Archives
/
algo
mirror of https://github.com/trailofbits/algo
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

Move FAQ to its own doc.

Browse Source
pull/235/head
Dan Guido 7 years ago
parent d9b13cbd45
commit a94c427596
4 changed files with 52 additions and 26 deletions
Show Stats Download Patch File Download Diff File

2
CONTRIBUTING.md
Unescape Escape View File

@ -1,6 +1,6 @@
### Filing New Issues
* Check that your issue is not already described in the [FAQ](https://github.com/trailofbits/algo#faq) or [troubleshooting](docs/TROUBLESHOOTING.md) docs
* Check that your issue is not already described in the [FAQ](docs/FAQ.md) or [troubleshooting](docs/TROUBLESHOOTING.md) docs
* Did you remember to install the dependencies for your operating system prior to installing Algo?
* Client supported is limited to only modern operating systems, e.g. macOS 10.11+, iOS 9+, Windows 8+, Ubuntu 16.04+, etc.
* If you need to file an issue, fill out any relevant fields in the Issue Template

39
README.md
Unescape Escape View File

@ -99,36 +99,25 @@ Algo's own scripts can easily add and remove users from the VPN server.
The Algo VPN server now contains only the users listed in the `config.cfg` file.
## FAQ
## Documentation
### Has Algo been audited?
* The [FAQ](docs/FAQ.md) includes answers to common questions.
* The [Troubleshooting](docs/TROUBLESHOOTING.md) doc includes answers to common technical issues.
* The [Roles](docs/ROLES.md) doc includes a description of optional Algo VPN server features.
* The [Advanced Usage](docs/ADVANCED.md) doc describes how to run Algo VPN directly from Ansible.
No. This project is under [active development](https://github.com/trailofbits/algo/projects/1). We're happy to [accept and fix issues](https://github.com/trailofbits/algo/issues) as they are identified. Use Algo at your own risk. If you find a security issue of any severity, please [contact us on Slack](https://empireslacking.herokuapp.com).
## Endorsements
### Why aren't you using Tor?
> I've been ranting about the sorry state of VPN svcs for so long, probably about
> time to give a proper talk on the subject. TL;DR: use Algo.
The goal of this project is not to provide anonymity, but to ensure confidentiality of network traffic while traveling. Tor introduces new risks that are unsuitable for Algo's intended users. Namely, with Algo, users are in control over the gateway routing their traffic. With Tor, users are at the mercy of [actively](https://www.securityweek2016.tu-darmstadt.de/fileadmin/user_upload/Group_securityweek2016/pets2016/10_honions-sanatinia.pdf) [malicious](https://chloe.re/2015/06/20/a-month-with-badonions/) [exit](https://community.fireeye.com/people/archit.mehta/blog/2014/11/18/onionduke-apt-malware-distributed-via-malicious-tor-exit-node) [nodes](https://www.wired.com/2010/06/wikileaks-documents/).
-- [Kenn White](https://twitter.com/kennwhite/status/814166603587788800)
### Why aren't you using Racoon, LibreSwan, or OpenSwan?
> Before picking a VPN provider/app, make sure you do some research
> https://research.csiro.au/ng/wp-content/uploads/sites/106/2016/08/paper-1.pdf ... – or consider Algo
Racoon does not support IKEv2. Racoon2 supports IKEv2 but is not actively maintained. When we looked, the documentation for StrongSwan was better than the corresponding documentation for LibreSwan or OpenSwan. StrongSwan also has the benefit of a from-scratch rewrite to support IKEv2. I consider such rewrites a positive step when supporting a major new protocol version.
-- [The Register](https://twitter.com/TheRegister/status/825076303657177088)
### Why aren't you using a memory-safe or verified IKE daemon?
> Algo is really easy and secure.
I would, but I don't know of any [suitable ones](https://github.com/trailofbits/algo/issues/68). If you're in the position to fund the development of such a project, [contact us](mailto:info@trailofbits.com). We would be interested in leading such an effort. At the very least, I plan to make modifications to StrongSwan and the environment it's deployed in that prevent or significantly complicate exploitation of any latent issues.
### Why aren't you using OpenVPN?
OpenVPN does not have out-of-the-box client support on any major desktop or mobile operating system. This introduces user experience issues and requires the user to [update](https://www.exploit-db.com/exploits/34037/) and [maintain](https://www.exploit-db.com/exploits/20485/) the software themselves. OpenVPN depends on the security of [TLS](https://tools.ietf.org/html/rfc7457), both the [protocol](http://arstechnica.com/security/2016/08/new-attack-can-pluck-secrets-from-1-of-https-traffic-affects-top-sites/) and its [implementations](http://arstechnica.com/security/2014/04/confirmed-nasty-heartbleed-bug-exposes-openvpn-private-keys-too/), and we simply trust the server less due to [past](https://sweet32.info/) [security](https://github.com/ValdikSS/openvpn-fix-dns-leak-plugin/blob/master/README.md) [incidents](https://www.exploit-db.com/exploits/34879/).
### Why aren't you using Alpine Linux, OpenBSD, or HardenedBSD?
Alpine Linux is not supported out-of-the-box by any major cloud provider. We are interested in supporting Free-, Open-, and HardenedBSD. Follow along or contribute to our BSD support in [this issue](https://github.com/trailofbits/algo/issues/35).
### Where did the name "Algo" come from?
Algo is short for "Al Gore", the **V**ice **P**resident of **N**etworks everywhere for [inventing the Internet](https://www.youtube.com/watch?v=BnFJ8cHAlco).
## [Troubleshooting](docs/TROUBLESHOOTING.md)
If you have issues deploying and using the Algo VPN server, check the [troubleshooting](docs/TROUBLESHOOTING.md) documentation for solutions to common problems.
-- [the grugq](https://twitter.com/thegrugq/status/786249040228786176)

