<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hi Noel, Hi Imarn<br>
<br>
thanks for your answers!<br>
Any idea whats the best authentication method for username/password
only on client-side? <br>
EAP-MD5?<br>
<br>
The client should be able to connect via windows ikev2 native
clients, the strongswan android-app,<br>
and the native clients from osx/ios.<br>
<br>
Best<br>
Thomas<br>
<br>
Am 03.12.2014 19:40, schrieb Imran Akbar:<br>
<span style="white-space: pre;">> Hey Thomas,<br>
> Seems like we're in the same boat. Which client are you
using to connect?<br>
> I'm going to try that config on my own gateway and see if
works for me.<br>
> I'm also looking at this example for PSK authentication:
<a class="moz-txt-link-freetext" href="http://www.strongswan.org/uml/testresults/ikev2/rw-psk-ipv4/">http://www.strongswan.org/uml/testresults/ikev2/rw-psk-ipv4/</a><br>
><br>
> yours,<br>
> imarn<br>
><br>
> On Wed, Dec 3, 2014 at 10:13 AM, Noel Kuntze
<<a class="moz-txt-link-abbreviated" href="mailto:noel@familie-kuntze.de">noel@familie-kuntze.de</a>
<a class="moz-txt-link-rfc2396E" href="mailto:noel@familie-kuntze.de"><mailto:noel@familie-kuntze.de></a>> wrote:<br>
><br>
></span><br>
<blockquote type="cite">Hello Thomas,<br>
<br>
Using something like you already have in the conn win7 section
will do.<br>
Just don't set any authentication method for the client, that
needs certificates or psk and you're golden.<br>
Assuming of course your client is configured the right way, of
course.<br>
<br>
Mit freundlichen Grüßen/Regards,<br>
Noel Kuntze<br>
<br>
GPG Key ID: 0x63EC6658<br>
Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658<br>
<br>
Am 03.12.2014 um 14:54 schrieb Thomas:<br>
> Hi,<br>
<br>
> I'm trying to setup strongswan to acceppt only username and
password as<br>
> logincredentials.<br>
> So, the client do not need any certificate, only his username
and password.<br>
> Is there any way to do that ?<br>
<br>
<br>
> My actual ipsec.conf is this:<br>
<br>
> config setup<br>
<br>
> conn ios<br>
> keyexchange=ikev1<br>
> authby=xauthrsasig<br>
> xauth=server<br>
> left=%defaultroute<br>
> leftsubnet=0.0.0.0/0 <a class="moz-txt-link-rfc2396E" href="http://0.0.0.0/0"><http://0.0.0.0/0></a><br>
> leftfirewall=yes<br>
> leftcert=serverCert.pem<br>
> right=%any<br>
> rightsubnet=10.0.0.0/24 <a class="moz-txt-link-rfc2396E" href="http://10.0.0.0/24"><http://10.0.0.0/24></a><br>
> rightsourceip=10.0.0.0/24 <a class="moz-txt-link-rfc2396E" href="http://10.0.0.0/24"><http://10.0.0.0/24></a><br>
> rightcert=clientCert.pem<br>
> auto=add<br>
<br>
> conn android<br>
> keyexchange=ikev2<br>
> left=%defaultroute<br>
> leftauth=pubkey<br>
> leftsubnet=0.0.0.0/0 <a class="moz-txt-link-rfc2396E" href="http://0.0.0.0/0"><http://0.0.0.0/0></a><br>
> leftcert=serverCert.pem<br>
> right=%any<br>
> rightauth=pubkey<br>
> rightsourceip=10.0.0.0/24 <a class="moz-txt-link-rfc2396E" href="http://10.0.0.0/24"><http://10.0.0.0/24></a><br>
> rightcert=clientCert.pem<br>
> auto=add<br>
<br>
> conn win7<br>
> keyexchange=ikev2<br>
> ike=aes256-sha1-modp1024!<br>
> esp=aes256-sha1!<br>
> dpdaction=clear<br>
> dpddelay=300s<br>
> rekey=no<br>
> left=%any<br>
> leftsubnet=0.0.0.0/0 <a class="moz-txt-link-rfc2396E" href="http://0.0.0.0/0"><http://0.0.0.0/0></a><br>
> leftauth=pubkey<br>
> leftcert=serverCert.pem<br>
> right=%any<br>
> rightsourceip=10.0.0.0/24 <a class="moz-txt-link-rfc2396E" href="http://10.0.0.0/24"><http://10.0.0.0/24></a><br>
> rightauth=eap-mschapv2<br>
> rightsendcert=never<br>
> eap_identity=%any<br>
> auto=add<br>
<br>
> _______________________________________________<br>
> Users mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a>
<a class="moz-txt-link-rfc2396E" href="mailto:Users@lists.strongswan.org"><mailto:Users@lists.strongswan.org></a><br>
> <a class="moz-txt-link-freetext" href="https://lists.strongswan.org/mailman/listinfo/users">https://lists.strongswan.org/mailman/listinfo/users</a><br>
<br>
</blockquote>
<span style="white-space: pre;">><br>
> _______________________________________________<br>
> Users mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a>
<a class="moz-txt-link-rfc2396E" href="mailto:Users@lists.strongswan.org"><mailto:Users@lists.strongswan.org></a><br>
> <a class="moz-txt-link-freetext" href="https://lists.strongswan.org/mailman/listinfo/users">https://lists.strongswan.org/mailman/listinfo/users</a><br>
><br>
><br>
><br>
><br>
> _______________________________________________<br>
> Users mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a><br>
> <a class="moz-txt-link-freetext" href="https://lists.strongswan.org/mailman/listinfo/users">https://lists.strongswan.org/mailman/listinfo/users</a></span><br>
<br>
<br>
</body>
</html>