Aker Secure Roaming User's Manual - Data
Contents
1. To load a new library click on the Add button and browse for the dll windows or so Unix file Next click on the square box next to it so that a checkmark is drawn inside it Finally click Reload so that the tokens are recognized To be sure you selected the correct file please verify if the additional columns version and description are filled If a dynamic library for another purpose is selected by mistake a error message will be displayed li 3 Tf you have trouble finding the correct library file for your token please contact the token manufacturer or reseller They can provide you with support on finding theses files 3 5 Log page Aker Secure Roaming Client Log Ka Priorities O Information a L Warning Save Clear E Erro W Fatal error Priority Date Time WEro 0240272005 15 11 04 Error opening virtual interface Pinto 0240242005 15 11 04 Successful connected to server 10 0 0 111 This page shows you the client s activity log This can be very useful for the system administrator when troubleshooting a malfunctioning setup Clicking the Save button will allow you to export the log to a text file which can easily be sent to your support personnel By toggling the colored marks on the top right you can control which new messages will be shown on the log window Please note that messages already in the log list can only be removed by clicking the Clear button Copyright c 2003 2005 Aker Security2. Secure Roaming Client Here you ll find the necessary instructions to correctly configure and manage your Secure Roaming Clients You shall discover they are much simpler than the Server thereby making end user s experience much simpler 3 1 Servers page Aker Secure Roaming Client Servers O A h New Edit Delete Connect Name IF address Status teste 127 0 0 1 Use data compression y Connecting to service Tokens Pe Apply In this page you ll find a place to inform the client on which servers it shall connect and when to do so Apart from the servers list there are buttons to add edit remove and connect disconnect from the servers By clicking on new or edit you ll be prompted with the following dialog i Edit Server Connection Name Pe IP address Ports ICP NP UDP NP Trigger mode Ce Manual On startup O Sync with dialup Authentication Je 4 509 Certificates Select a certificate to present to the Aker Secure Roaming Client Subject lssuer a Change Username and password Automatic authentication Username Authenticator Save password e Name This name is for your reference only It can be anything which helps identifying the Secure Roaming Server you are connecting to e IP Address The server s IP address as seen from the client This number can be different from the server s real address if it is placed behind a NAT gateway Please note you won t be able to
3. Solutions
4. type anything else but an IP address in this field e Ports The TCP and UDP ports the server is listening on These numbers must match the ones entered when configuring the server or like the IP address the translated port numbers if the server is behind a NAT engine which changes the ports e Keep alive period This period is the maximum period of inactivity in the TCP connection and UDP packet sequence If the default values are too big so that any equipment between the client and the server either drop the connection or change UDP port numbers typical in a IP masquerading device N 1 NAT near to the client please decrease them accordingly Please keep in mind that using a very short number just to be sure is hardly a good idea because you may end up using much of the scarce bandwidth between the client and the server with keep alive packets e Trigger mode This setting defines when the VPN connection should be started and ended There are three choices 1 Manual The connection will be setup and tear down whenever the user chooses to do so If some problem makes the connection stop the user will have to restart it manually 2 On startup The client will try to maintain the connection always active from the time it is started on This method 1s more useful for clients connected to permanently to the network like DSL lines or local area networks 3 Sync with dialup Windows OSes only The connection state will be syn
5. 005 09 54 56 Successtully connected to server 10 0 0 111 WEro 0270372005 09 54 53 Unknown authentication eror at the server 5 Minio 02 03 2005 09 54 52 Successtully connected to server 10 0 0 111 warming 02 03 2005 09 54 45 Server closed connection 127 0 0 1 Here you can examine the system log and set wherever it will be sent to syslog Unix or Event Viewer Windows The syslog facility combo box only in Unix Systems defines which syslog facility the Aker Secure Roaming Server should use 2 7 About page Aker Secure Roaming Server About Aker Secure Roaming Server Version 1 5 Build date Jan 28 2005 Copyright C 2002 2004 Aker security Solutions Product registration License holder User License IP z0 10 5 0 About a Activation key a53421 143443 DSFASD Fsz234 Simultaneous clients DREIE License expiration Invalid key 5 connected to service Apply Exit E In this last page you must set the registration information according to the license you received from Aker Security Solution Please verify the limits maximum number of simultaneous clients and date of expiration are as expected lly 3 If you incorrectly type anything your license will be considered invalid you must type the license holder s name IP address and key exactly as written in your license term Copyright c 2003 2005 Aker Security Solutions 3 0 Configuring and managing the Aker
