LinuxQuestions.org
Visit Jeremy's Blog.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
Reload this Page IPsec:Problem with setkey
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
Page 2 of 2 1 2
  Search this Thread
Old 10-24-2006, 12:04 AM   #16
hegdeshashi
Member
 
Registered: Dec 2005
Posts: 73
Blog Entries: 3

Rep: Reputation: 15

hi,

If you want to work with ipsec, just use SAD & SPD entries.In SAD entry, you have 16 bits auth value,that's the password for you to commnicate .If you change that one you can't ping6.
 
Old 10-26-2006, 07:53 PM   #17
squirtle
Member
 
Registered: Jun 2006
Posts: 55

Original Poster
Rep: Reputation: 15
Hi,
This is my SAD and SPD entries in the server PC.
add -6 2001:328:2003:2::11 2001:328:2::12 ah 17000 -m transport -A hmac-md5 "1234567890123456";
add -6 2001:328:2003:2::12 2001:328:2::11 ah 17001 -m transport -A hmac-md5 "1234567890123456";

add 2001:328:2003:2::11 2001:328:2::12 esp 25000 -m transport -E des-cbc "12345678";
add 2001:328:2003:2::12 2001:328:2::11 esp 25000 -m transport -E des-cbc "12345678";

spdadd 2001:328:2003:2::11 2001:328:2003:2::12 any -P out ipsec esp/transport//require;

spdadd 2001:328:2003:2::12 2001:328:2003:2::11 any -P out ipsec esp/transport//require;

Then SAD and SPD entries in remote host is also same?only replace "in" withe "out" ?The key I use in Ah is "1234567890123456" and ESP is "12345678" is right"

Then I need to test the ipsec with tcpdump?
No command to start the ipsec?Just setup the SAD and SPD?
Sorry ask so much questions.

Thanks.
 
Old 10-29-2006, 09:35 PM   #18
squirtle
Member
 
Registered: Jun 2006
Posts: 55

Original Poster
Rep: Reputation: 15
I still can't ping after setup the SAD & SPD.
That is /etc/setkey.conf in host 2001:328:2003:2::5

Quote:
#!/usr/sbin/setkey -f
#host 2001:328:2003:2::5
add -6 2001:328:2003:2::5 2001:328:2003:2::6 ah 15700 -m transport -A hmac-md5 "1234567890123456";
add -6 2001:328:2003:2::6 2001:328:2003:2::5 ah 24500 -m transport -A hmac-md5 "6541230987654321";

add 2001:328:2003:2::5 2001:328:2003:2::6 esp 15701 -m transport -E des-cbc "12345678";
add 2001:328:2003:2::6 2001:328:2003:2::5 esp 24501 -m transport -E des-cbc "87654321";

spdadd 2001:328:2003:2::5 2001:328:2003:2::6 any -P out ipsec esp/transport//require ah/transport//require;
spdadd 2001:328:2003:2::6 2001:328:2003:2::5 any -P in ipsec esp/transport//require ah/transport//require;
 
Old 10-29-2006, 09:35 PM   #19
squirtle
Member
 
Registered: Jun 2006
Posts: 55

Original Poster
Rep: Reputation: 15
That is /etc/setkey.conf in host 2001:328:2003:2::6

Quote:
#!/usr/sbin/setkey -f
#host 2001:328:2003:2::6
add -6 2001:328:2003:2::5 2001:328:2003:2::6 ah 15700 -m transport -A hmac-md5 "1234567890123456";
add -6 2001:328:2003:2::6 2001:328:2003:2::5 ah 24500 -m transport -A hmac-md5 "6541230987654321";

add 2001:328:2003:2::5 2001:328:2003:2::6 esp 15701 -m transport -E des-cbc "12345678";
add 2001:328:2003:2::6 2001:328:2003:2::5 esp 24501 -m transport -E des-cbc "87654321";

spdadd 2001:328:2003:2::5 2001:328:2003:2::6 any -P in ipsec esp/transport//require ah/transport//require;
spdadd 2001:328:2003:2::6 2001:328:2003:2::5 any -P out ipsec esp/transport//require ah/transport//require;
Any problem in my setup?
After configure both host,I invoke the setkey by setkey -f /etc/setkey.conf
Before setup the SAD & SPD I can ping6 each other.
Thanks a lot.
Last edited by squirtle; 10-29-2006 at 09:40 PM.
 
