forked from debian-handbook-pl/pl-PL
-
Notifications
You must be signed in to change notification settings - Fork 0
/
10_network-infrastructure.po
2237 lines (1881 loc) · 93.8 KB
/
10_network-infrastructure.po
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#
# AUTHOR <EMAIL@ADDRESS>, YEAR.
#
msgid ""
msgstr ""
"Project-Id-Version: 0\n"
"POT-Creation-Date: 2015-06-18T12:29:20\n"
"PO-Revision-Date: 2012-11-22 21:16+0100\n"
"Last-Translator: Mateusz Kacprzak <[email protected]>\n"
"Language-Team: \n"
"Language: \n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Generator: Poedit 1.5.4\n"
#. Tag: keyword
#, no-c-format
msgid "Network"
msgstr ""
#. Tag: keyword
#, no-c-format
msgid "Gateway"
msgstr ""
#. Tag: keyword
#, no-c-format
msgid "TCP/IP"
msgstr ""
#. Tag: keyword
#, no-c-format
msgid "IPv6"
msgstr ""
#. Tag: keyword
#, no-c-format
msgid "DNS"
msgstr ""
#. Tag: keyword
#, no-c-format
msgid "Bind"
msgstr ""
#. Tag: keyword
#, no-c-format
msgid "DHCP"
msgstr ""
#. Tag: keyword
#, no-c-format
msgid "QoS"
msgstr ""
#. Tag: title
#, no-c-format
msgid "Network Infrastructure"
msgstr ""
#. Tag: para
#, no-c-format
msgid "Linux sports the whole Unix heritage for networking, and Debian provides a full set of tools to create and manage them. This chapter reviews these tools."
msgstr ""
#. Tag: para
#, no-c-format
msgid "A gateway is a system linking several networks. This term often refers to a local network's “exit point” on the mandatory path to all external IP addresses. The gateway is connected to each of the networks it links together, and acts as a router to convey IP packets between its various interfaces."
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>gateway</primary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>network</primary><secondary>gateway</secondary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>router</primary>"
msgstr ""
#. Tag: title
#, no-c-format
msgid "<emphasis>BACK TO BASICS</emphasis> IP packet"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>packet</primary><secondary>IP</secondary>"
msgstr ""
#. Tag: para
#, no-c-format
msgid "Most networks nowadays use the IP protocol (<emphasis>Internet Protocol</emphasis>). This protocol segments the transmitted data into limited-size packets. Each packet contains, in addition to its payload data, a number of details required for its proper routing."
msgstr ""
#. Tag: title
#, no-c-format
msgid "<emphasis>BACK TO BASICS</emphasis> TCP/UDP"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>port</primary><secondary>TCP</secondary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>port</primary><secondary>UDP</secondary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>TCP, port</primary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>UDP, port</primary>"
msgstr ""
#. Tag: para
#, no-c-format
msgid "Many programs do not handle the individual packets themselves, even though the data they transmit does travel over IP; they often use TCP (<emphasis>Transmission Control Protocol</emphasis>). TCP is a layer over IP allowing the establishment of connections dedicated to data streams between two points. The programs then only see an entry point into which data can be fed with the guarantee that the same data exits without loss (and in the same sequence) at the exit point at the other end of the connection. Although many kinds of errors can happen in the lower layers, they are compensated by TCP: lost packets are retransmitted, and packets arriving out of order (for example, if they used different paths) are re-ordered appropriately."
msgstr ""
#. Tag: para
#, no-c-format
msgid "Another protocol relying on IP is UDP (<emphasis>User Datagram Protocol</emphasis>). In contrast to TCP, it is packet-oriented. Its goals are different: the purpose of UDP is only to transmit one packet from an application to another. The protocol does not try to compensate for possible packet loss on the way, nor does it ensure that packets are received in the same order as were sent. The main advantage to this protocol is that the latency is greatly improved, since the loss of a single packet does not delay the receiving of all following packets until the lost one is retransmitted."
msgstr ""
#. Tag: para
#, no-c-format
msgid "TCP and UDP both involve ports, which are “extension numbers” for establishing communication with a given application on a machine. This concept allows keeping several different communications in parallel with the same correspondent, since these communications can be distinguished by the port number."
msgstr ""
#. Tag: para
#, no-c-format
msgid "Some of these port numbers — standardized by the IANA (<emphasis>Internet Assigned Numbers Authority</emphasis>) — are “well-known” for being associated with network services. For instance, TCP port 25 is generally used by the email server. <ulink type=\"block\" url=\"http://www.iana.org/assignments/port-numbers\" />"
msgstr ""
#. Tag: para
#, no-c-format
msgid "When a local network uses a private address range (not routable on the Internet), the gateway needs to implement <emphasis>address masquerading</emphasis> so that the machines on the network can communicate with the outside world. The masquerading operation is a kind of proxy operating on the network level: each outgoing connection from an internal machine is replaced with a connection from the gateway itself (since the gateway does have an external, routable address), the data going through the masqueraded connection is sent to the new one, and the data coming back in reply is sent through to the masqueraded connection to the internal machine. The gateway uses a range of dedicated TCP ports for this purpose, usually with very high numbers (over 60000). Each connection coming from an internal machine then appears to the outside world as a connection coming from one of these reserved ports."
