ppp-ssh(1).pdf
(
62 KB
)
Pobierz
VPN PPP-SSH Mini-HOWTO
VPN PPP−SSH Mini−HOWTO
Scott Bronson
bronson@trestle.com
2001−07−29
Revision History
Revision v1.00
2002−01−16
Revised by: sb
Initial (public) release.
A PPP−SSH VPN is probably the easiest type of VPN to set up. It uses nothing more than the very common
PPP and SSH utilities to form an encrypted network tunnel between two hosts.
VPN PPP−SSH Mini−HOWTO
Table of Contents
1. Introduction.
....................................................................................................................................................1
1.1. Copyright.
.........................................................................................................................................1
1.2. Disclaimer.
........................................................................................................................................1
1.3. Credits.
..............................................................................................................................................1
2. Introduction.
....................................................................................................................................................2
2.1. PPP−SSH Benefits.
...........................................................................................................................2
2.2. PPP−SSH Drawbacks.
......................................................................................................................2
2.3. Suggested Reading.
...........................................................................................................................4
2.4. Alternatives.
......................................................................................................................................4
3. Software Installation.
......................................................................................................................................6
3.1. Terminology..
....................................................................................................................................6
3.2. Requirements.
...................................................................................................................................6
3.3. Planning.
...........................................................................................................................................6
3.4. Set Up PPP.
.......................................................................................................................................7
3.5. Allow SSH Through the Firewall.
....................................................................................................8
4. Configure the Server.
......................................................................................................................................9
4.1. Create a VPN User.
...........................................................................................................................9
4.2. Set up Authenticated Login.
.............................................................................................................9
4.3. Set Up sudo.
....................................................................................................................................10
5. Configure the Client.
....................................................................................................................................12
5.1. Install the Script.
.............................................................................................................................12
5.2. The vpn−pppssh Script
...................................................................................................................12
6. Bring up the Link.
.........................................................................................................................................15
6.1. Troubleshooting.
.............................................................................................................................15
6.1.1. sendto: Operation not permitted.
....................................................................................15
7. Integrating the VPN into your system
........................................................................................................17
7.1. Connecting at Boot Time.
...............................................................................................................17
7.2. Connecting via Dial−Up.
................................................................................................................17
8. Forwarding Between Subnets.
.....................................................................................................................19
8.1. Forwarding.
.....................................................................................................................................19
8.2. Gatewaying.
....................................................................................................................................19
8.3. Routing..
..........................................................................................................................................19
8.4. Masquerading.
.................................................................................................................................20
8.5. Now try it.
.......................................................................................................................................20
i
1. Introduction
The technique described in this HOWTO uses PPP to convert packets into a character stream and SSH to
encrypt it and transmit it to the remote computer. Most system administrators are well acquainted with the
tools and configuration files needed to set up a PPP−SSH VPN.
While it works well with moderate loads over a reliable connection, be warned that a PPP−SSH VPN is
subject to some scalability problems. I've included a list of benefits in
Section 2.1
and drawbacks in
Section
2.2
so you can decide for yourself if a PPP−SSH VPN is a good fit for your needs.
1.1. Copyright
Copyright © 2001 Scott Bronson. This document may be distributed under the terms set forth in the GNU
Free Documentation License. A copy of this license can be found at
http://www.fsf.org/licenses/fdl.html
.
1.2. Disclaimer
You use the information in this document entirely at your own risk. I especially make no guarantees as to the
legality or cryptographic strength of the techniques described here. If you feel that you cannot take full
responsibility for your setup, then you need to put down this HOWTO and hire one of the many excellent
companies who provide accountable, professional VPN service.
1.3. Credits
I took some notes as I adapted Bart Trojanowski's excellent
instructions
to a newer version of PPP running on
my Debian system. A few weeks later, I converted the notes into SGML. Eventually, those evolved into this
HOWTO.
Bart's instructions were based on Arpad Magosanyi's good but now fairly dated
VPN Mini−HOWTO
. If you
run into troubles and my document doesn't seem to help, or if you're running an older version of the Linux
kernel or PPP, you'll definitely want to give his HOWTO a read.
1. Introduction
1
2. Introduction
2.1. PPP−SSH Benefits
There are a number of benefits to setting up a PPP−SSH VPN. It's relatively simple, it uses common
off−the−shelf tools, and it probably won't require a reboot before bringing up the link. Here's a more
comprehensive list:
Easy to install
You probably won't need to patch or recompile your kernel, run LILO, reboot, or perform any other
perilous administration activities. PPP and SSH are included with most distributions, and most
kernels come preconfigured to use them properly.
