testing: Configure logging via syslog in strongswan.conf

Globally configure logging in strongswan.conf.testing and replace all
charondebug statements with strongswan.conf settings.
This commit is contained in:
Tobias Brunner
2017-11-15 17:24:04 +01:00
parent d24d26c4bc
commit ce4aebe00a
98 changed files with 269 additions and 167 deletions
@@ -7,8 +7,6 @@ charon {
xfrm_acq_expires = 60 xfrm_acq_expires = 60
} }
} }
}
charon-systemd {
syslog { syslog {
daemon { daemon {
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="cfg 2, knl 3"
conn %default conn %default
keyexchange=ikev1 keyexchange=ikev1
ike=aes128-sha256-modp3072! ike=aes128-sha256-modp3072!
@@ -3,4 +3,10 @@
charon { charon {
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
multiple_authentication = no multiple_authentication = no
syslog {
daemon {
cfg = 2
knl = 3
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="cfg 2, knl 3"
conn %default conn %default
keyexchange=ikev1 keyexchange=ikev1
ike=aes128-sha256-modp3072! ike=aes128-sha256-modp3072!
@@ -3,4 +3,10 @@
charon { charon {
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
multiple_authentication = no multiple_authentication = no
syslog {
daemon {
cfg = 2
knl = 3
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="cfg 2, knl 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -3,4 +3,10 @@
charon { charon {
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
multiple_authentication = no multiple_authentication = no
syslog {
daemon {
cfg = 2
knl = 2
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="cfg 2, knl 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -3,4 +3,10 @@
charon { charon {
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
multiple_authentication = no multiple_authentication = no
syslog {
daemon {
cfg = 2
knl = 2
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="ike 4, lib 4"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -6,6 +6,12 @@ charon {
multiple_authentication = no multiple_authentication = no
send_vendor_id = yes send_vendor_id = yes
syslog {
daemon {
ike = 4
lib = 4
}
}
plugins { plugins {
ntru { ntru {
parameter_set = optimum parameter_set = optimum
@@ -1,13 +1,10 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="ike 4, lib 4"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
rekeymargin=3m rekeymargin=3m
keyingtries=1 keyingtries=1
keyexchange=ikev1 keyexchange=ikev1
ike=aes256-sha512-ntru256! ike=aes256-sha512-ntru256!
esp=aes256-sha512! esp=aes256-sha512!
@@ -5,4 +5,10 @@ charon {
multiple_authentication = no multiple_authentication = no
send_vendor_id = yes send_vendor_id = yes
syslog {
daemon {
ike = 4
lib = 4
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="job 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -2,4 +2,9 @@
charon { charon {
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
syslog {
daemon {
job = 2
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="job 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -2,4 +2,9 @@
charon { charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
syslog {
daemon {
job = 2
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="cfg 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -2,4 +2,9 @@
charon { charon {
load = random nonce aes blowfish md5 sha1 sha2 pem pkcs1 gmp curl x509 revocation hmac stroke kernel-netlink socket-default updown load = random nonce aes blowfish md5 sha1 sha2 pem pkcs1 gmp curl x509 revocation hmac stroke kernel-netlink socket-default updown
syslog {
daemon {
cfg = 2
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="cfg 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -2,4 +2,9 @@
charon { charon {
load = random nonce blowfish sha1 sha2 pem pkcs1 gmp curl x509 revocation hmac stroke kernel-netlink socket-default updown load = random nonce blowfish sha1 sha2 pem pkcs1 gmp curl x509 revocation hmac stroke kernel-netlink socket-default updown
syslog {
daemon {
cfg = 2
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="knl 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -2,4 +2,9 @@
charon { charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
syslog {
daemon {
knl = 2
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="cfg 2, knl 2"
conn %default conn %default
keyexchange=ikev2 keyexchange=ikev2
ike=aes128-sha256-modp3072! ike=aes128-sha256-modp3072!
@@ -3,4 +3,10 @@
charon { charon {
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
multiple_authentication = no multiple_authentication = no
syslog {
daemon {
cfg = 2
knl = 2
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="cfg 2, knl 2"
conn %default conn %default
keyexchange=ikev2 keyexchange=ikev2
ike=aes128-sha256-modp3072! ike=aes128-sha256-modp3072!