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>masquerading</primary>"
msgstr ""
#. Tag: title
#, no-c-format
msgid "<emphasis>CULTURE</emphasis> Private address range"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>IP address</primary><secondary>private</secondary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>private IP address</primary>"
msgstr ""
#. Tag: para
#, no-c-format
msgid "RFC 1918 defines three ranges of IPv4 addresses not meant to be routed on the Internet but only used in local networks. The first one, <literal>10.0.0.0/8</literal> (see sidebar <xref linkend=\"sidebar.networking-basics\" />), is a class-A range (with 2<superscript>24</superscript> IP addresses). The second one, <literal>172.16.0.0/12</literal>, gathers 16 class-B ranges (<literal>172.16.0.0/16</literal> to <literal>172.31.0.0/16</literal>), each containing 2<superscript>16</superscript> IP addresses. Finally, <literal>192.168.0.0/16</literal> is a class-B range (grouping 256 class-C ranges, <literal>192.168.0.0/24</literal> to <literal>192.168.255.0/24</literal>, with 256 IP addresses each). <ulink type=\"block\" url=\"http://www.faqs.org/rfcs/rfc1918.html\" />"
msgstr ""
#. Tag: para
#, no-c-format
msgid "The gateway can also perform two kinds of <emphasis>network address translation</emphasis> (or NAT for short). The first kind, <emphasis>Destination NAT</emphasis> (DNAT) is a technique to alter the destination IP address (and/or the TCP or UDP port) for a (generally) incoming connection. The connection tracking mechanism also alters the following packets in the same connection to ensure continuity in the communication. The second kind of NAT is <emphasis>Source NAT</emphasis> (SNAT), of which <emphasis>masquerading</emphasis> is a particular case; SNAT alters the source IP address (and/or the TCP or UDP port) of a (generally) outgoing connection. As for DNAT, all the packets in the connection are appropriately handled by the connection tracking mechanism. Note that NAT is only relevant for IPv4 and its limited address space; in IPv6, the wide availability of addresses greatly reduces the usefulness of NAT by allowing all “internal” addresses to be directly routable on the Internet (this does not imply that internal machines are accessible, since intermediary firewalls can filter traffic)."
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>NAT</primary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>Network</primary><secondary>Address Translation</secondary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>SNAT</primary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>DNAT</primary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>Destination NAT</primary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>Source NAT</primary>"
msgstr ""
#. Tag: title
#, no-c-format
msgid "<emphasis>BACK TO BASICS</emphasis> Port forwarding"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>port forwarding</primary>"
msgstr ""
#. Tag: para
#, no-c-format
msgid "A concrete application of DNAT is <emphasis>port forwarding</emphasis>. Incoming connections to a given port of a machine are forwarded to a port on another machine. Other solutions may exist for achieving a similar effect, though, especially at the application level with <command>ssh</command> (see <xref linkend=\"sect.ssh-port-forwarding\" />) or <command>redir</command>."
msgstr ""
#. Tag: para
#, no-c-format
msgid "Enough theory, let's get practical. Turning a Debian system into a gateway is a simple matter of enabling the appropriate option in the Linux kernel, by way of the <filename>/proc/</filename> virtual filesystem:"
msgstr ""
#. Tag: screen
#, no-c-format
msgid ""
"\n"
"<computeroutput># </computeroutput><userinput>echo 1 > /proc/sys/net/ipv4/conf/default/forwarding</userinput>\n"
msgstr ""
#. Tag: para
#, no-c-format
msgid "This option can also be automatically enabled on boot if <filename>/etc/sysctl.conf</filename> sets the <literal>net.ipv4.conf.default.forwarding</literal> option to <literal>1</literal>."
msgstr ""
#. Tag: title
#, no-c-format
msgid "The <filename>/etc/sysctl.conf</filename> file"
msgstr ""
#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"net.ipv4.conf.default.forwarding = 1\n"
"net.ipv4.conf.default.rp_filter = 1\n"
"net.ipv4.tcp_syncookies = 1\n"
msgstr ""
#. Tag: para
#, no-c-format
msgid "The same effect can be obtained for IPv6 by simply replacing <literal>ipv4</literal> with <literal>ipv6</literal> in the manual command and using the <literal>net.ipv6.conf.all.forwarding</literal> line in <filename>/etc/sysctl.conf</filename>."
msgstr ""
#. Tag: para
#, no-c-format
msgid "Enabling IPv4 masquerading is a slightly more complex operation that involves configuring the <emphasis>netfilter</emphasis> firewall."
msgstr ""
#. Tag: para
#, no-c-format
msgid "Similarly, using NAT (for IPv4) requires configuring <emphasis>netfilter</emphasis>. Since the primary purpose of this component is packet filtering, the details are listed in <xref linkend=\"security\" xrefstyle=\"select: label quotedtitle nopage\" /> (see <xref linkend=\"sect.firewall-packet-filtering\" />)."
msgstr ""
#. Tag: title
#, no-c-format
msgid "Virtual Private Network"
msgstr ""
#. Tag: para
#, no-c-format
msgid "A <emphasis>Virtual Private Network</emphasis> (VPN for short) is a way to link two different local networks through the Internet by way of a tunnel; the tunnel is usually encrypted for confidentiality. VPNs are often used to integrate a remote machine within a company's local network."
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>network</primary><secondary>virtual private</secondary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>VPN</primary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>virtual private network</primary>"
msgstr ""
#. Tag: para
#, no-c-format
msgid "Several tools provide this. OpenVPN is an efficient solution, easy to deploy and maintain, based on SSL/TLS. Another possibility is using IPsec to encrypt IP traffic between two machines; this encryption is transparent, which means that applications running on these hosts need not be modified to take the VPN into account. SSH can also be used to provide a VPN, in addition to its more conventional features. Finally, a VPN can be established using Microsoft's PPTP protocol. Other solutions exist, but are beyond the focus of this book."
msgstr ""
#. Tag: title
#, no-c-format
msgid "OpenVPN"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>OpenVPN</primary>"
msgstr ""
#. Tag: para
#, no-c-format
msgid "OpenVPN is a piece of software dedicated to creating virtual private networks. Its setup involves creating virtual network interfaces on the VPN server and on the client(s); both <literal>tun</literal> (for IP-level tunnels) and <literal>tap</literal> (for Ethernet-level tunnels) interfaces are supported. In practice, <literal>tun</literal> interfaces will most often be used except when the VPN clients are meant to be integrated into the server's local network by way of an Ethernet bridge."
msgstr ""
#. Tag: para
#, no-c-format
msgid "OpenVPN relies on OpenSSL for all the SSL/TLS cryptography and associated features (confidentiality, authentication, integrity, non-repudiation). It can be configured either with a shared private key or using X.509 certificates based on a public key infrastructure. The latter configuration is strongly preferred since it allows greater flexibility when faced with a growing number of roaming users accessing the VPN."
msgstr ""
#. Tag: title
#, no-c-format
msgid "<emphasis>CULTURE</emphasis> SSL and TLS"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>SSL</primary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>TLS</primary>"
msgstr ""
#. Tag: para
#, no-c-format
msgid "The SSL protocol (<emphasis>Secure Socket Layer</emphasis>) was invented by Netscape to secure connections to web servers. It was later standardized by IETF under the acronym TLS (<emphasis>Transport Layer Security</emphasis>); TLS is very similar to SSLv3 with only a few fixes and improvements."
msgstr ""
#. Tag: title
#, no-c-format
msgid "Public Key Infrastructure: <emphasis>easy-rsa</emphasis>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>PKI (Public Key Infrastructure)</primary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>Public Key Infrastructure</primary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>X.509, certificate</primary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>certificate</primary><secondary>X.509</secondary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary><emphasis>easy-rsa</emphasis></primary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>RSA (algorithm)</primary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>key pair</primary>"
msgstr ""
#. Tag: para
#, no-c-format
msgid "The RSA algorithm is widely used in public-key cryptography. It involves a “key pair”, comprised of a private and a public key. The two keys are closely linked to each other, and their mathematical properties are such that a message encrypted with the public key can only be decrypted by someone knowing the private key, which ensures confidentiality. In the opposite direction, a message encrypted with the private key can be decrypted by anyone knowing the public key, which allows authenticating the origin of a message since only someone with access to the private key could generate it. When associated with a digital hash function (MD5, SHA1, or a more recent variant), this leads to a signature mechanism that can be applied to any message."
msgstr ""
#. Tag: para
#, no-c-format
msgid "However, anyone can create a key pair, store any identity on it, and pretend to be the identity of their choice. One solution involves the concept of a <emphasis>Certification Authority</emphasis> (CA), formalized by the X.509 standard. This term covers an entity that holds a trusted key pair known as a <emphasis>root certificate</emphasis>. This certificate is only used to sign other certificates (key pairs), after proper steps have been undertaken to check the identity stored on the key pair. Applications using X.509 can then check the certificates presented to them, if they know about the trusted root certificates."
msgstr ""
#. Tag: para
#, no-c-format
msgid "OpenVPN follows this rule. Since public CAs only emit certificates in exchange for a (hefty) fee, it is also possible to create a private certification authority within the company. For that purpose, OpenVPN provides the <emphasis>easy-rsa</emphasis> tool which serves as an X.509 certification infrastructure. Its implementation is a set of scripts using the <command>openssl</command> command; these scripts can be found under <filename>/usr/share/doc/openvpn/examples/easy-rsa/2.0/</filename>."
msgstr ""
#. Tag: para
#, no-c-format
msgid "The Falcot Corp administrators use this tool to create the required certificates, both for the server and the clients. This allows the configuration of all clients to be similar since they will only have to be set up so as to trust certificates coming from Falcot's local CA. This CA is the first certificate to create; to this end, the administrators copy the directory containing <emphasis>easy-rsa</emphasis> into a more appropriate location, preferably on a machine not connected to the network in order to mitigate the risk of the CA's private key being stolen."
