skiphost(1M)

NAME
skiphost - Add or remove hosts or networks from the SKIP access control list; enable and disable SKIP.

SYNOPSIS
/usr/sbin/skiphost [ -i interface ]
[ -h ]
[ hostname|IP address ]
[ -o on|off ]
[ -P|-V ]
[ -f ]
[ -d hostname|address|'*' -M mask...
-r receiver NSID -R receiver key ID...
-v SKIP version ]
[ -x hostname|address|'*' -M mask
-k key algorithm -t crypt algorithm...
-m mac algorithm -c compression algorithm...
-r receiver NSID -R receiver key ID...
-s sender NSID -S sender key ID...
-v SKIP version -A tunnel address -T ]
[ -a hostname|address|'*' -M mask...
-k key algorithm -t crypt algorithm...
-m mac algorithm -c compression algorithm...
-r receiver NSID -R receiver key ID...
-s sender NSID -S sender key ID...
-v SKIP version -A tunnel address -T ]

DESCRIPTION
skiphost can be used to list, add or delete host, network or nomadic (mobile) system information from SKIP's access control list. skiphost can be also used to enable or disable SKIP. Without arguments, skiphost will list the SKIP interface state and all authorized and un-authorized hosts, networks or nomadic systems. To configure a network interface for SKIP use the skipif(1M) command. Access Control List Processing The access control list allows the user to configure which remote systems can access the local host and the type of access granted. Access control is usually based on the IP address of the remote host or by the remote system's key id. Remote systems may be specified either as individual hosts, networks or nomadic (mobile systems): hosts - by their hostname or IP address (e.g. "otis", 192.9.200.3) network or subnetworks - by a network address plus a mask similar to that used in subnetting. The mask is specified using the -M option. The unmasked portion of the address must consist of all zeros. For example, 192.9.200.0 -M 255.255.255.0. nomadic systems (SKIP only) - by a key identifier (i.e. any IP address with key id "x") The order of processing of ACL entries is as follows. A search is made for an ACL entry specifying the remote host. If one exists it will be used. If not, a search is then made for a network entry which corresponds to the remote host. If more than one entry applies, the best match (i.e. the entry which matches best the remote) will be used. If no entry containing the IP address can be found then a search is made for a nomadic ACL entry containing the sender key identifier present in the SKIP protocol header. If one is found and the packet is correctly authenticated then the sender's IP address is stored for future reference. If no corresponding ACL entry can be found for a remote system a special entry, the default, is used. The default may be configured to allow access or deny access. This mechanism is somewhat similar to the mechanism used by IP when deciding how to route a packet to the destination (i.e. host routes take precedence over network routes, in the absence of anything better the default route is used). When applying access control, the system treats the lists of authorized and excluded systems as one global list and always selects the best match. Default Entry

The catch-all entry "default" may be specified to indicate all other hosts not specifically covered by other access control entries.

OPTIONS

-h  This option is used to display the SKIP statistics for a given network interface.

hostname|address
    skiphost used without any options, checks if the system hostname or network exists in the access control list, and displays its parameters.

-a hostname|address -M mask
    If used without additional options, it will add hostname or network to the access control list, and enable traffic between the hosts in the clear. To add hostname or network and enable encrypted and/or authenticated traffic to the host, use the -k, -m and/or -t options.

-a '*'
    This option is used to specify a nomadic system. It must be used in conjunction with the authentication and receiver key ID options. To encrypt and/or authenticate communications with a remote system the following options should be used: used:

    -k key algorithm
        Specifies the key encryption algorithm for encrypting keys. A list of supported algorithms is available using the skipstat(1M) command.

    -t crypt algorithm
        Specifies the traffic encryption algorithm for encrypting traffic (bulk data).

    -m mac algorithm
        Specifies the authentication algorithm.

    -c comp algorithm
        Specifies the compression algorithm. Not currently implemented.

    -r receiver NSID
        -s sender NSID
        The Key Name Space Identifier (NSID) options (-r and -s) are used to control the identification of keying information in the SKIP protocol. They take numeric values from 0 to 11. The remote key id option (-R) and local key id option (-S) take a hexadecimal value of different lengths, depending on the name space being used. The default NSID values (0, "Not Present") are normally acceptable for most applications. Currently only name spaces 0 ("Not Present"), 1 ("IPv4 address") and 8 ("MD5 DH public values") are supported.

