doc/intro.html

   1 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
   2 <HTML>
   3 <HEAD>
   4 <TITLE>Introduction to FreeS/WAN</TITLE>
   5 <META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
   6 <STYLE TYPE="text/css"><!--
   7 BODY { font-family: serif }
   8 H1 { font-family: sans-serif }
   9 H2 { font-family: sans-serif }
  10 H3 { font-family: sans-serif }
  11 H4 { font-family: sans-serif }
  12 H5 { font-family: sans-serif }
  13 H6 { font-family: sans-serif }
  14 SUB { font-size: smaller }
  15 SUP { font-size: smaller }
  16 PRE { font-family: monospace }
  17 --></STYLE>
  18 </HEAD>
  19 <BODY>
  20 <A HREF="toc.html">Contents</A>
  21 <A HREF="upgrading.html">Next</A>
  22 <HR>
  23 <H1><A name="intro">Introduction</A></H1>
  24 <P>This section gives an overview of:</P>
  25 <UL>
  26 <LI>what IP Security (IPsec) does</LI>
  27 <LI>how IPsec works</LI>
  28 <LI>why we are implementing it for Linux</LI>
  29 <LI>how this implementation works</LI>
  30 </UL>
  31 <P>This section is intended to cover only the essentials,<EM> things you
  32  should know before trying to use FreeS/WAN.</EM></P>
  33 <P>For more detailed background information, see the<A href="politics.html#politics">
  34  history and politics</A> and<A href="ipsec.html#ipsec.detail"> IPsec
  35  protocols</A> sections.</P>
  36 <H2><A name="ipsec.intro">IPsec, Security for the Internet Protocol</A></H2>
  37 <P>FreeS/WAN is a Linux implementation of the IPsec (IP security)
  38  protocols. IPsec provides<A href="glossary.html#encryption"> encryption</A>
  39  and<A href="glossary.html#authentication"> authentication</A> services
  40  at the IP (Internet Protocol) level of the network protocol stack.</P>
  41 <P>Working at this level, IPsec can protect any traffic carried over IP,
  42  unlike other encryption which generally protects only a particular
  43  higher-level protocol --<A href="glossary.html#PGP"> PGP</A> for mail,<A
  44 href="glossary.html#SSH"> SSH</A> for remote login,<A href="glossary.html#SSL">
  45  SSL</A> for web work, and so on. This approach has both considerable
  46  advantages and some limitations. For discussion, see our<A href="ipsec.html#others">
  47  IPsec section</A></P>
  48 <P>IPsec can be used on any machine which does IP networking. Dedicated
  49  IPsec gateway machines can be installed wherever required to protect
  50  traffic. IPsec can also run on routers, on firewall machines, on
  51  various application servers, and on end-user desktop or laptop
  52  machines.</P>
  53 <P>Three protocols are used</P>
  54 <UL>
  55 <LI><A href="glossary.html#AH">AH</A> (Authentication Header) provides a
  56  packet-level authentication service</LI>
  57 <LI><A href="glossary.html#ESP">ESP</A> (Encapsulating Security Payload)
  58  provides encryption plus authentication</LI>
  59 <LI><A href="glossary.html#IKE">IKE</A> (Internet Key Exchange)
  60  negotiates connection parameters, including keys, for the other two</LI>
  61 </UL>
  62 <P>Our implementation has three main parts:</P>
  63 <UL>
  64 <LI><A href="glossary.html#KLIPS">KLIPS</A> (kernel IPsec) implements
  65  AH, ESP, and packet handling within the kernel</LI>
  66 <LI><A href="glossary.html#Pluto">Pluto</A> (an IKE daemon) implements
  67  IKE, negotiating connections with other systems</LI>
  68 <LI>various scripts provide an adminstrator's interface to the machinery</LI>
  69 </UL>
  70 <P>IPsec is optional for the current (version 4) Internet Protocol.
  71  FreeS/WAN adds IPsec to the Linux IPv4 network stack. Implementations
  72  of<A href="glossary.html#ipv6.gloss"> IP version 6</A> are required to
  73  include IPsec. Work toward integrating FreeS/WAN into the Linux IPv6
  74  stack has<A href="compat.html#ipv6"> started</A>.</P>
  75 <P>For more information on IPsec, see our<A href="ipsec.html#ipsec.detail">
  76  IPsec protocols</A> section, our collection of<A href="web.html#ipsec.link">
  77  IPsec links</A> or the<A href="rfc.html#RFC"> RFCs</A> which are the
  78  official definitions of these protocols.</P>
  79 <H3><A name="intro.interop">Interoperating with other IPsec
  80  implementations</A></H3>
  81 <P>IPsec is designed to let different implementations work together. We
  82  provide:</P>
  83 <UL>
  84 <LI>a<A href="web.html#implement"> list</A> of some other
  85  implementations</LI>
  86 <LI>information on<A href="interop.html#interop"> using FreeS/WAN with
  87  other implementations</A></LI>
  88 </UL>
  89 <P>The VPN Consortium fosters cooperation among implementers and
  90  interoperability among implementations. Their<A href="http://www.vpnc.org/">
  91  web site</A> has much more information.</P>
  92 <H3><A name="advantages">Advantages of IPsec</A></H3>
  93 <P>IPsec has a number of security advantages. Here are some
  94  independently written articles which discuss these:</P>
  95 <P><A HREF="http://www.sans.org/rr/"> SANS institute papers</A>. See the
  96  section on Encryption &amp;VPNs.
