From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Date: Fri, 14 Oct 2005 09:32:48 +0400 From: Vitaly Gorshkov X-Mailer: The Bat! (v3.5) Professional X-Priority: 3 (Normal) Message-ID: <1063760809.20051014093248@mail.ru> To: community@altlinux.ru MIME-Version: 1.0 Content-Type: text/plain; charset=koi8-r Content-Transfer-Encoding: 8bit Subject: [Comm] slackware 10 + freeswan + altllinux 2.4 + openswan X-BeenThere: community@altlinux.ru X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Vitaly Gorshkov , ALT Linux Community List-Id: ALT Linux Community List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Oct 2005 05:32:55 -0000 Archived-At: List-Archive: List-Post: есть два Slackware 10, между ними freeswan, в ipsec.conf написано version 2.0 - вроде как формат версии конфигурационных файлов. тут http://www.opennet.ru/base/net/ipsec_opnswan_howto.txt.html, написано: " что использовали пакет: "Скачиваем последний стабильный пакет системы OpenS/WAN, в моем случае это 2.3.1." " на АМ 2.4: rpm -qa|grep swan openswan-libdes-1.0.9-alt0.M24.1 openswan-1.0.9-alt0.M24.1 это последняя версия? в ipsec.conf version 2.0 нету. на Salckware: rpm -qa - не проходит - на Slackware сделал настройки для АМ 2.4 во что просиходит на АМ 2.4 ipsec setup restart Oct 14 09:17:29 linux2 ipsec__plutorun: Starting Pluto subsystem... Oct 14 09:17:29 linux2 pluto[31240]: Starting Pluto (Openswan Version 1.0.9) Oct 14 09:17:29 linux2 pluto[31240]: including X.509 patch with traffic selectors (Version 0.9.42) Oct 14 09:17:29 linux2 pluto[31240]: including NAT-Traversal patch (Version 0.6) [disabled] Oct 14 09:17:29 linux2 pluto[31240]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0) Oct 14 09:17:29 linux2 pluto[31240]: ike_alg_register_enc(): Activating OAKLEY_BLOWFISH_CBC: Ok (ret=0) Oct 14 09:17:29 linux2 pluto[31240]: ike_alg_register_enc(): Activating OAKLEY_CAST_CBC: Ok (ret=0) Oct 14 09:17:29 linux2 pluto[31240]: ike_alg_register_enc(): Activating OAKLEY_SERPENT_CBC: Ok (ret=0) Oct 14 09:17:29 linux2 pluto[31240]: ike_alg_register_hash(): Activating OAKLEY_SHA2_256: Ok (ret=0) Oct 14 09:17:29 linux2 pluto[31240]: ike_alg_register_hash(): Activating OAKLEY_SHA2_512: Ok (ret=0) Oct 14 09:17:29 linux2 pluto[31240]: ike_alg_register_enc(): Activating OAKLEY_TWOFISH_CBC: Ok (ret=0) Oct 14 09:17:29 linux2 pluto[31240]: ike_alg_register_enc(): Activating OAKLEY_SSH_PRIVATE_65289: Ok (ret=0) Oct 14 09:17:29 linux2 pluto[31240]: Changing to directory '/etc/openswan/ipsec.d/cacerts' Oct 14 09:17:29 linux2 pluto[31240]: Warning: empty directory Oct 14 09:17:29 linux2 pluto[31240]: Changing to directory '/etc/openswan/ipsec.d/crls' Oct 14 09:17:29 linux2 pluto[31240]: Warning: empty directory Oct 14 09:17:30 linux2 pluto[31240]: OpenPGP certificate file '/etc/pgpcert.pgp' not found Oct 14 09:17:30 linux2 pluto[31240]: | from whack: got --esp=3des Oct 14 09:17:30 linux2 pluto[31240]: | from whack: got --ike=3des Oct 14 09:17:30 linux2 pluto[31240]: added connection description "ru-prag" Oct 14 09:17:30 linux2 pluto[31240]: listening for IKE messages Oct 14 09:17:30 linux2 pluto[31240]: adding interface ipsec1/ppp0 ххх.ххх.ххх.