[lkml]   [1996]   [Aug]   [8]   [last100]   RSS Feed
Messages in this thread
SubjectRe: IP security
Linus Torvalds <> writes:

> I'd just like people to look into ssh before getting all that excited about
> secure IP. Quite frankly, doing cryptography in the IP layer sucks raw eggs,
> and anybody who thinks it's a good idea has probably not really thought it
> through.
> change the keys etc. That means that the user is at the mercy of the
> maintainer, who may be overworked, uncaring about the users needs, or simply
> stupid. You can't really protect against a actively _evil_ root, but ipsec
> doesn't even protect against a _uncaring_ root..
> be installed easily on the system with minimal need for maintenance, so you
> don't need to worry overmuch about maintaining it. It ports to just about any
> you see fit.
> Note: if somebody thinks ipsec is useful and implements it cleanly for Linux,
> don't think ipsec is _evil_, I just don't think it's the right way to do
> security on the internet.
> Linus

According to my local security guru, ipsec doesn't particularly care where
the certificates come from, and it's perfectly happy to use keys which are
stored in the user's home directory and which root doesn't need to know
anything about. Also, ipsec provides for IP authentication, which is quite
handy for preventing things like my laptop pretending to have a trusted
machine's IP address and NFS mounting all sorts of things. Ssh can't even
try to prevent that. With a secure IP layer, you greatly shore up the
security of logins, ftp, talk, NFS, whatever. While with ssh, you get a nicely
secure login, X, a secure authentication for ftp (but no encryption on
transferred files I believe), and nothing for talk, nfs, dns, etc.

Also, if you have an uncaring root, I wouldn't rely too much on ssh to
provide any security either. One setuid script and poof, people are snooping
your tty.

If you have an moderately uncaring root, then ssh can be quite handy.
But, in the flip situation, where root cares about security, but the users
don't, it's not so easy to craft a comprehensive security policy only
using ssh.

I think that secure ip, and secure sockets complement each other, but they
can't easily be substituted for each other.

 \ /
©2003-2011 Jasper Spaans