Slashdot Mirror
Novell-SUSE Sponsors Openswan
hsjones writes "Concerned about the demise of FreeS/WAN? Well, looks like Openswan is going to be a good, strong open source IPsec project going forward. Novell and SUSE have jumped in with Astaro to back the project and move it along. See the press release. The Openswan project is at http://www.openswan.org. SUSE Linux and Astaro Security Linux both use FreeS/WAN in their current releases. It will be very interesting to watch what they do now with Openswan!"
Stop looking at me Swan!
Distributed proteome folding @ WorldCommunityGrid.org
Team Slashdot - Members:#1 Run Time:#1 Points:#1 Results:#1
Building on its contributions to the open source community and commitment to interoperability
As one of many people who vividly remembers the success of NetWare 3.x, the current situation seems very alien. Novell virtually died when the fact of the matter is their product was by far the best. Today they have good products, yet they really can't claim an enormous technological edge. Their second coming is, instead, based on commitment to a thriving community, and feeds off anti-Microsoft sentiment. If best-of-breed products didn't work, will this perhaps be the strategy that finally works for them? I don't know, but I certainly wouldn't complain to see Novell take back a sizeable bite of the business that was stolen from them.
SUSE is now one of the premier players on the linux scene now, with Novell's help of course. SUSE was my first disro and I am very happy it has found succes. I just hope it does not go the way of redhat and not try to make their distro the best one out there and rely on the name alone, also like metallica but that is for another time.
Fin
Even since FreeS/WAN gave up on changing the world to Opportunistic Encryption (not my favorite idea, but I suppose if I feel too strongly I can write my own damn implementation :) ), I've been looking into alternatives, and obviously OpenS/WAN is the first choice. A frustration I had when looking into it was that I couldn't find any documentation describing the differences between the two projects. I didn't do any diffs on the documentations, but from a brief perusal it looks pretty much like the FreeS/WAN docs. Does anyone out there have a list of specific differences between the projects - other than the included patches for things like x.509 NAT traversal, etc that are also included in Super FreeS/WAN (I'm kind of assuming that there are more changes)?
Help save the critically endangered Blue Iguana
Well, "Openswan is an implementation of IPsec for Linux."
IPsec is basically authentication/encryption for packets at the IP level.
What's more, unlike other Linux-based solutions, I don't think there have ever been any serious questions raised over its security.
Free/OpenSWAN also interoperates with a wide variety of commercial (soft and hard) VPNs. Authentication can be by RSA secrets or X509 certificates.
The real "Libtards" are the Libertarians!
What does FreeSWAN do that OpenVPN does not ?
I have never tried SWAN because OpenVPN is so easy.
Are there any compelling reasons to try it ??
Openswan is a good example of a patent hurting an Open Source app. I *need* LZS compression for my company's VPN, but Openswan won't work cuz of IPCP LZS compression. I was offered an internal version of super-freeswan with the LZS code but refuse to use it cuz it's not Free. i'm stupid that way
If thou see a fair woman pay court to her, for thus thou wilt obtain love
There has been a working and tested IPSec implementation from Kame Project in the vanilla Linux kernel for some time now. Why go with a competing and conflicting IPSec implementation that was once formed because the official Linus tree lacked the support. Diversity is a richness etc. on but in this case I feel like these efforts seem fruitless. But big companies such as Novell don't do things because they just can so maybe there's something I don't quite get. I'd love to be englightened, though.
Novell got complacent, made some dumb moves (eg, buying WordPerfect) and hit some real competition when Microsoft started muscling in on their traditional turf. Whilst the competition was coming right at it, Novell just looked on, doe-eyed.
A littany of bad management decisions is why they are where they are today. Maybe Novell can regain some of its lost market share but you'll have to wait a very long time if you want to see it regain market dominance.
"Accept that some days you are the pigeon, and some days you are the statue." - David Brent, Wernham Hogg
I'm so very pleased by this news. My biggest concern from Novell's acquistion of SuSE and Ximian was whether or not they would continue to support Free Software. With other major Linux vendors (well, vendor) seemingly moving more and more toward closing their software, and locking users into their products, it's refreshing to see Novell opening more software up and supporting community projects.
We've seen it now with their support of OpenSWAN, the open-sourcing of YaST and iFolder, and the continuing free releases of SuSE 9.1.
