Slashdot Mirror

← Back to Stories (view on slashdot.org)

Novell-SUSE Sponsors Openswan

Posted by timothy on from the they're-building-a-behemoth dept.

hsjones writes "Concerned about the demise of FreeS/WAN? Well, looks like Openswan is going to be a good, strong open source IPsec project going forward. Novell and SUSE have jumped in with Astaro to back the project and move it along. See the press release. The Openswan project is at http://www.openswan.org. SUSE Linux and Astaro Security Linux both use FreeS/WAN in their current releases. It will be very interesting to watch what they do now with Openswan!"

132 comments

  1. Shampoo is better, no, conditioner is better by UnCivil+Liberty · · Score: 3, Funny

    Stop looking at me Swan!

    --
    Distributed proteome folding @ WorldCommunityGrid.org
    Team Slashdot - Members:#1 Run Time:#1 Points:#1 Results:#1
    1. Re:Shampoo is better, no, conditioner is better by Anonymous Coward · · Score: 0

      I hope the joke explaining troll comes along and works his magic on this one.

    2. Re:Shampoo is better, no, conditioner is better by Anonymous Coward · · Score: 0

      Remeber that Billy Madison also saw penguins when he was drunk.

      Who knew that Adam Sandler was a Linux user?

    3. Re:Shampoo is better, no, conditioner is better by swordsaintzero · · Score: 2, Funny

      its an adam sandler movie reference. I forget which one does it really matter? (removes hook from mouth after being reeled in)

      --
      Panel F, Relay #70
  2. Somewhat off-topic by coupland · · Score: 5, Informative

    Building on its contributions to the open source community and commitment to interoperability

    As one of many people who vividly remembers the success of NetWare 3.x, the current situation seems very alien. Novell virtually died when the fact of the matter is their product was by far the best. Today they have good products, yet they really can't claim an enormous technological edge. Their second coming is, instead, based on commitment to a thriving community, and feeds off anti-Microsoft sentiment. If best-of-breed products didn't work, will this perhaps be the strategy that finally works for them? I don't know, but I certainly wouldn't complain to see Novell take back a sizeable bite of the business that was stolen from them.

    1. Re:Somewhat off-topic by wolfdvh · · Score: 3, Insightful
      I don't know, but I certainly wouldn't complain to see Novell take back a sizeable bite of the business that was stolen from them.

      It was not stolen from them, they gave it away. They lost market share with arrogance and poor support that at the time made Micro$oft seem a breath of fresh air. Their support devolved to where didn't want to even talk to you if you weren't a CNE. The whole certification racket they pioneered was a brilliant stratagem. It got people to pay Novell for the privilege of doing their technical support for them. It was so successful that Microsoft later copied it.

      Novell's near ruin was largely the result of thinking that a 90% market share makes you unaccountable to you customers. The ash heap of the industry is littered with companies, Digital Research (CP/M), Lotus, Ashton-Tate (dBase), WordStar, who made that same mistake.

      I know that all those old players are gone and only the name is the same, but I was struck with real pangs of apprehension when I heard they were buying SuSE. It was the irrational fear that they would do to SuSE what they did to WordPerfect.

      Legally, a corporation is a person, and I suspect this person has changed. I truly wish them well.

    2. Re:Somewhat off-topic by Donny+Smith · · Score: 1

      >>I don't know, but I certainly wouldn't complain to see Novell take back a sizeable bite of the business that was stolen from them.

      >It was not stolen from them, they gave it away

      Uhm, they had stolen that market share from someone else before Microsoft stole or took it from them.
      What comes around, goes around.

    3. Re:Somewhat off-topic by Anonymous Coward · · Score: 0

      It was the irrational fear that they would do to SuSE what they did to WordPerfect.

      I don't know what Novell did to WordPerfect, but Pete Peterson's (one of the three owners) "Almost Perfect" (readable online) tells how WP got into trouble all on their own.

      Mainly by first betting on OS/2 and then not getting a Windows version of WP out when Microsoft Released WinWord after WinWord. And it's pretty amazing in the book how WP Corp was unable to even figure out how to get WPwin done, where to find the programmers who knew Windows, et cetera, and how they didn't treat the situation like a major crisis.

      The book focuses on management and marketing, not on the actual product and the prorammers, so it is hard to say what exactly went/was wrong in the WPwin project. But it gives the appearance that there wasn't much Novell could do to save the situation.

      ( www.fitnesoft.com/AlmostPerfect/ )

    4. Re:Somewhat off-topic by Tony-A · · Score: 1

      Novell's near ruin was largely the result of thinking that a 90% market share makes you unaccountable to your customers.

      That probably holds true for any company in any industry.
      Seems it almost did in IBM. Seems also that Linux has rejuvenated IBM, maybe moreso that Linux is an antidote for the same-old same-old than Linux itself. Assuming that Novell can provide value for its customers, highly likely since most businesses would rather deal with Novell than the Open Source rabble, both Novell and SuSE should do nicely.

  3. Can someone explain this? by agent+dero · · Score: 0

    Yeah, I understand how SuSE & Novell become involved in this, but can someone explain what this does? I mean, what's the hoopla about?

    --
    Error 407 - No creative sig found
    1. Re:Can someone explain this? by Anonymous Coward · · Score: 0

      S/WAN = Secure Wide Area Network

      http://www.freeswan.org/intro.html

    2. Re:Can someone explain this? by krumms · · Score: 2, Informative

      Well, "Openswan is an implementation of IPsec for Linux."

      IPsec is basically authentication/encryption for packets at the IP level.

    3. Re:Can someone explain this? by whoever57 · · Score: 4, Informative
      Yeah, I understand how SuSE & Novell become involved in this, but can someone explain what this does? I mean, what's the hoopla about?
      FreeSWAN/OpenSWAN is a Linux-based VPN solution. It is a flexible solution providing host-to-host, network-to-network and host-to-network VPNs.

      What's more, unlike other Linux-based solutions, I don't think there have ever been any serious questions raised over its security.

      Free/OpenSWAN also interoperates with a wide variety of commercial (soft and hard) VPNs. Authentication can be by RSA secrets or X509 certificates.

      --
      The real "Libtards" are the Libertarians!
    4. Re:Can someone explain this? by Anonymous Coward · · Score: 0, Funny

      Oh, okay, it's a VPN solution.

      What's a VPN?

    5. Re:Can someone explain this? by DetrimentalFiend · · Score: 1

      Virtual Private Network. Of course 2 seconds on google could have told you that.

    6. Re:Can someone explain this? by Anonymous Coward · · Score: 0, Troll

      :Can someone explain this? (Score:-1, Troll)
      by Anonymous Coward on 11:07 PM -- Saturday June 19 2004

      What's a troll?

    7. Re:Can someone explain this? by ticktockticktock · · Score: 3, Informative
      Copied and pasted in verbatim from www.wikipedia.org:

      "A Virtual Private Network, or VPN, is a private communications network usually used within a company, or by several different companies or organisations, communicating over a public network. VPN message traffic is carried on public networking infrastructure (ie, the Internet) using standard (possibly unsecure) protocols.

