More about keys

[tinc] / doc / HOWTO

diff --git a/doc/HOWTO b/doc/HOWTO
index f6511bf..2e0a55f 100644 (file)
--- a/doc/HOWTO
+++ b/doc/HOWTO
@@ -19,6 +19,10 @@ have the router forward all packets. This way you can---instead of
 connecting hosts---connect entire sites together! Now you need only one
 outgoing network connection for both internet and intranet.
 \f
+Architecture
+------------
+FIXME
+\f
 Getting Tinc
 ------------
 Before you fetch the latest tarball, you might want to check if there's a
@@ -52,8 +56,8 @@ The kernel
 ----------
 FIXME
 \f
-Configuring
------------
+Picking your numbers
+--------------------
 The first thing we should do is pick network numbers. Tinc has a very
 peculiar taste for network numbers, which is caused by the way it routes
 traffic. However, it turns out to be really handy if you want to use
@@ -65,6 +69,10 @@ range. This is standard CIDR notation for all IP addresses from 192.168.0.0
 to 192.168.255.255. The /16 means that the first 16 bits form the network
 part.
 
+It is common practice for Tinc networks to use private (RFC 1918) addresses.
+This is not necessary, but it would be a waste to use official addresses
+for a private network!
+
 In the example we will connect three machines: f00f, fdiv and hlt. We will
 give each an address, but not just that, also a slice of our address space
 to play with.
@@ -80,6 +88,46 @@ It is very important that none of the Tinc netmasks overlap! Note how the
 We will refer to the 192.168.0/16 network as the `umbrella' from now on.
 As you can see we can fit 256 hosts into this umbrella this way, which is
 also the practical maximum for tinc.
-
+\f
+The configuration file
+----------------------
 Let's create a configuration file for f00f. We have to put it in /etc/tinc,
 unless you participate in multiple umbrella's (more on that later).
+
+       MyOwnVPNIP = 192.168.1.1/24
+       VpnMask    = 255.255.0.0
+       ConnectTo  = 126.202.37.81
+       ConnectTo  = 103.22.1.218
+
+The first two lines tell Tinc about the numbers we have chosen above.
+Using the ConnectTo lines, the daemon will seek contact with the rest of
+the umbrella. It's possible to configure any number of ConnectTo lines,
+you can even omit them so that it just sits and waits until someone else
+contacts it. Until someone does, the poor daemon won't be able to send
+any data because it doesn't know where everybody is.
+\f
+The passphrases
+---------------
+We will have to generate keys for ourselves, and get a key from everybody
+we want to ConnectTo. All of these go into a directory named
+/etc/tinc/passphrases. PROTECT THIS DIRECTORY!
+
+       mkdir -m 700 /etc/tinc/passphrases
+
+To generate our own key:
+
+       genauth 1024 >/etc/tinc/passphrases/local
+
+You should then proceed to give this key to anyone who wants to ConnectTo
+you. DO THIS IN A SECURE MANNER! Anyone who has this number can do icky
+things to the umbrella network! Encrypt it using PGP, GPG or another
+program using asymetric keys. Read it over the phone (without anyone
+listening of course). Send it by snailmail. Write the key down and bring
+it to your partners yourself!
+
+If you get any keys from your partners, store them under their network
+number. For example, the key we get from fdiv's network administrator
+will be stored in /etc/tinc/passphrases/192.168.2.0 (note the 0).
+
+--
+$Id: HOWTO,v 1.4 2000/06/30 21:09:32 wsl Exp $