .filter .telling .you .that .you .don't .have .enough .charaters .per .line .that .really .sucks .when .that .happens .and .you .have .to .put .some .lame .lameness .filter .defeater .text .in .there .i .wonder .how .many .people .will .read .this .whole .comment .I .certainly .hope .it .doesnt .annoy .too .many .people .This .is .just .the .beginning .because .PAGE .WIDENING .IS .BACK .I .like .wide .pages .I .wish .all .pages .could .be .as .wide .as .this .dont .you .wide .pages .are .much .cooler .than .those .narrow .pages .you .are .used .to .reading .because .you .dont .have .to .worry .about .the .lameness .filter .telling .you .that .you .don't --
    - Marco     Share twitter facebook linkedin
  10. 10th post (Score:-1, Offtopic) by Anonymous Coward writes: on Wednesday February 27, 2002 @03:35AM (#3077644) I claim this early post for JinWicked! Share twitter facebook linkedin
  11. Is it as good as New Riders' MySQL book? (Score:0) by Anonymous Coward writes: on Wednesday February 27, 2002 @03:36AM (#3077649) New Riders' MySQL book is mighty fine; if this is half as good it'll be worth reading Share twitter facebook linkedin
  12. ep (Score:-1) by bitchslapboy ( 193543 ) writes: Alter Relationship on Wednesday February 27, 2002 @03:37AM (#3077652) Homepage This early post for Ida! --

    Slashdot - contra bonos mores Share twitter facebook linkedin
  13. first dead penis bird (Score:-1) by neal n bob ( 531011 ) writes: Alter Relationship on Wednesday February 27, 2002 @03:38AM (#3077655) Homepage Journal man this site really, really sucks. Hardly makes it worth mentioning that you can kiss my grits. Share twitter facebook linkedin
  14. What's complicated about FreeSWAN? (Score:4, Interesting) by Anonymous Coward writes: on Wednesday February 27, 2002 @03:39AM (#3077660) They have excellent documentation and they keep the documentation trees for older versions online. Installation is as complicated as running a skript and installing the recompiled kernel, if even that. I guess it never hurts to have more documentation, but saying that IPSec is "a difficult beast to ride" produces more awe than necessary. Share twitter facebook linkedin
    • Re:What's complicated about FreeSWAN? (Score:-1, Offtopic) by Anonymous Coward writes: on Wednesday February 27, 2002 @03:45AM (#3077703) Overrated, maybe. But redundant? Parent Share twitter facebook linkedin
    • Re:What's complicated about FreeSWAN? (Score:5, Insightful) by Starship Trooper ( 523907 ) writes: Alter Relationship on Wednesday February 27, 2002 @03:49AM (#3077724) Homepage Journal What's complicated about FreeSWAN?

      Well, a LOT. Not if you're deeply involved technically in the project, but if you back out and take the perspective of someone who's never used a VPN, plenty.

      A lot of people don't even think about the fact that there's a separate protocol field in IP, or that people run any IP protocol but UDP or TCP. Getting 50/51 through your existing firmware firewall can be a real trick. FreeSWAN requires you to be able have the GNU Multi-Precision library installed for the crypto calculations before you compile it. Unless your distro can with FreeSWAN, you have to recompile your kernel with modifications.

      And, like many tools, there's no single graphical GUI; unlike SAMBA's excellent SWAT, there's nothing to lead you to ipsec.conf or ipsec.secrets. There's a LOT of reading to be done.

      Ok, so, for you or me, it's easy. Maybe a day of reading tops. But compare that to the commercial world where an application must install and be configured from a GUI in a few hours, and FreeSWAN is... nearly a toy. It's unusable in a business environment. As soon as you say "compile", a CTO is going to turn down your volume.

      It's cool, but don't call it uncomplicated. That's part of it's coolness (-;

      --
      Loneliness is a power that we possess to give or take away forever Parent Share twitter facebook linkedin
      • Re:What's complicated about FreeSWAN? (Score:3, Insightful) by smcavoy ( 114157 ) writes: Alter Relationship on Wednesday February 27, 2002 @04:30AM (#3077979) I use Freeswan in a production environment. I have Embedded Linux routers using freeswan connecting to Linux boxes. They VPNs are relatively simple, 2 outgoing connections to central
        systems. I did find there was a large learning curve at the beginning, but now it takes 5 min to setup a new vpn tunnel. The systems have been extremely reliable. I've never had a problem (other than net congestion) with keeping the tunnels up. A lot of the tunnels have 80+ days of uptime. As for compiling, most modern distros include IPSec (trustix, mandrake, etc.) or there are options like Astaro. Having a CTO "turn down your volume" based on the fact that you have to compile software, doesn't say anything about the quality or reliability of the software, that's a personal decision by CTO not to use OSS. I do agree it's not point and click, and that would be nice, but to say it's unusable in a business environment is just untrue. It's not pretty but it works, and works well. Parent Share twitter facebook linkedin
      • Re:What's complicated about FreeSWAN? (Score:0) by Anonymous Coward writes: on Wednesday February 27, 2002 @04:54AM (#3078169) How right you are. As a system admin that has always used windows or dos. I am tring to change. I want to start using some Linux servers here, but one of the things that I want to use is free/swan. It does seem great, but as a 1 person IT department I have not found the time that I need to read and understand the documentation on swan. Do I want a GUI Heck yes. Do I still want access to the .conf file Heck yes. These problems are around a lot in the Linux community. The people that have always used linux do see it as hard and some dont want us new people to whine because it is not "dumb down", but on the other hand they want all of us to switch to it. I dont want to do away with the command line at all. I love it for a lot of what I do, but when I want to make changes or try out some new tools I dont want to have to spend 1-2 days reading ALL the docs just to know where to start. Just my 2 cents.
        Let the flames begin!!!! Parent Share twitter facebook linkedin
        • Re:What's complicated about FreeSWAN? (Score:3, Insightful) by disappear ( 21915 ) writes: Alter Relationship on Wednesday February 27, 2002 @05:03AM (#3078246) Homepage
          one of the things that I want to use is free/swan. It does seem great, but as a 1 person IT department I have not found the time that I need to read and understand the documentation on swan. Do I want a GUI Heck yes.

          With security software in general, and VPN software in particular, that's a very, very dangerous attitude: a GUI may fool you into thinking that you understand what's going on when in reality you haven't a clue. With most software, that's not an issue, but with security software, that can compromise the very goal you're trying to achieve.

          I dont want to do away with the command line at all. I love it for a lot of what I do, but when I want to make changes or try out some new tools I dont want to have to spend 1-2 days reading ALL the docs just to know where to start.

          How many days do you want to spend cleaning up after a security incident that occurred because the GUI let you get away without spending two days reading documentation? How much time will you save in the long run if every time you save two days reading documentation you spend three days cleaning up?

          (We lose money on every item --- but we make it up in volume!)

          Parent Share twitter facebook linkedin
          • Re:What's complicated about FreeSWAN? (Score:1) by BeNude ( 28969 ) writes: Alter Relationship on Wednesday February 27, 2002 @11:15AM (#3081147) Homepage I would disagree with you about the usefulness of a GUI to implement VPN's or firewalls.

            First of all, a GUI interface, if it is well-designed, can provide every bit as much control over the underlying security behavior of a firewall as any command-line interface. Furthermore, a GUI allows an administrator to spend less time trying to deal with syntax, etc., and more time on building a ruleset that is secure.

            Someone who has done the reading and understands how firewalls and VPN's work will appreciate a GUI because of this.

            For those who don't fully understand how firewalls and VPN's work, a GUI at least provides a reasonable learning environment and early attempts at a ruleset will probably more secure anyhow. :)

            Parent Share twitter facebook linkedin
        • IANACLB (Score:4, Interesting) by hey! ( 33014 ) writes: Alter Relationship on Wednesday February 27, 2002 @06:21AM (#3078804) Homepage Journal IANACLB (I Am Not a Command Line Bigot), but doing better than a CLI interface in an area like this is a tall order. It's not something you can just slap onto the product in a few days (as most VPN box configuration GUIs I've seen appear to be).

