From owner-svn-doc-all@freebsd.org Tue Sep 29 17:31:04 2020 Return-Path: Delivered-To: svn-doc-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 7208C42AF42; Tue, 29 Sep 2020 17:31:04 +0000 (UTC) (envelope-from bhd@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4C15yc2TRGz3dfx; Tue, 29 Sep 2020 17:31:04 +0000 (UTC) (envelope-from bhd@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 39897122AC; Tue, 29 Sep 2020 17:31:04 +0000 (UTC) (envelope-from bhd@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 08THV4i4060141; Tue, 29 Sep 2020 17:31:04 GMT (envelope-from bhd@FreeBSD.org) Received: (from bhd@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 08THV49e060140; Tue, 29 Sep 2020 17:31:04 GMT (envelope-from bhd@FreeBSD.org) Message-Id: <202009291731.08THV49e060140@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: bhd set sender to bhd@FreeBSD.org using -f From: Bjoern Heidotting Date: Tue, 29 Sep 2020 17:31:04 +0000 (UTC) To: doc-committers@freebsd.org, svn-doc-all@freebsd.org, svn-doc-head@freebsd.org Subject: svn commit: r54549 - head/en_US.ISO8859-1/books/handbook/security X-SVN-Group: doc-head X-SVN-Commit-Author: bhd X-SVN-Commit-Paths: head/en_US.ISO8859-1/books/handbook/security X-SVN-Commit-Revision: 54549 X-SVN-Commit-Repository: doc MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-doc-all@freebsd.org X-Mailman-Version: 2.1.33 Precedence: list List-Id: "SVN commit messages for the entire doc trees \(except for " user" , " projects" , and " translations" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Sep 2020 17:31:04 -0000 Author: bhd Date: Tue Sep 29 17:31:03 2020 New Revision: 54549 URL: https://svnweb.freebsd.org/changeset/doc/54549 Log: - Turn programlistings into screens - Add root prompts to screens - Separate corp-net an priv-net screens Reviewed by: bcr Differential Revision: https://reviews.freebsd.org/D26575 Modified: head/en_US.ISO8859-1/books/handbook/security/chapter.xml Modified: head/en_US.ISO8859-1/books/handbook/security/chapter.xml ============================================================================== --- head/en_US.ISO8859-1/books/handbook/security/chapter.xml Tue Sep 29 10:09:47 2020 (r54548) +++ head/en_US.ISO8859-1/books/handbook/security/chapter.xml Tue Sep 29 17:31:03 2020 (r54549) @@ -2244,7 +2244,7 @@ inet6 fe80::250:bfff:fe3a:c1f%gif0 prefixlen 64 scopei Once complete, both internal IP addresses should be reachable using &man.ping.8;: - priv-net# ping 10.0.0.5 + priv-net&prompt.root; ping 10.0.0.5 PING 10.0.0.5 (10.0.0.5): 56 data bytes 64 bytes from 10.0.0.5: icmp_seq=0 ttl=64 time=42.786 ms 64 bytes from 10.0.0.5: icmp_seq=1 ttl=64 time=19.255 ms @@ -2252,9 +2252,9 @@ PING 10.0.0.5 (10.0.0.5): 56 data bytes 64 bytes from 10.0.0.5: icmp_seq=3 ttl=64 time=21.036 ms --- 10.0.0.5 ping statistics --- 4 packets transmitted, 4 packets received, 0% packet loss -round-trip min/avg/max/stddev = 19.255/25.879/42.786/9.782 ms +round-trip min/avg/max/stddev = 19.255/25.879/42.786/9.782 ms -corp-net# ping 10.246.38.1 + corp-net&prompt.root; ping 10.246.38.1 PING 10.246.38.1 (10.246.38.1): 56 data bytes 64 bytes from 10.246.38.1: icmp_seq=0 ttl=64 time=28.106 ms 64 bytes from 10.246.38.1: icmp_seq=1 ttl=64 time=42.917 ms @@ -2263,7 +2263,7 @@ PING 10.246.38.1 (10.246.38.1): 56 data bytes 64 bytes from 10.246.38.1: icmp_seq=4 ttl=64 