Hacker News Reader

Comment by 45h34jh53k4j | Hacker News Reader

Streisand is a good idea, but I don't believe users want 500 services running on their VPN gateway. Most of these protocols require a specific client, like OpenVPN. This is a 'kitchen sink' collection.

TrailOfBits released their ansible scripts for StrongS/WAN, which has sensible secure defaults (IPSec using AES-GCM only). They are calling the project algo.

https://github.com/trailofbits/algo

View on HN

It is pretty easy to turn off any roles you don't want on Streisand. If you know for sure you will be using IPSEC I agree with you, use the ToB setup.

Specifically, compare their IKE setups:

https://github.com/jlund/streisand/blob/master/playbooks/rol...

https://github.com/trailofbits/algo/blob/master/roles/vpn/te...

Algo's is much more conservative. Streisand lets 3des and SHA1 into the mix. If you allow it, users will end up using it.

Otherwise, I think you are spot on and I prefer Algo (having used both for various things and just playing around).

For anyone about to try out algo – I assume it's great if you are using AWS or DigitalOcean, but if you're self hosting, or have an unsupported VPS, I've had nothing but trouble getting it up and running. I am most certainly to blame, but just a heads up.

Not to toot my own horn, but here's a blog post I just wrote on some issues I ran into setting up Algo on a pre-existing Vultr server. It might help.

http://modulolotus.net/posts/2016-03-28-setting-up-algo/

Excellent I'm embarrassed that I didn't ask if anyone had done this and wrote up their results.

From what I was experiencing, I bet it was either the root privileges, or the SSH connection errors. Thanks a ton.

Reply on news.ycombinator.com