<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
I have the XAuth EAP Plugin enabled in my IPsec VPN responder, along<br>
with a number of eap plugins. I did not build this version of
strongSwan<br>
(5.2.1) but downloaded it from a Raspberry Pi repository.<br>
<br>
My /etc/ipsec.secrets file contains entries similar to:<br>
<br>
Fred : EAP "1234567"<br>
<br>
fred : XAUTH "deadbeef1234567"<br>
<br>
Please note the different capitalisation of the letter f for the two
different <br>
usernames.<br>
<br>
<br>
My iPhone 4 Cisco IPsec VPN client has an X.509 entity certificate<br>
and is configured with username=fred and password=1234567<br>
<br>
My /etc/ipsec.conf file is configured as follows:<br>
<br>
conn CiscoIPSec<br>
keyexchange=ikev1<br>
# forceencaps=yes<br>
rightauth=pubkey<br>
rightauth2=xauth<br>
auto=add<br>
<br>
As the iPhone password is not the same as the XAUTH password in<br>
/etc/ipsec.secrets, I was not expecting authentication to succeed.<br>
<br>
However [1] notes it may not be this simple.<br>
<br>
The <em>xauth-eap</em> plugin is an IKEv1 XAuth server backend. It
requests<br>
username/password XAuth credentials and verifies them against <br>
any password based IKEv2 EAP plugin. <br>
<br>
My experience suggests the password is checked but not the<br>
username. I was not expecting Fred's password to successfully<br>
authenticate a request from user fred (note the lower case f).<br>
<br>
The following log output suggests username is compared along with
password.<br>
<br>
01[ENC] <CiscoIPSec|58> generating TRANSACTION request
2160949662 [ HASH CPRQ(X_USER X_PWD) ]<br>
11[ENC] <CiscoIPSec|58> parsed TRANSACTION response 2160949662
[ HASH CPRP(X_USER X_PWD) ]<br>
11[IKE] <CiscoIPSec|58> XAuth authentication of 'fred'
successful<br>
<br>
The other possible reason for my observed behaviour is that a
truncated password is used in the hash<br>
calculation, but I would doubt that is the case.<br>
<br>
My iPhone X.509 certificate has the serverAuth flag set as required
by Windows 7 but I don't think<br>
this would explain what I am seeing. <br>
<br>
Any help appreciated, thank you.<br>
<br>
<br>
[1] <a class="moz-txt-link-freetext" href="https://wiki.strongswan.org/projects/strongswan/wiki/XAuthEAP">https://wiki.strongswan.org/projects/strongswan/wiki/XAuthEAP</a><br>
<pre class="moz-signature" cols="132">
</pre>
</body>
</html>