1) In questo documento realizzeremo una VPN con IPSEC solamente con tool che siano presenti in una installazione di default di OpenBSD 3.2. Si può fare anche con versioni precedenti, ovviamente a scapito di minori features e probabilmente più bug noti non ancora risolti.

Ognuno dei computer, da cui eseguiremo gli esempi, ha un IP privato della classe 192.168.0.0/255.255.255.0. Non è importante ai fini dell’esempio conoscerli tutti, li vedremo mano a mano, useremo la classe 10.0.0.0/255.0.0.0 se ci serviranno altri indirizzi IP.

Ecco i computer utilizzati per l’esempio:

  • die0 -> Pentium 166 con OpenBSD 3.1
  • die1 -> Pentium 150 con OpenBSD 3.2
  • sparc -> Sun Sparcstation 10 con OpenBSD 3.2

2) PRIMA di configurare qualsiasi cosa, proviamo da Sparc ad effettuare un ping verso die1 e contemporaneamente da una terza macchina a fare sniffing del traffico.

[sparc.sick-net]# ping 192.168.0.8
PING 192.168.0.8 (192.168.0.8): 56 data bytes
64 bytes from 192.168.0.8: icmp_seq=0 ttl=255 time=1.962 ms
64 bytes from 192.168.0.8: icmp_seq=1 ttl=255 time=1.169 ms
64 bytes from 192.168.0.8: icmp_seq=2 ttl=255 time=1.104 ms
64 bytes from 192.168.0.8: icmp_seq=3 ttl=255 time=1.155 ms
64 bytes from 192.168.0.8: icmp_seq=4 ttl=255 time=1.164 ms
--- 192.168.0.8 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/std-dev = 1.104/1.310/1.962/0.329 ms
[sparc.sick-net]#

Ecco cosa vediamo facendo sniffing:

[die0.sick-net]# tcpdump -i fxp0 -s 1500 host 192.168.0.8 and host 192.168.0.17
tcpdump: listening on fxp0
13:44:39.628638 arp who-has die1.sick-net tell 192.168.0.17
13:44:39.628892 arp reply die1.sick-net is-at 0:50:fc:1:21:5f
13:44:39.629253 192.168.0.17 > die1.sick-net: icmp: echo request
13:44:39.629498 die1.sick-net > 192.168.0.17: icmp: echo reply
13:44:40.635745 192.168.0.17 > die1.sick-net: icmp: echo request
13:44:40.635982 die1.sick-net > 192.168.0.17: icmp: echo reply
13:44:41.645596 192.168.0.17 > die1.sick-net: icmp: echo request
13:44:41.645844 die1.sick-net > 192.168.0.17: icmp: echo reply
^C
949 packets received by filter
0 packets dropped by kernel
[die0.sick-net]#

Ogni pacchetto può essere visto e, con l’opzione -w, salvato su un file pcap analizzabile con tantissimi tool, anche grafici, o anche con un semplice hexdump o strings, il chè potrebbe permettere con estrema facilità la lettura di tutte password che passano su tale LAN: a meno che i pacchetti non siano criptati, magari con IPSec.

3) Abilitiamo i protocolli che dovremo usare nel kernel con sysctl (nel GENERIC ci sono già compilati, basta appunto abilitarli), abilitiamo anche il routing dei pacchetti, e facciamo in modo che vengano mantenute tali impostazioni anche al reboot:

Prima eseguiamo un backup di /etc/sysctl.conf con

cp /etc/sysctl.conf /etc/sysctl.conf.bak

.
In questo modo se dovessimo fare errori potremmo sempre ripristinare il file di sistema originale.

[die1.sick-net]# sysctl -w net.inet.esp.enable=1
net.inet.esp.enable: 1 -> 1
[die1.sick-net]# sysctl -w net.inet.ah.enable=1
net.inet.ah.enable: 1 -> 1
[die1.sick-net]# echo "net.inet.ah.enable=1" >> /etc/sysctl.conf <
[die1.sick-net]# echo "net.inet.esp.enable=1" >> /etc/sysctl.conf
[die1.sick-net]# sysctl -w net.inet.ip.forwarding=1
net.inet.ip.forwarding: 0 -> 1
[die1.sick-net]# sysctl -w net.inet6.ip6.forwarding=1
net.inet6.ip6.forwarding: 0 -> 1
[die1.sick-net]# echo "net.inet.ip.forwarding=1" >> /etc/sysctl.conf
[die1.sick-net]# echo "net.inet6.ip6.forwarding=1" >> /etc/sysctl.conf
[die1.sick-net]# sysctl -w net.inet.ipcomp.enable=1
net.inet.ipcomp.enable: 0 -> 1
[die1.sick-net]# echo "net.inet.ipcomp.enable=1" >> /etc/sysctl.conf

