<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 10pt; font-family: Verdana,Geneva,sans-serif'>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">Update:<br /> <br /> After having read thru openswan-2.6.51.3/docs/README.nss, I:<br /> <br /> <span style="color: #0000ff;"><a style="color: #0000ff;" href="mailto:root@raspberrypi">root@raspberrypi</a> /etc/ipsec.d</span># certutil -N -d /etc/ipsec.d/<br /> <br /> This created 4 .db files:<br /> <br /> <span style="color: #0000ff;"><a style="color: #0000ff;" href="mailto:root@raspberrypi">root@raspberrypi</a> /etc/ipsec.d#</span> ls -l *.db<br /> -rw------- 1 root root 65536 Apr 5 21:48 cert8.db<br /> -rw------- 1 root root 28672 Apr 5 21:24 cert9.db<br /> -rw------- 1 root root 16384 Apr 5 21:48 key3.db<br /> -rw------- 1 root root 28672 Apr 5 21:24 key4.db<br /> -rw------- 1 root root 16384 Apr 5 21:22 secmod.db<br /> <br /> Checking further, I found:<br /> <br /> <span style="color: #0000ff;"><a style="color: #0000ff;" href="mailto:root@raspberrypi">root@raspberrypi</a> /etc/ipsec.d#</span> ls *.db | xargs file<br />cert8.db: Berkeley DB 1.85 (Hash, version 2, native byte-order)<br />cert9.db: SQLite 3.x database, last written using SQLite version 3016002<br />key3.db: Berkeley DB 1.85 (Hash, version 2, native byte-order)<br />key4.db: SQLite 3.x database, last written using SQLite version 3016002<br />secmod.db: Berkeley DB 1.85 (Hash, version 2, native byte-order)</div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">*** Why am I getting <span>Berkeley and SQLite 3.x DBs?</span><br /><br /> Then I created nsspassword:<br /> <br /> <span style="color: #0000ff;"><a style="color: #0000ff;" href="mailto:root@raspberrypi">root@raspberrypi</a> /etc/ipsec.d#</span> echo cert8.db:<password> > nsspassword<br /> <span style="color: #0000ff;"><a style="color: #0000ff;" href="mailto:root@raspberrypi">root@raspberrypi</a> /etc/ipsec.d#</span> echo cert9.db:<password> > nsspassword<br /> <br /> Now I get:<br /> <br /> <span style="color: #0000ff;"><a style="color: #0000ff;" href="mailto:pi@raspberrypi">pi@raspberrypi</a> ~></span> systemctl status ipsec<br /> ...<br /> Apr 05 21:50:33 raspberrypi pluto[1227]: adding interface lo/lo ::1:500 (AF_INET6)<br /> Apr 05 21:50:33 raspberrypi ipsec__plutorun[1223]: 002 adding interface lo/lo ::1:500 (AF_INET6)<br /> Apr 05 21:50:33 raspberrypi pluto[1227]: loading secrets from "/etc/ipsec.secrets"<br /> Apr 05 21:50:33 raspberrypi ipsec__plutorun[1223]: 002 loading secrets from "/etc/ipsec.secrets"<br /> Apr 05 21:50:33 raspberrypi pluto[1227]: loading secrets from "/var/lib/openswan/ipsec.secrets.inc"<br /> Apr 05 21:50:33 raspberrypi ipsec__plutorun[1223]: 002 loading secrets from "/var/lib/openswan/ipsec.secrets.inc"<br /> Apr 05 21:50:33 raspberrypi pluto[1227]: could not open host cert with nick name '/etc/ipsec.d/private/raspberrypiKey.pem' in NSS DB<br /> Apr 05 21:50:33 raspberrypi ipsec__plutorun[1223]: 002 could not open host cert with nick name '/etc/ipsec.d/private/raspberrypiKey.pem' in NSS DB<br /> Apr 05 21:50:33 raspberrypi pluto[1227]: "/var/lib/openswan/ipsec.secrets.inc" line 1: NSS certficate not found<br /> Apr 05 21:50:33 raspberrypi ipsec__plutorun[1223]: 003 "/var/lib/openswan/ipsec.secrets.inc" line 1: NSS certficate not found<br /> <br /> and:<br /> <br /> <span style="color: #0000ff;"><a style="color: #0000ff;" href="mailto:root@raspberrypi">root@raspberrypi</a> /etc/ipsec.d#</span> ipsec verify<br /> Checking if IPsec got installed and started correctly:<br /> <br /> Version check and ipsec on-path [OK]<br /> Openswan U2.6.51.2/K4.14.79-v7+ (netkey)<br /> See `ipsec --copyright' for copyright information.<br /> Checking for IPsec support in kernel [OK]<br /> NETKEY: Testing XFRM related proc values<br /> ICMP default/send_redirects [NOT DISABLED]<br /> <br /> Disable /proc/sys/net/ipv4/conf/*/send_redirects or NETKEY will cause act on or cause sending of bogus ICMP redirects!<br /> <br /> ICMP default/accept_redirects [NOT DISABLED]<br /> <br /> Disable /proc/sys/net/ipv4/conf/*/accept_redirects or NETKEY will cause act on or cause sending of bogus ICMP redirects!