Slashdot Mirror

← Back to Stories (view on slashdot.org)

FreeS/WAN Continues As Openswan

Posted by timothy on from the duckling-of-indeterminate-pulchritude dept.

leto writes "It seems some of the developers and volunteers of the (recently deceased) FreeS/WAN project have started a new company to develop and support the successor of the Linux IPsec code under the name of Openswan in a "Cygnus style" business model. They announced the new version at CeBIT which fully supports the new Linux 2.6 native IPsec stack. According to the Openswan website, it was started 'by a few of the developers who were growing frustrated with the politics surrounding the FreeS/WAN project.' There is a FAQ that explains how the various parts of IPsec on Linux work together. I guess that means US citizens can finally submit patches, and that distributions like RedHat/Fedora can now include it in their distribution. FreeS/WAN has always had the most features and most the most user-friendly configuration. It is good to see that will continue. And their mailing list finally seems to refuse spam too."

68 comments

  1. A friendly reminder from your local SCO-chapter by Anonymous Coward · · Score: -1, Offtopic

    WHAT OPERATING SYSTEM DO YOU USE because it has ALL BEEN LOGGED!.

    "ONE LINE OF SOURCE CODE MEANS GUILTY!"

    You had a safe, comfortable middle-class life? No, you thought you had, but you didn't. You are a CRIMINAL, you are GUILTY and you can be EXECUTED.

    You are just another statistic criminal. Do you want YOU and your PARTNER and KIDS to be DRAGGED from your home and SHOT IN THE STREET?

    Is your anus insured for AIDS RAPE?

    Does your life insurance cover FORCED PRISON SEX and AIDS DEATH ? Check the policy - maybe not. Does "your" life-insurance carry a clause in the contract about perverts, convicts and enemies of society JUST LIKE YOU? Why should they insure "SOURCE CODE THIEVES" like you?

    Scociety hates you.

    What are your family going to do when you are jailed for 50 years with no parole? Do you reckon your spouse will hang around for 1 year let alone 50 years before they get lonely and find another partner to love them?

    You can be JAILED and RAPED.

    A great big muscle-bound GAY RAPIST will tie you to the PRISON BARS and RAPE YOUR ASS with his AIDS AND WART-INFESTED PENIS .

    You will be forced to SUCK AIDS INFECTED DICKS . Do you want that?

    SOCIETY SUCKS and you had better get used to it because this is what you can expect when YOUR COMPUTER is EXAMINED FOR EVIDENCE by the "government".

    You will soon learn how "LAWFUL" AND "CORRECT" your government is when you are being raped and the prison guards are looking the other way - or WATCHING or JOINING IN.

    DO YOU WANT TO BE RAPED? WELL, DO YOU?

    Your "government" wants you to be RAPED IN THE ASS and you had better wise up before they get YOUR ass, because they can recover what OS you use LAST YEAR and use it to kidnap you and rape you.

    STOP yourself and your family and kids being kidnapped and raped by criminals.

    Protect yourself - don't be a dirty GNU hippie - BUY A SCO(R) LISENCE(tm) TODAY!.

    NOW ONLY $699, YOU COCK SMOKING TEABAGGERS!!!!!


    This message was generated by the good GOATDOCTOR - Proctologist by Trade (now with 33% more niggardly behaviour!)

  2. Comment removed by account_deleted · · Score: 2, Informative

    Comment removed based on user account deletion

  3. user friendly? by Kryptolus · · Score: 5, Insightful

    I guess you never personally configured it...

    --

    --
    Violators will be prosecuted and prosecutors will be violated.
    1. Re:user friendly? by Anonymous Coward · · Score: 0

      Of course leto has!

      http://freshmeat.net/~letoii/

      He in on the projects, just an ad for his company.

    2. Re:user friendly? by anonymous+coword · · Score: -1

      This gets insightful, while This gets -1! The moderators are smoking fucking crack again, no wait, they are using Debian!

      --
      Nero-burning ROM for Linux!
    3. Re:user friendly? by arivanov · · Score: 4, Insightful

      Ahem.

      The most horrible IPSEC out there. Broken by design, absolutely incompatible with any routing protocol software, broken in operation and utter nightmare to configure and get working.

      One of the things I apploaded most when reading the 2.6 kernel changelogs was the port of KAME IPSEC and utilities. They work (TM). They are missing some features that were in FreeSwan that made it useable as a amateur VPN access point (email ID in shared keys, x509 CRL and a few others), but I do not see these as a reason to revive freeswan instead of fixing the omissions.

