Encrypting the Local Network

As with Full WaveSEC, this solution is vulnerable to rogue APs and rogue DHCP servers, although not using anything is of course also vulnerable to those active attacks.

The worst part is that this solution requires manual intervention and installation from the end user, rather than being fully transparent.

The most satisfactory alternative would be a port of the Openswan userland to Windows, with hooks into the Windows kernel IPsec stack using the ipsec2k library. The Openswan userland has already been ported to Windows using Cygwin (as opposed to the native Windows winsock API) and is already available in CVS HEAD, which will become the Openswan 2.5 branch. Hopefully, we will soon be able to offer Full WaveSEC on the Windows platform as well. A port of Openswan to Mac OS X has also recently started. For now, using an SSL web server with a specially downloadable client is the best we can offer for Windows and MacOSX.

Building a WaveSEC for Windows Server

A prototype WaveSEC for Windows server has been written using PHP. This is really no more than a proof of concept, and should not be rolled out in production environments. For example, no security has been added to prevent one client from downloading another client's generated certificate. The prototype can be downloaded from our FTP server at ftp.openswan.org.

The setup for this server is much easier than the Full WaveSEC variant. First you need to create the CA and the WaveSEC server's own IPsec certificate. In our prototype, this is done when you initialize the WaveSEC server over its SSL web interface.

250

Chapter 10

The SSL X.509 Certificate is also used for Openswan. On the WaveSEC server, we only need to configure one WaveSEC for Windows connection. Assuming our wireless network is

192.168.0.0/24 and our default gateway (and WaveSEC server!) is 192.168.0.254, our conn would look like:

conn wavesec-for-windows left=192.168.0.254 leftrsasigkey=%cert leftsubnet=0.0.0.0/0

leftcert=/etc/ipsec.d/certs/gateway-cert.pem right=%any

rekey=no

rightca=%same

rightrsasigkey=%cert

auto=add

authby=rsasig

pfs=yes

If you are using this machine with more than one type of IPsec tunnel, you will need to add a leftid= option with the DN of your gateway-cert.pem X.509 Certificate.

In ipsec.secrets, we would have the corresponding private key for this certificate:

: RSA /etc/ipsec.d/private/gateway-key.pem "ThePassphraseIsGlowingWhispers"

conn roadwarrior-net left=%any right=192.168.0.254 rightsubnet=*

rightca="C=NL, L=Amsterdam,O=Xelerance,CN=WaveSEC CA,E=postmaster@xelerance.com"

auto=start

pfs=yes

network=auto

The rightca= line varies according to how you initialized the WaveSEC server earlier on. lsipsectool.exe can be installed with a pre-recorded configuration file.

Obtaining the Certificate and Client Software

Once a client connects to the WaveSEC server website, the server will generate an X.509 Certificate in PKCS#12 format, which the client can then download:

251