ipsec.conf.5

来自「ipsec vpn」· 5 代码 · 共 1,431 行 · 第 1/3 页

a single
\fIvirtual\fB=\fIphysical\fR pair, a (quoted!) list of pairs separated
by white space, or
.BR %none .
One of the pairs may be written as
.BR %defaultroute ,
which means: find the interface \fId\fR that the default route points to,
and then act as if the value was ``\fBipsec0=\fId\fR''.
.B %defaultroute
is the default;
.B %none
must be used to denote no interfaces.
If
.B %defaultroute
is used (implicitly or explicitly)
information about the default route and its interface is noted for
use by
.IR ipsec_manual (8)
and
.IR ipsec_auto (8).)
.TP
.B forwardcontrol
whether
.I setup
should turn IP forwarding on
(if it's not already on) as IPsec is started,
and turn it off again (if it was off) as IPsec is stopped;
acceptable values are
.B yes
and (the default)
.BR no .
For this to have full effect, forwarding must be
disabled before the hardware interfaces are brought
up (e.g.,
.B "net.ipv4.ip_forward\ =\ 0"
in Red Hat 6.x
.IR /etc/sysctl.conf ),
because IPsec doesn't get control early enough to do that.

.TP
.B rp_filter
whether and how
.I setup
should adjust the reverse path filtering mechanism for the
physical devices to be used.
Values are \fB%unchanged\fP (to leave it alone)
or \fB0\fP, \fB1\fP, \fB2\fP (values to set it to).
\fI/proc/sys/net/ipv4/conf/PHYS/rp_filter\fP
is badly documented; it must be \fB0\fP in many cases
for ipsec to function.
The default value for the parameter is \fB0\fP.

.TP
.B syslog
the
.IR syslog (2)
``facility'' name and priority to use for
startup/shutdown log messages,
default
.BR daemon.error .

.TP
.B klipsdebug
how much KLIPS debugging output should be logged.
An empty value,
or the magic value
.BR none ,
means no debugging output (the default).
The magic value
.B all
means full output.
Otherwise only the specified types of output
(a quoted list, names separated by white space) are enabled;
for details on available debugging types, see
.IR ipsec_klipsdebug (8).

.TP
.B plutodebug
how much Pluto debugging output should be logged.
An empty value,
or the magic value
.BR none ,
means no debugging output (the default).
The magic value
.B all
means full output.
Otherwise only the specified types of output
(a quoted list, names without the
.B \-\-debug\-
prefix,
separated by white space) are enabled;
for details on available debugging types, see
.IR ipsec_pluto (8).

.TP
.B plutoopts
additional options to pass to pluto upon startup. See
.IR ipsec_pluto (8).
.TP
.B plutostderrlog
do not use syslog, but rather log to stderr, and direct stderr to the
argument file.

.TP
.B dumpdir
in what directory should things started by
.I setup
(notably the Pluto daemon) be allowed to
dump core?
The empty value (the default) means they are not
allowed to.

.TP
.B manualstart
which manually-keyed connections to set up at startup
(empty, a name, or a quoted list of names separated by white space);
see
.IR ipsec_manual (8).
Default is none.

.TP
.B pluto
whether to start Pluto or not;
Values are
.B yes
(the default)
or
.B no
(useful only in special circumstances).

.TP
.B plutowait
should Pluto wait for each
negotiation attempt that is part of startup to
finish before proceeding with the next?
Values are
.B yes
or
.BR no
(the default).

.TP
.B prepluto
shell command to run before starting Pluto
(e.g., to decrypt an encrypted copy of the
.I ipsec.secrets
file).
It's run in a very simple way;
complexities like I/O redirection are best hidden within a script.
Any output is redirected for logging,
so running interactive commands is difficult unless they use
.I /dev/tty
or equivalent for their interaction.
Default is none.

.TP
.B postpluto
shell command to run after starting Pluto
(e.g., to remove a decrypted copy of the
.I ipsec.secrets
file).
It's run in a very simple way;
complexities like I/O redirection are best hidden within a script.
Any output is redirected for logging,
so running interactive commands is difficult unless they use
.I /dev/tty
or equivalent for their interaction.
Default is none.