6. Aker Secure Roaming User s Manual e Introduction e 1 Installation O O O 1 1 System requirements 1 2 Installation 1 3 Removal e 2 Secure Roaming Server O UI I No o o o o o O O O O O e 2 1 Server configuration page 2 2 Client configuration page 2 3 Filtering configuration page 2 4 Active clients page 2 5 Certificate Authority page 2 6 Log page 2 7 About page cure Roaming Client 3 1 Servers page 3 2 Certificates 3 3 Requests page 3 4 Tokens page 3 5 Log page Copyright c 2003 2005 Aker Security Solutions Introduction This is the Aker Secure Roaming user s manual In the following chapters you will learn how to install and configure the product This introduction describes the manual s organization and the conventions used writing it QWhat is the Aker Secure Roaming The Secure Roaming system makes it possible for remote users to connect to a server and establish a secure channel VPN to the home network This VPN is special in that it assigns a home network IP address to the client enabling the user to work exactly the same way he does when his not roaming Two products make up the system e Aker Secure Roaming Server The server runs over Windows 2000 or better Linux with kernel 2 4 series and FreeBSD 4 9 or better It accepts the connections and sets the user s network configuration according to pre defined parameters making the connection setup experience very simple for the en
7. Filtering Q4 bx Mew Edit Delete From client 10 5 33 20 255 255 255 252TCP 21 fp TCP 80 httpi J Block To client 10 0 0 0 255 0 0 0 TCP 137 gt 138 G3 Block Default action for client originated packets Accept Default action for client destinated packets Accept S Connected to service SHI Exit Mi oo In this page you will be able to create filters for the traffic between the client and the home network This can be used both to enforce security measures and to restrict the traffic of useless data so that mission critical information has more of the rather scarce roaming user s connection bandwidth e Rules list In this list you can see the rules currently enforced There are two kinds of rules 1 Rules for client originated traffic which are marked as From Client 2 Rules for client destinated traffic which are marked as To Client The rules can also block or allow the traffic lly 5 The rules are scanned sequentially This means that a more generic rule may eclipse the context of a following more specific one When editing new or old rules the following dialog will be shown Edit filtering rule Matches packets Site lena Networks IP Address Range 1053320 290 290 200 202 20 53 59 10 gt 29 99 9 10 TCP 21 ftp 21 ftp b TCP BO htp 80 http F Action 3 Reject Cancel 2 In this dialog the following controls are available o Matches pa
8. MINS servers l l Domain Jaker com by Routes D Faaes 200 101 19 0 255 255 255 24510 1 1 50 Address pools D Paas 10 1 1 130 995 209 200 202 10 1 1 126 gt 10 1 1 131 S Connected to service Apply Exit E In this page you ll find the settings which are relevant to the clients who connect to the server e Enable broadcast packets to reach clients This options disables the block the server imposes on broadcast packets Broadcast packets may be needed by some protocols like SMB Netbios Microsoft Windows networking On the other hand a badly configured network will have lots of those packets which when allowed to reach the client could simply flood a typical dial up link used by roaming users e Allow clients to use data compression This option allows for the clients to enable bidirectional data compression so that the net bandwidth can be increased specially in very slow connections such as dialup modems e Change default gateway during VPN session This option makes the server alter the clients default gateway setting for the duration of the VPN session Enabling it will make the client s computer behave exactly how it would when connected inside the network but will also redirect every traffic from it to the outside to the default router on your network If you have a few known routes it is best to set those in the list bellow thus letting the Internet destined traffic to flow directly from the cl
9. ation path e Keys stored on external cryptographic tokens The token where the key is stored will be shown on the Key Stored in column e Private key not found The key can be lost damaged or stored in a token which is not currently connected to the system ii SA request with a not found key is not necessarily invalid If it is stored in an external token which has been removed from the system it will be available again blue when the token is inserted and the refresh button is pressed 3 4 Tokens page In this tab you can manage the PKCS 11 dynamic libraries used to access the hardware tokens These libraries are like drivers and are provided by the token manufacturer You can also view which tokens are inserted and recognized by the system Aker Secure Roaming Client Token Librarys pd Add Remove Reload Library Version Manufacture Description eppk11 dll 0210 Feitian Technologies ePas22000 PECS 11 Library Tokens Tokens Inserted Token Name Model ePass 000 ePass 000 ey Connecting to service Tokens HU In the top box the PKCS 11 libraries are displayed In the bottom one the currently detected tokens are displayed The bottom box cannot be directly edited it will change its contents automatically when the Reload button is pressed The available options for managing libraries are Add and Remove i Soniy when the library is loaded and enabled checked the tokens which it is responsible for will be detected