  97 <BR><A HREF="http://www.cisco.com/en/US/netsol/ns110/ns170/ns171/ns128/networking_solutions_white_papers_list.html">
  98  Cisco's white papers on &quot;Networking Solutions&quot;</A>.
  99 <BR><A HREF="http://iscs.sourceforge.net/HowWhyBrief/HowWhyBrief.html">
 100  Advantages of ISCS (Linux Integrated Secure Communications System;
 101  includes FreeS/WAN and other software)</A>.</P>
 102 <H3><A name="applications">Applications of IPsec</A></H3>
 103 <P>Because IPsec operates at the network layer, it is remarkably
 104  flexible and can be used to secure nearly any type of Internet traffic.
 105  Two applications, however, are extremely widespread:</P>
 106 <UL>
 107 <LI>a<A href="glossary.html#VPN"> Virtual Private Network</A>, or VPN,
 108  allows multiple sites to communicate securely over an insecure Internet
 109  by encrypting all communication between the sites.</LI>
 110 <LI>&quot;Road Warriors&quot; connect to the office from home, or perhaps from a
 111  hotel somewhere</LI>
 112 </UL>
 113 <P>There is enough opportunity in these applications that vendors are
 114  flocking to them. IPsec is being built into routers, into firewall
 115  products, and into major operating systems, primarily to support these
 116  applications. See our<A href="web.html#implement"> list</A> of
 117  implementations for details.</P>
 118 <P>We support both of those applications, and various less common IPsec
 119  applications as well, but we also add one of our own:</P>
 120 <UL>
 121 <LI>opportunistic encryption, the ability to set up FreeS/WAN gateways
 122  so that any two of them can encrypt to each other, and will do so
 123  whenever packets pass between them.</LI>
 124 </UL>
 125 <P>This is an extension we are adding to the protocols. FreeS/WAN is the
 126  first prototype implementation, though we hope other IPsec
 127  implementations will adopt the technique once we demonstrate it. See<A href="#goals">
 128  project goals</A> below for why we think this is important.</P>
 129 <P>A somewhat more detailed description of each of these applications is
 130  below. Our<A href="quickstart.html#quick_guide"> quickstart</A> section
 131  will show you how to build each of them.</P>
 132 <H4><A name="makeVPN">Using secure tunnels to create a VPN</A></H4>
 133 <P>A VPN, or<STRONG> V</STRONG>irtual<STRONG> P</STRONG>rivate<STRONG> N</STRONG>
 134 etwork lets two networks communicate securely when the only connection
 135  between them is over a third network which they do not trust.</P>
 136 <P>The method is to put a security gateway machine between each of the
 137  communicating networks and the untrusted network. The gateway machines
 138  encrypt packets entering the untrusted net and decrypt packets leaving
 139  it, creating a secure tunnel through it.</P>
 140 <P>If the cryptography is strong, the implementation is careful, and the
 141  administration of the gateways is competent, then one can reasonably
 142  trust the security of the tunnel. The two networks then behave like a
 143  single large private network, some of whose links are encrypted tunnels
 144  through untrusted nets.</P>
 145 <P>Actual VPNs are often more complex. One organisation may have fifty
 146  branch offices, plus some suppliers and clients, with whom it needs to
 147  communicate securely. Another might have 5,000 stores, or 50,000
 148  point-of-sale devices. The untrusted network need not be the Internet.
 149  All the same issues arise on a corporate or institutional network
 150  whenever two departments want to communicate privately with each other.</P>
 151 <P>Administratively, the nice thing about many VPN setups is that large
 152  parts of them are static. You know the IP addresses of most of the
 153  machines involved. More important, you know they will not change on
 154  you. This simplifies some of the admin work. For cases where the
 155  addresses do change, see the next section.</P>
 156 <H4><A name="road.intro">Road Warriors</A></H4>
 157 <P>The prototypical &quot;Road Warrior&quot; is a traveller connecting to home
 158  base from a laptop machine. Administratively, most of the same problems
 159  arise for a telecommuter connecting from home to the office, especially
 160  if the telecommuter does not have a static IP address.</P>
 161 <P>For purposes of this document:</P>
 162 <UL>
 163 <LI>anyone with a dynamic IP address is a &quot;Road Warrior&quot;.</LI>
 164 <LI>any machine doing IPsec processing is a &quot;gateway&quot;. Think of the
 165  single-user road warrior machine as a gateway with a degenerate subnet
 166  (one machine, itself) behind it.</LI>
 167 </UL>
 168 <P>These require somewhat different setup than VPN gateways with static
 169  addresses and with client systems behind them, but are basically not
 170  problematic.</P>
 171 <P>There are some difficulties which appear for some road warrior
 172  connections:</P>
 173 <UL>
 174 <LI>Road Wariors who get their addresses via DHCP may have a problem.
 175  FreeS/WAN can quite happily build and use a tunnel to such an address,
 176  but when the DHCP lease expires, FreeS/WAN does not know that. The
 177  tunnel fails, and the only recovery method is to tear it down and
 178  re-build it.</LI>
 179 <LI>If<A href="glossary.html#NAT.gloss"> Network Address Translation</A>
 180  (NAT) is applied between the two IPsec Gateways, this breaks IPsec.
