testing: Script building fresh certificates
This commit is contained in:
Andreas Steffen
committed by
Tobias Brunner
Tobias Brunner
parent
3ee352a691
commit
8db01c6a3f
@@ -7,5 +7,5 @@ dave::iptables-restore < /etc/iptables.flush
|
||||
moon::rm /etc/ipsec.d/acerts/carol-sales-finance.pem
|
||||
moon::rm /etc/ipsec.d/acerts/dave-sales-expired.pem
|
||||
moon::rm /etc/ipsec.d/acerts/dave-marketing.pem
|
||||
moon::rm /etc/ipsec.d/private/aa.pem
|
||||
moon::rm /etc/ipsec.d/aacerts/aa.pem
|
||||
moon::rm /etc/ipsec.d/private/aaKey.pem
|
||||
moon::rm /etc/ipsec.d/aacerts/aaCert.pem
|
||||
|
||||
@@ -1,23 +0,0 @@
|
||||
# Carols acert for sales and finance
|
||||
pki --acert \
|
||||
--issuercert hosts/moon/etc/ipsec.d/aacerts/aa.pem \
|
||||
--issuerkey hosts/moon/etc/ipsec.d/private/aa.pem \
|
||||
--in ../../../hosts/carol/etc/ipsec.d/certs/carolCert.pem \
|
||||
--group sales --group finance -l 87600 -f pem \
|
||||
> hosts/moon/etc/ipsec.d/acerts/carol-sales-finance.pem
|
||||
|
||||
# Daves acert for marketing
|
||||
pki --acert \
|
||||
--issuercert hosts/moon/etc/ipsec.d/aacerts/aa.pem \
|
||||
--issuerkey hosts/moon/etc/ipsec.d/private/aa.pem \
|
||||
--in ../../../hosts/dave/etc/ipsec.d/certs/daveCert.pem \
|
||||
--group marketing -l 87600 -f pem \
|
||||
> hosts/moon/etc/ipsec.d/acerts/dave-marketing.pem
|
||||
|
||||
# Daves expired acert for sales
|
||||
pki --acert \
|
||||
--issuercert hosts/moon/etc/ipsec.d/aacerts/aa.pem \
|
||||
--issuerkey hosts/moon/etc/ipsec.d/private/aa.pem \
|
||||
--in ../../../hosts/dave/etc/ipsec.d/certs/daveCert.pem \
|
||||
--group sales -F "01.01.13 08:00:00" -l 240 -f pem \
|
||||
> hosts/moon/etc/ipsec.d/acerts/dave-sales-expired.pem
|
||||
@@ -4,5 +4,5 @@ moon::iptables-restore < /etc/iptables.flush
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
carol::rm /etc/ipsec.d/acerts/carol-sales.pem
|
||||
carol::rm /etc/ipsec.d/acerts/carol-finance-expired.pem
|
||||
moon::rm /etc/ipsec.d/private/aa.pem
|
||||
moon::rm /etc/ipsec.d/aacerts/aa.pem
|
||||
moon::rm /etc/ipsec.d/private/aaKey.pem
|
||||
moon::rm /etc/ipsec.d/aacerts/aaCert.pem
|
||||
|
||||
@@ -1,15 +0,0 @@
|
||||
# Carols expired acert for finance
|
||||
pki --acert \
|
||||
--issuercert hosts/moon/etc/ipsec.d/aacerts/aa.pem \
|
||||
--issuerkey hosts/moon/etc/ipsec.d/private/aa.pem \
|
||||
--in ../../../hosts/carol/etc/ipsec.d/certs/carolCert.pem \
|
||||
--group finance -F "01.01.13 08:00:00" -l 240 -f pem \
|
||||
> ./hosts/carol/etc/ipsec.d/acerts/carol-finance-expired.pem
|
||||
|
||||
# Carols valid acert for sales
|
||||
pki --acert \
|
||||
--issuercert hosts/moon/etc/ipsec.d/aacerts/aa.pem \
|
||||
--issuerkey hosts/moon/etc/ipsec.d/private/aa.pem \
|
||||
--in ../../../hosts/carol/etc/ipsec.d/certs/carolCert.pem \
|
||||
--group sales -l 87600 -f pem \
|
||||
> hosts/carol/etc/ipsec.d/acerts/carol-sales.pem
|
||||
@@ -3,9 +3,9 @@ dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.s
|
||||
moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
|
||||
moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*[email protected]::NO
|
||||
moon::cat /var/log/daemon.log::constraint check failed: group membership to 'sales' required::YES
|
||||
carol::cat /var/log/daemon.log::sending attribute certificate issued by \"C=CH, O=Linux strongSwan, CN=strongSwan AA\"::YES
|
||||
dave::cat /var/log/daemon.log::sending attribute certificate issued by \"C=CH, O=Linux strongSwan, CN=strongSwan AA\"::YES
|
||||
dave::cat /var/log/daemon.log::sending attribute certificate issued by \"C=CH, O=Linux strongSwan, CN=expired AA\"::YES
|
||||
carol::cat /var/log/daemon.log::sending attribute certificate issued by \"C=CH, O=strongSwan Project, CN=strongSwan Attribute Authority\"::YES
|
||||
dave::cat /var/log/daemon.log::sending attribute certificate issued by \"C=CH, O=strongSwan Project, CN=strongSwan Attribute Authority\"::YES
|
||||
dave::cat /var/log/daemon.log::sending attribute certificate issued by \"C=CH, O=strongSwan Project, CN=strongSwan Legacy AA\"::YES
