MESSAGE
| DATE | 2002-06-30 |
| FROM | Ruben I Safir
|
| SUBJECT | Subject: [hangout] Fwd: Shared Secrets using SSH Sentinal fails [ruben@www2]
|
On 2002.06.30 11:27 Ruben I Safir wrote:
Hello
I've been knocking myself out trying to get the shared secrets
to work between Frees/Wan and SSH Sentinal. I've poured over documentation
and I'm completely out of ideas.
I have a NON patched version of FreeS/Wan running on a server
The Server has worked BEAUTIFULLY from Linux to Linux.
My ipsec.conf looks like this:
# basic configuration
config setup
# THIS SETTING MUST BE CORRECT or almost nothing will work;
# %defaultroute is okay for most simple cases.
interfaces=%defaultroute
# Debug-logging controls: "none" for (almost) none, "all" for lots.
klipsdebug=all
plutodebug=all
# Use auto= parameters in conn descriptions to control startup actions.
plutoload=%search
plutostart=%search
# Close down old connection when new one using same ID shows up.
uniqueids=yes
# defaults for subsequent connection descriptions
conn %default
# How persistent to be in (re)keying negotiations (0 means very).
keyingtries=0
# RSA authentication with keys from DNS.
#authby=rsasig
authby=secret
#leftrsasigkey=%dns
#rightrsasigkey=%dns
# connection description for (experimental!) opportunistic encryption
# (requires KEY record in your DNS reverse map; see doc/opportunism.howto)
conn me-to-anyone
left=%defaultroute
right=%opportunistic
# uncomment to enable incoming; change to auto=route for outgoing
#auto=add
conn mrbrklyn-rmcpa
# Left security gateway, subnet behind it, next hop toward right.
leftid=-at-www2.mrbrklyn.com
leftrsasigkey=some long key
left=216.254.112.136
leftsubnet=10.0.0..0/24
leftnexthop=216.254.112.1
# Right security gateway, subnet behind it, next hop toward left.
rightid=-at-ghost.rm-cpa.com
rightrsasigkey=some long key
right=216.112.229.115
rightsubnet=192.168.0.0/24
rightnexthop=216.112.229.113
# To authorize this connection, but not actually start it, at startup,
# uncomment this.
auto=add
conn www2-ghost
# Left security gateway, subnet behind it, next hop toward right.
leftid=-at-www2.mrbrklyn.com
leftrsasigkey=some long key
left=216.254.112.136
leftnexthop=216.254.112.1
# Right security gateway, subnet behind it, next hop toward left.
rightid=-at-ghost.rm-cpa.com
rightrsasigkey=some long key
right=216.112.229.115
rightnexthop=216.112.229.113
# To authorize this connection, but not actually start it, at startup,
# uncomment this.
auto=add
conn www2-rmcpa
# Left security gateway, subnet behind it, next hop toward right.
leftid=-at-www2.mrbrklyn.com
leftrsasigkey=some long key
left=216.254.112.136
leftnexthop=216.254.112.1
# Right security gateway, subnet behind it, next hop toward left.
rightid=-at-ghost.rm-cpa.com
rightrsasigkey=some long key
right=216.112.229.115
rightnexthop=216.112.229.113
rightsubnet=192.168.0.0/24
# To authorize this connection, but not actually start it, at startup,
# uncomment this.
auto=add
conn rmcpalap
type=tunnel
left=216.112.229.115
leftnexthop=216.112.229.113
leftsubnet=192.168.0.0/24
right=0.0.0.0
rightnexthop=
rightsubnet=
keyexchange=ike
keylife=8h
pfs=yes
authby=secret
auto=add
ipsec.secrets is this
# This file holds shared secrets or RSA private keys for inter-Pluto
# authentication. See ipsec_pluto(8) manpage, and HTML documentation.
216.112.229.115 %any: PSK "THE STUPID SECRET"
# RSA private key for this host, authenticating it to any other host
# which knows the public part. Suitable public keys, for ipsec.conf, DNS,
# or configuration of other implementations, can be extracted conveniently
# with "ipsec showhostkey".
: RSA {
# RSA 2048 bits phantom.rm-cpa.com Tue Sep 25 17:51:20 2001
# for signatures only, UNSAFE FOR ENCRYPTION
#pubkey=some long key
# (0x4200 = auth-only host-level, 4 = IPSec, 1 = RSA)
Modulus: some long key
PublicExponent: 0x03
# everything after this point is secret
PrivateExponent: some long key
Prime1: Some Long Key
Exponent1: Some Long Key
Exponent2: Some Long Key
Coefficient: Some Long Key
}
# do not change the indenting of that "}"
Originally, when I had the %default authby=rsasig it complained that I was using the wrong certificate,
regardless of having the 'new preshared key' selected for the authenticity key.
