From: Michael Tremer Date: Sun, 20 Aug 2017 11:10:39 +0000 (+0200) Subject: man: Add documentation for VPN security policies X-Git-Tag: 010~189 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=bec94f95fe6fc4b01baf8eae5a07155593a5c3e8;p=network.git man: Add documentation for VPN security policies Fixes #11426 Signed-off-by: Michael Tremer --- diff --git a/Makefile.am b/Makefile.am index c963b7c8..c18c460a 100644 --- a/Makefile.am +++ b/Makefile.am @@ -347,6 +347,8 @@ MANPAGES = \ man/network-route.8 \ man/network-route-static.8 \ man/network-settings.8 \ + man/network-vpn.8 \ + man/network-vpn-security-policies.8 \ man/network-zone.8 \ man/network-zone-6to4-tunnel.8 \ man/network-zone-bridge.8 \ diff --git a/man/network-vpn-security-policies.xml b/man/network-vpn-security-policies.xml new file mode 100644 index 00000000..a2f91430 --- /dev/null +++ b/man/network-vpn-security-policies.xml @@ -0,0 +1,295 @@ + + + + + + network-vpn-security-policies + network + + + + Developer + Michael + Tremer + michael.tremer@ipfire.org + + + + + + network-vpn-security-policies + 8 + + + + network-vpn-security-policies + Network Configuration Control Program + + + + + network vpn security-policies [new|destroy] NAME ... + + + + network vpn security-policies NAME command ... + + + + + Description + + + With help of the vpn security-policies, it is possible + to create, destroy and edit VPN security policies. + + + A security policy is a definition of ciphers and algorithms for integrity + and key-exchanges for VPN connections. + + + + + Commands + + + The following commands are understood: + + + + + + new NAME + + + + + A new security policy may be created with the + new command. + + + + NAME does not allow any spaces. + + + + + + + destroy NAME + + + + + A security policy can be destroyed with this command. + + + If the policy is still in use, it cannot be deleted. + + + + + + + For all other commands, the name of the security policy needs to be passed first: + + + + + + NAME show + + + + + Shows the configuration of the security policy. + + + + + + + NAME key-exchange [IKEv2|IKEv1] + + + + + Defines the key exchange algorithm that should be used to + initiate an IPsec VPN connection. + + + + + + + NAME ciphers [CIPHER-LIST|+CIPHER ...|-CIPHER ...] + + + + + This command allows modifying the cipher list. + + + + A new CIPHER-LIST can be passed + which will replace the current configuration. + Alternatively, new ciphers can be added by prepending a + + sign to the cipher name and can removed likewise + using -. + + + + A cipher is an algorithm that encrypts and decrypts data + to be able to transmit it over an insecure channel. + + + + + + + NAME integrities [INTEGRITY-LIST|+INTEGRITY ...|-INTEGRITY ...] + + + + + This command allows modifying the integrity list + similar to the ciphers command. + + + + Integrity algorithms are used to be able to determine + if data has been altered when being transfered over + an untrusted channel. + + + + + + + NAME group-types [GROUP-TYPES-LIST|+GROUP-TYPE ...|-GROUP-TYPE] + + + + + + This command allows modifying the list of group types + similar to the ciphers command. + + + + These algorithms are used to negotiate a shared secret + of an insecure channel. + + + + + + + NAME pfs [on|off] + + + + + This command allows to enable or disable Perfect Forward Secrecy (PFS). + + + + If PFS is enabled, the encrypted channels of a VPN connection will be + renegotiated regularly to avoid that the same keys are used for too long. + If an attacker is able to obtain a key that was used to encrypt the + data, it is only possible to decrypt a certain amount of data. + + + + It is strongly recommended to enable PFS at all times. + + + + + + + NAME lifetime LIFETIME + + + + + This command allows to define how often the VPN connection is + renegotiated if PFS is enabled. + + + + + + + NAME compression [on|off] + + + + + This command allows to enable or disable compression. + + + + If compression is enabled, all data is being compressed before being + sent through the VPN. + This setting is ignored if the peer does not support this. + + + + + + + + System Policies + + + The system comes with builtin policies that cannot be modified by the user. + They are intended to provide good defaults for various situations. + + + + system + + + This policy is the default for every VPN connection and allows using + all ciphers, integrity and key-exchange algorithms that are recommended + to use and have not been proven or assumed to be broken, yet. + + + + Over time, this policy will change whenever an algorithm has been broken + and is not recommended to be used any more. + + + + + performance + + + This policy is recommended to be used on systems that are not very powerful. + Algorithms with smaller key lengths, but still considered to be secure + are being used. + + + + + System policies cannot be deleted. + + + + + See Also + + + + network + 8 + , + + network-vpn + 8 + + + + diff --git a/man/network-vpn.xml b/man/network-vpn.xml new file mode 100644 index 00000000..d71d14a8 --- /dev/null +++ b/man/network-vpn.xml @@ -0,0 +1,81 @@ + + + + + + network-vpn + network + + + + Developer + Michael + Tremer + michael.tremer@ipfire.org + + + + + + network-vpn + 8 + + + + network-vpn + Network Configuration Control Program + + + + + network vpn command ... + + + + + Description + + + The vpn command allows to create, delete, edit + and show the status of VPN connections and the configuration around it. + + + + + Commands + + + The following commands are understood: + + + + + + security-policies ... + + + + + Use this command to manage security policies. + See + network-vpn-security-policies + 8 + for details. + + + + + + + + See Also + + + + network + 8 + + + + diff --git a/man/network.xml b/man/network.xml index 3b773c01..0a97453c 100644 --- a/man/network.xml +++ b/man/network.xml @@ -279,6 +279,22 @@ + + + vpn ... + + + + + The vpn allows managing VPN connections. + See + network-vpn + 8 + for details. + + + + reset