msgstr ""
#. Tag: screen
#, no-c-format
msgid ""
"\n"
"<computeroutput>$ </computeroutput><userinput>cp -r /usr/share/doc/openvpn/examples/easy-rsa/2.0 pki-falcot\n"
"</userinput><computeroutput>$ </computeroutput><userinput>cd pki-falcot</userinput>\n"
msgstr ""
#. Tag: para
#, no-c-format
msgid "They then store the required parameters into the <filename>vars</filename> file, especially those named with a <literal>KEY_</literal> prefix; these variables are then integrated into the environment:"
msgstr ""
#. Tag: screen
#, no-c-format
msgid ""
"\n"
"<computeroutput>$ </computeroutput><userinput>vim vars\n"
"</userinput><computeroutput>$ </computeroutput><userinput>grep KEY_ vars\n"
"</userinput><computeroutput>export KEY_CONFIG=`$EASY_RSA/whichopensslcnf $EASY_RSA`\n"
"export KEY_DIR=\"$EASY_RSA/keys\"\n"
"echo NOTE: If you run ./clean-all, I will be doing a rm -rf on $KEY_DIR\n"
"export KEY_SIZE=2048\n"
"export KEY_EXPIRE=3650\n"
"export KEY_COUNTRY=\"FR\"\n"
"export KEY_PROVINCE=\"Loire\"\n"
"export KEY_CITY=\"Saint-Étienne\"\n"
"export KEY_ORG=\"Falcot Corp\"\n"
"export KEY_EMAIL=\"[email protected]\"\n"
"$ </computeroutput><userinput>. ./vars\n"
"</userinput><computeroutput>NOTE: If you run ./clean-all, I will be doing a rm -rf on /home/rhertzog/pki-falcot/keys\n"
"$ </computeroutput><userinput>./clean-all\n"
"</userinput>\n"
msgstr ""
#. Tag: para
#, no-c-format
msgid "The next step is the creation of the CA's key pair itself (the two parts of the key pair will be stored under <filename>keys/ca.crt</filename> and <filename>keys/ca.key</filename> during this step):"
msgstr ""
#. Tag: screen
#, no-c-format
msgid ""
"\n"
"<computeroutput>$ </computeroutput><userinput>./build-ca</userinput>\n"
"<computeroutput>Generating a 2048 bit RSA private key\n"
"..............................................++++++\n"
".......................++++++\n"
"writing new private key to 'ca.key'\n"
"-----\n"
"You are about to be asked to enter information that will be incorporated\n"
"into your certificate request.\n"
"What you are about to enter is what is called a Distinguished Name or a DN.\n"
"There are quite a few fields but you can leave some blank\n"
"For some fields there will be a default value,\n"
"If you enter '.', the field will be left blank.\n"
"-----\n"
"Country Name (2 letter code) [FR]:\n"
"State or Province Name (full name) [Loire]:\n"
"Locality Name (eg, city) [Saint-Étienne]:\n"
"Organization Name (eg, company) [Falcot Corp]:\n"
"Organizational Unit Name (eg, section) []:\n"
"Common Name (eg, your name or your server's hostname) [Falcot Corp CA]:\n"
"Name []:\n"
"Email Address [[email protected]]:\n"
"</computeroutput>\n"
msgstr ""
#. Tag: para
#, no-c-format
msgid "The certificate for the VPN server can now be created, as well as the Diffie-Hellman parameters required for the server side of an SSL/TLS connection. The VPN server is identified by its DNS name <literal>vpn.falcot.com</literal>; this name is re-used for the generated key files (<filename>keys/vpn.falcot.com.crt</filename> for the public certificate, <filename>keys/vpn.falcot.com.key</filename>for the private key):"
msgstr ""
#. Tag: screen
#, no-c-format
msgid ""
"\n"
"<computeroutput>$ </computeroutput><userinput>./build-key-server vpn.falcot.com\n"
"</userinput><computeroutput>Generating a 2048 bit RSA private key\n"
"...............++++++\n"
"...........++++++\n"
"writing new private key to 'vpn.falcot.com.key'\n"
"-----\n"
"You are about to be asked to enter information that will be incorporated\n"
"into your certificate request.\n"
"What you are about to enter is what is called a Distinguished Name or a DN.\n"
"There are quite a few fields but you can leave some blank\n"
"For some fields there will be a default value,\n"
"If you enter '.', the field will be left blank.\n"
"-----\n"
"Country Name (2 letter code) [FR]:\n"
"State or Province Name (full name) [Loire]:\n"
"Locality Name (eg, city) [Saint-Étienne]:\n"
"Organization Name (eg, company) [Falcot Corp]:\n"
"Organizational Unit Name (eg, section) []:\n"
"Common Name (eg, your name or your server's hostname) [vpn.falcot.com]:\n"
"Name []:\n"
"Email Address [[email protected]]:\n"
"\n"
"Please enter the following 'extra' attributes\n"
"to be sent with your certificate request\n"
"A challenge password []:\n"
"An optional company name []:\n"
"Using configuration from /home/rhertzog/pki-falcot/openssl.cnf\n"
"Check that the request matches the signature\n"
"Signature ok\n"
"The Subject's Distinguished Name is as follows\n"
"countryName :PRINTABLE:'FR'\n"
"stateOrProvinceName :PRINTABLE:'Loire'\n"
"localityName :T61STRING:'Saint-\\0xFFFFFFC3\\0xFFFFFF89tienne'\n"
"organizationName :PRINTABLE:'Falcot Corp'\n"
"commonName :PRINTABLE:'vpn.falcot.com'\n"
"emailAddress :IA5STRING:'[email protected]'\n"
"Certificate is to be certified until Oct 9 13:57:42 2020 GMT (3650 days)\n"
"Sign the certificate? [y/n]:</computeroutput><userinput>y\n"
