The candidate should be able to configure a network device to implement various network authentication schemes. This objective includes configuring a multi-homed network device, configuring a virtual private network and resolving networking and communication problems.
This objective has a weight of 4 points
Key Knowledge Areas:
The following is a partial list of used files, terms, and utilities:
VPN stands for Virtual Private Network. A VPN uses the Internet as its transport mechanism, while maintaining the security of the data on the VPN. What does a VPN do? It allows you to connect two or more remote networks securely over an insecure connection. The reason it is called virtual is that there is no physical connection between the two networks. Instead a non-dedicated secure tunnel is created through an insecure connection (like the Internet). This tunnel is generally encrypted and is only decrypted when it arrives at the destination host.
Why would you need such a network? In today's connected world, employees always need access to the data on the corporate network. Until recently this was done by dialing directly into the servers. The issue with this is that long-distance bills can be expensive as well as the cost of equipment and extra phone lines. By letting the employee connect via local internet access wherever he is, the costs are dramatically reduced.
Another reason for implementing a VPN is to integrate the LANs in several office or branches. By connecting the two networks, a user in Los Angeles can access network services in New York while still using their regular Internet connection.
There are many ways to implement a VPN. Many companies use proprietary software implementations while others use their routers because many routers have VPN support built in. These VPNs can be as simple as an SSH tunnel or very complicated. But all implementations create a virtual tunnel through an insecure network. Some VPN implementations include:
OpenVPN is a free and open source software application that implements virtual private network (VPN) techniques for creating secure point-to-point or site-to-site connections in routed or bridged configurations and remote access facilities. It uses SSL/TLS security for encryption and is capable of traversing network address translators (NATs) and firewalls.
OpenVPN allows peers to authenticate each other using a pre-shared secret key, certificates, or username/password. When used in a multiclient-server configuration, it allows the server to release an authentication certificate for every client, using signature and Certificate authority. It uses the OpenSSL encryption library extensively, as well as the SSLv3/TLSv1 protocol, and contains many security and control features.
OpenVPN is available on almost any modern operating system and can be built from source or installed as a pre-built package.
OpenVPN is not compatible with IPsec or any other VPN package. The entire package consists of one binary for both client and server connections, an optional configuration file, and one or more key files depending on the authentication method used.
This example uses static keys for authentication. This is a very simple setup, ideal for point-to-point networking.
A VPN tunnel will be created with a server endpoint of 10.10.10.10 and a client endpoint of 10.10.10.11. The public ipaddress of the server is referenced by vpnserver.example.com The communication between these endpoints will be encrypted and occur over the default OpenVPN port 1194.
To setup this example a key has to be created: openvpn --genkey --secret static.key.
Copy this key (
static.key) to both client and server.
Server configuration file (server.conf):
dev tun ifconfig 10.10.10.10 10.10.10.11 keepalive 10 60 ping-timer-rem persist-tun persist-key secret static.key
Client configuration file (client.conf):
remote vpnserver.example.com dev tun ifconfig 10.10.10.11 10.10.10.10 keepalive 10 60 ping-timer-rem persist-tun persist-key secret static.key
Start the vpn on the server by running openvpn server.conf and running openvpn client.conf on the client.
A more full-blown approach to VPN tunnels is the IPSEC protocol. IPSEC provides encryption and authentication services at the IP (Internet Protocol) level of the network protocol stack. IPSEC can be used on any machine which does IP networking. Dedicated IPSEC gateway machines can be installed wherever required to protect traffic. IPSEC can also run on routers, on firewall machines, on various application servers and on end-user desktop or laptop machines.
The basic idea of IPSEC is to provide security functions, authentication and encryption at the IP-level. This requires a higher-level protocol (IKE) to set things up for the IP-level services (ESP and AH).
Three protocols are used in an IPSEC implementation:
Encrypts and/or authenticates data;
Provides a packet authentication service;
Negotiates connection parameters, including keys, for the other two.
The term IPSEC is slightly ambiguous. In some contexts, it includes all three of the above, but, in other contexts, it refers only to AH and ESP.
KLIPS (kernel IPSEC) implements AH, ESP and packet handling within the kernel (2.4).
