[strongSwan] trying to get basic pubkey strongswan connection with certificates up and running
Cindy Moore
ctmoore at cs.ucsd.edu
Sun Sep 14 07:57:32 CEST 2014
OK, I am now spotting this in the syslog, but I'm a bit at a loss... I
have this private file (vpnHostKey.pem) set to 600. How can I find
out where it's lookign for the private key? I have all mine in
/etc/ipsec.d/private (see below)...
Sep 13 22:42:47 vpn charon: 15[IKE] no private key found for 'C=CH,
O=strongSwan, CN=vpn.example.com'
ipsec.conf is now:
config setup
charondebug="cfg 2, dmn 2, ike 2, net 2"
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ike
leftcert=vpnHostCert.pem
leftid="C=CH, O=strongSwan, CN=vpn.example.com"
conn roadwarrior
#vpn server
left=137.110.222.66
#allow full tunneling
leftsubnet=0.0.0.0/0
right=%any
rightid=%any
rightauth=pubkey
#rightauth2=xauth-pam
#assign ip addr from this pool
rightsourceip=xxx.xx.xxx.0/24
auto=add
and
root at vpn:/etc/ipsec.d# ipsec statusall
Status of IKE charon daemon (strongSwan 5.1.2, Linux 3.13.0-35-generic, x86_64):
uptime: 2 days, since Sep 11 14:16:36 2014
malloc: sbrk 2568192, mmap 0, used 429616, free 2138576
worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0,
scheduled: 0
loaded plugins: charon test-vectors ldap aes rc2 sha1 sha2 md4 md5
random nonce x509 revocation constraints pkcs1 pkcs7 pkcs8 pkcs12 pem
openssl xcbc cmac hk
Virtual IP pools (size/online/offline):
xxx.xx.xxx.0/24: 254/0/0
Listening IP addresses:
xxx.xxx.xxx.xxx
(ipv6 deleted)
Connections:
roadwarrior: xxx.xxx.xxx.xxx...%any IKEv1/2
roadwarrior: local: [C=CH, O=strongSwan, CN=vpn.example.com] uses
public key authentication
roadwarrior: cert: "C=CH, O=strongSwan, CN=vpn.example.com"
roadwarrior: remote: uses public key authentication
roadwarrior: child: 0.0.0.0/0 === dynamic TUNNEL
Security Associations (0 up, 0 connecting):
none
and...
root at vpn:/etc/ipsec.d# ls -F
aacerts/ acerts/ cacerts/ certs/ crls/ ocspcerts/ policies/
private/ README reqs/
root at vpn:/etc/ipsec.d# ls -lt private/
total 12
-rw------- 1 root root 1679 Sep 13 22:19 moiKey.pem
-rw------- 1 root root 1675 Sep 13 22:18 vpnHostKey.pem
-rw------- 1 root root 3243 Sep 11 00:39 strongswanKey.pem
thanks!
On Sat, Sep 13, 2014 at 11:52 AM, Noel Kuntze <noel at familie-kuntze.de> wrote:
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> Hello Cindy,
>
> Please set the leftid to "C=CH, O=strongSwan, CN=vpn.example.com" or set leftcert to the file name of your server certificate.
>
> Mit freundlichen Grüßen/Regards,
> Noel Kuntze
>
> GPG Key ID: 0x63EC6658
> Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658
> Am 13.09.2014 um 16:17 schrieb Cindy Moore:
>> Ah, thank you for the Network Manager explanation. I thought that
>> was very strange. I didn't realize it didn't run with root
>> privileges.
>>
>> As for the ipsec.conf file, it is fine. It is the email client that
>> destroys how it is formatted when I send it out, so you guys can't see
>> how it looks but
>>
>> root at vpn:/etc# ipsec statusall
>> Status of IKE charon daemon (strongSwan 5.1.2, Linux 3.13.0-35-generic, x86_64):
>> uptime: 40 hours, since Sep 11 14:16:36 2014
>> malloc: sbrk 2568192, mmap 0, used 416528, free 2151664
>> worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0,
>> scheduled: 0
>> loaded plugins: charon test-vectors ldap aes rc2 sha1 sha2 md4 md5
>> random nonce x509 revocation constraints pkcs1 pkcs7 pkcs8 pkcs12 pem
>> openssl xcbc cmac hk
>> Virtual IP pools (size/online/offline):
>> xxx.xx.xxx.0/24: 254/0/0
>> Listening IP addresses:
>> xxx.xxx.xxx.xxx
>> (ipv6 address deleted)
>> Connections:
>> roadwarrior: xxx.xxx.xxx.xxx...%any IKEv1/2
>> roadwarrior: local: [vpn.example.com] uses public key authentication
>> roadwarrior: cert: "C=CH, O=strongSwan, CN=vpn.example.com"
>> roadwarrior: remote: uses public key authentication
>> roadwarrior: child: 0.0.0.0/0 === dynamic TUNNEL
>> Security Associations (0 up, 0 connecting):
>> none
>>
>>
>> Thanks,
>>
>>
>> On Sat, Sep 13, 2014 at 3:24 AM, Noel Kuntze <noel at familie-kuntze.de> wrote:
>>>
>> Hello Cindy,
>>
>> As network manager doesn't run as your user, you need to give
>> it access to the certificate and the private key in your home directory.