[sparc.sick-net]# sysctl -w net.inet.esp.enable=1
net.inet.esp.enable: 1 -> 1
[sparc.sick-net]# sysctl -w net.inet.ah.enable=1
net.inet.ah.enable: 1 -> 1
[sparc.sick-net]# echo "net.inet.ah.enable=1" >> /etc/sysctl.conf <
[sparc.sick-net]# echo "net.inet.esp.enable=1" >> /etc/sysctl.conf
[sparc.sick-net]# sysctl -w net.inet.ip.forwarding=1
net.inet.ip.forwarding: 0 -> 1
[sparc.sick-net]# sysctl -w net.inet6.ip6.forwarding=1
net.inet6.ip6.forwarding: 0 -> 1
[sparc.sick-net]# echo "net.inet.ip.forwarding=1" >> /etc/sysctl.conf
[sparc.sick-net]# echo "net.inet6.ip6.forwarding=1" >> /etc/sysctl.conf
[sparc.sick-net]# sysctl -w net.inet.ipcomp.enable=1
net.inet.ipcomp.enable: 0 -> 1
[sparc.sick-net]# echo "net.inet.ipcomp.enable=1" >> /etc/sysctl.conf

4) Creiamo su ogni macchina le chiavi e le SA (Security Associations), usando come convenzione A=die1=192.168.0.8/255.255.255.0 e B=sparc=192.168.0.17/255.255.255.0. Da questo punto in poi se dovessimo fare errori o semplicemente volessimo ricominciare da 0 senza bisogno di riavviare, potremmo semplicemente eseguire “

/sbin/ipsecadm flush

” resettando sia i flussi che le SA:

[die1.sick-net]# dd if=/dev/urandom bs=1024 count=1 | sha1
1+0 records in
1+0 records out
1024 bytes transferred in 0.062 secs (16466 bytes/sec)
4ae1fdd43524bb86d9298febc4b565ca4852664d
[die1.sick-net]# dd if=/dev/urandom bs=1024 count=1 | sha1
1+0 records in
1+0 records out
1024 bytes transferred in 0.069 secs (14762 bytes/sec)
f1381cdc084f64b1f13eed04cf682e840277e9ce

[die1.sick-net]# /sbin/ipsecadm new esp -src 192.168.0.8 -dst 192.168.0.17 -forcetunnel
-spi 1000 -enc blf -auth sha1 -key   4ae1fdd43524bb86d9298febc4b565ca4852664d -authkey f1381cdc084f64b1f13eed04cf682e840277e9ce
[die1.sick-net]# /sbin/ipsecadm new esp -src 192.168.0.17 -dst 192.168.0.8 -forcetunnel
-spi 1001 -enc blf -auth sha1 -key  4ae1fdd43524bb86d9298febc4b565ca4852664d -authkey f1381cdc084f64b1f13eed04cf682e840277e9ce

[sparc.sick-net]# /sbin/ipsecadm new esp -src 192.168.0.8 -dst 192.168.0.17 -forcetunnel -spi 1000 -enc blf
-auth sha1 -key  4ae1fdd43524bb86d9298febc4b565ca4852664d -authkey f1381cdc084f64b1f13eed04cf682e840277e9ce
[sparc.sick-net]# /sbin/ipsecadm new esp -src 192.168.0.17 -dst 192.168.0.8 -forcetunnel -spi 1001 -enc blf
-auth sha1 -key 4ae1fdd43524bb86d9298febc4b565ca4852664d -authkey f1381cdc084f64b1f13eed04cf682e840277e9ce

E’ necessario ricordarsi sempre di tenere *SEGRETE* queste chiavi. Non usare quelle dell’esempio ma crearne di nuove, inquanto queste ormai sono già state sicuramente lette.

