doc/src/intro.html

   1 <html>
   2 <head>
   3   <meta http-equiv="Content-Type" content="text/html">
   4   <title>Introduction to FreeS/WAN</title>
   5   <meta name="keywords"
   6   content="Linux, IPsec, VPN, security, FreeSWAN, introduction">
   7   <!--
   8
   9   Written by Sandy Harris for the Linux FreeS/WAN project
  10   Freely distributable under the GNU General Public License
  11
  12   More information at www.freeswan.org
  13   Feedback to users@lists.freeswan.org
  14
  15   CVS information:
  16   RCS ID:          $Id: intro.html,v 1.1 2004/03/15 20:35:24 as Exp $
  17   Last changed:    $Date: 2004/03/15 20:35:24 $
  18   Revision number: $Revision: 1.1 $
  19
  20   CVS revision numbers do not correspond to FreeS/WAN release numbers.
  21   -->
  22 </head>
  23
  24 <body>
  25 <h1><a name="intro">Introduction</a></h1>
  26
  27 <p>This section gives an overview of:</p>
  28 <ul>
  29   <li>what IP Security (IPsec) does</li>
  30   <li>how IPsec works</li>
  31   <li>why we are implementing it for Linux</li>
  32   <li>how this implementation works</li>
  33 </ul>
  34
  35 <p>This section is intended to cover only the essentials, <em>things you
  36 should know before trying to use FreeS/WAN.</em></p>
  37
  38 <p>For more detailed background information, see the <a
  39 href="politics.html#politics">history and politics</a> and
  40 <a href="ipsec.html#ipsec.detail">IPsec protocols</a> sections.</p>
  41
  42 <h2><a name="ipsec.intro">IPsec, Security for the Internet Protocol</a></h2>
  43
  44 <p>FreeS/WAN is a Linux implementation of the IPsec (IP security) protocols.
  45 IPsec provides <a href="glossary.html#encryption">encryption</a> and <a
  46 href="glossary.html#authentication">authentication</a> services at the IP
  47 (Internet Protocol) level of the network protocol stack.</p>
  48
  49 <p>Working at this level, IPsec can protect any traffic carried over IP,
  50 unlike other encryption which generally protects only a particular
  51 higher-level protocol -- <a href="glossary.html#PGP">PGP</a> for mail, <a
  52 href="glossary.html#SSH">SSH</a> for remote login, <a
  53 href="glossary.html#SSL">SSL</a> for web work, and so on. This approach has
  54 both considerable advantages and some limitations. For discussion, see our <a
  55 href="ipsec.html#others">IPsec section</a></p>
  56
  57 <p>IPsec can be used on any machine which does IP networking. Dedicated IPsec
  58 gateway machines can be installed wherever required to protect traffic. IPsec
  59 can also run on routers, on firewall machines, on various application
  60 servers, and on end-user desktop or laptop machines.</p>
  61
  62 <p>Three protocols are used</p>
  63 <ul>
  64   <li><a href="glossary.html#AH">AH</a> (Authentication Header) provides a
  65     packet-level authentication service</li>
  66   <li><a href="glossary.html#ESP">ESP</a> (Encapsulating Security Payload)
  67     provides encryption plus authentication</li>
  68   <li><a href="glossary.html#IKE">IKE</a> (Internet Key Exchange) negotiates
  69     connection parameters, including keys, for the other two</li>
  70 </ul>
  71
  72 <p>Our implementation has three main parts:</p>
  73 <ul>
  74   <li><a href="glossary.html#KLIPS">KLIPS</a> (kernel IPsec) implements AH,
  75     ESP, and packet handling within the kernel</li>
  76   <li><a href="glossary.html#Pluto">Pluto</a> (an IKE daemon) implements IKE,
  77     negotiating connections with other systems</li>
  78   <li>various scripts provide an adminstrator's interface to the
  79   machinery</li>
  80 </ul>
  81
  82 <p>IPsec is optional for the current (version 4) Internet Protocol. FreeS/WAN
  83 adds IPsec to the Linux IPv4 network stack. Implementations of <a
  84 href="glossary.html#ipv6.gloss">IP version 6</a> are required to include
  85 IPsec. Work toward integrating FreeS/WAN into the Linux IPv6 stack has <a
  86 href="compat.html#ipv6">started</a>.</p>
  87
  88 <p>For more information on IPsec, see our
  89 <a href="ipsec.html#ipsec.detail">IPsec protocols</a> section,
  90 our collection of <a href="web.html#ipsec.link">IPsec
  91 links</a> or the <a href="rfc.html#RFC">RFCs</a> which are the official
  92 definitions of these protocols.</p>
  93
  94 <h3><a name="intro.interop">Interoperating with other IPsec
  95 implementations</a></h3>
  96
  97 <p>IPsec is designed to let different implementations work together. We
  98 provide:</p>
  99 <ul>
 100   <li>a <a href="web.html#implement">list</a> of some other
 101   implementations</li>
 102   <li>information on <a href="interop.html#interop">using FreeS/WAN
 103   with other implementations</a></li>
 104 </ul>
 105
 106 <p>The VPN Consortium fosters cooperation among implementers and
 107 interoperability among implementations. Their <a
 108 href="http://www.vpnc.org/">web site</a> has much more information.</p>
 109
 110 <h3><a name="advantages">Advantages of IPsec</a></h3>
 111
 112 <p>IPsec has a number of security advantages. Here are some independently
 113 written articles which discuss these:</p>
 114
 115 <P>
 116 <A HREF="http://www.sans.org/rr/">SANS institute papers</A>. See the section
 117 on Encryption &amp;VPNs.
 118 <BR>
 119 <A HREF="http://www.cisco.com/en/US/netsol/ns110/ns170/ns171/ns128/networking_solutions_white_papers_list.html">Cisco's
 120 white papers on "Networking Solutions"</A>.
 121 <BR>
 122 <A HREF="http://iscs.sourceforge.net/HowWhyBrief/HowWhyBrief.html">
 123 Advantages of ISCS (Linux Integrated Secure Communications System;
 124 includes FreeS/WAN and other software)</A>.
 125
 126 </P>
 127
 128
 129 <h3><a name="applications">Applications of IPsec</a></h3>
 130
 131 <p>Because IPsec operates at the network layer, it is remarkably flexible and
 132 can be used to secure nearly any type of Internet traffic. Two applications,
 133 however, are extremely widespread:</p>
 134 <ul>
 135   <li>a <a href="glossary.html#VPN">Virtual Private Network</a>, or VPN,
 136     allows multiple sites to communicate securely over an insecure Internet
 137     by encrypting all communication between the sites.</li>
 138   <li>"Road Warriors" connect to the office from home, or perhaps from a
 139     hotel somewhere</li>
 140 </ul>
 141
 142 <p>There is enough opportunity in these applications that vendors are
 143 flocking to them. IPsec is being built into routers, into firewall products,
 144 and into major operating systems, primarily to support these applications.
 145 See our <a href="web.html#implement">list</a> of implementations for
 146 details.</p>
 147
 148 <p>We support both of those applications, and various less common IPsec
 149 applications as well, but we also add one of our own:</p>
 150 <ul>
 151   <li>opportunistic encryption, the ability to set up FreeS/WAN gateways so
 152     that any two of them can encrypt to each other, and will do so whenever
 153     packets pass between them.</li>
 154 </ul>
 155
 156 <p>This is an extension we are adding to the protocols. FreeS/WAN is the
 157 first prototype implementation, though we hope other IPsec implementations
 158 will adopt the technique once we demonstrate it. See <a href="#goals">project
 159 goals</a> below for why we think this is important.</p>
 160
 161 <p>A somewhat more detailed description of each of these applications is
 162 below. Our <a href="quickstart.html#quick_guide">quickstart</a> section will
 163 show you how to build each of them.</p>
 164
 165 <h4><a name="makeVPN">Using secure tunnels to create a VPN</a></h4>
 166
 167 <p>A VPN, or <strong>V</strong>irtual <strong>P</strong>rivate
 168 <strong>N</strong>etwork lets two networks communicate securely when the only
 169 connection between them is over a third network which they do not trust.</p>
 170
 171 <p>The method is to put a security gateway machine between each of the
 172 communicating networks and the untrusted network. The gateway machines
 173 encrypt packets entering the untrusted net and decrypt packets leaving it,
 174 creating a secure tunnel through it.</p>
 175
 176 <p>If the cryptography is strong, the implementation is careful, and the
 177 administration of the gateways is competent, then one can reasonably trust
 178 the security of the tunnel. The two networks then behave like a single large
 179 private network, some of whose links are encrypted tunnels through untrusted
 180 nets.</p>
 181
 182 <p>Actual VPNs are often more complex. One organisation may have fifty branch
 183 offices, plus some suppliers and clients, with whom it needs to communicate
 184 securely. Another might have 5,000 stores, or 50,000 point-of-sale devices.
 185 The untrusted network need not be the Internet. All the same issues arise on
 186 a corporate or institutional network whenever two departments want to
 187 communicate privately with each other.</p>
 188
 189 <p>Administratively, the nice thing about many VPN setups is that large parts
 190 of them are static. You know the IP addresses of most of the machines
 191 involved. More important, you know they will not change on you. This
 192 simplifies some of the admin work. For cases where the addresses do change,
 193 see the next section.</p>
 194
 195 <h4><a name="road.intro">Road Warriors</a></h4>
 196
 197 <p>The prototypical "Road Warrior" is a traveller connecting to home base
 198 from a laptop machine. Administratively, most of the same problems arise for
 199 a telecommuter connecting from home to the office, especially if the
 200 telecommuter does not have a static IP address.</p>
 201
 202 <p>For purposes of this document:</p>
 203 <ul>
 204   <li>anyone with a dynamic IP address is a "Road Warrior".</li>
 205   <li>any machine doing IPsec processing is a "gateway". Think of the
 206     single-user road warrior machine as a gateway with a degenerate subnet
 207     (one machine, itself) behind it.</li>
 208 </ul>
 209
 210 <p>These require somewhat different setup than VPN gateways with static
 211 addresses and with client systems behind them, but are basically not
 212 problematic.</p>
 213
 214 <p>There are some difficulties which appear for some road warrior
 215 connections:</p>
 216 <ul>
 217   <li>Road Wariors who get their addresses via DHCP may have a problem.
 218     FreeS/WAN can quite happily build and use a tunnel to such an address,
 219     but when the DHCP lease expires, FreeS/WAN does not know that. The tunnel
 220     fails, and the only recovery method is to tear it down and re-build
 221   it.</li>
 222   <li>If <a href="glossary.html#NAT.gloss">Network Address Translation</a>
 223     (NAT) is applied between the two IPsec Gateways, this breaks IPsec. IPsec
 224     authenticates packets on an end-to-end basis, to ensure they are not
 225     altered en route. NAT rewrites packets as they go by. See our <a
 226     href="firewall.html#NAT">firewalls</a> document for details.</li>
 227 </ul>
 228
 229 <p>In most situations, however, FreeS/WAN supports road warrior connections
 230 just fine.</p>
 231
 232 <h4><a name="opp.intro">Opportunistic encryption</a></h4>
 233
 234 <p>One of the reasons we are working on FreeS/WAN is that it gives us the
 235 opportunity to add what we call opportuntistic encryption. This means that
 236 any two FreeS/WAN gateways will be able to encrypt their traffic, even if the
 237 two gateway administrators have had no prior contact and neither system has
 238 any preset information about the other.</p>
 239
 240 <p>Both systems pick up the authentication information they need from the <a
 241 href="glossary.html#DNS">DNS</a> (domain name service), the service they
 242 already use to look up IP addresses. Of course the administrators must put
 243 that information in the DNS, and must set up their gateways with
 244 opportunistic encryption enabled. Once that is done, everything is automatic.
