IPSEC is Internet Protocol SECurity. It uses strong
cryptography to provide both authentication and encryption services.
Authentication ensures that packets are from the right sender and have not been
altered in transit. Encryption prevents unauthorised reading of packet contents.
These services allow you to build secure tunnels through untrusted
networks. Everything passing through the untrusted net is encrypted by
the IPSEC gateway machine and decrypted by the gateway at the other end. The
result is Virtual Private Network or VPN. This is a network
which is effectively private even though it includes machines at several
different sites connected by the insecure Internet.
For more info, see the FreeS/WAN web site
IPSec 1.5 LRP package
|All are Eiger, version 2.2.16-1
||For floppy only systems
||IDE support built-in
||Full 'Eiger' settings
||Eiger kernel (2.2.16-1)
||EigerBeta kernel (2.2.15pre5)
- To use this package, you need to use an IPSec enabled kernel. The
kernel above is version 2.2.16-1 (Eiger) and contains the IPSec patches.
Copy the IPSec kernel above to your LRP floppy disk (name the file 'linux'),
and add the ipsec.lrp package to your system as usual.
- Configuration is done through the /etc/ipsec.conf configuration file and
/etc/ipsec.secrets secrets file
- WARNING - The config and secrets files require PROPER FORMATTING.
See the links below for details.
- There is extensive online
documentation covering all aspects of installation, configuring, and
testing available at the FreeS/WAN web site.
PLEASE READ THIS!
- Make sure you allow the ISPec packets through your firewall...see the freeswan
firewall documentation for details.
- You must allow UDP packets to/from port 500 between your
LRP box and the remote system. Add something like the following to
network.conf (see network.conf documentation
- You must also allow ESP (protocol 50) and/or AH (protocol 51)
packets through your firewall. This is now done automatically if
you specify leftfirewall or rightfirewall (as appropriate) in
ipsec.conf (LRP customization thanks to Mike Stankavich).
- You must create proper forward rules for your VPN traffic.
Again, if you use the leftfirewall or rightfirewall settings in
ipsec.conf, this is handled automatically (standard FreeS/WAN feature
modified to use ipchains for LRP).
- WHERE'S The latest version? I am specifically NOT packaging FreeS/WAN
Version 1.6 or 1.7 for LRP. There are many internal updates happening to
IPSec (support for IPV6, packet compression, etc), and the FreeS/WAN
developers have proclaimed on their own mailing list that the 1.6 version is
quite a bit more 'experimental' than previous versions. When things
stabalize a bit, I will package an updated version. From the FreeS/WAN
1.5 is a "plateau release", which has been extensively tested to prove its
stability, and so is still a good choice for a high-stress production
environment. While 1.7 has so far been reliable, it has not yet been subjected
to the rigorous testing or community feedback that 1.5 has.
The changes since 1.5, while certainly moving in important directions,
may not have so much immediate benefit that upgrading would be best for
you. If you like, download the latest source just to have a look at
- This package replaces my previous IPSec packages. The earlier
versions are still available (see the download link, above). Sept
9, 2000 - Added correct version of ipsec script to LRP package (now
startup indicates version 1.5, not 1.4), and folded in changes to _updown
script provided by Mike Stankavich.
- The klips code is not compiled as a module, it is embedded in the kernel,
so you do not need to modify your modules configuration when installing
- Three versions of the IPSec enabled kernel are now provided...the
traditional floppy-only kernel, an IDE capable kernel, and the 'full-blown'
Eiger kernel. Use whichever is most appropriate for your system.
- Package size was reduced by stripping all binaries, and switching to mawk
instead of gawk.
