[securityguide] Removed 7_Zip section from book
by Eric Christensen
commit 78793841799661bfe33f8c25044fad6a57f60025
Author: Eric Christensen <sparks(a)fedoraproject.org>
Date: Fri Jun 20 00:25:02 2014 -0400
Removed 7_Zip section from book
en-US/Encryption.xml | 1 -
1 files changed, 0 insertions(+), 1 deletions(-)
---
diff --git a/en-US/Encryption.xml b/en-US/Encryption.xml
index def7428..9b22d0c 100644
--- a/en-US/Encryption.xml
+++ b/en-US/Encryption.xml
@@ -65,7 +65,6 @@ AuthorizedKeysFile .ssh/authorized_keys</screen>The first line tells the SSH pro
</section>
</section>
<xi:include href="DiskEncryptionUserGuide.xml" xmlns:xi="http://www.w3.org/2001/XInclude"></xi:include>
- <xi:include href="7_Zip.xml" xmlns:xi="http://www.w3.org/2001/XInclude"></xi:include>
<xi:include href="Using_GPG.xml" xmlns:xi="http://www.w3.org/2001/XInclude"></xi:include>
</section>
</chapter>
9 years, 10 months
[securityguide] Removing old chapters
by Eric Christensen
commit 1c95a9c40b9094edb1e7bef5efcc77e78f1ec3a7
Author: Eric H Christensen <sparks(a)redhat.com>
Date: Tue Jun 17 15:42:42 2014 -0400
Removing old chapters
en-US/Appendix.xml | 6 -
en-US/Tcp_Wrappers.xml | 1014 ------------------------------------------------
2 files changed, 0 insertions(+), 1020 deletions(-)
9 years, 10 months
[securityguide] Updated bit suggestion, updated examples, and updated markup.
by Eric Christensen
commit 64552776b14adaf0494692db8312427d0e0dcb53
Author: Eric H Christensen <sparks(a)redhat.com>
Date: Tue Jun 17 10:53:23 2014 -0400
Updated bit suggestion, updated examples, and updated markup.
en-US/Using_GPG.xml | 13 ++++++++-----
1 files changed, 8 insertions(+), 5 deletions(-)
---
diff --git a/en-US/Using_GPG.xml b/en-US/Using_GPG.xml
index 1086c7a..8b8c4c2 100644
--- a/en-US/Using_GPG.xml
+++ b/en-US/Using_GPG.xml
@@ -85,29 +85,32 @@ What keysize do you want? (2048)</screen>
<para>
Entering a value of <code>1y</code>, for example, makes the key valid for one year. (You may change this expiration date after the key is generated, if you change your mind.)
</para>
+ <important>
+ <para>Making the key expire after a relatively short period of time provides a failsafe function if you lose control over the key. You must, however, extend the expiration date <emphasis>before</emphasis> the key expires.</para>
+ </important>
<para>
Before the <code>gpg</code>code> program asks for signature information, the following prompt appears:
- <code>Is this correct (y/n)?</code> Enter <code>y</code>code> to finish the process.
+ <code>Is this correct (y/n)?</code> Enter <code>y</code> to finish the process.
</para>
<para>
Next, enter your name and email address. Remember this process is about authenticating you as a real individual. For this reason, include your real name. Do not use aliases or handles, since these disguise or obfuscate your identity.
</para>
<para>
- Enter your real email address for your GPG key. If you choose a bogus email address, it will be more difficult for others to find your public key. This makes authenticating your communications difficult. If you are using this GPG key for [[DocsProject/SelfIntroduction| self-introduction]] on a mailing list, for example, enter the email address you use on that list.
+ Enter your real email address for your GPG key. If you choose a bogus email address, it will be more difficult for others to find your public key. This makes authenticating your communications difficult. If you are using this GPG key for self-introduction on a mailing list, for example, enter the email address you use on that list.
</para>
<para>
Use the comment field to include aliases or other information. (Some people use different keys for different purposes and identify each key with a comment, such as "Office" or "Open Source Projects.")
</para>
<para>
- At the confirmation prompt, enter the letter O to continue if all entries are correct, or use the other options to fix any problems. Finally, enter a passphrase for your secret key. The <code>gpg</code> program asks you to enter your passphrase twice to ensure you made no typing errors.
+ At the confirmation prompt, enter the letter O to continue if all entries are correct, or use the other options to fix any problems. Finally, enter a passphrase for your secret key. The <application>gpg</application> program asks you to enter your passphrase twice to ensure you made no typing errors.