      --
      Baker's Law: Misery no longer loves company. Nowadays it insists on it
      http://www.sigsegv.cx/
    4. Re:user friendly? by jamesh · · Score: 2, Interesting

      Openswan works fine with 2.6 ipsec, as did freeswan. With the 2.6 Kernel, openswan just does isakmp and then tells the kernel what to do. imho, openswan is more flexible than any of the other isakmp implementations i've seen available for linux.

      For certain values of 'nice', one of the nice things about klips was that there was a virtual interface for the decrypted traffic. Stuff for encryption went out ipsecN, then the encrypted packet (proto 50/51) went out the real interface. Made firewalling and routing easier, or harder, depending on how you like to do things. But you could instantly say 'accept encrypted traffic on tcp/123' without having to muck around with firewall marks etc.

      btw, you can get a 2.4 linux kernel with 2.6 ipsec backported, if you don't like klips. Debian does this.

    5. Re:user friendly? by Shoten · · Score: 1

      Don't forget about the arrogance one encountered when asking for help, either. I've sucked up and dealt with some amazing Napoleonic complexes when using software before, but these guys were such bastards I actually chose a commercial solution over them in the end. I draw the line at accepting condescending remarks from people who don't know how to keep a listserv running properly while failing to address the question asked of them.

      --

      For your security, this post has been encrypted with ROT-13, twice.
    6. Re:user friendly? by Jacco+de+Leeuw · · Score: 1

      I disagree. The support mailinglist has been great. For instance, FreeS/WAN team member Sam Sgro provided commercial quality support. One issue is that they deliberately did not filter for viruses and spam. But other filtered mailinglists sprung up so that was not really an issue.

      --
      -------
      Warning: Slashdot may contain traces of nuts.
    7. Re:user friendly? by arivanov · · Score: 2, Informative
      For certain values of 'nice', one of the nice things about klips was that there was a virtual interface for the decrypted traffic.

      Nice for manual kludge on a small office VPN setups - agree 100%.

      Absolutely disagree for a larger network with dynamic routing. For any network with these it was THE NIGHTMARE DESIGN (TM). Reason is that nearly any routing protocol carries either IP or IP/NETMASK information and no interface information (neither name, nor ifIndex). It is obvious that in the presence of two interfaces with exactly the same netmasks and ip addresses the information content of a routing protocol becomes highly ambigous. This is something BSDs have got right - they define a separate address family for IPSEC and handle it completely separately. As a result you can happily use them both.

      --
      Baker's Law: Misery no longer loves company. Nowadays it insists on it
      http://www.sigsegv.cx/
  4. The HATE WINDOWS Campaign Celebrates! by Anonymous Coward · · Score: -1, Offtopic

    windows (452268) is hated by no one?!

    It is your duty as a Slashdot reader to officially and formally hate windows. Slashdot is impure until windows' freaks outnumber it's fans! Strike down this vile evil corporate monster today! Show it how much you hate it. Do Slashdot a favor and bloat windows' freaks list!

    Celebrate Our Success!

    Our founder, users.pl, has enjoyed great success in persuading brave moderators to promote our cause. Both posts were modded back to -1 in short order, but make sure you metamod our positive moderations as fair and the negative moderations as unfair! Do not let our brave supporters' efforts be shot down by windows loving Nazis!

    users.pl has gained public support in other areas as well, gaining nearly unanimous moderator support in a posting promoting the benefits of open source. Waves of people have already joined our cause causing windows' freaks list to inflate rapidly.

    In response to our onslaught, windows has posted a frantic and angry journal entry criticizing no less than all of Slashdot for it's open source zealotry and has begun a poll with misleading links to try and trick you into voting for him! Surely, as faithful readers of Slashdot and loving supporters of open source you will not let this blasphemy continue! Make windows your foe and vote for users.pl today! Every Slashdot account and every IP counts!

  5. Man this stories fucking boring... by SimianOverlord · · Score: -1

    Did you ever wonder what the hell was going on at the end of X-men 2?
    Why did Jean Grey climb out of the ship to stop the tidal wave of water from the dam. If she's telekinetic, why couldn't she do it from in the ship? Why didn't she just lift the ship above the water?

    How come Iceman didn't create a wall of ice to protect them? Or cyclops shot big red bolts of energy to vaporise the oncoming flood. Xaviar can move stuff telekinetically, why didn't he help? It just makes no sense whatsoever.

    --
    Meine Schwester ist sehr, sehr reizvoll - Nietzsche
    1. Re:Man this stories fucking boring... by Anonymous Coward · · Score: -1, Offtopic

      That is something to mull over, but I got some bigger ones that EVEN GOOGLE CANT ANSWER. In fact,
      these are the questions I used to kill my AI robot guards with logic failures when I escaped from Krasus.

      What is a 6ft wookie doing on a planet full of 3ft ewoks?

