<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Answers below<br>
<br>
Paul Wouters wrote:
<blockquote
cite="mid:alpine.LFD.1.10.0908091332010.17998@newtla.xelerance.com"
type="cite">On Sat, 8 Aug 2009, Diego Rivera wrote:
<br>
<br>
<blockquote type="cite">Hello, everyone! I'd like to implement IPSec
for roadwarriors using x509
<br>
certificates. I already was able to achieve this with racoon but due
to
<br>
some very big bugs in racoon we've been forced to move away from it.
The
<br>
</blockquote>
<br>
Out of curiosity, what were those bugs?
<br>
</blockquote>
For racoon to execute auto-connect on tunnel drops the netkey policies
had to be stated statically. This caused problems when the tunnel was
down, but some process within the firewall itself (which was one of
the endpoints) tried to cross it. Said process would hang indefinitely
while the kernel tried to send stuff over a tunnel that wasn't there
and had no guarantee of coming back. Other minor nuisances such as
bugs in the configuration reload causing configuration file descriptors
to not be closed/released properly, among others.<br>
<blockquote
cite="mid:alpine.LFD.1.10.0908091332010.17998@newtla.xelerance.com"
type="cite"><br>
<blockquote type="cite">configuration we had in place was compatible
with Cisco VPN clients using
<br>
XAUTH against PAM (and thus LDAP or whatever backend auth we chose).
<br>
<br>
My questions for OpenSWAN are these:
<br>
* What's the PAM service name used when performing authentication?
<br>
</blockquote>
<br>
PAM authentication is only supported via system. You will likely need
<br>
to reomcpile openswan and enable it specifically in Makefile.inc.
<br>
<br>
<blockquote type="cite"> * How do I tell OpenSWAN in the
configurations that it should
<br>
authenticate via PAM for IPSec+XAUTH users?
<br>
</blockquote>
<br>
leftxauthserver, rightxauthclient. See the XAUTH and modeConfig options
<br>
in 'man ipsec.conf'. For a client, you either run a manual 'ipsec auto
<br>
--up connname' that will prompt for the user/passwd, or you can add
<br>
leftxauthusername= and an XAUTH password entry in /etc/ipsec.secrets
<br>
(see man ipsec.secrets)
<br>
</blockquote>
I know that's how you enable it so I guess a better question is: when I
don't specify "authby=secret", will it automagically use PAM? That's
more or less what I was asking.<br>
<blockquote
cite="mid:alpine.LFD.1.10.0908091332010.17998@newtla.xelerance.com"
type="cite"><br>
<blockquote type="cite"> * Is it possible to configure OpenSWAN as a
server for the Cisco VPN
<br>
client? (yeah - I know Cisco does some gnarly things but still ...
<br>
someone likely has tried it before and perhaps even succeeded)
<br>
+ If it is indeed possible, can anyone offer up sample
<br>
configs/guides/reference material/etc?
<br>
</blockquote>
<br>
It should be possible. You might need to de-obfuscate the Group Secret
<br>
in the pcf file, but there are tools in the contrib/ directory for
that.
<br>
Note that it might be a license violation with cisco to do this though.
<br>
<br>
Paul
<br>
</blockquote>
We're aware of the license implications, but this is an important
*backup* solution for us. It allows us to rapidly deploy firewall
equipment while the real equipment arrives (which can sometimes take a
couple of weeks).<br>
<br>
Also - would you happen to know how to tell pluto to *NOT* listen on
all interfaces/addresses? I have multiple interfaces on those boxes,
some of those with multiple IP's - yet I only want pluto to listen on a
couple. I can't seem to find clear documentation of how to achieve
this.<br>
<br>
Thanks!<br>
<br>
<div class="moz-signature">-- <br>
<style type="text/css">
p { margin: 0; }
</style>
<div style="font-family: Arial; font-size: 10pt; color: rgb(0, 0, 0);">
<font size="1"> Diego Rivera<br>
Director / System Operations<br>
Roundbox Global : <span
style="font-style: italic; color: rgb(102, 102, 102);">enterprise :
technology : genius</span><br>
------------------------------------------------------------------------------------------------------------------<br>
Avenida 11 y Calle 7-9, Barrio Amón, San José, Costa Rica<br>
tel: +1 (404) 567-5000 ext. 2147 | cel: +(506) 8393-0772 | fax: +(506)
2258-3695<br>
email: <a href="mailto:diego.rivera@rbxglobal.com">diego.rivera@rbxglobal.com</a>
| <a href="http://www.rbxglobal.com">www.rbxglobal.com</a><br>
------------------------------------------------------------------------------------------------------------------<br>
</font> </div>
</div>
</body>
</html>