|
||||
dave::cat /var/log/daemon.log::received AUTHENTICATION_FAILED notify error::YES
|
||||
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
|
||||
dave:: ping -c 1 -W 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::NO
|
||||
|
||||
@@ -7,7 +7,7 @@ dave::iptables-restore < /etc/iptables.flush
|
||||
carol::rm /etc/ipsec.d/acerts/carol-sales.pem
|
||||
dave::rm /etc/ipsec.d/acerts/dave-expired-aa.pem
|
||||
dave::rm /etc/ipsec.d/acerts/dave-marketing.pem
|
||||
moon::rm /etc/ipsec.d/private/aa-expired.pem
|
||||
moon::rm /etc/ipsec.d/private/aa.pem
|
||||
moon::rm /etc/ipsec.d/aacerts/aa-expired.pem
|
||||
moon::rm /etc/ipsec.d/aacerts/aa.pem
|
||||
moon::rm /etc/ipsec.d/private/aaKey-expired.pem
|
||||
moon::rm /etc/ipsec.d/private/aaKey.pem
|
||||
moon::rm /etc/ipsec.d/aacerts/aaCert-expired.pem
|
||||
moon::rm /etc/ipsec.d/aacerts/aaCert.pem
|
||||
|
||||
@@ -1,23 +0,0 @@
|
||||
# Carols sales acert
|
||||
pki --acert \
|
||||
--issuercert hosts/moon/etc/ipsec.d/aacerts/aa.pem \
|
||||
--issuerkey hosts/moon/etc/ipsec.d/private/aa.pem --in \
|
||||
../../../hosts/carol/etc/ipsec.d/certs/carolCert.pem \
|
||||
--group sales -l 87600 -f pem \
|
||||
> hosts/carol/etc/ipsec.d/acerts/carol-sales.pem
|
||||
|
||||
# Daves marketing acert
|
||||
pki --acert \
|
||||
--issuercert hosts/moon/etc/ipsec.d/aacerts/aa.pem \
|
||||
--issuerkey hosts/moon/etc/ipsec.d/private/aa.pem \
|
||||
--in ../../../hosts/dave/etc/ipsec.d/certs/daveCert.pem \
|
||||
--group marketing -l 87600 -f pem
|
||||
> hosts/dave/etc/ipsec.d/acerts/dave-marketing.pem
|
||||
|
||||
# Daves sales acert from expired AA
|
||||
pki --acert \
|
||||
--issuercert hosts/moon/etc/ipsec.d/aacerts/aa-expired.pem \
|
||||
--issuerkey hosts/moon/etc/ipsec.d/private/aa-expired.pem \
|
||||
--in ../../../hosts/dave/etc/ipsec.d/certs/daveCert.pem \
|
||||
--group sales -l 87600 -f pem \
|
||||
> hosts/dave/etc/ipsec.d/acerts/dave-expired-aa.pem
|
||||
@@ -16,7 +16,7 @@ conn %default
|
||||
left=%any
|
||||
leftcert=bobCert.pem
|
||||
|
||||
conn sun
|
||||
conn sun
|
||||
right=PH_IP_SUN1
|
||||
rightid="C=CH, O=Linux strongSwan, CN=sun.strongswan.org"
|
||||
rightid="C=CH, O=strongSwan Project, CN=sun.strongswan.org"
|
||||
auto=route
|
||||
|
||||
@@ -18,10 +18,10 @@ conn %default
|
||||
|
||||
conn alice
|
||||
right=PH_IP_ALICE
|
||||
rightid="C=CH, O=Linux strongSwan, OU=Sales, [email protected]"
|
||||
rightid="C=CH, O=strongSwan Project, OU=Sales, [email protected]"
|
||||
auto=route
|
||||
|
||||
conn sun
|
||||
conn sun
|
||||
right=PH_IP_SUN
|
||||
rightid="C=CH, O=Linux strongSwan, CN=sun.strongswan.org"
|
||||
rightid="C=CH, O=strongSwan Project, CN=sun.strongswan.org"
|
||||
auto=route
|
||||
|
||||
@@ -6,7 +6,7 @@ config setup
|
||||
|
||||
ca strongswan
|
||||
cacert=strongswanCert.pem
|
||||
crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=Linux strongSwan, c=CH?certificateRevocationList"
|
||||
crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=strongSwan Project, c=CH?certificateRevocationList"
|
||||
auto=add
|
||||
|
||||
conn %default
|
||||
|
||||
@@ -6,7 +6,7 @@ config setup
|
||||
|
||||
ca strongswan
|
||||
cacert=strongswanCert.pem
|
||||
crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=Linux strongSwan, c=CH?certificateRevocationList"
|
||||
crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=strongSwan Project, c=CH?certificateRevocationList"
|
||||
auto=add
|
||||
|
||||
conn %default
|
||||
|
||||
@@ -11,7 +11,7 @@ conn %default
|
||||
|
||||
conn home
|
||||
left=PH_IP_CAROL
|
||||
leftcert=carolRevokedCert.pem
|
||||
leftcert=carolCert.pem
|
||||
[email protected]
|
||||
right=PH_IP_MOON
|
||||
rightsubnet=10.1.0.0/16
|
||||
|
||||
@@ -1,3 +1,3 @@
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
|
||||
: RSA carolRevokedKey.pem
|
||||
: RSA carolKey.pem
|
||||
|
||||
@@ -1,4 +1,2 @@
|
||||
moon::ipsec stop
|
||||
carol::ipsec stop
|
||||
carol::rm /etc/ipsec.d/private/*
|
||||