>> You can do this by changing the group of those files to a group
>> the network manager user is in and giving said group read
>> access to the file and execute access down the path to said files.
>>
>> Yes, the error message indicates a configuration mismatch
>> between the server and the client.
>>
>> I think you need to indent the section parameters with a tab for strongSwan to read them correctly.
>> Check with "ipsec statusall", if it correctly read all the conn definitions.
>>
>> Mit freundlichen Grüßen/Regards,
>> Noel Kuntze
>>
>> GPG Key ID: 0x63EC6658
>> Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658
>> Am 13.09.2014 um 00:05 schrieb Cindy Moore:
>> >>> Hi, I'm hoping I can get some tips or direction here, because I've
>> >>> been banging my head on this for a while.
>> >>>
>> >>> I have strongswan 5 installed on ubuntu 14.04 with all the latest updates, etc:
>> >>> root at vpn:/etc# ipsec version
>> >>> Linux strongSwan U5.1.2/K3.13.0-35-generic
>> >>>
>> >>> This part seems to be functioning fine. I've used the ipsec pki to
>> >>> generate a vpn cacert, and then a couple of certs to test things with.
>> >>> (For reference, I've included the steps I took to create those below,
>> >>> along with my ipsec.conf)
>> >>>
>> >>> All I want is to set up a connection between two machines, both
>> >>> running 14.04. "vpn" is a server install, client is a desktop
>> >>> install. I've installed the network-manager-strongswan (version
>> >>> 1.3.0-1ubuntu1) and restarted the network manager. I've tried to
>> >>> configure it as per
>> >>> https://wiki.strongswan.org/projects/strongswan/wiki/NetworkManager
>> >>> but there are already some differences in what's shown and what I get.
>> >>>
>> >>> Instead of Authentication, there is now Client, with Authentication
>> >>> under that (and additional options depending on what is chosen for
>> >>> Authentication. The choices for Authentication are
>> >>> Certificate/private key, Certificate/ssh-agent, Smartcard, EAP. I
>> >>> have questions about the ssh-agent, but I'll tabulate those for now.
>> >>> Anyway, so when I choose Certificate/private key, I get two more
>> >>> options below Authentication, which are Certificate and Private key.
>> >>>
>> >>> So for Gateway, I've got down vpn.example.com (name changed to protect
>> >>> guilty of course :) )
>> >>> and for Certificate, I have vpnHostCert.pem (see below). For
>> >>> Authentication, Certifcate/private key, for Certificate, moiCert.pem
>> >>> (see below) and for private key moiKey.pem (see below). I've checked
>> >>> the options to request an inner IP address, and to enforce udp
>> >>> encapsulation, but have left the ip compression unchecked.
>> >>>
>> >>> Under the General and IPv4 settings, I've left the latter to the
>> >>> deafult Automatic (VPN), for the former, I've tried both checking and
>> >>> unchecking "all users may connect..."
>> >>>
>> >>> [NB: I find that I MUST have all .pem files set to 644 and any
>> >>> directory along their path to 755 or else Network Manager stalls with
>> >>> asking me for a password and the client's syslog contains "charon-nm:
>> >>> 15[LIB] opening 'path/to/moiKey.pem' filed: Permission denied", which
>> >>> strikes me as rather strange: to force a private key to be readable??
>> >>> In this case client is a personal laptop so maybe not that bad, but
>> >>> really?]
>> >>>
>> >>> In following the syslog output on the vpn host, I see:
>> >>>
>> >>> Sep 12 14:42:02 vpn charon: 04[CFG] looking for peer configs matching
>> >>> xxx.xxx.xxx.xxx[C=CH, O=strongSwan, CN=vpn.example.com]...<client's
>> >>> current IP addr>[C=CH, O=strongSwan, CN=moi]
>> >>> Sep 12 14:42:02 vpn charon: 04[CFG] no matching peer config found
>> >>>
>> >>> so my guess is the conn roadwarrior (see below) isn't properly configured?
>> >>>
>> >>> I would appreciate any help... getting this configured has been a huge
>> >>> headache. Thanks.
