skiptool(1M)

NAME
skiptool - SKIP Administration tool

SYNOPSYS
skiptool [-n] [interface]

OPTIONS

-n  Disable checking for required systems.

[interface]
    Network interface, e.g. le0, hme0, elx0...

DESCRIPTION
skiptool allows the workstation user to administer SKIP. You must be root to run this tool. The optional interface is the name of the network interface you wish to administer.

skiptool will allow you to: enable and disable access control, add hosts for encrypted and clear connections, and set the actions that will occur when unauthorized hosts try to connect.

skiptool's main screen is divided into two parts. The first section of the main screen tells you the access control status and provides the means to change it (enable or disable SKIP). Use your third mouse button to bring up a pull-down-menu which will allow you to modify the current setting.

Also shown is the policy towards unauthorized systems. With your third mouse button, bring up the menu. You will have three choices. No Access will not allow any host which is not listed in the Authorized Systems list to connect. The Ask for confirmation option will have the skiptool pop up a box, everytime an unauthorized host tries to connect. You will have the option of allowing or disallowing access. The third option, Add Automatically will add any host which tries to connect to the Authorized Systems list.

The second section of the screen contains a list of Authorized Systems and a list of Excluded Systems. Each list has buttons to add or delete entries. Between the two lists are a pair of buttons which can be used to move items from one list to another (to permit or deny access for example).

Access Control List Processing The access control list allows the user to configure which remote systems can access the local host and the type of access granted. Access control is usually based on the IP address of the remote host or by the remote system's key id. At present no provision is made to provide finer-grained access control (say on the basis of individual TCP/IP services). Remote systems may be specified either as individual hosts, networks or nomadic (mobile systems): hosts - by their hostname or IP address (e.g. "otis", 192.9.200.3) network or subnetworks - by a network address plus a mask similar to that used in subnetting. For example, "grenoble-eng", 192.9.200.0/255.255.255.0. nomadic systems (SKIP only) - by a key identifier (i.e. any IP address with key id "x") The order of processing of ACL entries is as follows. A search is made for an ACL entry specifying the remote host. If one exists it will be used. If not, a search is then made for a network entry which corresponds to the remote host. If more than one entry applies, the best match (i.e. the entry which matches best the remote) will be used. If no entry containing the IP address can be found then a search is made for a nomadic ACL entry containing the sender key identifier present in the SKIP protocol header. If one is found and the packet is correctly authenticated then the sender's IP address is stored for future reference. If no corresponding ACL entry can be found for a remote system a special entry, the default, is used. The default may be configured to allow access or deny access. This mechanism is somewhat similar to the mechanism used by IP when deciding how to route a packet to the destination (i.e. host routes take precedence over network routes, in the absence of anything better the default route is used). When applying access control, the system treats the lists of authorized and excluded systems as one global list and always selects the best match. Default Entry

The catch-all entry "default" may be specified to indicate all other hosts not specifically covered by other access control entries. Note: specifying a default entry effectively disables skiptool's "Ask for Confirmation" and "Add Automatically" modes (any would-be unauthorized systems are caught by the default entry). Adding and Editing Authorized Systems.

Use your third mouse button on the Authorized Systems Add menu to pull down a menu of system types: host, network or nomadic. Without releasing the button, pull right the menu to choose the security setting. Security settings can be Off (communication in the clear), SKIP (encryption and/or authentication), SKIP (version 1) or ESP/AH (Manual Keying). These modes are described further in the user guide. SKIP version 1 is used to communicate with SunScreen(tm) SPF-100 and SunScreen SPF100G systems.

To Delete an authorized entry, single click on the system and click the delete button.

Adding and Editing Excluded Systems.

Use your third mouse button on the Excluded Systems Add menu to pull down a menu of system types: host, network or nomadic. Without releasing the button, pull right the menu to choose the security setting. Systems added in this manner will be denied access.

To Delete an excluded entry, single click on the system and click the delete button.

Enabling and Disabling SKIP

Third-button Click on the Access Control for this system setting. You will be given the choice to have SKIP enabled or disabled

Preserving the Access Control List

By pulling down the File menu, and selecting the Save option, the current access control list will be preserved across system restarts. Note: Make sure that your system is operating correctly before saving the current access control list. If not, your system may not restart. See the emergency start instructions in the user guide for more information. By pulling down the File menu, and selecting the Load option, skiptool will update its display to show the current access control list. This is useful if the ACL was modified by another user and the current settings are no longer valid. Key Management By pulling down the File menu, and selecting the Key Management option, you can open the key management menu. With this menu, you can set how long unused keys are kept and how many kilobytes are transmitted before the keys change. Adjust these parameters with the arrow buttons and click on Apply to set the results. You can also set the key management back to the defaults by clicking on Default. After setting the parameters, click on Apply.

Statistical Information By pulling down the File menu, and selecting the SKIP Statistics option, you can select from a range of statistical displays. The information displayed is updated once every 3 seconds. The documentation for skipstat describes the information displayed in detail. Leaving skiptool By pulling down the File menu, and selecting the Exit option, you may exit skiptool. The access control configuration currently established will remain in place. If the configuration was saved, then it will automatically be restored during the next system startup. Iconified Status Information

If you iconify the skiptool, the icon will indicate whether SKIP is on or off.

BUGS
Be sure to provide access to your file and name service hosts. Otherwise, your system can hang.