Old 10-29-2006, 10:47 PM   #20
hegdeshashi
Member
 
Registered: Dec 2005
Posts: 73
Blog Entries: 3

Rep: Reputation: 15
send me your racoon.conf
 
Old 10-30-2006, 01:19 AM   #21
squirtle
Member
 
Registered: Jun 2006
Posts: 55

Original Poster
Rep: Reputation: 15
I need to configure racoon.conf?
Last you said only use SAD and SPD?
 
Old 10-30-2006, 01:20 AM   #22
squirtle
Member
 
Registered: Jun 2006
Posts: 55

Original Poster
Rep: Reputation: 15
I only set up the setkey.conf then run ping6(can't work)and run tcpdump.Below is my result.
Quote:
[root@localhost etc]# tcpdump
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
13:48:19.082101 2001:328:2003:2::8 > 2001:328:2003:2::6: ESP(spi=0x00003d55,seq=0x5)
13:48:20.082048 2001:328:2003:2::8 > 2001:328:2003:2::6: ESP(spi=0x00003d55,seq=0x6)
13:48:21.081656 2001:328:2003:2::8 > 2001:328:2003:2::6: ESP(spi=0x00003d55,seq=0x7)
13:48:22.014953 fe80::290:27ff:fea6:3ed6 > fe80::260:8ff:fe2d:8fc8: icmp6: neighbor sol: who has fe80::260:8ff:fe2d:8fc8
13:48:22.015075 fe80::260:8ff:fe2d:8fc8 > fe80::290:27ff:fea6:3ed6: icmp6: neighbor adv: tgt is fe80::260:8ff:fe2d:8fc8
13:48:22.081503 2001:328:2003:2::8 > 2001:328:2003:2::6: ESP(spi=0x00003d55,seq=0x8)
13:48:23.081351 2001:328:2003:2::8 > 2001:328:2003:2::6: ESP(spi=0x00003d55,seq=0x9)
13:48:24.081201 2001:328:2003:2::8 > 2001:328:2003:2::6: ESP(spi=0x00003d55,seq=0xa)
13:48:25.081049 2001:328:2003:2::8 > 2001:328:2003:2::6: ESP(spi=0x00003d55,seq=0xb)
13:48:26.080896 2001:328:2003:2::8 > 2001:328:2003:2::6: ESP(spi=0x00003d55,seq=0xc)
13:48:27.013584 fe80::260:8ff:fe2d:8fc8 > fe80::290:27ff:fea6:3ed6: icmp6: neighbor sol: who has fe80::290:27ff:fea6:3ed6
13:48:27.013934 fe80::290:27ff:fea6:3ed6 > fe80::260:8ff:fe2d:8fc8: icmp6: neighbor adv: tgt is fe80::290:27ff:fea6:3ed6
13:48:27.080744 2001:328:2003:2::8 > 2001:328:2003:2::6: ESP(spi=0x00003d55,seq=0xd)
13:48:28.080591 2001:328:2003:2::8 > 2001:328:2003:2::6: ESP(spi=0x00003d55,seq=0xe)
13:48:29.080447 2001:328:2003:2::8 > 2001:328:2003:2::6: ESP(spi=0x00003d55,seq=0xf)
13:48:30.080388 2001:328:2003:2::8 > 2001:328:2003:2::6: ESP(spi=0x00003d55,seq=0x10)
13:48:31.080124 2001:328:2003:2::8 > 2001:328:2003:2::6: ESP(spi=0x00003d55,seq=0x11)
13:48:32.079989 2001:328:2003:2::8 > 2001:328:2003:2::6: ESP(spi=0x00003d55,seq=0x12)
13:48:33.079832 2001:328:2003:2::8 > 2001:328:2003:2::6: ESP(spi=0x00003d55,seq=0x13)
13:48:34.079681 2001:328:2003:2::8 > 2001:328:2003:2::6: ESP(spi=0x00003d55,seq=0x14)
13:48:35.079516 2001:328:2003:2::8 > 2001:328:2003:2::6: ESP(spi=0x00003d55,seq=0x15)
13:48:36.079375 2001:328:2003:2::8 > 2001:328:2003:2::6: ESP(spi=0x00003d55,seq=0x16)
13:48:37.079224 2001:328:2003:2::8 > 2001:328:2003:2::6: ESP(spi=0x00003d55,seq=0x17)
13:48:38.079072 2001:328:2003:2::8 > 2001:328:2003:2::6: ESP(spi=0x00003d55,seq=0x18)
13:48:39.078921 2001:328:2003:2::8 > 2001:328:2003:2::6: ESP(spi=0x00003d55,seq=0x19)
 
