<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<font face="Courier New, Courier, monospace">Hello,<br>
<br>
<br>
I am trying to configure remote access authenticated by client
certificates.<br>
This is the client-side swanctl.conf:<br>
<br>
connections {<br>
home {<br>
local_addrs = %any<br>
remote_addrs = 37.120.163.19<br>
vips = 0.0.0.0<br>
local {<br>
auth=pubkey<br>
certs=udo-office.crt.pem<br>
id=nw049994<br>
}<br>
remote {<br>
auth=pubkey<br>
id=server.upokojski.de<br>
}<br>
children {<br>
home {<br>
remote_ts=10.8.0.0/24<br>
esp_proposals = aes128gcm128-x25519<br>
}<br>
}<br>
version=2<br>
proposals=aes128-sha256-x25519<br>
}<br>
}<br>
<br>
secrets {<br>
rsa-udo {<br>
file=udo-office.key.pem<br>
secret="Abc123"<br>
}<br>
}<br>
<br>
<br>
Any connection attempt end with an authentication failure. The
client log says, that the private cannot be loaded:<br>
Nov 24 13:52:40 client-udo charon-systemd[24951]: dnscert plugin
is disabled<br>
Nov 24 13:52:40 client-udo charon-systemd[24951]: ipseckey plugin
is disabled<br>
Nov 24 13:52:40 client-udo charon-systemd[24951]: attr-sql plugin:
database URI not set<br>
Nov 24 13:52:40 client-udo charon-systemd[24951]: loading ca
certificates from '/etc/ipsec.d/cacerts'<br>
Nov 24 13:52:40 client-udo charon-systemd[24951]: loaded ca
certificate "C=DE, ST=NRW, L=Oberhausen, O=Home, OU=Homenet,
CN=Home PKI" from '/etc/ipsec.d/cacerts/ca-cert.pem'<br>
Nov 24 13:52:40 client-udo charon-systemd[24951]: loading aa
certificates from '/etc/ipsec.d/aacerts'<br>
Nov 24 13:52:40 client-udo charon-systemd[24951]: loading ocsp
signer certificates from '/etc/ipsec.d/ocspcerts'<br>
Nov 24 13:52:40 client-udo charon-systemd[24951]: loading
attribute certificates from '/etc/ipsec.d/acerts'<br>
Nov 24 13:52:40 client-udo charon-systemd[24951]: loading crls
from '/etc/ipsec.d/crls'<br>
Nov 24 13:52:40 client-udo charon-systemd[24951]: loading secrets
from '/etc/ipsec.secrets'<br>
Nov 24 13:52:40 client-udo charon-systemd[24951]: loaded EAP
secret for nw049994<br>
Nov 24 13:52:40 client-udo charon-systemd[24951]: loaded RSA
private key from '/etc/ipsec.d/private/udo-office.plainkey.pem'<br>
Nov 24 13:52:40 client-udo charon-systemd[24951]: sql plugin:
database URI not set<br>
Nov 24 13:52:40 client-udo charon-systemd[24951]: opening triplet
file /etc/ipsec.d/triplets.dat failed: No such file or directory<br>
Nov 24 13:52:40 client-udo charon-systemd[24951]: eap-simaka-sql
database URI missing<br>
Nov 24 13:52:40 client-udo charon-systemd[24951]: loaded 0 RADIUS
server configurations<br>
Nov 24 13:52:40 client-udo charon-systemd[24951]: HA config misses
local/remote address<br>
Nov 24 13:52:40 client-udo charon-systemd[24951]: no threshold
configured for systime-fix, disabled<br>
Nov 24 13:52:40 client-udo charon-systemd[24951]: coupling file
path unspecified<br>
Nov 24 13:52:40 client-udo charon-systemd[24951]: loaded plugins:
charon-systemd charon-systemd test-vectors unbound ldap pkcs11 tpm
aesni aes rc2 sha2 sha1 md4 md5 mgf1 random nonce x509 revocation
constraints acert pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey
sshkey dnscert ipseckey pem openssl gcrypt af-alg fips-prf gmp
curve25519 agent chapoly xcbc cmac hmac ctr ccm gcm ntru bliss
curl soup mysql sqlite attr kernel-netlink resolve socket-default
connmark farp stroke vici updown eap-identity eap-sim eap-sim-pcsc
eap-aka eap-aka-3gpp2 eap-simaka-pseudonym eap-simaka-reauth
eap-md5 eap-gtc eap-mschapv2 eap-dynamic eap-radius eap-tls
eap-ttls eap-peap eap-tnc xauth-generic xauth-eap xauth-pam
xauth-noauth tnc-tnccs tnccs-20 tnccs-11 tnccs-dynamic dhcp
whitelist lookip error-notify certexpire led radattr addrblock
unity counters<br>
Nov 24 13:52:40 client-udo charon-systemd[24951]: dropped
capabilities, running as uid 0, gid 0<br>
Nov 24 13:52:40 client-udo charon-systemd[24951]: spawning 16
worker threads<br>
Nov 24 13:52:40 client-udo kernel: [110583.945449] audit:
type=1400 audit(1606222360.438:123): apparmor="ALLOWED"
operation="sendmsg" profile="/usr/sbin/charon-systemd"
name="/run/systemd/notify" pid=24951 comm="charon-systemd"
requested_mask="w" denied_mask="w" fsuid=0 ouid=0<br>
Nov 24 13:52:40 client-udo kernel: [110583.945478] audit:
type=1400 audit(1606222360.438:124): apparmor="ALLOWED"
operation="sendmsg" profile="/usr/sbin/charon-systemd"
name="/run/systemd/notify" pid=24951 comm="charon-systemd"
requested_mask="w" denied_mask="w" fsuid=0 ouid=0<br>
Nov 24 13:52:40 client-udo charon-systemd[24951]: loaded
certificate 'C=DE, ST=NRW, L=Oberhausen, O=Home, OU=VPN,
CN=udonbwin'<br>
Nov 24 13:52:40 client-udo charon-systemd[24951]: loaded
certificate 'C=DE, ST=NRW, L=Oberhausen, O=Office, OU=VPN,
CN=udo-office'<br>
Nov 24 13:52:40 client-udo charon-systemd[24951]: loaded ANY
private key<br>
Nov 24 13:52:40 client-udo charon-systemd[24951]: building
CRED_PRIVATE_KEY - ANY failed, tried 10 builders<br>
Nov 24 13:52:40 client-udo charon-systemd[24951]: added vici
connection: home<br>
<br>
<br>
<br>
swanctl --load-creds asks for a password:<br>
<a class="moz-txt-link-abbreviated" href="mailto:root@client-udo:/etc/strongswan.d/charon#">root@client-udo:/etc/strongswan.d/charon#</a> swanctl --load-creds<br>
loaded certificate from '/etc/swanctl/x509/udonbwin.crt.pem'<br>
loaded certificate from '/etc/swanctl/x509/udo-office.crt.pem'<br>
loaded rsa key from '/etc/swanctl/private/udo-office.plainkey.pem'<br>
Password for private file 'udo-office.key.pem':<br>
Password for private file 'udo-office.key.pem':<br>
Password for private file 'udo-office.key.pem':<br>
Password for private file 'udo-office.key.pem':<br>
building CRED_PRIVATE_KEY - ANY failed, tried 9 builders<br>
loading '/etc/swanctl/private/udo-office.key.pem' failed: parsing
ANY private key failed<br>
<br>
<br>
I checked the pass by trying
this:root@client-udo:/etc/swanctl/private# openssl rsa -noout
-text -in udo-office.key.pem<br>
Enter pass phrase for udo-office.key.pem:<br>
RSA Private-Key: (4096 bit, 2 primes)<br>
modulus:<br>
00:d5:e0:61:79:4a:73:ad:39:7c:e6:f0:c3:d1:57:<br>
6c:86:8e:2e:ba:c5:32:f6:78:77:20:46:1d:28:2f:<br>
fb:e2:f6:c5:f4:2f:6d:4e:95:70:80:39:9c:b4:60:<br>
11:47:2b:b2:3c:c1:13:67:89:12:ca:89:52:de:f7:<br>
e4:37:f1:27:c8:72:30:60:4b:20:43:01:24:48:4c:<br>
cf:38:a2:a9:11:7d:5d:7e:a2:5b:f2:a0:bf:0d:4e:<br>
[....]<br>
<br>
Why is the correct password denied by swanctl?<br>
<br>
<br>
Thanks,<br>
Udo<br>
<br>
</font>
</body>
</html>