 245 The gateways look for opportunities to encrypt, and encrypt whatever they
 246 can. Whether they also accept unencrypted communication is a policy decision
 247 the administrator can make.</p>
 248
 249 <p>This technique can give two large payoffs:</p>
 250 <ul>
 251   <li>It reduces the administrative overhead for IPsec enormously. You
 252     configure your gateway and thereafter everything is automatic. The need
 253     to configure the system on a per-tunnel basis disappears. Of course,
 254     FreeS/WAN allows specifically configured tunnels to co-exist with
 255     opportunistic encryption, but we hope to make them unnecessary in most
 256     cases.</li>
 257   <li>It moves us toward a more secure Internet, allowing users to create an
 258     environment where message privacy is the default. All messages can be
 259     encrypted, provided the other end is willing to co-operate. See our <a
 260     href="politics.html#politics">history and politics of cryptography</a>
 261     section for discussion of why we think this is needed.</li>
 262 </ul>
 263
 264 <p>Opportunistic encryption is not (yet?) a standard part of the IPsec
 265 protocols, but an extension we are proposing and demonstrating. For details
 266 of our design, see <a href="#applied">links</a> below.</p>
 267
 268 <p>Only one current product we know of implements a form of opportunistic
 269 encryption. <a href="web.html#ssmail">Secure sendmail</a> will automatically
 270 encrypt server-to-server mail transfers whenever possible.</p>
 271
 272 <h3><a name="types">The need to authenticate gateways</a></h3>
 273
 274 <p>A complication, which applies to any type of connection -- VPN, Road
 275 Warrior or opportunistic -- is that a secure connection cannot be created
 276 magically. <em>There must be some mechanism which enables the gateways to
 277 reliably identify each other.</em> Without this, they cannot sensibly trust
 278 each other and cannot create a genuinely secure link.</p>
 279
 280 <p>Any link they do create without some form of <a
 281 href="glossary.html#authentication">authentication</a> will be vulnerable to
 282 a <a href="glossary.html#middle">man-in-the-middle attack</a>. If <a
 283 href="glossary.html#alicebob">Alice and Bob</a> are the people creating the
 284 connection, a villian who can re-route or intercept the packets can pose as
 285 Alice while talking to Bob and pose as Bob while talking to Alice. Alice and
 286 Bob then both talk to the man in the middle, thinking they are talking to
 287 each other, and the villain gets everything sent on the bogus "secure"
 288 connection.</p>
 289
 290 <p>There are two ways to build links securely, both of which exclude the
 291 man-in-the middle:</p>
 292 <ul>
 293   <li>with <strong>manual keying</strong>, Alice and Bob share a secret key
 294     (which must be transmitted securely, perhaps in a note or via PGP or SSH)
 295     to encrypt their messages. For FreeS/WAN, such keys are stored in the <a
 296     href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</a> file. Of course, if
 297     an enemy gets the key, all is lost.</li>
 298   <li>with <strong>automatic keying</strong>, the two systems authenticate
 299     each other and negotiate their own secret keys. The keys are
 300     automatically changed periodically.</li>
 301 </ul>
 302
 303 <p>Automatic keying is much more secure, since if an enemy gets one key only
 304 messages between the previous re-keying and the next are exposed. It is
 305 therefore the usual mode of operation for most IPsec deployment, and the mode
 306 we use in our setup examples. FreeS/WAN does support manual keying for
 307 special circumstanes. See this <a
 308 href="adv_config.html#prodman">section</a>.</p>
 309
 310 <p>For automatic keying, the two systems must authenticate each other during
 311 the negotiations. There is a choice of methods for this:</p>
 312 <ul>
 313   <li>a <strong>shared secret</strong> provides authentication. If Alice and
 314     Bob are the only ones who know a secret and Alice recives a message which
 315     could not have been created without that secret, then Alice can safely
 316     believe the message came from Bob.</li>
 317   <li>a <a href="glossary.html#public">public key</a> can also provide
 318     authentication. If Alice receives a message signed with Bob's private key
 319     (which of course only he should know) and she has a trustworthy copy of
 320     his public key (so that she can verify the signature), then she can
 321     safely believe the message came from Bob.</li>
 322 </ul>
 323
 324 <p>Public key techniques are much preferable, for reasons discussed <a
 325 href="config.html#choose">later</a>, and will be used in all our setup
 326 examples. FreeS/WAN does also support auto-keying with shared secret
 327 authentication. See this <a
 328 href="adv_config.html#prodsecrets">section</a>.</p>
 329
 330 <h2><a name="project">The FreeS/WAN project</a></h2>
 331
 332 <p>For complete information on the project, see our web site, <a
 333 href="http://liberty.freeswan.org">freeswan.org</a>.</p>
 334
 335 <p>In summary, we are implementing the <a
 336 href="glossary.html#IPsec">IPsec</a> protocols for Linux and extending them
 337 to do <a href="glossary.html#carpediem">opportunistic encryption</a>.</p>
 338