      VPNs use cryptographic tunneling protocols to provide the necessary confidentiality (preventing snooping), sender authentication (preventing identity spoofing), and message integrity (preventing message alteration) to achieve the privacy intended. When properly chosen, implemented, and used, such techniques can indeed provide secure communications over unsecure networks.

      Note that such choice, implementation, and use are not trivial and there are many unsecure VPN schemes on the market. Users are cautioned to investigate products they propose to use very carefully. 'VPN' is a label which, by itself, provides little except a marketing tag.

      VPN technologies may also be used to enhance security as a 'security overlay' within dedicated networking infrastructures.

      VPN protocols include:

      * IPSec (IP security), an obligatory part of IPv6.
      * PPTP (point-to-point tunneling protocol), developed by Microsoft.
      * L2F (Layer 2 Forwarding), developed by Cisco.
      * L2TP (Layer 2 Tunnelling Protocol), including work by both Microsoft and Cisco.

      Multi-protocol label switching can be used to build VPNs."

    8. Re:Can someone explain this? by Mind+Booster+Noori · · Score: 1
      What's more, unlike other Linux-based solutions, I don't think there have ever been any serious questions raised over its security.

      Free/OpenSWAN also interoperates with a wide variety of commercial (soft and hard) VPNs. Authentication can be by RSA secrets or X509 certificates.

      Honestly, this project is bloated. FreeS/Wan was allways bad (specially on it's setup, documentation and interoperabillity), but for some time it was less bad sollution. Then Linux Kernel 2.5 and 2.6 came, and with it a good IPSec implementation.

      So... Why use FreeS/WAN when we can use in-kernel implementation? The only cenarion when it's better to use it is where we're going to communicate with other FreeS/WAN nodes, since (as I said before) it's interoperabillity sucks.

      Not that I never used Openswan so I don't know if the issues pointed out to FreeS/WAN are still there. Anyway, the fact that 2.6 already has an IPSec implementation still exists, and seeing that Openswan uses 2.6's native IPsec stack, wouldn't it be better that they submit their implementation to kernel.org's kernel instead of building their implementation?

      --
      Mind Booster Noori
  4. "It will be very interesting to watch..." by crashnbur · · Score: 3, Funny
    " It will be very interesting to watch what they do now with Openswan!"
    Damn straight! I've got popcorn in the microwave and three Coke's on ice in anticipation! Now... tell me what I'm watching!
  5. SUSE by Harrison819 · · Score: 3, Interesting

    SUSE is now one of the premier players on the linux scene now, with Novell's help of course. SUSE was my first disro and I am very happy it has found succes. I just hope it does not go the way of redhat and not try to make their distro the best one out there and rely on the name alone, also like metallica but that is for another time.

    --
    Fin
    1. Re:SUSE by DAldredge · · Score: 1

      And what is wrong with Red Hat?

    2. Re:SUSE by j-pimp · · Score: 1

      I remember Redhat 7.0 It came with gcc 3.0 and the out of the box full install was incapable of recompiling the very kernel sources that came with it. I refused to use redhat, decreed it had sinned against me and excommunicated it from me.

      Then fedora came. I took a copy of the CDs at linux world after talking to one of the peopel there and forgave the company. Mind you I don't think Bob Young would care about my excommunication enough to stand barefoot in the snow outside my window for a few days, I was pissed at redhat.

      Anyway, I never got around to installing Fedora, but its on my todo list. Redhat seems to be making money selling services and presumeably doing whatever they do that requires the newer features of C++ that GCC 3 had that caused them to ship a compiler that would not compiloe their kernel.
      However, they started to forget about the little guy. Being the distro of the geeks means that you have free developers, word of mouth marketing etc. Luckily, they did this fedora thing to try to correct that.

      --
      --- Justin Dearing http://www.justaprogrammer.net/ We're just programmers.
    3. Re:SUSE by ahillen · · Score: 1

      SUSE is now one of the premier players on the linux scene now...

      Hmm, I think they also were before. But with Novell's help probably even more so. ;)

    4. Re:SUSE by rkit · · Score: 2, Informative

      Slight correction: redhat 7.0 shipped with a snapshot towards gcc-3.0 they called gcc-2.96. It is true that this compiler version miscompiled the kernel, but it is also true that they provided a gcc version that was the recommended compiler for the kernel at that time. (they called it kgcc).
      It is also true hat "gcc-2.96" did not have the quality of a proper gcc release. However, this step proved very valuable for gcc 3.0 development, because of the huge user base acting as testers. Of course, 99 percent of redhat users would never have bothered to install a development snapshot of gcc. (and the rest would not have used in a production environment...)

      --
      sig intentionally left blank
  6. Nice project but documentation is lacking... by ErikTheRed · · Score: 5, Informative

    Even since FreeS/WAN gave up on changing the world to Opportunistic Encryption (not my favorite idea, but I suppose if I feel too strongly I can write my own damn implementation :) ), I've been looking into alternatives, and obviously OpenS/WAN is the first choice. A frustration I had when looking into it was that I couldn't find any documentation describing the differences between the two projects. I didn't do any diffs on the documentations, but from a brief perusal it looks pretty much like the FreeS/WAN docs. Does anyone out there have a list of specific differences between the projects - other than the included patches for things like x.509 NAT traversal, etc that are also included in Super FreeS/WAN (I'm kind of assuming that there are more changes)?

    --

    Help save the critically endangered Blue Iguana
    1. Re:Nice project but documentation is lacking... by buddha42 · · Score: 3, Informative

      http://www.openswan.org/development/roadmap.php

    2. Re:Nice project but documentation is lacking... by velkro · · Score: 5, Informative

      Hi,

      I was the maintainer of Super FreeS/WAN, and am now the release manager of Openswan.

      We're currently working on a whole new set of documentation, in DocBook/XML format to boot. It's slow, since we all know how much developers love to write documentation, but it's coming. For now, you can see The Wiki which will probably get slashdotted.

      Ken

    3. Re:Nice project but documentation is lacking... by Anonymous Coward · · Score: 0

      Whoah. UID 11. The Old Ghosts are back!

    4. Re:Nice project but documentation is lacking... by Anonymous Coward · · Score: 0

      As a maintainer and release manager of these tools, can you *pretty please* get the developers to give up on the idea of keeping the encryption keys as locally stored plaintext? SSH and OpenSSH and SSL solved this problem a long time ago by allowing, or encouraging, the use of keys that are unlocked at boot time to prevent the theft of files from the servers from allowing the theft of the server's encryption keys.

      It's a real security issue: even Microsoft's VPN software doesn't do this kind of local plaintext key storage, and the reasons for not doing it are obvious to anyone who's ever had their user's SSH keys stolen because they left them unlocked on a poorly secured laptop, or who's had a server cracked via one of the SSH vulnerabilities over the years.

  7. and ? by kayen_telva · · Score: 3, Interesting

    What does FreeSWAN do that OpenVPN does not ?
    I have never tried SWAN because OpenVPN is so easy.
    Are there any compelling reasons to try it ??

