[Comm] slackware 10 + freeswan + altllinux 2.4 + openswan
Vitaly Gorshkov
=?iso-8859-1?q?vita55555_=CE=C1_mail=2Eru?=
Пт Окт 14 09:32:48 MSD 2005
есть два Slackware 10, между ними freeswan,
в ipsec.conf написано version 2.0 - вроде как формат версии
конфигурационных файлов.
тут http://www.opennet.ru/base/net/ipsec_opnswan_howto.txt.html, написано:
"
что использовали пакет: "Скачиваем последний стабильный пакет системы OpenS/WAN, в моем случае
это 2.3.1."
"
на АМ 2.4:
rpm -qa|grep swan
openswan-libdes-1.0.9-alt0.M24.1
openswan-1.0.9-alt0.M24.1
это последняя версия? в ipsec.conf version 2.0 нету.
на Salckware:
rpm -qa - не проходит
- на Slackware сделал настройки для АМ 2.4
во что просиходит на АМ 2.4 ipsec setup restart
Oct 14 09:17:29 linux2 ipsec__plutorun: Starting Pluto subsystem...
Oct 14 09:17:29 linux2 pluto[31240]: Starting Pluto (Openswan Version 1.0.9)
Oct 14 09:17:29 linux2 pluto[31240]: including X.509 patch with traffic selectors (Version 0.9.42)
Oct 14 09:17:29 linux2 pluto[31240]: including NAT-Traversal patch (Version 0.6) [disabled]
Oct 14 09:17:29 linux2 pluto[31240]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)
Oct 14 09:17:29 linux2 pluto[31240]: ike_alg_register_enc(): Activating OAKLEY_BLOWFISH_CBC: Ok (ret=0)
Oct 14 09:17:29 linux2 pluto[31240]: ike_alg_register_enc(): Activating OAKLEY_CAST_CBC: Ok (ret=0)
Oct 14 09:17:29 linux2 pluto[31240]: ike_alg_register_enc(): Activating OAKLEY_SERPENT_CBC: Ok (ret=0)
Oct 14 09:17:29 linux2 pluto[31240]: ike_alg_register_hash(): Activating OAKLEY_SHA2_256: Ok (ret=0)
Oct 14 09:17:29 linux2 pluto[31240]: ike_alg_register_hash(): Activating OAKLEY_SHA2_512: Ok (ret=0)
Oct 14 09:17:29 linux2 pluto[31240]: ike_alg_register_enc(): Activating OAKLEY_TWOFISH_CBC: Ok (ret=0)
Oct 14 09:17:29 linux2 pluto[31240]: ike_alg_register_enc(): Activating OAKLEY_SSH_PRIVATE_65289: Ok (ret=0)
Oct 14 09:17:29 linux2 pluto[31240]: Changing to directory '/etc/openswan/ipsec.d/cacerts'
Oct 14 09:17:29 linux2 pluto[31240]: Warning: empty directory
Oct 14 09:17:29 linux2 pluto[31240]: Changing to directory '/etc/openswan/ipsec.d/crls'
Oct 14 09:17:29 linux2 pluto[31240]: Warning: empty directory
Oct 14 09:17:30 linux2 pluto[31240]: OpenPGP certificate file '/etc/pgpcert.pgp' not found
Oct 14 09:17:30 linux2 pluto[31240]: | from whack: got --esp=3des
Oct 14 09:17:30 linux2 pluto[31240]: | from whack: got --ike=3des
Oct 14 09:17:30 linux2 pluto[31240]: added connection description "ru-prag"
Oct 14 09:17:30 linux2 pluto[31240]: listening for IKE messages
Oct 14 09:17:30 linux2 pluto[31240]: adding interface ipsec1/ppp0
ххх.ххх.ххх.ххх
Oct 14 09:17:30 linux2 pluto[31240]: loading secrets from "/etc/openswan/ipsec.secrets"
ключи сгенерил ipsec rsasigkey 1936 + добавил ": RSA { }"
вот что показывает ipsec auto --status
000 interface ipsec1/ppp0 xxx.xxx.xxx.xxx
000
000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=64, keysizemin=168, keysizemax=168
000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128
000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160
000
000 algorithm IKE encrypt: id=65289, name=OAKLEY_SSH_PRIVATE_65289, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: id=65005, name=OAKLEY_TWOFISH_CBC, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: id=65004, name=OAKLEY_SERPENT_CBC, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: id=6, name=OAKLEY_CAST_CBC, blocksize=8, keydeflen=128
000 algorithm IKE encrypt: id=3, name=OAKLEY_BLOWFISH_CBC, blocksize=8, keydeflen=128
000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192
000 algorithm IKE hash: id=6, name=OAKLEY_SHA2_512, hashsize=64
000 algorithm IKE hash: id=4, name=OAKLEY_SHA2_256, hashsize=32
000 algorithm IKE hash: id=2, name=OAKLEY_SHA, hashsize=20
000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16
000 algorithm IKE dh group: id=1, name=OAKLEY_GROUP_MODP768, bits=768
000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024
000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536
000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048
000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072
000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096
000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144
000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192
000
000 stats db_ops.c: {curr_cnt, total_cnt, maxsz} :context={0,0,0} trans={0,0,0} attrs={0,0,0}
000
000 "ru-prag":
172.16.0.0/24===xxx.xx.x.xx---xxx.xx.xx.xxx...xx.xx.xxx.xxx---xx.xx.xxx.xxx===192.168.2.0/24
000 "ru-prag": CAs: '%any'...'%any'
000 "ru-prag": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 10
000 "ru-prag": policy: PSK+ENCRYPT+TUNNEL+PFS+DISABLEARRIVALCHECK; interface: ; unrouted
000 "ru-prag": newest ISAKMP SA: #0; newest IPsec SA: #0; eroute owner: #0
000 "ru-prag": IKE algorithms wanted: 5_000-1-5, 5_000-2-5, 5_000-1-2, 5_000-2-2, 5_000-1-1, 5_000-2-1, flags=-strict
000 "ru-prag": IKE algorithms found: 5_192-1_128-5, 5_192-2_160-5, 5_192-1_128-2, 5_192-2_160-2, 5_192-1_128-1, 5_192-2_160-1,
000 "ru-prag": ESP algorithms wanted: 3_000-1, 3_000-2, flags=-strict
000 "ru-prag": ESP algorithms loaded: 3_168-1_128, 3_168-2_160,
000
000
АМ 2.4 ipsec.conf
config setup
interfaces="ipsec1=ppp0"
klipsdebug=none
plutodebug=none
plutoload=%search
plutostart=%search
plutowait=no
uniqueids=yes
conn ru-prag
auth=esp
type=tunnel
keyingtries=10
authby=secret
left=ххх.хх.х.хх
leftsubnet=172.16.0.0/24
leftnexthop=ххх.хх.хх.ххх
right=хх.хх.ххх.ххх
rightsubnet=192.168.2.0/24
rightnexthop=хх.хх.ххх.ххх
spi=0x300
auto=add
ifconfig
...
ipsec1 Link encap:Point-to-Point Protocol
inet addr:ххх.хх.хх.ххх Mask:255.255.255.255
UP RUNNING NOARP MTU:16260 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:10
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
....
1) можно ли подружить freeswan и openswan, где то читал что openswan
-это продолжении freeswan, из-за американских законов..
2) версия openswan на АМ 2.4 свежая? может делов ней?
3) или настройки ?
--
С уважением,
Vitaly mailto:vita55555 на mail.ru
icq: 138491970
Подробная информация о списке рассылки community