 181  IPsec authenticates packets on an end-to-end basis, to ensure they are
 182  not altered en route. NAT rewrites packets as they go by. See our<A href="firewall.html#NAT">
 183  firewalls</A> document for details.</LI>
 184 </UL>
 185 <P>In most situations, however, FreeS/WAN supports road warrior
 186  connections just fine.</P>
 187 <H4><A name="opp.intro">Opportunistic encryption</A></H4>
 188 <P>One of the reasons we are working on FreeS/WAN is that it gives us
 189  the opportunity to add what we call opportuntistic encryption. This
 190  means that any two FreeS/WAN gateways will be able to encrypt their
 191  traffic, even if the two gateway administrators have had no prior
 192  contact and neither system has any preset information about the other.</P>
 193 <P>Both systems pick up the authentication information they need from
 194  the<A href="glossary.html#DNS"> DNS</A> (domain name service), the
 195  service they already use to look up IP addresses. Of course the
 196  administrators must put that information in the DNS, and must set up
 197  their gateways with opportunistic encryption enabled. Once that is
 198  done, everything is automatic. The gateways look for opportunities to
 199  encrypt, and encrypt whatever they can. Whether they also accept
 200  unencrypted communication is a policy decision the administrator can
 201  make.</P>
 202 <P>This technique can give two large payoffs:</P>
 203 <UL>
 204 <LI>It reduces the administrative overhead for IPsec enormously. You
 205  configure your gateway and thereafter everything is automatic. The need
 206  to configure the system on a per-tunnel basis disappears. Of course,
 207  FreeS/WAN allows specifically configured tunnels to co-exist with
 208  opportunistic encryption, but we hope to make them unnecessary in most
 209  cases.</LI>
 210 <LI>It moves us toward a more secure Internet, allowing users to create
 211  an environment where message privacy is the default. All messages can
 212  be encrypted, provided the other end is willing to co-operate. See our<A
 213 href="politics.html#politics"> history and politics of cryptography</A>
 214  section for discussion of why we think this is needed.</LI>
 215 </UL>
 216 <P>Opportunistic encryption is not (yet?) a standard part of the IPsec
 217  protocols, but an extension we are proposing and demonstrating. For
 218  details of our design, see<A href="#applied"> links</A> below.</P>
 219 <P>Only one current product we know of implements a form of
 220  opportunistic encryption.<A href="web.html#ssmail"> Secure sendmail</A>
 221  will automatically encrypt server-to-server mail transfers whenever
 222  possible.</P>
 223 <H3><A name="types">The need to authenticate gateways</A></H3>
 224 <P>A complication, which applies to any type of connection -- VPN, Road
 225  Warrior or opportunistic -- is that a secure connection cannot be
 226  created magically.<EM> There must be some mechanism which enables the
 227  gateways to reliably identify each other.</EM> Without this, they
 228  cannot sensibly trust each other and cannot create a genuinely secure
 229  link.</P>
 230 <P>Any link they do create without some form of<A href="glossary.html#authentication">
 231  authentication</A> will be vulnerable to a<A href="glossary.html#middle">
 232  man-in-the-middle attack</A>. If<A href="glossary.html#alicebob"> Alice
 233  and Bob</A> are the people creating the connection, a villian who can
 234  re-route or intercept the packets can pose as Alice while talking to
 235  Bob and pose as Bob while talking to Alice. Alice and Bob then both
 236  talk to the man in the middle, thinking they are talking to each other,
 237  and the villain gets everything sent on the bogus &quot;secure&quot; connection.</P>
 238 <P>There are two ways to build links securely, both of which exclude the
 239  man-in-the middle:</P>
 240 <UL>
 241 <LI>with<STRONG> manual keying</STRONG>, Alice and Bob share a secret
 242  key (which must be transmitted securely, perhaps in a note or via PGP
 243  or SSH) to encrypt their messages. For FreeS/WAN, such keys are stored
 244  in the<A href="manpage.d/ipsec.conf.5.html"> ipsec.conf(5)</A> file. Of
 245  course, if an enemy gets the key, all is lost.</LI>
 246 <LI>with<STRONG> automatic keying</STRONG>, the two systems authenticate
 247  each other and negotiate their own secret keys. The keys are
 248  automatically changed periodically.</LI>
 249 </UL>
 250 <P>Automatic keying is much more secure, since if an enemy gets one key
 251  only messages between the previous re-keying and the next are exposed.
 252  It is therefore the usual mode of operation for most IPsec deployment,
 253  and the mode we use in our setup examples. FreeS/WAN does support
 254  manual keying for special circumstanes. See this<A href="adv_config.html#prodman">
 255  section</A>.</P>
 256 <P>For automatic keying, the two systems must authenticate each other
 257  during the negotiations. There is a choice of methods for this:</P>
 258 <UL>
 259 <LI>a<STRONG> shared secret</STRONG> provides authentication. If Alice
 260  and Bob are the only ones who know a secret and Alice recives a message
 261  which could not have been created without that secret, then Alice can
 262  safely believe the message came from Bob.</LI>
 263 <LI>a<A href="glossary.html#public"> public key</A> can also provide
 264  authentication. If Alice receives a message signed with Bob's private
 265  key (which of course only he should know) and she has a trustworthy
 266  copy of his public key (so that she can verify the signature), then she
 267  can safely believe the message came from Bob.</LI>
 268 </UL>
 269 <P>Public key techniques are much preferable, for reasons discussed<A href="config.html#choose">
 270  later</A>, and will be used in all our setup examples. FreeS/WAN does
 271  also support auto-keying with shared secret authentication. See this<A href="adv_config.html#prodsecrets">
 272  section</A>.</P>
 273 <H2><A name="project">The FreeS/WAN project</A></H2>
 274 <P>For complete information on the project, see our web site,<A href="http://liberty.freeswan.org">
 275  freeswan.org</A>.</P>
 276 <P>In summary, we are implementing the<A href="glossary.html#IPsec">
 277  IPsec</A> protocols for Linux and extending them to do<A href="glossary.html#carpediem">
 278  opportunistic encryption</A>.</P>
 279 <H3><A name="goals">Project goals</A></H3>
 280 <P>Our overall goal in FreeS/WAN is to make the Internet more secure and
 281  more private.</P>
 282 <P>Our IPsec implementation supports VPNs and Road Warriors of course.