10. ce Tokens HU Apply The available actions are Save Backup Load Backup Details Remove Load Certificate and Refresh e The Save Load Backup buttons save or restore a certificate and its private key using the PKCS 12 format This format is an encrypted package for both the certificate and the corresponding keys To save or restore it a encryption decryption password must be entered If you forget the password used when saving the backup you will not be able to load it e The Details button make a new dialog pop up with additional information about the certificate subject and issuer e The Remove button erases the certificate and its private key If the certificate 1s stored in an external hardware token you will be prompted for the token PIN or password e The Load Certificate button loads a certificate which can be stored both in DER or Base64 formats This certificate is generated by a CA using a previously created request e The Refresh button is only useful if you are using a external hardware token It will search all installed tokens for ready to use certificates During this process an animated bar will be shown on the bottom of the window The bar will stop when the refresh operation is complete According to the certificate and private key location a different icon is displayed left of the certificate subject name e Certificate and private key stored in hard drive The files can be found in the x509 folder inside the
11. chronized with the dial up adapter s This is the preferred method for users which cannot get access to a permanent Internet connection In this method the system will always try to keep the VPN session alive if there is a dial up connection active e Authentication You can choose between two methods to authenticate yourself o X 509 Certificates While operating in this method you need a correctly installed X 509 certificate to present to the Secure Roaming Server To select one of such certificates click on the Change button The following dialog will be shown Please choose a personal certificate to present to the Aker Secure Roaming Server To view details double click over the desired item lssued by Not Before Mot After Stored In J bosscompa Aker Feb 2417 11 10 2 Feb 2177 21 10 2 ePass2000 Jemployee ico Aker Feb 217 12 03 Feb 2172203 2 Hard Disk Cancel The dialog will be filled with a list of possible certificates To choose one of them double click on it or click the Choose button Save token password This option will be enabled only when the selected certificate is stored in a external cryptographic token It makes the Client store your token password in encrypted form so that you do not have to type it upon VPN session establishment o Username and password This is the traditional authentication mechanism the user presents the server a username password pair which is verified If you do not f
12. ckets Here you can set the type of rule to either chent originated packets from client or client destinated packets to client o Networks This list contains the networks where the other IP address destination IP address for client originated rules or source IP address for client destinated rules should be for it to match These can be edited using the same dialog used to edit the access control lists o Services This list contains the services destination port on TCP or UDP packets type of service on ICMP packets or protocol on raw IP packets which should be present on the packet for the rule to match You can edit these using this dialog P Edit service AmE cy Protocol aiima af From port 157 nethios ns To port 136 netbios dqm Protocol this is the type of IP packet you wish the service to specify 1 e the definition of service you are wishing to use from the above ones From port To port The services for which the rule will match are the ones with numbers port type of service or protocol between these two inclusive o Action Defines if the rule will allow or deny the packet to transverse the VPN lly ad The rules are checked both at the client and at the server This ensures both maximum performance no packet enters the VPN to be discarded at the other end and maximum security event a malicious client won t be able to inject disallowed traffic into the network e Default actions Th
13. d user e Aker Secure Roaming Client The client runs over Windows 98 Windows 2000 or better Linux with kernel 2 4 series and FreeBSD 4 9 or better It has a very simple user interface where not much more apart from the server s IP address should be configured It can also be setup to synchronize the VPN establishement and teardown with the Windows dialup adapter status QHow is this manual organized This manual is made of several chapters Each one of them explains how to configure some features of the programs It also explains how to best fine tune the options presented by it Although you may find screeshots from different OSes as yours the graphical user interfaces GUIs look and behave exactly yhe same way in the different OSes the only remarkable change being the window manager style skin We strongly recommend that this manual be read at least once as a whole ii In various places over the manual you ll find the symbol 3 followed by some red text This text presents a very important remark which should be completely understood before continuing Copyright c 2003 2005 Aker Security Solutions 1 0 Aker Secure Roaming Installation In this chapter you ll learn how to install or remove the Aker Secure Roaming products 1 1 System Requirements e Aker Secure Roaming Server 1 Windows 2000 or better 2 Linux kernel 2 4 x 3 FreeBSD 4 7 or better e Aker Secure Roaming Client 1 Windows 2000 or better 2 Wind
