IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
S 5.83 Secure Connection of an External Network
with Linux FreeS/WAN
Initiation responsibility: Head of IT Section, Administrator
Implementation responsibility: Administrator
In many organisations there is a requirement to link up the various local
networks which are installed at individual locations. In most cases this is
achieved using leased lines or public networks which are outside the control of
the organisation. In such cases there is a danger that the transmitted data could
be intercepted or tampered with or that an adversary could pass himself off as
an authorised communication partner (a masquerade attack). These threats can
be countered through use of a Virtual Private Network (VPN). With the aid of
cryptographic procedures, it is then possible to protect the integrity and
confidentiality of the data and to reliably authenticate communication
partners. Linux FreeS/WAN is a freeware software package for the Linux
operating system, with whose assistance a VPN that complies with the IPSEC
standard can be established.
Planning
As the first step in the planning phase, the requirements which the product that
will be used to protect the communications link must satisfy should be
established. These include, for example, whether it needs to work alongside
existing components or whether other protocols apart from TCP/IP have to be
transported. The documentation for FreeS/WAN should then be worked
through and used to determine whether this software package is suitable for
the task in hand. If it is suitable, then the next step is to identify and document
which functions of FreeS/WAN are to be used for what purpose and how it
should be incorporated into the existing network structure.
Installation
FreeS/WAN runs on the freeware operating system Linux and meshes with the
IP protocol stack of the kernel.
It is recommended that FreeS/WAN is only run on PCs that are configured for
this purpose and that no other services - apart from any routing functions
which may be required - are activated on these PCs (see also S 4.97 One
Service per Server). In particular, they should not execute any firewall
functions but should be independent of the firewall system. To install the
operating system it is recommended using a Linux package which already
contains FreeS/WAN. This facilitates installation considerably, as otherwise it
is usually necessary to recompile the Linux kernel. Reference should be made
here to the FreeS/WAN documentation. Moreover, only those software
modules within the Linux package which are absolutely necessary should be
installed.
Configuration
FreeS/WAN implements a whole range of different functions which are
defined in IPSEC. Through appropriate configuration settings it is therefore
possible to use this software package in many different environments, and for
quite different application areas. The example provided below illustrates how
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000