NAME

       vde_cryptcab - Virtual Distributed Ethernet encrypted cable manager

SYNOPSIS

       vde_cryptcab [ -p portnum ] [ -s socketpath ] [ -c [remote_user@]host[:remote_portnum] ] [
       -P pre_shared.key ]| [ -x ] [ -v [v][v][v] ] [ -k ] [ -d ]

DESCRIPTION

       A vde_cryptcab is a distributed cable  manager  for  VDE  switches.   It  allows  two  VDE
       switches on two machines to communicate using a blowfish encrypted channel.

       When  used  in client mode (i.e., with -c option), it generates a random blowfish key, and
       uses scp (1) to transfer the key to the remote server.

       On the client side, the environment variable SCP_EXTRA_OPTIONS may  be  set  in  order  to
       append  options  to  the  scp  command  line  (this is useful for example when dropbear or
       another non-standard ssh client is used to transfer the blowfish key).

       After a 4-way handshake phase  to  verify  client  credentials,  server  and  client  will
       exchange  VDE  datagrams encapsulating them into cryptograms that are sent via udp to each
       remote host.

       On server side, one could run:
              vde_cryptcab -s /tmp/vde2.ctl -p 2100
       To start a multi-peer cryptcab server, accepting udp datagrams on port 2100, that connects
       each  authenticated  remote  client  to  a  different  port  of the switch. In fact, a new
       instance of vde_plug (1) is started and connected to the switch through local unix socket.

       The command
              vde_cryptcab -s /tmp/vde2.ctl -c foo@remote.machine.org:2100
       will connect a client to the remote server, running on udp port 2100.  At this  point,  on
       server  side a verify for user "foo" credentials is required, typically it could be: host-
       based authentication, password challenge or public key authentication.  See  ssh  (1)  for
       more details about it.

       If  the  two vde_switches run as daemon and they are connected to tap interfaces a level 2
       encrypted tunnel is established.

OPTIONS

       -p portnum
              It is possible to decide which local udp port to use.   When  this  option  is  not
              specified, cryptcab will use default udp port number, 7667.

       -c [remote_user@]host[:remote_portnum]
              run  vde_cryptcab in client mode, trying to connect to host .  Both remote_user and
              remote_portnum parameters are not  required.   If  not  specified,  the  same  user
              running  vde_cryptcab  is  used  for authentication on server, and default udp port
              7667 is used.

       -s socketpath
              specify the UNIX socket to be used by local programs  for  joining  the  VDE.   The
              default value is "/tmp/vde.ctl".

       -P pre_shared.keypath
              if specified, vde_cryptcab will run in pre-shared key mode, instead of generating a
              random key to transmit with ssh.  Given  option  is  the  path  to  the  pre-shared
              symmetric key file to use for data encryption.  The same key has to be used on both
              client and server.

       -x     Disable symmetric key encryption.

       -k     Send periodic "keepalive" packets to avoid server timeouts. Useful when you want to
              keep a low-traffic link available.

       -d     Run as daemon.

       -v     Verbose. (Use -vv -vvv or -vvvv for more verbosity)

KNOWN ISSUES

       Encapsulating  IP packets into session+udp layer results in real datagrams larger than tap
       device mtu. Since vde_cryptcab gets confused by packet fragmentation, the tap  device  mtu
       must be set to a smaller value than real interface mtu. Use ip(8) or ifconfig(8) to set up
       your tap device mtu.

       Explicitly disabling encryption leads to obvious security problems. It is advised to avoid
       unencrypted mode (-x) in non-controlled networks.

NOTICE

       Virtual  Distributed  Ethernet  is  not  related in any way with www.vde.com ("Verband der
       Elektrotechnik, Elektronik und  Informationstechnik"  i.e.  the  German  "Association  for
       Electrical, Electronic & Information Technologies").

SEE ALSO

       vde_switch(1), vdeq(1), vde_plug(1), vde_plug2tap(1), scp(1), ssh(1).

AUTHORS

       VDE is a project by Renzo Davoli <renzo@cs.unibo.it>.

       vde_cryptcab is a VDE component by Daniele Lacamera <root@danielinux.net>