Date: Sat, 13 Jul 2013 03:51:23 +0000 (UTC) From: Warren Block <wblock@FreeBSD.org> To: doc-committers@freebsd.org, svn-doc-all@freebsd.org, svn-doc-head@freebsd.org Subject: svn commit: r42267 - head/en_US.ISO8859-1/books/handbook/security Message-ID: <201307130351.r6D3pNSR069093@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: wblock Date: Sat Jul 13 03:51:22 2013 New Revision: 42267 URL: http://svnweb.freebsd.org/changeset/doc/42267 Log: Whitespace-only fixes. Translators, please ignore. Modified: head/en_US.ISO8859-1/books/handbook/security/chapter.xml Modified: head/en_US.ISO8859-1/books/handbook/security/chapter.xml ============================================================================== --- head/en_US.ISO8859-1/books/handbook/security/chapter.xml Sat Jul 13 03:33:20 2013 (r42266) +++ head/en_US.ISO8859-1/books/handbook/security/chapter.xml Sat Jul 13 03:51:22 2013 (r42267) @@ -2444,57 +2444,57 @@ device crypto</screen> </listitem> </itemizedlist> - <sect3> - <sect3info> - <authorgroup> - <author> - <firstname>Tom</firstname> - <surname>Rhodes</surname> - <affiliation> - <address><email>trhodes@FreeBSD.org</email></address> - </affiliation> - <contrib>Written by </contrib> - </author> - </authorgroup> - </sect3info> - - <title>Configuring IPsec on &os;</title> - - <para>To begin, - <filename role="package">security/ipsec-tools</filename> - must be installed from the Ports Collection. This software - provides a number of applications which support the - configuration.</para> - - <para>The next requirement is to create two &man.gif.4; - pseudo-devices which will be used to tunnel packets and - allow both networks to communicate properly. As - <username>root</username>, run the following commands, - replacing <replaceable>internal</replaceable> and - <replaceable>external</replaceable> with the real IP - addresses of the internal and external interfaces of the two - gateways:</para> - - <screen>&prompt.root; <userinput>ifconfig gif0 create</userinput></screen> - - <screen>&prompt.root; <userinput>ifconfig gif0 <replaceable>internal1 internal2</replaceable></userinput></screen> - - <screen>&prompt.root; <userinput>ifconfig gif0 tunnel <replaceable>external1 external2</replaceable></userinput></screen> - - <para>In this example, the corporate <acronym>LAN</acronym>'s - external <acronym>IP</acronym> address is <hostid - role="ipaddr">172.16.5.4</hostid> and its internal - <acronym>IP</acronym> address is <hostid - role="ipaddr">10.246.38.1</hostid>. The home - <acronym>LAN</acronym>'s external <acronym>IP</acronym> - address is <hostid role="ipaddr">192.168.1.12</hostid> and its - internal private <acronym>IP</acronym> address is <hostid - role="ipaddr">10.0.0.5</hostid>.</para> + <sect3> + <sect3info> + <authorgroup> + <author> + <firstname>Tom</firstname> + <surname>Rhodes</surname> + <affiliation> + <address><email>trhodes@FreeBSD.org</email></address> + </affiliation> + <contrib>Written by </contrib> + </author> + </authorgroup> + </sect3info> + + <title>Configuring IPsec on &os;</title> + + <para>To begin, + <filename role="package">security/ipsec-tools</filename> + must be installed from the Ports Collection. This software + provides a number of applications which support the + configuration.</para> + + <para>The next requirement is to create two &man.gif.4; + pseudo-devices which will be used to tunnel packets and + allow both networks to communicate properly. As + <username>root</username>, run the following commands, + replacing <replaceable>internal</replaceable> and + <replaceable>external</replaceable> with the real IP + addresses of the internal and external interfaces of the two + gateways:</para> + + <screen>&prompt.root; <userinput>ifconfig gif0 create</userinput></screen> + + <screen>&prompt.root; <userinput>ifconfig gif0 <replaceable>internal1 internal2</replaceable></userinput></screen> + + <screen>&prompt.root; <userinput>ifconfig gif0 tunnel <replaceable>external1 external2</replaceable></userinput></screen> + + <para>In this example, the corporate <acronym>LAN</acronym>'s + external <acronym>IP</acronym> address is + <hostid role="ipaddr">172.16.5.4</hostid> and its internal + <acronym>IP</acronym> address is + <hostid role="ipaddr">10.246.38.1</hostid>. The home + <acronym>LAN</acronym>'s external <acronym>IP</acronym> + address is <hostid role="ipaddr">192.168.1.12</hostid> and + its internal private <acronym>IP</acronym> address is + <hostid role="ipaddr">10.0.0.5</hostid>.