4 ms·

Streisand is a good idea, but I don't believe users want 500 services running on their VPN gateway. Most of these protocols require a specific client, like Open

Streisand is a good idea, but I don't believe users want 500 services running on their VPN gateway. Most of these protocols require a specific client, like OpenVPN. This is a 'kitchen sink' collection. TrailOfBits released their ansible scripts for StrongS/WAN, which has sensible secure defaults (IPSec using AES-GCM only). They are calling the project algo. https://github.com/trailofbits/algo https://github.com/trailofbits/algo

bitexploder 10y ago
It is pretty easy to turn off any roles you don't want on Streisand. If you know for sure you will be using IPSEC I agree with you, use the ToB setup. Specifically, compare their IKE setups: https://github.com/jlund/streisand/blob/master/playbooks/roles/l2tp-ipsec/templates/ipsec.conf.j2#L26 https://github.com/jlund/streisand/blob/master/playbooks/rol... https://github.com/trailofbits/algo/blob/master/roles/vpn/templates/ipsec.conf.j2#L13 https://github.com/trailofbits/algo/blob/master/roles/vpn/te... Algo's is much more conservative. Streisand lets 3des and SHA1 into the mix. If you allow it, users will end up using it. Otherwise, I think you are spot on and I prefer Algo (having used both for various things and just playing around).
codezero 10y ago
For anyone about to try out algo – I assume it's great if you are using AWS or DigitalOcean, but if you're self hosting, or have an unsupported VPS, I've had nothing but trouble getting it up and running. I am most certainly to blame, but just a heads up.
- KingMob 10y ago
  Not to toot my own horn, but here's a blog post I just wrote on some issues I ran into setting up Algo on a pre-existing Vultr server. It might help. http://modulolotus.net/posts/2016-03-28-setting-up-algo/ http://modulolotus.net/posts/2016-03-28-setting-up-algo/
  - codezero 10y ago
    Excellent I'm embarrassed that I didn't ask if anyone had done this and wrote up their results. From what I was experiencing, I bet it was either the root privileges, or the SSH connection errors. Thanks a ton.

bitexploder 10y ago

It is pretty easy to turn off any roles you don't want on Streisand. If you know for sure you will be using IPSEC I agree with you, use the ToB setup. Specifically, compare their IKE setups: https://github.com/jlund/streisand/blob/master/playbooks/roles/l2tp-ipsec/templates/ipsec.conf.j2#L26 https://github.com/jlund/streisand/blob/master/playbooks/rol... https://github.com/trailofbits/algo/blob/master/roles/vpn/templates/ipsec.conf.j2#L13 https://github.com/trailofbits/algo/blob/master/roles/vpn/te... Algo's is much more conservative. Streisand lets 3des and SHA1 into the mix. If you allow it, users will end up using it. Otherwise, I think you are spot on and I prefer Algo (having used both for various things and just playing around).

codezero 10y ago

For anyone about to try out algo – I assume it's great if you are using AWS or DigitalOcean, but if you're self hosting, or have an unsupported VPS, I've had nothing but trouble getting it up and running. I am most certainly to blame, but just a heads up.

KingMob 10y ago
Not to toot my own horn, but here's a blog post I just wrote on some issues I ran into setting up Algo on a pre-existing Vultr server. It might help. http://modulolotus.net/posts/2016-03-28-setting-up-algo/ http://modulolotus.net/posts/2016-03-28-setting-up-algo/
- codezero 10y ago
  Excellent I'm embarrassed that I didn't ask if anyone had done this and wrote up their results. From what I was experiencing, I bet it was either the root privileges, or the SSH connection errors. Thanks a ton.