carol::rm /etc/ipsec.d/certs/*
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
|
||||
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
|
||||
moon:: cat /var/log/daemon.log::written crl .*/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl::YES
|
||||
carol::cat /var/log/daemon.log::written crl .*/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl::YES
|
||||
moon:: cat /var/log/daemon.log::written crl .*/etc/ipsec.d/crls/.*.crl::YES
|
||||
carol::cat /var/log/daemon.log::written crl .*/etc/ipsec.d/crls/.*.crl::YES
|
||||
|
||||
@@ -5,7 +5,7 @@ config setup
|
||||
|
||||
ca strongswan
|
||||
cacert=strongswanCert.pem
|
||||
crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=Linux strongSwan, c=CH?certificateRevocationList"
|
||||
crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=strongSwan Project, c=CH?certificateRevocationList"
|
||||
auto=add
|
||||
|
||||
conn %default
|
||||
@@ -18,12 +18,12 @@ conn %default
|
||||
leftcert=carolCert.pem
|
||||
right=PH_IP_MOON
|
||||
[email protected]
|
||||
rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
|
||||
rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
|
||||
|
||||
conn alice
|
||||
rightsubnet=PH_IP_ALICE/32
|
||||
auto=add
|
||||
|
||||
|
||||
conn venus
|
||||
rightsubnet=PH_IP_VENUS/32
|
||||
auto=add
|
||||
|
||||
@@ -5,7 +5,7 @@ config setup
|
||||
|
||||
ca strongswan
|
||||
cacert=strongswanCert.pem
|
||||
crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=Linux strongSwan, c=CH?certificateRevocationList"
|
||||
crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=strongSwan Project, c=CH?certificateRevocationList"
|
||||
auto=add
|
||||
|
||||
conn %default
|
||||
@@ -18,12 +18,12 @@ conn %default
|
||||
leftcert=daveCert.pem
|
||||
right=PH_IP_MOON
|
||||
[email protected]
|
||||
rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
|
||||
rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
|
||||
|
||||
conn alice
|
||||
rightsubnet=PH_IP_ALICE/32
|
||||
auto=add
|
||||
|
||||
|
||||
conn venus
|
||||
rightsubnet=PH_IP_VENUS/32
|
||||
auto=add
|
||||
|
||||
@@ -5,19 +5,19 @@ config setup
|
||||
|
||||
ca strongswan
|
||||
cacert=strongswanCert.pem
|
||||
crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=Linux strongSwan, c=CH?certificateRevocationList"
|
||||
crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=strongSwan Project, c=CH?certificateRevocationList"
|
||||
auto=add
|
||||
|
||||
ca research
|
||||
ca research
|
||||
cacert=researchCert.pem
|
||||
crluri="ldap://ldap.strongswan.org/cn=Research CA, ou=Research, o=Linux strongSwan, c=CH?certificateRevocationList"
|
||||
crluri="ldap://ldap.strongswan.org/cn=Research CA, ou=Research, o=strongSwan Project, c=CH?certificateRevocationList"
|
||||
auto=add
|
||||
|
||||
ca sales
|
||||
|
||||
ca sales
|
||||
cacert=salesCert.pem
|
||||
crluri="ldap://ldap.strongswan.org/cn=Sales CA, ou=Sales, o=Linux strongSwan, c=CH?certificateRevocationList"
|
||||
crluri="ldap://ldap.strongswan.org/cn=Sales CA, ou=Sales, o=strongSwan Project, c=CH?certificateRevocationList"
|
||||
auto=add
|
||||
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
@@ -32,11 +32,11 @@ conn %default
|
||||
conn alice
|
||||
leftsubnet=PH_IP_ALICE/32
|
||||
right=%any
|
||||
rightca="C=CH, O=Linux strongSwan, OU=Research, CN=Research CA"
|
||||
rightca="C=CH, O=strongSwan Project, OU=Research, CN=Research CA"
|
||||
auto=add
|
||||
|
||||
|
||||
conn venus
|
||||
leftsubnet=PH_IP_VENUS/32
|
||||
right=%any
|
||||
rightca="C=CH, O=Linux strongSwan, OU=Sales, CN=Sales CA"
|
||||
rightca="C=CH, O=strongSwan Project, OU=Sales, CN=Sales CA"
|
||||
auto=add
|
||||
|
||||
@@ -17,5 +17,5 @@ conn home
|
||||
right=PH_IP_MOON
|
||||
rightsubnet=10.1.0.0/16
|
||||
[email protected]
|
||||
rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
|
||||
rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
|
||||
auto=add
|
||||
|
||||
@@ -3,11 +3,6 @@
|
||||
config setup
|
||||
strictcrlpolicy=yes
|
||||
|
||||