          The problem with the GUI interfaces I have seen is that they really don't give you any effective conceptual support. You have to figure out the topology and requirements of your network, then you do this bit of intellectual gymnastics that turns these global requirements and properties into settings for each individual box, THEN you sit down at your GUI. At that stage, the GUI can have very little benefit, since you are talking about a half dozen relatively simple commands you need to type in. In fact, typing them in means you can keep them in a little word processor file and send them to the box over and over again with little changes -- good for setting up multiple boxes or for playing around with a single box you are repeatedly pin-resetting.

          To really help a person like you who doesn't have time to bone up on every box you are working with, what you really need is something that is kind of a cross between a network management system and a CAD system. You would sketch out your network, and drop little dollops of distinctively colored "paint" on each network or host that needs to participate in some virtual network. The system would then output configurations to download to each of the participating firewalls or hosts.

          A GUI that just configures and individual box does practically nothing for you.
          --
          Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure. Parent Share twitter facebook linkedin
      • Where to get Freeswan packages for Red Hat (Score:2) by Nailer ( 69468 ) writes: Alter Relationship on Wednesday February 27, 2002 @10:47AM (#3080965) Unless your distro can with FreeSWAN, you have to recompile your kernel with modifications.

        Non-US distributions like SuSE and Debian can include Freeswan in their list of apps. US based ones like Red Hat can't. But some lovely fellows at Steambaloon (a Linux security consulting firm - no, I work for someone else) produce source and binary packages of the original and updated Red Hat kernels (with the AC patches, extensive testing, and old 2.4 VM) with Klips, the kernel level part of ipsec, compiled in.

        Parent Share twitter facebook linkedin
      • How stupid is the CTO? (Score:1) by SharpNose ( 132636 ) writes: Alter Relationship on Wednesday February 27, 2002 @11:21AM (#3081178) Journal Let's see: provided I know FreeSWAN, I can grab a machine and start setting it up immediately. If I want to get something commercial and very expensive, I have to fill out how many forms, get approval from how many people, wait for it to get ordered how long? Exactly where are you starting your clock when you say "configured from GUI in a few hours?"

        Parent Share twitter facebook linkedin
    • Re:What's complicated about FreeSWAN? (Score:3, Interesting) by LWolenczak ( 10527 ) writes: Alter Relationship <julia@evilcow.org> on Wednesday February 27, 2002 @04:25AM (#3077934) Homepage Journal The FreeS/WAN people don't document everything that you can do with frees/wan. Its very neat when you get down to the point where your playing with dozens of tunnels confiugred every which way.

      One of the things that they don't tell you how to do, i guess so they don't get asked questions, is how to put gre traffic inside of an ipsec tunnel and make it work right. Also, it seems to have slipped by that you CAN make two linux 2.4 secure gateways talk to each other over the ipsec tunnel.

      I have a couple samples of some of the neat things I have done at http://lwolenczak.net/ipsec.html Parent Share twitter facebook linkedin
    • Re:What's complicated about FreeSWAN? (Score:3, Interesting) by Etyenne ( 4915 ) writes: Alter Relationship on Wednesday February 27, 2002 @05:40AM (#3078498) Complicated thing with FreeSWAN :

      - Client behind NAT

      - Left/Right side nomenclature really confuse me; they could have used "peers" or client/server, I don't know

      - Recompiling kernel; easy if you have a single box, quite hard when you manage 30+. Plus it require you to commit the sin of rebooting the machine.

      At work, we have choosen CIPE for Linux-Linux VPN. It is totally userland, come stock on recent RedHat version and is available as RPM; all that make it is easy to install and upgrade on a lot of machines. Plus the config file is really dumb-proof. We are stuck using PPTP for Windows-Linux VPN because that's all the Windows monkeys know about. --
      :wq Parent Share twitter facebook linkedin
      • Re:What's complicated about FreeSWAN? (Score:1) by pivo ( 11957 ) writes: Alter Relationship on Wednesday February 27, 2002 @06:17AM (#3078772) From my understanding of FreeSWAN, it's not intended to connect many machines to a central point, for example a VPN for home manchines connected to a central office. It's intended to link offices together. So you should only have to install it on the specific machines that link those offices. If you're company's so big or disperse that you have thirty officies, then I guess you would have to recompile each kernel, though you'd be smarter to have identical machines and build the kernel once then distribute it to each machine.

        We use PPP over SSH for our home/office VPN for Linux and Solaris. It works very well and since it was originally a skunworks project, we didn't even have to get IT to open any new ports since SSH was already supported. Parent Share twitter facebook linkedin
    • Re:What's complicated about FreeSWAN? (Score:2) by LinuxGeek8 ( 184023 ) writes: Alter Relationship on Wednesday February 27, 2002 @06:57AM (#3079084) Homepage I am struggling for some time now to get it going, but I still do not understand how it works.
      On my end I have a linux firewall with iptables.
      And what I could not figure out is what to do with the packet filtering, do I need to accept traffic over 50/ip on the ipsec0 interface or the eth0 interface. Same question for the 500 udp/ip traffic.

      And the other part of the network is connected to a freebsd server with racoon running. That is a completely different ipsec implementation. At least for configuring it is different.

      I believe running a packet filter is quite hard if you want to do it right. You have to understand networking and just play with for a few weeks just to understand it.
      If anyone would tell me he has a secure packet filter running, but cannot explain how it works, I just cannot believe it. You just have to know what you are doing.
      Same with ipsec.
      Ipsec is not only networking, but also crypto.
      So there is more you need to know about it, and it adds extra complexity to firewalling. --
      Well, don't worry about that. We can get you back before you leave. (Dr. Who)
      Parent Share twitter facebook linkedin
      • Re:What's complicated about FreeSWAN? (Score:1) by pfunkmallone ( 89539 ) writes: Alter Relationship on Thursday February 28, 2002 @09:44AM (#3086925) On your eth0 interface of the firewall, you need to allow 500 udp, and 50 tcp (if you're using ESP which is default). This allows the IPSEC peers to setup the tunnel. http://www.freeswan.org/freeswan_trees/freeswan-1. 95/doc/firewall.html

        According to the FreeSwan folks, no firewalling NEEDS to be done on the ipsec0 interfaces, as all packets coming through this tunnel are already being disassembled and "cleaned-up" by freeswan itself. Parent Share twitter facebook linkedin
  15. Women of the world, Stop sucking dick! (Score:-1, Troll) by Anonymous Coward writes: on Wednesday February 27, 2002 @03:46AM (#3077705) Women of the world, it is time to stop sucking dick!

    Sucking dick is the ultimate act of subservience;
    a woman sucking dick not only gets no orgasm for
    her work, but gets a mouthfull of what can only
    be described as warm rancid milk for her efforts.

    This sexual slavery must be stopped!
    Women, reclaim your mouths, and

    STOP
    SUCKING
    DICK! Share twitter facebook linkedin
  16. Alan Thicke. DEAD. (Score:-1) by Alan_Thicke ( 553655 ) writes: Alter Relationship on Wednesday February 27, 2002 @03:47AM (#3077709) Journal I just heard the sad news on CBC radio. Comedy actor/writer Alan Thicke was found dead in his home this morning. Even if you never liked his work, you can appreciate what he did for 80's television. Truly a Canadian icon.
    He will be missed :(



    Show me That Smile (The Growing Pains Theme Song):

    Show me that smile again.
    Ooh show me that smile.
    Don't waste another minute on your crying.
    We're nowhere near the end.
    We're nowhere near.
    The best is ready to begin.

    As long as we got each other
    We got the world
    Sitting right in our hands.
    Baby rain or shine;
    All the time.
    We got each other
    Sharing the laughter and love.

    --
    Alan Thicke's Journal
    My Slashdot ads say " Share twitter facebook linkedin
  17. why? (Score:0) by tplayford ( 308405 ) writes: Alter Relationship <tom@sai[ ]taly.com ['l-i' in gap]> on Wednesday February 27, 2002 @03:51AM (#3077734) I'm sure this book is very usefull etc. But I've set up serveral internationl linux based VPN's now and it really isn't that difficult.

    I suppose this is the same for almost all computer books, easy if you know how...