As I said, I'm very pleased to see this, and I suspect we'll see even more support of the open source and free software community from the reborn phoenix that is Novell.
"Adventure? Excitement? A Jedi craves not these things."
But the real performance killer on lots of networks was all the chatty SAP announcements - even on a medium-sized network, all the printers advertising themselves can clog up any useful bandwidth, which often meant 56kbps back when this sort of networking was common for users like banks, retail stores, and branch offices of big companies. Yes, we learned how to do SAP filtering, and eventually Novell came out with NLSP which helped a lot.
The more important problems were pricing - upgrading to Netware 5 which could use TCP/IP instead of IPX tended to cost too much for the types of companies that were big Netware users back in mumblety-95, so they stayed with IPX way past its prime, around the time that Microsoft was figuring out how to make NetBIOS-over-IP perform badly over long distances (as opposed to NetBIOS-over-NETBEUI.) While Microsoft _still_ doesn't have a clue about decent networking, they were good enough to beat Netware in the market, and small networks of either Netware or NetBEUI could both be self-configuring, a lesson we're trying to relearn for IPv6.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
"A Virtual Private Network, or VPN, is a private communications network usually used within a company, or by several different companies or organisations, communicating over a public network. VPN message traffic is carried on public networking infrastructure (ie, the Internet) using standard (possibly unsecure) protocols.
VPNs use cryptographic tunneling protocols to provide the necessary confidentiality (preventing snooping), sender authentication (preventing identity spoofing), and message integrity (preventing message alteration) to achieve the privacy intended. When properly chosen, implemented, and used, such techniques can indeed provide secure communications over unsecure networks.
Note that such choice, implementation, and use are not trivial and there are many unsecure VPN schemes on the market. Users are cautioned to investigate products they propose to use very carefully. 'VPN' is a label which, by itself, provides little except a marketing tag.
VPN technologies may also be used to enhance security as a 'security overlay' within dedicated networking infrastructures.
VPN protocols include:
* IPSec (IP security), an obligatory part of IPv6.
* PPTP (point-to-point tunneling protocol), developed by Microsoft.
* L2F (Layer 2 Forwarding), developed by Cisco.
* L2TP (Layer 2 Tunnelling Protocol), including work by both Microsoft and Cisco.
Multi-protocol label switching can be used to build VPNs."
___
internet, productivity blog
The real difference is that IPSEC is encrypting at the IP layer of the protocol stack, aka Layer 3 in OSI terms, while OpenVPN is creating a TCP Layer 4 tunnel. Inside the tunnel, IPSEC normally puts Layer 3 IP packets, while OpenVPN does something with a TUN/TAP driver on the ends, so they could be doing Layer 3 IP packets or Layer 2 Ethernet packets, and I haven't read the docs enough to know which they did. Layer 4 has more overhead, but has a potentially easier time going through NAT.
For both of these applications, you have to create an association between two endpoints, and then tell your endpoints' packet handlers to use that association when they want to get packets somewhere. The choice of protocol layers for the inside and outside of the crypto tunnel has a major impact on how you get the routing mechanisms (or whatever) to decide to set up a tunnel and send packets through it.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
OpenVPN (http://openvpn.sf.net/) is an excellent alternative to IPSec. It's using UDP or TCP as transport layer and doesn't care about NAT. You can have NAT on the both sides. The client and server share the same code and can be used on WIN32 or GNU/Linux (and more). The version 2.0 can handle routing per X.509 certificate... and much more.
Novell-Suse-... should sponsor this excellent project instead of the brain damaged(tm) IPSec.
KAME also has problems with netfilter; specifically it doesn't work with all NAT rules, which are VERY common on ipsec gateways. It also doesn't work at the interface level, so many of the advanced routing tools don't work like you'd expect (try using tc with it, on an inteface level...).
I don't know why 2.6 and the Linux ipsec-tools project standardized on KAME. It may be from BSD, but we already have better userland tools, and they already (mostly) work with the new 2.6 ipsec intefaces. Hopefully these tools will get better with time, but right now pluto/openswan are simply more mature, stable and just plain better.
The wheel is turning, but the hamster is dead.
Maybe because strongswan is a class project with no QA. Easy to get enhancements in when you don't need to bother testing them...