Commit | Line | Data |
---|---|---|
2fe58dfd SE |
1 | INSTALLATION INSTRUCTIONS for SECNET |
2 | ||
3 | Ensure that you have libgmp2-dev and adns installed (and bison and | |
4 | flex, and for that matter gcc...). | |
5 | ||
6 | If you intend to configure secnet to obtain packets from the kernel | |
7 | through userv-ipif, install and configure userv-ipif. It is part of | |
8 | userv-utils, available from ftp.chiark.greenend.org.uk in | |
9 | /users/ian/userv | |
10 | ||
4efd681a SE |
11 | If you intend to configure secnet to obtain packets from the kernel |
12 | using the universal TUN/TAP driver, make sure it's configured in your | |
13 | kernel (it's under "network device support" in Linux) and that you've | |
14 | created the appropriate device files; see | |
15 | linux/Documentation/networking/tuntap.txt | |
16 | ||
17 | If you're using TUN/TAP on a platform other than Linux, see | |
18 | http://vtun.sourceforge.net/tun/ | |
19 | ||
2fe58dfd SE |
20 | Then, to install secnet do |
21 | ||
22 | $ ./configure | |
23 | $ make | |
24 | # cp secnet /usr/local/sbin/secnet | |
25 | # mkdir /etc/secnet | |
26 | # cp example.conf /etc/secnet/secnet.conf | |
27 | # cd /etc/secnet | |
28 | # ssh-keygen -f key -N "" | |
29 | ||
30 | (When upgrading, just install the new /usr/local/sbin/secnet; keep | |
31 | your current configuration file.) | |
32 | ||
33 | If you intend to start secnet as root, I suggest you create an userid | |
34 | for it to run as once it's ready to drop its privileges. Example: | |
35 | # adduser --system --no-create-home secnet | |
36 | ||
37 | Generate a site file fragment for your site, and submit it for | |
38 | inclusion in the vpn-sites file. Download the vpn-sites file. | |
39 | ||
40 | * Constructing a site file fragment | |
41 | ||
42 | You need the following information: | |
43 | ||
44 | 1. a short name for your site, eg. "greenend". This is used to | |
45 | identify your site in the vpn-sites file. | |
46 | ||
47 | 2. the name your site will use in the key setup protocol, | |
48 | eg. "greenend" (these two will usually be similar or the same). | |
49 | ||
50 | 3. the DNS name of the machine that will be the "front-end" for your | |
51 | secnet installation. This will typically be the name of the gateway | |
52 | machine for your network, eg. sinister.dynamic.greenend.org.uk | |
53 | ||
54 | secnet does not actually have to run on this machine, as long as the | |
55 | machine can be configured to forward UDP packets to the machine that | |
56 | is running secnet. | |
57 | ||
58 | 4. the port number used to contact secnet at your site. This is the | |
59 | port number on the front-end machine, and does not necessarily have to | |
60 | match the port number on the machine running secnet. | |
61 | ||
62 | 5. the list of networks accessible at your site over the VPN. | |
63 | ||
64 | 6. the public part of the RSA key you generated during installation | |
65 | (in /etc/secnet/key.pub if you followed the installation | |
66 | instructions). This file contains three numbers and a comment on one | |
67 | line. The first number is the key length in bits, and can be | |
68 | ignored. The second number (typically small) is the encryption key | |
69 | 'e', and the third number (large) is the modulus 'n'. | |
70 | ||
71 | If you are running secnet on a particularly slow machine, you may like | |
72 | to specify a larger value for the key setup retry timeout than the | |
73 | default, to prevent unnecessary retransmissions of key setup | |
74 | packets. See the notes in the example configuration file for more on | |
75 | this. | |
76 | ||
77 | The site file fragment should look something like this: | |
78 | ||
79 | shortname { | |
80 | name "sitename"; | |
81 | address "your.public.address.org.uk"; | |
82 | port 5678; | |
83 | networks "172.18.45.0/24"; | |
84 | key rsa-public("35","153279875126380522437827076871354104097683702803616313419670959273217685015951590424876274370401136371563604396779864283483623325238228723798087715987495590765759771552692972297669972616769731553560605291312242789575053620182470998166393580503400960149506261455420521811814445675652857085993458063584337404329"); | |
85 | }; |