Join Sean Colins for an in-depth discussion in this video What is a VPN and how does it fit into your server puzzle?, part of Mac OS X Server 10.6 Snow Leopard: DNS and Network Services.
You need to say something very important and very private to someone else. You're a spy, and your secret could mean life or death for millions. The security of what you're about to say cannot be compromised. You're watched, you're bugged, and every word you say is heard instantly by everyone you must evade. You need some way to communicate securely and accurately with someone in another room in another country, thousands of miles away.
You step very carefully into a dark box about the size of an old wooden phone booth. You close the door behind you, and you're encased in darkness and silence. The sounds from the room you just left are gone. The light is gone. Everything is gone. You say your name and a password, and the box transmits a secret only the box knows to another box in another room, thousands of miles away.
Suddenly, you're bathed in light and the sounds from that distant room thousands of miles away. You're not there, but you see and hear and can interact with others in that room as if you are there. You have entered a VPN. You may not be a secret agent, you may not even be the IT guy who supports spies, but you probably want to protect yourself from the prying eyes of hackers or other snoopers who would just love to know what you're doing.
A lot of hackers would be very happy to sniff your username and password off a public network, so they can access your accounts later. You'd be surprised how easy it is to eavesdrop on a network. If you have ever connected to a wireless network in a coffee shop, a hotel, or a library, your data was exposed to every one else on that network at that time. If you logged into chat or check your e-mail or make an online purchase, your personal information was probably exposed on that network.
There are only a few ways to protect yourself from the people who want to collect your information. One of those ways is using SSL, and you may remember that we tackled the subject of SSL in Snow Leopard Server New Features, and in Snow Leopard Server Essential Training. But for all of your stuff that isn't or can't be protected using SSL, there's really only one black box you can step into to protect yourself, and that's a VPN.
Encryption is a cool technology, and it's been around for centuries. From Julius Caesar to the US military employing Native American code talkers to speak in their native language to create an unbreakable code in World War II, to the James Bond's spy novels, encryption has been in our collective culture for what seems like forever. Encryption is code. When you encrypt data, you wrap up something that anyone could read in a wrapper that changes it.
So it cannot be read until it gets to its destination where a code can be used to unravel the mystery of the context. This makes it readable again. When you activate a VPN, you can send all of your network traffic from your computer to your VPN server in an encrypted form that can only be unrevealed by the VPN server. As a result, you can send and receive information to and from your trusted network without any fear of interception by the bad guys.
To prove you are who you say you are, you have to authenticate, and this process is simple and should be straightforward for any person who can use a computer. All the person must do to authenticate is enter their unique username and the correct password. In our analogy above, the black box transmitted its own secret to another black box as the final step in the process, before our hero was transported safely away. In a real VPN, at least sometimes, a shared secret must be present in addition to the authentication information to complete a secure transaction.
Sometimes the VPN server is embedded on a piece of network equipment, but OS X server has VPN server software included and it's really very good. So let's get into Server Admin and configure our VPN server.
- Deploying, troubleshooting, and understanding OS X 10.6 DNS server
- Understanding and configuring OS X and OS X Server-based firewalls
- Fixing server- and client-side firewalls
- Configuring and troubleshooting DHCP
- Setting up and troubleshooting a VPN server