@@ -3,4 +3,10 @@
charon { charon {
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
multiple_authentication = no multiple_authentication = no
syslog {
daemon {
cfg = 2
knl = 2
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="cfg 2, knl 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -3,4 +3,10 @@
charon { charon {
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
multiple_authentication = no multiple_authentication = no
syslog {
daemon {
cfg = 2
knl = 2
}
}
} }
@@ -1,13 +1,10 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="cfg 2, knl 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
rekeymargin=3m rekeymargin=3m
keyingtries=1 keyingtries=1
keyexchange=ikev2 keyexchange=ikev2
ike=aes128-sha256-modp3072! ike=aes128-sha256-modp3072!
esp=aes128-sha256-esn! esp=aes128-sha256-esn!
@@ -3,4 +3,10 @@
charon { charon {
load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown load = random nonce aes sha1 sha2 pem pkcs1 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
multiple_authentication = no multiple_authentication = no
syslog {
daemon {
cfg = 2
knl = 2
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="ike 4, lib 4"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -6,6 +6,12 @@ charon {
multiple_authentication = no multiple_authentication = no
send_vendor_id = yes send_vendor_id = yes
syslog {
daemon {
ike = 4
lib = 4
}
}
plugins { plugins {
ntru { ntru {
parameter_set = x9_98_bandwidth parameter_set = x9_98_bandwidth
@@ -1,13 +1,10 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="ike 4, lib 4"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
rekeymargin=3m rekeymargin=3m
keyingtries=1 keyingtries=1
keyexchange=ikev2 keyexchange=ikev2
ike=aes128-sha256-ntru128! ike=aes128-sha256-ntru128!
esp=aes128-sha256! esp=aes128-sha256!
@@ -6,6 +6,12 @@ charon {
multiple_authentication = no multiple_authentication = no
send_vendor_id = yes send_vendor_id = yes
syslog {
daemon {
ike = 4
lib = 4
}
}
plugins { plugins {
ntru { ntru {
parameter_set = x9_98_bandwidth parameter_set = x9_98_bandwidth
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="ike 4, lib 4"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -6,6 +6,12 @@ charon {
multiple_authentication = no multiple_authentication = no
send_vendor_id = yes send_vendor_id = yes
syslog {
daemon {
ike = 4
lib = 4
}
}
plugins { plugins {
ntru { ntru {
parameter_set = optimum parameter_set = optimum
@@ -1,13 +1,10 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="ike 4, lib 4"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
rekeymargin=3m rekeymargin=3m
keyingtries=1 keyingtries=1
keyexchange=ikev2 keyexchange=ikev2
ike=aes256-sha512-ntru256! ike=aes256-sha512-ntru256!
esp=aes256-sha512! esp=aes256-sha512!
@@ -4,4 +4,10 @@ charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl mgf1 ntru revocation hmac stroke kernel-netlink socket-default updown load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl mgf1 ntru revocation hmac stroke kernel-netlink socket-default updown
multiple_authentication = no multiple_authentication = no
send_vendor_id = yes send_vendor_id = yes
syslog {
daemon {
ike = 4
lib = 4
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="knl 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -3,4 +3,9 @@
charon { charon {
load = random nonce aes sha1 sha2 curve25519 hmac curl stroke kernel-netlink socket-default updown load = random nonce aes sha1 sha2 curve25519 hmac curl stroke kernel-netlink socket-default updown
multiple_authentication = no multiple_authentication = no
syslog {
daemon {
knl = 2
}
}
} }
@@ -1,13 +1,10 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="knl 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
rekeymargin=3m rekeymargin=3m
keyingtries=1 keyingtries=1
keyexchange=ikev2 keyexchange=ikev2
mobike=no mobike=no
@@ -3,4 +3,9 @@
charon { charon {
load = random nonce aes sha1 sha2 curve25519 hmac curl stroke kernel-netlink socket-default updown load = random nonce aes sha1 sha2 curve25519 hmac curl stroke kernel-netlink socket-default updown
multiple_authentication = no multiple_authentication = no
syslog {
daemon {
knl = 2
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="knl 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
lifetime=10s lifetime=10s
@@ -4,4 +4,9 @@ charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
# remove rekeyed inbound SA a bit quicker for the test scenario # remove rekeyed inbound SA a bit quicker for the test scenario
delete_rekeyed_delay = 2 delete_rekeyed_delay = 2
syslog {
daemon {
knl = 2
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="cfg 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -3,4 +3,9 @@
charon { charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation addrblock hmac stroke kernel-netlink socket-default updown load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation addrblock hmac stroke kernel-netlink socket-default updown
multiple_authentication = no multiple_authentication = no
syslog {
daemon {
cfg = 2
}
}
} }
@@ -1,13 +1,10 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="cfg 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
rekeymargin=3m rekeymargin=3m
keyingtries=1 keyingtries=1
keyexchange=ikev2 keyexchange=ikev2
mobike=no mobike=no
@@ -3,4 +3,9 @@
