The general idea of IPsec(as i understand it) was to provide end-to-end encryption on the transport layer. this was back in the days when the application layer didn't have encryption on its own(http, telnet, ftp). As such there is a way to use IPsec as a transport layer for VPNs by tunneling all traffic that is not the IPsec encrypted through the IPsec connection. This is used by services like l2tp/ipsec or Cisco and is widely used. Ultimately the primary purpose of IPsec is obsolete as (almost)all application layer services that are capable of passing authentication tokens also have an encryption layer either on a dedicated SSL port or implemented natively(StartTLS). If you want to implement a VPN service then there are better(IMHO) and easier to administer alternatives. I recommend OpenVPN but SSH can work in a pinch. Using both application layer encryption AND transport layer encryption is (generally speaking) redundant. On Fri, Jun 13, 2014 at 4:19 PM, Chris Frederick <cdf123 at cdf123.net> wrote: > On 06/13/14 13:21, Brian Wood wrote: >> >> I've been thinking about IPsec recently after not >> making much progress with it previously. I'm >> wondering how it would work with my current >> configuration. Currently I run both nginx and >> my code generation service on the same machine. >> I also use ssh to login remotely. If you have IPsec >> running on a server, do you still use ssh to login to >> that machine? > > > I typically don't use ssh over ipsec. ssh has pretty good security features > already. I mostly use it to secure ldap, and database connections. > > It's also good for tunneling through services on an internal network from a > dmz. The firewall just needs to allow ipsec through, and then the host > firewall on the internal server can handle the port, and ipsec authenticates > the two servers. So you can't just bring up a new device and get the same > access because the device isn't authenticated to the internal server. > > >> I found this info >> >> http://link.springer.com/chapter/10.1007/11542322_29 >> >> It looks like the authors found some problems with IPsec. > > > I haven't read that yet, but the first page preview thing seems like it's > confusing SSH with SSL. May be a type-o. The way it's referring to SSH > doesn't sound right, where SSL would make more sense in it's place. > _______________________________________________ > TCLUG Mailing List - Minneapolis/St. Paul, Minnesota > tclug-list at mn-linux.org > http://mailman.mn-linux.org/mailman/listinfo/tclug-list