"</userinput><computeroutput>\n"
"\n"
"1 out of 1 certificate requests certified, commit? [y/n]</computeroutput><userinput>y\n"
"</userinput><computeroutput>Write out database with 1 new entries\n"
"Data Base Updated\n"
"$ </computeroutput><userinput>./build-dh\n"
"</userinput><computeroutput>Generating DH parameters, 2048 bit long safe prime, generator 2\n"
"This is going to take a long time\n"
"..............+.......+.................................++*++*++*\n"
"</computeroutput>\n"
msgstr ""
#. Tag: para
#, no-c-format
msgid "The following step creates certificates for the VPN clients; one certificate is required for each computer or person allowed to use the VPN:"
msgstr ""
#. Tag: screen
#, no-c-format
msgid ""
"\n"
"<computeroutput>$ </computeroutput><userinput>./build-key JoeSmith\n"
"</userinput><computeroutput>Generating a 2048 bit RSA private key\n"
"................++++++\n"
".............................++++++\n"
"writing new private key to 'JoeSmith.key'\n"
"-----\n"
"You are about to be asked to enter information that will be incorporated\n"
"into your certificate request.\n"
"What you are about to enter is what is called a Distinguished Name or a DN.\n"
"There are quite a few fields but you can leave some blank\n"
"For some fields there will be a default value,\n"
"If you enter '.', the field will be left blank.\n"
"-----\n"
"Country Name (2 letter code) [FR]:\n"
"State or Province Name (full name) [Loire]:\n"
"Locality Name (eg, city) [Saint-Étienne]:\n"
"Organization Name (eg, company) [Falcot Corp]:\n"
"Organizational Unit Name (eg, section) []:\n"
"Common Name (eg, your name or your server's hostname) [JoeSmith]:</computeroutput><userinput>Joe Smith\n"
"</userinput><computeroutput>Name []:\n"
"Email Address [[email protected]]:</computeroutput><userinput>[email protected]\n"
"</userinput><computeroutput>[…]</computeroutput>"
msgstr ""
#. Tag: para
#, no-c-format
msgid "Now all certificates have been created, they need to be copied where appropriate: the root certificate's public key (<filename>keys/ca.crt</filename>) will be stored on all machines (both server and clients) as <filename>/etc/ssl/certs/Falcot_CA.crt</filename>. The server's certificate is installed only on the server (<filename>keys/vpn.falcot.com.crt</filename> goes to <filename>/etc/ssl/vpn.falcot.com.crt</filename>, and <filename>keys/vpn.falcot.com.key</filename> goes to <filename>/etc/ssl/private/vpn.falcot.com.key</filename> with restricted permissions so that only the administrator can read it), with the corresponding Diffie-Hellman parameters (<filename>keys/dh2048.pem</filename>) installed to <filename>/etc/openvpn/dh2048.pem</filename>. Client certificates are installed on the corresponding VPN client in a similar fashion."
msgstr ""
#. Tag: title
#, no-c-format
msgid "Configuring the OpenVPN Server"
msgstr ""
#. Tag: para
#, no-c-format
msgid "By default, the OpenVPN initialization script tries starting all virtual private networks defined in <filename>/etc/openvpn/*.conf</filename>. Setting up a VPN server is therefore a matter of storing a corresponding configuration file in this directory. A good starting point is <filename>/usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz</filename>, which leads to a rather standard server. Of course, some parameters need to be adapted: <literal>ca</literal>, <literal>cert</literal>, <literal>key</literal> and <literal>dh</literal> need to describe the selected locations (respectively, <literal>/etc/ssl/certs/Falcot_CA.crt</literal>, <literal>/etc/ssl/vpn.falcot.com.crt</literal>, <literal>/etc/ssl/private/vpn.falcot.com.key</literal> and <literal>/etc/openvpn/dh2048.pem</literal>). The <literal>server 10.8.0.0 255.255.255.0</literal> directive defines the subnet to be used by the VPN; the server uses the first IP address in that range (<literal>10.8.0.1</literal>) and the rest of the addresses are allocated to clients."
msgstr ""
#. Tag: para
#, no-c-format
msgid "With this configuration, starting OpenVPN creates the virtual network interface, usually under the <literal>tun0</literal> name. However, firewalls are often configured at the same time as the real network interfaces, which happens before OpenVPN starts. Good practice therefore recommends creating a persistent virtual network interface, and configuring OpenVPN to use this pre-existing interface. This further allows choosing the name for this interface. To this end, <command>openvpn --mktun --dev vpn --dev-type tun</command> creates a virtual network interface named <literal>vpn</literal> with type <literal>tun</literal>; this command can easily be integrated in the firewall configuration script, or in an <literal>up</literal> directive of the <filename>/etc/network/interfaces</filename> file. The OpenVPN configuration file must also be updated accordingly, with the <literal>dev vpn</literal> and <literal>dev-type tun</literal> directives."