>> >>>
>> >>> --------------
>> >>> Background info/files:
>> >>>
>> >>> CAcert/key:
>> >>>
>> >>> $ cd /etc/ipsec.d/
>> >>> $ ipsec pki --gen --type rsa --size 4096 \
>> >>> --outform pem \
>> >>>> private/strongswanKey.pem
>> >>> $ chmod 600 private/strongswanKey.pem
>> >>> $ ipsec pki --self --ca --lifetime 3650 \
>> >>> --in private/strongswanKey.pem --type rsa \
>> >>> --dn "C=CH, O=strongSwan, CN=strongSwan Root CA" \
>> >>> --outform pem \
>> >>>> cacerts/strongswanCert.pem
>> >>>
>> >>> vpnHostKey/Cert:
>> >>>
>> >>> $ cd /etc/ipsec.d/
>> >>> $ ipsec pki --gen --type rsa --size 2048 \
>> >>> --outform pem \
>> >>>> private/vpnHostKey.pem
>> >>> $ chmod 600 private/vpnHostKey.pem
>> >>> $ ipsec pki --pub --in private/vpnHostKey.pem --type rsa | \
>> >>> ipsec pki --issue --lifetime 730 \
>> >>> --cacert cacerts/strongswanCert.pem \
>> >>> --cakey private/strongswanKey.pem \
>> >>> --dn "C=CH, O=strongSwan, CN=vpn.example.com" \
>> >>> --san vpn.example.com \
>> >>> --flag serverAuth --flag ikeIntermediate \
>> >>> --outform pem > certs/vpnHostCert.pem
>> >>>
>> >>> Client cert/key:
>> >>>
>> >>> $ cd /etc/ipsec.d/
>> >>> $ ipsec pki --gen --type rsa --size 2048 \
>> >>> --outform pem \
>> >>>> private/moiKey.pem
>> >>> $ chmod 600 private/moiKey.pem
>> >>> $ ipsec pki --pub --in private/moiKey.pem --type rsa | \
>> >>> ipsec pki --issue --lifetime 730 \
>> >>> --cacert cacerts/strongswanCert.pem \
>> >>> --cakey private/strongswanKey.pem \
>> >>> --dn "C=CH, O=strongSwan, CN=moi" \
>> >>> --san moi \
>> >>> --outform pem > certs/moiCert.pem
>> >>>
>> >>> ("moi" is just a standin for my personal uid)
>> >>>
>> >>> ipsec.conf (note that this email client is munging the tabs, but ipsec
>> >>> reload is perfectly happy with this conf file's syntax)
>> >>>
>> >>> config setup
>> >>> # uniqueids=never
>> >>> charondebug="cfg 2, dmn 2, ike 2, net 2"
>> >>>
>> >>> conn %default
>> >>> ikelifetime=60m
>> >>> keylife=20m
>> >>> rekeymargin=3m
>> >>> keyingtries=1
>> >>> #note iOS, Android, xauth-pam are all ikev1!
>> >>> keyexchange=ike
>> >>>
>> >>> conn roadwarrior
>> >>> #vpn server
>> >>> left=xxx.xxx.xxx.xxx
>> >>> #allow full tunneling
>> >>> leftsubnet=0.0.0.0/0
>> >>> right=%any
>> >>> rightauth=pubkey
>> >>> #assign ip addr from this pool
>> >>> rightsourceip=xxx.xx.xx.0/24
>> >>> auto=add
>> >>> _______________________________________________
>> >>> Users mailing list
>> >>> Users at lists.strongswan.org
>> >>> https://lists.strongswan.org/mailman/listinfo/users
>>
>>>
>>> _______________________________________________
>>> Users mailing list
>>> Users at lists.strongswan.org
>>> https://lists.strongswan.org/mailman/listinfo/users
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2
>
> iQIcBAEBCAAGBQJUFJKLAAoJEDg5KY9j7GZYsjYP+wdUifzWcfnRHehkVIFdgxb5
> uJ8GgMDY6wPSReZ24dHqAVCjJVPa+38lDbIrG0/5G78safsbPYLKbuBwtPNVPfWq
> UVMG9zjWLMxxu7IelnjKSQR6N0N3JcpTas9X5J5lSV5NX5nStHrgXtC3H9T4UYT0
> +vjg1sUrmZ5V1K7zLrK5qKzo2Bdzq9p3+feiyhAV05g2I1iArERBm3dBfftymGI3
> qHwaU2DCNRBYzUv7htzm7/jy9g+zG1b+dLDLLYkQkkShBuLknDJFaAOjZFdjRO/E
> iWpWD03O+01ErphDkLtgg/t6tT56wCthbvsKlsUo3ycDcLYj6rvwHXA7Jesc0hOn
> rZSww6PHkxsloHOlExMI1Yss+FetUibnVue8Wkk1SbGyEAA7fLE8KrKNiAvXrA0e
> O6G/xgycXiQLEZyjfOWnVhJZ5z2KhSxTx0y7p8NdjE2/rn0IvgOw9kj8imkPJ2pb
> FwfxPfL/DmQ43kLvJzurJ/AIqdDu8N5vIEPu2MFsrdpy8VnZOytUmagB7v9DRqth
> ivHmY+RatFvnhS4h6mKTUSK0WoE4HvMEZsLtsSNH8uOpnkNbbOOm/JG5wtpRCjag
> GtptIzJoSY2QCHluN8iIjGJcppcq4mtg5RR4e8vMCZiqaTvIiFuT8RvMs1y/6+Js
> P0APsohzwcsAudAAh5i1
> =zUBr
> -----END PGP SIGNATURE-----
>
>
More information about the Users
mailing list