 283  Those are important applications. Many users will want FreeS/WAN to
 284  build corporate VPNs or to provide secure remote access.</P>
 285 <P>However, our goals in building it go beyond that. We are trying to
 286  help<STRONG> build security into the fabric of the Internet</STRONG> so
 287  that anyone who choses to communicate securely can do so, as easily as
 288  they can do anything else on the net.</P>
 289 <P>More detailed objectives are:</P>
 290 <UL>
 291 <LI>extend IPsec to do<A href="glossary.html#carpediem"> opportunistic
 292  encryption</A> so that
 293 <UL>
 294 <LI>any two systems can secure their communications without a
 295  pre-arranged connection</LI>
 296 <LI><STRONG>secure connections can be the default</STRONG>, falling back
 297  to unencrypted connections only if:
 298 <UL>
 299 <LI><EM>both</EM> the partner is not set up to co-operate on securing
 300  the connection</LI>
 301 <LI><EM>and</EM> your policy allows insecure connections</LI>
 302 </UL>
 303 </LI>
 304 <LI>a significant fraction of all Internet traffic is encrypted</LI>
 305 <LI>wholesale monitoring of the net (<A href="politics.html#intro.poli">
 306 examples</A>) becomes difficult or impossible</LI>
 307 </UL>
 308 </LI>
 309 <LI>help make IPsec widespread by providing an implementation with no
 310  restrictions:
 311 <UL>
 312 <LI>freely available in source code under the<A href="glossary.html#GPL">
 313  GNU General Public License</A></LI>
 314 <LI>running on a range of readily available hardware</LI>
 315 <LI>not subject to US or other nations'<A href="politics.html#exlaw">
 316  export restrictions</A>.
 317 <BR> Note that in order to avoid<EM> even the appearance</EM> of being
 318  subject to those laws, the project cannot accept software contributions
 319  --<EM> not even one-line bug fixes</EM> -- from US residents or
 320  citizens.</LI>
 321 </UL>
 322 </LI>
 323 <LI>provide a high-quality IPsec implementation for Linux
 324 <UL>
 325 <LI>portable to all CPUs Linux supports:<A href="compat.html#CPUs">
 326  (current list)</A></LI>
 327 <LI>interoperable with other IPsec implementations:<A href="interop.html#interop">
 328  (current list)</A></LI>
 329 </UL>
 330 </LI>
 331 </UL>
 332 <P>If we can get opportunistic encryption implemented and widely
 333  deployed, then it becomes impossible for even huge well-funded agencies
 334  to monitor the net.</P>
 335 <P>See also our section on<A href="politics.html#politics"> history and
 336  politics</A> of cryptography, which includes our project leader's<A href="politics.html#gilmore">
 337  rationale</A> for starting the project.</P>
 338 <H3><A name="staff">Project team</A></H3>
 339 <P>Two of the team are from the US and can therefore contribute no code:</P>
 340 <UL>
 341 <LI>John Gilmore: founder and policy-maker (<A href="http://www.toad.com/gnu/">
 342 home page</A>)</LI>
 343 <LI>Hugh Daniel: project manager, Most Demented Tester, and occasionally
 344  Pointy-Haired Boss</LI>
 345 </UL>
 346 <P>The rest of the team are Canadians, working in Canada. (<A href="politics.html#status">
 347 Why Canada?</A>)</P>
 348 <UL>
 349 <LI>Hugh Redelmeier:<A href="glossary.html#Pluto"> Pluto daemon</A>
 350  programmer</LI>
 351 <LI>Richard Guy Briggs:<A href="glossary.html#KLIPS"> KLIPS</A>
 352  programmer</LI>
 353 <LI>Michael Richardson: hacker without portfolio</LI>
 354 <LI>Claudia Schmeing: documentation</LI>
 355 <LI>Sam Sgro: technical support via the<A href="mail.html#lists">
 356  mailing lists</A></LI>
 357 </UL>
 358 <P>The project is funded by civil libertarians who consider our goals
 359  worthwhile. Most of the team are paid for this work.</P>
 360 <P>People outside this core team have made substantial contributions.
 361  See</P>
 362 <UL>
 363 <LI>our<A href="../CREDITS"> CREDITS</A> file</LI>
 364 <LI>the<A href="web.html#patch"> patches and add-ons</A> section of our
 365  web references file</LI>
 366 <LI>lists below of user-written<A href="#howto"> HowTos</A> and<A href="#applied">
 367  other papers</A></LI>
 368 </UL>
 369 <P>Additional contributions are welcome. See the<A href="faq.html#contrib.faq">
 370  FAQ</A> for details.</P>
 371 <H2><A name="products">Products containing FreeS/WAN</A></H2>
 372 <P>Unfortunately the<A href="politics.html#exlaw"> export laws</A> of
 373  some countries restrict the distribution of strong cryptography.
