<div class="gmail_quote">On Thu, Jul 15, 2010 at 12:19 PM, Paul Wouters <span dir="ltr"><<a href="mailto:paul@xelerance.com">paul@xelerance.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div><div></div><div class="h5">On Wed, 14 Jul 2010, Brad Peterson wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
The authby section of man ipsec.conf(5) says authby can have a value of 'secret|rsasig' to accept either. I'm running openswan 2.6.25 and<br>
get an error using that value: "WARNING: /etc/ipsec.d/l2tp-psk.conf: 2: keyword authby, invalid value: secret|rsasig"<br>
<br>
I haven't found any mention in the docs, the git commits, or online of this option being removed. Was it replaced with anything?<br>
</blockquote>
<br></div></div>
I think we just never extended the parser for that. I think ideally, we would use a new keyword<br>
for this situation.<br>
<br>
It is a very uncommon scenario, and best avoided btw.<br><font color="#888888">
<br>
Paul<br>
</font></blockquote></div><br><div>I agree of course, and wish I had another way. But supporting iPhone clients is a priority, and they don't support certificates for L2TP/IPsec. I am hoping a dual-auth setup will let us accept iPhone clients, but still protect other connections from the man-in-the-middle attacks that PSK's allow.</div>
<div><br></div><div>Am I missing a better way to do this?</div><div><br></div><div>Bradley</div>