- When debugging IPSec, refer to to /var/log/auth.log instead of
/var/log/secure as specified in the documentation. LRP and debian systems do not use /var/log/secure,
but the same info gets sent to /var/log/auth.log
- Modifications to the FreeS/WAN distribution scripts were made for the LRP environment:
- Add code to make /dev/ipsec
- Used old procedure for verifying permissions, as 'id' command is
not fully implemented in LRP
- startklips() - Change module loading code from depmod and modprobe
- defaultinterface() - Replace wc command with some shell script
- klipsinterface() - Replace expr commands with sed
- Change ipfwadm commands to ipchains (2 places)
- Added commands to allow ESP and AH packets through firewall if
left/right firewall setting specified in ipsec.conf
- sort commands removed or replaced with cat (3 places)
- Change ipfwadm commands to ipchains (2 places)
- WARNING - FreeS/WAN includes many scripts to do a wide variety of
setup and configuration. I have attempted to port the scripts cleanly
to the limited environment available on LRP, but I have not and can not
extensively test all aspects of the scripts. I know the core IPSec
functionality works, as I am running a VPN using these exact files (except
for ipsec.conf and ipsec.secrets). If you discover and fix any
problems with the scripts, please let me know so I can include them in
- 'Clients' - The FreeS/WAN IPSec software works with a wide variety
of other IPSec implementations. See the compatibility section of the
documentation for details. If you want a free windows based IPSec
connection (just use FreeS/WAN for a free linux solution), you might want to
look at the freeware version
8/21/00 16:21 504,938 2.2.16-1-LRP-FloppyImage-IPSec-1.5-zImage
8/21/00 16:21 529,184 2.2.16-1-LRP-IDE-IPSec-1.5-bzImage
8/21/00 16:21 547,137 2.2.16-1-LRP-IPSec-1.5-bzImage
9/11/00 15:14 322,844 ipsec.lrp
-rwxr-xr-x root/root 109988 Aug 21 11:14 2000 bin/mawk
lrwxrwxrwx root/root 0 Sep 11 15:13 2000 bin/awk -> /bin/mawk
-rwxr-xr-x root/root 69444 May 09 20:45 1998 bin/egrep
-rwxr-xr-x root/root 19008 Apr 23 23:43 1998 usr/bin/tr
-rwxr-xr-x root/root 7932 Jan 24 11:40 2000 usr/bin/column
-rwxr-xr-x root/root 28348 Mar 14 00:41 2000 sbin/ifconfig
-rwxr-xr-x root/root 24368 Mar 14 00:41 2000 sbin/route
-rw-r--r-- root/root 1641 Aug 21 11:13 2000 etc/ipsec.conf
-rw------- root/root 4441 Aug 21 11:13 2000 etc/ipsec.secrets
-rwxr-xr-x root/root 13513 Aug 21 10:03 2000 etc/init.d/ipsec
-rwxr-xr-x root/root 2346 Aug 21 09:22 2000 usr/local/sbin/ipsec
drwxr-xr-x root/root 0 Sep 11 15:13 2000 usr/local/lib/ipsec/
-rwxr-xr-x root/root 8719 Aug 21 10:05 2000 usr/local/lib/ipsec/_confread
-rwxr-xr-x root/root 2124 Aug 21 10:05 2000 usr/local/lib/ipsec/_include
-rwxr-xr-x root/root 1342 Aug 21 10:05 2000 usr/local/lib/ipsec/_keycensor
-rwxr-xr-x root/root 1860 Aug 21 10:05 2000 usr/local/lib/ipsec/_secretcensor
-rwxr-xr-x root/root 4089 Sep 11 07:06 2000 usr/local/lib/ipsec/_updown
-rwxr-xr-x root/root 9315 Aug 21 10:05 2000 usr/local/lib/ipsec/auto
-rwxr-xr-x root/root 4319 Aug 21 10:05 2000 usr/local/lib/ipsec/barf
-rwxr-xr-x root/root 44620 Aug 21 10:05 2000 usr/local/lib/ipsec/eroute
-rwxr-xr-x root/root 2346 Aug 21 10:05 2000 usr/local/lib/ipsec/ipsec
-rwxr-xr-x root/root 36732 Aug 21 10:05 2000 usr/local/lib/ipsec/klipsdebug
-rwxr-xr-x root/root 1993 Aug 21 10:05 2000 usr/local/lib/ipsec/look
-rwxr-xr-x root/root 13886 Aug 21 10:05 2000 usr/local/lib/ipsec/manual
-rwxr-xr-x root/root 221860 Aug 21 10:05 2000 usr/local/lib/ipsec/pluto
-rwxr-xr-x root/root 6476 Aug 21 10:05 2000 usr/local/lib/ipsec/ranbits
-rwxr-xr-x root/root 44200 Aug 21 10:05 2000 usr/local/lib/ipsec/rsasigkey
lrwxrwxrwx root/root 0 Sep 11 15:13 2000 usr/local/lib/ipsec/setup -> /etc/init.d/ipsec
-rwxr-xr-x root/root 865 Aug 21 10:05 2000 usr/local/lib/ipsec/showdefaults
-rwxr-xr-x root/root 52444 Aug 21 10:05 2000 usr/local/lib/ipsec/spi
-rwxr-xr-x root/root 38768 Aug 21 10:05 2000 usr/local/lib/ipsec/spigrp
-rwxr-xr-x root/root 8832 Aug 21 10:05 2000 usr/local/lib/ipsec/tncfg
-rwxr-xr-x root/root 20152 Aug 21 10:05 2000 usr/local/lib/ipsec/whack
-rwxr-xr-x root/root 1621 Aug 21 10:05 2000 usr/local/lib/ipsec/showhostkey
-rw-r--r-- root/root 87 Feb 25 11:15 2000 var/lib/lrpkg/ipsec.conf
-rw-r--r-- root/root 1776 Aug 21 10:12 2000 var/lib/lrpkg/ipsec.help
-rw-r--r-- root/root 191 Aug 21 11:13 2000 var/lib/lrpkg/ipsec.list
-rw-r--r-- root/root 4 Aug 21 10:09 2000 var/lib/lrpkg/ipsec.version