    -v SKIP version
        SKIP can use an old version of the protocol to communicate with SunScreen(tm) SPF-100 and SunScreen SPF-100G systems. To use this mode, specify the -v 1 option. If no version is specified, skiphost will use SKIP version 2 by default.

    -A tunnel address
        This option is used in tunneling mode to replace the destination address in outgoing packets with the supplied value. This permits hiding of network topology. By default, the tunnel address is set to the destination address.

    -T  Encrypt or authenticate only the data part of the IP packet. By default, SKIP uses tunneling mode and protects the whole packet.

-i interface
    The -i option is used with the -o option to enable or disable SKIP for a particular interface. If this option is not specified skiphost operates on the system's primary network interface.

-d hostname|address|* -M mask
    Removes hostname, network or nomadic system from the access control list.

-x hostname|address|'*' -M mask
    Excludes hostname, network or nomadic system from the access control list.

-o on|off
    This option enables and disables SKIP. To enable SKIP, use -o on, to disable SKIP use -o off.

-P  Adding this option to skiphost prints the current access control list in a format which is suitable for execution in a shell script.

-V  Adding this option to skiphost prints the current access control list in a name=value verbose format.

-f  This option is used to remove (flush) all ACL entries from a given network interface. This option will automatically disable SKIP.

USAGE

You must be root to run this command.

In order to set up SKIP, the skiphost command must be executed multiple times, one time for each host being set up in the access control list, then one final time to enable SKIP.

EXAMPLES

To add host 'bar' to the access control list and allow communication to it in the clear, the following command is used:

    # skiphost -a bar

To define the behavior of SKIP if no matching enty is found into the access control list, the 'default' hostname can be used. The following command is used allow communication in clear:

    # skiphost -a default

To allow communication in clear with every host from network '192.9.200', the following command is used:

    # skiphost -a 192.9.200.0 -M 255.255.255.0

The following command adds host 'foo' to the access control list, and specifies DES CBC encryption for both the keys and traffic.

    # skiphost -a foo -k des-cbc -t des-cbc

In this version of the command, the host is specified as an IP address instead of a name, the keys are encrypted using DES CBC and the traffic is encrypted using Triple-DES, and the receiver master key ID is set to the IPv4 address.

    # skiphost -a 192.9.200.1 -k des-cbc -t des-ede-k3 -r 1

This example shows the use of the -v option. Version 1 is used in Sun Microsystem's SunScreen SPF-100 and SunScreen SPF-100G products.

    # skiphost -a foo -k des-cbc -t des-cbc -v1

To add a nomadic system equipped with key id 0xc202c606 which uses DES to encrypt both traffic and keys, MD5 to authenticate packets:

    # skiphost -a "*" -v 2 -k DES-CBC -t DES-CBC -m MD5 -r 1 -R 0xc202c606

To communicate with the host "hostreal" using DES to encrypt both traffic and keys, MD5 to authenticate packets and specifying a tunnel address, the following command should be used:

    # skiphost -a hostreal -v 2 -A hostgate -k DES-CBC -t DES-CBC -m MD5

To prevent communication with every host from network '192.9.200', the following command is used:

    # skiphost -x 192.9.200.0 -M 255.255.255.0

To remove the network '192.9.200.*', from the access control list, the following command is used:

    # skiphost -d 192.9.200.0 -M 255.255.255.0

This example shows how to enable SKIP only for the hme0 interface.

    # skiphost -o on -i hme0

This last example shows how to display SKIP statistics for the default betwork interface.

    # skiphost -h SKIP interface (hme0) statistics:
        skip_if_ipkts: # of packets received
        skip_if_opkts: # of packets sent
        skip_if_encrypts: # of packets encrypted
        skip_if_decrypts: # of packets decrypted
        skip_if_drops: # of packets dropped
        skip_if_notv4: # of non-IPV4 packets
        skip_if_bypasses: # of certificate packets
        skip_if_raw_in: # of raw packets received
        skip_if_raw_out: # of raw packets sent

NOTES
Before enabling SKIP, any hosts needed for correct operation of the local system must be present in the access control list. Be sure to include any NFS file servers or name servers (use ypwhich(1) in NIS environments). You may also need to include your network's local broadcast address. The graphical user interface skiptool(1M) provides an easy mechanism for determining such systems.

SEE ALSO
skipif(1M), skipstat(1M), skiptool(1M), skipif(1M), ypwhich(1), mount(1M), modunload(1)

FILES

/etc/skip/acl.<interface>