ca strongswan
|
||||
cacert=strongswanCert.pem
|
||||
crluri=http://crl.strongswan.org/strongswan.crl
|
||||
auto=add
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
@@ -21,5 +16,5 @@ conn %default
|
||||
conn alice
|
||||
leftsubnet=PH_IP_ALICE/32
|
||||
right=%any
|
||||
rightca="C=CH, O=Linux strongSwan, OU=Research, CN=Research CA"
|
||||
rightca="C=CH, O=strongSwan Project, OU=Research, CN=Research CA"
|
||||
auto=add
|
||||
|
||||
@@ -17,5 +17,5 @@ conn home
|
||||
right=PH_IP_MOON
|
||||
rightsubnet=10.1.0.0/16
|
||||
[email protected]
|
||||
rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
|
||||
rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
|
||||
auto=add
|
||||
|
||||
@@ -3,11 +3,6 @@
|
||||
config setup
|
||||
strictcrlpolicy=yes
|
||||
|
||||
ca strongswan
|
||||
cacert=strongswanCert.pem
|
||||
crluri=http://crl.strongswan.org/not-available.crl
|
||||
auto=add
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
@@ -21,5 +16,5 @@ conn %default
|
||||
conn alice
|
||||
leftsubnet=PH_IP_ALICE/32
|
||||
right=%any
|
||||
rightca="C=CH, O=Linux strongSwan, OU=Research, CN=Research CA"
|
||||
rightca="C=CH, O=strongSwan Project, OU=Research, CN=Research CA"
|
||||
auto=add
|
||||
|
||||
@@ -14,12 +14,12 @@ conn %default
|
||||
leftsendcert=ifasked
|
||||
right=PH_IP_MOON
|
||||
[email protected]
|
||||
rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
|
||||
rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
|
||||
|
||||
conn alice
|
||||
rightsubnet=PH_IP_ALICE/32
|
||||
auto=add
|
||||
|
||||
|
||||
conn venus
|
||||
rightsubnet=PH_IP_VENUS/32
|
||||
auto=add
|
||||
|
||||
@@ -14,12 +14,12 @@ conn %default
|
||||
leftsendcert=ifasked
|
||||
right=PH_IP_MOON
|
||||
[email protected]
|
||||
rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
|
||||
rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
|
||||
|
||||
conn alice
|
||||
rightsubnet=PH_IP_ALICE/32
|
||||
auto=add
|
||||
|
||||
|
||||
conn venus
|
||||
rightsubnet=PH_IP_VENUS/32
|
||||
auto=add
|
||||
|
||||
@@ -22,11 +22,11 @@ conn %default
|
||||
conn alice
|
||||
leftsubnet=PH_IP_ALICE/32
|
||||
right=%any
|
||||
rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
|
||||
rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
|
||||
auto=add
|
||||
|
||||
|
||||
conn venus
|
||||
leftsubnet=PH_IP_VENUS/32
|
||||
right=%any
|
||||
rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
|
||||
rightca="C=CH, O=strongSwan Project, CN=strongSwan Root CA"
|
||||
auto=add
|
||||
|
||||
@@ -2,11 +2,6 @@
|
||||
|
||||
config setup
|
||||
|
||||
ca strongswan
|
||||
cacert=strongswanCert.pem
|
||||
crluri=http://crl.strongswan.org/strongswan.crl
|
||||
auto=add
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
@@ -21,11 +16,11 @@ conn %default
|
||||
conn alice
|
||||
leftsubnet=PH_IP_ALICE/32
|
||||
right=%any
|
||||
rightca="C=CH, O=Linux strongSwan, OU=Research, CN=Research CA"
|
||||
rightca="C=CH, O=strongSwan Project, OU=Research, CN=Research CA"
|
||||
auto=add
|
||||
|
||||
|
||||
conn venus
|
||||
leftsubnet=PH_IP_VENUS/32
|
||||
right=%any
|
||||
rightca="C=CH, O=Linux strongSwan, OU=Sales, CN=Sales CA"
|
||||
rightca="C=CH, O=strongSwan Project, OU=Sales, CN=Sales CA"
|
||||
auto=add
|
||||
|
||||
@@ -3,5 +3,5 @@
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
|
||||
|
||||
fragment_size = 1024
|
||||
fragment_size = 1088
|
||||
}
|
||||
|
||||
@@ -3,5 +3,5 @@
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
|
||||
|
||||
fragment_size = 1024
|
||||
fragment_size = 1088
|
||||
}
|
||||
|
||||
@@ -13,12 +13,12 @@ conn net-net
|
||||
left=PH_IP_MOON
|
||||
leftsubnet=10.1.0.0/16
|
||||
[email protected]
|
||||
leftsigkey=moonPub.der
|
||||
leftsigkey=moonPub.pem
|
||||
leftauth=pubkey
|
||||
leftfirewall=yes
|
||||
right=PH_IP_SUN
|
||||
rightsubnet=10.2.0.0/16
|
||||
[email protected]
|
||||
rightsigkey=sunPub.der
|
||||
rightsigkey=sunPub.pem
|
||||
rightauth=pubkey
|
||||
auto=add
|
||||
|
||||
Binary file not shown.