</para> - <para>If this is confusing, review the following example output - from &man.ifconfig.8;:</para> + <para>If this is confusing, review the following example + output from &man.ifconfig.8;:</para> - <programlisting>Gateway 1: + <programlisting>Gateway 1: gif0: flags=8051 mtu 1280 tunnel inet 172.16.5.4 --> 192.168.1.12 @@ -2508,10 +2508,10 @@ tunnel inet 192.168.1.12 --> 172.16.5 inet 10.0.0.5 --> 10.246.38.1 netmask 0xffffff00 inet6 fe80::250:bfff:fe3a:c1f%gif0 prefixlen 64 scopeid 0x4</programlisting> - <para>Once complete, both internal <acronym>IP</acronym> - addresses should be reachable using &man.ping.8;:</para> + <para>Once complete, both internal <acronym>IP</acronym> + addresses should be reachable using &man.ping.8;:</para> - <programlisting>priv-net# ping 10.0.0.5 + <programlisting>priv-net# ping 10.0.0.5 PING 10.0.0.5 (10.0.0.5): 56 data bytes 64 bytes from 10.0.0.5: icmp_seq=0 ttl=64 time=42.786 ms 64 bytes from 10.0.0.5: icmp_seq=1 ttl=64 time=19.255 ms @@ -2532,26 +2532,26 @@ PING 10.246.38.1 (10.246.38.1): 56 data 5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max/stddev = 28.106/94.594/154.524/49.814 ms</programlisting> - <para>As expected, both sides have the ability to send and - receive <acronym>ICMP</acronym> packets from the privately - configured addresses. Next, both gateways must be told how - to route packets in order to correctly send traffic from - either network. The following command will achieve this - goal:</para> + <para>As expected, both sides have the ability to send and + receive <acronym>ICMP</acronym> packets from the privately + configured addresses. Next, both gateways must be told how + to route packets in order to correctly send traffic from + either network. The following command will achieve this + goal:</para> - <screen>&prompt.root; <userinput>corp-net# route add <replaceable>10.0.0.0 10.0.0.5 255.255.255.0</replaceable></userinput></screen> + <screen>&prompt.root; <userinput>corp-net# route add <replaceable>10.0.0.0 10.0.0.5 255.255.255.0</replaceable></userinput></screen> - <screen>&prompt.root; <userinput>corp-net# route add net <replaceable>10.0.0.0: gateway 10.0.0.5</replaceable></userinput></screen> + <screen>&prompt.root; <userinput>corp-net# route add net <replaceable>10.0.0.0: gateway 10.0.0.5</replaceable></userinput></screen> - <screen>&prompt.root; <userinput>priv-net# route add <replaceable>10.246.38.0 10.246.38.1 255.255.255.0</replaceable></userinput></screen> + <screen>&prompt.root; <userinput>priv-net# route add <replaceable>10.246.38.0 10.246.38.1 255.255.255.0</replaceable></userinput></screen> - <screen>&prompt.root; <userinput>priv-net# route add host <replaceable>10.246.38.0: gateway 10.246.38.1</replaceable></userinput></screen> + <screen>&prompt.root; <userinput>priv-net# route add host <replaceable>10.246.38.0: gateway 10.246.38.1</replaceable></userinput></screen> - <para>At this point, internal machines should be reachable - from each gateway as well as from machines behind the - gateways. Again, use &man.ping.8; to confirm:</para> + <para>At this point, internal machines should be reachable + from each gateway as well as from machines behind the + gateways. Again, use &man.ping.8; to confirm:</para> - <programlisting>corp-net# ping 10.0.0.8 + <programlisting>corp-net# ping 10.0.0.8 PING 10.0.0.8 (10.0.0.8): 56 data bytes 64 bytes from 10.0.0.8: icmp_seq=0 ttl=63 time=92.391 ms 64 bytes from 10.0.0.8: icmp_seq=1 ttl=63 time=21.870 ms @@ -2573,15 +2573,15 @@ PING 10.246.38.1 (10.246.38.107): 56 dat 5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max/stddev = 21.145/31.721/53.491/12.179 ms</programlisting> - <para>Setting up the tunnels is the easy part. Configuring a - secure link is a more in depth process. The following - configuration uses