Chapter 6

Unfortunately, the parties cannot both have a key in the forward, since this would open up the entire process to a man-in-the-middle attack. Another important limitation is that when a client is using a key in the forward, it is not advertising its own OE capabilities to the world, since no one knows that the IP address it is using belongs to the hostname laptop.xelerance.com.

For servers, it can be quite an overhead to determine whether an incoming connection belongs to a client that can perform OE. In fact, it is probably very unlikely, because if the client could do OE, and the server is advertising its OE capability, the client would not be coming in using plaintext, but would first send an IKE packet for the OE initialization. Therefore, it makes sense to place servers in a responding-only mode known as passive mode.

The following table summarizes the four different kinds of OE peers.

Type

Resources needed

When to use

Limitations

Full OE	DNS entry in the reverse	Whenever possible
	zone, a static IP
Initiate-only OE	DNS entry in any forward	If no control of reverse, or
(iOE)	DNS zone	when configured for
		DHCP
Passive OE	DNS entry in the reverse	On very busy servers, or
	zone, a static IP	on responding-mostly
		servers (web servers,
		authoritative name
		servers)

Takes a lot of resources

Does not advertise OE, will talk in the clear to other initiate-only peers

All initiating connections from the host will be in the clear

NAT-OE / BTNS	None, keys exchanged	Meant to be usable from	Vulnerable to man-in-the-
(currently not	inline (!)	behind NAT	middle attacks
implemented)

Policy Groups

Apart from these four classes of OE, there is a mechanism in place to fine-tune these modes even further. The policy files in /etc/ipsec.d/policies/ are a few files that may contain IP addresses or subnets for explicit handling. 0.0.0.0/0 is used to denote the entire Internet.

Policy file	Purpose
block	Never talk to these hosts at all
clear	Always talk in the clear to these hosts
clear-or-private	Talk in the clear, but allow these hosts to initiate OE to us
private	Only talk encrypted to these hosts
private-or-clear	Attempt OE to these hosts, but talk in the clear if they do not support OE
	137