 339 <h3><a name="goals">Project goals</a></h3>
 340
 341 <p>Our overall goal in FreeS/WAN is to make the Internet more secure and more
 342 private.</p>
 343
 344 <p>Our IPsec implementation supports VPNs and Road Warriors of course. Those
 345 are important applications. Many users will want FreeS/WAN to build corporate
 346 VPNs or to provide secure remote access.</p>
 347
 348 <p>However, our goals in building it go beyond that. We are trying to help
 349 <strong>build security into the fabric of the Internet</strong> so that
 350 anyone who choses to communicate securely can do so, as easily as they can do
 351 anything else on the net.</p>
 352
 353 <p>More detailed objectives are:</p>
 354 <ul>
 355   <li>extend IPsec to do <a href="glossary.html#carpediem">opportunistic
 356     encryption</a> so that
 357     <ul>
 358       <li>any two systems can secure their communications without a
 359         pre-arranged connection</li>
 360       <li><strong>secure connections can be the default</strong>, falling
 361         back to unencrypted connections only if:
 362         <ul>
 363           <li><em>both</em> the partner is not set up to co-operate on
 364             securing the connection</li>
 365           <li><em>and</em> your policy allows insecure connections</li>
 366         </ul>
 367       </li>
 368       <li>a significant fraction of all Internet traffic is encrypted</li>
 369       <li>wholesale monitoring of the net (<a
 370         href="politics.html#intro.poli">examples</a>) becomes difficult or
 371         impossible</li>
 372     </ul>
 373   </li>
 374   <li>help make IPsec widespread by providing an implementation with no
 375     restrictions:
 376     <ul>
 377       <li>freely available in source code under the <a
 378         href="glossary.html#GPL">GNU General Public License</a></li>
 379       <li>running on a range of readily available hardware</li>
 380       <li>not subject to US or other nations' <a
 381         href="politics.html#exlaw">export restrictions</a>.<br>
 382         Note that in order to avoid <em>even the appearance</em> of being
 383         subject to those laws, the project cannot accept software
 384         contributions -- <em>not even one-line bug fixes</em> -- from US
 385         residents or citizens.</li>
 386     </ul>
 387   </li>
 388   <li>provide a high-quality IPsec implementation for Linux
 389     <ul>
 390       <li>portable to all CPUs Linux supports: <a
 391         href="compat.html#CPUs">(current list)</a></li>
 392       <li>interoperable with other IPsec implementations: <a
 393         href="interop.html#interop">(current list)</a></li>
 394     </ul>
 395   </li>
 396 </ul>
 397
 398 <p>If we can get opportunistic encryption implemented and widely deployed,
 399 then it becomes impossible for even huge well-funded agencies to monitor the
 400 net.</p>
 401
 402 <p>See also our section on <a href="politics.html#politics">history and
 403 politics</a> of cryptography, which includes our project leader's <a
 404 href="politics.html#gilmore">rationale</a> for starting the project.</p>
 405
 406 <h3><a name="staff">Project team</a></h3>
 407
 408 <p>Two of the team are from the US and can therefore contribute no code:</p>
 409 <ul>
 410   <li>John Gilmore: founder and policy-maker (<a
 411     href="http://www.toad.com/gnu/">home page</a>)</li>
 412   <li>Hugh Daniel: project manager, Most Demented Tester, and occasionally
 413     Pointy-Haired Boss</li>
 414 </ul>
 415
 416 <p>The rest of the team are Canadians, working in Canada. (<a
 417 href="politics.html#status">Why Canada?</a>)</p>
 418 <ul>
 419   <li>Hugh Redelmeier: <a href="glossary.html#Pluto">Pluto daemon</a>
 420     programmer</li>
 421   <li>Richard Guy Briggs: <a href="glossary.html#KLIPS">KLIPS</a>
 422   programmer</li>
 423   <li>Michael Richardson: hacker without portfolio</li>
 424   <li>Claudia Schmeing: documentation</li>
 425   <li>Sam Sgro: technical support via the <a href="mail.html#lists">mailing
 426     lists</a></li>
 427 </ul>
 428
 429 <p>The project is funded by civil libertarians who consider our goals
 430 worthwhile. Most of the team are paid for this work.</p>
 431
 432 <p>People outside this core team have made substantial contributions. See</p>
 433 <ul>
 434   <li>our <a href="../CREDITS">CREDITS</a> file</li>
 435   <li>the <a href="web.html#patch">patches and add-ons</a> section of our web
 436     references file</li>
 437   <li>lists below of user-written <a href="#howto">HowTos</a> and <a
 438     href="#applied">other papers</a></li>
 439 </ul>
 440
 441 <p>Additional contributions are welcome. See the <a
 442 href="faq.html#contrib.faq">FAQ</a> for details.</p>
 443
 444 <h2><a name="products">Products containing FreeS/WAN</a></h2>
 445
 446 <p>Unfortunately the <a href="politics.html#exlaw">export laws</a> of some
 447 countries restrict the distribution of strong cryptography. FreeS/WAN is
 448 therefore not in the standard Linux kernel and not in all CD or web
 449 distributions.</p>
 450
 451 <p>FreeS/WAN is, however, quite widely used. Products we know of that use it
 452 are listed below. We would appreciate hearing, via the <a
 453 href="mail.html#lists">mailing lists</a>, of any we don't know of.</p>
 454
 455 <h3><a name="distwith">Full Linux distributions</a></h3>
 456