    1. Re:and ? by jcr · · Score: 5, Informative

      IPSEC, of which FreeSWAN is one implementation, doesn't require that you set up a point-to-point tunnel like VPN's do. It encrypts any traffic between any machines that implement it.

      -jcr

      --
      The only title of honor that a tyrant can grant is "Enemy of the State."
    2. Re:and ? by ErikTheRed · · Score: 4, Informative
      What does FreeSWAN do that OpenVPN does not?
      It's an implementation of IPSec, and thus is compatible with a whole slew of systems. For most corporations running VPNs, Extranets, etc., IPSec is pretty much the defacto standard. I'll be the first to call IPSec a huge designed-by-committee pain in the ass, but it's pretty damned secure when properly implemented, and it's a widely supported open standard.
      --

      Help save the critically endangered Blue Iguana
    3. Re:and ? by accessdeniednsp · · Score: 5, Informative

      The *SWANs are IPsec. OpenVPN is not. IPsec is cross platform and cross-vendor (hang on, before you get excited, let me finish) and is a (series of) RFCs. IPsec also gets you plenty of perks such as kernel-space (fast, secure, etc).

      Now for the "reply" trigger-happy, OpenVPN does do SSL/TLS, is all in user-space, and does neat things, yes. However, with the *SWANs, you can also get x509, nat-t, dpd, foo, and bar. And yes, OpenVPN is cross-platform.

      The problem lies in not being cross-vendor. And you also have to realize that there is a very large inter-web out there and not everyone uses the same platforms and vendors, etc.

      For example, as a security engineer, I often have to build VPNs between disparate vendors, devices, and software versions. Even with IPsec/IKE it's difficult enough. And they've all pretty much agreed on how to speak IKE well enough to at least have a meet-and-greet among each other. Unfortunately, there is plenty of room for interpretation, so each vendor has a slightly different dialect.

      The point being, OpenVPN isn't a "standards-based VPN" whereas an IKE-based VPN is. I know it's not necessarily a great answer to the question, but it is the truth. (Besides, OpenVPN even says so on their site...it does not do IKE.)

      (whoa, poet and didn't know it)
      (woops, i did it again!)

    4. Re:and ? by Homology · · Score: 1

      OpenVPN is a free VPN client (talking to an OpenVPN gateway, of course) on Windows that is much easier to setup and get working than IPSec - at least for Windows 2000 Pro. Most Windows users will use a commercial VPN client when using IPSec.

    5. Re:and ? by kayen_telva · · Score: 4, Interesting

      However, with the *SWANs, you can also get x509, nat-t, dpd, foo, and bar.

      x509 is certs right ? OpenVPN can do em. nat-t ? OpenVPN doesnt need that kludge. It uses one port that can be redirected through multiple Nats if need be. Dead peer detection ? OpenVPN is self healing. Link goes down, comes back up and OpenVPN reconnects.

      Now before I get too carried away, I dont know shit about vpn, but SWAN looks like a bitch (based on my IPCop machine) and OpenVPN is very easy.

    6. Re:and ? by Anonymous Coward · · Score: 0

      IPsec is a protocol designed and scrutinised by real security experts.

      Interoperability: there are several IPsec implementations available.

      Built-in client: recent versions of Windows, Mac and Linux support IPsec out of the box. No need to download and install a third-party client.

    7. Re:and ? by mcrbids · · Score: 1

      ...SWAN looks like a bitch (based on my IPCop machine) and OpenVPN is very easy.

      How long does it take to put together a "normal" VPN? I spent about 6 hours before I got OpenVPN to work, futzing with this option, that config file, etc. until I *finally* got it to do what I wanted.

      Specifically, I have a remote desktop application that I use for tech support (based on VNC) that requires the customer to download a program from a web page, and then connect to a dedicated IP.

      The VPN connects my laptop to the dedicated IP so that, wherever I am, I can use the VNC application on any broadband 'net connection.

      I'm *not* a newbie - is this typical?

      --
      I have no problem with your religion until you decide it's reason to deprive others of the truth.
    8. Re:and ? by kayen_telva · · Score: 1

      sounds like you had some extra requirements that I didnt have to mess with. I setup openvpn on my laptop so that everytime it turns on, if it has an internet connection, openvpn connects to my home computer, creates the vpn, and I can browse or remote control my home computer. It doesnt matter where I am, my laptop "phones home" and creates the connection. Took me less than an hour (including forwarding one port in my firewall), by just following the instructions. I think I probably setup the most simple type it supports (shared key using SSL). I have been wanting this for several years, but hated the IPsec/PPTP/L2TP/SWAN complexities. I "knew" someone would make a simple vpn app eventually, and I was so pleased I donated. Cant code for shit so I put my money where my data is. Im going to research the SWAN IPsec implementation more closely just so I know what I am missing ;)

    9. Re:and ? by xsecrets · · Score: 2, Interesting

      Well 6 hours is nothing compared to trying to get one of the SWAN's setup for roadwarior mode. I work with IPSEC implemintations from numerous vendors on a daily basis, and I spent almost two weeks trying to get FreeSWAN to do road warrior before I just gave up to wait for someone to actually write an IPSEC client for linux, and that was over a year ago, and still even with ipsec built into the 2.6 kernel no one has.

      This is one area where I think one of the commercial distrobutions could easily differentiate themselves from the pack, but no signs of it yet.

    10. Re:and ? by Anonymous Coward · · Score: 2, Interesting

      IPsec is secure tunneling done right. If you go with a TCP-in-TCP solution, some things screw up. You don't need to mess with OpenVPN for that, good old PPP-over-SSH works perfectly. But it still is TCP-in-TCP.

    11. Re:and ? by arkhan_jg · · Score: 1

      As I understand it, OpenVPN needs software at both ends, so is basically a userspace implementation. Which is fine if you're going desktop to server, but not so suitable if you're doing hardware router/router for network-network encrypted tunnels.

      IPSec is an open standard, so implementations are available from many different vendors in many different setups, including hardware.

      One other advantage if you're supporting windows roadwarriors, is that L2TP/IPSec is built into dialup networking on windows 2K/XP, so with a bit of minor jiggery pokery you can have L2TP support on a linux gateway (authing directly, or to a windows server) without having to install any additional software on their remote box; just give em an autoinstaller DUN connection, and you're away, with a user-familiar interface.

      To sum up, having played with both (we went with https webDAV and webmail in the end) openVPN is a lot easier to setup, but IPSec is a lot more flexible. (there are further technical differences, but I won't go into those as others already have)

      --
      Remember kids, it's all fun and games until someone commits wholesale galactic genocide.
    12. Re:and ? by Anonymous Coward · · Score: 0

      Unfortunately, it is difficult to "properly implement" a secure system that stores all the private keys of each end in clear text. This behavior automatically leaves you vulnerable to man in the middle attacks from anyone who can gain local file access to the "secure" server.