</para>
<para>
Finally, <code>gpg</code> generates random data to make your key as unique as possible. Move your mouse, type random keys, or perform other tasks on the system during this step to speed up the process. Once this step is finished, your keys are complete and ready to use:
</para>
<screen>
-pub 1024D/1B2AFA1C 2005-03-31 John Q. Doe <jqdoe@example.com>
+pub 3072R/1B2AFA1C 2005-03-31 John Q. Doe <jqdoe@example.com>
Key fingerprint = 117C FE83 22EA B843 3E86 6486 4320 545E 1B2A FA1C
-sub 1024g/CEA4B22E 2005-03-31 [expires: 2006-03-31]
+sub 3072R/CEA4B22E 2013-03-31 [expires: 2014-03-31]
</screen>
<para>
The key fingerprint is a shorthand "signature" for your key. It allows you to confirm to others that they have received your actual public key without any tampering. You do not need to write this fingerprint down. To display the fingerprint at any time, use this command, substituting your email address:
9 years, 10 months
[securityguide] Updated asymmetric certificate size suggestion
by Eric Christensen
commit 9d4c9b0a6f8ea021dce8227548bceaa61827c4f6
Author: Eric H Christensen <sparks(a)redhat.com>
Date: Tue Jun 17 10:35:04 2014 -0400
Updated asymmetric certificate size suggestion
en-US/Encryption.xml | 2 +-
en-US/Encryption_Standards.xml | 2 +-
en-US/Using_GPG.xml | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
---
diff --git a/en-US/Encryption.xml b/en-US/Encryption.xml
index 5df7691..def7428 100644
--- a/en-US/Encryption.xml
+++ b/en-US/Encryption.xml
@@ -59,7 +59,7 @@
<para>A configuration change must occur before cryptographic logon can occur. In the file <filename>/etc/ssh/sshd_config</filename> uncomment and modify the following lines so that appear as such:
<screen>PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys</screen>The first line tells the SSH program to allow public key authentication. The second line points to a file in the home directory where the public key of authorized key pairs exists on the system.</para>
- <para>The next thing to do is to generate the ssh key pairs on the client you will use to connect to the system. The command <command>ssh-keygen</command> will generate an RSA 2048-bit key set for logging into the system. The keys are stored, by default, in the <filename>~/.ssh</filename> directory. You can utilize the switch <command>-b</command> to modify the bit-strength of the key. 2048-bits is probably okay but you can go up to, and possibly beyond, 8192-bit keys.</para>
+ <para>The next thing to do is to generate the ssh key pairs on the client you will use to connect to the system. The command <command>ssh-keygen</command> will generate an RSA 2048-bit key set for logging into the system. The keys are stored, by default, in the <filename>~/.ssh</filename> directory. You can utilize the switch <command>-b</command> to modify the bit-strength of the key. A 2048-bit certificate only provides 112 bits of security. To get 128 bits of security requires a 3072-bit certificate and to get 256 bits of security one must use a 15,360-bit certificate. Elliptical certificates (<abbrev>ECDSA</abbrev>) and elliptical ciphers can increase the security to 256 bits with smaller certificates.</para>
<para>In your <filename>~/.ssh</filename> directory you should see the two keys you just created. If you accepted the defaults when running the <command>ssh-keygen</command> then your keys are named <filename>id_rsa</filename> and <filename>id_rsa.pub</filename>, the private and public keys. You should always protect the private key from exposure. The public key, however, needs to be transfered over to the system you are going to login to. Once you have it on your system the easiest way to add the key to the approved list is by: <screen>$ cat id_rsa.pub >> ~/.ssh/authorized_keys</screen> This will append the public key to the authorized_key file. The <application>SSH</application> application will check this file when you attempt to login to the computer.</para>
<para>Similarly to passwords and any other authentication mechanism, you should change your <application>SSH</application> keys regularly. When you do make sure you clean out any unused key from the authorized_key file.</para>
</section>
diff --git a/en-US/Encryption_Standards.xml b/en-US/Encryption_Standards.xml
index 361dfb3..732f9b9 100644
--- a/en-US/Encryption_Standards.xml
+++ b/en-US/Encryption_Standards.xml
@@ -63,7 +63,7 @@
<section>
<title>SSL/TLS</title>
