Red Hat ENTERPRISE LINUX 5 - VIRTUAL SERVER ADMINISTRATION, Руководство по развертыванию

Страница: 708 / 848

Chapter 43. Securing Your Network
682
43.7. Virtual Private Networks (VPNs)
Organizations with several satellite offices often connect to each other with dedicated lines for
efficiency and protection of sensitive data in transit. For example, many businesses use frame relay or
Asynchronous Transfer Mode
(ATM) lines as an end-to-end networking solution to link one office with
others. This can be an expensive proposition, especially for small to medium sized businesses (SMBs)
that want to expand without paying the high costs associated with enterprise-level, dedicated digital
circuits.
To address this need,
Virtual Private Networks
(VPNs) were developed. Following the same functional
principles as dedicated circuits, VPNs allow for secured digital communication between two parties (or
networks), creating a
Wide Area Network
(WAN) from existing
Local Area Networks
(LANs). Where
it differs from frame relay or ATM is in its transport medium. VPNs transmit over IP using datagrams
as the transport layer, making it a secure conduit through the Internet to an intended destination. Most
free software VPN implementations incorporate open standard encryption methods to further mask
data in transit.
Some organizations employ hardware VPN solutions to augment security, while others use software
or protocol-based implementations. Several vendors provide hardware VPN solutions, such as Cisco,
Nortel, IBM, and Checkpoint. There is a free software-based VPN solution for Linux called FreeS/Wan
that utilizes a standardized
Internet Protocol Security
(IPsec) implementation. These VPN solutions,
irrespective of whether they are hardware or software based, act as specialized routers that exist
between the IP connection from one office to another.
43.7.1. How Does a VPN Work?
When a packet is transmitted from a client, it sends it through the VPN router or gateway, which adds
an
Authentication Header
(AH) for routing and authentication. The data is then encrypted and, finally,
enclosed with an
Encapsulating Security Payload
(ESP). This latter constitutes the decryption and
handling instructions.
The receiving VPN router strips the header information, decrypts the data, and routes it to its intended
destination (either a workstation or other node on a network). Using a network-to-network connection,
the receiving node on the local network receives the packets already decrypted and ready for
processing. The encryption/decryption process in a network-to-network VPN connection is transparent
to a local node.
With such a heightened level of security, an attacker must not only intercept a packet, but decrypt the
packet as well. Intruders who employ a man-in-the-middle attack between a server and client must
also have access to at least one of the private keys for authenticating sessions. Because they employ
several layers of authentication and encryption, VPNs are a secure and effective means of connecting
multiple remote nodes to act as a unified intranet.
43.7.2. VPNs and Red Hat Enterprise Linux
Red Hat Enterprise Linux provides various options in terms of implementing a software solution to
securely connect to a WAN.
Internet Protocol Security
(IPsec) is the supported VPN implementation
for Red Hat Enterprise Linux, and sufficiently addresses the usability needs of organizations with
branch offices or remote users.