 457 <p>FreeS/WAN is included in various general-purpose Linux distributions,
 458 mostly from countries (shown in brackets) with more sensible laws:</p>
 459 <ul>
 460   <li><a href="http://www.suse.com/">SuSE Linux</a> (Germany)</li>
 461   <li><a href="http://www.conectiva.com">Conectiva</a> (Brazil)</li>
 462   <li><a href="http://www.linux-mandrake.com/en/">Mandrake</a> (France)</li>
 463   <li><a href="http://www.debian.org">Debian</a></li>
 464   <li>the <a href="http://www.pld.org.pl/">Polish(ed) Linux Distribution</a>
 465     (Poland)</li>
 466   <li><a>Best Linux</a> (Finland)</li>
 467 </ul>
 468
 469 <p>For distributions which do not include FreeS/WAN and are not Redhat (which
 470 we develop and test on), there is additional information in our <a
 471 href="compat.html#otherdist">compatibility</a> section.</p>
 472
 473 <p>The server edition of <a href="http://www.corel.com">Corel</a> Linux
 474 (Canada) also had FreeS/WAN, but Corel have dropped that product line.</p>
 475
 476 <h3><a name="kernel_dist">Linux kernel distributions</a></h3>
 477
 478 <ul>
 479 <li><a href="http://sourceforge.net/projects/wolk/">Working Overloaded Linux Kernel (WOLK)</a></li>
 480 </ul>
 481
 482
 483 <h3><a name="office_dist">Office server distributions</a></h3>
 484
 485 <p>FreeS/WAN is also included in several distributions aimed at the market
 486 for turnkey business servers:</p>
 487 <ul>
 488   <li><a href="http://www.e-smith.com/">e-Smith</a> (Canada), which has
 489     recently been acquired and become the Network Server Solutions group of
 490     <a href="http://www.mitel.com/">Mitel Networks</a> (Canada)</li>
 491   <li><a href="http://www.clarkconnect.org/">ClarkConnect</a> from Point Clark Networks (Canada)</li>
 492   <li><a href="http://www.trustix.net/">Trustix Secure Linux</a> (Norway)</li>
 493
 494 </ul>
 495
 496 <h3><a name="fw_dist">Firewall distributions</a></h3>
 497
 498 <p>Several distributions intended for firewall and router applications
 499 include FreeS/WAN:</p>
 500 <ul>
 501   <li>The <a href="http://www.linuxrouter.org/">Linux Router Project</a>
 502     produces a Linux distribution that will boot from a single floppy. The <a
 503     href="http://leaf.sourceforge.net">LEAF</a> firewall project provides
 504     several different LRP-based firewall packages. At least one of them,
 505     Charles Steinkuehler's Dachstein, includes FreeS/WAN with X.509
 506   patches.</li>
 507   <li>there are several distributions bootable directly from CD-ROM, usable
 508     on a machine without hard disk.
 509     <ul>
 510       <li>Dachstein (see above) can be used this way</li>
 511       <li><a href="http://www.gibraltar.at/">Gibraltar</a> is based on Debian
 512         GNU/Linux.</li>
 513       <li>at time of writing, <a href="www.xiloo.com">Xiloo</a> is available
 514         only in Chinese. An English version is expected.</li>
 515     </ul>
 516   </li>
 517   <li><a href="http://www.astaro.com/products/index.html">Astaro Security
 518     Linux</a> includes FreeS/WAN. It has some web-based tools for managing
 519     the firewall that include FreeS/WAN configuration management.</li>
 520   <li><a href="http://www.linuxwall.de">Linuxwall</a></li>
 521   <li><a href="http://www.smoothwall.org/">Smoothwall</a></li>
 522   <li><a href="http://www.devil-linux.org/">Devil Linux</a></li>
 523   <li>Coyote Linux has a <a
 524     href="http://embedded.coyotelinux.com/wolverine/index.php">Wolverine</a>
 525     firewall/VPN server</li>
 526 </ul>
 527
 528 <p>There are also several sets of scripts available for managing a firewall
 529 which is also acting as a FreeS/WAN IPsec gateway. See this <a
 530 href="firewall.html#rules.pub">list</a>.</p>
 531
 532 <h3><a name="turnkey">Firewall and VPN products</a></h3>
 533
 534 <p>Several vendors use FreeS/WAN as the IPsec component of a turnkey firewall
 535 or VPN product.</p>
 536
 537 <p>Software-only products:</p>
 538 <ul>
 539   <li><a href="http://www.linuxmagic.com/vpn/index.html">Linux Magic</a>
 540     offer a VPN/Firewall product using FreeS/WAN</li>
 541   <li>The Software Group's <a
 542     href="http://www.wanware.com/sentinet/">Sentinet</a> product uses
 543     FreeS/WAN</li>
 544   <li><a href="http://www.merilus.com">Merilus</a> use FreeS/WAN in their
 545     Gateway Guardian firewall product</li>
 546 </ul>
 547
 548 <p>Products that include the hardware:</p>
 549 <ul>
 550   <li>The <a href="http://www.lasat.com">LASAT SafePipe[tm]</a> series. is an
 551     IPsec box based on an embedded MIPS running Linux with FreeS/WAN and a
 552     web-config front end. This company also host our freeswan.org web
 553   site.</li>
 554   <li>Merilus <a
 555     href="http://www.merilus.com/products/fc/index.shtml">Firecard</a> is a
 556     Linux firewall on a PCI card.</li>
 557   <li><a href="http://www.kyzo.com/">Kyzo</a> have a "pizza box" product line
 558     with various types of server, all running from flash. One of them is an
 559     IPsec/PPTP VPN server</li>
 560   <li><a href="http://www.pfn.com">PFN</a> use FreeS/WAN in some of their
 561     products</li>
 562 </ul>
 563
 564 <p><a href="www.rebel.com">Rebel.com</a>, makers of the Netwinder Linux
 565 machines (ARM or Crusoe based), had a product that used FreeS/WAN. The
 566 company is in receivership so the future of the Netwinder is at best unclear.