<para>Transport Layer Security (TLS) and its predecessor, Secure Socket Layer (SSL), are cryptographic protocols that provide security for communications over networks such as the Internet. TLS and SSL encrypt the segments of network connections at the Transport Layer end-to-end. Several versions of the protocols are in widespread use in applications like web browsing, electronic mail, Internet faxing, instant messaging and voice-over-IP (VoIP). TLS is an IETF standards track protocol, last updated in RFC 5246, that was based on the earlier SSL specifications developed by Netscape Corporation.</para>
- <para>The TLS protocol allows client/server applications to communicate across a network in a way designed to prevent eavesdropping and tampering. TLS provides endpoint authentication and communications confidentiality over the Internet using cryptography. TLS provides RSA security with 1024 and 2048 bit strengths.</para>
+ <para>The TLS protocol allows client/server applications to communicate across a network in a way designed to prevent eavesdropping and tampering. TLS provides endpoint authentication and communications confidentiality over the Internet using cryptography. TLS traditionally uses RSA keys which provide 112 bits of security with a 2048-bit certificate and 128 bits of security with a 3072-bit certificate.</para>
<para>In typical end-user/browser usage, TLS authentication is unilateral: only the server is authenticated (the client knows the server's identity), but not vice versa (the client remains unauthenticated or anonymous).</para>
<para>TLS also supports the more secure bilateral connection mode (typically used in enterprise applications), in which both ends of the "conversation" can be assured with whom they are communicating (provided they diligently scrutinize the identity information in the other party's certificate). This is known as mutual authentication, or 2SSL. Mutual authentication requires that the TLS client-side also hold a certificate (which is not usually the case in the end-user/browser scenario). Unless, that is, TLS-PSK, the Secure Remote Password (SRP) protocol, or some other protocol is used that can provide strong mutual authentication in the absence of certificates.</para>
<para>Typically, the key information and certificates necessary for TLS are handled in the form of X.509 certificates, which define required fields and data formats.</para>
diff --git a/en-US/Using_GPG.xml b/en-US/Using_GPG.xml
index e6ed3a1..1086c7a 100644
--- a/en-US/Using_GPG.xml
+++ b/en-US/Using_GPG.xml
@@ -68,7 +68,7 @@
<screen>RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048)</screen>
- Again, the default is sufficient for almost all users, and represents a strong level of security.
+ Again, the default only provides 112 bits of security. Increasing this to 3072 helps provide 128 bits of security and represents a stronger level of security.
</para>
<para>
Next, choose when the key will expire. It is a good idea to choose an expiration date instead of using the default, which is none. If, for example, the email address on the key becomes invalid, an expiration date will remind others to stop using that public key.
9 years, 10 months
[securityguide] Commented out IPSec
by Eric Christensen
commit 94dcc16b6e13db4719ab65d0af8a2e7941406328
Author: Eric H Christensen <sparks(a)redhat.com>
Date: Tue Jun 17 10:20:17 2014 -0400
Commented out IPSec
en-US/VPN.xml | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
---
diff --git a/en-US/VPN.xml b/en-US/VPN.xml
index a74c96d..4641e62 100644
--- a/en-US/VPN.xml
+++ b/en-US/VPN.xml
@@ -59,7 +59,7 @@
</para>
</section>
- <section id="sect-Security_Guide-Virtual_Private_Networks_VPNs-IPsec">
+<!-- <section id="sect-Security_Guide-Virtual_Private_Networks_VPNs-IPsec">
<title>IPsec</title>
<para>
&PRODUCT; supports <abbrev>IPsec</abbrev> for connecting remote hosts and networks to each other using a secure tunnel on a common carrier network such as the Internet. <abbrev>IPsec</abbrev> can be implemented using a host-to-host (one computer workstation to another) or network-to-network (one <acronym>LAN</acronym>/<acronym>WAN</acronym> to another) configuration.
@@ -985,7 +985,7 @@ include "/etc/racoon/<replaceable>X.X.X.X</replaceable>.conf"</screen>
</section>
</section>
-
+-->
<section id="sect-Security_Guide-Virtual_Private_Networks_VPNs-OpenConnect">
<title>OpenConnect</title>
<para>
9 years, 10 months
[securityguide] VPN: Added OpenConnect section.
by Eric Christensen
commit cb81ac7d069e080d57df40433544bb7308073496
Author: Nikos Mavrogiannopoulos <nmav(a)redhat.com>
Date: Mon Jun 16 15:52:46 2014 +0200
VPN: Added OpenConnect section.
Signed-off-by: Eric H Christensen <sparks(a)redhat.com>
en-US/VPN.xml | 86 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 files changed, 86 insertions(+), 0 deletions(-)
---
diff --git a/en-US/VPN.xml b/en-US/VPN.xml
index f4a2242..a74c96d 100644
--- a/en-US/VPN.xml
+++ b/en-US/VPN.xml
@@ -985,6 +985,92 @@ include "/etc/racoon/<replaceable>X.X.X.X</replaceable>.conf"</screen>
</section>
</section>
+
+ <section id="sect-Security_Guide-Virtual_Private_Networks_VPNs-OpenConnect">
+ <title>OpenConnect</title>
+ <para>
+ &PRODUCT; supports <abbrev>OpenConnect</abbrev> for connecting remote hosts and networks to each other using an SSL/TLS-based secure tunnel on a common carrier network such as the Internet. The protocol is compatible with the CISCO AnyConnect and can be used to connect to CISCO gateways in addition to OpenConnect servers. OpenConnect utilizes two channels, a TCP channel under TLS, and a UDP channel under DTLS to establish the tunnel. The UDP channel takes precedence when can be reliably established, and the TCP channel is used as backup.
+ </para>
+ <para>
+ <abbrev>OpenConnect</abbrev> can be deployed to connect a host to a network, or a network to network. The mode is determined by the server which provides the appropriate configuration (e.g., routes) to the client.
+ </para>
+
+ <section id="sect-Security_Guide-Virtual_Private_Networks_VPNs-OpenConnect_Authentication">
+ <title>Authentication of an <abbrev>OpenConnect</abbrev> Connection</title>
+ <para>
+ An <abbrev>OpenConnect</abbrev> connection can be established after the credentials are available to the user. The credentials may be a username-password pair, a client certificate or both. In all cases, the server's certificate (or its hash) must be available or known to the user.
+ </para>
+ </section>
+
+ <section id="sect-Security_Guide-Virtual_Private_Networks_VPNs-OpenConnect_Installation">
+ <title>OpenConnect Installation</title>
+ <para>
+ Deploying <abbrev>OpenConnect</abbrev> client side requires that the <filename>NetworkManager-openconnect</filename>, and <filename>openconnect</filename> RPM packages be installed. The server side requires the <filename>ocserv</filename> RPM package. The available applications are listed below.
+ </para>
+ <itemizedlist>
+ <listitem>
+ <para>
+ <command>/usr/sbin/openconnect</command> — It is the client tunnel establishment tool. Refer to the <command>openconnect</command>(8) man page for more information.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <command>/usr/sbin/ocserv</command> — it is the openconnect server application. Refer to the <command>ocserv</command>(8) man page for more information.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <filename>/etc/ocserv/ocserv.conf</filename> — <command>ocserv</command>'s daemon configuration file used to configure various aspects of the connection, including authentication methods and encryption algorithms used in the connection. Refer to the <filename>ocserv</filename>(8) man page for a complete listing of available directives.
+ </para>
+ </listitem>
+ </itemizedlist>
+ <para>
+ To configure an <abbrev>OpenConnect</abbrev> client on &PRODUCT;, you can use the <application>Network Manager Tool</application>, or manually execute the <filename>openconnect</filename> application with the appropriate command line parameters.
+ </para>
+ </section>
+
+ <section id="sect-Security_Guide-Virtual_Private_Networks_VPNs-OpenConnect_Client_Configuration">
+ <title>OpenConnect Client Configuration</title>
+ <para>
+ OpenConnect's default operation connects one desktop or workstation (host) to a network. The server openconnect connects to provides the routes that are available from the VPN tunnel.
+ </para>
+ <para>
+ To configure a host-to-host <abbrev>IPsec</abbrev> connection, use the following steps for each host:
+ </para>
+ <orderedlist continuation="restarts" inheritnum="ignore">
+ <listitem>
+ <para>
+ Select the configuration option on the top right menu and select the <application>Network</application> settings.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ On the <guilabel>Network</guilabel> tab, click <guibutton>+</guibutton> to start the new connection configuration wizard.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ On the <guilabel>Add Network Connection</guilabel> dialog, click <guibutton>VPN</guibutton>.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ Then select the <guibutton>Cisco AnyConnect Compatible VPN (openconnect)</guibutton>.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ Enter the gateway (server address) for the connection, and optionally specify the server's certificate. If no certificate is specified you'll be prompted to trust the one that is obtained by the server on the initial connection.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ Save and, return the the initial <guilabel>Network</guilabel> tab, and then click on the newly created VPN connection. You'll be prompted for the username and password.
+ </para>
+ </listitem>
+ </orderedlist>
+ </section>
+ </section>
</section>
9 years, 10 months