Installing tcpcrypt
git clone git://github.com/scslab/tcpcrypt.git
cd tcpcrypt
./bootstrap.sh
./configure
make
sudo ./launch_tcpcryptd.sh
The launch script starts tcpcryptd and adds firewall rules to divert all TCP traffic on port 80 to tcpcryptd. When the script exits (on Ctrl-C or kill), it restores your firewall config to its former state -- no permanent changes are made.
On Linux, you must first install libnfnetlink, libnetfilter_queue, and libcap.
Optional: running make install will install libtcpcrypt and tcpcrypt headers, for building apps that use tcpcrypt's session ID.
Try it out
Go to http://tcpcrypt.org/test.php with tcpcryptd running. If tcpcrypt is working, you'll be able to join the tcpcrypt Hall of Fame and your tcpcrypt session ID will be displayed at the bottom of the page.
Now let's examine the packets going over the wire by starting tcpdump and then reloading the URL above.
sudo tcpdump -X -s0 host tcpcrypt.org
Compare this tcpdump output, which appears encrypted (or at least unreadable), with the cleartext packets you would see without tcpcryptd running.
Troubleshooting
If it's not working, the most likely causes are the following.
Your browser already had an open, non-tcpcrypted TCP connection to tcpcrypt.org before you ran the launch script. Quit and reopen your browser, wait 30 seconds, or use a different browser to retrieve the tcpcrypt.org URL.
There's a conflict with your existing firewall rules. See the firewall setup section in the install guide for your platform.
Visit http://wiki.github.com/scslab/tcpcrypt/troubleshooting if you're still unable to make it work.
More info
The INSTALL-* files have more detailed installation and firewall setup instructions. See tcpcrypt.org for general info, including the protocol specification and the tcpcrypt paper, "The case for ubiquitous transport-level encryption", presented at USENIX Security 2010.
The code repository lives at http://github.com/scslab/tcpcrypt.
from https://github.com/scslab/tcpcrypt，这一版本没问题。
（原版https://github.com/sorbo/tcpcrypt有问题。）
-----
We might be already using SSL, HTTPS, VPN in our network. Those solutions are inadequate for ubiquitous encryption. For example, almost all solutions rely on a PKI to stop man-in-the-middle attacks, which for ubiquitous deployment would mean that all Internet users would have to get verified by a CA like Verisign and have to spend money to buy a certificate. Tcpcrypt abstracts away authentication, allowing any mechanism to be used, whether PKI, passwords, or something else.
Tcpcrypt has very high performance (up to 25x faster than SSL), making it feasible for high volume servers to enable encryption on all connections.
No comments:
Post a Comment