pre-shared (<acronym>PSK</acronym>) - <acronym>RSA</acronym> keys. Other than the - <acronym>IP</acronym> addresses, the - <filename>/usr/local/etc/racoon/racoon.conf</filename> on - both gateways will be identical and look similar to:</para> + <para>Setting up the tunnels is the easy part. Configuring a + secure link is a more in depth process. The following + configuration uses pre-shared (<acronym>PSK</acronym>) + <acronym>RSA</acronym> keys. Other than the + <acronym>IP</acronym> addresses, the + <filename>/usr/local/etc/racoon/racoon.conf</filename> on + both gateways will be identical and look similar to:</para> - <programlisting>path pre_shared_key "/usr/local/etc/racoon/psk.txt"; #location of pre-shared key file + <programlisting>path pre_shared_key "/usr/local/etc/racoon/psk.txt"; #location of pre-shared key file log debug; #log verbosity setting: set to 'notify' when testing and debugging is complete padding # options are not to be changed @@ -2639,33 +2639,33 @@ sainfo (address 10.246.38.0/24 any addr compression_algorithm deflate; }</programlisting> - <para>For descriptions of each available option, refer to the - manual page for <filename>racoon.conf</filename>.</para> + <para>For descriptions of each available option, refer to the + manual page for <filename>racoon.conf</filename>.</para> - <para>The Security Policy Database (<acronym>SPD</acronym>) - needs to be configured so that &os; and - <application>racoon</application> are able to encrypt and - decrypt network traffic between the hosts.</para> - - <para>This can be achieved with a shell script, similar to the - following, on the corporate gateway. This file will be used - during system initialization and should be saved as - <filename>/usr/local/etc/racoon/setkey.conf</filename>.</para> + <para>The Security Policy Database (<acronym>SPD</acronym>) + needs to be configured so that &os; and + <application>racoon</application> are able to encrypt and + decrypt network traffic between the hosts.</para> + + <para>This can be achieved with a shell script, similar to the + following, on the corporate gateway. This file will be used + during system initialization and should be saved as + <filename>/usr/local/etc/racoon/setkey.conf</filename>.</para> - <programlisting>flush; + <programlisting>flush; spdflush; # To the home network spdadd 10.246.38.0/24 10.0.0.0/24 any -P out ipsec esp/tunnel/172.16.5.4-192.168.1.12/use; spdadd 10.0.0.0/24 10.246.38.0/24 any -P in ipsec esp/tunnel/192.168.1.12-172.16.5.4/use;</programlisting> - <para>Once in place, <application>racoon</application> may be - started on both gateways using the following command:</para> + <para>Once in place, <application>racoon</application> may be + started on both gateways using the following command:</para> - <screen>&prompt.root; <userinput>/usr/local/sbin/racoon -F -f /usr/local/etc/racoon/racoon.conf -l /var/log/racoon.log</userinput></screen> + <screen>&prompt.root; <userinput>/usr/local/sbin/racoon -F -f /usr/local/etc/racoon/racoon.conf -l /var/log/racoon.log</userinput></screen> - <para>The output should be similar to the following:</para> + <para>The output should be similar to the following:</para> - <programlisting>corp-net# /usr/local/sbin/racoon -F -f /usr/local/etc/racoon/racoon.conf + <programlisting>corp-net# /usr/local/sbin/racoon -F -f /usr/local/etc/racoon/racoon.conf Foreground mode. 2006-01-30 01:35:47: INFO: begin Identity Protection mode. 2006-01-30 01:35:48: INFO: received Vendor ID: KAME/racoon @@ -2678,43 +2678,43 @@ Foreground mode. 2006-01-30 01:36:18: INFO: IPsec-SA established: ESP/Tunnel 192.168.1.12[0]->172.16.5.4[0] spi=124397467(0x76a279b) 2006-01-30 01:36:18: INFO: IPsec-SA established: ESP/Tunnel 172.16.5.4[0]->192.168.1.12[0] spi=175852902(0xa7b4d66)</programlisting> - <para>To ensure the tunnel is working properly, switch to - another console and use &man.tcpdump.1; to view network - traffic using the following command. Replace - <literal>em0</literal> with the network interface card as - required:</para> - - <screen>&prompt.root; <userinput>tcpdump -i em0 host <replaceable>172.16.5.4 and dst 192.168.1.12</replaceable></userinput></screen> - - <para>Data similar to the following should appear on the - console. If not, there is an issue and debugging the - returned data will be required.