      And furthermore, was it *really* a planet or a planetoid?

      And for that matter is the deathstar held in a spherical shape by the force of it's own gravity?

      Maybe your ill-spent youth reading slashdot will come in handy one day. And maybe you will be found dead (by-pizza choking no less) with a smile on your face having solved the riddle no man can; 1/16th sized first edition starwars figurines arranged before you. Who knows, the net is vast and infinite.

    2. Re:Man this stories fucking boring... by Anonymous Coward · · Score: -1, Offtopic

      Jean simply isn't powerful enough to lift the ship that quickly. It appears that creating a defensive shell (projecting force in a direction indiscriminately) is easier than levitating objects. Jean had to get out because projecting her power through a wall requires greater concentration. Simply exerting force in a direction is easy, but ensuring that force starts beyond the hull of the ship creates a greater strain, and reduces her ability to stop the tidal wave.

      Iceman's story is different. He didn't create a wall of ice because he's a useless fag that will never come close to realizing the full potential of his powers. I wouldn't count on him to do anything more critical than filling an ice cube tray.

      Cyclops' bolts hit with enormous force, but they don't produce heat directly. The heat caused by friction wouldn't be enough to slow down the flood.

      Xavier's powers are primarily telepathic, the telekinetic component is secondary and limited.

      Now, if they were smart, they would've had Nightcrawler teleport them all to safety.

    3. Re:Man this stories fucking boring... by Anonymous Coward · · Score: -1, Offtopic

      What is a 6ft wookie doing on a planet full of 3ft ewoks?

      Having dinner.

      And furthermore, was it *really* a planet or a planetoid?

      Like anybody cares, let alone people in a galaxy far, far away. go read the latest Pluto|Sedna story.

      And for that matter is the deathstar held in a spherical shape by the force of it's own gravity?

      It was designed and built to be spherical and its internal construction provides structural integrity, but the spherical form minimizes the stress gravity places on the structure and provides the greatest efficiency.

      Maybe your ill-spent youth reading slashdot will come in handy one day. And maybe you will be found dead (by-pizza choking no less) with a smile on your face having solved the riddle no man can; 1/16th sized first edition starwars figurines arranged before you. Who knows, the net is vast and infinite.

      Yeah, that'll be the day, when this comes in handy. ha ha. I only use the large 1/8 sized doll-type (with cloth clothing) action figures, so your prediction of death shall not come to pass. Not exactly, anyway.

    4. Re:Man this stories fucking boring... by Anonymous Coward · · Score: -1, Troll

      You might try to change the subject, Singer stooge, but the problems remain. If you listen to the DVD commentry of Xmen 2 the director admits he decided to kill Jean Grey half way through the shooting of the film. No wonder the ending is so half-assed.

      Yes, the many problems I have outlined to this date remain unanswered. E-mails to the director, producer, stars and distributer have been ignored. Many, many posts to various online forums, while attracting ad hominem attacks, have resulted in no adequate explanation of this perplexing mystery.

      The real mystery is why anyone accepted the original story in the first place, way back when they saw it in the cinema. Why weren't they screaming? Why did they not demand their money back? They had just spent a considerable sum of money and 2 hours of their precious, finite lifespan only to be confronted in the end with a throwaway afterthought of ill concieved nonsense.

      Was Verbal Kint even Keyser Soze? In my opinion the end of the film only shows that the story told to Agent Kuyan was made up on the spot. And why is anyone surprised that a confidence trickster would feign an illness? The fax - well the Hungarian saw Verbal after all, he was there at the boat wasn't he? Doesn't mean he's Keyser Soze - and a bullshit ID by a burnt Hungarian, well a public defender could get you out of that one.

      Bryan Singer's MO is to make stylish films with bullshit, invalidate-the-whole-rest-of-the-movie endings.

    5. Re:Man this stories fucking boring... by Anonymous Coward · · Score: -1, Offtopic

      Jean simply isn't powerful enough to lift the ship that quickly. It appears that creating a defensive shell (projecting force in a direction indiscriminately) is easier than levitating objects. Jean had to get out because projecting her power through a wall requires greater concentration. Simply exerting force in a direction is easy, but ensuring that force starts beyond the hull of the ship creates a greater strain, and reduces her ability to stop the tidal wave.

      Couldn't she have hopped up on the ship? You can't tell me lifting an object through directing a force under it is more difficult than redirecting the force of hundreds of tons of water. It won't wash. I doubt the Xmobile weighed more than a dam full of water.

      Iceman's story is different. He didn't create a wall of ice because he's a useless fag that will never come close to realizing the full potential of his powers. I wouldn't count on him to do anything more critical than filling an ice cube tray.