      I've attempted to discuss with the pptpclient, Free/Swan, and other VPN software creators of this vulnerability. The only ones who actually noticed were Microsoft's VPN authors, who actually don't have this particular problem because they use user login/password authentication which has at least *vague* hash-based encryption of the user's private keys or passwords.

    13. Re:and ? by jjackson · · Score: 3, Informative

      Granted, IPSEC can be a pain to configure.

      However, if you are implementing a VPN between Linux and a device such as a Cisco PIX, you can't use OpenVPN.

      The fact of the matter is - Openswan implements an industry standard VPN implementation, OpenVPN does not.

      Not that it is a cause for great concern, but OpenVPN connections are also vulnerable to connection cutting (see the many, many recent stories about TCP/IP connection cutting DoS attacks), IPSEC is not.

    14. Re:and ? by ErikTheRed · · Score: 1

      I have to disagree with this to a certain extent on a practical level. If a system's keys are encyrpted then user or administrative intervention is required on reboot. This is usually an unacceptable condition for "border" devices, especially for small- and medium-sized companies that typically don't have 24x7 administrative support. Our solution has been to strictly control root access to the VPN systems, and to strictly limit running processes on it - typically SSH w/ key-based authentication, and maybe some DNS caching / servies using the DJBDNS tools for small remote sites that don't have another box to run that on.

      But that's it. Only two admins for each box have any sort of login access (once logged in they can su / sudo). Only root can read or write the files (root's password is 20-char random alpha-numeric-symbolic, locked in a safe and basically never used). Yes, there's the old "boot access is root access" saw, but that's a trade-off we're willing to accept. "Central" VPN devices are typically stored in a reasonably secure co-lo facility, or dedicated server room with controlled access, and if the key for one remote site gets compromised, then so be it. Keep in mind that IPSec keys can be set up as IP Address-specific (with the exception of road warriors). On travelling Windows laptops, we can encrypt local keys with XP file encryption built in to NTFS, and with each remote host having a unique key, and with fairly strict firewall rules for road warriors (easy to implement because Free/OpenS/WAN creates a virtual network interface that is subject to the usual NetFilter rules) exposure is reasonably limited.

      As always, the only completely secure system is one that has been unplugged, put through a metal grinder, melted down, and had the resulting slag turned to plasma in the core of a fission reactor. Unfortunately, systems must be reasonably accessible in order to be useful, and thus trade-offs must be made. If they are made intelligently, then a system can be both accessible and reasonably secure.

      --

      Help save the critically endangered Blue Iguana
    15. Re:and ? by kayen_telva · · Score: 1

      gotcha. in the cases where I wanted two networks connected by a vpn, I have used hardware routers that did all the work for me, such as a netopia r910 or sonicwall. can a linux box doing the same job handle more/faster connections ? of course I guess it depends on the processor. might be a cheaper/more scalable route than an r910 or something similar.

  8. ISAKMPD by Anonymous Coward · · Score: 1

    I don't get it. Why don't use isakmpd for key management?

    It easy to set up, and works just fine on my gentoo box.

    1. Re:ISAKMPD by DetrimentalFiend · · Score: 1

      FreeS/Wan (what Openswan is built off of) was around a long time before the code that is now shipped with the kernel. As for why people haven't resigned to use the (newly) built in IPSec code, I'm not sure. Maybe it's because Openswan is very reliable and is already running on many production servers.

  9. patents hurt openswan by jaymzter · · Score: 2, Informative

    Openswan is a good example of a patent hurting an Open Source app. I *need* LZS compression for my company's VPN, but Openswan won't work cuz of IPCP LZS compression. I was offered an internal version of super-freeswan with the LZS code but refuse to use it cuz it's not Free. i'm stupid that way

    --
    If thou see a fair woman pay court to her, for thus thou wilt obtain love
    1. Re:patents hurt openswan by Anonymous Coward · · Score: 1, Informative

      Huh? IPCP is used by PPP, not IPsec. If you really need LZS compression, you would need to fix your ppd. You would still have the patent issue, though.

      Openswan supports IPCOMP compression. It should interoperate with many IPsec implementations, if they support IPCOMP.

    2. Re:patents hurt openswan by pe1chl · · Score: 1

      Does it work with Cisco?
      FreeS/Wan doesn't.

      I would like to enable encryption on my link to work, but as soon as I do so the link dies.
      It works OK between FreeS/WANs and between Ciscos but not between the two...

    3. Re:patents hurt openswan by velkro · · Score: 1

      I've done Openswan interop with Cisco... 17xx's, 36x, 72xx's and 30xx series VPN Concentrators.

      So, details please... it works nicely for me.

    4. Re:patents hurt openswan by pe1chl · · Score: 1

      It does not work between Cisco and FreeS/WAN (1.99), and all I have been able to find on Google is posts from people with the same problem. The link just does not work when compression is enabled.

    5. Re:patents hurt openswan by jaymzter · · Score: 1

      Try to interop with an Avaya VSU using LZS. It'll never work because they use LZS as the encryption protocol for IPPCP (not to mention the other peculiarities of the VSU which require yet other patches to freeswan).

      --
      If thou see a fair woman pay court to her, for thus thou wilt obtain love
    6. Re:patents hurt openswan by Anonymous Coward · · Score: 1, Interesting

      lan-2-lan or client (user/group/password) mode ?

      I thought the former was possible, but the latter was not (yet) there ?

  10. Why? by Turmio · · Score: 4, Interesting

    There has been a working and tested IPSec implementation from Kame Project in the vanilla Linux kernel for some time now. Why go with a competing and conflicting IPSec implementation that was once formed because the official Linus tree lacked the support. Diversity is a richness etc. on but in this case I feel like these efforts seem fruitless. But big companies such as Novell don't do things because they just can so maybe there's something I don't quite get. I'd love to be englightened, though.

    1. Re:Why? by Anonymous Coward · · Score: 2, Interesting

      Because it's like OSS (open sound system) versus Alsa. OSS is being being depreciated in favor of Alsa. Likewise, because of Novell's support, Kame will be depreciated as Openswan ascends. Novell is putting a lot of money and engineers behind Openswan. Other vendors are getting on board too. Openswan is the future. Kame just doesn't have the flexibility and features to meet *all* the needs of the professional enterprise.

    2. Re:Why? by hsjones · · Score: 5, Informative

      A complete VPN solution is more than just an IPsec module (Kame) or an IKE module (Racoon). So it's not a question of Openswan vs. 2.6 kernel IPsec. Openswan moves up the stack with added functionality and intends to continue doing so. And it can use either the FreeS/WAN IPsec engine (which is being carried forward for use on pre-Linux 2.6 machines) *or* the 2.6 kernel IPsec (Kame).

      (Btw, the 2.6 kernel hasn't exactly been official "for some time now" -- even SuSE is just now shipping it in their 9.1 release.)

      In fact, with Novell now involved in Openswan (which means IBM is likely involved as well but less publicly), we will probably see Openswan work with IPsec hardware too (IBM makes some).

    3. Re:Why? by velkro · · Score: 2, Interesting

      There are still bugs in the KAME IPsec stack that is integrated into the Linux 2.6 series of kernels, and will be for another few months, I suspect.

