ti, 2006-03-07 kello 10:44 +0100, Peter Bosman kirjoitti: > The Ubuntu team has done a lot of work securing LTSP by tunnelling it > through SSL. As I have been messing around with IPSEC a lot lately, the > thought just crossed my mind to use ipsec to encrypt all LTSP traffic. I > don't know yet what CPU impact this might have (keeping in mind that the > hardware requirements for the thin clients must be kept low). > Anybody any thoughts on this?
Hello, I have been working on LTSP IPsec for a while and we actually have a working setup using Openswan to encrypt all X+esd+LDA traffic in LTSP. The NFS part cannot, of course, be encrypted if you still want to boot from network. (Putting Openswan on initrd might be also possible, though.) There are some security issues that need to be taken care of, but this setup certainly makes it harder at least for casual eavesdroppers to sniff the traffic. The CPU impact is substantial if you use old hardware, but new VIA CPUs have VIA PadLock encryption module embedded in them, which makes IPsec extremely fast with the appropriate kernel modules. With a 800 MHz VIA Eden CPU one cannot tell the difference between IPsec encrypted connection and an unencrypted connection. In our tests it sometimes seemed like those beasts seem to be able to encrypt faster than my brand new Pentium M laptop.. I have been working on putting a package together containing the necessary files to get this working, but I haven't had the time to finish that yet. Veli-Matti Lintu ------------------------------------------------------- This SF.Net email is sponsored by xPML, a groundbreaking scripting language that extends applications into web and mobile media. Attend the live webcast and join the prime developer group breaking into this new coding territory! http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642 _____________________________________________________________________ Ltsp-discuss mailing list. To un-subscribe, or change prefs, goto: https://lists.sourceforge.net/lists/listinfo/ltsp-discuss For additional LTSP help, try #ltsp channel on irc.freenode.net