 374  FreeS/WAN is therefore not in the standard Linux kernel and not in all
 375  CD or web distributions.</P>
 376 <P>FreeS/WAN is, however, quite widely used. Products we know of that
 377  use it are listed below. We would appreciate hearing, via the<A href="mail.html#lists">
 378  mailing lists</A>, of any we don't know of.</P>
 379 <H3><A name="distwith">Full Linux distributions</A></H3>
 380 <P>FreeS/WAN is included in various general-purpose Linux distributions,
 381  mostly from countries (shown in brackets) with more sensible laws:</P>
 382 <UL>
 383 <LI><A href="http://www.suse.com/">SuSE Linux</A> (Germany)</LI>
 384 <LI><A href="http://www.conectiva.com">Conectiva</A> (Brazil)</LI>
 385 <LI><A href="http://www.linux-mandrake.com/en/">Mandrake</A> (France)</LI>
 386 <LI><A href="http://www.debian.org">Debian</A></LI>
 387 <LI>the<A href="http://www.pld.org.pl/"> Polish(ed) Linux Distribution</A>
 388  (Poland)</LI>
 389 <LI><A>Best Linux</A> (Finland)</LI>
 390 </UL>
 391 <P>For distributions which do not include FreeS/WAN and are not Redhat
 392  (which we develop and test on), there is additional information in our<A
 393 href="compat.html#otherdist"> compatibility</A> section.</P>
 394 <P>The server edition of<A href="http://www.corel.com"> Corel</A> Linux
 395  (Canada) also had FreeS/WAN, but Corel have dropped that product line.</P>
 396 <H3><A name="kernel_dist">Linux kernel distributions</A></H3>
 397 <UL>
 398 <LI><A href="http://sourceforge.net/projects/wolk/">Working Overloaded
 399  Linux Kernel (WOLK)</A></LI>
 400 </UL>
 401 <H3><A name="office_dist">Office server distributions</A></H3>
 402 <P>FreeS/WAN is also included in several distributions aimed at the
 403  market for turnkey business servers:</P>
 404 <UL>
 405 <LI><A href="http://www.e-smith.com/">e-Smith</A> (Canada), which has
 406  recently been acquired and become the Network Server Solutions group of<A
 407 href="http://www.mitel.com/"> Mitel Networks</A> (Canada)</LI>
 408 <LI><A href="http://www.clarkconnect.org/">ClarkConnect</A> from Point
 409  Clark Networks (Canada)</LI>
 410 <LI><A href="http://www.trustix.net/">Trustix Secure Linux</A> (Norway)</LI>
 411 </UL>
 412 <H3><A name="fw_dist">Firewall distributions</A></H3>
 413 <P>Several distributions intended for firewall and router applications
 414  include FreeS/WAN:</P>
 415 <UL>
 416 <LI>The<A href="http://www.linuxrouter.org/"> Linux Router Project</A>
 417  produces a Linux distribution that will boot from a single floppy. The<A
 418 href="http://leaf.sourceforge.net"> LEAF</A> firewall project provides
 419  several different LRP-based firewall packages. At least one of them,
 420  Charles Steinkuehler's Dachstein, includes FreeS/WAN with X.509
 421  patches.</LI>
 422 <LI>there are several distributions bootable directly from CD-ROM,
 423  usable on a machine without hard disk.
 424 <UL>
 425 <LI>Dachstein (see above) can be used this way</LI>
 426 <LI><A href="http://www.gibraltar.at/">Gibraltar</A> is based on Debian
 427  GNU/Linux.</LI>
 428 <LI>at time of writing,<A href="www.xiloo.com"> Xiloo</A> is available
 429  only in Chinese. An English version is expected.</LI>
 430 </UL>
 431 </LI>
 432 <LI><A href="http://www.astaro.com/products/index.html">Astaro Security
 433  Linux</A> includes FreeS/WAN. It has some web-based tools for managing
 434  the firewall that include FreeS/WAN configuration management.</LI>
 435 <LI><A href="http://www.linuxwall.de">Linuxwall</A></LI>
 436 <LI><A href="http://www.smoothwall.org/">Smoothwall</A></LI>
 437 <LI><A href="http://www.devil-linux.org/">Devil Linux</A></LI>
 438 <LI>Coyote Linux has a<A href="http://embedded.coyotelinux.com/wolverine/index.php">
 439  Wolverine</A> firewall/VPN server</LI>
 440 </UL>
 441 <P>There are also several sets of scripts available for managing a
 442  firewall which is also acting as a FreeS/WAN IPsec gateway. See this<A href="firewall.html#rules.pub">
 443  list</A>.</P>
 444 <H3><A name="turnkey">Firewall and VPN products</A></H3>
 445 <P>Several vendors use FreeS/WAN as the IPsec component of a turnkey
 446  firewall or VPN product.</P>
 447 <P>Software-only products:</P>
 448 <UL>
 449 <LI><A href="http://www.linuxmagic.com/vpn/index.html">Linux Magic</A>
 450  offer a VPN/Firewall product using FreeS/WAN</LI>
 451 <LI>The Software Group's<A href="http://www.wanware.com/sentinet/">
 452  Sentinet</A> product uses FreeS/WAN</LI>
 453 <LI><A href="http://www.merilus.com">Merilus</A> use FreeS/WAN in their
 454  Gateway Guardian firewall product</LI>
 455 </UL>
 456 <P>Products that include the hardware:</P>
 457 <UL>
 458 <LI>The<A href="http://www.lasat.com"> LASAT SafePipe[tm]</A> series. is
 459  an IPsec box based on an embedded MIPS running Linux with FreeS/WAN and
 460  a web-config front end. This company also host our freeswan.org web
 461  site.</LI>
 462 <LI>Merilus<A href="http://www.merilus.com/products/fc/index.shtml">
 463  Firecard</A> is a Linux firewall on a PCI card.</LI>
 464 <LI><A href="http://www.kyzo.com/">Kyzo</A> have a &quot;pizza box&quot; product
 465  line with various types of server, all running from flash. One of them
 466  is an IPsec/PPTP VPN server</LI>
 467 <LI><A href="http://www.pfn.com">PFN</A> use FreeS/WAN in some of their
 468  products</LI>
 469 </UL>
 470 <P><A href="www.rebel.com">Rebel.com</A>, makers of the Netwinder Linux
 471  machines (ARM or Crusoe based), had a product that used FreeS/WAN. The
 472  company is in receivership so the future of the Netwinder is at best
 473  unclear.<A href="web.html#patch"> PKIX patches</A> for FreeS/WAN
 474  developed at Rebel are listed in our web links document.</P>
 475 <H2><A name="docs">Information sources</A></H2>
 476 <H3><A name="docformats">This HowTo, in multiple formats</A></H3>
 477 <P>FreeS/WAN documentation up to version 1.5 was available only in HTML.