Old 10-30-2006, 01:24 AM   #23
squirtle
Member
 
Registered: Jun 2006
Posts: 55

Original Poster
Rep: Reputation: 15
This default racoon.conf in directory /etc/racoon
Quote:
# Racoon IKE daemon configuration file.
# See 'man racoon.conf' for a description of the format and entries.

path include "/etc/racoon";
path pre_shared_key "/etc/racoon/psk.txt";
path certificate "/etc/racoon/certs";

sainfo anonymous
{
pfs_group 2;
lifetime time 1 hour ;
encryption_algorithm 3des, blowfish 448, rijndael ;
authentication_algorithm hmac_sha1, hmac_md5 ;
compression_algorithm deflate ;
}
Thanks
----------------------------------------------
If you want to work with ipsec, just use SAD & SPD entries.In SAD entry, you have 16 bits auth value,that's the password for you to commnicate .If you change that one you can't ping6.
----------------------------------------------

I still use the same key?right?however both host still can't communicate.
Last edited by squirtle; 10-30-2006 at 01:26 AM.
 
Old 10-30-2006, 02:23 AM   #24
squirtle
Member
 
Registered: Jun 2006
Posts: 55

Original Poster
Rep: Reputation: 15
I try setup the racoon.conf
Quote:
# Racoon IKE daemon configuration file.
# See 'man racoon.conf' for a description of the format and entries.

path include "/etc/racoon";
path pre_shared_key "/etc/racoon/psk.txt";
#path certificate "/etc/racoon/certs";

listen
{
isakmp 2001:328:2003:2::8;
}

remote 2001:328:2003:2::6
{
exchange_mode main;
lifetime time 24 hour;
proposal
{
encryption_algorithm 3des;
hash_algorithm md5;
authentication_method pre_shared_key;
dh_group 2;
}
}

sainfo address 2001:328:2003:2::8 any address 2001:328:2003:2::6 any
{
lifetime time 1 hour;
encryption_algorithm 3des;
authentication_algorithm hmac_md5;
compression_algorithm deflate;
}