      Look at the recent posts on the netfilter lists, for instance - doing secure firewalling with 26sec is still a real pain. There's a set of 6 patches now, but they aren't integrated into the kernel yet, and some may not be for some time.

      Also, there's some network configurations that work fine under 2.4/Openswan, but will not work at all in 2.6. One of these configs I use daily (subnet extrusion), so I've been unable to update any of my production machines to the new stack, even though I'm one of the Openswan developers.

      I hope to see about solving some of this at LinuxTag in a few days, since there will be a large contingent of developers present, and putting the right people in a room together gets things resolved very quickly :)

      Ken

    4. Re:Why? by Ded+Bob · · Score: 1

      Novell is putting a lot of money and engineers behind Openswan. Other vendors are getting on board too.

      Will it be as big as KAME's list of corporations? KAME's list:
      Fujitsu Limited
      Hitachi, Ltd.
      Internet Initiative Japan Inc.
      NEC Corporation
      Toshiba Corporation
      Yokogawa Electric Corporation

  11. Novell fumbled the ball - again and again... by WIAKywbfatw · · Score: 4, Insightful

    Novell got complacent, made some dumb moves (eg, buying WordPerfect) and hit some real competition when Microsoft started muscling in on their traditional turf. Whilst the competition was coming right at it, Novell just looked on, doe-eyed.

    A littany of bad management decisions is why they are where they are today. Maybe Novell can regain some of its lost market share but you'll have to wait a very long time if you want to see it regain market dominance.

    --

    "Accept that some days you are the pigeon, and some days you are the statue." - David Brent, Wernham Hogg
    1. Re:Novell fumbled the ball - again and again... by coupland · · Score: 4, Insightful

      No offense, but you don't remember the timeline particularly well. WordPerfect had the poop beaten out of it long before Novell bought it -- caused by their failure to release a Windows version while they still had the superior product. By the time Novell bought it they were a steal. Agreed, not a brilliant move, but not what killed them, either. What really killed Novell was Windows 3.11 (Windows for Workgroups) which had built-in networking. Windows NT followed and sealed Netware's fate, despite the fact that NW4 was years ahead of NT. Both instances where the OS was leveraged to strangle the market for a superior product.

      Novell didn't look on doe-eyed, the Wordperfect aquisition (which came much later) was a desperate attempt to save themselves once they realized Microsoft could leverage the OS to beat them, *no matter how superior their products were*. It was desperation, not stupidity.

    2. Re:Novell fumbled the ball - again and again... by flinxmeister · · Score: 2, Insightful

      I disagree. The OS was not leveraged more than Novell dropped the ball. Remember TCP/IP? Remember how slow Novell was to adopt it? Remember how hard it was to write NLMs for Novell vs. apps for NT? Remember how cryptic working on the server console was? Granted, you didn't have to do it often but next to the GUI most small offices went the logical way. Bottom line, Novell got complacent, then got the pants beat off em fair and square with a more market friendly product. Microsoft is vulnerable to the same thing now.

    3. Re:Novell fumbled the ball - again and again... by coupland · · Score: 2, Informative

      Again, you're mixing up your history. Sure Novell was slow to adopt TCP/IP but that's because IPX/SPX was always routable. Microsoft held onto NetBEUI (ptooie!) for far longer and still won the war. Sure Microsoft competitors made some mis-steps, but no more so than Microsoft. Unfortunately they didn't have an endless supply of cash to help them recover.

    4. Re:Novell fumbled the ball - again and again... by Anonymous Coward · · Score: 0

      Remember TCP/IP? ... Remember how hard it was to write NLMs for Novell vs. apps for NT?

      And the worst part about this was that Novell OWNED UNIX! But yet just sat on it and pushed NetWare, even tho the market felt it to be inferior in many ways.

    5. Re:Novell fumbled the ball - again and again... by Anonymous Coward · · Score: 0

      IPX sucked on large networks, unlike TCP/IP.
      Plus, TCP/IP == Internet == Buzz == Stock Price, something Novell badly needed.

      Also, Microsoft adopted TCP/IP back in the 80s with OS/2 so I dunno if you know your history either.

    6. Re:Novell fumbled the ball - again and again... by coupland · · Score: 3, Funny

      Also, Microsoft adopted TCP/IP back in the 80s with OS/2 so I dunno if you know your history either.

      Awww, yer so cute when you have no clue what you're talking about. Microsoft? TCP/IP? OS/2? That's utterly adorable. Go do some research and once you realize how funny that is come back here and we'll have a good ol' laugh about it.

      OS/2... Snicker...

    7. Re:Novell fumbled the ball - again and again... by coupland · · Score: 4, Informative

      Ok fine after mocking you mercilessly I will explain why you are such a funny guy.

      1. Microsoft was only involved in OS/2 up until version 1.3
      2. OS/2 was widely criticized because it did not have built-in networking. So Microsoft certainly didn't introduce TCP/IP in the 80's with OS/2.
      3. The first version of OS/2 with built-in networking was OS/2 WARP, which was after OS/2 2.1. This was many years after the IBM/Microsoft rift.

      So.... yeah. This is what any decent research will tell you. Rebuttals are welcome, I'm kind of enjoying teaching a new generation about how the 80's played out. ;-)

    8. Re:Novell fumbled the ball - again and again... by coupland · · Score: 2, Insightful

      See my last comment to parent, where I point out that your hypothesis is completely impossible. Microsoft didn't go IP until years after the competition, and they had no hand in OS/2. I feel like I'm arguing history with a 12-year-old. You were obviously not there, dude, so stop making up stories about what happened. Anyone who was there knows you are wrong.

    9. Re:Novell fumbled the ball - again and again... by Anonymous Coward · · Score: 0

      Do the research yourself. Microsoft OS/2 LAN Manager was a server OS sold and supported until Windows NT came out in 1993, after which IBM continued the product as OS/2 LAN Server. As you might guess by the name, it had networking and it had TCP/IP.

      Now be a good old senile grouch and admit you were wrong, or we'll have to go Logan's Run on your ass.

    10. Re:Novell fumbled the ball - again and again... by coupland · · Score: 2, Informative

      Sorry but you are falling into "retard" status. LAN Manager was based on NetBIOS and NetBEUI was the transport protocol. Neither were routable, and had nothing to do with TCP/IP. In fact, LAN Manager was licensed technology to begin with! Sure, you could run TCP/IP under LANMAN, but you could also run IPX/SPX. This doesn't mean Microsoft "went" TCP/IP any more so than they "went" IPX/SPX. Your memory of the time is passable at best and totally flawed at worst.

    11. Re:Novell fumbled the ball - again and again... by coupland · · Score: 0, Flamebait

      Thanks, I knew you'd admit I was right sooner or later. I scrubbed both my cheeks smoothe as silk in anticipation of your admission, but on second thought I'd prefer a nice french-kiss on the browneye.

      OOooo, thanks, that tickled!