14. ese can be understood as a default last rule action which applies to every packet which for the rules didn t match 2 4 Active clients page Aker Secure Roaming Server Active clients IP Address TCP port UDP port Virtual IP Session start 10 0 0 200 3196 O 0 0 0 0 Negotiating session Mon Jan 31 10 2 S Connected to service Here you can see the clients which are connected right now and their properties e Username This field includes the username and authenticator the user used to log in It can also contain some other information pertinent to the other authentication methods e IP address This field shows the address from which the client has connected as seen from the server Beware the client can be behind a IP masquerading device which could effectively hide the real address he 1s using e TCP UDP port This field displays the ports from which the client 1s connecting The above note applies here too 1 e the numbers could be altered by a IP masquerading device e Virtual IP This field shows the IP address which has been assigned to the client from the previously defined pool e Status In this field you will find a text describing the VPN status The important ones are Authenticating which means the client provided authentication data and we are waiting for a positive response from the authenticator and Established which means the client is fully functional e Session start This field shows the date and w
15. from which clients you will accept connections 1 No control Every client is allowed to connect to the server 2 Allow access only from listed networks Only the clients which have IP addresses belonging to the networks in the right list will successfully establish a VPN 3 Deny access from listed networks The clients which have IP Addresses belonging to the networks in the right list will not be able to establish a VPN Everyone else will By editing or creating a new entry in the right network list you ll be taken to the following dialog Edit network aj Network IP address 10 99 99 54 al Network IP mask Address range from 10 99 99 45 to 10 995 99 63 a coo oo edi E In this window you will enter the network IP address and netmask Please note that invalid adresses or netmasks won t be accepted 1 e you won t be able to type them 1n Once you enter valid address and netmask the IP address range will be calculated automaticaly This range includes the first network address and last broadcast address IPs since it does not specify a subnet in the routing meaning but a range of IP addresses 2 2 Client configuration page Aker Secure Roaming Server Client configuration Enable broadcast packets to reach clients Allow clients to use data compression Client settings WM Change default gateway during YPN session 10 1 1 11 Name servers DNS servers 1 1 1 80
16. ght c 2003 2005 Aker Security Solutions 2 0 Configuring and managing the Aker Secure Roaming Server Here you ll find the necessary instructions to correctly configure and manage your Secure Roaming Server 2 1 Server configuration page Aker Secure Roaming Server Server configuration Configuration Maximum simultaneous clients le a TCP Part Detant 1011 21 UDP Port Default 1011 21 Authentication GF Password Authenticator IP Address M X 509 certificates auth 179 10 0 0 179 Ban eno tekens Access Control f Mo control Allow access only 2 from listed networks BI le TI BI ln Deny access from listed networks 5 Connected to service Apply Exit E In this page you ll find the settings which are relevant to the server itself e Maximum simultaneous clients Here you can set the maximum number of clients allowed to simultaneously connected at any given time Use this setting to avoid having your server overflooded by too many clients which could decrease the expected performance Please note this number 1s limited by your license e TCP UDP port This controls allow you to set which ports the server will use to listen for client connections and data respectively For instance you could set the server to use ports TCP 443 and UDP 53 in order to easily bypass firewalls and or other filtering devices between your server and clients which would mistake the VPN connecti
