denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

swanctl: Support private key decryption passhprases in swanctl.conf

Browse Source 
While there is no real security benefit of storing private keys encrypted if
the passphrase is stored along with it, there still seems to be demand for this
functionality. We add it for compatibility with ipsec.secrets, even if it is
not really recommended.
This commit is contained in:
Martin Willi
2014-06-17 17:52:14 +02:00
parent 28e0f9b57d
commit 19ea055092
2 changed files with 145 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/swanctl/swanctl.opt
+37 -4
View File
@@ -664,11 +664,17 @@ connections.<conn>.children.<child>.close_action = none
failures. Use trap policies to reliably re-create failed CHILD_SAs.
secrets { # }
Section defining secrets for IKE and EAP/XAuth authentication.
Section defining secrets for IKE/EAP/XAuth authentication and private
key decryption.
Section defining secrets for IKE and EAP/XAuth authentication. The
**secrets** section takes sub-sections having a specific prefix which
defines the secret type.
Section defining secrets for IKE/EAP/XAuth authentication and private key
decryption. The **secrets** section takes sub-sections having a specific
prefix which defines the secret type.
It is not recommended to define any private key decryption passphrases,
as then there is no real security benefit in having encrypted keys. Either
store the key unencrypted, or enter the keys manually when loading
credentials.
secrets.eap<suffix> { # }
EAP secret section for a specific secret.
@@ -718,6 +724,33 @@ secrets.ike<suffix>.id<suffix> =
may be specified, each having an _id_ prefix, if a secret is shared between
multiple peers.
secrets.rsa<suffix> { # }
Private key decryption passphrase for a key in the _rsa_ folder.
secrets.rsa<suffix>.file =
File name in the _rsa_ folder for which this passphrase should be used.
secrets.rsa<suffix>.secret
Value of decryption passphrase for RSA key.
secrets.ecdsa<suffix> { # }
Private key decryption passphrase for a key in the _ecdsa_ folder.
secrets.ecdsa<suffix>.file =
File name in the _ecdsa_ folder for which this passphrase should be used.
secrets.ecdsa<suffix>.secret
Value of decryption passphrase for ECDSA key.
secrets.pkcs8<suffix> { # }
Private key decryption passphrase for a key in the _pkcs8_ folder.
secrets.pkcs8<suffix>.file =
File name in the _pkcs8_ folder for which this passphrase should be used.
secrets.pkcs8<suffix>.secret
Value of decryption passphrase for PKCS#8 key.
pools { # }
Section defining named pools.