Re: PSK in FreeSWAN

On Wed, Sep 22, 2004 at 11:09:14AM -0300, Nereu Gustavo wrote:
> Dears,
> 
>     I need specify a PSK in ipsec.secrets on a
> concentrator site, but um using dynamic IP address in
> client site. How can i do this?

>From ipsec.secrets(5):

The file is a sequence of entries and include directives. Here is an
example. Each entry or directive must start at the left margin, but if
it continues beyond a single line, each continuation line must be
indented.

              # sample /etc/ipsec.secrets file for 10.1.0.1
              10.1.0.1 10.2.0.1: PSK "secret shared by two hosts"

              # an entry may be split across lines,
              # but indentation matters
              www.xs4all.nl @www.kremvax.ru
                  10.6.0.1 10.7.0.1 1.8.0.1: PSK "secret shared by 5"

Each entry in the file is a list of indices, followed by a secret. The
two parts are separated by a colon (:) that is followed by whitespace or
a newline. For compatability with the previous form of this file, if the
key part is just a double-quoted string the colon may be left out.

An index is an IP address, or a Fully Qualified Domain Name, user@FQDN,
%any or %any6

An additional complexity arises in the case of authentication by
preshared secret: the responder will need to look up the secret before
the Peer's ID payload has been decoded, so the ID used will be the IP
address.

So, having read all that, I don't know about you, but I reach two
conclusions:

1) You can specify a remote peer's secret by IP address, FQDN or the
%any catch-all. The FQDN can be used to match the ID sent by the peer
during the negotiations.
2) Except you can't do that with PSK, because the secret needs to be
known before the peer's packets have been decoded.

So, you either need to specify by IP address (which you can't do, since
they're a 'roadwarrior') or by %any, which would imply either having
only one roadwarrior, or all roadwarriors sharing the same PSK.

You could just use RSA keying - it's not exactly difficult. Then you
could get the roadwarrior to send an FQDN (in practise, any text
string'll do) as its ID and use that as the index in ipsec.secrets.

It may also be possible to get the roadwarriors to register with a
dynamic DNS service and use the hostname that gives you, but I don't
know if FreeS/WAN would want to verify reverse lookups too... it's not a
nice solution, no matter which way you look at it.

-- 
Russell Howe       | Why be just another cog in the machine,
[email protected] | when you can be the spanner in the works?