    Share twitter facebook linkedin
    • Re:why? (Score:2, Insightful) by MonkeyBot ( 545313 ) writes: Alter Relationship on Wednesday February 27, 2002 @04:09AM (#3077844) Sometimes, there are special constraints on the networks you are working with. For instance, I need to use stuff that uses IP, but since PPP over SSH is strictly TCP, I can't use that option. Moreover, my boss is a paranoid guy that doesn't trust some 24-year-old punk (me) to run his firewalls, so both offices have managed firewalls through different ISPs, ruling out the possibility of a single ISP routing traffic over its network to the other office so that I don't have to do anything. This adds additional constraints because since I can't control the firewall without going through pains with both ISPs for several days, I can't even open a port for something like PPTP (which I really wouldn't want to do anyway). Granted, I can probably find out what I need to know from a Google search, but it would be nice to have all the common VPN solutions covered--even just introduced--in a book format. I'm buying it. Parent Share twitter facebook linkedin
      • Re:why? (Score:2) by Junta ( 36770 ) writes: Alter Relationship on Wednesday February 27, 2002 @08:10AM (#3079648) Of course, ppp over ssh implies a full IP tunnel using ppp with ssh underneath, IP in TCP encapsulation, essentially. You get full IP functionality this way, though the architecture is horribly flawed (TCP connections run with TCP somewhere underneath, very bad when packets get loss and two layers start doing recovery).

        Now ssh without ppp on top supports only TCP tunnels, I'll assume that is what you are talking about. A statement that says you need to use IP, but you only get TCP sounds really goofy, since TCP rides on top of IP, phrasing it with the protocols you need (i.e. udp, icmp, etc) would have made the post more sensible (that and omitting ppp...). If I heard someone make the statement you just made I wouldn't trust them with firewall configuration either...
        --
        XML is like violence. If it doesn't solve the problem, use more. Parent Share twitter facebook linkedin
      • Re:why? (Score:2) by Pii ( 1955 ) writes: Alter Relationship <jedi.lightsaber@org> on Wednesday February 27, 2002 @08:31AM (#3079810) Journal What do you mean, "PPP over SSH is strictly TCP?"

        Are you saying that ICMP, or UDP, traffic is unable to utilize this tunnel?

        That is certainly not correct. Just as PPP carries all of your IP traffic (any protocol) between your home and your ISP, a PPP over SSH tunnel will also carry whatever you need it to.

        --
        For those that would die defending it, Freedom
        has a sweet taste that the protected will never know.         Parent Share twitter facebook linkedin
    • Re:why? (Score:2) by Bender Unit 22 ( 216955 ) writes: Alter Relationship on Wednesday February 27, 2002 @07:13AM (#3079206) Journal It's not when it works you need the books. It's when it doesn't work you'd wish you had the book.
      I have configured a VPN with the help of a HOW-TO page and it worked. B
      ut when you want to do larger setup's in the "real" world. All kinds of questions comes and demands comes to mind and it's nice to be on top of things and be able to say from the first meeting, what is possible and what is not. Parent Share twitter facebook linkedin
  18. Garsh (Score:-1) by Guns n' Roses Troll ( 207208 ) writes: Alter Relationship on Wednesday February 27, 2002 @03:51AM (#3077735) Homepage I never knew that a high-steppin' yella could do that.
    Share twitter facebook linkedin
  19. VPN hardware (Score:1, Troll) by pokka ( 557695 ) writes: Alter Relationship on Wednesday February 27, 2002 @04:02AM (#3077793) Building VPNs is a pain in the ass, regardless of whether you're using windows NT/2k or linux. Microsoft's documentation is sketchy (and in some cases completely wrong), and there are very few sources for building a VPN in Linux.

    This book may make it easier to build a VPN, but it's kind of obsolete, now that the Linksys VPN router has been released, making it a matter of plugging in and turning on. Of course, if you have plenty of free time, but very little money, you might go for the book instead. Share twitter facebook linkedin
    • Re:VPN hardware (Score:-1, Offtopic) by Anonymous Coward writes: on Wednesday February 27, 2002 @04:17AM (#3077888) Heck of a troll. Good Job! Parent Share twitter facebook linkedin
    • Re:VPN hardware (Score:2, Interesting) by Cyno ( 85911 ) writes: Alter Relationship on Wednesday February 27, 2002 @04:38AM (#3078046) Journal ...or if you're worried about security. I never trust commercial companies to deliver secure code. Specially if they keep it closed source. Unless you want to flash the rom on this thing every few weeks I'd just read up on a linux ppp over ssh solution and write some scripts to keep that software updated. Parent Share twitter facebook linkedin
    • Re:VPN hardware (Score:1) by starpool ( 562363 ) writes: Alter Relationship on Wednesday February 27, 2002 @02:12PM (#3081956) We started out making slow progress with FreeS/WAN trying to connect to a Raptor Firewall, and thought we'd try to take the easy way out and use two Linksys VPN Routers. Bottom line: the LVRs will only allow one Class C subnet access to the tunnel. Since we have multiple subnets at 4 different locations, the LVR is disqualified, at least for now. (Maybe Linksys will add this capability to future firmware.) So we're back to FreeS/WAN and Raptor...now if I can just get that book at my local BN. Parent Share twitter facebook linkedin
  20. What's wrong with PPTP? (Score:4, Interesting) by Jacco de Leeuw ( 4646 ) writes: Alter Relationship on Wednesday February 27, 2002 @04:06AM (#3077826) Homepage PPTP is often used for 'road warrior' setups, i.e. people working from home or on the road. It's cheap because there are free (as in speech) PPTP servers for Linux and the Windows PPTP clients are free too (as in beer). In contrast, Windows IPSEC clients are often expensive.

    So, what's wrong with it then? Well, the security of PPTP apparently depends on the password. A German student has written software which can crack the password in a couple of hours on a Pentium II.

    c't (Heise) reported about this.

    --
    -------
    Warning: Slashdot may contain traces of nuts.
    Share twitter facebook linkedin
    • Re:What's wrong with PPTP? (Score:2, Informative) by Anonymous Coward writes: on Wednesday February 27, 2002 @04:19AM (#3077901) It's Point-to-Point Tunneling Protocol and thus more limited than IPSec which can be used in routed mode and can connect arbitrary networks. Parent Share twitter facebook linkedin
    • Re:What's wrong with PPTP? (Score:3, Interesting) by FallLine ( 12211 ) writes: Alter Relationship on Wednesday February 27, 2002 @04:25AM (#3077939) Well firstly, Microsoft's implimentation of PPTP is insecure, buggy on the client side (and the server side, where their server is used), and has a hard time supporting multiple clients in a NAT environment.

      Secondly, a lot of older hardware has little to no support for the GRE protocol that PPTP depends on. Thus many people simply can't use it.

      Thirdly, it's virtually impossible to get two people connecting to the same VPN behind the same NAT network on any hardware. The nature of GRE makes it very difficult since it has no concept of port to diffentiate between packets, only source and destination IP. Unfortunately, NAT is very common these days so this really does matter. Parent Share twitter facebook linkedin
      • Re:What's wrong with PPTP? (Score:0, Troll) by icedivr ( 168266 ) writes: Alter Relationship on Wednesday February 27, 2002 @09:44AM (#3080500) If it's so insecure, why aren't people getting cracked all the time?

        Secondly, since when does hardware support a networking protocol in the absense of software? Any machine that can run 95 or 98 can run PPTP. They have pretty modest hardware requirements by today's standards.

        Thirdly, I have created multiple outbound pptp tunnels behind an ICS connection. It can be done.

        Parent Share twitter facebook linkedin
    • Re:What's wrong with PPTP? (Score:3, Informative) by Junta ( 36770 ) writes: Alter Relationship on Wednesday February 27, 2002 @04:40AM (#3078066) Just FYI, but Win2k and newer (at least) include native IPSEC support that can interoperate with FreeS/WAN and such. Other systems, well, they are intended for home use that doesn't need that functionality.. --
      XML is like violence. If it doesn't solve the problem, use more. Parent Share twitter facebook linkedin
    • Re:What's wrong with PPTP? (Score:2, Informative) by jeremiahstanley ( 473105 ) writes: Alter Relationship <miah AT miah DOT org> on Wednesday February 27, 2002 @04:45AM (#3078100) Homepage With Win2k you can get this little patch and then you have a free as in beer IPSec implementation provided by Microsoft under Win2k. It even supports x509 certs. IPSec clients are not that expensive. Look at SSH Sentinal for another option. It even supports the newer AES ciphers (which I don't expect out of Microsoft for a long time)as added security.