      Very true. Iceman is clearly a gay who shouldn't be trusted to do more than look after the X Academy tuck shop. But Iceman, Xaviar and Cyclops, working together might have combined their puny powers to take some of the pressure off of Grey.

      Now, if they were smart, they would've had Nightcrawler teleport them all to safety.

      There wasn't enough time. Now if Rogue had borrowed Night Crawlers powers so there was two of them, then they could have teleported them all away. Hell, she could have done the same with Grey. She could also have kissed Jean Grey so the two of them could both lift the ship, locked in a passionate embrace with tongues. Now that would be a shit hot ending.

    6. Re:Man this stories fucking boring... by Anonymous Coward · · Score: -1, Offtopic

      Troll? TROLL??

      Do any of you mods even know what it means? Do any of you total morons even know what insightful is? I used to think the moderation system was so fucked up because the majority of those with mod points were sheeplike LINUX:DOUBLEPLUSGOOD, WINDOWS:UNGOOD idiots but now I see I overestimated you. You don't even know the meaning of the terms that you use to moderate.

      I knew that the majority of users and hence moderators were US in origin, and I further knew that your lamentable education system produced a good crop of the half witted, but this is the living proof. Get educated before you moderate, you acephalous cretins.

      The only way the parent could possibly have been a troll was if you had watched "The Usual Suspects" and knew I was bullshitting. What, are you Bryan Singer himself? Did you just not understand the reference? If you did not, what the hell are you moderating the comment for? How can you accurately judge the worth of a post if you don't even understand it. Do us all a favour and check the "I do not wish to moderate" box under preferences. Alternatively, stick to "fp" moderations - you aren't sufficiently intelligent to moderate anything else.

    7. Re:Man this stories fucking boring... by Anonymous Coward · · Score: 0

      Agreed. This is why we need to replace "interesting" with +1 Sexy, among other things.

  6. fucking sand niggers by Anonymous Coward · · Score: -1, Flamebait

    As a good, christian, American patriot, I hate niggers in all forms, including sand-niggers, and Israel would be fully justified in going nazi on those camel humpers!

    1. Re:fucking sand niggers by Anonymous Coward · · Score: -1, Troll

      lol

    2. Re:fucking sand niggers by Anonymous Coward · · Score: -1, Offtopic

      Israelis are sand niggers too!

  7. Not the only IPSec stack by The-Pheon · · Score: 5, Interesting

    Don't forget about KAME. It isn't just for IPv6, and also supports IPSec for both ipv4 and ipv6.

    1. Re:Not the only IPSec stack by Anonymous Coward · · Score: 5, Informative

      Yes, and it's under a very liberal license too.
      Even better, it is VERY portable, which means that as an administrator you just have to care to know about KAME and not a gazillion halfbaked inconsistent implementations.

    2. Re:Not the only IPSec stack by Anonymous Coward · · Score: -1, Troll

      the rules of naming groups are;

      google first

      check profanities

      future proof

      they failed on the last two - wearable computing + their name = KAME in my pants

  8. Problems with OpenSwan by MooKore+2004 · · Score: -1, Troll
    I am a Linux Certified network consultant. I as the security manager of a new network, had to install OpenSwan to provide secure network services to my clients. The problems were many.
    • Network overhead increased by 40%
    • Router MTBF increased by 50%
    • Adminstration costs increased by 70%
    We eventually dropped Openswan and fired the linux zealot who recommended it to us. We chose the MTSEC security from Bizland Consultants inc instead, and it saved us over 700%! So, don't choose swan without trying MTSEC first!
    --
    found here
    1. Re:Problems with OpenSwan by Anonymous Coward · · Score: -1, Flamebait

      Argh, you bastard, just reading your post made my IQ drop by at least 20 points.

    2. Re:Problems with OpenSwan by SimianOverlord · · Score: -1

      I never realised you could actually have a negative IQ.

      --
      Meine Schwester ist sehr, sehr reizvoll - Nietzsche
    3. Re:Problems with OpenSwan by mwood · · Score: 1

      "Router MTBF increased by 50%"

      So, at least something improved. :-)

  9. At Lazt ... by AftanGustur · · Score: 5, Funny


    I guess that means US citizens can finally submit patches, and that distributions like RedHat/Fedora can now include it in their distribution.

    Ahh, u mean ze citisenz of ze USA can finally have ze same freedom as ze French Bastardz have had for yearz ?

    --
    echo '[q]sa[ln0=aln80~Psnlbx]16isb572CCB9AE9DB03273snlbxq' |dc
    1. Re:At Lazt ... by Anonymous Coward · · Score: -1, Offtopic

      no need for pigeon talk... use proper english... it is after all the "lingua franca" now.. muahahaha

      thankyou, I'll be here all night

    2. Re:At Lazt ... by /dev/trash · · Score: 0, Offtopic

      France? Has freedoms? Care to discuss Nazi's and the like on a french based website?