17. hen time the client connected 2 5 Certificate Authority Page Aker Secure Roaming Server Certificate Authority CA AH x Import Certificate Delete Subject Mot Before Mot After URL for CRL i Aker Jul 50 19 51 53 2004 GMT Jul 30 20 00 44 2006 GMT serveraker com brqual S Connected to service Here you can define which CAs you trust This trust relation implies that every valid certificate issued by the CAs will be accepted as valid credentials for VPN establishment purposes To add a CA to the trusted CAs list click on the Import Certificates button find its X 509 certificate and click OK You can also assign a location URL where Secure Roaming Server will periodically download the CA s CRL Certificate Revocation List from Whenever a certificate is no longer to be accepted e g when its corresponding private key has been compromised the CA will publish its serial number on its CRL Secure Roaming Server will not accept certificates which are listed as canceled no mater the reason To define the URL where the CRL is to be found right click on the corresponding CA line and enter on the pop up menu The CRL will be downloaded upon service startup and each 24 hours 2 6 Log page i Aker Secure Roaming Client Log x Priorities M Information T Warning Save Clear W Error W Fatal error Priority Date Time WEro 0240342005 09 54 56 Unknown authentication error at the server 5 Minio 02 03 2
18. ient to it without consuming your link s bandwidth twice e Name servers For the roaming user s computer to behave exactly the same way it does when connected to his home network it needs to resolve network names using the DNS and WINS services Please fill them from left to right noting that the next one will only be available when the previous is filled with a valid IP address you won t be allowed to type something else than As with the default gateway the client s DNS servers will be restored when the VPN session is terminated e Routes When a large intranet is used clients may need routes to other network segments in order to reach them When entering a new route or editing an old one you will be prompted with the following dialog box P Edit route BO 0 x ag Network IP address 200 101 19 0 af Network IP mask 255 cod 29o 246 Gateway 10 1 1 30 In this window you will be able to enter the network address and mask and the gateway to reach it Please note it will not be possible to enter invalid IP adresses or masks in the appropriate fields e Address Pools The IP addresses assigned to the client will be drawn from the address pools bellow in a sequential fashion Please note these pools do not specify a network they specify a range of IP addresses The dialog to edit them is the same one used to edit the access control lists 2 3 Filtering configuration page Aker Secure Roaming Server
19. ill the fields bellow you will be prompted for them upon connection establishment Username your username on the network you are connecting to Domain the authenticator name used in the server If you leave this field blank the server will try every authenticator it knows about Password your password can be save so that you need not to enter any information when the VPN session is established If you check this method please be aware your password will be saved in encrypted form Using this options will enable you to run the client without the graphical user interface just the background daemon service which can be particularly useful for Unix users no willing to start an X session Some of this page s functionality can be accessed by right clicking the system tray icon W Aker Secure Roaming client Y Aker secure Roaming clien is Connect teste Ra Connect teste Close window Exit 3 2 Certificates page This page makes it possible for you to manage the certificates used for authentication The page has the following appearance Aker Secure Roaming Client Certificates a 2 2 E DB Paa Tr ae Certificates Save Backup Load Backup Detale Delete Load Certificate Refresh Subject Issued By Mot Before Not After Stored in GJ bosscompany com Aker Feb 27 71 10 2005 GMT Feb 27 27 10 2006 GMT ePass2000 EJemployee company comAker Feb 2171203 2005 GMT Feb 217 2 03 2006 GMT Hard Disk y Connecting to servi
20. installation path e EJCertificate and private key stored in an external hardware token The token name will be shown on the Stored in column 3 3 Requesis page This page allows you to create and manage the certificate requests Aker Secure Roaming Client Request O0 Hd bk dq New Request Saveacopy Delete Load Certificate Subject Rey Size Key stored in PS boss company cam 1024 ePass000 B4 employee company com 1024 Hard Disk BF unknown company com 1024 Mot Found Ey Connecting to service Tokens Tl The avaiable options are New Request Save a copy Delete and Load Certificate e New Request Prompts the user for the data necessary to generate a new certificate request and the corresponding key pair e Save a copy Exports the request using a standard format used by CAs The file saved here can be taken to a CA 1n order to obtain a certificate e Remove Deletes the saved request and key pair from wherever it is installed If the store location is a external hardware token the user will be prompted for the token password e Load Certificate loads a certificate which can be stored both in DER or Base64 formats This certificate 1s generated by a CA using a previously created request The dialog box used to prompt the user for certificate request information is the following it New Request Please enter your data to create a request After the request creation the request file will be save in Hard Disk and