ххх Oct 14 09:17:30 linux2 pluto[31240]: loading secrets from "/etc/openswan/ipsec.secrets" ключи сгенерил ipsec rsasigkey 1936 + добавил ": RSA { }" вот что показывает ipsec auto --status 000 interface ipsec1/ppp0 xxx.xxx.xxx.xxx 000 000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=64, keysizemin=168, keysizemax=168 000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128 000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160 000 000 algorithm IKE encrypt: id=65289, name=OAKLEY_SSH_PRIVATE_65289, blocksize=16, keydeflen=128 000 algorithm IKE encrypt: id=65005, name=OAKLEY_TWOFISH_CBC, blocksize=16, keydeflen=128 000 algorithm IKE encrypt: id=65004, name=OAKLEY_SERPENT_CBC, blocksize=16, keydeflen=128 000 algorithm IKE encrypt: id=6, name=OAKLEY_CAST_CBC, blocksize=8, keydeflen=128 000 algorithm IKE encrypt: id=3, name=OAKLEY_BLOWFISH_CBC, blocksize=8, keydeflen=128 000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128 000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192 000 algorithm IKE hash: id=6, name=OAKLEY_SHA2_512, hashsize=64 000 algorithm IKE hash: id=4, name=OAKLEY_SHA2_256, hashsize=32 000 algorithm IKE hash: id=2, name=OAKLEY_SHA, hashsize=20 000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16 000 algorithm IKE dh group: id=1, name=OAKLEY_GROUP_MODP768, bits=768 000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024 000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536 000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048 000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072 000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096 000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144 000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192 000 000 stats db_ops.c: {curr_cnt, total_cnt, maxsz} :context={0,0,0} trans={0,0,0} attrs={0,0,0} 000 000 "ru-prag": 172.16.0.0/24===xxx.xx.x.xx---xxx.xx.xx.xxx...xx.xx.xxx.xxx---xx.xx.xxx.xxx===192.168.2.0/24 000 "ru-prag": CAs: '%any'...'%any' 000 "ru-prag": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 10 000 "ru-prag": policy: PSK+ENCRYPT+TUNNEL+PFS+DISABLEARRIVALCHECK; interface: ; unrouted 000 "ru-prag": newest ISAKMP SA: #0; newest IPsec SA: #0; eroute owner: #0 000 "ru-prag": IKE algorithms wanted: 5_000-1-5, 5_000-2-5, 5_000-1-2, 5_000-2-2, 5_000-1-1, 5_000-2-1, flags=-strict 000 "ru-prag": IKE algorithms found: 5_192-1_128-5, 5_192-2_160-5, 5_192-1_128-2, 5_192-2_160-2, 5_192-1_128-1, 5_192-2_160-1, 000 "ru-prag": ESP algorithms wanted: 3_000-1, 3_000-2, flags=-strict 000 "ru-prag": ESP algorithms loaded: 3_168-1_128, 3_168-2_160, 000 000 АМ 2.4 ipsec.conf config setup interfaces="ipsec1=ppp0" klipsdebug=none plutodebug=none plutoload=%search plutostart=%search plutowait=no uniqueids=yes conn ru-prag auth=esp type=tunnel keyingtries=10 authby=secret left=ххх.хх.х.хх leftsubnet=172.16.0.0/24 leftnexthop=ххх.хх.хх.ххх right=хх.хх.ххх.ххх rightsubnet=192.168.2.0/24 rightnexthop=хх.хх.ххх.ххх spi=0x300 auto=add ifconfig ... ipsec1 Link encap:Point-to-Point Protocol inet addr:ххх.хх.хх.ххх Mask:255.255.255.255 UP RUNNING NOARP MTU:16260 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:10 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) .... 1) можно ли подружить freeswan и openswan, где то читал что openswan -это продолжении freeswan, из-за американских законов.. 2) версия openswan на АМ 2.4 свежая? может делов ней? 3) или настройки ? -- С уважением, Vitaly mailto:vita55555@mail.ru icq: 138491970