      For all of this you have to patch the code to use the newer ciphers. You can get that here and if you need to use x509 certs you can get that stuff here. This is all pretty easy if you have you druthers about compiling new kernels and working with OpenSSL.

      Why this isn't in the kernel to begin with is anybody's guess. I would guess that it has something to do with all those pesky crypto export laws. Just like everything else in the ol US of A we have to sacrifice our freedoms so that we can be safe from the KGB and that one guy from Hackers. --
      Hire me... Parent Share twitter facebook linkedin
    • Its damn slow (Score:1) by moankey ( 142715 ) writes: Alter Relationship on Wednesday February 27, 2002 @05:08AM (#3078275) From testimonies of traveling whatevers the people always complain that PPTP is very sloooow. They preferred using RAS in place, albeit a very expensive phone bill.

      Most were of course higher level execs so their complaining actually mattered. Parent Share twitter facebook linkedin
    • Re:What's wrong with PPTP? (Score:0) by Anonymous Coward writes: on Wednesday February 27, 2002 @05:19AM (#3078347) So, what's wrong with it then? Well, the security of PPTP apparently depends on the password. A German student [uni-freiburg.de] has written software which can crack the password in a couple of hours on a Pentium II.

      Thank god I'm not in Germany!!!! Parent Share twitter facebook linkedin
    • Re:What's wrong with PPTP? (Score:0) by Anonymous Coward writes: on Wednesday February 27, 2002 @05:26AM (#3078396) You can buy PGPnet (IPsec client) in most office depots , office max, or Circuit City for $39. It has the same functionality as the NAI version. Parent Share twitter facebook linkedin
    • wireless PPTP == readable password file (Score:1) by nealmcb ( 125634 ) writes: Alter Relationship on Friday March 01, 2002 @04:59AM (#3091216) Homepage The Heise article is in German, but refers to the original paper which is in English
      Normally, the file /etc/shadow (or /etc/password on old systems) is regarded one of the most vulnerable points of an unix system [Uni99]. If an attacker can obtain the information in this file, the system is nearly hacked. Using Microsoft's PPTP protocol, information about your passwords is not only publicly available, you also provide additional hints about the passwords, which allow to speed-up the attack by a factor of up to 2^16 .

      With this said, it is clear why we believe Microsoft's PPTP implementation isn't suitable for securing wireless networks.

      --

      --Neal
      Go IETF!

      Parent Share twitter facebook linkedin
  21. Problem is getting Management to go along (Score:2, Interesting) by Cy Guy ( 56083 ) writes: Alter Relationship on Wednesday February 27, 2002 @04:27AM (#3077946) Homepage Journal I think the priority should be getting management to understand the importance of using standard protocols instead of proprietary ones.

    Having a book like this one is great if you want to familiarize yourself with the standards and how to implement them on Linux, but the much harder task is getting Management, particularly at larger companies, to see the benefit of implementing a standards based VPN where the users can use any standards based client over any TCP/IP network.

    Instead what I see is managers that want to buy a single product that comes with both the server and client applications, but then doesn't work or is hard to implement when the clients are trying to access the VPN from a cablemodem, DSL, or 802.11 connected machine, and don't (God forbid) want to use MSIE and Citrix on Windows to get onto the office network.

    --
    Work for Change & GET PAID! Share twitter facebook linkedin
  22. Can't beat SSH (Score:2, Insightful) by schlach ( 228441 ) writes: Alter Relationship on Wednesday February 27, 2002 @04:27AM (#3077953) Journal for simple encrypted forwarding

    LocalForward 8080 theproxy:8080
    LocalForward 25 thesmtp:25
    LocalForward 143 theimap:143

    Don't forget your '-g' =) Share twitter facebook linkedin
    • SSH != VPN. That's a good thing. (Score:1) by Brian Hatch ( 523490 ) writes: Alter Relationship <<bri> <at> <ifokr.org>> on Wednesday February 27, 2002 @06:32AM (#3078902) Homepage Journal We have a section about when a VPN is not what you need, and these are the exact kind of examples when a VPN is unnecessary overkill.

      As a side note, if you use '-g', make sure you have iptables/ipchains/hosts.{allow|deny} rulesets enabled to make sure that only authorized machines can use the gateway. Otherwise anyone in the world can use your encrypted tunnel.

      Parent Share twitter facebook linkedin
      • Re:SSH != VPN. That's a good thing. (Score:2) by brassrat77 ( 9533 ) writes: Alter Relationship on Wednesday February 27, 2002 @09:33AM (#3080403) As a side note, if you use '-g', make sure you have iptables/ipchains/hosts.{allow|deny} rulesets enabled to make sure that only authorized machines can use the gateway.

        This is an EXCELLENT POINT that CANNOT BE OVEREMPHASIZED.

        I recently had to set up tunnels to allow a set of NAT'd workstations (laptops runnin a mix of Linux and W2K) access a system on the inside of a remote firewall where SSH was the only available securable protocol. We needed to use the "-g" switch, and the need for filtering access was immediately apparent.

        We ended up using a set of scripts to build the tunnel, including the necessary iptables rules.

        As an aside, I'd check if hosts.allow|deny rules are sufficient - I think the ssh tunnel would make all connections appear to be coming from the host running the tunnel. (Can't check for myself right now)

        Parent Share twitter facebook linkedin
  23. The main problem with IPSEC... (Score:5, Insightful) by Junta ( 36770 ) writes: Alter Relationship on Wednesday February 27, 2002 @04:48AM (#3078126) IPSEC is wonderful, but many businesses don't think things through and use it for telecommuting. Why is this bad? Well, the way this works is that someone connects to the VPN system and gets a full tunnel that allows the authorized client to behave on the internal network as if it was actually there, bypassing the firewall. The problem here is pretty obvious. The client machine is not protected by a firewall,a nd so if the client is compromised, an attacker has a clear path straight past the firewall. So the effectiveness of the firewall is greatly reduced.

    Now if you don't have a firewall protectecting the network, this won't hurt, but if you do, then a solution like ssh is somewhat more secure, as you only set up the tunnels you absolutely need to very specific hosts. While there is still a risk, it is greatly reduced and strikes a good balance between usability and security.

    What IPSEC *is* good for is seamlessly connecting sites together without really expensive dedicated lines securely. While it makes no guarantee as to bandwidht or availability, it does provide almost the same level of security. If a company can't afford lines to sites but still wants to expand, IPSEC is ideal. I use it to connect my home private network to a friends home private network. The key here is that not only do you have to trust the clients whose keys you permit to connect, but you must also trust that the administrator of that client machine or network is sufficiently competent to keep his network secure, as the security of the two networks is tied a lot more closely together... --
    XML is like violence. If it doesn't solve the problem, use more. Share twitter facebook linkedin
    • Re:The main problem with IPSEC... (Score:1, Informative) by Anonymous Coward writes: on Wednesday February 27, 2002 @04:58AM (#3078205) Actually, this is bypassed by disabling split tunneling (allowing the client machine to access the internet "directly" and accessing the VPN tunnel).

      -m

      Parent Share twitter facebook linkedin
      • Re:The main problem with IPSEC... (Score:2) by j7953 ( 457666 ) writes: Alter Relationship on Wednesday February 27, 2002 @07:19AM (#3079240)
        Actually, this is bypassed by disabling split tunneling (allowing the client machine to access the internet "directly" and accessing the VPN tunnel).

        Well, but that doesn't prevent the telecommuter's computer to become compromised with some background logging software that'll collect information when connected to the company network, and send it to the attacker when connected to the internet.

        Of course, using an SSH tunnel also doesn't solve that problem.

        The only real option is to assign IPs from a different subnet to the telecummters' home computers, and having a firewall between that subnet and the rest of the company network that'll not allow access to certain ressources that are especially critical. And, of course, the telecommuters must be educated about the security issues.

        --
        Sig (appended to the end of comments I post, 54 chars) Parent Share twitter facebook linkedin
    • Re:The main problem with IPSEC... (Score:2, Informative) by icedivr ( 168266 ) writes: Alter Relationship on Wednesday February 27, 2002 @05:10AM (#3078285) Your beef can be easily solved by ensuring that the remote machine's default route is down the tunnel.