@@ -1,3 +0,0 @@
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
|
||||
: RSA moonKey.der
|
||||
@@ -13,10 +13,10 @@ conn net-net
|
||||
left=PH_IP_SUN
|
||||
leftsubnet=10.2.0.0/16
|
||||
[email protected]
|
||||
leftsigkey=sunPub.der
|
||||
leftsigkey=sunPub.pem
|
||||
leftfirewall=yes
|
||||
right=PH_IP_MOON
|
||||
rightsubnet=10.1.0.0/16
|
||||
[email protected]
|
||||
rightsigkey=moonPub.der
|
||||
rightsigkey=moonPub.pem
|
||||
auto=add
|
||||
|
||||
Binary file not shown.
@@ -1,3 +0,0 @@
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
|
||||
: RSA sunKey.der
|
||||
+1
-1
@@ -1,6 +1,6 @@
|
||||
#!/bin/bash
|
||||
|
||||
cd /etc/openssl
|
||||
cd /etc/ca
|
||||
|
||||
echo "Content-type: application/ocsp-response"
|
||||
echo ""
|
||||
@@ -31,11 +31,11 @@ conn %default
|
||||
conn alice
|
||||
leftsubnet=PH_IP_ALICE/32
|
||||
right=%any
|
||||
rightca="C=CH, O=Linux strongSwan, OU=Research, CN=Research CA"
|
||||
rightca="C=CH, O=strongSwan Project, OU=Research, CN=Research CA"
|
||||
auto=add
|
||||
|
||||
|
||||
conn venus
|
||||
leftsubnet=PH_IP_VENUS/32
|
||||
right=%any
|
||||
rightca="C=CH, O=Linux strongSwan, OU=Sales, CN=Sales CA"
|
||||
rightca="C=CH, O=strongSwan Project, OU=Sales, CN=Sales CA"
|
||||
auto=add
|
||||
|
||||
@@ -4,5 +4,7 @@ dave::ipsec start
|
||||
moon::expect-connection alice
|
||||
carol::expect-connection alice
|
||||
carol::ipsec up alice
|
||||
carol::ipsec up venus
|
||||
dave::expect-connection venus
|
||||
dave::ipsec up venus
|
||||
dave::ipsec up alice
|
||||
+1
-1
@@ -1,6 +1,6 @@
|
||||
#!/bin/bash
|
||||
|
||||
cd /etc/openssl
|
||||
cd /etc/ca
|
||||
|
||||
echo "Content-type: application/ocsp-response"
|
||||
echo ""
|
||||
@@ -15,7 +15,7 @@ conn %default
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
left=PH_IP_CAROL
|
||||
leftcert=carolRevokedCert.pem
|
||||
leftcert=carolCert.pem
|
||||
[email protected]
|
||||
|
||||
conn home
|
||||
|
||||
@@ -1,3 +1,3 @@
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
|
||||
: RSA carolRevokedKey.pem
|
||||
: RSA carolKey.pem
|
||||
|
||||
@@ -1,4 +1,2 @@
|
||||
moon::ipsec stop
|
||||
carol::ipsec stop
|
||||
carol::rm /etc/ipsec.d/private/*
|
||||
carol::rm /etc/ipsec.d/certs/*
|
||||
|
||||
@@ -15,7 +15,7 @@ conn %default
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
left=PH_IP_CAROL
|
||||
leftcert=carolCert-ocsp.pem
|
||||
leftcert=carolCert.pem
|
||||
[email protected]
|
||||
|
||||
conn home
|
||||
|
||||
@@ -1,3 +1,3 @@
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
|
||||
: RSA carolKey-ocsp.pem
|
||||
: RSA carolKey.pem
|
||||
|
||||
@@ -1,4 +1,2 @@
|
||||
moon::ipsec stop
|
||||
carol::ipsec stop
|
||||
carol::rm /etc/ipsec.d/certs/*
|
||||
carol::rm /etc/ipsec.d/private/*
|
||||
|
||||
@@ -10,14 +10,14 @@ conn %default
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
left=PH_IP_CAROL
|
||||
leftcert=carolCert-ifuri.pem
|
||||
leftcert=carolCert.pem
|
||||
right=PH_IP_MOON
|
||||
[email protected]
|
||||
|
||||
conn alice
|
||||
rightsubnet=PH_IP_ALICE/32
|
||||
auto=add
|
||||
|
||||
|
||||
conn venus
|
||||
rightsubnet=PH_IP_VENUS/32
|
||||
auto=add
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
config setup
|
||||
strictcrlpolicy=ifuri
|
||||
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
@@ -10,14 +10,14 @@ conn %default
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
left=PH_IP_DAVE
|
||||
leftcert=daveCert-ifuri.pem
|
||||
leftcert=daveCert.pem
|
||||
right=PH_IP_MOON
|
||||
[email protected]
|
||||
|
||||
conn alice
|
||||
rightsubnet=PH_IP_ALICE/32
|
||||
auto=add
|
||||
|
||||
|
||||
conn venus
|
||||
rightsubnet=PH_IP_VENUS/32
|
||||
auto=add
|
||||
|
||||
@@ -16,11 +16,11 @@ conn %default
|
||||
conn alice
|
||||
leftsubnet=PH_IP_ALICE/32
|
||||
right=%any
|
||||
rightca="C=CH, O=Linux strongSwan, OU=Research, CN=Research CA"
|
||||
rightca="C=CH, O=strongSwan Project, OU=Research, CN=Research CA"
|
||||
auto=add
|
||||
|
||||
|
||||
conn venus
|
||||
leftsubnet=PH_IP_VENUS/32
|
||||
right=%any
|
||||
rightca="C=CH, O=Linux strongSwan, OU=Sales, CN=Sales CA"
|
||||
rightca="C=CH, O=strongSwan Project, OU=Sales, CN=Sales CA"