</para> + <para>To ensure the tunnel is working properly, switch to + another console and use &man.tcpdump.1; to view network + traffic using the following command. Replace + <literal>em0</literal> with the network interface card as + required:</para> + + <screen>&prompt.root; <userinput>tcpdump -i em0 host <replaceable>172.16.5.4 and dst 192.168.1.12</replaceable></userinput></screen> + + <para>Data similar to the following should appear on the + console. If not, there is an issue and debugging the + returned data will be required.</para> - <programlisting>01:47:32.021683 IP corporatenetwork.com > 192.168.1.12.privatenetwork.com: ESP(spi=0x02acbf9f,seq=0xa) + <programlisting>01:47:32.021683 IP corporatenetwork.com > 192.168.1.12.privatenetwork.com: ESP(spi=0x02acbf9f,seq=0xa) 01:47:33.022442 IP corporatenetwork.com > 192.168.1.12.privatenetwork.com: ESP(spi=0x02acbf9f,seq=0xb) 01:47:34.024218 IP corporatenetwork.com > 192.168.1.12.privatenetwork.com: ESP(spi=0x02acbf9f,seq=0xc)</programlisting> - <para>At this point, both networks should be available and - seem to be part of the same network. Most likely both - networks are protected by a firewall. To allow traffic to - flow between them, rules need to be added to pass packets. - For the &man.ipfw.8; firewall, add the following lines to the - firewall configuration file:</para> + <para>At this point, both networks should be available and + seem to be part of the same network. Most likely both + networks are protected by a firewall. To allow traffic to + flow between them, rules need to be added to pass packets. + For the &man.ipfw.8; firewall, add the following lines to + the firewall configuration file:</para> - <programlisting>ipfw add 00201 allow log esp from any to any + <programlisting>ipfw add 00201 allow log esp from any to any ipfw add 00202 allow log ah from any to any ipfw add 00203 allow log ipencap from any to any ipfw add 00204 allow log udp from any 500 to any</programlisting> - <note> - <para>The rule numbers may need to be altered depending on - the current host configuration.</para> - </note> + <note> + <para>The rule numbers may need to be altered depending on + the current host configuration.</para> + </note> - <para>For users of &man.pf.4; or &man.ipf.8;, the following - rules should do the trick:</para> + <para>For users of &man.pf.4; or &man.ipf.8;, the following + rules should do the trick:</para> - <programlisting>pass in quick proto esp from any to any + <programlisting>pass in quick proto esp from any to any pass in quick proto ah from any to any pass in quick proto ipencap from any to any pass in quick proto udp from any port = 500 to any port = 500 @@ -2725,16 +2725,16 @@ pass out quick proto ipencap from any to pass out quick proto udp from any port = 500 to any port = 500 pass out quick on gif0 from any to any</programlisting> - <para>Finally, to allow the machine to start support for the - <acronym>VPN</acronym> during system initialization, add the - following lines to <filename>/etc/rc.conf</filename>:</para> + <para>Finally, to allow the machine to start support for the + <acronym>VPN</acronym> during system initialization, add the + following lines to <filename>/etc/rc.conf</filename>:</para> - <programlisting>ipsec_enable="YES" + <programlisting>ipsec_enable="YES" ipsec_program="/usr/local/sbin/setkey" ipsec_file="/usr/local/etc/racoon/setkey.conf" # allows setting up spd policies on boot racoon_enable="yes"</programlisting> - </sect3> - </sect2> + </sect3> + </sect2> </sect1> <sect1 id="openssh"> @@ -3719,11 +3719,11 @@ VII. References <co id="co-ref"/></progr <sect1 id="security-resourcelimits"> <sect1info> <authorgroup> - <author> - <firstname>Tom</firstname> - <surname>Rhodes</surname> - <contrib>Contributed by </contrib> - </author> + <author> + <firstname>Tom</firstname> + <surname>Rhodes</surname> + <contrib>Contributed by </contrib> + </author> </authorgroup> </sect1info> @@ -3767,35 +3767,37 @@ VII. References <co id="co-ref"/></progr <programlisting>options RACCT options RCTL</programlisting> - <para>The entire system will need rebuilt. See <xref - linkend="kernelconfig"/>, which will provide instructions for - the process. Once this is complete, the <command>rctl</command> - may be used to set rules for the system.