5) Creiamo su ogni macchina i flussi di uscita e di ingresso per i pacchetti cryptati, sarebbero quindi 8 per ogni macchina, 4 di uscita e 4 di ingresso, 2 per ogni ip gestito, cioè quello pubblico su internet delle due macchine e quello privato sulla LAN interna, come ip “virtuali” per due eventuali interfacce di lan interna sui due lati della vpn useremo questi A=die1=10.0.1.1/255.255.255.0 e B=sparc=10.0.2.2/255.255.255.0, se ci si volesse limitare soltanto a riuscire a criptare il traffico tra le due macchine basterebbe configurare solamente i primi 2 flussi elencati sotto di ogni macchina.

[die1.sick-net]# /sbin/ipsecadm flow -dst 192.168.0.17 -proto esp -addr 192.168.0.8 255.255.255.255 192.168.0.17 255.255.255.255
-require  -out -src 192.168.0.8
[die1.sick-net]# /sbin/ipsecadm flow -dst 192.168.0.17 -proto esp -addr 192.168.0.17 255.255.255.255 192.168.0.8 255.255.255.255
-require -in  -src 192.168.0.8

[die1.sick-net]# /sbin/ipsecadm flow -dst 192.168.0.17 -proto esp -addr 10.0.1.0 255.255.255.0 10.0.2.0 255.255.255.0
-require -out -src 192.168.0.8
[die1.sick-net]# /sbin/ipsecadm flow -dst 192.168.0.17 -proto esp -addr 192.168.0.8 255.255.255.255 10.0.2.0 255.255.255.0
-require -out -src 192.168.0.8
[die1.sick-net]# /sbin/ipsecadm flow -dst 192.168.0.17 -proto esp -addr 10.0.1.0 255.255.255.0 192.168.0.17 255.255.255.255
-require -out -src 192.168.0.8
[die1.sick-net]# /sbin/ipsecadm flow -dst 192.168.0.17 -proto esp -addr 10.0.2.0 255.255.255.0 10.0.1.0 255.255.255.0
-require -in -src 192.168.0.8
[die1.sick-net]# /sbin/ipsecadm flow -dst 192.168.0.17 -proto esp -addr 192.168.0.17 255.255.255.255 10.0.1.0 255.255.255.0
-require -in -src 192.168.0.8
[die1.sick-net]# /sbin/ipsecadm flow -dst 192.168.0.17 -proto esp -addr 10.0.2.0 255.255.255.0 192.168.0.8 255.255.255.255
-require -in -src  192.168.0.8
***

***
[sparc.sick-net]# /sbin/ipsecadm flow -dst 192.168.0.8 -proto esp -addr 192.168.0.17 255.255.255.255 192.168.0.8 255.255.255.255
-require -out -src 192.168.0.17
[sparc.sick-net]# /sbin/ipsecadm flow -dst 192.168.0.8 -proto esp -addr 192.168.0.8 255.255.255.255 192.168.0.17 255.255.255.255
-require -in -src 192.168.0.17

[sparc.sick-net]# /sbin/ipsecadm flow -dst 192.168.0.8 -proto esp -addr 10.0.2.0 255.255.255.0 10.0.1.0 255.255.255.0
-require -out -src 192.168.0.17
[sparc.sick-net]# /sbin/ipsecadm flow -dst 192.168.0.8 -proto esp -addr 192.168.0.17 255.255.255.255 10.0.1.0 255.255.255.0
-require -out  -src 192.168.0.17
[sparc.sick-net]# /sbin/ipsecadm flow -dst 192.168.0.8 -proto esp -addr 10.0.2.0 255.255.255.0 192.168.0.8 255.255.255.255
-require -out -src 192.168.0.17
[sparc.sick-net]# /sbin/ipsecadm flow -dst 192.168.0.8 -proto esp -addr 10.0.1.0 255.255.255.0 10.0.2.0 255.255.255.0
-require -in -src 192.168.0.17
[sparc.sick-net]# /sbin/ipsecadm flow -dst 192.168.0.8 -proto esp -addr 192.168.0.8 255.255.255.255 10.0.2.0 255.255.255.0
-require -in -src  192.168.0.17
[sparc.sick-net]# /sbin/ipsecadm flow -dst 192.168.0.8 -proto esp -addr 10.0.1.0 255.255.255.0 192.168.0.17 255.255.255.255
-require -in -src 192.168.0.17
***