|
||||
auto=add
|
||||
|
||||
@@ -8,7 +8,7 @@ ca strongswan-ca
|
||||
ocspuri1=http://bob.strongswan.org:8800
|
||||
ocspuri2=http://ocsp.strongswan.org:8880
|
||||
auto=add
|
||||
|
||||
|
||||
conn %default
|
||||
keyexchange=ikev2
|
||||
ikelifetime=60m
|
||||
@@ -16,7 +16,7 @@ conn %default
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
left=PH_IP_CAROL
|
||||
leftcert=carolCert-ocsp.pem
|
||||
leftcert=carolCert.pem
|
||||
[email protected]
|
||||
|
||||
conn home
|
||||
|
||||
@@ -1,3 +1,3 @@
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
|
||||
: RSA carolKey-ocsp.pem
|
||||
: RSA carolKey.pem
|
||||
|
||||
@@ -1,4 +1,2 @@
|
||||
moon::ipsec stop
|
||||
carol::ipsec stop
|
||||
carol::rm /etc/ipsec.d/certs/*
|
||||
carol::rm /etc/ipsec.d/private/*
|
||||
|
||||
+1
-1
@@ -1,6 +1,6 @@
|
||||
#!/bin/bash
|
||||
|
||||
cd /etc/openssl
|
||||
cd /etc/ca
|
||||
|
||||
echo "Content-type: application/ocsp-response"
|
||||
echo ""
|
||||
@@ -2,7 +2,7 @@ carol::cat /var/log/daemon.log::server requested EAP_PEAP authentication::YES
|
||||
carol::cat /var/log/daemon.log::allow mutual EAP-only authentication::YES
|
||||
carol::cat /var/log/daemon.log::server requested EAP_MD5 authentication::YES
|
||||
carol::cat /var/log/daemon.log::EAP method EAP_PEAP succeeded, MSK established::YES
|
||||
carol::cat /var/log/daemon.log::authentication of 'C=CH, O=Linux strongSwan, CN=moon.strongswan.org' with EAP successful::YES
|
||||
carol::cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, CN=moon.strongswan.org' with EAP successful::YES
|
||||
dave:: cat /var/log/daemon.log::server requested EAP_PEAP authentication::YES
|
||||
dave:: cat /var/log/daemon.log::allow mutual EAP-only authentication::YES
|
||||
dave:: cat /var/log/daemon.log::server requested EAP_MD5 authentication::YES
|
||||
@@ -17,7 +17,7 @@ dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*CN=moo
|
||||
moon:: ipsec status 2> /dev/null::rw-eap[{]1}.*INSTALLED, TUNNEL::YES
|
||||
moon:: ipsec status 2> /dev/null::rw-eap[{]2}.*INSTALLED::NO
|
||||
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
|
||||
dave:: ipsec status 2> /dev/null::home.*INSTALLED::NO
|
||||
dave:: ipsec status 2> /dev/null::home.*INSTALLED::NO
|
||||
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
|
||||
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
|
||||
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
|
||||
|
||||
@@ -15,7 +15,7 @@ conn home
|
||||
leftauth=eap
|
||||
leftfirewall=yes
|
||||
right=PH_IP_MOON
|
||||
rightid="C=CH, O=Linux strongSwan, CN=moon.strongswan.org"
|
||||
rightid="C=CH, O=strongSwan Project, CN=moon.strongswan.org"
|
||||
rightauth=any
|
||||
rightsubnet=10.1.0.0/16
|
||||
rightsendcert=never
|
||||
|
||||
@@ -15,7 +15,7 @@ conn home
|
||||
leftauth=eap
|
||||
leftfirewall=yes
|
||||
right=PH_IP_MOON
|
||||
rightid="C=CH, O=Linux strongSwan, CN=moon.strongswan.org"
|
||||
rightid="C=CH, O=strongSwan Project, CN=moon.strongswan.org"
|
||||
rightauth=any
|
||||
rightsubnet=10.1.0.0/16
|
||||
rightsendcert=never
|
||||
|
||||
@@ -2,7 +2,7 @@ carol::cat /var/log/daemon.log::server requested EAP_PEAP authentication::YES
|
||||
carol::cat /var/log/daemon.log::allow mutual EAP-only authentication::YES
|
||||
carol::cat /var/log/daemon.log::server requested EAP_MSCHAPV2 authentication::YES
|
||||
carol::cat /var/log/daemon.log::EAP method EAP_PEAP succeeded, MSK established::YES
|
||||
carol::cat /var/log/daemon.log::authentication of 'C=CH, O=Linux strongSwan, CN=moon.strongswan.org' with EAP successful::YES
|
||||
carol::cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, CN=moon.strongswan.org' with EAP successful::YES
|
||||
dave:: cat /var/log/daemon.log::server requested EAP_PEAP authentication::YES
|
||||
dave:: cat /var/log/daemon.log::allow mutual EAP-only authentication::YES
|
||||
dave:: cat /var/log/daemon.log::server requested EAP_MSCHAPV2 authentication::YES
|
||||
|
||||
@@ -15,7 +15,7 @@ conn home
|
||||
leftauth=eap
|
||||
leftfirewall=yes
|
||||
right=PH_IP_MOON
|
||||
rightid="C=CH, O=Linux strongSwan, CN=moon.strongswan.org"
|
||||
rightid="C=CH, O=strongSwan Project, CN=moon.strongswan.org"