</para> + <para>The entire system will need rebuilt. See + <xref linkend="kernelconfig"/>, which will provide instructions + for the process. Once this is complete, the + <command>rctl</command> may be used to set rules for the + system.</para> <para>Rule syntax is simple, controlled through the use of - a <emphasis>subject</emphasis>, a <emphasis>subject-id</emphasis>, - <emphasis>resource</emphasis>, and <emphasis>action</emphasis>. - Take the following example rule:</para> + a <emphasis>subject</emphasis>, a + <emphasis>subject-id</emphasis>, <emphasis>resource</emphasis>, + and <emphasis>action</emphasis>. Take the following example + rule:</para> <programlisting>user:trhodes:<literal>maxproc</literal>:<literal>deny</literal>=10/user</programlisting> - <para>This rule shows a basic premise of a rule, here the - subject is <literal>user</literal> and the subject-id - is <literal>trhodes</literal>. The maxproc is, of course, - max number of processes, which is considered the resource. - The action here is set to <literal>deny</literal>, which blocks - any new processes from being created. In the previous example, - the user, <literal>trhodes</literal> will be constrained - to <literal>10</literal> (ten) processes and no greater. - Other actions are available and could be log to the console, - pass a notification to &man.devd.8;, or - send a sigterm to the process.</para> + <para>This rule shows a basic premise of a rule, here the subject + is <literal>user</literal> and the subject-id is + <literal>trhodes</literal>. The maxproc is, of course, max + number of processes, which is considered the resource. The + action here is set to <literal>deny</literal>, which blocks any + new processes from being created. In the previous example, the + user, <literal>trhodes</literal> will be constrained to + <literal>10</literal> (ten) processes and no greater. Other + actions are available and could be log to the console, pass a + notification to &man.devd.8;, or send a sigterm to the + process.</para> <para>Some care must be taken while adding rules. The one above - will unfortunately block my user from doing the most simple tasks - after I have logged in and executed a <command>screen</command> - session. When a resource limit has been hit, an error will - be printed, as in this example:</para> + will unfortunately block my user from doing the most simple + tasks after I have logged in and executed a + <command>screen</command> session. When a resource limit has + been hit, an error will be printed, as in this example:</para> <screen>&prompt.user; <userinput>man test</userinput> /usr/bin/man: Cannot fork: Resource temporarily unavailable @@ -3808,9 +3810,9 @@ eval: Cannot fork: Resource temporarily <screen>&prompt.root; <userinput>rctl -a jail:httpd:memoryuse:deny=2G/jail</userinput></screen> <para>Rules may also persist across reboots if they have been - added to <filename>/etc/rctl.conf</filename>. The - format is a rule, without the preceding command. For example, - the previous rule could be added like the following:</para> + added to <filename>/etc/rctl.conf</filename>. The format is a + rule, without the preceding command. For example, the previous + rule could be added like the following:</para> <programlisting># Block jail from using more than 2G memory: jail:httpd:memoryuse:deny=2G/jail</programlisting> @@ -3826,7 +3828,7 @@ jail:httpd:memoryuse:deny=2G/jail</progr <screen>&prompt.root; <userinput>rctl -r user:trhodes</userinput></screen> - <para>Many other resources exist which can be used to excert + <para>Many other resources exist which can be used to exert additional control over various <literal>subjects</literal>. See &man.rctl.8; to learn about them.</para> </sect1>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201307130351.r6D3pNSR069093>