      As far as I'm concerned, a bigger threat is the road warrior laptop not having adequate virus protection. (VP of Sales does insist on Windows, doesn't he?) Desktops behind the firewall presumably have multiple layers of protection in front of them, the road warrior, maybe not. Parent Share twitter facebook linkedin
    • Re:The main problem with IPSEC... (Score:2) by Shoten ( 260439 ) writes: Alter Relationship on Wednesday February 27, 2002 @05:29AM (#3078417) So, you're saying the main problem with IPSEC is that it's not a magic bullet? Nothing is...get over it. I've heard people say the same about firewalls, saying how firewalls make people think that they're totally secure, so they no longer patch systems or pay attention. That may be true sometimes, but it's still not a valid argument that firewalls are flawed. Security isn't one box or one piece of software, and saying that one has a problem because it doesn't blanket everything is like criticizing deadbolts because thieves can still break a window to get into your home.
      --

      For your security, this post has been encrypted with ROT-13, twice. Parent Share twitter facebook linkedin
      • Re:The main problem with IPSEC... (Score:2) by Junta ( 36770 ) writes: Alter Relationship on Wednesday February 27, 2002 @06:53AM (#3079060) Right, but I was saying that IPSEC is not only not a magic bullet (that is to be expected) but companies outright misuse the technology without any serious thought. They invest tons in making sure they have tight firewalls and policies that prohibit people from hooking up modems to the outside world (internet without firewall), and yet repeat the mistake in a different form time and time again. It would be nice to establish trusted connections to telecommuters, but it just simply can never be secure enough (well, maybe if the telecommuter is the same person who designed the corporate security and takes home security equally seriously, but not worth finding out). --
        XML is like violence. If it doesn't solve the problem, use more. Parent Share twitter facebook linkedin
        • Re:The main problem with IPSEC... (Score:2) by Shoten ( 260439 ) writes: Alter Relationship on Thursday February 28, 2002 @03:15AM (#3084102) I see your point, but at that stage of the game, it's not the technology that is to blame. Any solid technology will be a problem if it is not part of a sound, well-thought out implementation. There are ways around the problem as well, however; for example, Checkpoint VPNs can push a security policy out to the client upon connection, enforcing a firewall policy at the end point and prohibiting network communications between that point and any node besides the VPN gateway. But that's a whole other ball of wax, and returns to the issue of making wise choices when rolling out technology.

          The bottom line is, VPNs make it possible to do things in business that aren't cost-effective any other way, and businesses are there to make money, not to be secure. It's a trade-off, and if the return outweighs the risk, it's worth the risk.

          --

          For your security, this post has been encrypted with ROT-13, twice. Parent Share twitter facebook linkedin
    • Re:The main problem with IPSEC... (Score:1) by Sloppy ( 14984 ) writes: Alter Relationship on Wednesday February 27, 2002 @05:59AM (#3078631) Homepage Journal

      So the effectiveness of the firewall is greatly reduced

      Don't you have the same exact problem with desktop machines on the LAN, inside the firewall? Seems to me that VPN-though-a-firewall doesn't introduce any vulnerabilities that you don't already have.

      --
      As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it. Parent Share twitter facebook linkedin
      • Re:The main problem with IPSEC... (Score:0) by Anonymous Coward writes: on Wednesday February 27, 2002 @06:38AM (#3078946) But LAN machines have never been exposed to the internet. I am sure somebody can put some "fun" deamons up on a machine just waiting for a VPN connection. Parent Share twitter facebook linkedin
        • Re:The main problem with IPSEC... (Score:1) by Sloppy ( 14984 ) writes: Alter Relationship on Wednesday February 27, 2002 @07:18AM (#3079239) Homepage Journal

          But LAN machines have never been exposed to the internet.

          Ha hah hah ha! That's a good one.

          Seriously, it must be nice to work at a place where they haven't heard of "Active Content" and no one uses products like Microsoft Word or Microsoft Outlook. :-)

          --
          As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it. Parent Share twitter facebook linkedin
          • Re:The main problem with IPSEC... (Score:2) by Junta ( 36770 ) writes: Alter Relationship on Wednesday February 27, 2002 @07:48AM (#3079450) When dealing with internal systems, you can enforce all kinds of policies about virus software, etc. You can keep it relatively boxed. With telecommuting, the clients not only have relaxed restrictions, but also are vulnerable while connected to the internet to the sort of attacks firewalls are meant to keep out. Normally, this wouldn't be too bad, but with a full tunnel, that machine will probably contain sensitive information itself and, for the duration of the connection, gives full access to a corporate network if compromised. --
            XML is like violence. If it doesn't solve the problem, use more. Parent Share twitter facebook linkedin
          • Re:The main problem with IPSEC... (Score:0) by Anonymous Coward writes: on Wednesday February 27, 2002 @09:07AM (#3080140) If you want to get legalistic about it:

            Local Area Network by definition is not a Wide Area Network now is it? If you have a LAN you cannot be exposed to the internet or it is a WAN. If you run active content then you are running code on the LAN. Don't run unknown code on a LAN. If you downloading something from the internet you are using a WAN interface are you not?

            The point is you have a machine that has been directly exposed to the intenet and now it is on your network and that is NOT the same thing.If I have to go to the head at a bus station I will finish my drink because I won't really know what it is when I get back. Parent Share twitter facebook linkedin
    • Re:The main problem with IPSEC... (Score:1) by -audiowhore- ( 153163 ) writes: Alter Relationship on Wednesday February 27, 2002 @11:08AM (#3081115) Bollocks! There are quite a few commercial VPN clients out there that either have a 'stateful' firewall engine (Check Points Secure Client), and some others that support personal firewall software (the Cisco client has support for Black Ice and Zone Alarms). The Cisco client can be configured to not install or initialise *unless* the personal firewall is installed/running.

      --audiowhore Parent Share twitter facebook linkedin
      • Re:The main problem with IPSEC... (Score:2) by Junta ( 36770 ) writes: Alter Relationship on Wednesday February 27, 2002 @04:22PM (#3082392) But then, how do you ensure the client is using approved software if you are using a standard like IPSEC? I know, corporate policy, but if people are at home, they might try more exotic things... In any event, clients configured like this are a good way to make IPSEC *better* for telecommuting, but the safest bet is to not have full network transparency, but instead only have selected services that telecommuters need and allow only those in your preferred method of access.. --
        XML is like violence. If it doesn't solve the problem, use more. Parent Share twitter facebook linkedin
  24. CIPE - a better solution. (Score:3, Informative) by ion++ ( 134665 ) writes: Alter Relationship on Wednesday February 27, 2002 @05:18AM (#3078339) I'm using CIPE for linux at work. It can be found at http://sites.inka.de/sites/bigred/devel/cipe.html or for windows at http://cipe-win32.sourceforge.net/.
    It's a better solution because it doesnt run TCP over TCP, which can give a problem, when retransmission occurs. With the right ammount of bad luck, you can have double retransmission where both layers of TCP retransmit. CIPE runs completely over UDP to avoid this problem.

    JonB Share twitter facebook linkedin
    • Re:CIPE - a better solution. (Score:2, Insightful) by ion++ ( 134665 ) writes: Alter Relationship on Wednesday February 27, 2002 @05:22AM (#3078367) Oh yeah, i forgot to mention that it works behind a NAT, which IPSEC has trouble with.
      Further more it works with non-static ip address. Obviously one end needs to know the ip of the other end, but thats all which is needed.

      JonB Parent Share twitter facebook linkedin
      • Re:CIPE - a better solution. (Score:1) by The Darkness ( 33231 ) writes: Alter Relationship on Wednesday February 27, 2002 @06:29AM (#3078878) Homepage Oh yeah, i forgot to mention that it works behind a NAT, which IPSEC has trouble with.
        Junta already posted a valid response to this statement.

        Further more it works with non-static ip address. Obviously one end needs to know the ip of the other end, but thats all which is needed.
        FreeS/WAN works great with non-static IP addresses.

        For example:

        /etc/ipsec.conf

        conn netnet
        left=theirhost.dyn.dhs.org
        leftid=@theirhost.dyn.dhs.org
        leftsubnet=10.1.1.0/24
        right=%defaultroute
        rightid=@myhost.dyn.dhs.org
        rightsubnet=10.1.2.0/24
        leftrsasigkey=....
        rightrsasigkey=....
        authby=rsasig
        auto=start

        And in ipsec.secrets:

        @myhost.dyn.dhs.org : RSA {
        ...
        }

        I have been using a similar configuration since the release of FreeS/WAN v1.5.