Dopo aver fatto questo sui due host dovremmo avere una routing table simile a questa, controllabile con

netstat -nr

(non ci interessa risolvere i nomi, nè quello che c’è prima di Encap):

[die1.sick-net]# netstat -nr
Encap:
Source Port Destination Port Proto SA(Address/Proto/Type/Direction)
10.0.2/24 0 10.0.1/24 0 0 192.168.0.17/50/require/in
10.0.2/24 0 192.168.0.8/32 0 0 192.168.0.17/50/require/in
192.168.0.17/32 0 10.0.1/24 0 0 192.168.0.17/50/require/in
192.168.0.17/32 0 192.168.0.8/32 0 0 192.168.0.17/50/require/in
10.0.1/24 0 10.0.2/24 0 0 192.168.0.17/50/require/out
10.0.1/24 0 192.168.0.17/32 0 0 192.168.0.17/50/require/out
192.168.0.8/32 0 10.0.2/24 0 0 192.168.0.17/50/require/out
192.168.0.8/32 0 192.168.0.17/32 0 0 192.168.0.17/50/require/out

[sparc.sick-net]# netstat -nr
Encap:
Source Port Destination Port Proto SA(Address/Proto/Type/Direction)
10.0.1/24 0 10.0.2/24 0 0 192.168.0.8/50/require/in
10.0.1/24 0 192.168.0.17/32 0 0 192.168.0.8/50/require/in
192.168.0.8/32 0 10.0.2/24 0 0 192.168.0.8/50/require/in
192.168.0.8/32 0 192.168.0.17/32 0 0 192.168.0.8/50/require/in
10.0.2/24 0 10.0.1/24 0 0 192.168.0.8/50/require/out
10.0.2/24 0 192.168.0.8/32 0 0 192.168.0.8/50/require/out
192.168.0.17/32 0 10.0.1/24 0 0 192.168.0.8/50/require/out
192.168.0.17/32 0 192.168.0.8/32 0 0 192.168.0.8/50/require/out

6) Ora controlliamo se tra i 2 host iniziali la connessione avviene cryptata o meno, rifacendo la semplice prova con ping come al punto 2:

[die1.sick-net]# ping -c 3 192.168.0.17
PING 192.168.0.17 (192.168.0.17): 56 data bytes
64 bytes from 192.168.0.17: icmp_seq=0 ttl=255 time=5.382 ms
64 bytes from 192.168.0.17: icmp_seq=1 ttl=255 time=4.394 ms
64 bytes from 192.168.0.17: icmp_seq=2 ttl=255 time=4.321 ms
--- 192.168.0.17 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max/std-dev = 4.321/4.699/5.382/0.483 ms
[die1.sick-net]#

[sparc.sick-net]# ping -c 3 192.168.0.8
PING 192.168.0.8 (192.168.0.8): 56 data bytes
64 bytes from 192.168.0.8: icmp_seq=0 ttl=255 time=5.091 ms
64 bytes from 192.168.0.8: icmp_seq=1 ttl=255 time=4.742 ms
64 bytes from 192.168.0.8: icmp_seq=2 ttl=255 time=4.730 ms
--- 192.168.0.8 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max/std-dev = 4.730/4.854/5.091/0.176 ms
[sparc.sick-net]#

