[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Use IPSEC as SSH replacement
>>>>> "Markku" == Markku Savela <msa@anise.tte.vtt.fi> writes:
Markku> Does it support a similar system as SSH? That is, asuming
Markku> IKE/IPSEC implementation on both ends, two totally unrelated
Markku> hosts can setup a secure connection between them. Without any
Markku> preconfigured keys or knowledge about each others public keys?
Markku> After that one could just use unmodified tools (telnet, smtp,
Markku> etc) again.
Two unrelated hosts could *not* set up a secure connection, as they would
have no mechanism to trust each other, although doing opportunistic
encryption is one of the goals of the FreeSWAN project. Such encryption
does not provide security.
SSH has the same properties, but it provides an easy way to make the
initial exchange of keys. That initial connection is generaly not secure.
If SSH or IKE end points have signaatures from a common CA, then there
is probably a way to establish trusted connection. (There may be other issues
that prevent it). But that requires "preconfiguration" of the root CA.
Markku> And the next step: perhaps we could have a "conditional policy":
Markku> even when communication is allowed to be in clear, the system
Markku> would just activate KEY negotiation on parallel, and if the other
Markku> end actually replies and loads SA's, IPSEC would kick in (and, of
Markku> course should remain enforced from then on during that session).
FreeSWAN may provide something like this. However, since the first thing I
do in a session is type my password in, I'd rather wait.
:!mcr!: | Network and security consulting/contract programming
Michael Richardson | Firewalls, TCP/IP and Unix administration
Personal: http://www.sandelman.ottawa.on.ca/People/Michael_Richardson/Bio.html
Corporate: http://www.sandelman.ottawa.on.ca/SSW/
ON HUMILITY: To err is human, to moo bovine.
References: