Re: multiple ipsec.secrets entries

"Road Warrior" <[email protected]> Wed, 05 Mar 2003 12:46:31 -0500
Newsgroups gmane.network.freeswan.devel,gmane.network.freeswan.user
Message-ID <[email protected]> 
I have followed the suggestions and also reread/followed Nate's howto. I 
still cannot establish a rw connection without first swapping the 
ipsec.secrets keys. 

I have included the ipsec.conf of the w2k rw and the unedited output of 
'ipsec barf'. 

I believe I may be suffering from myopia and could benefit from a few extra 
eyeballs. 

dxd 


Andreas Steffen writes: 

> Let's assume the following scenario 
> 
> ipsec.conf: 
> 
>  conn rw_A
> 	right=%any
> 	rightid="C=CH, O=foo CN=client A"
> 	rsasigkey=%cert
> 	left=%defaultroute
> 	leftcert=freeswan_fooCert.pem 
> 
>   conn rw_B
> 	right=%any
> 	rightid="C=CH, O=bar, CN=Client B"
> 	rsasigkey=%cert
> 	left=%defaultroute
> 	leftcert=freeswan_barCert.pem 
> 
>   conn rw_C
> 	right=%any
> 	[email protected]
> 	rightrsasigkey=0s2b85da...
> 	left=%defaultroute
> 	[email protected]
> 	leftrsasigkey=0s348a5d.. 
> 
> ipsec.secrets: 
> 
> : RSA {
>      <standard FreeS/WAN RSA private key>
>    } 
> 
> : RSA freeswan_barKey.pem 
> 
> : RSA freeswan_fooKey.pem 
> 
> roadwarrior connections A and B are based on X.509 certificates
> issued by two different CAs (foo and bar) and using different
> private keys whereas connection C is based on raw RSA keys
> (could also be opportunistic) having a third private key. 
> 
> Certificate based connections always find the correct
> private key in ipsec.secret because a link to the
> certificate loaded via the leftcert command is maintained in
> the connection description which allows to match the public
> key contained in the certificate to the public key in the
> private key representation. 
> 
> With raw RSA keys it is different because no public key
> information is available in the connection description
> (although there is a leftrsasigkey parameter this information
> is currently disregarded because the local side needs only
> its private key in order to sign the hash in IKE Main mode). 
> 
> Standard FreeS/WAN explicitly does not allow multiple anomymous
> RSA private keys in ipsec.secrets because it cannot differentiate
> them. This is why the warning 
> 
> >Pluto[24727]: "roadwarrior-net" 206.26.195.236 #6:
>    multiple ipsec.secrets entries with distinct secrets match endpoints:
>    first secret used 
> 
> is generated. 
> 
> Current workaround:
> ------------------ 
> 
> - Put the raw private key first on the list in ipsec.secrets.
>   Since in the presence of multiple secrets always the first is
>   taken, this will work out correctly for connections based on
>   raw RSA keys. 
> 
>   An unlimited number of anonymous RSA private keys can follow.
>   If they belong to an X.509 certificate loaded via the
>   [left|right]cert parameter, the correct key will always be found.
>   Attention: This is not valid if FreeS/WAN's cert is loaded via the
>   /etc/x509cert.der file. This is the actual reason that its use is
>   deprecated and why it has been eliminated in the X.509 patch for
>   freeswan-2.00. 
> 
> Proper workaround:
> ------------------ 
> 
> - Although not mandatory, the local public key can be defined
>   in connections based on raw RSA keys by using the leftrsasigkey
>   parameter. Since X.509-1.1.6 for freeswan-2.00 alread supports
>   both X.509 and OpenPGP certificates, as a thirk class, a link to
>   the raw public key could be created in the connection description
>   which would allow the private key to be found in ipsec.secrets
>   irrespective of its position in the list. This would also introduce
>   support of multiple RSA private keys in roadwarrior connections based
>   on raw RSA public keys. I could implement this feature within
>   the next month but for freeswan-2.00, only. 
> 
> Regards 
> 
> Andreas 
> 
> Paul Wouters wrote:
>> On Tue, 25 Feb 2003, Road Warrior wrote: 
>> 
>> (I have CC:ed this to design@ since I believe this is a design problem) 
>> 
>> 
>>> I then noticed this on the gateway logs: Feb 25 19:25:32 sparta 
>>> Pluto[24727]: "roadwarrior-net" 206.26.195.236 #6: multiple 
>>> ipsec.secrets entries with distinct secrets match endpoints: first 
>>> secret used
>> 
>>   
>> 
>>> The other three connections [understandably] could not be made.  
>>> 
>>> How do I work around this?
>>> Can I have multiple ipsec.secrets entries?  
>>> 
>>> I am using Linux FreeS/WAN 1.96 from debian stable.
>>  
>> 
>> Though 1.96 is an old version, I've recently encountered the same 
>> problem.
>> You can find some information in the man page for ipsec.secrets, and 
>> there
>> it says you can use multiple secrets, and that the "most exact" match for
>> a secret is used. 
>> 
>> However, I believe that scheme is no longer properly functioning, though
>> I have yet to pinpoint what causes the failure. I think mixing x509 
>> certificates and RSA keys is what is no longer working properly. The 
>> latter
>> is used for Opportunistic Encryption, and in the 2.x series, this
>> connection will be enabled by default (even if the connection is not
>> specified in the ipsec.conf). Therefor, I believe anyone who is going to 
>> run X.509 certificates with Freeswan 2.x will run into this problem. 
>> 
>> If you just want multiple road warriors to connect to your gateway,
>> each using their own certificate, by far the easiest approach is to
>> use a "certificate agency" that signs all the certificates
>> of your roadwarriors. Then you only need to load the certificate of the
>> CA on the gateway. You can use this together with a revocation list to 
>> disallow certain signed certifictes which administratively no longer 
>> should be valid, but are still valid technically (as specified in the 
>> signature of the ca). A good link on how to accomplish this is: 
>> 
>> http://www.natecarlson.com/linux/ipsec-x509.php 
>> 
>> Perhaps DHR and Stefan can comment on how it might be possible to get
>> X509 and RSA secrets to co-exist in Pluto? And if so, then perhaps 
>> Claudia can put this information in the FAQ? 
>> 
>> Paul
> 
> =======================================================================
> Andreas Steffen                   e-mail: [email protected]
> strongSec GmbH                    home:   http://www.strongsec.com
> Alter Zürichweg 20                phone:  +41 1 730 80 64
> CH-8952 Schlieren (Switzerland)   fax:    +41 1 730 80 65
> ==========================================[strong internet security]=== 
> 
> 
> Content Security by MailMarshal
> _______________________________________________
> Users mailing list
> [email protected]
> http://lists.freeswan.org/mailman/listinfo/users
barf.txt (text/plain, 47.9 KB) 
sparta
Wed Mar  5 11:49:09 EST 2003
+ _________________________ version
+ ipsec --version
Linux FreeS/WAN 1.96
See `ipsec --copyright' for copyright information.
+ _________________________ proc/version
+ cat /proc/version
Linux version 2.4.18 (root@sparta) (gcc version 2.95.4 20011002 (Debian prerelease)) #1 Thu Feb 20 21:15:35 EST 2003
+ _________________________ proc/net/ipsec_eroute
+ sort +3 /proc/net/ipsec_eroute
23         192.168.1.0/24     -> 192.168.100.0/24   => [email protected]
0          192.168.1.0/24     -> 192.168.3.0/24     => [email protected]
0          192.168.1.0/24     -> 192.168.4.0/24     => [email protected]
+ _________________________ proc/net/ipsec_spi
+ cat /proc/net/ipsec_spi
[email protected] IPIP: dir=in  src=24.123.99.190 policy=192.168.4.0/24->192.168.1.0/24 flags=0x8<> life(c,s,h)=addtime(1006577,0,0)
[email protected] ESP_3DES_HMAC_MD5: dir=out src=207.14.191.112 iv_bits=64bits iv=0xbff248d63a3ce540 ooowin=64 alen=128 aklen=128 eklen=192 life(c,s,h)=addtime(1006577,0,0)
[email protected] IPIP: dir=in  src=66.166.193.50 policy=192.168.100.0/24->192.168.1.0/24 flags=0x8<> life(c,s,h)=bytes(1824,0,0)addtime(1006576,0,0)usetime(1006586,0,0)packets(18,0,0) idle=130
[email protected] IPIP: dir=in  src=66.166.98.66 policy=192.168.3.0/24->192.168.1.0/24 flags=0x8<> life(c,s,h)=addtime(1006574,0,0)
[email protected] ESP_3DES_HMAC_MD5: dir=out src=207.14.191.112 iv_bits=64bits iv=0xd96ab80505637a09 ooowin=64 seq=23 alen=128 aklen=128 eklen=192 life(c,s,h)=bytes(3712,0,0)addtime(1006576,0,0)usetime(1006585,0,0)packets(23,0,0) idle=85
[email protected] IPIP: dir=out src=207.14.191.112 life(c,s,h)=bytes(2903,0,0)addtime(1006576,0,0)usetime(1006585,0,0)packets(23,0,0) idle=85
[email protected] IPIP: dir=out src=207.14.191.112 life(c,s,h)=addtime(1006577,0,0)
[email protected] IPIP: dir=out src=207.14.191.112 life(c,s,h)=addtime(1006574,0,0)
[email protected] ESP_3DES_HMAC_MD5: dir=in  src=24.123.99.190 iv_bits=64bits iv=0xa5984d5921279bb7 ooowin=64 alen=128 aklen=128 eklen=192 life(c,s,h)=addtime(1006577,0,0)
[email protected] ESP_3DES_HMAC_MD5: dir=in  src=66.166.193.50 iv_bits=64bits iv=0xaff132f1fb5e539f ooowin=64 seq=18 bit=0x3ffff alen=128 aklen=128 eklen=192 life(c,s,h)=bytes(1824,0,0)addtime(1006576,0,0)usetime(1006586,0,0)packets(18,0,0) idle=130
[email protected] ESP_3DES_HMAC_MD5: dir=in  src=66.166.98.66 iv_bits=64bits iv=0xa26f049d53b073f1 ooowin=64 alen=128 aklen=128 eklen=192 life(c,s,h)=addtime(1006574,0,0)
[email protected] ESP_3DES_HMAC_MD5: dir=out src=207.14.191.112 iv_bits=64bits iv=0x4d4c5ebc4ddb27fb ooowin=64 alen=128 aklen=128 eklen=192 life(c,s,h)=addtime(1006574,0,0)
+ _________________________ proc/net/ipsec_spigrp
+ cat /proc/net/ipsec_spigrp
[email protected] [email protected] 
[email protected] [email protected] 
[email protected] [email protected] 
[email protected] [email protected] 
[email protected] [email protected] 
[email protected] [email protected] 
+ _________________________ netstart-rn
+ netstat -nr
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
192.168.100.0   207.14.191.1    255.255.255.0   UG       40 0          0 ipsec0
192.168.4.0     207.14.191.1    255.255.255.0   UG       40 0          0 ipsec0
192.168.3.0     207.14.191.1    255.255.255.0   UG       40 0          0 ipsec0
192.168.1.0     0.0.0.0         255.255.255.0   U        40 0          0 eth0
207.14.191.0    0.0.0.0         255.255.255.0   U        40 0          0 eth1
207.14.191.0    0.0.0.0         255.255.255.0   U        40 0          0 ipsec0
0.0.0.0         207.14.191.1    0.0.0.0         UG       40 0          0 eth1
+ _________________________ proc/net/ipsec_tncfg
+ cat /proc/net/ipsec_tncfg
ipsec0 -> eth1 mtu=16260(1443) -> 1500
ipsec1 -> NULL mtu=0(0) -> 0
ipsec2 -> NULL mtu=0(0) -> 0
ipsec3 -> NULL mtu=0(0) -> 0
+ _________________________ proc/net/pf_key
+ cat /proc/net/pf_key
    sock   pid   socket     next     prev e n p sndbf    Flags     Type St
c30f1a80 11833 c117a960        0        0 0 0 2 65535 00000000        3  1
+ _________________________ proc/net/pf_key-star
+ cd /proc/net
+ egrep '^' pf_key_registered pf_key_supported
pf_key_registered:satype   socket   pid       sk
pf_key_registered:     2 c117a960 11833 c30f1a80
pf_key_registered:     3 c117a960 11833 c30f1a80
pf_key_registered:     9 c117a960 11833 c30f1a80
pf_key_registered:    10 c117a960 11833 c30f1a80
pf_key_supported:satype exttype alg_id ivlen minbits maxbits
pf_key_supported:     2      14      3     0     160     160
pf_key_supported:     2      14      2     0     128     128
pf_key_supported:     3      15      3    64     168     168
pf_key_supported:     3      14      3     0     160     160
pf_key_supported:     3      14      2     0     128     128
pf_key_supported:     9      15      1     0      32      32
pf_key_supported:    10      15      2     0       1       1
+ _________________________ proc/sys/net/ipsec-star
+ cd /proc/sys/net/ipsec
+ egrep '^' debug_ah debug_eroute debug_esp debug_ipcomp debug_netlink debug_pfkey debug_radij debug_rcv debug_spi debug_tunnel debug_verbose debug_xform icmp inbound_policy_check tos
debug_ah:0
debug_eroute:0
debug_esp:0
debug_ipcomp:0
debug_netlink:0
debug_pfkey:0
debug_radij:0
debug_rcv:0
debug_spi:0
debug_tunnel:0
debug_verbose:0
debug_xform:0
icmp:1
inbound_policy_check:1
tos:1
+ _________________________ ipsec/status
+ ipsec auto --status
000 interface ipsec0/eth1 207.14.191.112
000  
000 algorithm ESP encrypt: id=3, name=ESP_3DES
000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5
000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1
000  
000 "roadwarrior-net" instance: 192.168.1.0/24===207.14.191.112[C=US, ST=New Jersey, L=Union, O=Phoenix Medical Construction Net, OU=IT, CN=Darius Xerxes Desiderio, [email protected]]---207.14.191.1...206.26.195.236[C=US, ST=New Jersey, L=Union, O=Phoenix Medical Construction Net, OU=IT, CN=Darius Xerxes Desiderio, [email protected]]
000 "roadwarrior-net" instance:   ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "roadwarrior-net" instance:   policy: RSASIG+ENCRYPT+TUNNEL+PFS; interface: eth1; unrouted
000 "roadwarrior-net" instance:   newest ISAKMP SA: #10; newest IPsec SA: #0; eroute owner: #0
000 "roadwarrior-net" instance:   ESP algorithms wanted: 3/000-1/000, 3/000-2/000, 
000 "roadwarrior-net" instance:   ESP algorithms loaded: 3/168-1/128, 3/168-2/160, 
000 "kansas-sparta": 192.168.1.0/24===207.14.191.112---207.14.191.1...24.123.99.189---24.123.99.190===192.168.4.0/24
000 "kansas-sparta":   ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "kansas-sparta":   policy: RSASIG+ENCRYPT+TUNNEL+PFS; interface: eth1; erouted
000 "kansas-sparta":   newest ISAKMP SA: #5; newest IPsec SA: #6; eroute owner: #6
000 "kansas-sparta":   ESP algorithms wanted: 3/000-1/000, 3/000-2/000, 
000 "kansas-sparta":   ESP algorithms loaded: 3/168-1/128, 3/168-2/160, 
000 "sparta-union": 192.168.1.0/24===207.14.191.112---207.14.191.1...66.166.193.49---66.166.193.50===192.168.100.0/24
000 "sparta-union":   ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "sparta-union":   policy: RSASIG+ENCRYPT+TUNNEL+PFS; interface: eth1; erouted
000 "sparta-union":   newest ISAKMP SA: #3; newest IPsec SA: #4; eroute owner: #4
000 "sparta-union":   ESP algorithms wanted: 3/000-1/000, 3/000-2/000, 
000 "sparta-union":   ESP algorithms loaded: 3/168-1/128, 3/168-2/160, 
000 "hydepark-sparta": 192.168.1.0/24===207.14.191.112---207.14.191.1...66.166.98.65---66.166.98.66===192.168.3.0/24
000 "hydepark-sparta":   ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "hydepark-sparta":   policy: RSASIG+ENCRYPT+TUNNEL+PFS; interface: eth1; erouted
000 "hydepark-sparta":   newest ISAKMP SA: #1; newest IPsec SA: #2; eroute owner: #2
000 "hydepark-sparta":   ESP algorithms wanted: 3/000-1/000, 3/000-2/000, 
000 "hydepark-sparta":   ESP algorithms loaded: 3/168-1/128, 3/168-2/160, 
000 "roadwarrior-net": 192.168.1.0/24===207.14.191.112[C=US, ST=New Jersey, L=Union, O=Phoenix Medical Construction Net, OU=IT, CN=Darius Xerxes Desiderio, [email protected]]---207.14.191.1...%any
000 "roadwarrior-net":   ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "roadwarrior-net":   policy: RSASIG+ENCRYPT+TUNNEL+PFS; interface: eth1; unrouted
000 "roadwarrior-net":   newest ISAKMP SA: #0; newest IPsec SA: #0; eroute owner: #0
000 "roadwarrior-net":   ESP algorithms wanted: 3/000-1/000, 3/000-2/000, 
000 "roadwarrior-net":   ESP algorithms loaded: 3/168-1/128, 3/168-2/160, 
000 "roadwarrior": 207.14.191.112[C=US, ST=New Jersey, L=Union, O=Phoenix Medical Construction Net, OU=IT, CN=Darius Xerxes Desiderio, [email protected]]---207.14.191.1...%any
000 "roadwarrior":   ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "roadwarrior":   policy: RSASIG+ENCRYPT+TUNNEL+PFS; interface: eth1; unrouted
000 "roadwarrior":   newest ISAKMP SA: #0; newest IPsec SA: #0; eroute owner: #0
000 "roadwarrior":   ESP algorithms wanted: 3/000-1/000, 3/000-2/000, 
000 "roadwarrior":   ESP algorithms loaded: 3/168-1/128, 3/168-2/160, 
000  
000 #10: "roadwarrior-net" 206.26.195.236 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 3247s; newest ISAKMP
000 #2: "hydepark-sparta" STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 27300s; newest IPSEC; eroute owner
000 #2: "hydepark-sparta" [email protected] [email protected] [email protected] [email protected]
000 #1: "hydepark-sparta" STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 2487s; newest ISAKMP
000 #8: "roadwarrior-net" 206.26.195.236 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 3015s
000 #4: "sparta-union" STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 27546s; newest IPSEC; eroute owner
000 #4: "sparta-union" [email protected] [email protected] [email protected] [email protected]
000 #3: "sparta-union" STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 2147s; newest ISAKMP
000 #6: "kansas-sparta" STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 27308s; newest IPSEC; eroute owner
000 #6: "kansas-sparta" [email protected] [email protected] [email protected] [email protected]
000 #5: "kansas-sparta" STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 2216s; newest ISAKMP
000 #7: "roadwarrior-net" 206.26.195.236 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 2895s
000 #9: "roadwarrior-net" 206.26.195.236 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 3135s
+ _________________________ ifconfig-a
+ ifconfig -a
eth0      Link encap:Ethernet  HWaddr 00:50:BA:4A:72:66  
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1020065 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1665519 errors:0 dropped:0 overruns:6 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:127736038 (121.8 MiB)  TX bytes:2168853408 (2.0 GiB)
          Interrupt:15 Base address:0xb000 

eth1      Link encap:Ethernet  HWaddr 00:50:BA:49:69:17  
          inet addr:207.14.191.112  Bcast:207.14.191.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1707998 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1055905 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:2255590754 (2.1 GiB)  TX bytes:200014895 (190.7 MiB)
          Interrupt:11 Base address:0xd000 

ipsec0    Link encap:Ethernet  HWaddr 00:50:BA:49:69:17  
          inet addr:207.14.191.112  Mask:255.255.255.0
          UP RUNNING NOARP  MTU:16260  Metric:1
          RX packets:1570280 errors:0 dropped:1662 overruns:0 frame:0
          TX packets:915444 errors:0 dropped:10228 overruns:0 carrier:0
          collisions:0 txqueuelen:10 
          RX bytes:2100476495 (1.9 GiB)  TX bytes:164059632 (156.4 MiB)

ipsec1    Link encap:IPIP Tunnel  HWaddr   
          NOARP  MTU:0  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:10 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

ipsec2    Link encap:IPIP Tunnel  HWaddr   
          NOARP  MTU:0  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:10 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

ipsec3    Link encap:IPIP Tunnel  HWaddr   
          NOARP  MTU:0  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:10 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:1979 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1979 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:430143 (420.0 KiB)  TX bytes:430143 (420.0 KiB)

+ _________________________ ipsec/directory
+ ipsec --directory
/usr/lib/ipsec
+ _________________________ hostname/fqdn
+ hostname --fqdn
sparta
+ _________________________ hostname/ipaddress
+ hostname --ip-address
127.0.0.1 
+ _________________________ uptime
+ uptime
 11:49:14 up 11 days, 15:45,  2 users,  load average: 0.00, 0.01, 0.00
+ _________________________ ps
+ ps alxw
+ egrep -i 'ppid|pluto|ipsec|klips'
  F   UID   PID  PPID PRI  NI   VSZ  RSS WCHAN  STAT TTY        TIME COMMAND
040     0 11826     1   9   0  2040  940 wait4  S    pts/0      0:00 /bin/bash /usr/lib/ipsec/_plutorun --debug none --uniqueids yes --dump  --load %search --start %search --wait  --pre  --post  --log daemon.error --pid /var/run/pluto.pid
000     0 11827     1   9   0  1256  480 pipe_w S    pts/0      0:00 logger -p daemon.error -t ipsec__plutorun
040     0 11830 11826   9   0  2040  940 wait4  S    pts/0      0:00 /bin/bash /usr/lib/ipsec/_plutorun --debug none --uniqueids yes --dump  --load %search --start %search --wait  --pre  --post  --log daemon.error --pid /var/run/pluto.pid
000     0 11831 11826   8   0  2040  948 pipe_w S    pts/0      0:00 /bin/sh /usr/lib/ipsec/_plutoload --load %search --start %search --wait  --post 
100     0 11833 11830   9   0  1956 1012 select S    pts/0      0:03 /usr/lib/ipsec/pluto --nofork --debug-none --uniqueids
000     0 12319  5018   9   0  2036  928 wait4  S    pts/0      0:00 /bin/sh /usr/sbin/ipsec barf
100     0 12320  5018   9   0  3416 1588 select S    pts/0      0:00 ssh [email protected] cat > /home/dxd/dxd/ipsec/barf
000     0 12321 12319   9   0  2056  980 wait4  S    pts/0      0:00 /bin/sh /usr/lib/ipsec/barf
000     0 12362 12321   9   0  1352  492 pipe_w S    pts/0      0:00 egrep -i ppid|pluto|ipsec|klips
+ _________________________ ipsec/showdefaults
+ ipsec showdefaults
routephys=eth1
routephys=eth1
routevirt=ipsec0
routevirt=ipsec0
routeaddr=207.14.191.112
routeaddr=207.14.191.112
routenexthop=207.14.191.1
routenexthop=207.14.191.1
defaultroutephys=eth1
defaultroutevirt=ipsec0
defaultrouteaddr=207.14.191.112
defaultroutenexthop=207.14.191.1
+ _________________________ ipsec/conf
+ ipsec _include /etc/ipsec.conf
+ ipsec _keycensor

#< /etc/ipsec.conf 1
# /etc/ipsec.conf - FreeS/WAN IPsec configuration file

# More elaborate and more varied sample configurations can be found
# in FreeS/WAN's doc/examples file, and in the HTML documentation.



# basic configuration
config setup
	# THIS SETTING MUST BE CORRECT or almost nothing will work;
	# %defaultroute is okay for most simple cases.
	interfaces=%defaultroute
	# Debug-logging controls:  "none" for (almost) none, "all" for lots.
	klipsdebug=none
	plutodebug=none
	# Use auto= parameters in conn descriptions to control startup actions.
	plutoload=%search
	plutostart=%search
	# Close down old connection when new one using same ID shows up.
	uniqueids=yes


# defaults for subsequent connection descriptions
# (mostly to fix internal defaults which, in retrospect, were badly chosen)
conn %default
	keyingtries=0
	disablearrivalcheck=no
	authby=rsasig
	#leftrsasigkey=%dns
	#rightrsasigkey=%dns
	leftrsasigkey=%cert
	rightrsasigkey=%cert


# connection description for (experimental!) opportunistic encryption
# (requires KEY record in your DNS reverse map; see doc/opportunism.howto)
#conn me-to-anyone
#	left=%defaultroute
#	right=%opportunistic
#	keylife=1h
#	rekey=[sums to e4ac...]
	# uncomment this next line to enable it
	#auto=route



conn kansas-sparta
        left=24.123.99.190
        leftsubnet=192.168.4.0/24
        leftnexthop=24.123.99.189
        leftrsasigkey=[sums to 8709...]
        right=207.14.191.112
        rightsubnet=192.168.1.0/24
        rightnexthop=207.14.191.1
        rightrsasigkey=[sums to 81e2...]
        auto=start

conn hydepark-sparta
        left=66.166.98.66
        leftsubnet=192.168.3.0/24
        leftnexthop=66.166.98.65
        leftrsasigkey=[sums to c432...]
        right=207.14.191.112
        rightsubnet=192.168.1.0/24
        rightnexthop=207.14.191.1
        rightrsasigkey=[sums to 81e2...]
        auto=start

conn sparta-union 
        left=66.166.193.50   
        leftsubnet=192.168.100.0/24 
        leftnexthop=66.166.193.49 
        leftrsasigkey=[sums to 0d4d...]
		right=207.14.191.112 
        rightsubnet=192.168.1.0/24
        rightnexthop=207.14.191.1
    	rightrsasigkey=[sums to 81e2...]
		auto=start

conn roadwarrior-net
		leftsubnet=192.168.1.0/24
		also=roadwarrior

conn roadwarrior
		right=%any
		left=%defaultroute
		leftcert=sparta.pem
		auto=add
		pfs=yes
	#	rightrsasigkey=%cert
	#	rightrsasigkey=%cert
+ _________________________ ipsec/secrets
+ ipsec _include /etc/ipsec.secrets
+ ipsec _secretcensor

#< /etc/ipsec.secrets 1
# This file holds shared secrets or RSA private keys for inter-Pluto
# authentication.  See ipsec_pluto(8) manpage, and HTML documentation.
# 207.14.191.112 %any : PSK "[sums to fc3e...]"
# RSA private key for this host, authenticating it to any other host
# which knows the public part.  Suitable public keys, for ipsec.conf, DNS,
# or configuration of other implementations, can be extracted conveniently
# with "[sums to ef67...]".
: RSA	{
	# RSA 2048 bits   sparta   Thu Aug 22 18:51:05 2002
	# for signatures only, UNSAFE FOR ENCRYPTION
	#pubkey=[sums to 81e2...]
	#IN KEY 0x4200 4 1 [sums to 6983...]
	# (0x4200 = auth-only host-level, 4 = IPSec, 1 = RSA)
	Modulus: [...]
	PublicExponent: [...]
	# everything after this point is secret
	PrivateExponent: [...]
	Prime1: [...]
	Prime2: [...]
	Exponent1: [...]
	Exponent2: [...]
	Coefficient: [...]
	}
# do not change the indenting of that "[sums to 7d9d...]"
: RSA /etc/ipsec.d/private/sparta.key "[sums to b778...]"
+ _________________________ ipsec/ls-dir
+ ls -l /usr/lib/ipsec
total 812
-rwxr-xr-x    1 root     root        11090 Nov 30 06:52 _confread
-rwxr-xr-x    1 root     root         4208 Nov 30 06:52 _copyright
-rwxr-xr-x    1 root     root         2164 Nov 30 06:52 _include
-rwxr-xr-x    1 root     root         1384 Nov 30 06:52 _keycensor
-rwxr-xr-x    1 root     root         3495 Nov 30 06:52 _plutoload
-rwxr-xr-x    1 root     root         3618 Nov 30 06:52 _plutorun
-rwxr-xr-x    1 root     root         7276 Nov 30 06:52 _realsetup
-rwxr-xr-x    1 root     root         1905 Nov 30 06:52 _secretcensor
-rwxr-xr-x    1 root     root         6050 Nov 30 06:52 _startklips
-rwxr-xr-x    1 root     root         5262 Nov 30 06:52 _updown
-rwxr-xr-x    1 root     root        12335 Nov 30 06:52 auto
-rwxr-xr-x    1 root     root         7013 Nov 30 06:52 barf
-rwxr-xr-x    1 root     root        61544 Nov 30 06:52 eroute
-rwxr-xr-x    1 root     root         2822 Nov 30 06:52 ipsec
-rw-r--r--    1 root     root         1950 Nov 30 06:52 ipsec_pr.template
-rwxr-xr-x    1 root     root        44200 Nov 30 06:52 klipsdebug
-rwxr-xr-x    1 root     root         2438 Nov 30 06:52 look
-rwxr-xr-x    1 root     root        16174 Nov 30 06:52 manual
-rwxr-xr-x    1 root     root         2004 Nov 30 06:52 mkx509cert
-rwxr-xr-x    1 root     root         1691 Nov 30 06:52 newhostkey
-rwxr-xr-x    1 root     root        35852 Nov 30 06:52 pf_key
-rwxr-xr-x    1 root     root       309832 Nov 30 06:52 pluto
-rwxr-xr-x    1 root     root         6376 Nov 30 06:52 ranbits
-rwxr-xr-x    1 root     root        16488 Nov 30 06:52 rsasigkey
-rwxr-xr-x    1 root     root        16657 Nov 30 06:52 send-pr
lrwxrwxrwx    1 root     root           17 Feb 20 17:19 setup -> /etc/init.d/ipsec
-rwxr-xr-x    1 root     root         1041 Nov 30 06:52 showdefaults
-rwxr-xr-x    1 root     root         3485 Nov 30 06:52 showhostkey
-rwxr-xr-x    1 root     root        72776 Nov 30 06:52 spi
-rwxr-xr-x    1 root     root        52776 Nov 30 06:52 spigrp
-rwxr-xr-x    1 root     root         9708 Nov 30 06:52 tncfg
-rwxr-xr-x    1 root     root        31496 Nov 30 06:52 whack
+ _________________________ ipsec/updowns
++ ls /usr/lib/ipsec
++ egrep updown
+ cat /usr/lib/ipsec/_updown
#! /bin/sh
# default updown script
# Copyright (C) 2000, 2001  D. Hugh Redelmeier, Henry Spencer
# 
# This program is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; either version 2 of the License, or (at your
# option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
# 
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
# or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
# for more details.
#
# RCSID $Id: _updown,v 1.18 2001/11/09 04:12:19 henry Exp $



# CAUTION:  Installing a new version of FreeS/WAN will install a new
# copy of this script, wiping out any custom changes you make.  If
# you need changes, make a copy of this under another name, and customize
# that, and use the (left/right)updown parameters in ipsec.conf to make
# FreeS/WAN use yours instead of this default one.



# check interface version
case "$PLUTO_VERSION" in
1.[0])	# Older Pluto?!?  Play it safe, script may be using new features.
	echo "$0: obsolete interface version \`$PLUTO_VERSION'," >&2
	echo "$0: 	called by obsolete Pluto?" >&2
	exit 2
	;;
1.*)	;;
*)	echo "$0: unknown interface version \`$PLUTO_VERSION'" >&2
	exit 2
	;;
esac

# check parameter(s)
case "$1:$*" in
':')			# no parameters
	;;
ipfwadm:ipfwadm)	# due to (left/right)firewall; for default script only
	;;
custom:*)		# custom parameters (see above CAUTION comment)
	;;
*)	echo "$0: unknown parameters \`$*'" >&2
	exit 2
	;;
esac

# utility functions for route manipulation
# Meddling with this stuff should not be necessary and requires great care.
uproute() {
	doroute add
}
downroute() {
	doroute del
}
doroute() {
	parms="-net $PLUTO_PEER_CLIENT_NET netmask $PLUTO_PEER_CLIENT_MASK"
	parms2="dev $PLUTO_INTERFACE gw $PLUTO_NEXT_HOP"
	case "$PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK" in
	"0.0.0.0/0.0.0.0")
		# horrible kludge for obscure routing bug with opportunistic
		it="route $1 -net 0.0.0.0 netmask 128.0.0.0 $parms2 &&"
		it="$it route $1 -net 128.0.0.0 netmask 128.0.0.0 $parms2"
		route $1 -net 0.0.0.0 netmask 128.0.0.0 $parms2 &&
			route $1 -net 128.0.0.0 netmask 128.0.0.0 $parms2
		;;
	*)	it="route $1 $parms $parms2"
		route $1 $parms $parms2
		;;
	esac
	st=$?
	if test $st -ne 0
	then
		# route has already given its own cryptic message
		echo "$0: \`$it' failed" >&2
		if test " $1 $st" = " add 7"
		then
			# another totally undocumented interface -- 7 and
			# "SIOCADDRT: Network is unreachable" means that
			# the gateway isn't reachable.
			echo "$0: (incorrect or missing nexthop setting??)" >&2
		fi
	fi
	return $st
}



# the big choice
case "$PLUTO_VERB:$1" in
prepare-host:*|prepare-client:*)
	# delete possibly-existing route (preliminary to adding a route)
	case "$PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK" in
	"0.0.0.0/0.0.0.0")
		# horrible kludge for obscure routing bug with opportunistic
		parms1="-net 0.0.0.0 netmask 128.0.0.0"
		parms2="-net 128.0.0.0 netmask 128.0.0.0"
		it="route del $parms1 2>&1 ; route del $parms2 2>&1"
		oops="`route del $parms1 2>&1 ; route del $parms2 2>&1`"
		;;
	*)
		parms="-net $PLUTO_PEER_CLIENT_NET netmask $PLUTO_PEER_CLIENT_MASK"
		it="route del $parms 2>&1"
		oops="`route del $parms 2>&1`"
		;;
	esac
	status="$?"
	if test " $oops" = " " -a " $status" != " 0"
	then
		oops="silent error, exit status $status"
	fi
	case "$oops" in
	'SIOCDELRT: No such process'*)
		# This is what route (currently -- not documented!) gives
		# for "could not find such a route".
		oops=
		status=0
		;;
	esac
	if test " $oops" != " " -o " $status" != " 0"
	then
		echo "$0: \`$it' failed ($oops)" >&2
	fi
	exit $status
	;;
route-host:*|route-client:*)
	# connection to me or my client subnet being routed
	uproute
	;;
unroute-host:*|unroute-client:*)
	# connection to me or my client subnet being unrouted
	downroute
	;;
up-host:*)
	# connection to me coming up
	# If you are doing a custom version, firewall commands go here.
	;;
down-host:*)
	# connection to me going down
	# If you are doing a custom version, firewall commands go here.
	;;
up-client:)
	# connection to my client subnet coming up
	# If you are doing a custom version, firewall commands go here.
	;;
down-client:)
	# connection to my client subnet going down
	# If you are doing a custom version, firewall commands go here.
	;;
up-client:ipfwadm)
	# connection to client subnet, with (left/right)firewall=yes, coming up
	# This is used only by the default updown script, not by your custom
	# ones, so do not mess with it; see CAUTION comment up at top.
	ipfwadm -F -i accept -b -S $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \
		-D $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK
	;;
down-client:ipfwadm)
	# connection to client subnet, with (left/right)firewall=yes, going down
	# This is used only by the default updown script, not by your custom
	# ones, so do not mess with it; see CAUTION comment up at top.
	ipfwadm -F -d accept -b -S $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \
		-D $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK
	;;
*)	echo "$0: unknown verb \`$PLUTO_VERB' or parameter \`$1'" >&2
	exit 1
	;;
esac
+ _________________________ proc/net/dev
+ cat /proc/net/dev
Inter-|   Receive                                                |  Transmit
 face |bytes    packets errs drop fifo frame compressed multicast|bytes    packets errs drop fifo colls carrier compressed
    lo:  430143    1979    0    0    0     0          0         0   430143    1979    0    0    0     0       0          0
ipsec0:2100476495 1570280    0 1662    0     0          0         0 164059632  915444    0 10228    0     0       0          0
ipsec1:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
ipsec2:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
ipsec3:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
  eth0:127736038 1020065    0    0    0     0          0         0 2168853408 1665519    0    0    6     0       0          0
  eth1:2255592404 1708023    0    0    0     0          0         0 200032977 1055930    0    0    0     0       0          0
+ _________________________ proc/net/route
+ cat /proc/net/route
Iface	Destination	Gateway 	Flags	RefCnt	Use	Metric	Mask		MTU	Window	IRTT                                                       
ipsec0	0064A8C0	01BF0ECF	0003	0	0	0	00FFFFFF	40	0	0                                                                            
ipsec0	0004A8C0	01BF0ECF	0003	0	0	0	00FFFFFF	40	0	0                                                                            
ipsec0	0003A8C0	01BF0ECF	0003	0	0	0	00FFFFFF	40	0	0                                                                            
eth0	0001A8C0	00000000	0001	0	0	0	00FFFFFF	40	0	0                                                                              
eth1	00BF0ECF	00000000	0001	0	0	0	00FFFFFF	40	0	0                                                                              
ipsec0	00BF0ECF	00000000	0001	0	0	0	00FFFFFF	40	0	0                                                                            
eth1	00000000	01BF0ECF	0003	0	0	0	00000000	40	0	0                                                                              
+ _________________________ proc/sys/net/ipv4/ip_forward
+ cat /proc/sys/net/ipv4/ip_forward
1
+ _________________________ proc/sys/net/ipv4/conf/star-rp_filter
+ cd /proc/sys/net/ipv4/conf
+ egrep '^' all/rp_filter default/rp_filter eth0/rp_filter eth1/rp_filter ipsec0/rp_filter lo/rp_filter
all/rp_filter:1
default/rp_filter:1
eth0/rp_filter:1
eth1/rp_filter:0
ipsec0/rp_filter:0
lo/rp_filter:1
+ _________________________ uname-a
+ uname -a
Linux sparta 2.4.18 #1 Thu Feb 20 21:15:35 EST 2003 i586 unknown
+ _________________________ redhat-release
+ test -r /etc/redhat-release
+ _________________________ proc/net/ipsec_version
+ cat /proc/net/ipsec_version
FreeS/WAN version: 1.96
+ _________________________ iptables/list
+ iptables -L -v -n
Chain INPUT (policy ACCEPT 1683K packets, 2198M bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       tcp  --  eth1   *       0.0.0.0/0            0.0.0.0/0          tcp dpt:901 
   20   956 DROP       tcp  --  eth1   *       0.0.0.0/0            0.0.0.0/0          tcp dpt:139 
    0     0 DROP       tcp  --  eth1   *       0.0.0.0/0            0.0.0.0/0          tcp dpt:515 
    0     0 DROP       tcp  --  eth1   *       0.0.0.0/0            0.0.0.0/0          tcp dpt:10000 
   20   944 DROP       tcp  --  eth1   *       0.0.0.0/0            0.0.0.0/0          tcp dpt:25 

Chain FORWARD (policy ACCEPT 2582K packets, 2246M bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 1026K packets, 187M bytes)
 pkts bytes target     prot opt in     out     source               destination         
+ _________________________ ipchains/list
+ ipchains -L -v -n
ipchains: Incompatible with this kernel
+ _________________________ ipfwadm/forward
+ ipfwadm -F -l -n -e
Generic IP Firewall Chains not in this kernel
+ _________________________ ipfwadm/input
+ ipfwadm -I -l -n -e
Generic IP Firewall Chains not in this kernel
+ _________________________ ipfwadm/output
+ ipfwadm -O -l -n -e
Generic IP Firewall Chains not in this kernel
+ _________________________ iptables/nat
+ iptables -t nat -L -v -n
Chain PREROUTING (policy ACCEPT 28584 packets, 3609K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 18745 packets, 2402K bytes)
 pkts bytes target     prot opt in     out     source               destination         
12692 1760K SNAT       all  --  *      eth1    0.0.0.0/0            0.0.0.0/0          to:207.14.191.112 
   24  2040 SNAT       all  --  *      ipsec0  207.14.191.112       0.0.0.0/0          to:192.168.1.1 

Chain OUTPUT (policy ACCEPT 11101 packets, 1908K bytes)
 pkts bytes target     prot opt in     out     source               destination         
+ _________________________ ipchains/masq
+ ipchains -M -L -v -n
ipchains: cannot open file `/proc/net/ip_masquerade'
+ _________________________ ipfwadm/masq
+ ipfwadm -M -l -n -e
Generic IP Firewall Chains not in this kernel
+ _________________________ iptables/mangle
+ iptables -t mangle -L -v -n
Chain PREROUTING (policy ACCEPT 4266K packets, 4444M bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 1683K packets, 2198M bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 2582K packets, 2246M bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 1026K packets, 187M bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 3608K packets, 2433M bytes)
 pkts bytes target     prot opt in     out     source               destination         
+ _________________________ proc/modules
+ cat /proc/modules
ip_nat_ftp              2912   0 (unused)
iptable_mangle          2112   0 (unused)
iptable_filter          1728   1
ipt_MASQUERADE          1184   0 (unused)
iptable_nat            12788   2 [ip_nat_ftp ipt_MASQUERADE]
ip_tables              10368   6 [iptable_mangle iptable_filter ipt_MASQUERADE iptable_nat]
ip_conntrack_ftp        3136   0 (unused)
8139too                12960   2
mii                     1056   0 [8139too]
+ _________________________ proc/meminfo
+ cat /proc/meminfo
        total:    used:    free:  shared: buffers:  cached:
Mem:  60010496 56872960  3137536        0  6344704 21741568
Swap: 254971904  3731456 251240448
MemTotal:        58604 kB
MemFree:          3064 kB
MemShared:           0 kB
Buffers:          6196 kB
Cached:          19732 kB
SwapCached:       1500 kB
Active:          19624 kB
Inactive:        11476 kB
HighTotal:           0 kB
HighFree:            0 kB
LowTotal:        58604 kB
LowFree:          3064 kB
SwapTotal:      248996 kB
SwapFree:       245352 kB
+ _________________________ dev/ipsec-ls
+ ls -l /dev/ipsec
c-w-------    1 root     root      36,  10 Feb 20 17:20 /dev/ipsec
+ _________________________ proc/net/ipsec-ls
+ ls -l /proc/net/ipsec_eroute /proc/net/ipsec_klipsdebug /proc/net/ipsec_spi /proc/net/ipsec_spigrp /proc/net/ipsec_tncfg /proc/net/ipsec_version
-r--r--r--    1 root     root            0 Mar  5 11:49 /proc/net/ipsec_eroute
-r--r--r--    1 root     root            0 Mar  5 11:49 /proc/net/ipsec_klipsdebug
-r--r--r--    1 root     root            0 Mar  5 11:49 /proc/net/ipsec_spi
-r--r--r--    1 root     root            0 Mar  5 11:49 /proc/net/ipsec_spigrp
-r--r--r--    1 root     root            0 Mar  5 11:49 /proc/net/ipsec_tncfg
-r--r--r--    1 root     root            0 Mar  5 11:49 /proc/net/ipsec_version
+ _________________________ usr/src/linux/.config
+ test -f /usr/src/linux/.config
+ _________________________ etc/syslog.conf
+ cat /etc/syslog.conf
#  /etc/syslog.conf	Configuration file for syslogd.
#
#			For more information see syslog.conf(5)
#			manpage.

#
# First some standard logfiles.  Log by facility.
#

auth,authpriv.*			/var/log/auth.log
*.*;auth,authpriv.none		-/var/log/syslog
#cron.*				/var/log/cron.log
daemon.*			-/var/log/daemon.log
kern.*				-/var/log/kern.log
lpr.*				-/var/log/lpr.log
mail.*				-/var/log/mail.log
user.*				-/var/log/user.log
uucp.*				/var/log/uucp.log

#
# Logging for the mail system.  Split it up so that
# it is easy to write scripts to parse these files.
#
mail.info			-/var/log/mail.info
mail.warn			-/var/log/mail.warn
mail.err			/var/log/mail.err

# Logging for INN news system
#
news.crit			/var/log/news/news.crit
news.err			/var/log/news/news.err
news.notice			-/var/log/news/news.notice

#
# Some `catch-all' logfiles.
#
*.=debug;\
	auth,authpriv.none;\
	news.none;mail.none	-/var/log/debug
*.=info;*.=notice;*.=warn;\
	auth,authpriv.none;\
	cron,daemon.none;\
	mail,news.none		-/var/log/messages

#
# Emergencies are sent to everybody logged in.
#
*.emerg				*

#
# I like to have messages displayed on the console, but only on a virtual
# console I usually leave idle.
#
#daemon,mail.*;\
#	news.=crit;news.=err;news.=notice;\
#	*.=debug;*.=info;\
#	*.=notice;*.=warn	/dev/tty8

# The named pipe /dev/xconsole is for the `xconsole' utility.  To use it,
# you must invoke `xconsole' with the `-file' option:
# 
#    $ xconsole -file /dev/xconsole [...]
#
# NOTE: adjust the list below, or you'll go crazy if you have a reasonably
#      busy site..
#
daemon.*;mail.*;\
	news.crit;news.err;news.notice;\
	*.=debug;*.=info;\
	*.=notice;*.=warn	|/dev/xconsole

+ _________________________ lib/modules-ls
+ ls -ltr /lib/modules
total 4
drwxr-xr-x   11 root     root         1024 Apr 30  2001 2.2.17
drwxr-xr-x    5 root     root         1024 Jul 26  2001 2.2.19
drwxr-xr-x    4 root     root         1024 Aug 19  2002 2.4.5
drwxr-xr-x    4 root     root         1024 Feb 21 17:25 2.4.18
+ _________________________ proc/ksyms-netif_rx
+ egrep netif_rx /proc/ksyms
c019263c netif_rx_Rc3d0e0ee
+ _________________________ lib/modules-netif_rx
+ modulegoo kernel/net/ipv4/ipip.o netif_rx
+ set +x
2.2.17: 
2.2.19: 
2.4.18: 
2.4.5: 
+ _________________________ kern.debug
+ test -f /var/log/kern.debug
+ _________________________ klog
+ sed -n '258,$p' /var/log/syslog
+ egrep -i 'ipsec|klips|pluto'
+ cat
Mar  5 11:39:38 sparta ipsec_setup: Starting FreeS/WAN IPsec 1.96...
Mar  5 11:39:38 sparta ipsec_setup: KLIPS debug `none'
Mar  5 11:39:39 sparta ipsec_setup: KLIPS ipsec0 on eth1 207.14.191.112/255.255.255.0 broadcast 207.14.191.255 
Mar  5 11:39:39 sparta ipsec_setup: ...FreeS/WAN IPsec started
Mar  5 11:39:47 sparta ipsec__plutorun: 104 "hydepark-sparta" #1: STATE_MAIN_I1: initiate
Mar  5 11:39:47 sparta ipsec__plutorun: 106 "hydepark-sparta" #1: STATE_MAIN_I2: sent MI2, expecting MR2
Mar  5 11:39:47 sparta ipsec__plutorun: 003 "hydepark-sparta" #1: multiple ipsec.secrets entries with distinct secrets match endpoints: first secret used
Mar  5 11:39:47 sparta ipsec__plutorun: 108 "hydepark-sparta" #1: STATE_MAIN_I3: sent MI3, expecting MR3
Mar  5 11:39:47 sparta ipsec__plutorun: 004 "hydepark-sparta" #1: STATE_MAIN_I4: ISAKMP SA established
Mar  5 11:39:47 sparta ipsec__plutorun: 112 "hydepark-sparta" #2: STATE_QUICK_I1: initiate
Mar  5 11:39:47 sparta ipsec__plutorun: 004 "hydepark-sparta" #2: STATE_QUICK_I2: sent QI2, IPsec SA established
Mar  5 11:39:49 sparta ipsec__plutorun: 104 "sparta-union" #3: STATE_MAIN_I1: initiate
Mar  5 11:39:49 sparta ipsec__plutorun: 106 "sparta-union" #3: STATE_MAIN_I2: sent MI2, expecting MR2
Mar  5 11:39:49 sparta ipsec__plutorun: 003 "sparta-union" #3: multiple ipsec.secrets entries with distinct secrets match endpoints: first secret used
Mar  5 11:39:49 sparta ipsec__plutorun: 108 "sparta-union" #3: STATE_MAIN_I3: sent MI3, expecting MR3
Mar  5 11:39:49 sparta ipsec__plutorun: 004 "sparta-union" #3: STATE_MAIN_I4: ISAKMP SA established
Mar  5 11:39:49 sparta ipsec__plutorun: 112 "sparta-union" #4: STATE_QUICK_I1: initiate
Mar  5 11:39:49 sparta ipsec__plutorun: 004 "sparta-union" #4: STATE_QUICK_I2: sent QI2, IPsec SA established
Mar  5 11:39:50 sparta ipsec__plutorun: 104 "kansas-sparta" #5: STATE_MAIN_I1: initiate
Mar  5 11:39:50 sparta ipsec__plutorun: 106 "kansas-sparta" #5: STATE_MAIN_I2: sent MI2, expecting MR2
Mar  5 11:39:50 sparta ipsec__plutorun: 003 "kansas-sparta" #5: multiple ipsec.secrets entries with distinct secrets match endpoints: first secret used
Mar  5 11:39:50 sparta ipsec__plutorun: 108 "kansas-sparta" #5: STATE_MAIN_I3: sent MI3, expecting MR3
Mar  5 11:39:50 sparta ipsec__plutorun: 004 "kansas-sparta" #5: STATE_MAIN_I4: ISAKMP SA established
Mar  5 11:39:50 sparta ipsec__plutorun: 112 "kansas-sparta" #6: STATE_QUICK_I1: initiate
Mar  5 11:39:50 sparta ipsec__plutorun: 004 "kansas-sparta" #6: STATE_QUICK_I2: sent QI2, IPsec SA established
+ _________________________ plog
+ sed -n '4350,$p' /var/log/auth.log
+ egrep -i pluto
+ cat
Mar  5 11:39:39 sparta ipsec__plutorun: Starting Pluto subsystem...
Mar  5 11:39:39 sparta Pluto[11833]: Starting Pluto (FreeS/WAN Version 1.96)
Mar  5 11:39:39 sparta Pluto[11833]:   including X.509 patch (Version 0.9.9)
Mar  5 11:39:39 sparta Pluto[11833]: Changing to directory '/etc/ipsec.d/cacerts'
Mar  5 11:39:39 sparta Pluto[11833]:   loaded cacert file 'cacert.pem' (1753 bytes)
Mar  5 11:39:39 sparta Pluto[11833]: Changing to directory '/etc/ipsec.d/crls'
Mar  5 11:39:39 sparta Pluto[11833]:   loaded crl file 'crl.pem' (731 bytes)
Mar  5 11:39:39 sparta Pluto[11833]:   could not open my X.509 cert file '/etc/x509cert.der'
Mar  5 11:39:39 sparta Pluto[11833]: OpenPGP certificate file '/etc/pgpcert.pgp' not found
Mar  5 11:39:41 sparta Pluto[11833]: | from whack: got --esp=3des
Mar  5 11:39:41 sparta Pluto[11833]:   loaded host cert file '/etc/ipsec.d/sparta.pem' (5214 bytes)
Mar  5 11:39:41 sparta Pluto[11833]: added connection description "roadwarrior"
Mar  5 11:39:41 sparta Pluto[11833]: | from whack: got --esp=3des
Mar  5 11:39:41 sparta Pluto[11833]: added connection description "hydepark-sparta"
Mar  5 11:39:42 sparta Pluto[11833]: | from whack: got --esp=3des
Mar  5 11:39:42 sparta Pluto[11833]:   loaded host cert file '/etc/ipsec.d/sparta.pem' (5214 bytes)
Mar  5 11:39:42 sparta Pluto[11833]: added connection description "roadwarrior-net"
Mar  5 11:39:43 sparta Pluto[11833]: | from whack: got --esp=3des
Mar  5 11:39:43 sparta Pluto[11833]: added connection description "sparta-union"
Mar  5 11:39:43 sparta Pluto[11833]: | from whack: got --esp=3des
Mar  5 11:39:43 sparta Pluto[11833]: added connection description "kansas-sparta"
Mar  5 11:39:44 sparta Pluto[11833]: listening for IKE messages
Mar  5 11:39:44 sparta Pluto[11833]: adding interface ipsec0/eth1 207.14.191.112
Mar  5 11:39:44 sparta Pluto[11833]: loading secrets from "/etc/ipsec.secrets"
Mar  5 11:39:44 sparta Pluto[11833]:   loaded private key file '/etc/ipsec.d/private/sparta.key' (1743 bytes)
Mar  5 11:39:45 sparta Pluto[11833]: "hydepark-sparta" #1: initiating Main Mode
Mar  5 11:39:45 sparta Pluto[11833]: "hydepark-sparta" #1: multiple ipsec.secrets entries with distinct secrets match endpoints: first secret used
Mar  5 11:39:46 sparta Pluto[11833]: "hydepark-sparta" #1: Peer ID is ID_IPV4_ADDR: '66.166.98.66'
Mar  5 11:39:46 sparta Pluto[11833]: "hydepark-sparta" #1: ISAKMP SA established
Mar  5 11:39:46 sparta Pluto[11833]: "hydepark-sparta" #2: initiating Quick Mode RSASIG+ENCRYPT+TUNNEL+PFS
Mar  5 11:39:47 sparta Pluto[11833]: "hydepark-sparta" #2: sent QI2, IPsec SA established
Mar  5 11:39:47 sparta Pluto[11833]: "sparta-union" #3: initiating Main Mode
Mar  5 11:39:47 sparta Pluto[11833]: "sparta-union" #3: multiple ipsec.secrets entries with distinct secrets match endpoints: first secret used
Mar  5 11:39:48 sparta Pluto[11833]: "sparta-union" #3: Peer ID is ID_IPV4_ADDR: '66.166.193.50'
Mar  5 11:39:48 sparta Pluto[11833]: "sparta-union" #3: ISAKMP SA established
Mar  5 11:39:48 sparta Pluto[11833]: "sparta-union" #4: initiating Quick Mode RSASIG+ENCRYPT+TUNNEL+PFS
Mar  5 11:39:49 sparta Pluto[11833]: "sparta-union" #4: sent QI2, IPsec SA established
Mar  5 11:39:49 sparta Pluto[11833]: "kansas-sparta" #5: initiating Main Mode
Mar  5 11:39:49 sparta Pluto[11833]: "kansas-sparta" #5: multiple ipsec.secrets entries with distinct secrets match endpoints: first secret used
Mar  5 11:39:50 sparta Pluto[11833]: "kansas-sparta" #5: Peer ID is ID_IPV4_ADDR: '24.123.99.190'
Mar  5 11:39:50 sparta Pluto[11833]: "kansas-sparta" #5: ISAKMP SA established
Mar  5 11:39:50 sparta Pluto[11833]: "kansas-sparta" #6: initiating Quick Mode RSASIG+ENCRYPT+TUNNEL+PFS
Mar  5 11:39:50 sparta Pluto[11833]: "kansas-sparta" #6: sent QI2, IPsec SA established
Mar  5 11:41:58 sparta Pluto[11833]: packet from 206.26.195.236:500: ignoring Vendor ID payload
Mar  5 11:41:58 sparta Pluto[11833]: "roadwarrior" 206.26.195.236 #7: responding to Main Mode from unknown peer 206.26.195.236
Mar  5 11:41:59 sparta Pluto[11833]: "roadwarrior" 206.26.195.236 #7: Peer ID is ID_DER_ASN1_DN: 'C=US, ST=New Jersey, L=Union, O=Phoenix Medical Construction Net, OU=IT, CN=Darius Xerxes Desiderio, [email protected]'
Mar  5 11:41:59 sparta Pluto[11833]: "roadwarrior" 206.26.195.236 #7: multiple ipsec.secrets entries with distinct secrets match endpoints: first secret used
Mar  5 11:41:59 sparta Pluto[11833]: "roadwarrior" 206.26.195.236 #7: multiple ipsec.secrets entries with distinct secrets match endpoints: first secret used
Mar  5 11:41:59 sparta Pluto[11833]: "roadwarrior-net" 206.26.195.236 #7: deleting connection "roadwarrior" instance with peer 206.26.195.236
Mar  5 11:41:59 sparta Pluto[11833]: "roadwarrior-net" 206.26.195.236 #7: multiple ipsec.secrets entries with distinct secrets match endpoints: first secret used
Mar  5 11:41:59 sparta Pluto[11833]: "roadwarrior-net" 206.26.195.236 #7: sent MR3, ISAKMP SA established
Mar  5 11:43:58 sparta Pluto[11833]: packet from 206.26.195.236:500: ignoring Vendor ID payload
Mar  5 11:43:58 sparta Pluto[11833]: "roadwarrior-net" 206.26.195.236 #8: responding to Main Mode from unknown peer 206.26.195.236
Mar  5 11:43:59 sparta Pluto[11833]: "roadwarrior-net" 206.26.195.236 #8: Peer ID is ID_DER_ASN1_DN: 'C=US, ST=New Jersey, L=Union, O=Phoenix Medical Construction Net, OU=IT, CN=Darius Xerxes Desiderio, [email protected]'
Mar  5 11:43:59 sparta Pluto[11833]: "roadwarrior-net" 206.26.195.236 #8: multiple ipsec.secrets entries with distinct secrets match endpoints: first secret used
Mar  5 11:43:59 sparta Pluto[11833]: "roadwarrior-net" 206.26.195.236 #8: sent MR3, ISAKMP SA established
Mar  5 11:44:01 sparta Pluto[11833]: "roadwarrior-net" 206.26.195.236 #7: ignoring Delete SA payload
Mar  5 11:44:01 sparta Pluto[11833]: "roadwarrior-net" 206.26.195.236 #7: received and ignored informational message
Mar  5 11:45:31 sparta Pluto[11833]: "roadwarrior-net" 206.26.195.236 #8: ignoring Delete SA payload
Mar  5 11:45:31 sparta Pluto[11833]: "roadwarrior-net" 206.26.195.236 #8: received and ignored informational message
Mar  5 11:45:58 sparta Pluto[11833]: packet from 206.26.195.236:500: ignoring Vendor ID payload
Mar  5 11:45:58 sparta Pluto[11833]: "roadwarrior-net" 206.26.195.236 #9: responding to Main Mode from unknown peer 206.26.195.236
Mar  5 11:45:59 sparta Pluto[11833]: "roadwarrior-net" 206.26.195.236 #9: Peer ID is ID_DER_ASN1_DN: 'C=US, ST=New Jersey, L=Union, O=Phoenix Medical Construction Net, OU=IT, CN=Darius Xerxes Desiderio, [email protected]'
Mar  5 11:45:59 sparta Pluto[11833]: "roadwarrior-net" 206.26.195.236 #9: multiple ipsec.secrets entries with distinct secrets match endpoints: first secret used
Mar  5 11:45:59 sparta Pluto[11833]: "roadwarrior-net" 206.26.195.236 #9: sent MR3, ISAKMP SA established
Mar  5 11:47:45 sparta Pluto[11833]: "roadwarrior-net" 206.26.195.236 #9: ignoring Delete SA payload
Mar  5 11:47:45 sparta Pluto[11833]: "roadwarrior-net" 206.26.195.236 #9: received and ignored informational message
Mar  5 11:47:51 sparta Pluto[11833]: packet from 206.26.195.236:500: ignoring Vendor ID payload
Mar  5 11:47:51 sparta Pluto[11833]: "roadwarrior-net" 206.26.195.236 #10: responding to Main Mode from unknown peer 206.26.195.236
Mar  5 11:47:51 sparta Pluto[11833]: "roadwarrior-net" 206.26.195.236 #10: Peer ID is ID_DER_ASN1_DN: 'C=US, ST=New Jersey, L=Union, O=Phoenix Medical Construction Net, OU=IT, CN=Darius Xerxes Desiderio, [email protected]'
Mar  5 11:47:51 sparta Pluto[11833]: "roadwarrior-net" 206.26.195.236 #10: multiple ipsec.secrets entries with distinct secrets match endpoints: first secret used
Mar  5 11:47:51 sparta Pluto[11833]: "roadwarrior-net" 206.26.195.236 #10: sent MR3, ISAKMP SA established
+ _________________________ date
+ date
Wed Mar  5 11:49:16 EST 2003
ipsec.conf (text/plain, 463 B) 
conn roadwarrior
	left=%any
	right=207.14.191.112
	rightca="C=US, S=New Jersey, L=Union, O=Phoenix Medical Construction Net, OU=IT, CN=Darius Xerxes Desiderio,[email protected]"
	auto=start
	pfs=yes

conn roadwarrior-net
	left=%any
	right=207.14.191.112
	rightsubnet=192.168.1.0/255.255.255.0
	rightca="C=US, S=New Jersey, L=Union, O=Phoenix Medical Construction Net, OU=IT, CN=Darius Xerxes Desiderio,[email protected]"
	network=auto
	auto=start
	pfs=yes