Now the IKE window is saying
0.0.0.0:500 (Initiator) <-> 216.112.229.115:500 { b6160729 b9000000 - 7b7113b1 1152b34e [-1] / 0x00000000 } IP; No pre shared key found
0.0.0.0:500 (Initiator) <-> 216.112.229.115:500 { b6160729 b9000000 - 7b7113b1 1152b34e [-1] / 0x00000000 } IP; No pre shared key found
0.0.0.0:500 (Initiator) <-> 216.112.229.115:500 { b6160729 b9000000 - 7b7113b1 1152b34e [-1] / 0x00000000 } IP; Error = Authentication failed (24)
unknown (unknown) <-> unknown { unknown [unknown] / unknown } unknown; Packet to unknown Isakmp SA, ip = 216.112.229.115:500
unknown (unknown) <-> unknown { unknown [unknown] / unknown } unknown; Packet to unknown Isakmp SA, ip = 216.112.229.115:500
0.0.0.0:500 (Initiator) <-> 216.112.229.115:500 { 88b95a6e c0000001 - a51dbf97 cb047c56 [-1] / 0x00000000 } IP; No pre shared key found
0.0.0.0:500 (Initiator) <-> 216.112.229.115:500 { 88b95a6e c0000001 - a51dbf97 cb047c56 [-1] / 0x00000000 } IP; No pre shared key found
0.0.0.0:500 (Initiator) <-> 216.112.229.115:500 { 88b95a6e c0000001 - a51dbf97 cb047c56 [-1] / 0x00000000 } IP; Error = Authentication failed (24)
unknown (unknown) <-> unknown { unknown [unknown] / unknown } unknown; Packet to unknown Isakmp SA, ip = 216.112.229.115:500
unknown (unknown) <-> unknown { unknown [unknown] / unknown } unknown; Packet to unknown Isakmp SA, ip = 216.112.229.115:500
I need the RSA Authentication AND the Preshared Secret to work. I've poured over SSH's docs and FreeSwans
docs. I'm at a complete loss.
One more point, the pre-shared secrets window in Sentinal should take Cut and Paste better.
And as a general question, why does SSH recommend in it's documentation to make 3 keys with openssl
in it's document VPN Connection with Certificates to FreeS/WAN Security Gateway.?
--
__________________________
Brooklyn Linux Solutions
__________________________
http://www.mrbrklyn.com - Consulting
http://www.brooklynonline.com - For the love of Brooklyn
http://www.nylxs.com - Leadership Development in Free Software
http://www.nyfairuse.org - The foundation of Democracy
http://www2.mrbrklyn.com/resources - Unpublished Archive or stories and articles from around the net
http://www2.mrbrklyn.com/mp3/dr.mp3 - Imagine my surprise when I saw you...
http://www2.mrbrklyn.com/downtown.html - See the New Downtown Brooklyn....
1-718-382-5752
--
__________________________
Brooklyn Linux Solutions
__________________________
http://www.mrbrklyn.com - Consulting
http://www.brooklynonline.com - For the love of Brooklyn
http://www.nylxs.com - Leadership Development in Free Software
http://www.nyfairuse.org - The foundation of Democracy
http://www2.mrbrklyn.com/resources - Unpublished Archive or stories and articles from around the net
http://www2.mrbrklyn.com/mp3/dr.mp3 - Imagine my surprise when I saw you...
http://www2.mrbrklyn.com/downtown.html - See the New Downtown Brooklyn....
1-718-382-5752
____________________________
New Yorker Linux Users Scene
Fair Use -
because it's either fair use or useless....
|
|