time=154.524 ms --- 10.246.38.1 ping statistics --- 5 packets transmitted, 5 packets received, 0% packet loss -round-trip min/avg/max/stddev = 28.106/94.594/154.524/49.814 ms +round-trip min/avg/max/stddev = 28.106/94.594/154.524/49.814 ms As expected, both sides have the ability to send and receive ICMP packets from the privately @@ -2273,15 +2273,16 @@ round-trip min/avg/max/stddev = 28.106/94.594/154.524/ goal: corp-net&prompt.root; route add 10.0.0.0 10.0.0.5 255.255.255.0 -corp-net&prompt.root; route add net 10.0.0.0: gateway 10.0.0.5 -priv-net&prompt.root; route add 10.246.38.0 10.246.38.1 255.255.255.0 +corp-net&prompt.root; route add net 10.0.0.0: gateway 10.0.0.5 + + priv-net&prompt.root; route add 10.246.38.0 10.246.38.1 255.255.255.0 priv-net&prompt.root; route add host 10.246.38.0: gateway 10.246.38.1 At this point, internal machines should be reachable from each gateway as well as from machines behind the gateways. Again, use &man.ping.8; to confirm: - corp-net# ping 10.0.0.8 + corp-net&prompt.root; ping 10.0.0.8 PING 10.0.0.8 (10.0.0.8): 56 data bytes 64 bytes from 10.0.0.8: icmp_seq=0 ttl=63 time=92.391 ms 64 bytes from 10.0.0.8: icmp_seq=1 ttl=63 time=21.870 ms @@ -2290,9 +2291,9 @@ PING 10.0.0.8 (10.0.0.8): 56 data bytes 64 bytes from 10.0.0.8: icmp_seq=4 ttl=63 time=174.705 ms --- 10.0.0.8 ping statistics --- 5 packets transmitted, 5 packets received, 0% packet loss -round-trip min/avg/max/stddev = 21.870/101.846/198.022/74.001 ms +round-trip min/avg/max/stddev = 21.870/101.846/198.022/74.001 ms -priv-net# ping 10.246.38.107 + priv-net&prompt.root; ping 10.246.38.107 PING 10.246.38.1 (10.246.38.107): 56 data bytes 64 bytes from 10.246.38.107: icmp_seq=0 ttl=64 time=53.491 ms 64 bytes from 10.246.38.107: icmp_seq=1 ttl=64 time=23.395 ms @@ -2301,7 +2302,7 @@ PING 10.246.38.1 (10.246.38.107): 56 data bytes 64 bytes from 10.246.38.107: icmp_seq=4 ttl=64 time=36.708 ms --- 10.246.38.107 ping statistics --- 5 packets transmitted, 5 packets received, 0% packet loss -round-trip min/avg/max/stddev = 21.145/31.721/53.491/12.179 ms +round-trip min/avg/max/stddev = 21.145/31.721/53.491/12.179 ms Setting up the tunnels is the easy part. Configuring a secure link is a more in depth process. The following @@ -2395,7 +2396,7 @@ spdadd 10.0.0.0/24 10.246.38.0/24 any -P in ipsec esp/ The output should be similar to the following: - corp-net# /usr/local/sbin/racoon -F -f /usr/local/etc/racoon/racoon.conf + corp-net&prompt.root; /usr/local/sbin/racoon -F -f /usr/local/etc/racoon/racoon.conf Foreground mode. 2006-01-30 01:35:47: INFO: begin Identity Protection mode. 2006-01-30 01:35:48: INFO: received Vendor ID: KAME/racoon @@ -2406,7 +2407,7 @@ Foreground mode. 2006-01-30 01:36:09: INFO: IPsec-SA established: ESP/Tunnel 172.16.5.4[0]->192.168.1.12[0] spi=47784998(0x2d92426) 2006-01-30 01:36:13: INFO: respond new phase 2 negotiation: 172.16.5.4[0]192.168.1.12[0] 2006-01-30 01:36:18: INFO: IPsec-SA established: ESP/Tunnel 192.168.1.12[0]->172.16.5.4[0] spi=124397467(0x76a279b) -2006-01-30 01:36:18: INFO: IPsec-SA established: ESP/Tunnel 172.16.5.4[0]->192.168.1.12[0] spi=175852902(0xa7b4d66) +2006-01-30 01:36:18: INFO: IPsec-SA established: ESP/Tunnel 172.16.5.4[0]->192.168.1.12[0] spi=175852902(0xa7b4d66) To ensure the tunnel is working properly, switch to another console and use &man.tcpdump.1; to view network