msgstr ""
#. Tag: para
#, no-c-format
msgid "Barring further action, VPN clients can only access the VPN server itself by way of the <literal>10.8.0.1</literal> address. Granting the clients access to the local network (192.168.0.0/24), requires adding a <literal>push route 192.168.0.0 255.255.255.0</literal> directive to the OpenVPN configuration so that VPN clients automatically get a network route telling them that this network is reachable by way of the VPN. Furthermore, machines on the local network also need to be informed that the route to the VPN goes through the VPN server (this automatically works when the VPN server is installed on the gateway). Alternatively, the VPN server can be configured to perform IP masquerading so that connections coming from VPN clients appear as if they are coming from the VPN server instead (see <xref linkend=\"sect.gateway\" />)."
msgstr ""
#. Tag: title
#, no-c-format
msgid "Configuring the OpenVPN Client"
msgstr ""
#. Tag: para
#, no-c-format
msgid "Setting up an OpenVPN client also requires creating a configuration file in <filename>/etc/openvpn/</filename>. A standard configuration can be obtained by using <filename>/usr/share/doc/openvpn/examples/sample-config-files/client.conf</filename> as a starting point. The <literal>remote vpn.falcot.com 1194</literal> directive describes the address and port of the OpenVPN server; the <literal>ca</literal>, <literal>cert</literal> and <literal>key</literal> also need to be adapted to describe the locations of the key files."
msgstr ""
#. Tag: para
#, no-c-format
msgid "If the VPN should not be started automatically on boot, set the <literal>AUTOSTART</literal> directive to <literal>none</literal> in the <filename>/etc/default/openvpn</filename> file. Starting or stopping a given VPN connection is always possible with the commands <command>/etc/init.d/openpvn start <replaceable>name</replaceable></command> and <command>/etc/init.d/openpvn stop <replaceable>name</replaceable></command> (where the connection <replaceable>name</replaceable> matches the one defined in <filename>/etc/openvpn/<replaceable>name</replaceable>.conf</filename>)."
msgstr ""
#. Tag: para
#, no-c-format
msgid "The <emphasis role=\"pkg\">network-manager-openvpn-gnome</emphasis> package contains an extension to Network Manager (see <xref linkend=\"sect.roaming-network-config\" />) that allows managing OpenVPN virtual private networks. This allows every user to configure OpenVPN connections graphically and to control them from the network management icon. <indexterm><primary><emphasis role=\"pkg\">network-manager-openvpn-gnome</emphasis></primary></indexterm>"
msgstr ""
#. Tag: title
#, no-c-format
msgid "Virtual Private Network with SSH"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>SSH</primary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>PPP</primary>"
msgstr ""
#. Tag: para
#, no-c-format
msgid "There are actually two ways of creating a virtual private network with SSH. The historic one involves establishing a PPP layer over the SSH link. This method is described in a HOWTO document: <ulink type=\"block\" url=\"http://www.tldp.org/HOWTO/ppp-ssh/\" />"
msgstr ""
#. Tag: para
#, no-c-format
msgid "The second method is more recent, and was introduced with OpenSSH 4.3; it is now possible for OpenSSH to create virtual network interfaces (<literal>tun*</literal>) on both sides of an SSH connection, and these virtual interfaces can be configured exactly as if they were physical interfaces. The tunneling system must first be enabled by setting <literal>PermitTunnel</literal> to “yes” in the SSH server configuration file (<filename>/etc/ssh/sshd_config</filename>). When establishing the SSH connection, the creation of a tunnel must be explicitly requested with the <literal>-w any:any</literal> option (<literal>any</literal> can be replaced with the desired <literal>tun</literal> device number). This requires the user to have administrator privilege on both sides, so as to be able to create the network device (in other words, the connection must be established as root)."
msgstr ""
#. Tag: para
#, no-c-format
msgid "Both methods for creating a virtual private network over SSH are quite straightforward. However, the VPN they provide is not the most efficient available; in particular, it does not handle high levels of traffic very well."
msgstr ""
#. Tag: para
#, no-c-format
msgid "The explanation is that when a TCP/IP stack is encapsulated within a TCP/IP connection (for SSH), the TCP protocol is used twice, once for the SSH connection and once within the tunnel. This leads to problems, especially due to the way TCP adapts to network conditions by altering timeout delays. The following site describes the problem in more detail: <ulink type=\"block\" url=\"http://sites.inka.de/sites/bigred/devel/tcp-tcp.html\" /> VPNs over SSH should therefore be restricted to one-off tunnels with no performance constraints."
msgstr ""
#. Tag: title
#, no-c-format
msgid "IPsec"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>IPsec</primary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary><command>openswan</command></primary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary><command>strongswan</command></primary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary><command>racoon</command></primary>"
msgstr ""
#. Tag: para
#, no-c-format
msgid "IPsec, despite being the standard in IP VPNs, is rather more involved in its implementation. The IPsec engine itself is integrated in the Linux kernel; the required user-space parts, the control and configuration tools, are provided by the <emphasis role=\"pkg\">ipsec-tools</emphasis> package. In concrete terms, each host's <filename>/etc/ipsec-tools.conf</filename> contains the parameters for <emphasis>IPsec tunnels</emphasis> (or <emphasis>Security Associations</emphasis>, in the IPsec terminology) that the host is concerned with; the <command>/etc/init.d/setkey</command> script provides a way to start and stop a tunnel (each tunnel is a secure link to another host connected to the virtual private network). This file can be built by hand from the documentation provided by the <citerefentry><refentrytitle>setkey</refentrytitle> <manvolnum>8</manvolnum></citerefentry> manual page. However, explicitly writing the parameters for all hosts in a non-trivial set of machines quickly becomes an arduous task, since the number of tunnels grows fast. Installing an IKE daemon (for <emphasis>IPsec Key Exchange</emphasis>) such as <emphasis role=\"pkg\">racoon</emphasis>, <emphasis role=\"pkg\">strongswan</emphasis> or <emphasis role=\"pkg\">openswan</emphasis> makes the process much simpler by bringing administration together at a central point, and more secure by rotating the keys periodically."
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>IKE</primary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>IPsec</primary><secondary>IPsec Key Exchange</secondary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary><command>setkey</command></primary>"
msgstr ""
#. Tag: para
#, no-c-format
msgid "In spite of its status as the reference, the complexity of setting up IPsec restricts its usage in practice. OpenVPN-based solutions will generally be preferred when the required tunnels are neither too many nor too dynamic."
msgstr ""
#. Tag: title
#, no-c-format
msgid "<emphasis>CAUTION</emphasis> IPsec and NAT"
msgstr ""
#. Tag: para
#, no-c-format
msgid "NATing firewalls and IPsec do not work well together: since IPsec signs the packets, any change on these packets that the firewall might perform will void the signature, and the packets will be rejected at their destination. Various IPsec implementations now include the <emphasis>NAT-T</emphasis> technique (for <emphasis>NAT Traversal</emphasis>), which basically encapsulates the IPsec packet within a standard UDP packet."
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>NAT-T</primary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>NAT Traversal</primary>"
msgstr ""
#. Tag: title
#, no-c-format
msgid "<emphasis>SECURITY</emphasis> IPsec and firewalls"
msgstr ""
#. Tag: para
#, no-c-format
msgid "The standard mode of operation of IPsec involves data exchanges on UDP port 500 for key exchanges (also on UDP port 4500 in case NAT-T is in use). Moreover, IPsec packets use two dedicated IP protocols that the firewall must let through; reception of these packets is based on their protocol numbers, 50 (ESP) and 51 (AH)."
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>ESP, protocol</primary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>AH, protocol</primary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>protocol</primary><secondary>AH</secondary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>protocol</primary><secondary>ESP</secondary>"
msgstr ""
#. Tag: title
#, no-c-format
msgid "PPTP"
msgstr ""
#. Tag: para
#, no-c-format
msgid "PPTP (for <emphasis>Point-to-Point Tunneling Protocol</emphasis>) uses two communication channels, one for control data and one for payload data; the latter uses the GRE protocol (<emphasis>Generic Routing Encapsulation</emphasis>). A standard PPP link is then set up over the data exchange channel."
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>PPTP</primary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>Point-to-Point Tunneling Protocol</primary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>GRE, protocol</primary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>protocol</primary><secondary>GRE</secondary>"
msgstr ""
#. Tag: title
#, no-c-format
msgid "Configuring the Client"
msgstr ""
#. Tag: para
#, no-c-format
msgid "The <emphasis role=\"pkg\">pptp-linux</emphasis> package contains an easily-configured PPTP client for Linux. The following instructions take their inspiration from the official documentation: <ulink type=\"block\" url=\"http://pptpclient.sourceforge.net/howto-debian.phtml\" />"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary><emphasis role=\"pkg\">pptp-linux</emphasis></primary>"
msgstr ""
#. Tag: para
#, no-c-format
msgid "The Falcot administrators created several files: <filename>/etc/ppp/options.pptp</filename>, <filename>/etc/ppp/peers/falcot</filename>, <filename>/etc/ppp/ip-up.d/falcot</filename>, and <filename>/etc/ppp/ip-down.d/falcot</filename>."
msgstr ""
#. Tag: title
#, no-c-format
msgid "The <filename>/etc/ppp/options.pptp</filename> file"
msgstr ""
#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"# PPP options used for a PPTP connection\n"
"lock\n"
"noauth\n"
"nobsdcomp\n"
"nodeflate\n"
msgstr ""
#. Tag: title
#, no-c-format
msgid "The <filename>/etc/ppp/peers/falcot</filename> file"
msgstr ""
#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"# vpn.falcot.com is the PPTP server\n"
"pty \"pptp vpn.falcot.com --nolaunchpppd\"\n"
"# the connection will identify as the \"vpn\" user\n"
"user vpn\n"
"remotename pptp\n"
"# encryption is needed\n"
"require-mppe-128\n"
"file /etc/ppp/options.pptp\n"
"ipparam falcot\n"
msgstr ""
#. Tag: title
#, no-c-format
msgid "The <filename>/etc/ppp/ip-up.d/falcot</filename> file"
msgstr ""
#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"# Create the route to the Falcot network\n"
"if [ \"$6\" = \"falcot\" ]; then\n"
" # 192.168.0.0/24 is the (remote) Falcot network\n"
" route add -net 192.168.0.0 netmask 255.255.255.0 dev $1\n"
"fi\n"
msgstr ""
#. Tag: title
#, no-c-format
msgid "The <filename>/etc/ppp/ip-down.d/falcot</filename> file"
msgstr ""
#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"# Delete the route to the Falcot network\n"
"if [ \"$6\" = \"falcot\" ]; then\n"
" # 192.168.0.0/24 is the (remote) Falcot network\n"
" route del -net 192.168.0.0 netmask 255.255.255.0 dev $1\n"
"fi\n"
msgstr ""
#. Tag: title
#, no-c-format
msgid "<emphasis>SECURITY</emphasis> MPPE"
msgstr ""
#. Tag: para
#, no-c-format
msgid "Securing PPTP involves using the MPPE feature (<emphasis>Microsoft Point-to-Point Encryption</emphasis>), which is available in official Debian kernels as a module."