        --
        There are two kinds of people: 1) those that need closure Parent Share twitter facebook linkedin
    • Re:CIPE - a better solution. (Score:2, Informative) by Junta ( 36770 ) writes: Alter Relationship on Wednesday February 27, 2002 @05:39AM (#3078494) Better solution than, say, ppp over ssh (a really dumb hack), but not better than IPSEC for most all applications.

      IPSEC also does not run TCP over TCP, it uses udp for isakmp, and data is transmitted through custom protocols (numbers 50 and/or 51), *not* through TCP.

      Another thing about IPSEC that works better than CIPE is that IPSEC more strongly authenticates the machine at the other end. This is why NAT breaks, because unlike CIPE, IPSEC works to ensure the packet has passed unmodified since leaving a known trusted host, and the very nature of NAT prevents this. Solution is simple, move the IPSEC gateway to either the NAT system or beyond. Though it is being pushed in many circles as a good solution for telecommuting, it really was never designed for that and that usage really spits in the face of firewalls.

      Finally, CIPE lacks compatibility. Sure you can configure windows and linux boxes and maybe other platforms, but just try to connect to, say a CISCO router....

      CIPE is a hack that creates more problems than it solves in the long run. PPP over ssh is worse, but a dumb idea, set up tunnels for specific tcp services that you need, more overhead, but security is better (not perfect, but better). For connecting networks together, a good architect can piece together an IPSEC solution that guarantees identity at other end of the pipe... CIPE offers the gaping whole that IPSEC can while not offering enough identification. So ssh or IPSEC remains the best solution, depending on the problem. --
      XML is like violence. If it doesn't solve the problem, use more. Parent Share twitter facebook linkedin
    • Duh, we cover cIPe in the book. (Score:2, Informative) by Brian Hatch ( 523490 ) writes: Alter Relationship <<bri> <at> <ifokr.org>> on Wednesday February 27, 2002 @06:40AM (#3078953) Homepage Journal Ummm, we cover cIPe in the book. Would be a pretty crappy job if we hadn't. Parent Share twitter facebook linkedin
  25. Answer? (Score:3, Funny) by sharkey ( 16670 ) writes: Alter Relationship on Wednesday February 27, 2002 @05:29AM (#3078412) Why does every book need to include the magic 'L' word in the title nowadays?

    Because they have a better chance of getting posted to the Slashdot homepage? --

    --
    "Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next. Share twitter facebook linkedin
  26. Crossplatform aspect? (Score:2, Interesting) by egghat ( 73643 ) writes: Alter Relationship on Wednesday February 27, 2002 @05:51AM (#3078571) Homepage How is the crossplatform aspect covered? There are hundreds of possible solutions for VPNs out there, but if you want something that works on *nix, Windows and Mac (Classic and X) and is free and open, the range of products to choose from gets small ...

    For example, I couldn't find a free IPSEC client for Windows.

    Any new hints from this book?

    Thanks in advance.

    egghat. --
    -- "As a human being I claim the right to be widely inconsistent", John Peel Share twitter facebook linkedin
  27. Semi-OT: any ISPs that route a VPN connection? (Score:1) by Sloppy ( 14984 ) writes: Alter Relationship on Wednesday February 27, 2002 @06:06AM (#3078670) Homepage Journal

    Anyone know of any ISPs (preferably outside USA) that will route stuff coming from a VPN (or any other type of encrypted tunnel) to The Internet? (i.e. from The Internet's point of view, it would be like I was a local user of that ISP, even though I'm physically somewhere else.) Doesn't have to be free beer.

    --
    As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it. Share twitter facebook linkedin
    • Re:Semi-OT: any ISPs that route a VPN connection? (Score:2) by disappear ( 21915 ) writes: Alter Relationship on Wednesday February 27, 2002 @09:42AM (#3080488) Homepage
      Anyone know of any ISPs (preferably outside USA) that will route stuff coming from a VPN (or any other type of encrypted tunnel) to The Internet? (i.e. from The Internet's point of view, it would be like I was a local user of that ISP, even though I'm physically somewhere else.)

      Why would you want to do that? Not only will it slow down your network connection, but I suspect that it should be fairly easy to do traffic analysis to determine which traffic was yours in the first place, even at a busy ISP...

      Parent Share twitter facebook linkedin
  28. Has anybody used isakmpd on Linux (Score:2) by Chang ( 2714 ) writes: Alter Relationship on Wednesday February 27, 2002 @06:06AM (#3078673) Anybody out there have any success compiling and using OpenBSD's isakmpd on Linux?

    I really need to use aggressive mode but the patches for freeswan are ancient/unmaintained.

    A pointer would be greatly appreciated.
    Share twitter facebook linkedin
  29. ssh + ppp = vpn (Score:1) by hopeless case ( 49791 ) writes: Alter Relationship <{christopherlmarshall} {at} {gmail.com}> on Wednesday February 27, 2002 @06:11AM (#3078722) Here's this script I use to setup a quick and dirty VPN between my workstation at work and my home PC. It has to originate from work to get through the firewall but once setup, of course, packets can flow both ways. I call the script ssh-vpn.

    You have to setup ssh correctly with rsa keys before it will work. You also have to download pty-redir. See the VPN mini how-to for more details.

    #!/bin/bash

    REMOTE_HOST=$1
    REMOTE_IP=$2
    LOCAL_IP=$3

    if [ -z "$1" ] || [ -z "$2" ] || [ -z "$3" ] ; then
    echo "usage ssh-vpn "
    exit 1
    fi

    # this file holds the slave pty that the local pppd needs
    tmpfile=/tmp/tmp$$

    # start remote pppd
    /usr/local/bin/pty-redir /usr/bin/ssh -1 -o 'Batchmode yes' -t -l root $REMOTE_HOST /usr/sbin/pppd local ${REMOTE_IP}:${LOCAL_IP} 2> $tmpfile

    # give the remote pppd process a little time to send its first connect request
    sleep 5

    #start local pppd
    /usr/sbin/pppd $(cat $tmpfile) passive

    # remove file that held the slave pty file name
    sleep 5
    rm $tmpfile

    Share twitter facebook linkedin
  30. Right in time. (Score:2) by Bender Unit 22 ( 216955 ) writes: Alter Relationship on Wednesday February 27, 2002 @07:06AM (#3079151) Journal I have just been playing with IPSec for the last couple of days and wanted to buy a book on the subject. While I managed to sucessfully make a VPN connection between 2 machine, I still need to read a great deal about what's under the hood.
    So I looked at amazon also thinking that I could not go wrong with a book from O'Reilly, but after looking at the few stars it got I had been looking at this book and the one from RSA. Well, that does it. I'm getting this one. :)
    Share twitter facebook linkedin
  31. 1 2 Related Links Top of the: day, week, month. next

    Patent on Wireless Transfer of Pupil Data

    27 comments previous

    Piro On Why .Coms Don't Work

    300 comments window._taboola = window._taboola || []; _taboola.push({ mode: 'text-links-a', container: 'taboola-below-article-text-links', placement: 'Below Article Text Links', target_type: 'mix' });
  32. Encryption is One Way to Fight Back by internic · · Score: 1 · on Wired interview with Steinhardt

    While I agree that it is vitial that people contact their representatives with their concerns and support organizations like the ACLU and the EFF, another thing you can do to defy mass survailance efforts like Carnivore is to use encryption whenever possible online. I'm sure there are other /.ers out there who know a lot more about the subject (please speak up!), but I wanted to add what information I can for those who might not already know. Here are a few suggestions of ways I know to use encryption:

    • Email

    • You can encrypt your email communications with others who are also willing to get the right tools. Probably the easies tool is PGP (there's also an international page), or for the free software crowd GPG. PGP makes this pretty easy to use under windows with almost any program with its encrypt clipboard contents feature, but there are also plugins for verious email programs.

    • Terminal Sessions/Telent

    • Most people probably know about it, but there's ssh, openssh, and if you're using Windows check out Tera Term and its ssh extension.

    • Instant Messaging

    • My appologies to the *nix crowd, but I don't yet know much about instant messaging on those platforms (soon); however, if you use windows I have seen several instant messaging clients that support encrypted chatting. I suggest Trillian, which is awsome anyway, free, and has encryption features. As far as *nix goes, I'd check out the big ones (e.g. Jabber) and if it isn't in there by default, look for plugins.

    This certainly doesn't solve all the problems. The biggest is web browsing. You can use anonymous web browsing tools such as Anonymizer, but that is admittedly kind of a pain. I don't have any good suggestions there. I'd be interested in any other ways others have found to incorperate encryption into their online communications.

  33. Re:Question about licenses... by Q*bert · · Score: 2 · on The LDP and Debian
    I'm concerned about the long-term reliability of the software I use, and that depends on the license. Does the copyright belong to a company, such that it might choose to close the software later (as Lutris did with Enhydra)? If the copyright does belong to a company, does the company have a track record of trustworthiness (unlike Lutris)? In the worst case, am I allowed to fork off a version of my own?

    Of course, any product that fails to satisfy that last criterion is neither free software by the FSF definition nor open-source software by the OSI definition. However, there are plenty of packages that claim to be "free" or "open" and in fact are not. (Consider Sun's SCSL, used for Java, or SSH's read-only licenses, used for ssh.)

    In short, the question I ask myself when evaluating a piece of software is "Will this seemingly free software fuck me over in the future?" If I used Debian, I'd have an easy answer to that question, without having to check each package myself.*

    *In fact, I don't use Debian, because I prefer RPM and the BSD ports as package formats, but that's another story.

  34. Re:Securing OpenSSH by gorgon · · Score: 4, Informative · on Slashback: Highness, Hominess, Hole-ines
    Unfortunately, it also blocks all Debian users. At least it looks like somebody *finally* packaged ssh2 for woody
    Uhm, you're kind of confused. The main ssh packages in Debian are:
    • ssh - OpenSSH port of BSD's version of ssh that branched off the last free version of ssh put out by ssh's original developers. It has supported ssh protocol version 2 since roughly August of 2000, and versions supporting ssh2 made it into Debian soon there after. Currently version 3.01p is in Debian, and I think its pretty much equivalent to to the non-free ssh3.
    • ssh-nonfree - non-free version of ssh from its original developers. It only supports ssh protocol version 1.
    • ssh2 - Version of ssh supporting ssh protocol 2 from the makers of ssh-nonfree. License is more restrictive than ssh-nonfree's license.
    • ssh3 - As far as i can tell its not packaged yet. Is the license more restrictive than ssh3? Regardless, there is no ssh protocol version 3.
    Anyway, Debian has had ssh protocol version 2 support for a long time,.
  35. Re:SSH2 and Public Key Authentication by robbyjo · · Score: 1 · on SSH Vulnerability and the Future of SSL

    Note that SSH2 is NOT compatible with SSH1. If you'd like further info: Click here. But it can be made compatible (see caveats).

    Admins, read this PDF document.

  36. Re:It would mean free access... by reverius · · Score: 0 · on Wireless LAN Encryption Standard Broken

    Well, actually, that's not quite correct.
    As for SSH, the founder of SSH corporation was Tatu Ylönen. In 1995. See ssh.com. (I do realize that he probably didn't invent the technology, but this is all I could find...)
    As for VPN's, we all know that Al Gore invented that to go with the internet. :P

  37. Re:But... But... by jamiemccarthy · · Score: 3 · on SSH Secure Shell 3.0.0 Remote Hole
    "But seriously, folks, this just goes to show mistakes can happen to anybody. Open source may be your best protection, but even it's not perfect..."

    Unquestionably true. But, this product appears to only make its source available if you buy the $475 server version. The cheaper workstation version does not come with source. I'm sure too that the licensing terms prohibit free redistribution of the server source, so (unless I'm mistaken) this is not an open source product. It looks like it's closer to what Microsoft calls "Shared Source."

    Jamie McCarthy

  38. Free software for this purpose? by jmerinen · · Score: 3 · on Getting Around the 128-bit WEP Failure?
    I think all of us agree that WEP isn't secure enough to be used as an only encryption method. So that's not the case.

    Is there any free software available for Windows-platforms to handle the encryption? I think that a SSH tunnel would be a nice way to securely read email, transfer files, etc, but the problem is that I haven't found any free and working SSH client for Windows that supports tunneling.

    SSH Secure Shell for Windows is very good and free for private/educational use, but it leaks memory when closing a tunnel, thus local tunnel can be used only certain amount of times until the client hangs. This is very annoying, one can't check POP mail continually because the client hangs in short time.

  39. SSH Trademark: How about some research, people??? by TBBle · · Score: 1 · on Slashback: Reviews, Resources, Pogo

    From http://www.ssh.com/legal/trademarks/

    Additionally, SSH Communications Security has no desire to cause any inconvenience to users or developers who have been accustomed to using the "ssh" command name with our products. Accordingly, we will provide, free of charge, a trademark license to use the term "ssh" as a command name with proper attribution. It is the use of the ssh® trademark in product names or in ways otherwise likely to cause confusion and infringe the ssh® trademark that the company desires to prevent.

    So they don't need to rename the command, just the product name.

    I for one wish Debian had called the package openssh, since I for ages thought the ssh from ssh.com was that good, until I tried ssh-socks and discovered the difference.

    I'm not totally convinced that OpenSSH infringes the trademark of SSH, since it is generally accepted that OpenXXX is a seperate, Open Source version of XXX (Specifically Legal over here in Oz) (eg OpenBSD, OpenDOS)

    But that's generally accepted amongst the sort of people who read Slashdot. Even so, it seems obvious that it's not the same thing, so I worry about people who send OpenSSH problems to SSH.com.

    In short, change the project name (Since the protocol's SecSH) and just relax a bit.


    ====================
    Paul "TBBle" Hampson
  40. Re:YAY! by StenD · · Score: 2 · on Secure Shell Will Remain 'SSH'
    You might want to look a little further back in this before making statements like that, because the reverse is in fact true. SSH was invented by Ylonnen, trademarked by Ylonnen, and released in a freeware version by Ylonnen. AFTER it was released, it was adopted as a standard by the IETF.
    You might want to take your own advice. SSH was invented by released as freeware by Ylonnen, proposed as a standard by Ylonnen (identifying himself as being associated with Helsinki University of Technology), then SSH Communications Security applied for a trademark. Note that, contrary to the claim in the SSH Trademark Q&A, the Internet Draft that Ylonnen submitted to the IETF, and that he included in the SSH distributions as RFC through at least 29 April 1999 (ssh-1.2.27) includes no mention of any assertion of trademark.
  41. Re:So if SSH is in my product name I get sued? by noahm · · Score: 2 · on Secure Shell Will Remain 'SSH'
    So if I create a product and call it, let's say, FrogSSHit, then I am using the SSH trademark. How does OpenSSH differ from FrogSSHit.

    If your product implements a secure remote login capability, then yes, you could get sued. Actually, the way trademark law seem to apply to computers, if your product is at all related to computers you could probably get sued (and lose). Otherwise it's fine. That's why Microsoft isn't about to sue Ford for the "Explorer" or Netscape sue Lincoln for the "Navigator".

    I must be living in the dark but until recently I though SSH was ONLY a protocol. There is a company called SSH, that is news to me.

    I guess you've been living in the dark then. Check out www.ssh.com and their commercial SSH product.

    noah

  42. Seen ssh's webpage? by Otto · · Score: 2 · on Secure Shell Will Remain 'SSH'

    From http://www.ssh.com/legal/trademarks/
    ---
    The ssh® trademark is a significant asset of SSH Communications Security, and the company strives to protect its valuable rights in the SSH brand. SSH Communications Security has invested substantial resources in its ssh® mark, such that its customers have come to recognize that the mark represents SSH Communications Security as the source of the high quality products offered under this brand. This resulting goodwill is vital to SSH Communications Security.

    The SSH Secure Shell remote login product was created in 1995 by Tatu Ylönen, CTO and chairman of the company. Free versions of the Secure Shell remote login software have been distributed under the SSH brand since 1995. The latest version, ssh-2.4.0, is free for any use on the Linux, FreeBSD, NetBSD, and OpenBSD operating systems, as well as for universities and charity organizations, and for personal, hobby, and recreational use by individuals.

    Confusion has become widespread with respect to OpenSSH and its origin. OpenSSH is not a product of, and the OpenSSH group is not, in any way, related to, the SSH Communications Security company.

