denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Updated and corrected the ipsec(8) manual page.

Browse Source
This commit is contained in:
Tobias Brunner
2010-05-30 12:29:18 +02:00
parent d9c751daac
commit 28550caaa8
1 changed files with 166 additions and 205 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/ipsec/ipsec.8
+166 -205
View File
@@ -1,128 +1,23 @@
.TH IPSEC 8 "9 February 2006" .TH IPSEC 8 "2010-05-30"
.SH NAME .SH NAME
ipsec \- invoke IPsec utilities ipsec \- invoke IPsec utilities
.SH SYNOPSIS .SH SYNOPSIS
.B ipsec .B ipsec
command [ argument ...] \fIcommand\fP [ \fIarguments\fP ] [ \fIoptions\fP ]
.sp .PP
.B ipsec start|update|reload|restart|stop
.sp
.B ipsec up|down|route|unroute
\fIconnectionname\fP
.sp
.B ipsec status|statusall
[
\fIconnectionname\fP
]
.sp
.B ipsec listalgs|listpubkeys|listcerts
[
.B \-\-utc
]
.br
.B ipsec listcacerts|listaacerts|listocspcerts
[
.B \-\-utc
]
.br
.B ipsec listacerts|listgroups|listcainfos
[
.B \-\-utc
]
.br
.B ipsec listcrls|listocsp|listcards|listall
[
.B \-\-utc
]
.sp
.B ipsec rereadsecrets|rereadgroups
.br
.B ipsec rereadcacerts|rereadaacerts|rereadocspcerts
.br
.B ipsec rereadacerts|rereadcrls|rereadall
.sp
.B ipsec purgeocsp
.sp
.B ipsec
[
.B \-\-help
] [
.B \-\-version
] [
.B \-\-versioncode
] [
.B \-\-copyright
]
.br
.B ipsec
[
.B \-\-directory
] [
.B \-\-confdir
]
.SH DESCRIPTION .SH DESCRIPTION
.I Ipsec The
invokes any of several utilities involved in controlling the IPsec .B ipsec
encryption/authentication system, utility invokes any of several utilities involved in controlling and monitoring
running the specified the IPsec encryption/authentication system, running the specified \fIcommand\fP
.I command with the specified \fIarguments\fP and \fIoptions\fP as if it had been invoked
with the specified directly. This largely eliminates possible name collisions with other software,
.IR argument s
as if it had been invoked directly.
This largely eliminates possible name collisions with other software,
and also permits some centralized services. and also permits some centralized services.
.PP .PP
The commands All the commands described in this manual page are built-in and are used to
.BR start , control and monitor IPsec connections as well as the IKE daemons.
.BR update ,
.BR reload ,
.BR restart ,
and
.BR stop
are built-in and are used to control the
.BR "ipsec starter"
utility, an extremely fast replacement for the traditional
.BR ipsec
.BR setup
script.
.PP .PP
The commands For other commands
.BR up,
.BR down,
.BR route,
.BR unroute,
.BR status,
.BR statusall,
.BR listalgs,
.BR listpubkeys,
.BR listcerts,
.BR listcacerts,
.BR listaacerts,
.BR listocspcerts,
.BR listacerts,
.BR listgroups,
.BR listcainfos,
.BR listcrls,
.BR listocsp,
.BR listcards,
.BR listall,
.BR rereadsecrets,
.BR rereadgroups,
.BR rereadcacerts,
.BR rereadaacerts,
.BR rereadocspcerts,
.BR rereadacerts,
.BR rereadcrls,
and
.BR rereadall
are also built-in and completely replace the corresponding
.BR "ipsec auto"
\-\-\fIoperation\fP"
commands. Communication with the pluto daemon happens via the
.BR "ipsec whack"
socket interface.