[die0.sick-net]# tcpdump -i fxp0 -s 1500 host 192.168.0.8 and host 192.168.0.17
tcpdump: listening on fxp0
12:00:27.237979 esp die1.sick-net > 192.168.0.17 spi 0x00001000 seq 13 len 116
12:00:27.241112 esp 192.168.0.17 > die1.sick-net spi 0x00001001 seq 13 len 116
12:00:28.240834 esp die1.sick-net > 192.168.0.17 spi 0x00001000 seq 14 len 116
12:00:28.243783 esp 192.168.0.17 > die1.sick-net spi 0x00001001 seq 14 len 116
12:00:29.250609 esp die1.sick-net > 192.168.0.17 spi 0x00001000 seq 15 len 116
12:00:29.253543 esp 192.168.0.17 > die1.sick-net spi 0x00001001 seq 15 len 116
12:00:38.039461 esp 192.168.0.17 > die1.sick-net spi 0x00001001 seq 16 len 116
12:00:38.040698 esp die1.sick-net > 192.168.0.17 spi 0x00001000 seq 16 len 116
12:00:39.048395 esp 192.168.0.17 > die1.sick-net spi 0x00001001 seq 17 len 116
12:00:39.049592 esp die1.sick-net > 192.168.0.17 spi 0x00001000 seq 17 len 116
12:00:40.058269 esp 192.168.0.17 > die1.sick-net spi 0x00001001 seq 18 len 116
12:00:40.059413 esp die1.sick-net > 192.168.0.17 spi 0x00001000 seq 18 len 116
^C
417 packets received by filter
0 packets dropped by kernel
[die0.sick-net]#

Perfetto. Tutti i pacchetti sono di tipo spi e sono quindi criptati, ma non solo. Adesso proviamo a pingare i 2 host “virtuali” tra loro, che altro non sarebbero che le due LAN ruotate attraverso la nostra vpn appena creata:

[die1.sick-net]# ping -c 3 10.0.2.2
PING 10.0.2.2 (10.0.2.2): 56 data bytes
64 bytes from 10.0.2.2: icmp_seq=0 ttl=255 time=4.577 ms
64 bytes from 10.0.2.2: icmp_seq=1 ttl=255 time=4.343 ms
64 bytes from 10.0.2.2: icmp_seq=2 ttl=255 time=4.438 ms
--- 10.0.2.2 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max/std-dev = 4.343/4.452/4.577/0.123 ms
[die1.sick-net]#

[sparc.sick-net]# ping -c 3 10.0.1.1
PING 10.0.1.1 (10.0.1.1): 56 data bytes
64 bytes from 10.0.1.1: icmp_seq=0 ttl=255 time=6.613 ms
64 bytes from 10.0.1.1: icmp_seq=1 ttl=255 time=4.679 ms
64 bytes from 10.0.1.1: icmp_seq=2 ttl=255 time=4.700 ms
--- 10.0.1.1 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max/std-dev = 4.679/5.330/6.613/0.910 ms
[sparc.sick-net]#

[die0.sick-net]# tcpdump -i fxp0 -s 1500 host 192.168.0.8 and host 192.168.0.17
tcpdump: listening on fxp0
12:02:23.346286 esp 192.168.0.17 > die1.sick-net spi 0x00001001 seq 19 len 116
12:02:23.347548 esp die1.sick-net > 192.168.0.17 spi 0x00001000 seq 19 len 116
12:02:24.358961 esp 192.168.0.17 > die1.sick-net spi 0x00001001 seq 20 len 116
12:02:24.360089 esp die1.sick-net > 192.168.0.17 spi 0x00001000 seq 20 len 116
12:02:25.368772 esp 192.168.0.17 > die1.sick-net spi 0x00001001 seq 21 len 116
12:02:25.369932 esp die1.sick-net > 192.168.0.17 spi 0x00001000 seq 21 len 116
12:02:28.538368 esp die1.sick-net > 192.168.0.17 spi 0x00001000 seq 22 len 116
12:02:28.541439 esp 192.168.0.17 > die1.sick-net spi 0x00001001 seq 22 len 116
12:02:29.547144 esp die1.sick-net > 192.168.0.17 spi 0x00001000 seq 23 len 116
12:02:29.550085 esp 192.168.0.17 > die1.sick-net spi 0x00001001 seq 23 len 116
12:02:30.556963 esp die1.sick-net > 192.168.0.17 spi 0x00001000 seq 24 len 116
12:02:30.559968 esp 192.168.0.17 > die1.sick-net spi 0x00001001 seq 24 len 116
^C
228 packets received by filter
0 packets dropped by kernel
[die0.sick-net]#

Benissimo. Non solo vengono cryptati i flussi di dati, ma vengono anche incapsulati gli header IP dei pacchetti tra le due LAN, così dall’esterno non è possibile vedere quali sono gli ip delle LAN private dietro i router IPSec.

A proposito dell'autore

Da aggiornare.

Post correlati

Close
Entra in contatto con altri professionisti ICT, seguici su Facebook e Twitter: