<filename>/etc/rc.conf.local</filename> or

	<filename>/etc/rc.conf.local</filename> or

	<filename>/etc/rc.conf</filename> to enable your firewall,

	<filename>/etc/rc.conf</filename> to enable your firewall,

	it is important to make sure your firewall is enabled before

	it is important to make sure your firewall is enabled before

      <para>The next problem is what your firewall should actually

      <para>The next problem is what your firewall should actually

	<emphasis>do</emphasis>! This is largely dependent on what access to

	<emphasis>do</emphasis>! This is largely dependent on what access to

    <tip>

    <tip>

      <para>For other HOWTOs detailing IPSec implementation in

      <para>For other HOWTOs detailing IPSec implementation in

    </tip>

    </tip>

    <para>The IPsec mechanism provides secure communication for IP

    <para>The IPsec mechanism provides secure communication for IP

    <para>The current IPsec implementation supports both transport mode

    <para>The current IPsec implementation supports both transport mode

    <para>Please be aware that in order to use this functionality, you

    <para>Please be aware that in order to use this functionality, you

      must have the following options compiled into your kernel:</para>

      must have the following options compiled into your kernel:</para>

      <title>Transport Mode Example with IPv4</title>

      <title>Transport Mode Example with IPv4</title>

      <para>Let us setup security association to deploy a secure channel

      <para>Let us setup security association to deploy a secure channel

      <para>Now we should choose an algorithm to be used corresponding to

      <para>Now we should choose an algorithm to be used corresponding to

      <para>Key length highly depends on each algorithm.  For example, key

      <para>Key length highly depends on each algorithm.  For example, key

      <para>OK, let us assign SPI (Security Parameter Index) for each protocol.

      <para>OK, let us assign SPI (Security Parameter Index) for each protocol.

      </para>

      </para>

      <screen>

      <screen>

</screen>

</screen>

      <para>Now, let us setup security association.  Execute &man.setkey.8;

      <para>Now, let us setup security association.  Execute &man.setkey.8;

      <screen>

      <screen>

&prompt.root; <command>setkey -c</command>

&prompt.root; <command>setkey -c</command>

</screen>

</screen>

     <para>Actually, IPsec communication does not process until security policy

     <para>Actually, IPsec communication does not process until security policy

     <screen>

     <screen>

At A:

At A:

      <para>Another example using IPv6.</para>

      <para>Another example using IPv6.</para>

      <para>ESP transport mode is recommended for TCP port number 110 between

      <para>ESP transport mode is recommended for TCP port number 110 between

      <screen>

      <screen>

              ============ ESP ============

              ============ ESP ============

</screen>

</screen>

      <para>Encryption algorithm is blowfish-cbc whose key is "kamekame", and

      <para>Encryption algorithm is blowfish-cbc whose key is "kamekame", and

      <screen>

      <screen>

        &prompt.root; <command>setkey -c</command> &lt;&lt;<filename>EOF</filename>

        &prompt.root; <command>setkey -c</command> &lt;&lt;<filename>EOF</filename>

      <para>Tunnel mode between two security gateways</para>

      <para>Tunnel mode between two security gateways</para>

      <para>Security protocol is old AH tunnel mode, i.e. specified by

      <para>Security protocol is old AH tunnel mode, i.e. specified by

      <screen>

      <screen>

                             ======= AH =======

                             ======= AH =======

</screen>

</screen>

      <para>If the port number field is omitted such as above then "[any]" is

      <para>If the port number field is omitted such as above then "[any]" is

      <para>and at Gateway-B:</para>

      <para>and at Gateway-B:</para>

      <para>Making SA bundle between two security gateways</para>

      <para>Making SA bundle between two security gateways</para>

      <para>AH transport mode and ESP tunnel mode is required between

      <para>AH transport mode and ESP tunnel mode is required between

      <screen>

      <screen>

                            ========== AH =========

                            ========== AH =========

      <title>Tunnel Mode Example with IPv6</title>

      <title>Tunnel Mode Example with IPv6</title>

      <para>Encryption algorithm is 3des-cbc, and authentication algorithm

      <para>Encryption algorithm is 3des-cbc, and authentication algorithm

      <screen>

      <screen>

        &prompt.root; <command>setkey -c</command> &lt;&lt;<filename>EOF</filename>

        &prompt.root; <command>setkey -c</command> &lt;&lt;<filename>EOF</filename>

      <para>Making SAs with the different end</para>

      <para>Making SAs with the different end</para>

      <para>ESP tunnel mode is required between Host-A and Gateway-A. Encryption

      <para>ESP tunnel mode is required between Host-A and Gateway-A. Encryption

      <screen>

      <screen>

              ================== ESP =================

              ================== ESP =================

      <secondary>OpenSSH</secondary>

      <secondary>OpenSSH</secondary>

    </indexterm>

    </indexterm>

      access remote machines securely.  It can be used as a direct

      access remote machines securely.  It can be used as a direct

      replacement for <command>rlogin</command>,

      replacement for <command>rlogin</command>,

      <command>rsh</command>, <command>rcp</command>, and

      <command>rsh</command>, <command>rcp</command>, and

      </indexterm>

      </indexterm>

      <para>The &man.ssh.1; utility works similarly to 

      <para>The &man.ssh.1; utility works similarly to 

      <screen>&prompt.root <userinput>ssh <replaceable>user@example.com</replaceable></userinput>

      <screen>&prompt.root <userinput>ssh <replaceable>user@example.com</replaceable></userinput>

Host key not found from the list of known hosts.

Host key not found from the list of known hosts.

        will alert you if the saved fingerprint differs from the

        will alert you if the saved fingerprint differs from the

        received fingerprint on future login attempts.  The fingerprints

        received fingerprint on future login attempts.  The fingerprints

        are saved in <filename>~/.ssh/known_hosts</filename>, or

        are saved in <filename>~/.ssh/known_hosts</filename>, or

      <para>By default, OpenSSH servers are configured to accept both

      <para>By default, OpenSSH servers are configured to accept both

	SSH v1 and SSH v2 connections.  The client, however, can choose

	SSH v1 and SSH v2 connections.  The client, however, can choose

      <para>The system-wide configuration files for both the OpenSSH 

      <para>The system-wide configuration files for both the OpenSSH 

        daemon and client reside within the <filename>/etc/ssh</filename> 

        daemon and client reside within the <filename>/etc/ssh</filename> 

      <para><filename>ssh_config</filename> configures the client 

      <para><filename>ssh_config</filename> configures the client 

        settings, while <filename>sshd_config</filename> configures the 

        settings, while <filename>sshd_config</filename> configures the 

      <para>Additionally, the <option>sshd_program</option>

      <para>Additionally, the <option>sshd_program</option>

	(<filename>/usr/sbin/sshd</filename> by default), and

	(<filename>/usr/sbin/sshd</filename> by default), and

      <title>ssh-keygen</title>

      <title>ssh-keygen</title>

      <para>Instead of using passwords, &man.ssh-keygen.1; can

      <para>Instead of using passwords, &man.ssh-keygen.1; can

      <screen>&prompt.user <userinput>ssh-keygen</userinput>

      <screen>&prompt.user <userinput>ssh-keygen</userinput>

Initializing random number generator...

Initializing random number generator...

        <filename>~/.ssh/identity</filename>, whereas the public key is

        <filename>~/.ssh/identity</filename>, whereas the public key is

        stored in <filename>~/.ssh/identity.pub</filename>.  The public

        stored in <filename>~/.ssh/identity.pub</filename>.  The public

        key must be placed in <filename>~/.ssh/authorized_keys</filename>

        key must be placed in <filename>~/.ssh/authorized_keys</filename>

      <para>This will allow connection to the remote machine based upon

      <para>This will allow connection to the remote machine based upon

        RSA authentication instead of passwords.</para>

        RSA authentication instead of passwords.</para>

	machine.</para>

	machine.</para>

      <para>&man.ssh-agent.1; and &man.ssh-add.1; are 

      <para>&man.ssh-agent.1; and &man.ssh-add.1; are 

    </sect2>

    </sect2>

    <sect2>

    <sect2>

      <para>OpenSSH has the ability to create a tunnel to encapsulate

      <para>OpenSSH has the ability to create a tunnel to encapsulate

        another protocol in an encrypted session.</para>

        another protocol in an encrypted session.</para>

         for telnet.</para>

         for telnet.</para>

       <screen>&prompt.user; <userinput>ssh -2 -N -f -L <replaceable>5023:localhost:23 user@foo.example.com</replaceable></userinput>

       <screen>&prompt.user; <userinput>ssh -2 -N -f -L <replaceable>5023:localhost:23 user@foo.example.com</replaceable></userinput>

      </variablelist>

      </variablelist>

	on the specified port.  It then forwards any connection received

	on the specified port.  It then forwards any connection received

	on the local host/port via the SSH connection to the specified

	on the local host/port via the SSH connection to the specified

	remote host and port.</para>

	remote host and port.</para>

	localhost is being forwarded to port

	localhost is being forwarded to port

	<replaceable>23</replaceable> on localhost of the remote

	<replaceable>23</replaceable> on localhost of the remote

	machine.  Since <replaceable>23</replaceable> is telnet, this

	machine.  Since <replaceable>23</replaceable> is telnet, this

       <para>This can be used to wrap any number of insecure TCP protocols 

       <para>This can be used to wrap any number of insecure TCP protocols 

       <para>A typical SSH Tunnel</para>

       <para>A typical SSH Tunnel</para>

       <screen>&prompt.user; <userinput>ssh -2 -N -f -L <replaceable>5025:localhost:25 user@mailserver.example.com</replaceable></userinput>

       <screen>&prompt.user; <userinput>ssh -2 -N -f -L <replaceable>5025:localhost:25 user@mailserver.example.com</replaceable></userinput>

       <para>This can be used in conjunction with an &man.ssh-keygen.1; 

       <para>This can be used in conjunction with an &man.ssh-keygen.1; 

         and additional user accounts to create a more seamless/hassle-free

         and additional user accounts to create a more seamless/hassle-free

         SSH tunneling environment.  Keys can be used in place of typing

         SSH tunneling environment.  Keys can be used in place of typing

      <sect3>

      <sect3>

	<title>Practical SSH Tunneling Examples</title>

	<title>Practical SSH Tunneling Examples</title>

	    <hostid>localhost</hostid> port 8888, which will be

	    <hostid>localhost</hostid> port 8888, which will be

	    forwarded over to <hostid>music.example.com</hostid> port

	    forwarded over to <hostid>music.example.com</hostid> port

	    8000, successfully evading the firewall.</para>

	    8000, successfully evading the firewall.</para>

      </sect3>

      </sect3>

    </sect2>

    </sect2>