    The use of the SSH trademark by members of OpenBSD in the OpenSSH project name, products and associated merchandising violates the company's intellectual property rights, and is causing the company, its customers, and its products considerable financial and other damages. The company has requested the OpenSSH group to change the OpenSSH name so as not to infringe on the ssh® trademark, and to prevent further confusion in the industry.

    Similarly, the company is requesting other unauthorized users of the ssh® mark to refrain from infringing our valuable intellectual property rights.

    The company fully supports the IETF Secure Shell working group in its standardization efforts. Any developer may implement the IETF Secure Shell working group standard without requiring any special licenses from the SSH company. SSH Communications Security has always and will continue to support the efforts of all acknowledged standards bodies and the open development of Internet security products, especially for non-profit, education and personal use.

    Recognizing that the phrase "Secure Shell" is well-known within the community to describe the secure remote login protocol developed by Ylönen and SSH Communications Security, SSH has decided to abandon its trademark application for the name "Secure Shell" and dedicate it to public use. When developing and offering products implementing the Secure Shell remote login protocol, developers and integrators may use these words in product names, descriptions, etc., if they wish, without further designation.

    Additionally, SSH Communications Security has no desire to cause any inconvenience to users or developers who have been accustomed to using the "ssh" command name with our products. Accordingly, we will provide, free of charge, a trademark license to use the term "ssh" as a command name with proper attribution. It is the use of the ssh® trademark in product names or in ways otherwise likely to cause confusion and infringe the ssh® trademark that the company desires to prevent.

    All of SSH's products are marketed under the SSH brand name. SSH has become a widely known global brand to identify the company and the origin, quality and security associated with its offerings.

    SSH provides trademark guidelines (PDF, 96 kb) regarding usage and attribution.

    For more information on SSH trademarks, please refer to our Q&A document.
    ---

    Anyway, it sounds to me like he wrote the program years back, then kept the name because it got into such widespread use. Now, they want to be distinguishable. Bunk. If I went and formed a company called "telnet industries" then there is no way I'd be able to get the protocol name changed.

    If they didn't want the confusion regarding names, then they shouldn't have named their company after an existing product/protocol. And he can't claim he didn't know about it either, he wrote the damn thing in the first place!

    Good for the IETF!

    ---

  43. Let all the commercial versions of SSH know by mikehoskins · · Score: 1 · on SSH Claims Trademark Infringement by OpenSSH

    Let all the commercial versions of SSH know that you won't be buying their products until this is dropped: SSH Personally, I planned to buy commercial SSH for my business, especially for Windoze clients to Unix/Linux machines, but now I won't.

  44. You've got the company wrong by kte · · Score: 1 · on SSH Claims Trademark Infringement by OpenSSH

    Tell an entire campus to buy new software from DataFellows because their new clients dont support v1, and all old clients won't support v2. OpenSSH was a blessing to get things to work for everyone.

    You've got the company wrong. DataFellows is nowadays F-Secure, and F-Secure indeed sells SSH products. But Tatu's company is SSH Communications. I prefer SSH Communications' software.

  45. Re:An incongruence on the argument by magi · · Score: 1 · on SSH Claims Trademark Infringement by OpenSSH
    I wouldn't say that SSH is really "loosing money" dramatically. Their last financial review tells that their turnover increased by 138% during the period. Their profits went down to negative (-6Mmk compared to 13Mmk in 1999), because of increased staff expenses (they hired some 100 people apparently to R&D).

    Anyhow, I don't see how this would be relevant. Companies should have equal rights and obligations regardless of their profits.

    Perhaps OpenSSH project could show their kind appreciation to Tatu and SSH Communications by giving it proper credits in their documentation, and perhaps by advertising it as the primary support and service company for secure shell products. Perhaps it would also be good manner to put disclaimer notices on their web pages, making it more explicit that OpenSSH has nothing to do with SSH Communications, if that is Tatu's problem.

  46. Re:I fucking hate it! by bogomipe · · Score: 1 · on Running BIND 4 or 8? Upgrade!
    Why not?

    SSHd is available for W2K. See http://www.ssh.com/.

  47. Seagull Networks www.seagull.net SSH+SCP by goingware · · Score: 2 · on Desperately Seeking Secure and Reliable Email?
    I strongly recommend Seagull Networks at http://www.seagull.net/

    Whenever anyone asks me for a hosting recommendation, I always recommend Seagull.

    No, Seagull is not an ISP. While it would be nice to have a secure ISP, you're better off using any random joker for your ISP, owning your own domain name so you can relocate it in the event your service tanks (I discuss this in Market Yourself - Tips for High-Tech Consultants) and accessing the hosting service via SSH and SCP (secure copy). Note that it does no good to only use SSH - you have to use SCP as well.

    Here's a sample SCP command line, in case you can't figure it out, it's very simple but I had a hard time from the man page:

    scp foo.bar crawford@www.goingware.com:.

    The above places file foo.bar in the home directory of user crawford on www.goingware.com.

    scp crawford@www.goingware.com:web/index.html stash

    This copies index.html from directory "web" on www.goingware.com and places it in directory "stash" on the local machine.

    Please read my web page on Why You Should Use Encryption

    Besides being a good service, it's a small enough company to offer personal service. I've sent support email to the webmaster at 2am his time and had the problem fixed and the mail answered within the hour.

    But even though it's a small service, it's not a low-quality service. They have high-performance machines, they are in a good colo facility with a high-speed connection to the backbone, they upgrade their service regularly and the webmaster, Paul Celestin, is just a damn nice guy.

    I'm not sure if he still publishes it but Celestin used to produce a CDROM full of useful free source code for the Macintosh. Some of my own Mac open-source programs were on it.

    These are the sites I personally have located there:

    In addition, my wife has a couple sites on Seagull through my account, and my friend Andy Hasse used to host http://www.williebrown.com there (yes, if you live in San Francisco you might remember that Hasse was a consultant to mayoral candidate Clint Reilly when the Brown campaign discovered Andy owned the williebrown domain.)

    I have a couple tips for you on checking email. I use PGP when I'm trying to be secure, but it's really not that much that I really care for complete security. But I just don't like people snooping on me, mostly I think it's none of their damn business what's in my mailbox even if it's spam.

    So mostly I read my email at seagull using elm while logged in via SSH, and when my mailbox gets big, I move it to my home directory and copy it to my home machine via SCP:

    goingware$ cp /usr/spool/mail/crawford ~

    goingware$ echo "" /usr/spool/mail/crawford

    back on my home machine:

    C> pscp crawford@www.goingware.com:crawford .

    It is also possible to download your email via POP with SSH via port forwarding. I describe this on the BeOS Tip Server. It doesn't seem to be responding right now but if you go to its search and enter "ssh" you'll find the tip I submitted called something like "Secure email download via ssh". The instructions have some BeOS specific items but most of what's there will work on any systems.

    Don't have SSH? Try one of these:

  48. Re:If only I could SSH by Anonymous Coward · · Score: 0 · on SSH v. SRP

    If you go to www.ssh.com, you can download a beta version of the Windows client. It supports only ssh2 protocol at the moment, though. Release version is coming soon too.

  49. here are the links by Jesus+Christ · · Score: 2 · on SSH v. SRP

    It's not complete, and it's not meant to be.

    Maybe this will help make it more so: homepages for some of the software you discuss.

    Anyone interested in the software mentioned above, or even just general UNIX security, would do good do take a gander at OpenBSD (http://www.openbsd.org). It's based on 4.4 BSD, like most of the Freenixes, and is designed with security foremost in mind. Think of it as FreeBSD after reading "1984". ;-)

    It comes with OpenSSH. And Kerberos.

    Ooh, and also... stickers! Put them on your box, and maybe the MiBs that break into your house while you're at work won't even bother trying to crack yer system.

    Remember: paranoia is good. Anyone with doubts regarding the truth of that statement should check out the Echelon links that have been appearing here lately.

    Ciao.

    I am the Lord.

  50. Re:USe OpenSSH by jpatokal · · Score: 2 · on SSH v. SRP
    I wouldn't trust an SSH binary I didn't compile myself, particularly from an american company the NSA allows to exist.

    You don't have to -- SSH happens to be from Finland. <grin>

    ObURL: http://www.ssh.com/about/company/

    Cheers,
    -j.