 478  Now we ship two formats:</P>
 479 <UL>
 480 <LI>as HTML, one file for each doc section plus a global<A href="toc.html">
 481  Table of Contents</A></LI>
 482 <LI><A href="HowTo.html">one big HTML file</A> for easy searching</LI>
 483 </UL>
 484 <P>and provide a Makefile to generate other formats if required:</P>
 485 <UL>
 486 <LI><A href="HowTo.pdf">PDF</A></LI>
 487 <LI><A href="HowTo.ps">Postscript</A></LI>
 488 <LI><A href="HowTo.txt">ASCII text</A></LI>
 489 </UL>
 490 <P>The Makefile assumes the htmldoc tool is available. You can download
 491  it from<A href="http://www.easysw.com"> Easy Software</A>.</P>
 492 <P>All formats should be available at the following websites:</P>
 493 <UL>
 494 <LI><A href="http://www.freeswan.org/doc.html">FreeS/WAN project</A></LI>
 495 <LI><A href="http://www.linuxdoc.org">Linux Documentation Project</A></LI>
 496 </UL>
 497 <P>The distribution tarball has only the two HTML formats.</P>
 498 <P><STRONG>Note:</STRONG> If you need the latest doc version, for
 499  example to see if anyone has managed to set up interoperation between
 500  FreeS/WAN and whatever, then you should download the current snapshot.
 501  What is on the web is documentation as of the last release. Snapshots
 502  have all changes I've checked in to date.</P>
 503 <H3><A name="rtfm">RTFM (please Read The Fine Manuals)</A></H3>
 504 <P>As with most things on any Unix-like system, most parts of Linux
 505  FreeS/WAN are documented in online manual pages. We provide a list of<A href="/mnt/floppy/manpages.html">
 506  FreeS/WAN man pages</A>, with links to HTML versions of them.</P>
 507 <P>The man pages describing configuration files are:</P>
 508 <UL>
 509 <LI><A href="/mnt/floppy/manpage.d/ipsec.conf.5.html">ipsec.conf(5)</A></LI>
 510 <LI><A href="/mnt/floppy/manpage.d/ipsec.secrets.5.html">
 511 ipsec.secrets(5)</A></LI>
 512 </UL>
 513 <P>Man pages for common commands include:</P>
 514 <UL>
 515 <LI><A href="/mnt/floppy/manpage.d/ipsec.8.html">ipsec(8)</A></LI>
 516 <LI><A href="/mnt/floppy/manpage.d/ipsec_pluto.8.html">ipsec_pluto(8)</A>
 517 </LI>
 518 <LI><A href="/mnt/floppy/manpage.d/ipsec_newhostkey.8.html">
 519 ipsec_newhostkey(8)</A></LI>
 520 <LI><A href="/mnt/floppy/manpage.d/ipsec_auto.8.html">ipsec_auto(8)</A></LI>
 521 </UL>
 522 <P>You can read these either in HTML using the links above or with the<VAR>
 523  man(1)</VAR> command.</P>
 524 <P>In the event of disagreement between this HTML documentation and the
 525  man pages, the man pages are more likely correct since they are written
 526  by the implementers. Please report any such inconsistency on the<A href="mail.html#lists">
 527  mailing list</A>.</P>
 528 <H3><A name="text">Other documents in the distribution</A></H3>
 529 <P>Text files in the main distribution directory are README, INSTALL,
 530  CREDITS, CHANGES, BUGS and COPYING.</P>
 531 <P>The Libdes encryption library we use has its own documentation. You
 532  can find it in the library directory..</P>
 533 <H3><A name="assumptions">Background material</A></H3>
 534 <P>Throughout this documentation, I write as if the reader had at least
 535  a general familiarity with Linux, with Internet Protocol networking,
 536  and with the basic ideas of system and network security. Of course that
 537  will certainly not be true for all readers, and quite likely not even
 538  for a majority.</P>
 539 <P>However, I must limit amount of detail on these topics in the main
 540  text. For one thing, I don't understand all the details of those topics
 541  myself. Even if I did, trying to explain everything here would produce
 542  extremely long and almost completely unreadable documentation.</P>
 543 <P>If one or more of those areas is unknown territory for you, there are
 544  plenty of other resources you could look at:</P>
 545 <DL>
 546 <DT>Linux</DT>
 547 <DD>the<A href="http://www.linuxdoc.org"> Linux Documentation Project</A>
 548  or a local<A href="http://www.linux.org/groups/"> Linux User Group</A>
 549  and these<A href="web.html#linux.link"> links</A></DD>
 550 <DT>IP networks</DT>
 551 <DD>Rusty Russell's<A href="http://netfilter.samba.org/unreliable-guides/networking-concepts-HOWTO/index.html">
 552  Networking Concepts HowTo</A> and these<A href="web.html#IP.background">
 553  links</A></DD>
 554 <DT>Security</DT>
 555 <DD>Schneier's book<A href="biblio.html#secrets"> Secrets and Lies</A>
 556  and these<A href="web.html#crypto.link"> links</A></DD>
 557 </DL>
 558 <P>Also, I do make an effort to provide some background material in
 559  these documents. All the basic ideas behind IPsec and FreeS/WAN are
 560  explained here. Explanations that do not fit in the main text, or that
 561  not everyone will need, are often in the<A href="glossary.html#ourgloss">
 562  glossary</A>, which is the largest single file in this document set.