|
||||
rightauth=any
|
||||
rightsubnet=10.1.0.0/16
|
||||
rightsendcert=never
|
||||
|
||||
@@ -15,7 +15,7 @@ conn home
|
||||
leftauth=eap
|
||||
leftfirewall=yes
|
||||
right=PH_IP_MOON
|
||||
rightid="C=CH, O=Linux strongSwan, CN=moon.strongswan.org"
|
||||
rightid="C=CH, O=strongSwan Project, CN=moon.strongswan.org"
|
||||
rightauth=any
|
||||
rightsubnet=10.1.0.0/16
|
||||
rightsendcert=never
|
||||
|
||||
@@ -18,5 +18,5 @@ conn home
|
||||
[email protected]
|
||||
rightsubnet=10.1.0.0/16
|
||||
rightauth=pubkey
|
||||
aaa_identity="C=CH, O=Linux strongSwan, CN=aaa.strongswan.org"
|
||||
aaa_identity="C=CH, O=strongSwan Project, CN=aaa.strongswan.org"
|
||||
auto=add
|
||||
|
||||
@@ -18,5 +18,5 @@ conn home
|
||||
[email protected]
|
||||
rightsubnet=10.1.0.0/16
|
||||
rightauth=pubkey
|
||||
aaa_identity="C=CH, O=Linux strongSwan, CN=aaa.strongswan.org"
|
||||
aaa_identity="C=CH, O=strongSwan Project, CN=aaa.strongswan.org"
|
||||
auto=add
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
carol::cat /var/log/daemon.log::server requested EAP_TLS authentication::YES
|
||||
carol::cat /var/log/daemon.log::allow mutual EAP-only authentication::YES
|
||||
carol::cat /var/log/daemon.log::negotiated TLS 1.2 using suite TLS_DHE_RSA_WITH_AES_128_GCM_SHA256::YES
|
||||
carol::cat /var/log/daemon.log::authentication of 'C=CH, O=Linux strongSwan, CN=moon.strongswan.org' with EAP successful::YES
|
||||
moon:: cat /var/log/daemon.log::authentication of 'C=CH, O=Linux strongSwan, OU=Research, [email protected]' with EAP successful::YES
|
||||
carol::cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, CN=moon.strongswan.org' with EAP successful::YES
|
||||
moon:: cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, OU=Research, [email protected]' with EAP successful::YES
|
||||
moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED::YES
|
||||
carol::ipsec status 2> /dev/null::home.*ESTABLISHED::YES
|
||||
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
|
||||
|
||||
@@ -13,7 +13,7 @@ conn home
|
||||
leftauth=eap
|
||||
leftfirewall=yes
|
||||
right=PH_IP_MOON
|
||||
rightid="C=CH, O=Linux strongSwan, CN=moon.strongswan.org"
|
||||
rightid="C=CH, O=strongSwan Project, CN=moon.strongswan.org"
|
||||
rightauth=any
|
||||
rightsubnet=10.1.0.0/16
|
||||
rightsendcert=never
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
carol::cat /var/log/daemon.log::authentication of 'C=CH, O=Linux strongSwan, CN=moon.strongswan.org' with RSA.* successful::YES
|
||||
carol::cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, CN=moon.strongswan.org' with RSA.* successful::YES
|
||||
carol::cat /var/log/daemon.log::server requested EAP_TLS authentication::YES
|
||||
carol::cat /var/log/daemon.log::authentication of 'C=CH, O=Linux strongSwan, CN=moon.strongswan.org' with EAP successful::YES
|
||||
moon:: cat /var/log/daemon.log::authentication of 'C=CH, O=Linux strongSwan, OU=Research, [email protected]' with EAP successful::YES
|
||||
carol::cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, CN=moon.strongswan.org' with EAP successful::YES
|
||||
moon:: cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, OU=Research, [email protected]' with EAP successful::YES
|
||||
moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED::YES
|
||||
carol::ipsec status 2> /dev/null::home.*ESTABLISHED::YES
|
||||
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
|
||||
|
||||
@@ -13,8 +13,8 @@ conn home
|
||||
leftauth=eap
|
||||
leftfirewall=yes
|
||||
right=PH_IP_MOON
|
||||
rightid="C=CH, O=Linux strongSwan, CN=moon.strongswan.org"
|
||||
rightid="C=CH, O=strongSwan Project, CN=moon.strongswan.org"
|
||||
rightsubnet=10.1.0.0/16
|
||||
rightauth=pubkey
|
||||
aaa_identity="C=CH, O=Linux strongSwan, CN=aaa.strongswan.org"
|
||||
aaa_identity="C=CH, O=strongSwan Project, CN=aaa.strongswan.org"
|
||||
auto=add
|
||||
|
||||
@@ -15,7 +15,7 @@ conn rw-eap
|
||||
leftcert=moonCert.pem
|
||||
leftauth=pubkey
|
||||
leftfirewall=yes
|
||||
rightid="C=CH, O=Linux strongSwan, OU=Research, [email protected]"
|
||||
rightid="C=CH, O=strongSwan Project, OU=Research, [email protected]"