 567 <a href="web.html#patch">PKIX patches</a> for FreeS/WAN developed at Rebel
 568 are listed in our web links document.</p>
 569
 570
 571 <h2><a name="docs">Information sources</a></h2>
 572
 573 <h3><a name="docformats">This HowTo, in multiple formats</a></h3>
 574
 575 <p>FreeS/WAN documentation up to version 1.5 was available only in HTML. Now
 576 we ship two formats:</p>
 577 <ul>
 578   <li>as HTML, one file for each doc section plus a global <a
 579     href="toc.html">Table of Contents</a></li>
 580   <li><a href="HowTo.html">one big HTML file</a> for easy searching</li>
 581 </ul>
 582
 583 <p>and provide a Makefile to generate other formats if required:</p>
 584 <ul>
 585   <li><a href="HowTo.pdf">PDF</a></li>
 586   <li><a href="HowTo.ps">Postscript</a></li>
 587   <li><a href="HowTo.txt">ASCII text</a></li>
 588 </ul>
 589
 590 <p>The Makefile assumes the htmldoc tool is available. You can download it
 591 from <a href="http://www.easysw.com">Easy Software</a>.</p>
 592
 593 <p>All formats should be available at the following websites:</p>
 594 <ul>
 595   <li><a href="http://www.freeswan.org/doc.html">FreeS/WAN project</a></li>
 596   <li><a href="http://www.linuxdoc.org">Linux Documentation Project</a></li>
 597 </ul>
 598
 599 <p>The distribution tarball has only the two HTML formats.</p>
 600
 601 <p><strong>Note:</strong> If you need the latest doc version, for example to
 602 see if anyone has managed to set up interoperation between FreeS/WAN and
 603 whatever, then you should download the current snapshot. What is on the web
 604 is documentation as of the last release. Snapshots have all changes I've
 605 checked in to date.</p>
 606
 607 <h3><a name="rtfm">RTFM (please Read The Fine Manuals)</a></h3>
 608
 609 <p>As with most things on any Unix-like system, most parts of Linux FreeS/WAN
 610 are documented in online manual pages. We provide a list of <a
 611 href="/mnt/floppy/manpages.html">FreeS/WAN man pages</a>, with links to HTML
 612 versions of them.</p>
 613
 614 <p>The man pages describing configuration files are:</p>
 615 <ul>
 616   <li><a href="/mnt/floppy/manpage.d/ipsec.conf.5.html">ipsec.conf(5)</a></li>
 617   <li><a
 618     href="/mnt/floppy/manpage.d/ipsec.secrets.5.html">ipsec.secrets(5)</a></li>
 619 </ul>
 620
 621 <p>Man pages for common commands include:</p>
 622 <ul>
 623   <li><a href="/mnt/floppy/manpage.d/ipsec.8.html">ipsec(8)</a></li>
 624   <li><a
 625   href="/mnt/floppy/manpage.d/ipsec_pluto.8.html">ipsec_pluto(8)</a></li>
 626   <li><a
 627     href="/mnt/floppy/manpage.d/ipsec_newhostkey.8.html">ipsec_newhostkey(8)</a></li>
 628   <li><a href="/mnt/floppy/manpage.d/ipsec_auto.8.html">ipsec_auto(8)</a></li>
 629 </ul>
 630
 631 <p>You can read these either in HTML using the links above or with the
 632 <var>man(1)</var> command.</p>
 633
 634 <p>In the event of disagreement between this HTML documentation and the man
 635 pages, the man pages are more likely correct since they are written by the
 636 implementers. Please report any such inconsistency on the <a
 637 href="mail.html#lists">mailing list</a>.</p>
 638
 639 <h3><a name="text">Other documents in the distribution</a></h3>
 640
 641 <p>Text files in the main distribution directory are README, INSTALL,
 642 CREDITS, CHANGES, BUGS and COPYING.</p>
 643
 644 <p>The Libdes encryption library we use has its own documentation. You can
 645 find it in the library directory..</p>
 646
 647 <h3><a name="assumptions">Background material</a></h3>
 648
 649 <p>Throughout this documentation, I write as if the reader had at least a
 650 general familiarity with Linux, with Internet Protocol networking, and with
 651 the basic ideas of system and network security. Of course that will certainly
 652 not be true for all readers, and quite likely not even for a majority.</p>
 653
 654 <p>However, I must limit amount of detail on these topics in the main text.
 655 For one thing, I don't understand all the details of those topics myself.
 656 Even if I did, trying to explain everything here would produce extremely long
 657 and almost completely unreadable documentation.</p>
 658
 659 <p>If one or more of those areas is unknown territory for you, there are
 660 plenty of other resources you could look at:</p>
 661 <dl>
 662   <dt>Linux</dt>
 663     <dd>the <a href="http://www.linuxdoc.org">Linux Documentation Project</a>
 664       or a local <a href="http://www.linux.org/groups/">Linux User Group</a>
 665       and these <a href="web.html#linux.link">links</a></dd>
 666   <dt>IP networks</dt>
 667     <dd>Rusty Russell's <a
 668       href="http://netfilter.samba.org/unreliable-guides/networking-concepts-HOWTO/index.html">Networking
 669       Concepts HowTo</a> and these <a
 670     href="web.html#IP.background">links</a></dd>
 671   <dt>Security</dt>
 672     <dd>Schneier's book <a href="biblio.html#secrets">Secrets and Lies</a>
 673       and these <a href="web.html#crypto.link">links</a></dd>
 674 </dl>
 675
 676 <p>Also, I do make an effort to provide some background material in these
 677 documents. All the basic ideas behind IPsec and FreeS/WAN are explained here.