NETKEY is the Kernel IPSec implementation included with the 2.6 kernel.
Pluto (an IKE daemon) implements IKE, negotiating connections with other systems.
various scripts provide an administrator interface to the machinery.
The config file contain three parts:
Each connection section starts with
ident is an arbitrary name
which is used to identify the connection.
This section starts with
conn %default. For each parameter in it,
any section which does not have a parameter of the
same name gets a copy of the one from the
%default section. There may
be multiple %default sections, but only one
default may be supplied for any specific parameter
name and all
sections must precede all
%default sections of
A sample configuration file is shown below:
# basic configuration config setup interfaces="ipsec0=eth0" klipsdebug=none plutodebug=none plutoload=%search plutostart=%search # Close down old connection when new one using same ID shows up. uniqueids=yes # defaults that apply to all connection descriptions conn %default # How persistent to be in (re)keying negotiations (0 means very). keyingtries=0 # How to authenticate gateways authby=rsasig # VPN connection for head office and branch office conn head-branch # identity we use in authentication exchanges firstname.lastname@example.org leftrsasigkey=0x175cffc641f... left=184.108.40.206 leftnexthop=220.127.116.11 leftsubnet=192.168.11.0/24 # right s.g., subnet behind it, and next hop to reach left email@example.com rightrsasigkey=0xfc641fd6d9a24... right=18.104.22.168 rightnexthop=22.214.171.124 rightsubnet=192.168.0.0/24 # start automatically when ipsec is loaded auto=start
To avoid trivial editing of the configuration file for
each system involved in a connection,
specifications are written in terms of
right participants, rather than in
terms of local and remote. Which participant is considered
right is arbitrary; IPSEC figures
out on which it is running on based on internal
information. This permits identical connection
specifications to be used on both ends.
leftnexthop (and the
right... counterparts) determine
the layout of the connection:
leftrsasigkey are used in
authenticating the left participant. The
leftrsasigkey is the public key of
the left participant (in the example above the RSA keys
are shortened for easy display). The private key is stored
/etc/ipsec.secrets file and
should be kept secure.
The keys can be generated on both client and server with the command:
# ipsec rsasigkey --verbose 2048 > rsa.key
The IKE-daemon of IPSEC is called pluto. It will authenticate and negotiate the secure tunnels. Once the connections is set up, the kernel implementation of IPSEC can route traffic through the tunnel.
the pluto daemon to search the
configuration file for
statements. All connections with
auto=add will be loaded in the
pluto database. Connections with
auto=start will also be started.
Network troubleshooting is a very broad subject with thousands of tools available. There are some very good books available on this topic, so we will limit our discussion to an overview of some of the tools which can be used to solve or detect network problems.
ifconfig checks the network interface configuration. Use this command to verify the user's configuration if the user's system has been recently configured or if the user's system cannot reach the remote host while other systems on the same network can.
When ifconfig is entered with an interface name and
no other arguments, it displays the current values assigned
to that interface. For example, checking interface
eth0 system gives this report:
$ ifconfig eth0 eth0 Link encap:Ethernet HWaddr 00:10:60:58:05:36 inet addr:192.168.2.3 Bcast:192.168.2.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:1398185 errors:0 dropped:0 overruns:0 frame:0 TX packets:1411351 errors:0 dropped:0 overruns:0 carrier:0 collisions:829 txqueuelen:100 RX bytes:903174205 (861.3 Mb) TX bytes:201042106 (191.7 Mb) Interrupt:11 Base address:0xa000
The ifconfig command displays a few lines of output. The third line of the display shows the characteristics of the interface. Check for these characteristics:
The interface is enabled for use. If the interface is “down”, bring the interface “up” with the ifconfig command (e.g. ifconfig eth0 up).
This interface is operational. If the interface is not “running”, the driver for this interface may not be properly installed.
The second line of ifconfig output shows the IP address, the subnet mask and the broadcast address. Check these three fields to make sure the network interface is properly configured.
Two common interface configuration problems are misconfigured subnet masks and incorrect IP addresses. A bad subnet mask is indicated when the host can reach other hosts on its local subnet and remote hosts on distant network, but cannot reach hosts on other local subnets. ifconfig quickly reveals if a bad subnet mask is set.