Easy to set up
You should not have to edit any existing configuration files. You simply customize the script file
provided later in this document, which contains all the VPN configuration info, and then execute it
on the client machine. Any existing PPP or SSH configurations should continue to work just fine.
No mucking with firewalling
If the SSH protocol currently traverses your firewall, then PPP over SSH will traverse your firewall
as well. (If you aren't using SSH, then why not? It is almost a required tool for system administrators
nowadays.)
No mucking with manual routing
pppd automatically sets up routing for you. And, if you have very complex routing needs, it's very
easy to put the custom routing commands in the script file.
No need for static IP addresses
PPP−SSH VPNs have no trouble whatsoever with dynamic IP addressess. The client must be able to
find the server to connect to, of course, but dynamic DNS would work fine for that. Setting up a VPN
over a dialup connection is no problem.
Multiple Tunnels are Easy
It's easy to set up multiple tunnels to a single computer. You simply need to make sure that the IP
address for each tunnel's network interface is distinct.
2.2. PPP−SSH Drawbacks
This type of VPN is not without a few difficulties. Basically, it doesn't run unattended very well. If you're
looking for a production−quality VPN that you can set up and forget about, you will proabably find
PPP−SSH a little disappointing. Some alternatives are described in
Section 2.4
.
2. Introduction
2
VPN PPP−SSH Mini−HOWTO
Trying to maintain a TCP connection
If the SSH TCP connection is broken for any reason, your VPN goes down hard and takes all
tunnelled TCP connections with it. If you have a less than reliable link −− say it's difficult to
download more than a few tens of megabytes at one go −− you will be re−starting the VPN a lot.
Running IP packets over a TCP stream
The TCP protocol consists of streams layered on top of IP packets. When you
then
run IP packets
over the TCP stream (as we're attempting to do), the personality conflict between the two can become
very apparent. Mostly, this manifests itself as weird delays, dropouts, and oscillations. Sometimes
you'll see problems at load, sometimes with next to no traffic. Short of changing the entire OSI model
(ha ha), there's not much that can be done about this.
Tends to be bursty
For some reason, when network load gets high, one tunneled TCP connection tends to get all the
bandwidth and the others get ignored. This leads to timeouts and dropped connections. Theoretically,
this is fixable.
Can't reliably tell when link is down
Keepalives are small packets sent to tell the machine on the other end that the connection is still up.
If the network load gets too high, keepalives will be delayed. The other machine will mistakenly
assume the connection has been dropped and take down its end of the link.
Without keepalives, however, there's no way for either machine tell if the link has been dropped.
When one machine tries to bring the link back up, if the other machine thinks it already has it up,
confusion can reign. Most often this will show up as multiple ppp network devices, duplicate routes,
and tunnels that appear to be up but drop every packet. A liberal use of "killall −9 pppd" will usually
set things back in order. A more intelligent start script could probably improve this.
Too many simultaneous connections avalanches fast
When I use regular PPP over a 56K modem and Postfix opens 10+ connections to deliver my
outgoing mail, everything works well. However, when I try to run this exact traffic over a VPN
tunneled over a much faster DSL link, it stalls out. Ping times skyrocket for a spell (2 minutes and
beyond), traffic moves at a trickle for a while, then it stops completely. The only way to get packets
moving again is to restart the tunnel. I'm not sure if this is a bug or an inherent limitation. Reducing
the number of connections that Postfix maintains for outgoing mail fixed this problem for me..
It's high−overhead, high−latency
Ping times over my 57.6 modem connection are normally in the 130−170 ms range. However, ping
times for a PPP−SSH VPN running over the same modem connection are in the 300−330 ms range.
Turning on PPP compression can help a lot if you're transmitting compressible data. Email is
compressible, Vorbis files are not.
2. Introduction
3
Plik z chomika:
megaskrypty
Inne pliki z tego folderu:
3-Button-Mouse(1).pdf
(58 KB)
XWindow-Overview-HOWTO(1).pdf
(30 KB)
Xterm-Title(1).pdf
(39 KB)
Xterminals(1).pdf
(30 KB)
Xinerama-HOWTO(1).pdf
(33 KB)
Inne foldery tego chomika:
Programowanie
Zgłoś jeśli
naruszono regulamin