.PP
In particular,
.I ipsec .I ipsec
supplies the invoked supplies the invoked
.I command .I command
@@ -134,173 +29,243 @@ the full pathname of the directory where the IPsec utilities are stored,
the full pathname of the directory where the configuration files live, the full pathname of the directory where the configuration files live,
and the IPsec version number. and the IPsec version number.
.PP .PP
.B "ipsec start" .SS CONTROL COMMANDS
.TP
.B "ipsec start [ starter options ]"
calls calls
.BR "ipsec starter" .BR "ipsec starter"
which in turn starts \fIpluto\fR. which in turn parses \fIipsec.conf\fR and starts the IKEv1 \fIpluto\fR and
IKEv2 \fIcharon\fR daemons.
.PP .PP
.TP
.B "ipsec update" .B "ipsec update"
sends a \fIHUP\fR signal to sends a \fIHUP\fR signal to
.BR "ipsec starter" .BR "ipsec starter"
which in turn determines any changes in \fIipsec.conf\fR which in turn determines any changes in \fIipsec.conf\fR
and updates the configuration on the running \fIpluto\fR daemon, correspondingly. and updates the configuration on the running IKEv1 \fIpluto\fR and IKEv2
\fIcharon\fR daemons, correspondingly.
.PP .PP
.TP
.B "ipsec reload" .B "ipsec reload"
sends a \fIUSR1\fR signal to sends a \fIUSR1\fR signal to
.BR "ipsec starter" .BR "ipsec starter"
which in turn reloads the whole configuration on the running \fIpluto\fR daemon which in turn reloads the whole configuration on the running IKEv1 \fIpluto\fR
based on the actual \fIipsec.conf\fR. and IKEv2 \fIcharon\fR daemons based on the actual \fIipsec.conf\fR.
.PP .PP
.TP
.B "ipsec restart" .B "ipsec restart"
executes is equivalent to
.B "ipsec stop" .B "ipsec stop"
followed by followed by
.BR "ipsec start". .B "ipsec start"
after a guard of 2 seconds.
.PP .PP
.TP
.B "ipsec stop" .B "ipsec stop"
stops \fIipsec\fR by sending a \fITERM\fR signal to terminates all IPsec connections and stops the IKEv1 \fIpluto\fR and IKEv2
\fIcharon\fR daemons by sending a \fITERM\fR signal to
.BR "ipsec starter". .BR "ipsec starter".
.PP .PP
.B "ipsec up" .TP
\fIname\fP tells the \fIpluto\fP daemon to start up connection \fIname\fP. .B "ipsec up \fIname\fP"
tells the responsible IKE daemon to start up connection \fIname\fP.
.PP .PP
.B "ipsec down" .TP
\fIname\fP tells the \fIpluto\fP daemon to take down connection \fIname\fP. .B "ipsec down \fIname\fP"
tells the responsible IKE daemon to terminate connection \fIname\fP.
.PP .PP
.B "ipsec route" .TP
\fIname\fP tells the \fIpluto\fP daemon to install a route for connection .B "ipsec down \fIname{n}\fP"
\fIname\fP. terminates IKEv2 CHILD SA instance \fIn\fP of connection \fIname\fP.
.PP .PP
.B "ipsec unroute" .TP
\fIname\fP tells the \fIpluto\fP daemon to take down the route for connection .B "ipsec down \fIname{*}\fP"
\fIname\fP. terminates all IKEv2 CHILD SA instances of connection \fIname\fP.
.PP .PP
.B "ipsec status" .TP
[ \fIname\fP ] gives concise status information either on connection .B "ipsec down \fIname[n]\fP"
\fIname\fP or if the \fIname\fP argument is lacking, on all connections. terminates all IKEv2 IKE SA instance \fIn\fP of connection \fIname\fP.
.PP .PP
.B "ipsec statusall" .TP
[ \fIname\fP ] gives detailed status information either on connection .B "ipsec down \fIname[*]\fP"
\fIname\fP or if the \fIname\fP argument is lacking, on all connections. terminates all IKEv2 IKE SA instances of connection \fIname\fP.