.TP
.B fragicmp
whether a tunnel's need to fragment a packet should be reported
back with an ICMP message,
in an attempt to make the sender lower his PMTU estimate;
acceptable values are
.B yes
(the default)
and
.BR no .

.TP
.B hidetos
whether a tunnel packet's TOS field should be set to
.B 0
rather than copied from the user packet inside;
acceptable values are
.B yes
(the default)
and
.BR no .

.TP
.B uniqueids
whether a particular participant ID should be kept unique,
with any new (automatically keyed)
connection using an ID from a different IP address
deemed to replace all old ones using that ID;
acceptable values are
.B yes
(the default)
and
.BR no .
Participant IDs normally \fIare\fR unique,
so a new (automatically-keyed) connection using the same ID is
almost invariably intended to replace an old one.

.TP
.B overridemtu
value that the MTU of the ipsec\fIn\fR interface(s) should be set to,
overriding IPsec's (large) default.
This parameter is needed only in special situations.

.TP
.B nat_traversal
whether to accept/offer to support NAT (NAPT, also known as "IP Masqurade")
workaround for IPsec. Acceptable values are:
.B yes
and
.BR no 
(the default).
This parameter may eventually become per-connection.

.SH "IMPLICIT CONNS"
.PP
The system automatically defines several conns to implement
default policy groups.  Each can be overridden by explicitly
defining a new conn with the same name.  If the new conn has \fBauto=ignore\fP,
the definition is suppressed.
.PP
Here are the automatically supplied definitions.
.PP
.ne 8
.nf
.ft B
.ta 1c
conn clear
	type=passthrough
	authby=never
	left=%defaultroute
	right=%group
	auto=route

conn clear-or-private
	type=passthrough
	left=%defaultroute
	leftid=%myid
	right=%opportunisticgroup
	failureshunt=passthrough
	keyingtries=3
	ikelifetime=1h
	keylife=1h
	rekey=no
	auto=route

conn private-or-clear
	type=tunnel
	left=%defaultroute
	leftid=%myid
	right=%opportunisticgroup
	failureshunt=passthrough
	keyingtries=3
	ikelifetime=1h
	keylife=1h
	rekey=no
	auto=route

conn private
	type=tunnel
	left=%defaultroute
	leftid=%myid
	right=%opportunisticgroup
	failureshunt=drop
	keyingtries=3
	ikelifetime=1h
	keylife=1h
	rekey=no
	auto=route

conn block
	type=reject
	authby=never
	left=%defaultroute
	right=%group
	auto=route

# default policy
conn packetdefault
	type=tunnel
	left=%defaultroute
	leftid=%myid
	left=0.0.0.0/0
	right=%opportunistic
	failureshunt=passthrough
	keyingtries=3
	ikelifetime=1h
	keylife=1h
	rekey=no
	auto=route
.ft
.fi
.PP
These conns are \fInot\fP affected by anything in \fBconn %default\fP.
They will only work if \fB%defaultroute\fP works.
The \fBleftid\fP will be the interfaces IP address; this
requires that reverse DNS records be set up properly.
.PP
The implicit conns are defined after all others.  It is
appropriate and reasonable to use \fBalso=private-or-clear\fP
(for example) in any other opportunistic conn.
.SH POLICY GROUP FILES
.PP
The optional files under 
.IR /etc/ipsec.d/policy ,
including
.nf

/etc/ipsec.d/policies/clear
/etc/ipsec.d/policies/clear-or-private
/etc/ipsec.d/policies/private-or-clear
/etc/ipsec.d/policies/private
/etc/ipsec.d/policies/block