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>MPPE</primary>"
msgstr ""
#. Tag: indexterm
#, no-c-format
msgid "<primary>Microsoft</primary><secondary>Point-to-Point Encryption</secondary>"
msgstr ""
#. Tag: title
#, no-c-format
msgid "Configuring the Server"
msgstr ""
#. Tag: title
#, no-c-format
msgid "<emphasis>CAUTION</emphasis> PPTP and firewalls"
msgstr ""
#. Tag: para
#, no-c-format
msgid "Intermediate firewalls need to be configured to let through IP packets using protocol 47 (GRE). Moreover, the PPTP server's port 1723 needs to be open so that the communication channel can happen."
msgstr ""
#. Tag: para
#, no-c-format
msgid "<command>pptpd</command> is the PPTP server for Linux. Its main configuration file, <filename>/etc/pptpd.conf</filename>, requires very few changes: <emphasis>localip</emphasis> (local IP address) and <emphasis>remoteip</emphasis> (remote IP address). In the example below, the PPTP server always uses the <literal>192.168.0.199</literal> address, and PPTP clients receive IP addresses from <literal>192.168.0.200</literal> to <literal>192.168.0.250</literal>."
msgstr ""
#. Tag: title
#, no-c-format
msgid "The <filename>/etc/pptpd.conf</filename> file"
msgstr ""
#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"# TAG: speed\n"
"#\n"
"# Specifies the speed for the PPP daemon to talk at.\n"
"#\n"
"speed 115200\n"
"\n"
"# TAG: option\n"
"#\n"
"# Specifies the location of the PPP options file.\n"
"# By default PPP looks in '/etc/ppp/options'\n"
"#\n"
"option /etc/ppp/pptpd-options\n"
"\n"
"# TAG: debug\n"
"#\n"
"# Turns on (more) debugging to syslog\n"
"#\n"
"# debug\n"
"\n"
"# TAG: localip\n"
"# TAG: remoteip\n"
"#\n"
"# Specifies the local and remote IP address ranges.\n"
"#\n"
"# You can specify single IP addresses separated by commas or you can\n"
"# specify ranges, or both. For example:\n"
"#\n"
"# 192.168.0.234,192.168.0.245-249,192.168.0.254\n"
"#\n"
"# IMPORTANT RESTRICTIONS:\n"
"#\n"
"# 1. No spaces are permitted between commas or within addresses.\n"
"#\n"
"# 2. If you give more IP addresses than MAX_CONNECTIONS, it will\n"
"# start at the beginning of the list and go until it gets\n"
"# MAX_CONNECTIONS IPs. Others will be ignored.\n"
"#\n"
"# 3. No shortcuts in ranges! ie. 234-8 does not mean 234 to 238,\n"
"# you must type 234-238 if you mean this.\n"
"#\n"
"# 4. If you give a single localIP, that's ok - all local IPs will\n"
"# be set to the given one. You MUST still give at least one remote\n"
"# IP for each simultaneous client.\n"
"#\n"
"#localip 192.168.0.234-238,192.168.0.245\n"
"#remoteip 192.168.1.234-238,192.168.1.245\n"
"#localip 10.0.1.1\n"
"#remoteip 10.0.1.2-100\n"
"localip 192.168.0.199\n"
"remoteip 192.168.0.200-250\n"
msgstr ""
#. Tag: para
#, no-c-format
msgid "The PPP configuration used by the PPTP server also requires a few changes in <filename>/etc/ppp/pptpd-options</filename>. The important parameters are the server name (<literal>pptp</literal>), the domain name (<literal>falcot.com</literal>), and the IP addresses for DNS and WINS servers."
msgstr ""
#. Tag: title
#, no-c-format
msgid "The <filename>/etc/ppp/pptpd-options</filename> file"
msgstr ""
#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"## turn pppd syslog debugging on\n"
"#debug\n"
"\n"
"## change 'servername' to whatever you specify as your server name in chap-secrets\n"
"name pptp\n"
"## change the domainname to your local domain\n"
"domain falcot.com\n"
"\n"
"## these are reasonable defaults for WinXXXX clients\n"
"## for the security related settings\n"
"# The Debian pppd package now supports both MSCHAP and MPPE, so enable them\n"
"# here. Please note that the kernel support for MPPE must also be present!\n"
"auth\n"
"require-chap\n"
"require-mschap\n"
"require-mschap-v2\n"
"require-mppe-128\n"
"\n"
"## Fill in your addresses\n"
"ms-dns 192.168.0.1\n"
"ms-wins 192.168.0.1\n"
"\n"
"## Fill in your netmask\n"
"netmask 255.255.255.0\n"
"\n"