 678 Explanations that do not fit in the main text, or that not everyone will
 679 need, are often in the <a href="glossary.html#ourgloss">glossary</a>, which is
 680 the largest single file in this document set. There is also a <a
 681 href="background.html#background">background</a> file containing various
 682 explanations too long to fit in glossary definitions. All files are heavily
 683 sprinkled with links to each other and to the glossary. <strong>If some passage
 684 makes no sense to you, try the links</strong>.</p>
 685
 686 <p>For other reference material, see the <a
 687 href="biblio.html#biblio">bibliography</a> and our collection of <a
 688 href="web.html#weblinks">web links</a>.</p>
 689
 690 <p>Of course, no doubt I get this (and other things) wrong sometimes.
 691 Feedback via the <a href="mail.html#lists">mailing lists</a> is welcome.</p>
 692
 693 <h3><a name="archives">Archives of the project mailing list</a></h3>
 694
 695 <p>Until quite recently, there was only one FreeS/WAN mailing list, and
 696 archives of it were:</p>
 697 <ul>
 698   <li><a href="http://www.sandelman.ottawa.on.ca/linux-ipsec">Canada</a></li>
 699   <li><a href="http://www.nexial.com">Holland</a></li>
 700 </ul>
 701 The two archives use completely different search engines. You might want to
 702 try both.
 703
 704 <p>More recently we have expanded to five lists, each with its own
 705 archive.</p>
 706
 707 <p><a href="mail.html#lists">More information</a> on mailing lists.</p>
 708
 709 <h3><a name="howto">User-written HowTo information</a></h3>
 710
 711 <p>Various user-written HowTo documents are available. The ones covering
 712 FreeS/WAN-to-FreeS/WAN connections are:</p>
 713 <ul>
 714   <li>Jean-Francois Nadeau's <a href="http://jixen.tripod.com/">practical
 715     configurations</a> document</li>
 716   <li>Jens Zerbst's HowTo on <a href="http://dynipsec.tripod.com/">Using
 717     FreeS/WAN with dynamic IP addresses</a>.</li>
 718   <li>an entry in Kurt Seifried's <a
 719     href="http://www.securityportal.com/lskb/kben00000013.html">Linux
 720     Security Knowledge Base</a>.</li>
 721   <li>a section of David Ranch's <a
 722     href="http://www.ecst.csuchico.edu/~dranch/LINUX/index-linux.html#trinityos">Trinity
 723     OS Guide</a></li>
 724   <li>a section in David Bander's book <a href="biblio.html#bander">Linux
 725     Security Toolkit</a></li>
 726 </ul>
 727
 728 <p>User-wriiten HowTo material may be <strong>especially helpful if you need
 729 to interoperate with another IPsec implementation</strong>. We have neither
 730 the equipment nor the manpower to test such configurations. Users seem to be
 731 doing an admirable job of filling the gaps.</p>
 732 <ul>
 733   <li>list of user-written <a href="interop.html#otherpub">interoperation
 734     HowTos</a> in our interop document</li>
 735 </ul>
 736
 737 <p>Check what version of FreeS/WAN user-written documents cover. The software
 738 is under active development and the current version may be significantly
 739 different from what an older document describes.</p>
 740
 741 <h3><a name="applied">Papers on FreeS/WAN</a></h3>
 742
 743 <p>Two design documents show team thinking on new developments:</p>
 744 <ul>
 745   <li><a href="opportunism.spec">Opportunistic Encryption</a> by technical
 746     lead Henry Spencer and Pluto programmer Hugh Redelemeier</li>
 747   <li>discussion of <a
 748     href="http://www.sandelman.ottawa.on.ca/SSW/freeswan/klips2req/">KLIPS
 749     redesign</a></li>
 750 </ul>
 751
 752 <p>Both documents are works in progress and are frequently revised. For the
 753 latest version, see the <a href="mail.html#lists">design mailing list</a>. Comments
 754 should go to that list.</p>
 755
 756 <p>There is now an <a
 757 href="http://www.ietf.org/internet-drafts/draft-richardson-ipsec-opportunistic-06.txt">Internet
 758 Draft on Opportunistic Encryption</a> by Michael Richardson, Hugh Redelmeier
 759 and Henry Spencer. This is a first step toward getting the protocol
 760 standardised so there can be multiple implementations of it. Discussion of it
 761 takes place on the <a
 762 href="http://www.ietf.org/html.charters/ipsec-charter.html">IETF IPsec
 763 Working Group</a> mailing list.</p>
 764
 765 <p>A number of papers giving further background on FreeS/WAN, or exploring
 766 its future or its applications, are also available:</p>
 767 <ul>
 768   <li>Both Henry and Richard gave talks on FreeS/WAN at the 2000 <a
 769     href="http://www.linuxsymposium.org">Ottawa Linux Symposium</a>.