    3. Re:At Lazt ... by Odin's+Raven · · Score: 3, Funny
      ...ze French Bastardz...

      Excuse me, but here in the US the politically-correct term is Freedom Bastardz. ;-)

      --
      A marriage is always made up of two people who are prepared to swear that only the other one snores.
    4. Re:At Lazt ... by AftanGustur · · Score: 1


      France? Has freedoms? Care to discuss Nazi's and the like on a french based website?

      Although I agree with you that banning discussions about a topic is not the best way, the French view is that the Nazi ideology is so far off, that it's simply off-topic..

      Like if you would put up a site anywhere in the world about the pros, cons and pleasures of Phedophily. I'm pretty sure it wouldn't stay up very long.

      Or, try to put up a website in the USA, that justifies the 3000 dead in the twin towers ...
      You would be lucky not to be killed...

      And that's just the internet.. Try to show some French commercials on American TV and they would be X-rated for nudity..

      Think about it, normal breasts and legs.... And The first thing that pops into the mind of Americans is "Porn", "Sex" and "Censorship" ..

      --
      echo '[q]sa[ln0=aln80~Psnlbx]16isb572CCB9AE9DB03273snlbxq' |dc
  10. Problems with OpenSwan by Anonymous Coward · · Score: -1, Troll
    I am a FreeBSD Certified network consultant. I as the security manager of a new network, had to install OpenSwan to provide secure network services to my clients. The problems were many.
    • Network overhead increased by 90%
    • Router MTBF increased by 150%
    • Adminstration costs increased by 770% (even after outsourcing to india!)
    We eventually dropped Openswan and fired the linux zealot who recommended it to us. We chose the Hell-O security from Hi Consultants and Kommunications inc instead, and it saved us over 700%! So, don't choose swan without trying Hell-O first!
  11. Debian packages now avalible for freeswan by Anonymous Coward · · Score: 0, Informative

    Yes, it works with Debian! This debian certified package is avalible for alpha, arm, i386, ia64, m68k, mipsel, and G5 (unoffically).

    So download it today!

    1. Re:Debian packages now avalible for freeswan by arivanov · · Score: 3, Informative

      As someone who have had to deal with this minor horror (on debian actually) I would not call that works. Works from time to time and very sporadically usually in tunnel mode. There was only one release which had transport mode working correctly and ineroperating versus both BSD and Windoze. All other either failed completely or did not rekey correctly.

      --
      Baker's Law: Misery no longer loves company. Nowadays it insists on it
      http://www.sigsegv.cx/
    2. Re:Debian packages now avalible for freeswan by Anonymous Coward · · Score: 0

      somebody please mod the parent down. it links to some gay picture.

    3. Re:Debian packages now avalible for freeswan by Bi()hazard · · Score: 3, Interesting

      There's a discussion about which type of linux is best for running it here on the mailing list. They like both Debian and SuSe.

      That said, it should work well enough on most things-from their site, "Standards Compliant: Openswan conforms to nearly all IPsec + IKE RFCs, and has one of the based interoperability track records of any IPsec implementation. It is compatible with products from Microsoft, Cisco, Nortel, Netscreen, Checkpoint, and many others vendors."
      And "Platforms: x86, IA64, PPC, PPC64, MIPS, Alpha, StrongArm"

      Openswan should work for just about anyone who isn't satisfied with KAME or Racoon (though it might be hard to set up, see this thread...

      The front page summary makes it sound like the company they're starting exists solely for openswan, but it's worth noting Xelerance is producing some other stuff including freeRadius, think about your breathing-you have to manually control your breathing or suffocate, DNSSec, and Asterisk. The changeover will likely mean an increase in the quality of support available for (paying) swan users, since they provide an array of consulting services.

      That also gives them an incentive to spread adoption. Unlike FreeS/WAN-one of the problems with FreeS/WAN was that it would not work with low-bit encryption. This was done to promote their political goal. But it also had the side effect of inhibiting adoption at the places where for whatever reason people had to interoperate with low-bit encryption applications or setups. According to their FAQ, "As we see it, it is more important to deliver real security than to comply with a standard which has been subverted into allowing use of inadequate methods." For example, they went out of their way to avoid allowing any handling of single DES.

      And if you've got any more questions about openswan, the guy to ask is on slashdot with user id #11! He'll probably be posting in here when it's morning in that part of the world.

      Who would win? Flying Shark or Flying Croc?? Croc all the way, fools!

    4. Re:Debian packages now avalible for freeswan by velkro · · Score: 1

      >And if you've got any more questions about openswan, the guy to ask is on slashdot with user id #11! He'll probably be posting in here when it's morning in that part of the world.

      Yup, I'm in EST, so it's morning now. Imagine my surprise with a 5.6mbit /. for a wakeup call!

  12. WHy is this marked YRO? by Anonymous Coward · · Score: 0

    Does open source now automatically mean YRO? Does security mean YRO, even when it's not homeland security? How do the editors make these decisions^H^H^H. . .^H^HWhat are the editors smoking?

  13. Talk about lacking in content by pinkUZI · · Score: 3, Interesting

    There was more content in the article on slashdot than on the entire Openswan website!

    --
    You are receiving this message because your browser supports Slashdot Sigs and you have Slashdot Sigs enabled.
  14. Re:no but maybe the better one... by pacman+on+prozac · · Score: 5, Informative

    The problem with KAME is that IPSec packets between two hosts can bypass the packet filters.

    That is, with KAME on Linux and FreeBSD, packets are not decrypted until after iptables/ipfw has looked at them. That means you cannot packet filter on anything other than IP & MAC Address as you can't read anything else, its all encrypted :)

    Apparently FreeS/WAN had a separate device to read from that gave unencrypted packets for filtering.

    This only applies to transport IPSec between two complete hosts. You can use tunnel mode onto a tun device and filter from that, and you can also just encrypt traffic based on port.

    Either way, I'm kind of relieved that FreeS/WAN has not gone completely and that the above situation still has a fix. A security protocol seems kinda useless when it allows firewall bypassing, especially when it could happen automatically if you have IKE setup and open to the world.

  15. The problem with Open/Free/Swan by 1337+Apple+Zealot · · Score: -1

    Is that it can't run on Xserves. Not even when Linux is on the xserve, the problem is that Apple uses a propreitery TCP stack in its servers, and must written in apple golden cocoa APIs, which cost 5,000 per developers. It makes me so mad that the Xserve has only a few network applications that cost thousands. I may still use Apple for my G5, but after I discovred this scandal I switched to x86 racks with Linux for my IPSEC and network needs!

    So I am a full Swan supporter, and I urge you to trash your XSERVES as soon as possible!

    --
    Screenshot of My G5 desktop!
  16. Strongswan by gvdkamp · · Score: 5, Informative

    There is yet another project. Andreas Steffen (Creator and maintainer of the X509 patches for FreeS/WAN) has started its own version as well. Check out www.strongswan.org for differences between openswan and strongswan.

  17. 2.6 IPsec still problematic by valentyn · · Score: 4, Interesting

    I've been testing with 2.6 IPsec, but I'm not convinced that it's production ready. Especially the MTU handling gives me the creeps:

    valentijn:~# ping -s 1435 host21
    PING host21.wireless.palmgracht.nl (10.15.67.21): 1435 data bytes
    ping: sendto: Message too long
    ping: wrote host21.wireless.palmgracht.nl 1443 chars, ret=-1
    ping: sendto: Message too long
    ping: wrote host21.wireless.palmgracht.nl 1443 chars, ret=-1

    Resetting the MTU on the network interface helps:

    valentijn:~# ifconfig eth1 mtu 1400
    valentijn:~# ping -s 1417 host21
    PING host21.wireless.palmgracht.nl (10.15.67.21): 1417 data bytes
    1425 bytes from 10.15.67.21: icmp_seq=0 ttl=64 time=93.0 ms
    1425 bytes from 10.15.67.21: icmp_seq=1 ttl=64 time=78.2 ms

    Then, resetting it to 1500 again does this:
    valentijn:~# ifconfig eth1 mtu 1500
    valentijn:~# ping -s 1435 host21
    PING host21.wireless.palmgracht.nl (10.15.67.21): 1435 data bytes
    ping: sendto: Message too long
    ping: wrote host21.wireless.palmgracht.nl 1443 chars, ret=-1
    1443 bytes from 10.15.67.21: icmp_seq=1 ttl=64 time=89.0 ms

    So only the first packet is blocked, after that the kernel adjusts to the right MTU. And please note: this is internally, the first packet doesn't leave the machine.

    I had no time to test further, but what I found so far doesn't encourage me a lot to use 2.6 IPsec in production.

    --
    my other sig is a 500 page novel
    1. Re:2.6 IPsec still problematic by Anonymous Coward · · Score: 0

      And what was KAME's response when you reported this bug?

      What, you didn't do that?

    2. Re:2.6 IPsec still problematic by sachar · · Score: 2, Informative

      Strange I've implemented kame yesterday on a 2.6.4 kernel and just tested this and have no problems what so ever. The ping times are a bit higher (3 ms on a local 100mbit network), but no error messages.