<br /> <br /> XFRM larval drop [OK]<br /> Hardware random device check [N/A]<br /> Two or more interfaces found, checking IP forwarding [FAILED]<br /> Checking rp_filter [OK]<br /> Checking that pluto is running [OK]<br /> Pluto listening for IKE on udp 500 [FAILED]<br /> Pluto listening for IKE on tcp 500 [NOT IMPLEMENTED]<br /> Pluto listening for IKE/NAT-T on udp 4500 [DISABLED]<br /> Pluto listening for IKE/NAT-T on tcp 4500 [NOT IMPLEMENTED]<br /> Pluto listening for IKE on tcp 10000 (cisco) [NOT IMPLEMENTED]<br /> Checking NAT and MASQUERADEing [TEST INCOMPLETE]<br /> Checking 'ip' command [OK]<br /> Checking 'iptables' command [OK]<br /> <br /> ipsec verify: encountered errors<br /> <br /> I'm not sure why I'm getting: "Pluto listening for IKE on udp 500 [FAILED]"</div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"><br /> <br /> On 2019-04-05 19:53, jchludzinski wrote:
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">I downloaded the latest and greatest source from<br /> <a href="https://www.openswan.org" target="_blank" rel="noopener noreferrer">https://www.openswan.org</a>. I wanted to build openswan with support for<br /> NSS. This appears to have worked using the USE_LIBNSS environment<br /> variable.<br /> <br /> Next:<br /> $ set -x USE_LIBNSS true<br /> (I use the fish shell, like all sane people).<br /> <br /> Then:<br /> $ make programs<br /> $ sudo make install<br /> <br /> Then I try:<br /> <br /> ~/openswan-2.6.51.3> sudo systemctl start ipsec<br /> <br /> ~/openswan-2.6.51.3> systemctl status ipsec<br /> <br /> ● ipsec.service - LSB: Start Openswan IPsec at boot time<br /> Loaded: loaded (/etc/init.d/ipsec; generated; vendor preset: enabled)<br /> Active: active (running) since Fri 2019-04-05 19:32:19 EDT; 16min ago<br /> Docs: man:systemd-sysv-generator(8)<br /> Process: 24261 ExecStop=/etc/init.d/ipsec stop (code=exited, status=0/SUCCESS)<br /> Process: 24360 ExecStart=/etc/init.d/ipsec start (code=exited,<br /> status=0/SUCCESS)<br /> CGroup: /system.slice/ipsec.service<br /> ├─24502 /bin/sh /usr/local/lib/ipsec/_plutorun --debug<br /> --uniqueids yes --force_busy no --nocrsend no --strictcrlpolicy no<br /> --nat_traversal yes --keep_alive --protostack auto --force_keepali<br /> ├─24503 logger -s -p daemon error -t ipsec__plutorun<br /> ├─24504 /bin/sh /usr/local/lib/ipsec/_plutorun --debug<br /> --uniqueids yes --force_busy no --nocrsend no --strictcrlpolicy no<br /> --nat_traversal yes --keep_alive --protostack auto --force_keepali<br /> ├─24505 /bin/sh /usr/local/lib/ipsec/_plutoload --wait no --post<br /> ├─24507 /usr/local/libexec/ipsec/pluto --nofork<br /> --secretsfile /etc/ipsec.secrets --ipsecdir /etc/ipsec.d --use-auto<br /> --uniqueids --nat_traversal --virtual_private<br /> %v4:10.0.0.0/8,%v4:192.168<br /> └─24518 _pluto_adns -- <idle><br /> <br /> Apr 05 19:32:20 raspberrypi pluto[24507]: adding interface lo/lo<br /> ::1:500 (AF_INET6)<br /> Apr 05 19:32:20 raspberrypi ipsec__plutorun[24503]: 002 adding<br /> interface lo/lo ::1:500 (AF_INET6)<br /> Apr 05 19:32:20 raspberrypi pluto[24507]: loading secrets from<br /> "/etc/ipsec.secrets"<br /> Apr 05 19:32:20 raspberrypi ipsec__plutorun[24503]: 002 loading<br /> secrets from "/etc/ipsec.secrets"<br /> Apr 05 19:32:20 raspberrypi pluto[24507]: loading secrets from<br /> "/var/lib/openswan/ipsec.secrets.inc"<br /> Apr 05 19:32:20 raspberrypi ipsec__plutorun[24503]: 002 loading<br /> secrets from "/var/lib/openswan/ipsec.secrets.inc"<br /> Apr 05 19:32:20 raspberrypi pluto[24507]: could not open host cert<br /> with nick name '/etc/ipsec.d/private/raspberrypiKey.pem' in NSS DB<br /> Apr 05 19:32:20 raspberrypi ipsec__plutorun[24503]: 002 could not<br /> open host cert with nick name<br /> '/etc/ipsec.d/private/raspberrypiKey.pem' in NSS DB<br /> Apr 05 19:32:20 raspberrypi pluto[24507]:<br /> "/var/lib/openswan/ipsec.secrets.inc" line 1: NSS certficate not found<br /> Apr 05 19:32:20 raspberrypi ipsec__plutorun[24503]: 003<br /> "/var/lib/openswan/ipsec.secrets.inc" line 1: NSS certficate not found<br /> <br /> How to I get past the final 4 messages?</blockquote>
<br />
<div>-- <br />
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">NULL</div>
</div>
</div>
</body></html>