test

SunScreen SKIP User's Guide, Release 1.5.1

Adding Authorized Systems

Any remote host with which you want to communicate must be configured using the Add pop-up window.

An authorized host may or may not be using encryption. The Add pop-up window provides three options:

You add hosts to the authorized systems list using the Add button. The valid types of remote hosts that you can add to your ACL are

To determine the servers your system communicates with, use the following commands:

If you do not specify a system that you currently have in use when you enable access control, a menu will come up and ask if you want to add the system. It also checks for multicast routers that are being used for others and adds them to the proposed list of systems to add.

Regardless of the type of system that you are adding to the ACL, you must implement the same policy on both your machine and the entity with which you wish to communicate securely. If you do not configure both systems properly, the packets are silently dropped and it appears as if that particular host does not exist. skiplog is useful in diagnosing this situation.

When you click on the Add button, the Add pop-up window appears. From the menu in this window, you select the type of connection: Host, Network, or Nomadic. Next, use the pull-right menu to set the security level. After you have selected the level of security, the appropriate Properties window becomes available. The Add System Properties window is used to set up the options for the type of encryption used by the host, network, or nomadic system being authorized. The procedures in the sections following the table detail how to set up each encryption option.

Adding a Host or Network with No Encryption

This procedure is used to allow a host or network access to your system without using any encryption.

  1. Click and hold the Add button at the bottom of the authorized systems list on the skiptool main window.

  2. Select the type of connection being authorized: Host or Network. (Nomadic does not offer this option.)

  3. Pull right on the type of connection and select Off.

    The Add Host properties or Add Network properties dialog box, shown in the following figure, in appears.

    Figure 3-2 Add Host/Properties--No Encryption

    Graphic

  4. In the Add Host or Network properties window, enter the name or IP address of the host system to be added to your ACL.

    In the case of a network, you must define the network with the IP address and the netmask.

  5. Click the Apply button.

Setting Up Security for a Host, Network, or Nomadic System

The procedures in this section enable a host, network, or nomadic system access to your system according to the encryption rules you set up. Remember, both your system and the other system need to use the same rules in order to communicate.

Dialog Box Parameters

The following section provides some background on the choices available to you from the skiptool dialog boxes. This material will be useful to use the procedures that follow. The two encryption dialog boxes (SKIP and SKIP Version 1) use common set-up parameters, as you can see in Figure 3-3 through Figure 3-5. Explanations of the parameters follow the figures.

Figure 3-3 Host--Add SKIP Host Properties and SKIP Version 1 Properties

GraphicGraphic

Figure 3-4 Network--Add SKIP Network Properties and SKIP Version 1 Properties

GraphicGraphic

Figure 3-5 Nomadic--Add SKIP Properties and Add SKIP Version 1

GraphicGraphic

Parameter Explanations

The following name spaces are listed in this menu:

Adding Authorized Systems with Encryption
Note -

While using any of the Add functions of skiptool, if you generate an error msg, clicking the apply button will not close the window. You must close the Add window manually. The normal behavior is for the window to close automatically after you click the apply button.

  1. Click and hold on the Add button at the bottom of the authorized systems list on skiptool's Main Window.

  2. Select the type of connection being authorized: Host, Network, or Nomadic.

  3. Pull right on the type of connection and select the type of encryption that you want to use.

    • If the remote host system also uses SKIP and the traffic between your systems is to be encrypted, select SKIP.

    • For systems using Sun Microsystems' SunScreen SPF-100, select SKIP Version 1.

  4. On the Add properties window, enter the name or IP address of the host system to be added to your ACL.

  5. Determine whether Whole packet (tunnel mode) or Data only (transport mode) is secure by clicking on the appropriate selection for the Secure button.

  6. Each type of encryption requires that certain options be set.

    The parameters selected are determined by the type of system being authorized and your security policies. The options to be considered are based on the method of encryption selected. They are

    • For systems using SKIP: Tunnel address, Remote Key ID, Local Key ID. If you leave the tunnel address blank, it will default to the peer's address.

    • For SKIP Version 1: Key ID, Tunnel address.

  7. Select the appropriate algorithms buttons for Key encryption, Traffic encryption, and Authentication.

    The options available for each system are based upon the method of encryption selected from the Security pop-up menu:

    • Key Encryption button: Selecting this button lists the available key encryption algorithms. The algorithm available is determined by the type of system and selected method of encryption. Please Table 3-2.

    • Traffic Encryption button: Selecting this button lists the algorithms available for encryption between your system and the remote system. The algorithms that are available for key and traffic encryption depend on the packages that were installed on the system, such as core product and key upgrades. The algorithms available determine the type of system and the method of encryption selected. Please see Table 3-2.

    • Authentication button: Use this button to select the type of authentication for the packets.

  8. Click Apply to add the host to the authorized systems list.

    Refer to the previous section for descriptions of the fields and buttons.

Repeat Steps 1 though 8 for all encrypted hosts. Remember that your policy options for each system entered on your ACL must be the same as those entered on the system entity with which you wish to communicate through encrypted channels. If the configuration on your system does not match that of the party with which you wish to communicate, the packets are silently dropped. It will simply appear as though that host no longer exists.

Using Default System Entry

The default system entry is used when no other more specific ACL entry matches a host. Often, this entry is set to clear to allow hosts that are not listed in the ACL to communicate in the clear. It may, however, be used to create a default encryption rule.

Communicating In the Clear (Off)

Typically, the NIS and DNS servers to which your systems have access are set up as communicating with your system in the clear or unencrypted. In addition, any host that does not use an encryption package must be set up to communicate with you in the clear.

Communicating Using SKIP Version 1

Complete the following steps to set these fields for encrypted traffic between your server and the system to be authorized.

  1. After selecting the type of system and setting the security to SKIP, enter the Hostname.

  2. Enter the Node ID.

    This is the IPv4 key ID.

  3. Local Key ID and ID buttons.

    Use the Local Key ID button to indicate whether you want your local system to send its key ID in the SKIP packet.

  4. Set the Tunnel Address, if you are using topology hiding.

    Tunnel addressing is generally used for clients of encrypted gateways where the IP address of the host entered here serves as the intermediary for any or all hosts on a network whose topography is to remain unknown or hidden from the rest of the world.

  5. Select the appropriate key and traffic algorithms for the Key and Traffic encryption buttons.

    The available key and traffic encryption algorithms depend on the which version of SKIP you are using: 512 bit, 1024 bit, 2048 bit, 4096 bit. To see which options are available, please see Table 3-2.

Communicating Using SKIP

Complete the following steps to set these fields for encrypted traffic between your server and the system to be authorized.

  1. After selecting the type of system and setting the security to SKIP, enter the Hostname.

  2. Set the Secure button to either Whole packet (tunnel mode) or Data only (transport mode).

    Whole packet is recommended because it offers a greater degree of security.

  3. Set the Tunnel address, if you are using topology hiding.

    Tunnel addressing is generally used for clients of encrypted gateways where the IP address of the host entered here serves as the intermediary for any or all hosts on a network whose topography is to remain unknown or hidden from the rest of the world.

  4. Use the Remote Key ID button to select whether you would like the remote system's keyID included in SKIP packets.

    If so, what namespace does that key occupy. By selecting Not Present, the receiver key ID is not sent.

    Not Present is the default. It uses the IP address of the remote system to identify its certificate. If a remote system has a key ID other than identified by its IP address, set the name spaces and indicate the remote system's key ID in the ID Field. The namespace indicated in the Remote Key ID field is determined by the type of certificate that is used or obtained for this system. The type of certificate and the Remote Key ID field for that certificate is shown in the following table:

    Table 3-3 Type of Certificate and Remote Key ID Field

    Certificate Type 

    Remote Key ID Field 

    CA (Sun or other) 

    IPv4 

    Self-generated unsigned key 

    MD5 (DH Public Value) 

  5. The following name spaces are used in this menu:

    Not present 

    IPv4 Address 

    MD5 (DH public Value) 

  6. If the Remote Key ID field has been set to something other than Not Present, enter the key ID in hexadecimal format in the ID field (0x0a000000).

    It must contain the appropriate key ID for the system that is being authorized based upon the selection made in the Remote Key ID field. Depending on the type of certificate, this information may be obtained from the master keyID on the diskette or from the Local key ID field of the other host.

  7. Select the appropriate key and traffic algorithms for the Key and Traffic encryption buttons.

    The available options that appear depend on which version of SKIP you are using. versions Available options include: 512 bit, 1024 bit, 2048 bit, or 4096 bit. Please see Table 3-2.

  8. Authentication button.

    Use the authentication button to select the type of authentication for the packets. Currently, SunScreen SKIP supports MD5 and MD5-NAT. You can also select None for no authentication.