 563  There is also a<A href="background.html#background"> background</A>
 564  file containing various explanations too long to fit in glossary
 565  definitions. All files are heavily sprinkled with links to each other
 566  and to the glossary.<STRONG> If some passage makes no sense to you, try
 567  the links</STRONG>.</P>
 568 <P>For other reference material, see the<A href="biblio.html#biblio">
 569  bibliography</A> and our collection of<A href="web.html#weblinks"> web
 570  links</A>.</P>
 571 <P>Of course, no doubt I get this (and other things) wrong sometimes.
 572  Feedback via the<A href="mail.html#lists"> mailing lists</A> is
 573  welcome.</P>
 574 <H3><A name="archives">Archives of the project mailing list</A></H3>
 575 <P>Until quite recently, there was only one FreeS/WAN mailing list, and
 576  archives of it were:</P>
 577 <UL>
 578 <LI><A href="http://www.sandelman.ottawa.on.ca/linux-ipsec">Canada</A></LI>
 579 <LI><A href="http://www.nexial.com">Holland</A></LI>
 580 </UL>
 581  The two archives use completely different search engines. You might
 582  want to try both.
 583 <P>More recently we have expanded to five lists, each with its own
 584  archive.</P>
 585 <P><A href="mail.html#lists">More information</A> on mailing lists.</P>
 586 <H3><A name="howto">User-written HowTo information</A></H3>
 587 <P>Various user-written HowTo documents are available. The ones covering
 588  FreeS/WAN-to-FreeS/WAN connections are:</P>
 589 <UL>
 590 <LI>Jean-Francois Nadeau's<A href="http://jixen.tripod.com/"> practical
 591  configurations</A> document</LI>
 592 <LI>Jens Zerbst's HowTo on<A href="http://dynipsec.tripod.com/"> Using
 593  FreeS/WAN with dynamic IP addresses</A>.</LI>
 594 <LI>an entry in Kurt Seifried's<A href="http://www.securityportal.com/lskb/kben00000013.html">
 595  Linux Security Knowledge Base</A>.</LI>
 596 <LI>a section of David Ranch's<A href="http://www.ecst.csuchico.edu/~dranch/LINUX/index-linux.html#trinityos">
 597  Trinity OS Guide</A></LI>
 598 <LI>a section in David Bander's book<A href="biblio.html#bander"> Linux
 599  Security Toolkit</A></LI>
 600 </UL>
 601 <P>User-wriiten HowTo material may be<STRONG> especially helpful if you
 602  need to interoperate with another IPsec implementation</STRONG>. We
 603  have neither the equipment nor the manpower to test such
 604  configurations. Users seem to be doing an admirable job of filling the
 605  gaps.</P>
 606 <UL>
 607 <LI>list of user-written<A href="interop.html#otherpub"> interoperation
 608  HowTos</A> in our interop document</LI>
 609 </UL>
 610 <P>Check what version of FreeS/WAN user-written documents cover. The
 611  software is under active development and the current version may be
 612  significantly different from what an older document describes.</P>
 613 <H3><A name="applied">Papers on FreeS/WAN</A></H3>
 614 <P>Two design documents show team thinking on new developments:</P>
 615 <UL>
 616 <LI><A href="opportunism.spec">Opportunistic Encryption</A> by technical
 617  lead Henry Spencer and Pluto programmer Hugh Redelemeier</LI>
 618 <LI>discussion of<A href="http://www.sandelman.ottawa.on.ca/SSW/freeswan/klips2req/">
 619  KLIPS redesign</A></LI>
 620 </UL>
 621 <P>Both documents are works in progress and are frequently revised. For
 622  the latest version, see the<A href="mail.html#lists"> design mailing
 623  list</A>. Comments should go to that list.</P>
 624 <P>There is now an<A href="http://www.ietf.org/internet-drafts/draft-richardson-ipsec-opportunistic-06.txt">
 625  Internet Draft on Opportunistic Encryption</A> by Michael Richardson,
 626  Hugh Redelmeier and Henry Spencer. This is a first step toward getting
 627  the protocol standardised so there can be multiple implementations of
 628  it. Discussion of it takes place on the<A href="http://www.ietf.org/html.charters/ipsec-charter.html">
 629  IETF IPsec Working Group</A> mailing list.</P>
 630 <P>A number of papers giving further background on FreeS/WAN, or
 631  exploring its future or its applications, are also available:</P>
 632 <UL>
 633 <LI>Both Henry and Richard gave talks on FreeS/WAN at the 2000<A href="http://www.linuxsymposium.org">