|
||||
rightauth=eap-radius
|
||||
rightsendcert=never
|
||||
right=%any
|
||||
|
||||
@@ -2,7 +2,7 @@ carol::cat /var/log/daemon.log::server requested EAP_TTLS authentication::YES
|
||||
carol::cat /var/log/daemon.log::allow mutual EAP-only authentication::YES
|
||||
carol::cat /var/log/daemon.log::server requested EAP_MD5 authentication::YES
|
||||
carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
|
||||
carol::cat /var/log/daemon.log::authentication of 'C=CH, O=Linux strongSwan, CN=moon.strongswan.org' with EAP successful::YES
|
||||
carol::cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, CN=moon.strongswan.org' with EAP successful::YES
|
||||
dave:: cat /var/log/daemon.log::server requested EAP_TTLS authentication::YES
|
||||
dave:: cat /var/log/daemon.log::allow mutual EAP-only authentication::YES
|
||||
dave:: cat /var/log/daemon.log::server requested EAP_MD5 authentication::YES
|
||||
|
||||
@@ -13,7 +13,7 @@ conn home
|
||||
leftauth=eap
|
||||
leftfirewall=yes
|
||||
right=PH_IP_MOON
|
||||
rightid="C=CH, O=Linux strongSwan, CN=moon.strongswan.org"
|
||||
rightid="C=CH, O=strongSwan Project, CN=moon.strongswan.org"
|
||||
rightauth=any
|
||||
rightsubnet=10.1.0.0/16
|
||||
rightsendcert=never
|
||||
|
||||
@@ -13,7 +13,7 @@ conn home
|
||||
leftauth=eap
|
||||
leftfirewall=yes
|
||||
right=PH_IP_MOON
|
||||
rightid="C=CH, O=Linux strongSwan, CN=moon.strongswan.org"
|
||||
rightid="C=CH, O=strongSwan Project, CN=moon.strongswan.org"
|
||||
rightauth=any
|
||||
rightsubnet=10.1.0.0/16
|
||||
rightsendcert=never
|
||||
|
||||
@@ -16,5 +16,5 @@ conn home
|
||||
[email protected]
|
||||
rightsubnet=10.1.0.0/16
|
||||
rightauth=pubkey
|
||||
aaa_identity="C=CH, O=Linux strongSwan, CN=aaa.strongswan.org"
|
||||
aaa_identity="C=CH, O=strongSwan Project, CN=aaa.strongswan.org"
|
||||
auto=add
|
||||
|
||||
@@ -16,5 +16,5 @@ conn home
|
||||
[email protected]
|
||||
rightsubnet=10.1.0.0/16
|
||||
rightauth=pubkey
|
||||
aaa_identity="C=CH, O=Linux strongSwan, CN=aaa.strongswan.org"
|
||||
aaa_identity="C=CH, O=strongSwan Project, CN=aaa.strongswan.org"
|
||||
auto=add
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each
|
||||
The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each
|
||||
to gateway <b>moon</b>. The authentication is based on <b>X.509 certificates</b>
|
||||
and matching RSA private keys stored in the <b>PKCS#8</b> format. <b>moon</b>'s key
|
||||
is unencrypted, <b>carol</b>'s key is encrypted with the default PKCS#5 v1.5
|
||||
DES algorithm and <b>dave</b>'s key with the PKCS#5 v2.0 3DES algorithm.
|
||||
DES algorithm and <b>dave</b>'s key with the PKCS#5 v2.0 AES-128 algorithm.
|
||||
<p/>
|
||||
Upon the successful establishment of the IPsec tunnels, <b>leftfirewall=yes</b>
|
||||
automatically inserts iptables-based firewall rules that let pass the tunneled traffic.
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
This scenario is derived from <a href="../rw-cert"><b>ikev2/rw-cert</b></a>.
|
||||
The gateway <b>moon</b> uses a 2048 bit RSA private key protected by <b>AES-128</b>
|
||||
The gateway <b>moon</b> uses a 3072 bit RSA private key protected by <b>AES-128</b>
|
||||
encryption whereas the roadwarriors <b>carol</b> and <b>dave</b> have an
|
||||
<b>AES-192</b> and <b>AES-256</b> envelope, respectively.
|
||||
<b>AES-192</b> and <b>AES-256</b> envelope, respectively.
|
||||
The X.509 certificate of the gateway <b>moon</b> uses a <b>SHA-224</b> hash in
|
||||
its signature whereas the certificates of the roadwarriors <b>carol</b>
|
||||
and <b>dave</b> use <b>SHA-384</b> and <b>SHA-512</b>, respectively.
|
||||
|
||||
@@ -15,12 +15,12 @@ conn %default
|
||||
conn alice
|
||||
leftsubnet=PH_IP_ALICE/32
|
||||
right=%any
|
||||
rightid="C=CH, O=Linux strongSwan, OU=Research, CN=*"
|
||||
rightid="C=CH, O=strongSwan Project, OU=Research, CN=*"
|
||||
auto=add
|
||||
|
||||
|
||||
conn venus
|
||||
leftsubnet=PH_IP_VENUS/32
|
||||
right=%any
|
||||
rightid="C=CH, O=Linux strongSwan, OU=Accounting, CN=*"
|
||||
rightid="C=CH, O=strongSwan Project, OU=Accounting, CN=*"
|
||||
auto=add
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user