charon { charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation addrblock hmac stroke kernel-netlink socket-default updown load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation addrblock hmac stroke kernel-netlink socket-default updown
multiple_authentication = no multiple_authentication = no
syslog {
daemon {
cfg = 2
}
}
} }
@@ -1,7 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="knl 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -2,4 +2,9 @@
charon { charon {
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
syslog {
daemon {
knl = 2
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="tls 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -4,6 +4,11 @@ charon {
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl hmac gcm stroke kernel-netlink socket-default eap-tls updown load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl hmac gcm stroke kernel-netlink socket-default eap-tls updown
multiple_authentication=no multiple_authentication=no
syslog {
daemon {
tls = 2
}
}
plugins { plugins {
eap-tls { eap-tls {
max_message_count = 40 max_message_count = 40
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="tls 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -4,6 +4,11 @@ charon {
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl hmac gcm stroke kernel-netlink socket-default eap-tls updown load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl hmac gcm stroke kernel-netlink socket-default eap-tls updown
multiple_authentication=no multiple_authentication=no
syslog {
daemon {
tls = 2
}
}
plugins { plugins {
eap-tls { eap-tls {
max_message_count = 40 max_message_count = 40
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="tls 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -4,4 +4,9 @@ charon {
load = random nonce aes md5 sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac gcm stroke kernel-netlink socket-default eap-tls updown load = random nonce aes md5 sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac gcm stroke kernel-netlink socket-default eap-tls updown
multiple_authentication=no multiple_authentication=no
syslog {
daemon {
tls = 2
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="tls 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -4,6 +4,11 @@ charon {
load = random nonce aes md5 sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac gcm stroke kernel-netlink socket-default eap-tls updown load = random nonce aes md5 sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac gcm stroke kernel-netlink socket-default eap-tls updown
multiple_authentication=no multiple_authentication=no
syslog {
daemon {
tls = 2
}
}
} }
libtls { libtls {
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="tls 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -3,6 +3,11 @@
charon { charon {
load = random nonce aes md5 sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default eap-tls updown load = random nonce aes md5 sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default eap-tls updown
multiple_authentication=no multiple_authentication=no
syslog {
daemon {
tls = 2
}
}
} }
libtls { libtls {
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="tls 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -3,4 +3,9 @@
charon { charon {
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default eap-identity eap-md5 eap-ttls updown load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default eap-identity eap-md5 eap-ttls updown
multiple_authentication=no multiple_authentication=no
syslog {
daemon {
tls = 2
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="tls 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -3,4 +3,9 @@
charon { charon {
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default eap-identity eap-md5 eap-ttls updown load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default eap-identity eap-md5 eap-ttls updown
multiple_authentication=no multiple_authentication=no
syslog {
daemon {
tls = 2
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="tls 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -4,6 +4,11 @@ charon {
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default eap-identity eap-md5 eap-ttls updown load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default eap-identity eap-md5 eap-ttls updown
multiple_authentication=no multiple_authentication=no
syslog {
daemon {
tls = 2
}
}
plugins { plugins {
eap-ttls { eap-ttls {
phase2_method = md5 phase2_method = md5
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="tls 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -3,4 +3,9 @@
charon { charon {
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default eap-identity eap-md5 eap-ttls updown load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default eap-identity eap-md5 eap-ttls updown
multiple_authentication=no multiple_authentication=no
syslog {
daemon {
tls = 2
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="tls 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -3,4 +3,9 @@
charon { charon {
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default eap-identity eap-md5 eap-ttls updown load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default eap-identity eap-md5 eap-ttls updown
multiple_authentication=no multiple_authentication=no
syslog {
daemon {
tls = 2
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="tls 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -4,6 +4,11 @@ charon {