sainfo address 2001:328:2003:2::6 any address 2001:328:2003:2::8 any
{
lifetime time 1 hour;
encryption_algorithm 3des;
authentication_algorithm hmac_md5;
compression_algorithm deflate;
}
#sainfo anonymous
#{
# pfs_group 2;
# lifetime time 1 hour ;
# encryption_algorithm 3des, blowfish 448, rijndael ;
# authentication_algorithm hmac_sha1, hmac_md5 ;
# compression_algorithm deflate ;
#}
Then run /etc/racoon/racoon.conf have an error
Quote:
[root@localhost racoon]# /etc/racoon/racoon.conf
/etc/racoon/racoon.conf: line 6: path: command not found
/etc/racoon/racoon.conf: line 7: path: command not found
/etc/racoon/racoon.conf: line 10: listen: command not found
/etc/racoon/racoon.conf: line 12: isakmp: command not found
/etc/racoon/racoon.conf: line 15: remote: command not found
/etc/racoon/racoon.conf: line 17: exchange_mode: command not found
/etc/racoon/racoon.conf: line 18: lifetime: command not found
/etc/racoon/racoon.conf: line 19: proposal: command not found
/etc/racoon/racoon.conf: line 21: encryption_algorithm: command not found
/etc/racoon/racoon.conf: line 22: hash_algorithm: command not found
/etc/racoon/racoon.conf: line 23: authentication_method: command not found
/etc/racoon/racoon.conf: line 24: dh_group: command not found
/etc/racoon/racoon.conf: line 28: sainfo: command not found
/etc/racoon/racoon.conf: line 30: lifetime: command not found
/etc/racoon/racoon.conf: line 31: encryption_algorithm: command not found
/etc/racoon/racoon.conf: line 32: authentication_algorithm: command not found
/etc/racoon/racoon.conf: line 33: compression_algorithm: command not found
/etc/racoon/racoon.conf: line 36: sainfo: command not found
/etc/racoon/racoon.conf: line 38: lifetime: command not found
/etc/racoon/racoon.conf: line 39: encryption_algorithm: command not found
/etc/racoon/racoon.conf: line 40: authentication_algorithm: command not found
/etc/racoon/racoon.conf: line 41: compression_algorithm: command
 
Old 10-30-2006, 02:26 AM   #25
squirtle
Member
 
Registered: Jun 2006
Posts: 55

Original Poster
Rep: Reputation: 15
Then I run
Quote:
[root@localhost racoon]# racoon -F -v -f /etc/racoon/racoon.conf
Foreground mode.
2006-10-30 16:00:38: INFO: @(#)ipsec-tools 0.5 (http://ipsec-tools.sourceforge.net)
2006-10-30 16:00:38: INFO: @(#)This product linked OpenSSL 0.9.7f 22 Mar 2005 (http://www.openssl.org/)
2006-10-30 16:00:39: INFO: 2001:328:2003:2::8[500] used as isakmp port (fd=6)
2006-10-30 16:01:10: INFO: IPsec-SA request for 2001:328:2003:2::6 queued due to no phase1 found.2006-10-30 16:01:10: INFO: initiate new phase 1 negotiation: 2001:328:2003:2::8[500]<=>2001:328:2003:2::6[500]
2006-10-30 16:01:10: INFO: begin Identity Protection mode.
2006-10-30 16:01:41: ERROR: phase2 negotiation failed due to time up waiting for phase1. AH 2001:328:2003:2::6->2001:328:2003:2::8
2006-10-30 16:01:41: INFO: delete phase 2 handler.
2006-10-30 16:02:10: ERROR: phase1 negotiation failed due to time up. 1b03638309977be7:0000000000000000
2006-10-30 16:02:10: INFO: IPsec-SA request for 2001:328:2003:2::6 queued due to no phase1 found.2006-10-30 16:02:10: INFO: initiate new phase 1 negotiation: 2001:328:2003:2::8[500]<=>2001:328:2003:2::6[500]
2006-10-30 16:02:10: INFO: begin Identity Protection mode.
2006-10-30 16:02:41: ERROR: phase2 negotiation failed due to time up waiting for phase1. AH 2001:328:2003:2::6->2001:328:2003:2::8
2006-10-30 16:02:41: INFO: delete phase 2 handler.
2006-10-30 16:03:10: ERROR: phase1 negotiation failed due to time up. 078f380d7dc7d070:0000000000000000
2006-10-30 16:12:07: INFO: unsupported PF_KEY message REGISTER
2006-10-30 16:12:29: INFO: caught signal 2
2006-10-30 16:12:30: INFO: racoon shutdown
That is psk.txt
# file for pre-shared keys used for IKE authentication
# format is: 'identifier' 'key'
# For example:
#
# 10.1.1.1 flibbertigibbet
# www.example.com 12345
# foo@www.example.com micropachycephalosaurus
2001:328:2003:2::6 124567890123456


Thanks
Last edited by squirtle; 10-30-2006 at 02:28 AM.
 