An incorrectly set IP address can be a subtle problem. If the network part of the address is incorrect, every ping will fail with the “no answer” error. In this case, using ifconfig will reveal the incorrect address. However, if the host part of the address is wrong, the problem can be more difficult to detect. A small system, such as a PC that only connects out to other systems and never accepts incoming connections, can run for a long time with the wrong address without its user noticing the problem. Additionally, the system that suffers the ill effects may not be the one that is misconfigured. It is possible for someone to accidentally use your IP address on his own system and for his mistake to cause your system intermittent communications problems. This type of configuration error cannot be discovered by ifconfig, because the error is on a remote host. The arp command is used for this type of problem.
The ifconfig command can be used to set up multihomed network device. There are two ways a host can be multihomed.
Two Or More Interfaces To The Same Network: Devices such as servers or high-powered workstations may be equipped with two physical interfaces to the same network for performance and/or reliability reasons. They will have two IP addresses on the same network with the same network ID.
Interfaces To Two Or More Different Networks: Devices may have multiple interfaces to different networks. The IP addresses will typically have different network IDs in them.
The basic format of the ping command on a Linux system is:
$ ping [-c
The hostname or IP address of the remote host being tested.
The number of packets to be sent in the test. Use the count field and set the value low. Otherwise, the ping command will continue to send test packets until you interrupt it, usually by pressing CTRL-C (^C).
$ ping -c 4 www.snow.nl PING home.NL.net (126.96.36.199): 56 data bytes 64 bytes from 188.8.131.52: icmp_seq=0 ttl=245 time=32.1 ms 64 bytes from 184.108.40.206: icmp_seq=1 ttl=245 time=32.1 ms 64 bytes from 220.127.116.11: icmp_seq=2 ttl=245 time=37.6 ms 64 bytes from 18.104.22.168: icmp_seq=3 ttl=245 time=34.1 ms --- home.NL.net ping statistics --- 4 packets transmitted, 4 packets received, 0% packet loss round-trip min/avg/max = 32.1/33.9/37.6 ms
This test shows a good wide-area network link to
with no packet loss and fast response. A small
packet loss, and a round-trip time an order of magnitude
higher, would not be abnormal for a connection made across a
wide-area network. The statistics displayed by the ping
command can indicate a low-level network problem. The key
How long it takes a packet to make the round trip, displayed in milliseconds after the string time=;
The percentage of packets lost, displayed in a summary line at the end of the ping output.
If the packet loss is high, the response time is very high or packets are arriving out of order, there could be a network hardware problem. If you see these conditions when communicating over great distances on a wide area network, there is nothing to worry about. TCP/IP was designed to deal with unreliable networks, and some wide-area networks suffer from a high level of packet loss. But if these problems are seen on a local-area network, they indicate trouble.
On a local-network cable segment, the round-trip time should be near 0, there should be little or no packet loss and the packets should arrive in order. If these things are not true, there is a problem with the network hardware. On an Ethernet, the problem could be improper cable termination, a bad cable segment or a bad piece of “active” hardware, such as a hub, switch or transceiver.
The results of a simple ping test, even if the ping is successful, can help direct you to further testing toward the most likely causes of the problem. But other diagnostic tools are needed to examine the problem more closely and find the underlying cause.
$ route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 192.168.11.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 22.214.171.124 0.0.0.0 255.255.252.0 U 0 0 0 eth1 0.0.0.0 126.96.36.199 0.0.0.0 UG 0 0 0 eth1
This host has two interfaces, one on subnet 192.168.11.0/24
the other on subnet 188.8.131.52/22. There is also a default
route out on
eth1 to 184.108.40.206
(denoted by the
G under “Flags” and a
“Destination” and “Genmask” of 0.0.0.0).
To be able to troubleshoot this information you need to know what the routing should be, perhaps by saving the routing information when the system is known to work.
The two most common mistakes are:
No network entry for an interface. When a network interface is configured a routing entry should be added that informs the kernel about the network that can be reached through the interface.
No default route (or two default routes). There should be exactly one default route. Note that two default gateways can go undetected for a long time because the routing could “accidentally” use the proper gateway.