37
docs/FAQ.md
Unescape Escape View File

@ -0,0 +1,37 @@
## FAQ
1. Has Algo been audited?
2. Why aren't you using Tor?
3. Why aren't you using Racoon, LibreSwan, or OpenSwan?
4. Why aren't you using a memory-safe or verified IKE daemon?
5. Why aren't you using OpenVPN?
6. Why aren't you using Alpine Linux, OpenBSD, or HardenedBSD?
7. Where did the name "Algo" come from?
### 1. Has Algo been audited?
No. This project is under [active development](https://github.com/trailofbits/algo/projects/1). We're happy to [accept and fix issues](https://github.com/trailofbits/algo/issues) as they are identified. Use Algo at your own risk. If you find a security issue of any severity, please [contact us on Slack](https://empireslacking.herokuapp.com).
### 2. Why aren't you using Tor?
The goal of this project is not to provide anonymity, but to ensure confidentiality of network traffic while traveling. Tor introduces new risks that are unsuitable for Algo's intended users. Namely, with Algo, users are in control over the gateway routing their traffic. With Tor, users are at the mercy of [actively](https://www.securityweek2016.tu-darmstadt.de/fileadmin/user_upload/Group_securityweek2016/pets2016/10_honions-sanatinia.pdf) [malicious](https://chloe.re/2015/06/20/a-month-with-badonions/) [exit](https://community.fireeye.com/people/archit.mehta/blog/2014/11/18/onionduke-apt-malware-distributed-via-malicious-tor-exit-node) [nodes](https://www.wired.com/2010/06/wikileaks-documents/).
### 3. Why aren't you using Racoon, LibreSwan, or OpenSwan?
Racoon does not support IKEv2. Racoon2 supports IKEv2 but is not actively maintained. When we looked, the documentation for StrongSwan was better than the corresponding documentation for LibreSwan or OpenSwan. StrongSwan also has the benefit of a from-scratch rewrite to support IKEv2. I consider such rewrites a positive step when supporting a major new protocol version.
### 4. Why aren't you using a memory-safe or verified IKE daemon?
I would, but I don't know of any [suitable ones](https://github.com/trailofbits/algo/issues/68). If you're in the position to fund the development of such a project, [contact us](mailto:info@trailofbits.com). We would be interested in leading such an effort. At the very least, I plan to make modifications to StrongSwan and the environment it's deployed in that prevent or significantly complicate exploitation of any latent issues.
### 5. Why aren't you using OpenVPN?
OpenVPN does not have out-of-the-box client support on any major desktop or mobile operating system. This introduces user experience issues and requires the user to [update](https://www.exploit-db.com/exploits/34037/) and [maintain](https://www.exploit-db.com/exploits/20485/) the software themselves. OpenVPN depends on the security of [TLS](https://tools.ietf.org/html/rfc7457), both the [protocol](http://arstechnica.com/security/2016/08/new-attack-can-pluck-secrets-from-1-of-https-traffic-affects-top-sites/) and its [implementations](http://arstechnica.com/security/2014/04/confirmed-nasty-heartbleed-bug-exposes-openvpn-private-keys-too/), and we simply trust the server less due to [past](https://sweet32.info/) [security](https://github.com/ValdikSS/openvpn-fix-dns-leak-plugin/blob/master/README.md) [incidents](https://www.exploit-db.com/exploits/34879/).
### 6. Why aren't you using Alpine Linux, OpenBSD, or HardenedBSD?
Alpine Linux is not supported out-of-the-box by any major cloud provider. We are interested in supporting Free-, Open-, and HardenedBSD. Follow along or contribute to our BSD support in [this issue](https://github.com/trailofbits/algo/issues/35).
### 7. Where did the name "Algo" come from?
Algo is short for "Al Gore", the **V**ice **P**resident of **N**etworks everywhere for [inventing the Internet](https://www.youtube.com/watch?v=BnFJ8cHAlco).

0
docs/Troubleshooting.md → docs/TROUBLESHOOTING.md
Unescape Escape View File

Write Preview
Loading…
Cancel
Save