| IP Security Validator | |
What is IP Security Validator? IP Security Validator is an experimental tool that allows validation of Virtual Private Network (VPN) configurations between two network interfaces. As with testing connectivity using the Ping program, IP Security Validator enables verification and validation of VPN configurations and their connectivity. IP Security Validator is not restricted to validate IPSEC encapsulation; a command-line parameter allows to validate any encapsulation type over IP. How does it work? IP Security Validator works both interactively as a command line tool and in a "quiet" mode. In interactive mode, the command line tool (ipsecvalidate) reports the results on the standard output in words (human-readable form). In quiet mode, IP Security Validator reports the result via a single return parameter without writing to standard output; this quality makes it suitable to be used as part of administration scripts that run regularly to validate VPN connectivity and encapsulation. Using tools such as IP Security Validator enables independent evaluation of VPN configurations and quick/autonomous reaction to problems. An offline mode even allows the offline evaluation of traffic that was captured into a file with other tools such as tcpdump or pcapture. This way, traffic collected from non-Linux network nodes can be evaluated on a Linux machine Where can I download it? This technology, named IP Security Validator, can be downloaded as an evaluation package from the alphaWorks server of IBM. Search for the name because the physical location within alphaWorks might change. Safely using IP Security Validator As with most security utilities, when you examine security you might find the opposite - this is why you examine it in the first place. Hence, if you find insecurity, IP Security Validator will enable its user to look into unprotected link traffic that can reveal secrets. IP Security Validator depends on libpcap to access link traffic and should only be used by administrators. The tool must be protected against unauthorized use and change by setting appropriate privileges. In Linux, the tool should be owned by "root" and be executable and readable by root only. You achieve this as root by "chown root:root ./ipsecvalidate; chmod 500 ./ipsecvalidate". Do NOT setuid the tool; this is experimental software. If you do not want to run it on very sensitive systems, then you can use the off-line validation mode, capture traffic with your open-source tools, and validate it afterwards on a less critical (offline) machine. If the community finds this tool useful, we can provide checksums or signatures to validate downloads. We are working on releasing the source code for the tool but the legal requirements are very complicated. Short history The IP Security Validator method was developed in 2001 by Dinesh Verma, Arup Acharya, Mandis Beigi, Raymond Jennings, and Reiner Sailer at the IBM T. J. Watson Research Center, NY. The method was implemented for AIX Unix by Raymond Jennings and for Linux by Reiner Sailer. It is currently available only in binary format for Intel Linux but offers an offline validation mode for link traffic captured on remote hosts with different operating systems. Its purpose is to enable security information officers to validate whether the enforced IPSEC security configuration on VPN links adheres to the high-level VPN security policy. As VPN nodes are assumed to be a heterogeneous group of servers using different operating systems and IPSEC implementations, the validation tool needed to be independent of the IPSEC implementation. Further information Have a look at the internals of the tool and respective security evaluation in our LISA 2001 contribution. |