-
Notifications
You must be signed in to change notification settings - Fork 0
/
grml-vpn.8_handcoded
111 lines (111 loc) · 4.47 KB
/
grml-vpn.8_handcoded
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
.\" Hey, EMACS: -*- nroff -*-
.\" First parameter, NAME, should be all caps
.\" Second parameter, SECTION, should be 1-8, maybe w/ subsection
.\" other parameters are allowed: see man(7), man(1)
.TH GRML-VPN 8 "AUG 9, 2005"
.\" Please adjust this date whenever revising the manpage.
.\"
.\" Some roff macros, for reference:
.\" .nh disable hyphenation
.\" .hy enable hyphenation
.\" .ad l left justify
.\" .ad b justify to both left and right margins
.\" .nf disable filling
.\" .fi enable filling
.\" .br insert line break
.\" .sp <n> insert n+1 empty lines
.\" for manpage-specific macros, see man(7)
.SH NAME
grml-vpn \- program to establish encrypted communication channels in a network
.SH SYNOPSIS
.B grml-vpn
.RI [OPTIONS] " <ACTION> " <SPI> " [IPs]
.br
.SH DESCRIPTION
This manual page documents briefly the
.B grml-vpn program
.PP
.\" TeX users may be more comfortable with the \fB<whatever>\fP and
.\" \fI<whatever>\fP escape sequences to invode bold face and italics,
.\" respectively.
\fBgrml-vpn\fP is a program that
provides an easy wrapper around ipsec and setkey (without any ike daemon).
With this program you can create a vpn based uppon ipsec to any number of computers.
It's intended purpose is for example for wlan sessions to create an encrypted network between all computers on the wlan.
It is also possible to create a standalone shellscript which only needs the setkey command to setup the vpn (using the -x option).
.TP
.B add
Add an ipsec entry
.TP
.B del
Delete an specific ipsec entry
.TP
.B clear
Delete all ipsec entries (attention, really deletes _all_ entrys, even from other setkey commands and isakmpd).
.TP
.B show
Show all infos about ipsec entrys.
.TP
.B info
Give infos about ciphers and there allowed keysizes.
.TP
.B help
Show the help message.
.SH OPTIONS
These program follow the long option style without dashes and
short options starting with one dash (`-').
A summary of options is included below.
.TP
.B \-h, help
Show summary of options.
.TP
.B \-v
Show what is going on (more v => more output).
.TP
.B \-a <IP>
Your IP (currently necessary for vpns with more than 2 computers).
.TP
.B \-e <ciphername> (default=rijndael-cbc, better known as AES)
Cipher name. Will be matched against ciphers available for ipsec (all ciphers not only the available ciphers on your box).
eg. "-e two" will match twofish-cbc. If more then one ciphers matches your regexp than the matches are printed and grml-vpn aborts.
.TP
.B \-b <keysize> (default=256 bit)
Keysize used for your encryption.
.TP
.B \-k <key>
Your key/password for the vpn (will be hashed).
.TP
.B \-K <raw-key>
Set raw key (you determine the keysize, not -b).
.TP
.B \-f <input-file>
Read IPs for encrypted connections from file (same as from stdin).
.TP
.B \-c
Read IPs from stdin (setkey commands are not written until _all_ IPs are read from stdin).
.TP
.B \-p
Only print the setkey commands (eg. grml-vpn -p ... |setkey -c).
USE THIS if you create a vpn with many computers, because this is a bit faster).
.TP
.B \-x
Print a standalone shellscript which only needs setkey to setup the vpn.
.SH EXAMPLES
.TP
.B grml-vpn -k testpw -b 128 add 1000 192.168.0.1 192.168.0.2
Creates encrypted connections between the two IPs possible, with the pre shared key (PSK) testpw and 128bit rijndael-cbc. You have to execute this command on both computers (if you type this command only on one computer, then it's impossible to create an connection between the two computers).
NOTE: with only 2 computers it's not necessary to specify your own ip with -a.
.TP
.B grml-vpn -e bl -b 255 -a 192.168.0.2 add 2000 192.168.0.1 192.168.0.2 192.168.0.3
Encrypted connections between all 3 computers. This command should be executed on 192.168.0.2 (-a) and on the other two computers with the appropriate -a <IP>.
The cipher is blowfisch-cbc (no, -e bl is NO typo ;).
.TP
.B grml-vpn -a 192.168.0.2 del 2000 192.168.0.1 192.168.0.2 192.168.0.3
This command deletes the previous created encrypted connections on 192.168.0.2 (after this command it's impossible to send data to 192.168.0.{1,3} until you delete the vpn entrys on them (no, even ssh does not work anymore).
You should execute this command on all computers of the vpn (with the appropriate -a <IP> option). You could also use grml-crypt clear to clear all vpn settings.
.SH SEE ALSO
.BR setkey (8)
.SH AUTHOR
grml-vpn was written by Michael Gebetsroither <gebi@grml.org>.
.PP
This manual page was written by Michael Gebetsroither <gebi@grml.org>.