6.15. Adding a Bit of Security to RIP and OSPF

Problem

All this stuff is going in cleartext between your routers—can't you at least add a password or something, so that the routers must authenticate to each other, and not allow any old host claiming to be a router to mess up your routing tables?

Solution

You can set MD5-hashed passwords on your routers. Add these lines to enable encrypted passwords for ripd in /etc/quagga/ripd.conf:

	key chain localnet
	 key 1
	  key-string bigsecretword

	interface eth1
	  ip rip authentication mode md5
	  ip rip authentication key-chain localnet

Replace bigsecretword with your own password, localnet with whatever name you want, and make sure you're specifying the correct network interface.

ospfd uses a slightly different syntax. Add these lines to /etc/quagga/ospfd.conf:

	interface eth0
	 ip ospf authentication message-digest
	 ip ospf message-digest-key 1 md5 bigsecretword

	router ospf
	 network 172.16.5.0/24 area 0.0.0.1
	 area 0.0.0.1 authentication message-digest

Use your own password, interface name, and network address. You can create multiple keys for multiple interfaces, numbering them sequentially.

Discussion

Remember to restart your routing daemons after making configuration changes.

RIPv1 does not support any form of authentication. There are two ways to deal with this. One way is to allow only RIPv2 on your network by adding this line to ripd.conf:

	version 2

If you must allow RIPv1 support, ripd handles this by allowing RIPv1 and other unauthenticated devices to receive routing information, but not to make any changes to the routing tables.

See Also