.fi
may contain policy group configuration information to 
supplement 
.IR ipsec.conf .
Their contents are not security-sensitive.
.PP
These files are text files.
Each consists of a list of CIDR blocks, one per line.
White space followed by # followed by anything to the end of the line
is a comment and is ignored, as are empty lines.
.PP
A connection in
.I /etc/ipsec.conf
which has
.B right=%group
or 
.BR right=%opportunisticgroup 
is a policy group connection.
When a policy group file of the same name is loaded, with
.PP
\ \ \ \ \ \fBipsec auto --rereadgroups\fR 
.PP
or at system start, the connection is instantiated such that each
CIDR block serves as an instance's 
.B right
value. The system treats the
resulting instances as normal connections.
.PP
For example, given a suitable connection definition 
.BR private ,
and the file
.I /etc/ipsec.d/policy/private 
with an entry 192.0.2.3,
the system creates a connection instance 
.BR private#192.0.2.3.
This connection inherits all details from 
.BR private , 
except that its right client is 192.0.2.3.
.SH DEFAULT POLICY GROUPS
.PP
The standard Openswan install includes several policy groups
which provide a way of classifying possible peers into IPsec security classes:
.B private
(talk encrypted only),
.B private-or-clear
(prefer encryption),
.B clear-or-private
(respond to requests for encryption), 
.B clear
and
.BR block .
Implicit policy groups apply to the local host only,
and are implemented by the
.B IMPLICIT CONNECTIONS 
described above.
.SH CHOOSING A CONNECTION
.PP
When choosing a connection to apply to an outbound packet caught with a 
.BR %trap,
the system prefers the one with the most specific eroute that
includes the packet's source and destination IP addresses.
Source subnets are examined before destination subnets.
For initiating, only routed connections are considered. For responding,
unrouted but added connections are considered.
.PP
When choosing a connection to use to respond to a negotiation which
doesn't match an ordinary conn, an opportunistic connection
may be instantiated. Eventually, its instance will be /32 -> /32, but
for earlier stages of the negotiation, there will not be enough
information about the client subnets to complete the instantiation.
.SH FILES
.nf
/etc/ipsec.conf
/etc/ipsec.d/policies/clear
/etc/ipsec.d/policies/clear-or-private
/etc/ipsec.d/policies/private-or-clear
/etc/ipsec.d/policies/private
/etc/ipsec.d/policies/block
.fi
.SH SEE ALSO
ipsec(8), ipsec_ttoaddr(8), ipsec_auto(8), ipsec_manual(8), ipsec_rsasigkey(8)
.SH HISTORY
Designed for the FreeS/WAN project
<http://www.freeswan.org>
by Henry Spencer.
.SH BUGS
.PP
When
.B type
or 
.B failureshunt
is set to
.B drop
or
.BR reject,
Openswan blocks outbound packets using eroutes, but assumes inbound
blocking is handled by the firewall. Openswan offers firewall hooks 
via an ``updown'' script.  However, the default 
.B ipsec _updown
provides no help in controlling a modern firewall.
.PP
Including attributes of the keying channel
(authentication methods,
.BR ikelifetime ,
etc.)
as an attribute of a connection,
rather than of a participant pair, is dubious and incurs limitations.
.PP
.IR Ipsec_manual
is not nearly as generous about the syntax of subnets,
addresses, etc. as the usual Openswan user interfaces.
Four-component dotted-decimal must be used for all addresses.
It
.I is
smart enough to translate bit-count netmasks to dotted-decimal form.
.PP
It would be good to have a line-continuation syntax,
especially for the very long lines involved in
RSA signature keys.
.PP
The ability to specify different identities,
.BR authby ,
and public keys for different automatic-keyed connections
between the same participants is misleading;
this doesn't work dependably because the identity of the participants
is not known early enough.
This is especially awkward for the ``Road Warrior'' case,
where the remote IP address is specified as
.BR 0.0.0.0 ,
and that is considered to be the ``participant'' for such connections.
.PP
In principle it might be necessary to control MTU on an
interface-by-interface basis,
rather than with the single global override that
.B overridemtu
provides.
.PP
A number of features which \fIcould\fR be implemented in
both manual and automatic keying
actually are not yet implemented for manual keying.
This is unlikely to be fixed any time soon.
.PP
If conns are to be added before DNS is available,
\fBleft=\fP\fIFQDN\fP,
\fBleftnextop=\fP\fIFQDN\fP,
and
.B leftrsasigkey=%dnsonload
will fail.
.IR ipsec_pluto (8)
does not actually use the public key for our side of a conn but it
isn't generally known at a add-time which side is ours (Road Warrior
and Opportunistic conns are currently exceptions).
.PP
The \fBmyid\fP option does not affect explicit \fB ipsec auto \-\-add\fP or \fBipsec auto \-\-replace\fP commands for implicit conns.