21. on by a encrypted HTTP request and a DNS request respectively The default port 1s 1011 for both TCP and UDP ports Authentication Here you can select which authentication methods the current version supports username password authenticators and X 509 Certificates you will allow your clients to use In the right list you can add edit or remove the authenticators you will use An authenticator is a computer which runs the Aker Authentication Agent in order to export its directory in a fully encrypted way When adding or editing a new authenticator the following window will appear P Edit Authenticator ee 7 oi x Name Jauth 1 fq 9 First IP address ai 0 0 175 Backup IP Address j is sw Password oe In this dialog you can set the name the primary IP address the backup ones and the password for your authenticator Please remember the password should be the same one you set in the Aker Authentication Agent For more information regarding the Authentication Agent please refer to the Aker Firewall User s Manual which can be found on the Aker WebSite In order for the X 509 authentication to work at leaset one CA Certificate Authority must be installed explained bellow The clients who present a certificate signed by a trusted CA and prove a corresponding private key ownership will be allowed access These steps are performed automatically by the Secure Roaming Client Access Control Here you can configure
22. ows 98 3 Linux kernel 2 4 x with KDE or Gnome 4 FreeBSD 4 7 or better with KDE or Gnome The minimum hardware requirements vary greatly according to the number of simultaneous clients and its link speed The absolute minimums are the same needed by the above OSes The Client consumes no more than 5MB of physical memory and is able to perform in speeds at least 100Kb s without imposing a significant CPU usage on a 500MHz Pentium 2 class CPU The Server consumes aproximately 50 kB of memory per connected client on top of a base 3MB It will consume CPU accordingly to the aggregate instantaneous connection speed As a rule of thumb you should allow 30MHz of CPU frequency for each Mbit s aggregate neto uncompressed connection speed Please note that all computer peripherals must be explicitly supported by the OS 1 2 Installing the products The installation should be quite straightforward Please follow the steps bellow Windows installations Once you have the AkerSecureRoaming client win 1 5 en exe file please do 1 Click on the Start button to raise the Start Menu 2 Choose the Run program item 3 Browse to the AkersSecureRoaming client win 1 5 en exe file and click ok 4 Follow the simple on screen instructions OLinux installations On Linux the Secure Roaming products come as RPM packages These can be installed by issuing the following command on a shell window rpm ivh spackage file name5 Alternaltivelly you can u
23. se a graphical package manager of your choice QFreeBSD installations On FreeBSD the Secure Roaming products come as standard packages These can be installed by issuing the following command on a shell window pkg add spackage file name Alternaltivelly you can use a graphical package manager of your choice Ally 9 Note for Linux and FreeBSD users The graphical user interface uses the QT 3 library It should be installed automatically when KDE is installed If it is not or your version is incompatible please browse to the download section of the Aker website and fetch the required library 1 3 Removing the products QWindows installations Open the Control Panel Click on Add Remove Programs Chose the Aker Secure Roaming product you wish to remove Click on the Remove button Follow the on screen instructions A a NS Linux installations To remove the Secure Roaming products from you host you can either use a graphical package manager or issue the following command on a shell prompt rpm e lt package_name gt If the package name is unknown use the following command to find it out rpm qa grep Aker FreeBSD installations To remove the Secure Roaming products from you host you can either use a graphical package manager or issue the following command on a shell prompt pkg_delete lt package_name gt If the package name is unknown use the following command to find it out pkg info grep Aker Copyri
24. the key will be save in the chosen device Hard Disk or Cryptogratic Token With this request the CA Certificate Authority can generate the certificate Request Tupe O PawontEmaleddess O Ol O SeverDoma OOO O Country Name letter code eet State or Province Name full name OE Organization Name eg company PA rrr kep specifications Hard Disk w 1024 we Hard Disk ep pk11 dll ePass2000 e Request type Defines if the certificate requested is for someone or a server The only difference is on the fields used for identification e Country two letter country code e g BR for Brazil e State or Province the province or state full name e Locality name the city or district full name e Organization name Company full name e g Aker Security Solutions e Organizational Unit Name Department or section full name e Key specifications The user can choose where to store the private key hard es or a external cryptographic token and the key size in bits Hy 9 The key generation process can be very time consuming depending on key size and key storage media During this operation the window will be disabled grayed out until it is complete Please wait for the window to close before using the client again According to the key storage media one of the following icons will be shown next to each request e Keys stored on the hard disk The private key is saved inside the x509 folder on the install
Download Pdf Manuals
Related Search