    3. Re:2.6 IPsec still problematic by valentyn · · Score: 2, Informative

      Ping the host (with large IP) without IPsec, then activate IPsec and ping again. Now as you've seen, the 2.6 kernel accomodates to the new MTU size. The bad thing is that the 2.4 backport of the 2.6 IPsec doesn't do that, which results in "too large" messages but no traffic.

      I've seen NFS mounts come to a grinding halt because of this.

      My setup is special in the sense that a 2.6 machine in between runs two tunnels: one to my office, one to a WiFi host (with a 2.4 kernel). I haven't found time yet to test a setup where the workstation runs 2.6 as well.

      --
      my other sig is a 500 page novel
  18. Re:no but maybe the better one... by arivanov · · Score: 4, Informative
    That means you cannot packet filter on anything other than IP & MAC Address as you can't read anything else, its all encrypted

    Used to be correct as of ipfw 1. No longer the case as of ipfw2, though some cases do not work fully yet. See the ipsec qualifier for rules.

    Dunno about Linux though. I use KAME extensively only on BSD.

    --
    Baker's Law: Misery no longer loves company. Nowadays it insists on it
    http://www.sigsegv.cx/
  19. MOD DOWN! contains gay porn by 1337+Apple+Zealot · · Score: -1

    The G5 link (which I clicked on because I use one) contains gay porn, so does the today link! Please mod this FILTH down!

    --
    Screenshot of My G5 desktop!
  20. corepirate nazi softwar gangsters continue.... by Anonymous Coward · · Score: -1, Offtopic

    'business' as use-you-all.

    what a surprise?

    9-Feb-04 GATES, WILLIAM H. III
    Chairman 1,063,273 Sale at $27.03 - $27.151 per share. $28,805,0002
    9-Feb-04 GATES, WILLIAM H. III
    Chairman 1,936,727 Sale at $26.88 - $27.025 per share. $52,200,0002
    6-Feb-04 GATES, WILLIAM H. III
    Chairman 3,000,000 Sale at $27 - $27.17 per share. $81,255,0002
    6-Feb-04 CASH, JAMES I. JR
    Director 200 Sale at $27.08 per share. $5,416
    6-Feb-04 GATES, WILLIAM H.
    Chairman 3,000,000 Planned Sale $80,880,0001
    5-Feb-04 GATES, WILLIAM H. III
    Chairman 3,000,000 Planned Sale $81,030,0001
    5-Feb-04 GATES, WILLIAM H. III
    Chairman 3,000,000 Sale at $26.89 - $27.12 per share. $81,015,0002
    4-Feb-04 GATES, WILLIAM H. III
    Chairman 898,265 Sale at $27.18 - $27.41 per share. $24,518,0002
    4-Feb-04 GATES, WILLIAM H. III
    Chairman 1,417,668 Sale at $27.09 - $27.177 per share. $38,466,0002
    4-Feb-04 GATES, WILLIAM H. III
    Chairman 684,067 Sale at $27.02 - $27.085 per share. $18,506,0002
    4-Feb-04 GATES, WILLIAM H. III
    Chairman 3,000,000 Planned Sale $81,870,0001
    3-Feb-04 GATES, WILLIAM H. III
    Chairman 2,000,000 Sale at $27.22 - $27.41 per share. $54,630,0002
    3-Feb-04 GATES, WILLIAM H. III
    Chairman 2,000,000 Planned Sale $54,800,0001
    2-Feb-04 GATES, WILLIAM H. III
    Chairman 3,000,000 Sale at $27.30 - $27.77 per share. $82,605,0002
    2-Feb-04 SHIRLEY, JON A.
    Director 120,000 Automatic Sale at $27.50 - $27.55 per share. $3,303,0002
    2-Feb-04 GATES, WILLIAM H. III
    Chairman 1,000,000 Planned Sale $27,650,0001
    29-Jan-04 MARQUARDT, DAVID F.
    Director 100,000 Sale at $27.65 per share. $2,765,000
    29-Jan-04 GATES, WILLIAM H. III
    Chairman 1,000,000 Sale at $27.69 - $27.93 per share. $27,810,0002
    28-Jan-04 GATES, WILLIAM H. III
    Chairman 1,000,000 Planned Sale $28,250,0001
    28-Jan-04 GATES, WILLIAM H. III
    Chairman 1,000,000 Sale at $28.01 - $28.4 per share. $28,205,0002

  21. fcuken gay by Anonymous Coward · · Score: -1, Troll

    slashdot is shit

  22. But by Anonymous Coward · · Score: -1, Flamebait

    will it run linux?

