IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
FreeS/WAN can be used to protect communications between two local
networks over the Internet. The configuration of the components in the two
networks is as follows:
firewall.west firewall.east
gateway.west
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Internet
lan.west lan.east
gateway.east
The two locations west and east of an organisation both have a connection to
the Internet. They both use a multi-level firewall system which, however, for
the sake of simplification is represented in the diagram by a single symbol.
gateway.west and gateway.east are IT systems which run under the Linux
operating system and are to serve as gateways for the local networks lan.west
and lan.east with the aid of FreeS/WAN. Each of the gateways has two
network cards connecting it to the firewall systems and the local networks.
The aim is to ensure that all the IT systems in lan.west and lan.east can
communicate securely with each other. Protection of communications is to be
transparent for these IT systems.
It is important that a suitable key management procedure is chosen. It is
recommended that automatic exchange of keys over a public key procedure
(RSA) is used. Compared with the other procedures supported by the
FreeS/WAN, this offers the highest security level. The first step in the
configuration process therefore entails the generation of RSA key pairs for the
two gateways. This can be achieved, for example, using the command ipsec
rsasigkey. The keys should be at least 768 bits long. As noted in the
documentation, the keys thus generated may only be used for signatures and
not for encryption. The FreeS/WAN software package ensures that this is the
case. The command ipsec rsasigkey produces in each case the public and
private RSA keys. It is critical to the security of the VPN that the private key
cannot be compromised under any circumstances (see also S 2.46
Appropriate Key Management). The private key is stored in file
/etc/ipsec.secrets on the gateway. Ownership and permissions should be set as
follows:
-rw------- root root /etc/ipsec.secrets
By contrast, the public key is entered in file /etc/ipsec.conf (see below). This
file is where all the other settings for FreeS/WAN are made. The format is
designed in such a way that it may be possible to use the same file on both
gateways. Configuration entails making settings in the form parameter =
value in several sections. All the parameters which have to be set differently
for the two gateways have the prefix left or right. The relevant FreeS/WAN