In general, if there is a routing problem, it is better to first locate the part of the network where the problem originates, e.g. with ping or traceroute and then use route as part of the diagnostics.
traceroute is a tool used to discover the links along a path. Path discovery is an essential step in diagnosing routing problems.
The traceroute is based on a clever use of the Time-To-Live (TTL) field in the IP packet's header. The TTL field is used to limit the life of a packet. When a router fails or is misconfigured, a routing loop or circular path may result. The TTL field prevents packets from remaining on a network indefinitely should such a routing loop occur. A packet's TTL field is decremented each time the packet crosses a router on its way through a network. When its value reaches 0, the packet is discarded rather than forwarded. When discarded, an ICMP TIME_EXCEEDED message is sent back to the packet's source to inform the source that the packet was discarded. By manipulating the TTL field of the original packet, the program traceroute uses information from these ICMP messages to discover paths through a network.
traceroute sends a series of UDP packets with the destination address of the device you want a path to. By default, traceroute sends sets of three packets to discover each hop. traceroute sets the TTL field in the first three packets to a value of 1 so that they are discarded by the first router on the path. When the ICMP TIME_EXCEEDED messages are returned by that router, traceroute records the source IP address of these ICMP messages. This is the IP address of the first hop on the route to the destination.
Next, three packets are sent with their TTL field set to 2. These will be discarded by the second router on the path. The ICMP messages returned by this router reveal the IP address of the second router on the path. The program proceeds in this manner until a set of packets finally has a TTL value large enough so that the packets reach their destination. Most implementations of traceroute default to trying only 30 hops before halting.
An example traceroute on linux looks like this:
$ traceroute vhost2.cistron.net traceroute to vhost2.cistron.net (220.127.116.11), 30 hops max, 38 byte packets 1 gateway.kabel.netvisit.nl (18.104.22.168) 56.013 ms 19.120 ms 12.642 ms 2 22.214.171.124 (126.96.36.199) 138.138 ms 28.482 ms 28.788 ms 3 asd-dc2-ias-ar10.nl.kpn.net (188.8.131.52) 102.338 ms 240.596 ms 253.462 ms 4 asd-dc2-ipc-dr03.nl.kpn.net (184.108.40.206) 95.325 ms 76.738 ms 97.651 ms 5 asd-dc2-ipc-cr01.nl.kpn.net (220.127.116.11) 61.378 ms 60.673 ms 75.867 ms 6 asd-sara-ipc-dr01.nl.kpn.net (18.104.22.168) 111.493 ms 96.631 ms 77.398 ms 7 asd-sara-ias-pr10.nl.kpn.net (22.214.171.124) 78.721 ms 95.029 ms 82.613 ms 8 ams-icr-02.carrier1.net (126.96.36.199) 90.179 ms 80.634 ms 112.130 ms 9 188.8.131.52 (184.108.40.206) 49.521 ms 80.354 ms 63.503 ms 10 220.127.116.11 (18.104.22.168) 94.528 ms 60.698 ms 103.550 ms 11 vhost2.cistron.net (22.214.171.124) 102.057 ms 62.515 ms 66.637 ms
Again, knowing what the route through your network should be, helps to localize the problem. Note that not all network problems can be detected with a traceroute, because of some complicating factors. First, the router at some hop may not return ICMP TIME_EXCEEDED messages. Second, some older routers may incorrectly forward packets even though the TTL is 0. A third possibility is that ICMP messages may be given low priority and may not be returned in a timely manner. Finally, beyond some point of the path, ICMP packets may be blocked.
The results of a traceroute is a great tool to narrow down the possible causes of a network problem.
arp is used to manipulate the kernel's ARP cache. The primary options are clearing an address mapping entry and manually setting one up. For debugging purposes, the arp program also allows a complete dump of the ARP cache.
If you know what the ARP address of a specific host should be, the dump may be used to determine a duplicate IP-address, but running arpwatch on a central system might prove more effective.
arpwatch keeps track of ethernet/IP address pairings. Changes are reported via syslog and e-mail.
arpwatch will report a “changed ethernet address” when a known IP address shows up with a new ethernet address. When the old ethernet address suddenly shows up again, a “flip flop” is reported.
Detection of duplicate IP addresses is very hard even with arpwatch. if, for example, a rogue host uses the IP address of the host running the arpwatch program or never communicates with it, a duplicate IP address will go unnoticed. Still, arpwatch is a very useful tool in detecting networking problems.
tcpdump is a program that enables network administrators to inspect in real-time every packet going through the network to which his or her computer is attached. This tool is typically used to monitor active connections or troubleshoot occasional network connectivity problems.
tcpdump can generate a lot of output, so
it may be useful to limit the reported packets by specifying
a port (e.g.
tcpdump port 80). There are lots of other ways to
specify which packets and what information we are interested
in - see the manpage of tcpdump for more
nmap is a versatile tool for network exploration and security auditing. It's main use is as a portscanner, which also can identify running services, versions of the running services and OS types.
An example of this command and output is:
# nmap -O -v localhost Starting Nmap 5.50 ( http://nmap.org ) at 2011-05-16 11:15 CEST Initiating SYN Stealth Scan at 11:15 Scanning localhost (127.0.0.1) [1000 ports] Discovered open port 22/tcp on 127.0.0.1 Discovered open port 25/tcp on 127.0.0.1 Discovered open port 111/tcp on 127.0.0.1 Discovered open port 631/tcp on 127.0.0.1 Completed SYN Stealth Scan at 11:15, 0.03s elapsed (1000 total ports) Initiating OS detection (try #1) against localhost (127.0.0.1) Nmap scan report for localhost (127.0.0.1) Host is up (0.00011s latency). Other addresses for localhost (not scanned): 127.0.0.1 Not shown: 996 closed ports PORT STATE SERVICE 22/tcp open ssh 25/tcp open smtp 111/tcp open rpcbind 631/tcp open ipp Device type: general purpose Running: Linux 2.6.X OS details: Linux 2.6.19 - 2.6.36 Uptime guess: 0.093 days (since Mon May 16 09:01:20 2011) Network Distance: 0 hops TCP Sequence Prediction: Difficulty=192 (Good luck!) IP ID Sequence Generation: All zeros Read data files from: /usr/share/nmap OS detection performed. Please report any incorrect results at http://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 2.15 seconds Raw packets sent: 1019 (45.598KB) | Rcv
wireshark (known as Ethereal until a trademark dispute in the summer of 2006) is an open source network protocol analyzer. It allows you to examine data from a live network or from a capture file on disk. You can interactively browse the capture data, delving down into just that level of packet detail you need.
Wireshark has several powerful features, including a rich display filter language and the ability to view the reconstructed stream of a TCP session. It also supports hundreds of protocols and media types. A tcpdump-like console version named tethereal is included. One word of caution is that Ethereal has suffered from dozens of remotely exploitable security holes, so stay up-to-date and be wary of running it on untrusted or hostile networks (such as security conferences).
The lsof command lists all open files on a system. Since Linux treats everything as a file, it also shows open network sockets. It can be used to find open ports on a system as well as determining the origin of a network connection.
Options of the lsof used for network troubleshooting.
List IP sockets. The -i option also takes arguments to restrict the sockets listed, like -i tcp or -i 192.168.1.2.
Do not resolve hostnames; can make lsof run faster.
Do not resolve port names; can make lsof run faster.
Resolve port name to protocol; default behaviour.
Like lsof,netstat is a program to list open ports on a system. It looks for the standard ports, but it also finds custom ports opened by applications, for instance netcat.
Frequently used options are:
List all sockets.
List only IP connections
Only show listening sockets
Show IP numbers instead of resolving them to hostnames.
Show the PID number and name of the process that is holding the socket.
Show the kernel routing table. Is the same as the route command.
nc Is used for arbitrary TCP and UDP connections and listens. The command allows the user to set up, analyze and read connections between systems. It is a very useful tool in the troubleshooting toolbox. nc Can be used to open up any port the user wants to be opened.
Because nc is capable of connecting and listening to any port it can be used to transfer files between systems that lack Samba, FTP or SSH etc.
if nmap is not available the nc command can be used to check for open ports: Run nc command with -z flag. You need to specify host name / ip along with the port range to limit and speedup operation. eg.
# nc -z localhost 1-1023