Hi

I wonder if anyone has example config files that work with Netkey?

Regards Richard


Richard de Rivaz  wrote:
>                 Hi
> 
> I am trying to use Openswan on Ubuntu to create an ipsec vpn but so far do not seem able to get Openswan to startup correctly. 'ipsec verify' produces the following:
> 
> Checking your system to see if IPsec got installed and started correctly:
> Version check and ipsec on-path                                 [OK]
> Linux Openswan U2.4.12/K2.6.27-9-generic (netkey)
> Checking for IPsec support in kernel                            [OK]
> NETKEY detected, testing for disabled ICMP send_redirects       [FAILED]
> 
>   Please disable /proc/sys/net/ipv4/conf/*/send_redirects
>   or NETKEY will cause the sending of bogus ICMP redirects!
> 
> NETKEY detected, testing for disabled ICMP accept_redirects     [FAILED]
> 
>   Please disable /proc/sys/net/ipv4/conf/*/accept_redirects
>   or NETKEY will accept bogus ICMP redirects!
> 
> Checking for RSA private key (/etc/ipsec.secrets)               [DISABLED]
>   ipsec showhostkey: no default key in "/etc/ipsec.secrets"
> Checking that pluto is running                                  [FAILED]
>   whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
> Two or more interfaces found, checking IP forwarding            [FAILED]
>   whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
> Checking NAT and MASQUERADEing                                  [N/A]
>   whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
> Checking for 'ip' command                                       [OK]
> Checking for 'iptables' command                                 [OK]
> Opportunistic Encryption Support                                [DISABLED]
> 
> 
> sysctl.conf is as follows:
> 
> #
> # /etc/sysctl.conf - Configuration file for setting system variables
> # See /etc/sysctl.d/ for additional system variables.
> # See sysctl.conf (5) for information.
> #
> 
> #kernel.domainname = example.com
> 
> # Uncomment the following to stop low-level messages on console
> #kernel.printk = 4 4 1 7
> 
> ##############################################################3
> # Functions previously found in netbase
> #
> 
> # Uncomment the next two lines to enable Spoof protection (reverse-path filter)
> # Turn on Source Address Verification in all interfaces to
> # prevent some spoofing attacks
> net.ipv4.conf.default.rp_filter = 0
> net.ipv4.conf.all.rp_filter = 1
> 
> # Uncomment the next line to enable TCP/IP SYN cookies
> # This disables TCP Window Scaling (http://lkml.org/lkml/2008/2/5/167),
> # and is not recommended.
> net.ipv4.tcp_syncookies = 1
> 
> # Uncomment the next line to enable packet forwarding for IPv4
> net.ipv4.ip_forward = 1
> 
> # Uncomment the next line to enable packet forwarding for IPv6
> net.ipv6.conf.all.forwarding=1
> 
> 
> ###################################################################
> # Additional settings - these settings can improve the network
> # security of the host and prevent against some network attacks
> # including spoofing attacks and man in the middle attacks through
> # redirection. Some network environments, however, require that these
> # settings are disabled so review and enable them as needed.
> #
> # Ignore ICMP broadcasts
> net.ipv4.icmp_echo_ignore_broadcasts = 1
> #
> # Ignore bogus ICMP errors
> net.ipv4.icmp_ignore_bogus_error_responses = 1
> # 
> # Do not accept ICMP redirects (prevent MITM attacks)
> net.ipv4.conf.all.accept_redirects = 0
> net.ipv6.conf.all.accept_redirects = 0
> # _or_
> # Accept ICMP redirects only for gateways listed in our default
> # gateway list (enabled by default)
> net.ipv4.conf.all.secure_redirects = 0
> #
> # Do not send ICMP redirects (we are not a router)
> net.ipv4.conf.all.send_redirects = 0
> #
> # Do not accept IP source route packets (we are not a router)
> net.ipv4.conf.all.accept_source_route = 0
> net.ipv6.conf.all.accept_source_route = 0
> #
> # Log Martian Packets
> net.ipv4.conf.all.log_martians = 1
> #
> # The contents of /proc/<pid>/maps and smaps files are only visible to 
> # readers that are allowed to ptrace() the process
> sys.kernel.maps_protect = 1
> 
> I would be grateful for any help in getting Openswan to work on Ubuntu 8.10
> 
> Regards Richard
> -- 
> 
> Richard de Rivaz
> MDR Interfaces Ltd
> Computer Control Specialists
> 
> Tel: +44(0)1825 790294  Fax: +44(0)1825 790119
> Reg in England No. 1577056 Directors: R de Rivaz   Z de Rivaz
> Reg Address: Little Bridge House, Danehill, Sussex RH17 7JD
> 
> http://www.mdr.co.uk                
-- 

Richard de Rivaz
MDR Interfaces Ltd
Computer Control Specialists

Tel: +44(0)1825 790294  Fax: +44(0)1825 790119
Reg in England No. 1577056 Directors: R de Rivaz   Z de Rivaz
Reg Address: Little Bridge House, Danehill, Sussex RH17 7JD

http://www.mdr.co.uk