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default eap-identity eap-md5 eap-ttls updown load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default eap-identity eap-md5 eap-ttls updown
multiple_authentication=no multiple_authentication=no
syslog {
daemon {
tls = 2
}
}
plugins { plugins {
eap-ttls { eap-ttls {
phase2_method = md5 phase2_method = md5
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="tls 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -3,4 +3,9 @@
charon { charon {
load = random nonce aes md5 sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default eap-identity eap-md5 eap-ttls updown load = random nonce aes md5 sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default eap-identity eap-md5 eap-ttls updown
multiple_authentication=no multiple_authentication=no
syslog {
daemon {
tls = 2
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="tls 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -3,4 +3,9 @@
charon { charon {
load = random nonce aes md5 sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default eap-identity eap-md5 eap-ttls updown load = random nonce aes md5 sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default eap-identity eap-md5 eap-ttls updown
multiple_authentication=no multiple_authentication=no
syslog {
daemon {
tls = 2
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="knl 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -2,4 +2,9 @@
charon { charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
syslog {
daemon {
knl = 2
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="knl 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -3,4 +3,9 @@
charon { charon {
load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown load = random nonce aes sha1 sha2 md5 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
multiple_authentication = no multiple_authentication = no
syslog {
daemon {
knl = 2
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="knl 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -3,4 +3,9 @@
charon { charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
multiple_authentication = no multiple_authentication = no
syslog {
daemon {
knl = 2
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="knl 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -3,4 +3,9 @@
charon { charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
multiple_authentication = no multiple_authentication = no
syslog {
daemon {
knl = 2
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="knl 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -3,4 +3,9 @@
charon { charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
multiple_authentication = no multiple_authentication = no
syslog {
daemon {
knl = 2
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="tls 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -3,4 +3,9 @@
charon { charon {
load = pem pkcs1 random nonce openssl curl revocation stroke kernel-netlink socket-default eap-tls updown load = pem pkcs1 random nonce openssl curl revocation stroke kernel-netlink socket-default eap-tls updown
multiple_authentication=no multiple_authentication=no
syslog {
daemon {
tls = 2
}
}
} }
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="tls 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
keylife=20m keylife=20m
@@ -3,6 +3,11 @@
charon { charon {
load = pem pkcs1 random nonce openssl curl revocation stroke kernel-netlink socket-default eap-tls updown load = pem pkcs1 random nonce openssl curl revocation stroke kernel-netlink socket-default eap-tls updown
multiple_authentication=no multiple_authentication=no
syslog {
daemon {
tls = 2
}
}
} }
libtls { libtls {
@@ -1,8 +1,5 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file # /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="knl 2"
conn %default conn %default
ikelifetime=60m ikelifetime=60m
lifetime=10s lifetime=10s
@@ -4,4 +4,9 @@ charon {
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-pfkey kernel-netlink socket-default updown load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-pfkey kernel-netlink socket-default updown
# remove rekeyed inbound SA a bit quicker for the test scenario # remove rekeyed inbound SA a bit quicker for the test scenario
delete_rekeyed_delay = 2 delete_rekeyed_delay = 2
syslog {
daemon {
knl = 2
}
}
} }
@@ -4,7 +4,6 @@ charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
multiple_authentication = no multiple_authentication = no
syslog { syslog {
daemon { daemon {
tnc = 3 tnc = 3
@@ -3,8 +3,7 @@
charon-systemd { charon-systemd {
load = random nonce x509 openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-tnc tnc-tnccs tnc-imc tnc-imv tnccs-20 updown load = random nonce x509 openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-tnc tnc-tnccs tnc-imc tnc-imv tnccs-20 updown
multiple_authentication = no multiple_authentication = no
syslog { syslog {
daemon { daemon {
tnc = 2 tnc = 2
@@ -3,8 +3,7 @@
charon-systemd { charon-systemd {
load = random nonce x509 openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-tnc tnc-tnccs tnc-imc tnc-imv tnccs-20 updown load = random nonce x509 openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-tnc tnc-tnccs tnc-imc tnc-imv tnccs-20 updown
multiple_authentication = no multiple_authentication = no
syslog { syslog {
daemon { daemon {
tnc = 2 tnc = 2
@@ -5,7 +5,7 @@ charon-systemd {
multiple_authentication = no multiple_authentication = no
syslog { syslog {
daemon { daemon {
tnc = 2 tnc = 2
imv = 3 imv = 3