    12. Re:Novell fumbled the ball - again and again... by j-pimp · · Score: 1

      So, Microsoft went with standards for their routable protocol, Novell didn't, and now lots of Linux boxes are running a "LanMan" clone.

      I would not call it a LanMan clone. Putting aside what role NetBios, NetBEUI, LanMan, SMB, CIFS and whatever other acronyms involved play in the proccess of me accessing my home directory on my FreeBSD box from my windows 2000 server, Samba was originally built to allow the author to access a DEC server from his Unix (I believe slowlaris) box.

      --
      --- Justin Dearing http://www.justaprogrammer.net/ We're just programmers.
    13. Re:Novell fumbled the ball - again and again... by Tony-A · · Score: 2, Interesting

      IIRC Novell was designed for corporate networks, routable and securable.
      TCP/IP is fundamentally designed to let anybody in, very routable and hardly securable. It's essentially a difference between private roads and public roads.

      Just on the basis of where Novell is coming from, I'd expect a Linux coming from Novell to be somehow much more "business-friendly". Just a different bias in setting various tweaks and configurations would be enough.

    14. Re:Novell fumbled the ball - again and again... by vadim_t · · Score: 1

      Oh the horror. People used the word "leverage" twice in a row on Slashdot. I'm about to run away screaming.

    15. Re:Novell fumbled the ball - again and again... by SEE · · Score: 0

      Windows for Workgroups 3.1 was released in October 1992, while Windows for Workgroups 3.11 was released in December 1993. Neither product was the same as Windows 3.1 (April 1992) or Windows 3.11 (December 1993, but a different product than WfW 3.11).

    16. Re:Novell fumbled the ball - again and again... by talon77 · · Score: 1

      You hit it on the head with the GUI I think. Anyone that ever used a windows station could feel comfortable on an NT server. And they were extremely slow to adopt TCP/IP, Sure IPX worked, but TCP/IP was needed for the internet anyways.. so they were basically forcing offices to run both protocols until they released netware 5 back around 98.

    17. Re:Novell fumbled the ball - again and again... by TheRealMindChild · · Score: 0

      Pretty bold troll. Especially when you seem to be the misinformed one.

      Microsoft HAD LOTS to do with OS/2. They just so happen to be making a competeing product along side it. DOn't you remember Microsoft's OS/2? IBM's OS/2? WinOS2? Oh yeah... you know what Microsofts OS/2 version 3 got renamed too? Windows NT :|

      Even a little googling can prove you retarded. Please drive through.

      --

      "When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
    18. Re:Novell fumbled the ball - again and again... by Anonymous Coward · · Score: 0

      The built-in networking of WfW 3.11 was not built in. It had to be added on as an upgrade patchkit. As near as I could tell, it also wasn't released to compete with Novell: it was released to compete with FTP Software in Boston's particular TCP stack, which was superior to Novell's and which Microsoft once again illegally stole much of the copyrighted code from.

      Microsoft has long been at the business of letting other companies take the risk and then stealing the profits by stealing their software when it shows promise of making money.

    19. Re:Novell fumbled the ball - again and again... by T-Ranger · · Score: 1

      Novell did not by Word Perfect Corp to buy Word Perfect. The bought it to buy what is now called Groupwise, which they make a lot of money on.

    20. Re:Novell fumbled the ball - again and again... by crabapple469 · · Score: 1

      The WP acquisition was (at least!) 50% Utah Mormon cronyism. Bunch of old buddies from the Stake got themslves in a hole and looked to Novell to bail 'm out. Could still have been good for Novell, but then Novell fired Norda and sold off WP, so never executed a real strategy against MS. Just rolled over and played dead under Frankenberger.

      [Btw, the Cambridge buy was 99% cronyism (east coast faction that time) and failed even worse.]

      SuSe is the first major acquisition by Novell that was motivated 100% by an actual business strategy. Proves what the press has said about the current Novell leaders not being the same people who made the mistakes of the past. I have good expectations this time. Keeping my stock. May buy more. Once the new products start shipping on Linux later this year, it will get expensive.

    21. Re:Novell fumbled the ball - again and again... by sgtrock · · Score: 1

      Yeah, it was routable. The real issue was that it was;

      a) proprietary, so it couldn't interoperate with any other platform

      b) couldn't scale globally, although Novell tried to sell it that way

      c) cost a mint to buy licenses for

      d) Had nowhere near the number of apps that TCP/IP had riding on top of it.

      TCP/IP was a FAR better protocol from the ground up.

  12. Novell's Commitment to Free Software by soren42 · · Score: 4, Insightful

    I'm so very pleased by this news. My biggest concern from Novell's acquistion of SuSE and Ximian was whether or not they would continue to support Free Software. With other major Linux vendors (well, vendor) seemingly moving more and more toward closing their software, and locking users into their products, it's refreshing to see Novell opening more software up and supporting community projects.

    We've seen it now with their support of OpenSWAN, the open-sourcing of YaST and iFolder, and the continuing free releases of SuSE 9.1.

    As I said, I'm very pleased to see this, and I suspect we'll see even more support of the open source and free software community from the reborn phoenix that is Novell.

    --

    "Adventure? Excitement? A Jedi craves not these things."
    1. Re:Novell's Commitment to Free Software by Anonymous Coward · · Score: 0

      [...]from the reborn phoenix that is Novell.

      A phoenix is a bird that by definition is reborn. Somthing that is already reborn canot be prefixed as being reborn.

      Cheesy Cheese? Brown Dogshit? White Lightning? Open Goatse? Fuck Microsoft? Slashdot Sucks? Win32 Virus? Yellow Urine? Dank Fart?

    2. Re:Novell's Commitment to Free Software by Sunspire · · Score: 4, Interesting

      With other major Linux vendors (well, vendor) seemingly moving more and more toward closing their software...

      Look, we all know which company you're thinking of, and I'm telling you you're completely misinformed. Can you please let me know some of the supposed closed programs this evil company is distributing, because the last time I checked it was all open source. Somehow the bashers always forget this detail...

      This is the comany that is afraid to include mp3 support for being non-free, right? The company that pays Alax Cox, Arjan van de Ven, Dave Jones, Jeff Garzik, Warren Togami, Roland McGrath, Guy Streeter and many more to hack the kernel? In fact, if I'm not mistaken this company has more kernel hackers than IBM and Novell combined (read a kernel changelog lately)? I'd list some GNOME developers that works for this beast of a company, but let's just say outside Ximian they're the #1 employer here as well (cough, Havoc Pennington, Alexandre Oliva *cough*). And all that money and effort they pour into Freedesktop.org and X.org, that's just to lock you in, right?

      That company? Am I forgetting something... ? Oh yeah, they pretty much alone funded NPTL development for 2.6, backported it to 2.4 not only for their paying customers but their free version too. I guess they're pretty much the defacto maintainers of GCC and glibc these days too, but other than that, what have they ever given us?

      --
      It's like deja vu all over again.
    3. Re:Novell's Commitment to Free Software by Anonymous Coward · · Score: 1, Interesting

      There's basically 3 kinds of Red Hat haters around these days.

      1. The n00b. Red Hat = MS. This person doesn't let the facts get in the way of a good argument. He's running Linux 'cause it's the l33t thing to do. Listen sonny, I was installing Slackware from disksets from the local BBS when you where a twinkle in your daddy's eye. Between then and now the community, and I myself, have written a shitload of code so that I and you don't have to do things the hard way anymore to be l33t. I've got actual work to do now on Linux, get this, not in fact related to Linux at all.

      2. The rabid KDE zealot (a minority in the KDE community). Red Hat will go KDE, oh, right about when the Sun goes Nova. They hate RH and Ximian for basically keeping GNOME alive no matter what might come.

      3. The distro zealot. "My distro makes me feel like a productive community member, because I've got GCC compiling 24/7... not that I know what any of the output means...". Curiously you never, ever see these distro makers posting on the Linux kernel mailing list, or contributing to any core project outside their own little package management tools.

    4. Re:Novell's Commitment to Free Software by soren42 · · Score: 2, Interesting

      I think you entirely missed the point of my post. I was not really attempting to throw stones at Red Hat, I was trying to say more that I was encouraged by Novell. Red Hat was founded around Free Software - it's no surprise that they are still heavily involved in Linux development.

      Novell, on the other hand, had built a (at one time) very successful business around proprietary software. It's a huge culture shift for them. Not they were ever the "evil empire" type of company, but they were certainly not making money on Free Software.

      I have so much more to say about this, actually, that I can't say in a public forum. Suffice to say, I never had the opportunity to work with Novell in it's former heyday, but today they are one of the most accomdating, ethical, and sensible companies I have ever dealt with. They have a true understanding of what "customer service" means, and it reflects very well on them. Additionally - only from personal experience, mind you - I could could say all the opposite things about my experiences with Red Hat. (If you'd more insights about this, privately, please feel free to e-mail at the address above.)

      So, here's what I'm getting at - I, personally, have decided to business with Novell instead of Red Hat, for reasons that have nothing to do with Free Software ideology. That said, I was very concerned about Novell's level of commitment to Free Software, but their recent actions have quelled those fears. I appreciate Red Hat's work, their staff, and the company's contribution to Free Software - but that was never really in question.



      One more thing (really a side note) - your list of kernel developers piqued my interest. I never realized that Jeff Garzik was working at Red Hat or was coding kernels. I read your list, and went, "Hey! I know Jeff Garzik! He's at Red Hat? Cool!" I went to college with Jeff at Georgia Tech back in the 90's, and I always wondered what he was up to. He was such a brilliant coder and SA, I'm glad to see he's doing well for himself. In fact, at one point, we did a really great Star Wars parody. Heh heh heh ... those were the days, being just a number (gtd543a, gt2357a, etc.) Thanks for that trip down memory lane!

      --

      "Adventure? Excitement? A Jedi craves not these things."
  13. IPX on large networks by billstewart · · Score: 5, Informative
    IPX actually did fine - it was the IP layer equivalent. What sucked on large networks was Netware. One of its problems was inadequate flow control (though I forget if that was SPX's fault or other Netware protocols - the PBurst stuff just didn't cut it when there were congestion problems.)

    But the real performance killer on lots of networks was all the chatty SAP announcements - even on a medium-sized network, all the printers advertising themselves can clog up any useful bandwidth, which often meant 56kbps back when this sort of networking was common for users like banks, retail stores, and branch offices of big companies. Yes, we learned how to do SAP filtering, and eventually Novell came out with NLSP which helped a lot.

    The more important problems were pricing - upgrading to Netware 5 which could use TCP/IP instead of IPX tended to cost too much for the types of companies that were big Netware users back in mumblety-95, so they stayed with IPX way past its prime, around the time that Microsoft was figuring out how to make NetBIOS-over-IP perform badly over long distances (as opposed to NetBIOS-over-NETBEUI.) While Microsoft _still_ doesn't have a clue about decent networking, they were good enough to beat Netware in the market, and small networks of either Netware or NetBEUI could both be self-configuring, a lesson we're trying to relearn for IPv6.

    --

    Bill Stewart
    New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
    1. Re:IPX on large networks by twoslice · · Score: 0
      The biggest problem with IPX was scalability (15 hop limit). Novell could have got around the NSAP broadcasts just like Microsoft did with NetBIOS broadcasts (WINS, AD, and DNS resource records etc.). but the 15 hop limit was a problem given all of the existing IPX gear in the marketplace that would need to support IPX2.

      Novell was also very late to start controlling unique IPX addresses by maintaining a central registry. Just imaging everyone just picking a public IP address willy nilly and expecting the Internet to function efficiently.

      --

      From excellent karma to terible karma with a single +5 funny post...
  14. Nativew IPsec Embedded in the Kernel by afriguru · · Score: 3, Informative
    Note that Freeswan and Openswan are not strictly needed for the future because:
    As of Linux 2.5.47, there is a native IPSEC implementation in the kernel. It was written by Alexey Kuznetsov and Dave Miller, inspired by the work of the USAGI IPv6 group. With its merge, James Morris' CrypoAPI also became part of the kernel - it does the actual crypting.
    http://lartc.org/howto/lartc.ipsec.html
    Freeswan only needs to remain secure for current deployments. This means fixing any discovered veulenrabilities. __________
    --
    ___
    internet, productivity blog
    1. Re:Nativew IPsec Embedded in the Kernel by Sunspire · · Score: 1

      It's not an either/or choice, Openswan can in fact directly use the kernel IPsec modules in 2.6. But Openswan is a whole lot more too, it provides all the userland tools and higher level functionality that makes using IPsec easier and more powerful. There exists other Linux IPsec toolchains, but right now Openswan seems to have the most momentum.

      --
      It's like deja vu all over again.
    2. Re:Nativew IPsec Embedded in the Kernel by jamesh · · Score: 1

      I use debian sarge on which the 2.4 kernel has the 2.6 IPSEC implementation backported. So xS/Wan is just the key manager. It is easier to use and more flexible than all the others I have tried.

    3. Re:Nativew IPsec Embedded in the Kernel by velkro · · Score: 3, Informative

      Sorry, but completed your research before spouting off links and quotes.

      2.6 has an IPsec kernel layer implementation. There are two part to IPsec - the kernel layer, and the key management (IKE) portion. The IKE daemons are userland, and without them, you don't have a complete IPsec implementation.

      Thus, they have ported isakmpd/racoon to Linux, or you can run Openswan's userland tool (aka pluto).

    4. Re:Nativew IPsec Embedded in the Kernel by omar_armas · · Score: 1

      Userland tools of Freeswan and derivatives can be used with 2.6 ipsec native stack.

      Personally, I have found easier and more mature the Freeswan tools than the the ipsec-tools.

      Omar

  15. IP Encryption vs. TCP Encryption by billstewart · · Score: 4, Informative
    Actually, IPSEC does require setting up point-to-point connections (though they can be tunnel mode or transport mode) - but one of the goals of FreeSWAN's Opportunistic Encrytion was to do this automatically whenever possible.

    The real difference is that IPSEC is encrypting at the IP layer of the protocol stack, aka Layer 3 in OSI terms, while OpenVPN is creating a TCP Layer 4 tunnel. Inside the tunnel, IPSEC normally puts Layer 3 IP packets, while OpenVPN does something with a TUN/TAP driver on the ends, so they could be doing Layer 3 IP packets or Layer 2 Ethernet packets, and I haven't read the docs enough to know which they did. Layer 4 has more overhead, but has a potentially easier time going through NAT.

    For both of these applications, you have to create an association between two endpoints, and then tell your endpoints' packet handlers to use that association when they want to get packets somewhere. The choice of protocol layers for the inside and outside of the crypto tunnel has a major impact on how you get the routing mechanisms (or whatever) to decide to set up a tunnel and send packets through it.

    --

    Bill Stewart
    New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
    1. Re:IP Encryption vs. TCP Encryption by imroy · · Score: 1

      An interesting use of OpenVPN is to bridge the OpenVPN TUN/TAP interface with the local ethernet interface. This way you have all your broadcast packets going over the VPN and keeping Network Neighborhood and other b'cast protocols happy. Plus you only have one address space and don't have to stuff around with a seperate subnet. I haven't done much with IPsec, but I don't think it can do either of these things. Still, IPsec does have the whole Standrd thing going for it.

    2. Re:IP Encryption vs. TCP Encryption by billstewart · · Score: 1
      The typical way people implement that sort of thing in IPSEC is to build GRE tunnels, usually running in IPSEC transport mode. In general, bridging protocols over Layer 2 is just inviting trouble, and should be avoided when you can do routing as an alternative - broadcast storms used to be a real problem. Also, if you're running a Layer 2 protocol over an OpenVPN tunnel, then you're adding an extra protocol header layer for the Layer 2 as well as adding a protocol layer for OpenVPN's Layer 4, compared to IPSEC where the secure side's Layer 3 IP is running directly on top of the IPSEC's Layer 3. If the stuff you're tunnelling is mostly large packets, e.g. 1500 byte FTP stuff, the percentage of bandwidth isn't that high, though you've still got a couple extra passes of checksum calculation, and you've got to be extra careful about MTU sizes - but if you're trying to carry 10-byte VOIP payloads on a dialup connection, each 20-40 byte header layer is just adding extra insult to injury.

      The FreeSWAN project did a bunch of stuff with different ways to mush parts of subnets out to various remote sites (e.g. giving a remote site a single IP off the hub site's subnet.) There's way too much documentation on it if you're interested.

      --

      Bill Stewart
      New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
  16. If you ask me... by ross.w · · Score: 0, Redundant

    It sounds more like an ugly duckling.

    --
    If my call is important, why am I talking to a recording?
  17. OpenVPN is an excellent alternative to IPSec... by Anonymous Coward · · Score: 2, Informative

    OpenVPN (http://openvpn.sf.net/) is an excellent alternative to IPSec. It's using UDP or TCP as transport layer and doesn't care about NAT. You can have NAT on the both sides. The client and server share the same code and can be used on WIN32 or GNU/Linux (and more). The version 2.0 can handle routing per X.509 certificate... and much more.

    Novell-Suse-... should sponsor this excellent project instead of the brain damaged(tm) IPSec.

    1. Re:OpenVPN is an excellent alternative to IPSec... by pe1chl · · Score: 2, Informative

      It needs support from some router manufacturers to become viable. Cisco would be nice, but it could start with Draytek, ZyXEL, etc.

    2. Re:OpenVPN is an excellent alternative to IPSec... by hsjones · · Score: 2, Interesting

      I think the issue is what is currently pervasive in corporate environments. Remember, we're talking about Novell here, a company that claims 80% of the Fortune 100, and like I said in a previous post, probably IBM in the background, a company with even more of the Global 2000. Those kinds of companies are using IPsec from Cisco, Check Point, Nortel, etc...

      With those hardware companies moving to Linux as a platform (CyberGuard, BorderWare, Stonesoft, Astaro and others already there -- many more moving), this is a good move for Novell to make SuSE Linux more attractive to those guys.

  18. openvpn by default uses the UDP port by ion++ · · Score: 1

    OpenVPN by default uses udp port 5000, but if you want to, you can configure it to use any other port, and tcp rather than udp. But as you wrote, tcp over tcp can bring trouble

  19. KAME has problems by ink · · Score: 2, Interesting
    Try managing 20 ipsec connections with KAME/racoon sometime. You almost always have to kill all the tunnels when a change is made to one tunnel. With Openswan, you can simply do 'ipsec auto --down/--up connectionname' after the connection has been defined. Racoon log messages themselves are cryptic; when no policy can be found, it simply logs (when logging works) a message to that effect: "no policy found"; Openswan will give you all the details of the attempted policy, without having to restart it in "debug mode"; or "running Racoon in foreground -F mode". Racoon seems to have problems logging normal information to syslog -- sometimes its messages just dissapear mysteriously (I've seen this on RHEL3 and FC2).

    KAME also has problems with netfilter; specifically it doesn't work with all NAT rules, which are VERY common on ipsec gateways. It also doesn't work at the interface level, so many of the advanced routing tools don't work like you'd expect (try using tc with it, on an inteface level...).

    I don't know why 2.6 and the Linux ipsec-tools project standardized on KAME. It may be from BSD, but we already have better userland tools, and they already (mostly) work with the new 2.6 ipsec intefaces. Hopefully these tools will get better with time, but right now pluto/openswan are simply more mature, stable and just plain better.

    --
    The wheel is turning, but the hamster is dead.
  20. Why not Strongswan? by omar_armas · · Score: 1

    Strongswan has been mucho more active since Freeswan dead. Also has more features. Why not to go for Strongswan instead of Freeswan?

    Omar

    1. Re:Why not Strongswan? by crabapple469 · · Score: 2, Informative

      Maybe because strongswan is a class project with no QA. Easy to get enhancements in when you don't need to bother testing them...

  21. you fail it by Anonymous Coward · · Score: 0

    YHBT
    YHL
    HAND.

  22. Re:screw this...why not just use.. by jojo900 · · Score: 1
    Cisco VPN widely tested ?
    How many Cisco VPN are around, and how many Freeeswan ?
    Probably it's not possible to know any of these numbers, but it would be very interesting to be able to estimate them.

    You say "Cisco VPN more secure" ?
    How many known vulnerabilities has been found in Cisco VPN, and how many in freeswan ?
    This time it's possible to know the numbers. Any one volunteer to search Google and/or securityfocus ?

  23. Why didn't they sponsor FreeSWAN? by ela_b · · Score: 1

    1) I wonder why they didn't sponsor the original FreeSWAN project in the first place? Why did FreeSWAN have to die bacause of lack of funding? Now THE FreeSWANs source is used by the OpenSWAN project, and they get sponsoring. Can anyone explain?

    2) Is opportunistic encryption still a priority for the FreeSWAN project as it was for OpenSWAN? I didn't see any mention of it on their starting page.