Old 10-30-2006, 03:19 AM   #26
squirtle
Member
 
Registered: Jun 2006
Posts: 55

Original Poster
Rep: Reputation: 15
Sorry post so many question.Is IPsec already enable in my PC?how to check whether IPsec is enable?If not enable yet,how to enable it?
Quote:
[root@localhost etc]# test -f /proc/net/if_inet6 && echo "Running kernel is IPv6 ready"
Running kernel is IPv6 ready
 
Old 10-30-2006, 07:16 AM   #27
hegdeshashi
Member
 
Registered: Dec 2005
Posts: 73
Blog Entries: 3

Rep: Reputation: 15
Hi,

just add SAD & SPD entries....

In system: 2001:328:2003:2::11
=======================================
add -6 2001:328:2003:2::11 2001:328:2::12 ah 17000 -m transport -A hmac-md5 "1234567890123456";
add -6 2001:328:2003:2::12 2001:328:2::11 ah 17000 -m transport -A hmac-md5 "1234567890123456";


spdadd 2001:328:2003:2::11 2001:328:2003:2::12 any -P out ipsec esp/transport//require;

spdadd 2001:328:2003:2::12 2001:328:2003:2::11 any -P in ipsec esp/transport//require;

============================

In system : 2001:328:2003:2::12
================================
add -6 2001:328:2003:2::11 2001:328:2::12 ah 17000 -m transport -A hmac-md5 "1234567890123456";
add -6 2001:328:2003:2::12 2001:328:2::11 ah 17000 -m transport -A hmac-md5 "1234567890123456";


spdadd 2001:328:2003:2::12 2001:328:2003:2::11 any -P out ipsec esp/transport//require;

spdadd 2001:328:2003:2::11 2001:328:2003:2::12 any -P in ipsec esp/transport//require;
================================


Now, it has to work..

Your password is 1234567890123456
If you change this..
it won't ping6....
just try..
 
Old 10-30-2006, 10:03 AM   #28
squirtle
Member
 
Registered: Jun 2006
Posts: 55

Original Poster
Rep: Reputation: 15
So I need to run racoon too?My configuration for racoon is correct?
I no need to add esp in SAD &SPD?
Now,is mean that ipsec is enabled already?
I need to create the ipsec in /etc/sysconfig/network-scripts/ifcfg-ipsec?
Thanks
Last edited by squirtle; 10-30-2006 at 10:10 AM.
 
Old 10-30-2006, 07:03 PM   #29
squirtle
Member
 
Registered: Jun 2006
Posts: 55

Original Poster
Rep: Reputation: 15
Thanks hegdeshashi.It can ping6 to each other.Thanks so much.
I follow the instructions gave by hegdeshashi.
Then tcpdump and the below is the result:
Quote:
2:40:43.290280 2001:328:2003:2::6 > 2001:328:2003:2::8: ESP(spi=0x00002710,seq=0x49f)
02:40:43.290806 2001:328:2003:2::8 > 2001:328:2003:2::6: ESP(spi=0x00002711,seq=0x4ed)
I only use the /etc/setkey.conf.I not run racoon.Is correct?
It mean my ipsec is work?
Thanks
Last edited by squirtle; 10-30-2006 at 09:38 PM.
 
  


Reply
Page 2 of 2 1 2



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
IPSEC problem regarding connection Name bkankur Linux - Security 1 07-22-2006 02:55 PM
ipsec problem after kernel upgrade from 2.6.8 to 2.6.16 sikp Linux - Networking 4 04-13-2006 06:39 AM
IPsec : Problem with racoon HaPagan Linux - Security 1 11-30-2005 12:23 AM
IPSEC VPN Problem nirav.jani Linux - Security 1 01-27-2005 10:01 AM
problem with FreeS/WAN IPsec cccc Linux - General 0 01-25-2004 10:59 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 12:40 AM.

Contact Us - Advertising Info - Rules - Privacy - LQ Merchandise - Donations - Contributing Member - LQ Sitemap -
Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration