MESSAGE
| DATE | 2001-10-16 |
| FROM | Brooklyn Linux Solutions CEO
|
| SUBJECT | Subject: [hangout] Setup of Free Swan - Authentication Troubles (fwd)
|
----- Forwarded message from Brooklyn Linux Solutions CEO -----
>From ruben-at-mrbrklyn.com Tue Oct 16 13:09:25 2001
Received: (from ruben-at-localhost)
by www2.mrbrklyn.com (8.11.2/8.11.2/SuSE Linux 8.11.1-0.5) id f9GH9PR06976;
Tue, 16 Oct 2001 13:09:25 -0400
From: Brooklyn Linux Solutions CEO
Message-Id: <200110161709.f9GH9PR06976-at-www2.mrbrklyn.com>
Subject: Setup of Free Swan - Authentication Troubles
In-Reply-To: <20011014194802.A4586-at-www2.mrbrklyn.com> from Brooklyn Linux Solutions
CEO at "Oct 14, 2001 07:48:02 pm"
To: ruben-at-mrbrklyn.com
Date: Tue, 16 Oct 2001 13:09:25 -0400 (EDT)
CC: users-at-lists.freeswan.org
X-Mailer: ELM [version 2.4ME+ PL60 (25)]
Hello
I got the freeswan to finally compile on the SuSe box, and
the new kernel working.
I'm testing the connections between ghost.rm-cpa.com and www2.mrbrklyn.com
When I built the ipsec.conf file, the sample seemed to leave out the
rightid and rightrsasigkey lines, and the left side entries as well.
They were not refered to in the documentation in the section headed
The setup section of ipsec.conf(5)
Until the very in
Examples Setups
VPN
They are memntioned in the RSA section only.
In the example earlier in the section where it says:
Editing a connection description
The variables are left out. You might consider adding them
to the example since it says there that any variables not
included are in the default conn section.
My ipsec.conf currently looks like this:
# /etc/ipsec.conf - FreeS/WAN IPsec configuration file
# More elaborate and more varied sample configurations can be found
# in FreeS/WAN's doc/examples file, and in the HTML documentation.
# basic configuration
config setup
# THIS SETTING MUST BE CORRECT or almost nothing will work;
# %defaultroute is okay for most simple cases.
interfaces=%defaultroute
# Debug-logging controls: "none" for (almost) none, "all" for lots.
klipsdebug=all
plutodebug=all
# Use auto= parameters in conn descriptions to control startup actions.
plutoload=%search
plutostart=%search
# Close down old connection when new one using same ID shows up.
uniqueids=yes
# defaults for subsequent connection descriptions
conn %default
# How persistent to be in (re)keying negotiations (0 means very).
keyingtries=0
# RSA authentication with keys from DNS.
authby=rsasig
leftrsasigkey=%dns
rightrsasigkey=%dns
# connection description for (experimental!) opportunistic encryption
# (requires KEY record in your DNS reverse map; see doc/opportunism.howto)
conn me-to-anyone
left=%defaultroute
right=%opportunistic
# uncomment to enable incoming; change to auto=route for outgoing
#auto=add
# sample VPN connection
conn sample
# Left security gateway, subnet behind it, next hop toward right.
left=10.0.0.1
leftsubnet=172.16.0.0/24
leftnexthop=10.22.33.44
# Right security gateway, subnet behind it, next hop toward left.
right=10.12.12.1
rightsubnet=192.168.0.0/24
rightnexthop=10.101.102.103
# To authorize this connection, but not actually start it, at startup,
# uncomment this.
#auto=add
conn mrbrklyn-rmcpa
# Left security gateway, subnet behind it, next hop toward right.
leftid=-at-www2.mrbrklyn.com
leftrsasigkey=0x0103787928345762726b58102e2415c47c67cad145539eb4f911f2678768371597dea73bbe6d7a3130a980cb15ac4d9844dd7b1e4af23c932b68c5e6f13ea9e89efe51a8fc26f829f01698329da4f4c48c6637efc09dcf3c6b5fc6f039dd743f5827b3991e18b86a40280adf1f60b5a28f3e1f06002c08d06a2362f01f670095025cac551cc4d0a430e430af070728e3df1bec47dd262b3f14835d3653c1a84d964daf4fb42e9ef4bd7cdddb51fab29419ca69557b02c553b06a86e96d2e562f9f2794fbef8989c8ae0bb6c271e27d779a4825de2869f7c92ea6cb8dcada5ad43e46cf89be7c38c33048727b8dab2f4c710d500800839bb0b1565331e424627beb51
left=216.254.112.136
leftsubnet=216.254.112.0/24
leftnexthop=216.254.112.1
# Right security gateway, subnet behind it, next hop toward left.
rightid=-at-ghost.rm-cpa.com
rightrsasigkey=0sAQPL4QnEfO98ISHxaNl+srtSjr5/0bCGhee2B3f7yE16rYIWwqgWlcivrk28mEjMIpwJg5FCAEnfe0HSCzCSr7RHKes8htZgj3PbdDjINiZTNQtYU7oEcsQMRVaQGgMdnX4c3ofi8AE1P/RJLueHGguC7udtHrv89MZ8sKgFEfhQOkr+t9GalIvkpLLHVV3uNdt3D7fxwNzfWo63Rk+/V7BvRxT8ya4sz8cMdHTuamMfLvM6KFFQio7oU3RGlbZIijts0z18bHwEhC7coaZZOaMMN6/ujpelSr
+xI8sgNpxG+jCjknf8P6FsWm86Ws/dn0GNyKeFYKG1j8zUOxN6FxU/
right=216.112.229.115
rightsubnet=192.168.0.0/24
rightnexthop=216.112.229.113
# To authorize this connection, but not actually start it, at startup,
# uncomment this.
auto=add
When I try to turn on the connection mrbrklyn-rmcpa, I get the following:
[root-at-phantom ruben]# /usr/local/sbin/ipsec auto --up mrbrklyn-rmcpa
104 "mrbrklyn-rmcpa" #55: STATE_MAIN_I1: initiate
106 "mrbrklyn-rmcpa" #55: STATE_MAIN_I2: from STATE_MAIN_I1; sent MI2, expecting MR2
108 "mrbrklyn-rmcpa" #55: STATE_MAIN_I3: from STATE_MAIN_I2; sent MI3, expecting MR3
010 "mrbrklyn-rmcpa" #55: STATE_MAIN_I3: retransmission; will wait 20s for response
003 "mrbrklyn-rmcpa" #55: discarding duplicate packet; already STATE_MAIN_I3
010 "mrbrklyn-rmcpa" #55: STATE_MAIN_I3: retransmission; will wait 40s for response
003 "mrbrklyn-rmcpa" #55: discarding duplicate packet; already STATE_MAIN_I3
031 "mrbrklyn-rmcpa" #55: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message
000 "mrbrklyn-rmcpa" #55: starting keying attempt 2 of an unlimited number, but releasing whack
I noticed the the ipsec.secets file has the public keys
commented out and they don't start with
-at-my.com: like it says in the ipsec.secrets man page.
It says on both sides:
: RSA {
# RSA 2048 bits phantom.rm-cpa.com Tue Sep 25 17:51:20 2001
# for signatures only, UNSAFE FOR ENCRYPTION
#pubkey=0sAQPL4QnEfO98ISHxaNl+srtSjr5/0b....
Any clues how to proceed from here?
Ruben
----- End of forwarded message from Brooklyn Linux Solutions CEO -----
____________________________
New Yorker Linux Users Scene
Fair Use -
because it's either fair use or useless....
|
|