 770     <ul>
 771       <li>Richard's <a
 772         href="http://www.conscoop.ottawa.on.ca/rgb/freeswan/ols2k/">slides</a></li>
 773       <li>Henry's paper</li>
 774       <li>MP3 audio of their talks is available from the <a
 775         href="http://www.linuxsymposium.org/">conference page</a></li>
 776     </ul>
 777   </li>
 778   <li><cite>Moat: A Virtual Private Network Appliances and Services
 779     Platform</cite> is a paper about large-scale (a few 100 links) use of
 780     FreeS/WAN in a production application at AT&amp;T Research. It is
 781     available in Postscript or PDF from co-author Steve Bellovin's <a
 782     href="http://www.research.att.com/~smb/papers/index.html">papers list
 783     page</a>.</li>
 784   <li>One of the Moat co-authors, John Denker, has also written
 785     <ul>
 786       <li>a <a
 787         href="http://www.av8n.com/vpn/ipsec+routing.htm">proposal</a>
 788         for how future versions of FreeS/WAN might interact with routing
 789         protocols</li>
 790       <li>a <a
 791         href="http://www.av8n.com/vpn/wishlist.htm">wishlist</a>
 792         of possible new features</li>
 793     </ul>
 794   </li>
 795   <li>Bart Trojanowski's web page has a draft design for <a
 796     href="http://www.jukie.net/~bart/linux-ipsec/">hardware acceleration</a>
 797     of FreeS/WAN</li>
 798 </ul>
 799
 800 <p>Several of these provoked interesting discussions on the mailing lists,
 801 worth searching for in the <a href="mail.html#archive">archives</a>.</p>
 802
 803 <p>There are also several papers in languages other than English, see our <a
 804 href="web.html#otherlang">web links</a>.</p>
 805
 806 <h3><a name="licensing">License and copyright information</a></h3>
 807
 808 <p>All code and documentation written for this project is distributed under
 809 either the GNU General Public License (<a href="glossary.html#GPL">GPL</a>)
 810 or the GNU Library General Public License. For details see the COPYING file
 811 in the distribution.</p>
 812
 813 <p>Not all code in the distribution is ours, however. See the CREDITS file
 814 for details. In particular, note that the <a
 815 href="glossary.html#LIBDES">Libdes</a> library and the version of <a
 816 href="glossary.html#MD5">MD5</a> that we use each have their own license.</p>
 817
 818 <h2><a name="sites">Distribution sites</a></h2>
 819
 820 <p>FreeS/WAN is available from a number of sites.</p>
 821
 822 <h3>Primary site</h3>
 823
 824 <p>Our primary site, is at xs4all (Thanks, folks!) in Holland:</p>
 825 <ul>
 826   <li><a href="http://www.xs4all.nl/~freeswan">HTTP</a></li>
 827   <li><a href="ftp://ftp.xs4all.nl/pub/crypto/freeswan">FTP</a></li>
 828 </ul>
 829
 830 <h3><a name="mirrors">Mirrors</a></h3>
 831
 832 <p>There are also mirror sites all over the world:</p>
 833 <ul>
 834   <li><a href="http://www.flora.org/freeswan">Eastern Canada</a> (limited
 835     resouces)</li>
 836   <li><a href="ftp://ludwig.doculink.com/pub/freeswan/">Eastern Canada</a>
 837     (has older versions too)</li>
 838   <li><a href="ftp://ntsc.notBSD.org/pub/crypto/freeswan/">Eastern Canada</a>
 839     (has older versions too)</li>
 840   <li><a href="ftp://ftp.kame.net/pub/freeswan/">Japan</a></li>
 841   <li><a href="ftp://ftp.futuredynamics.com/freecrypto/FreeSWAN/">Hong
 842     Kong</a></li>
 843   <li><a href="ftp://ipsec.dk/pub/freeswan/">Denmark</a></li>
 844   <li><a href="ftp://ftp.net.lut.ac.uk/freeswan">the UK</a></li>
 845   <li><a href="http://storm.alert.sk/comp/mirrors/freeswan/">Slovak
 846     Republic</a></li>
 847   <li><a
 848     href="http://the.wiretapped.net/security/vpn-tunnelling/freeswan/">Australia</a></li>
 849   <li><a href="http://freeswan.technolust.cx/">technolust</a></li>
 850   <li><a href="http://freeswan.devguide.de/">Germany</a></li>
 851   <li>Ivan Moore's <a href="http://snowcrash.tdyc.com/freeswan/">site</a></li>
 852   <li>the <a href="http://www.cryptoarchive.net/">Crypto Archive</a> on the
 853     <a href="http://www.securityportal.com/">Security Portal</a> site</li>
 854   <li><a href="http://www.wiretapped.net/">Wiretapped.net</a> in
 855   Australia</li>
 856 </ul>
 857
 858 <p>Thanks to those folks as well.</p>
 859
 860 <h3><a name="munitions">The "munitions" archive of Linux crypto
 861 software</a></h3>
 862
 863 <p>There is also an archive of Linux crypto software called "munitions", with
 864 its own mirrors in a number of countries. It includes FreeS/WAN, though not
 865 always the latest version. Some of its sites are:</p>
 866 <ul>
 867   <li><a href="http://munitions.vipul.net/">Germany</a></li>
 868   <li><a href="http://munitions.iglu.cjb.net/">Italy</a></li>
 869   <li><a href="http://munitions2.xs4all.nl/">Netherlands</a></li>
 870 </ul>
 871
 872 <p>Any of those will have a list of other "munitions" mirrors. There is also
 873 a CD available.</p>
 874
 875 <h2>Links to other sections</h2>
 876
 877 <p>For more detailed background information, see:</p>
 878 <ul>
 879   <li><a href="politics.html#politics">history and politics</a> of
 880    cryptography</li>
 881   <li><a href="ipsec.html#ipsec.detail">IPsec protocols</a></li>
 882 </ul>
 883
 884 <p>To begin working with FreeS/WAN, go to our <a
 885 href="quickstart.html#quick.guide">quickstart</a> guide.</p>
 886 </body>
 887 </html>