.PP .PP
.TP
.B "ipsec route \fIname\fP"
tells the responsible IKE daemon to insert an IPsec policy in the kernel
for connection \fIname\fP. The first payload packet matching the IPsec policy
will automatically trigger an IKE connection setup.
.PP
.TP
.B "ipsec unroute \fIname\fP"
remove the IPsec policy in the kernel for connection \fIname\fP.
.PP
.TP
.B "ipsec status [ \fIname\fP ]"
returns concise status information either on connection
\fIname\fP or if the argument is lacking, on all connections.
.PP
.TP
.B "ipsec statusall [ \fIname\fP ]"
returns detailed status information either on connection
\fIname\fP or if the argument is lacking, on all connections.
.PP
.SS LIST COMMANDS
.TP
.B "ipsec listalgs" .B "ipsec listalgs"
returns a list all supported IKE encryption and hash algorithms, the available returns a list all supported IKE encryption and hash algorithms, the available
Diffie-Hellman groups, as well as all supported ESP encryption and authentication Diffie-Hellman groups, as well as all supported ESP encryption and
algorithms. authentication algorithms registered via the Linux kernel's Crypto API.
.br
Supported by the IKEv1 \fIpluto\fP daemon only.
.PP .PP
.B "ipsec listpubkeys" .TP
.B "ipsec listpubkeys [ --utc ]"
returns a list of RSA public keys that were either loaded in raw key format returns a list of RSA public keys that were either loaded in raw key format
or extracted from X.509 and|or OpenPGP certificates. or extracted from X.509 and|or OpenPGP certificates.
.br
Supported by the IKEv1 \fIpluto\fP daemon only.
.PP .PP
.B "ipsec listcerts" .TP
returns a list of X.509 and|or OpenPGP certificates that were loaded locally .B "ipsec listcerts [ --utc ]"
by the \fIpluto\fP daemon. returns a list of X.509 and|or OpenPGP certificates that were either loaded
locally by the IKE daemon or received via the IKEv2 protocol.
.PP .PP
.B "ipsec listcacerts" .TP
.B "ipsec listcacerts [ --utc ]"
returns a list of X.509 Certification Authority (CA) certificates that were returns a list of X.509 Certification Authority (CA) certificates that were
loaded locally by the \fIpluto\fP daemon from the \fI/etc/ipsec.d/cacerts/\fP loaded locally by the IKE daemon from the \fI/etc/ipsec.d/cacerts/\fP
directory or received in PKCS#7-wrapped certificate payloads via the IKE directory or received in PKCS#7-wrapped certificate payloads via the IKE
protocol. protocol.
.PP .PP
.B "ipsec listaacerts" .TP
.B "ipsec listaacerts [ --utc ]"
returns a list of X.509 Authorization Authority (AA) certificates that were returns a list of X.509 Authorization Authority (AA) certificates that were
loaded locally by the \fIpluto\fP daemon from the \fI/etc/ipsec.d/aacerts/\fP loaded locally by the IKE daemon from the \fI/etc/ipsec.d/aacerts/\fP
directory. directory.
.PP .PP
.B "ipsec listocspcerts" .TP
.B "ipsec listocspcerts [ --utc ]"
returns a list of X.509 OCSP Signer certificates that were either loaded returns a list of X.509 OCSP Signer certificates that were either loaded
locally by the \fIpluto\fP daemon from the \fI/etc/ipsec.d/ocspcerts/\fP locally by the IKE daemon from the \fI/etc/ipsec.d/ocspcerts/\fP
directory or were sent by an OCSP server. directory or were sent by an OCSP server.
.PP .PP
.B "ipsec listacerts" .TP
.B "ipsec listacerts [ --utc ]"
returns a list of X.509 Attribute certificates that were loaded locally by returns a list of X.509 Attribute certificates that were loaded locally by
the \fIpluto\fP daemon from the \fI/etc/ipsec.d/acerts/\fP directory. the IKE daemon from the \fI/etc/ipsec.d/acerts/\fP directory.
.PP .PP
.B "ipsec listgroups" .TP
.B "ipsec listgroups [ --utc ]"
returns a list of groups that are used to define user authorization profiles. returns a list of groups that are used to define user authorization profiles.
.br
Supported by the IKEv1 \fIpluto\fP daemon only.
.PP .PP
.B "ipsec listcainfos" .TP
.B "ipsec listcainfos [ --utc ]"
returns certification authority information (CRL distribution points, OCSP URIs, returns certification authority information (CRL distribution points, OCSP URIs,
LDAP servers) that were defined by LDAP servers) that were defined by
.BR ca .BR ca
sections in \fIipsec.conf\fP. sections in \fIipsec.conf\fP.
.PP .PP
.B "ipsec listcrls" .TP
returns a list of Certificate Revocation Lists (CRLs). .B "ipsec listcrls [ --utc ]"
returns a list of Certificate Revocation Lists (CRLs) that were either loaded
by the IKE daemon from the \fI/etc/ipsec.d/crls\fP directory or fetched from
an HTTP- or LDAP-based CRL distribution point.
.PP .PP
.B "ipsec listocsp" .TP
.B "ipsec listocsp [ --utc ]"
returns revocation information fetched from OCSP servers. returns revocation information fetched from OCSP servers.
.PP .PP
.B "ipsec listcards" .TP
returns a list of certificates residing on smartcards. .B "ipsec listcards [ --utc ]"
list all certificates found on attached smart cards.
.br
Supported by the IKEv1 \fIpluto\fP daemon only.
.PP .PP
.B "ipsec listall" .TP
.B "ipsec listall [ --utc ]"
returns all information generated by the list commands above. Each list command returns all information generated by the list commands above. Each list command
can be called with the can be called with the
\-\-url \fB\-\-utc\fP
option which displays all dates in UTC instead of local time. option which displays all dates in UTC instead of local time.
.PP .PP
.SS REREAD COMMANDS
.TP
.B "ipsec rereadsecrets" .B "ipsec rereadsecrets"
flushes and rereads all secrets defined in \fIipsec.conf\fP. flushes and rereads all secrets defined in \fIipsec.secrets\fP.
.PP .PP
.TP
.B "ipsec rereadcacerts" .B "ipsec rereadcacerts"
reads all certificate files contained in the \fI/etc/ipsec.d/cacerts\fP reads all certificate files contained in the \fI/etc/ipsec.d/cacerts\fP
directory and adds them to \fIpluto\fP's list of Certification Authority (CA) certificates. directory and adds them to the list of Certification Authority (CA)
certificates.
.PP .PP
.TP
.B "ipsec rereadaacerts" .B "ipsec rereadaacerts"
reads all certificate files contained in the \fI/etc/ipsec.d/aacerts\fP reads all certificate files contained in the \fI/etc/ipsec.d/aacerts\fP
directory and adds them to \fIpluto\fP's list of Authorization Authority (AA) certificates. directory and adds them to the list of Authorization Authority (AA)
certificates.
.PP .PP
.TP
.B "ipsec rereadocspcerts" .B "ipsec rereadocspcerts"
reads all certificate files contained in the \fI/etc/ipsec.d/ocspcerts/\fP reads all certificate files contained in the \fI/etc/ipsec.d/ocspcerts/\fP
directory and adds them to \fIpluto\fP's list of OCSP signer certificates. directory and adds them to the list of OCSP signer certificates.
.PP .PP
.TP
.B "ipsec rereadacerts" .B "ipsec rereadacerts"
operation reads all certificate files contained in the \fI/etc/ipsec.d/acerts/\fP reads all certificate files contained in the \fI/etc/ipsec.d/acerts/\fP
directory and adds them to \fIpluto\fP's list of attribute certificates. directory and adds them to the list of attribute certificates.
.PP .PP
.TP
.B "ipsec rereadcrls" .B "ipsec rereadcrls"
reads all Certificate Revocation Lists (CRLs) contained in the reads all Certificate Revocation Lists (CRLs) contained in the
\fI/etc/ipsec.d/crls/\fP directory and adds them to \fIpluto\fP's list of CRLs. \fI/etc/ipsec.d/crls/\fP directory and adds them to the list of CRLs.
.PP .PP
.TP
.B "ipsec rereadall" .B "ipsec rereadall"
is equivalent to the execution of \fBrereadsecrets\fP, executes all reread commands listed above.
\fBrereadcacerts\fP, \fBrereadaacerts\fP, \fBrereadocspcerts\fP,
\fBrereadacerts\fP, and \fBrereadcrls\fP.
.PP .PP
.SS PURGE COMMANDS
.TP
.B "ipsec purgeike"
purges IKEv2 SAs that don't have a CHILD SA.
.PP
.TP
.B "ipsec purgeocsp"
purges all cached OCSP information records.
.PP
.SS INFO COMMANDS
.TP
.B "ipsec \-\-help" .B "ipsec \-\-help"
lists the available commands. returns the usage information for the ipsec command.
Most have their own manual pages, e.g.
.IR ipsec_auto (8)
for
.IR auto .
.PP .PP
.TP
.B "ipsec \-\-version" .B "ipsec \-\-version"
outputs version information about Linux strongSwan. returns the version in the form of
A version code of the form ``U\fIxxx\fR/K\fIyyy\fR'' .B Linux strongSwan U<strongSwan userland version>/K<Linux kernel version>
indicates that the user-level utilities are version \fIxxx\fR if strongSwan uses the native NETKEY IPsec stack of the Linux kernel it is
but the kernel portion appears to be version \fIyyy\fR running on.
(this form is used only if the two disagree).
.PP .PP
.TP
.B "ipsec \-\-versioncode" .B "ipsec \-\-versioncode"
outputs \fIjust\fR the version code, returns the version number in the form of
with none of .B U<strongSwan userland version>/K<Linux kernel version>
.BR \-\-version 's if strongSwan uses the native NETKEY IPsec stack of the Linux kernel it is
supporting information, running on.
for use by scripts.
.PP .PP
.TP
.B "ipsec \-\-copyright" .B "ipsec \-\-copyright"
supplies boring copyright details. returns the copyright information.
.PP .PP
.TP
.B "ipsec \-\-directory" .B "ipsec \-\-directory"
reports where returns the \fILIBEXECDIR\fP directory as defined by the configure options.
.I ipsec
thinks the IPsec utilities are stored.
.PP .PP
.TP
.B "ipsec \-\-confdir" .B "ipsec \-\-confdir"
reports where returns the \fISYSCONFDIR\fP directory as defined by the configure options.
.I ipsec
thinks the IPsec configuration files are stored.
.SH FILES .SH FILES
/usr/local/lib/ipsec usual utilities directory /usr/local/lib/ipsec usual utilities directory
.SH ENVIRONMENT .SH ENVIRONMENT
@@ -327,15 +292,11 @@ IPSEC_CHARON_PID PID file for IKEv2 keying daemon
.SH SEE ALSO .SH SEE ALSO
.hy 0 .hy 0
.na .na
ipsec.conf(5), ipsec.secrets(5), ipsec.conf(5), ipsec.secrets(5)
ipsec_barf(8),
.ad .ad
.hy .hy
.PP .PP
.SH HISTORY .SH HISTORY
Written for Linux FreeS/WAN Originally written for the FreeS/WAN project by Henry Spencer.
<http://www.freeswan.org> Updated and extended for the strongSwan project <http://www.strongswan.org> by
by Henry Spencer. Tobias Brunner and Andreas Steffen.
Updated and extended for Linux strongSwan
<http://www.strongswan.org>
by Andreas Steffen.