[Openswan dev] thoughts on openswan initscripts

[Michael Richardson]

-----BEGIN PGP SIGNED MESSAGE-----


>>>>> "Paul" == Paul Wouters <paul at xelerance.com> writes:
    >> 2. For something as complex as IPsec, duplicating all the
    >> configuration in a ifcfg-XXX file seems to not make sense. Why not
    >> just have something like:
    >> 
    >> IPSECCONS="me2work me2home"
    >> 
    >> You could stick that in a /etc/sysconfig/network-scripts/ifcfg-XXX or
    >> globally via /etc/sysconfig/network.
    >> 
    >> The actual configuration for the connections could/should stay in the
    >> /etc/ipsec.conf file.

    Paul> ipsec.conf supports including files, so it's easy to put conns in
    Paul> seperate files in /etc/ipsec.d/conns/connname.conf This will make
    Paul> it easier for any redhat-config-* tool to work on it.

  One could conceive of eventually just knowing that "connname" lives in
/etc/ipsec.d/conns/connname.conf, or
/etc/sysconfig/security-scritps/connname.conf.  

  A parser (in C rather than AWK!) for ipsec.conf exists, and has been
partially adapted to version 2 configuration files. It will eventually get
finished. If there is a different syntax that is desired (even some
XML variant, but please, let's do the DTD right), it could easily be adapted,
since syntax is just a front-end issue.

    >> BTW, the way I've done the Red Hat / IPsec thing is to have no linkage
    >> with the ifcfg scripts and define all my connections in
    >> /etc/ipsec.conf.  And when I want to bring up my tunnels, I do:
    >> 
    >> service ipsec start

    Paul> The service (or rather pluto) should start in time to prevent
    Paul> packets meant for ipsec tunnels to go out the default gateway. So
    Paul> yes, starting the service is always needed.

  This is a critical thing. 
  Independant of the tunnel being brought up, the firewalling must be
present.

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson,    Xelerance Corporation, Ottawa, ON    |net architect[
] mcr at xelerance.com      http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
Comment: Finger me for keys

iQCVAwUBQDEpEoqHRg3pndX9AQFw1QP/aoR5KjHkw0g44bbVZXdOEsV4vIcGwnA0
DLsQIQCydaCb6kxa8zCp3P7Q/ZwP4pVr8GsMRz/vAYyHEL4U3smkp4VqET35EeGu
aRmV6JMZegOhYyhpc1lMGrIb/AxG31TixgjMJDHrr0MDWeP1S2L/16BLoe2VyD6n
D+VqPokU96o=
=pgJ4
-----END PGP SIGNATURE-----