 634  Ottawa Linux Symposium</A>.
 635 <UL>
 636 <LI>Richard's<A href="http://www.conscoop.ottawa.on.ca/rgb/freeswan/ols2k/">
 637  slides</A></LI>
 638 <LI>Henry's paper</LI>
 639 <LI>MP3 audio of their talks is available from the<A href="http://www.linuxsymposium.org/">
 640  conference page</A></LI>
 641 </UL>
 642 </LI>
 643 <LI><CITE>Moat: A Virtual Private Network Appliances and Services
 644  Platform</CITE> is a paper about large-scale (a few 100 links) use of
 645  FreeS/WAN in a production application at AT&amp;T Research. It is available
 646  in Postscript or PDF from co-author Steve Bellovin's<A href="http://www.research.att.com/~smb/papers/index.html">
 647  papers list page</A>.</LI>
 648 <LI>One of the Moat co-authors, John Denker, has also written
 649 <UL>
 650 <LI>a<A href="http://www.av8n.com/vpn/ipsec+routing.htm"> proposal</A>
 651  for how future versions of FreeS/WAN might interact with routing
 652  protocols</LI>
 653 <LI>a<A href="http://www.av8n.com/vpn/wishlist.htm"> wishlist</A> of
 654  possible new features</LI>
 655 </UL>
 656 </LI>
 657 <LI>Bart Trojanowski's web page has a draft design for<A href="http://www.jukie.net/~bart/linux-ipsec/">
 658  hardware acceleration</A> of FreeS/WAN</LI>
 659 </UL>
 660 <P>Several of these provoked interesting discussions on the mailing
 661  lists, worth searching for in the<A href="mail.html#archive"> archives</A>
 662 .</P>
 663 <P>There are also several papers in languages other than English, see
 664  our<A href="web.html#otherlang"> web links</A>.</P>
 665 <H3><A name="licensing">License and copyright information</A></H3>
 666 <P>All code and documentation written for this project is distributed
 667  under either the GNU General Public License (<A href="glossary.html#GPL">
 668 GPL</A>) or the GNU Library General Public License. For details see the
 669  COPYING file in the distribution.</P>
 670 <P>Not all code in the distribution is ours, however. See the CREDITS
 671  file for details. In particular, note that the<A href="glossary.html#LIBDES">
 672  Libdes</A> library and the version of<A href="glossary.html#MD5"> MD5</A>
 673  that we use each have their own license.</P>
 674 <H2><A name="sites">Distribution sites</A></H2>
 675 <P>FreeS/WAN is available from a number of sites.</P>
 676 <H3><A NAME="1_5_1">Primary site</A></H3>
 677 <P>Our primary site, is at xs4all (Thanks, folks!) in Holland:</P>
 678 <UL>
 679 <LI><A href="http://www.xs4all.nl/~freeswan">HTTP</A></LI>
 680 <LI><A href="ftp://ftp.xs4all.nl/pub/crypto/freeswan">FTP</A></LI>
 681 </UL>
 682 <H3><A name="mirrors">Mirrors</A></H3>
 683 <P>There are also mirror sites all over the world:</P>
 684 <UL>
 685 <LI><A href="http://www.flora.org/freeswan">Eastern Canada</A> (limited
 686  resouces)</LI>
 687 <LI><A href="ftp://ludwig.doculink.com/pub/freeswan/">Eastern Canada</A>
 688  (has older versions too)</LI>
 689 <LI><A href="ftp://ntsc.notBSD.org/pub/crypto/freeswan/">Eastern Canada</A>
 690  (has older versions too)</LI>
 691 <LI><A href="ftp://ftp.kame.net/pub/freeswan/">Japan</A></LI>
 692 <LI><A href="ftp://ftp.futuredynamics.com/freecrypto/FreeSWAN/">Hong
 693  Kong</A></LI>
 694 <LI><A href="ftp://ipsec.dk/pub/freeswan/">Denmark</A></LI>
 695 <LI><A href="ftp://ftp.net.lut.ac.uk/freeswan">the UK</A></LI>
 696 <LI><A href="http://storm.alert.sk/comp/mirrors/freeswan/">Slovak
 697  Republic</A></LI>
 698 <LI><A href="http://the.wiretapped.net/security/vpn-tunnelling/freeswan/">
 699 Australia</A></LI>
 700 <LI><A href="http://freeswan.technolust.cx/">technolust</A></LI>
 701 <LI><A href="http://freeswan.devguide.de/">Germany</A></LI>
 702 <LI>Ivan Moore's<A href="http://snowcrash.tdyc.com/freeswan/"> site</A></LI>
 703 <LI>the<A href="http://www.cryptoarchive.net/"> Crypto Archive</A> on
 704  the<A href="http://www.securityportal.com/"> Security Portal</A> site</LI>
 705 <LI><A href="http://www.wiretapped.net/">Wiretapped.net</A> in Australia</LI>
 706 </UL>
 707 <P>Thanks to those folks as well.</P>
 708 <H3><A name="munitions">The &quot;munitions&quot; archive of Linux crypto software</A>
 709 </H3>
 710 <P>There is also an archive of Linux crypto software called &quot;munitions&quot;,
 711  with its own mirrors in a number of countries. It includes FreeS/WAN,
 712  though not always the latest version. Some of its sites are:</P>
 713 <UL>
 714 <LI><A href="http://munitions.vipul.net/">Germany</A></LI>
 715 <LI><A href="http://munitions.iglu.cjb.net/">Italy</A></LI>
 716 <LI><A href="http://munitions2.xs4all.nl/">Netherlands</A></LI>
 717 </UL>
 718 <P>Any of those will have a list of other &quot;munitions&quot; mirrors. There is
 719  also a CD available.</P>
 720 <H2><A NAME="1_6">Links to other sections</A></H2>
 721 <P>For more detailed background information, see:</P>
 722 <UL>
 723 <LI><A href="politics.html#politics">history and politics</A> of
 724  cryptography</LI>
 725 <LI><A href="ipsec.html#ipsec.detail">IPsec protocols</A></LI>
 726 </UL>
 727 <P>To begin working with FreeS/WAN, go to our<A href="quickstart.html#quick.guide">
 728  quickstart</A> guide.</P>
 729 <HR>
 730 <A HREF="toc.html">Contents</A>
 731 <A HREF="upgrading.html">Next</A>
 732 </BODY>
 733 </HTML>