Re: [Freeipa-users] Give laptops bidirectional anywhere access to freeipa and /home/

2010-05-26 Thread Simo Sorce
On Wed, 26 May 2010 03:40:33 -0500 Rob Townley wrote: > Tinc does not have a common shared secret between peers but that would > probably be an improvement to make it more like the hamachi vpn. If > both nodes do not have each other's public key host file, they should > not be able to communicat

Re: [Freeipa-users] Give laptops bidirectional anywhere access to freeipa and /home/

2010-05-13 Thread Dmitri Pal
Rob Townley wrote: > On Wed, May 12, 2010 at 4:38 PM, Dmitri Pal wrote: > >> Rob Townley wrote: >> >>> The main difference between tinc vpns and traditional vpns is that >>> tinc is bidirectional and does not require the user to enter a >>> username password. So if the computer is turned

Re: [Freeipa-users] Give laptops bidirectional anywhere access to freeipa and /home/

2010-05-13 Thread Rob Townley
On Wed, May 12, 2010 at 2:04 PM, Simo Sorce wrote: > On Wed, 12 May 2010 12:24:00 -0500 > Rob Townley wrote: > >> The main difference between tinc vpns and traditional vpns is that >> tinc is bidirectional and does not require the user to enter a >> username password.  So if the computer is turne

Re: [Freeipa-users] Give laptops bidirectional anywhere access to freeipa and /home/

2010-05-13 Thread Rob Townley
On Wed, May 12, 2010 at 4:38 PM, Dmitri Pal wrote: > Rob Townley wrote: >> The main difference between tinc vpns and traditional vpns is that >> tinc is bidirectional and does not require the user to enter a >> username password.  So if the computer is turned on, the remote >> machine is reachable

Re: [Freeipa-users] Give laptops bidirectional anywhere access to freeipa and /home/

2010-05-12 Thread Dmitri Pal
Rob Townley wrote: > The main difference between tinc vpns and traditional vpns is that > tinc is bidirectional and does not require the user to enter a > username password. So if the computer is turned on, the remote > machine is reachable by the IT department. If it is a windows > machine, you

Re: [Freeipa-users] Give laptops bidirectional anywhere access to freeipa and /home/

2010-05-12 Thread Simo Sorce
On Wed, 12 May 2010 12:24:00 -0500 Rob Townley wrote: > The main difference between tinc vpns and traditional vpns is that > tinc is bidirectional and does not require the user to enter a > username password. So if the computer is turned on, the remote > machine is reachable by the IT department

Re: [Freeipa-users] Give laptops bidirectional anywhere access to freeipa and /home/

2010-05-12 Thread Rob Townley
The main difference between tinc vpns and traditional vpns is that tinc is bidirectional and does not require the user to enter a username password. So if the computer is turned on, the remote machine is reachable by the IT department. If it is a windows machine, you may want to verify antivirus

Re: [Freeipa-users] Give laptops bidirectional anywhere access to freeipa and /home/

2010-05-12 Thread Christian Horn
On Wed, May 12, 2010 at 12:24:00PM -0500, Rob Townley wrote: > > Yes, it is a machine level as opposed to user level vpn. tinc would > have to run all machines to make it the easiest to use. With freeipa, > that could be easy. > > The keys currently are RSA public / private keypairs. > > Does

Re: [Freeipa-users] Give laptops bidirectional anywhere access to freeipa and /home/

2010-05-12 Thread Rob Crittenden
Rob Townley wrote: Microsoft is touting "Direct Access" as a main reason to upgrade to Win2008R2 / Win7. Microsoft makes it seem like a magical feature, but could be done using existing technology. The reality is that discontinuous offline access to ActiveDirectory was not thought out well in the

Re: [Freeipa-users] Give laptops bidirectional anywhere access to freeipa and /home/

2010-05-11 Thread Christian Horn
On Tue, May 11, 2010 at 04:42:26PM -0500, Rob Townley wrote: > Microsoft is touting "Direct Access" as a main reason to upgrade to > Win2008R2 / Win7. All i see there functionalitywise can be provided by a vpn-endpoint using kerberos/ldap for authentication/authorization. As a feature i read 'us

[Freeipa-users] Give laptops bidirectional anywhere access to freeipa and /home/

2010-05-11 Thread Rob Townley
Microsoft is touting "Direct Access" as a main reason to upgrade to Win2008R2 / Win7. Microsoft makes it seem like a magical feature, but could be done using existing technology. The reality is that discontinuous offline access to ActiveDirectory was not thought out well in the first place. Now tha

[Freeipa-users] Give laptops bidirectional anywhere access to freeipa and /home/

2010-05-11 Thread Rob Townley
Microsoft is touting "Direct Access" as a main reason to upgrade to Win2008R2 / Win7. Microsoft makes it seem like a magical feature, but could be done using existing technology. The reality is that discontinuous offline access to ActiveDirectory was not thought out well in the first place. Now tha