  23. Plz Mod Parent DOWN by bangular · · Score: 0, Troll

    I don't know how a post that has a pic of a man about to eat another mans ass with a giant fork got modded up. This one has to go down in slashdot history. Nice use of debian redirect cgi though, I was actually expecting a debian package page.

  24. Swansong by Alain+Williams · · Score: 2, Funny

    So that earlier noise about it closing was not it's SwanSong after all.

    1. Re:Swansong by Jon_E · · Score: 1

      It was for that other FreeBird (with apologies to Lynyrd Skynyrd and the late VanZant)

      "If I leave here tomorrow,
      will you still remember OE?"
      [*groan*]

  25. Free Swan?! by Anonymous Coward · · Score: 0

    that redhead is freakin HOT!

  26. apploaded by Anonymous Coward · · Score: 0

    We applauded when the apploaded

    or is it?

    app + exploded = apploaded

  27. openvpn by Anonymous Coward · · Score: 0

    From what I've seen, ipsec is FAR too complicated. It's too low level, it screws up routing.

    It looks to me that openvpn is MUCH simpler, and just as useful. I think ipsec should die.

  28. Does It Support Single DES? by Glug · · Score: 1

    If it wants to interoperate with any IPSec implementation other than itself, it will need to support negotiation through single DES (even if the tunnel doesn't wind up using it).

    Refusal to support single DES was what made FreeS/WAN virtually useless, even for those who muddled through the endpoint configurations and could put up with ip:port combos occasionally being hung out to dry due to dropped connects until the next rekey.

  29. Opportunistic Encryption? by SiliconEntity · · Score: 2, Interesting

    Ironically, the original goal of FreeS/WAN was not support of VPNs. It was to implement John "Suspected Terrorist" Gilmore's goal of "encrypting 5% of the Internet by Christmas". The idea was that if two systems went to talk to each other with an ordinary net connection, and both happened to be running FreeS/WAN or compatible software, they would automatically and transparently negotiate IPSec encryption and use that for the connection. This is what they called Opportunistic Encryption. The goal of the project was to get some substantial fraction of internet traffic to be encrypted by this mechanism, thereby increasing privacy and decreasing the effectiveness of net-wide surveillance and monitoring tools.

    Sounds like a good idea to me. Are either of these new FreeS/WAN offshoots, or any other comparable project, trying to achieve Opportunistic Encryption? Or are they just for VPNs?

  30. 700% savings? by Ungrounded+Lightning · · Score: 1

    We chose the MTSEC security from Bizland Consultants inc instead, and it saved us over 700%

    I see.

    Not only did your maintainence budget go to zero but Bizland Consultants paid YOU six times your former budget.

    Where do I sign up for THAT deal? B-)

    = = = =

    On second thought, forget it. TANSTAFFL, so they must be getting something from you that's worth even more.

    --
    Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
  31. Yes, Opportunistic Encryption? by billstewart · · Score: 2, Informative
    OE is still one of the goals; VPNs have been easy for a few years. One problem has been that their method for doing OE requires Reverse DNS support for DNSSEC, which makes it impractical for most potential users. In some sense it's still the Right Thing to do, because an IPSEC gateway only has a source and destination IP address to work from and needs some method for getting authentication keying information to prevent man-in-the-middle attacks, so it either needs Reverse DNSSEC or something very much like it, and preventing MITM is the Right Thing To Do.

    If Gilmore was willing to risk MITM attacks in return for protecting a much higher fraction of the network users from passive eavesdroppers, the alternative was to use "shared secret" mode with a publicly known "secret", such as "open secret" or something proposed in a draft rfc. But that would have meant that the people who most needed OE would be using a method that wasn't secure against governments or motivated crackers, and a false sense of security is arguably much more dangerous than known insecurity - if you know you're not secure, you're forced to use PGP to encrypt your email instead.

    --

    Bill Stewart
    New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
  32. "Cygnus style" business model by RedPhoenix · · Score: 1

    Or, based on the fact that this project is an offspring of freeswan, should that be "Cygnet style" ? ;) ... ok, back in my box.

    Red.

  33. Follow the BSDs by Anonymous Coward · · Score: 0

    FreeS/WAN and now OpenSwan.....

    is NetS/WAN next?

    1. Re:Follow the BSDs by DA-MAN · · Score: 1

      You must have forgot about 386 S/WAN 4.4-Lite to which FreeS/WAN was based upon.

      --
      Can I get an eye poke?
      Dog House Forum
  34. Re:Opportunistic Encryption - on by default by jimboid · · Score: 1

    In Openswan OE is on by default and you have to edit your config file to turn it off. Fortunately - it's easy to disable.