Section 8: administration and privileged commands
xtables-nft — iptables using nftables kernel api Description xtables-nft are versions of iptables that use the nftables API. This is a set of tools to help the system administrator migrate the ruleset from iptables(8), ip6tables(8), arptables(8), and ebtables(8) to nftables(8). The xtables-nft set is composed of several commands: • iptables-nft • iptables-nft-save • iptables-nft-restore •…
xtables-legacy — iptables using old getsockopt/setsockopt-based kernel api Description xtables-legacy are the original versions of iptables that use old getsockopt/setsockopt-based kernel interface. This kernel interface has some limitations, therefore iptables can also be used with the newer nf_tables based API. See xtables-nft(8) for information about the xtables-nft variants of iptables. Usage The xtables-legacy-multi binary can…
xtables-legacy — iptables using old getsockopt/setsockopt-based kernel api Description xtables-legacy are the original versions of iptables that use old getsockopt/setsockopt-based kernel interface. This kernel interface has some limitations, therefore iptables can also be used with the newer nf_tables based API. See xtables-nft(8) for information about the xtables-nft variants of iptables. Usage The xtables-legacy-multi binary can…
xtables-legacy — iptables using old getsockopt/setsockopt-based kernel api Description xtables-legacy are the original versions of iptables that use old getsockopt/setsockopt-based kernel interface. This kernel interface has some limitations, therefore iptables can also be used with the newer nf_tables based API. See xtables-nft(8) for information about the xtables-nft variants of iptables. Usage The xtables-legacy-multi binary can…
iptables-extensions — list of extensions in the standard iptables distribution Synopsis ip6tables [-m name [module-options…]] [-j target-name [target-options…] iptables [-m name [module-options…]] [-j target-name [target-options…] Match Extensions iptables can use extended packet matching modules with the -m or –match options, followed by the matching module name; after these, various extra command line options become available,…
iptables-apply – a safer way to update iptables remotely Synopsis iptables-apply [-hV] [-t timeout] [-w savefile] {[rulesfile]|-c [runcmd]} Description iptables-apply will try to apply a new rulesfile (as output by iptables-save, read by iptables-restore) or run a command to configure iptables and then prompt the user whether the changes are okay. If the new iptables…
ipset — administration tool for IP sets Synopsis ipset [ OPTIONS ] COMMAND [ COMMAND-OPTIONS ] COMMANDS := { create | add | del | test | destroy | list | save | restore | flush | rename | swap | help | version | – } OPTIONS := { -exist | -output { plain…
ipsec_pluto, ipsec_whack, pluto – ipsec whack : IPsec IKE keying daemon and control interface Synopsis ipsec pluto [–help] [–version] [–leak-detective] [–config filename] [–vendorid VID] [–nofork] [–stderrlog] [—-plutostderrlogtime] [–logfile filename] [–use-klips] [–use-mast] [–use-netkey] [–use-nostack] [–uniqueids] [–virtual-private network_list] [–keep-alive delay_sec] [–force-busy] [–nocrsend] [–strictcrlpolicy] [–crlcheckinterval] [–interface interfacename] [–listen ipaddr] [–ikeport portnumber] [–natikeport portnumber] [–ctlbase path] [–secretsfile secrets-file] [–nhelpers number] [–seedbits numbits] [–perpeerlog] [–perpeerlogbase dirname] [–ipsecdir dirname] [–nssdir dirname] [–coredir dirname] [–statsbin filename] [–secctx-attr-type number] ipsec whack [–help]…
ipsec_verify – see if the IPsec subsystem has been installed correctly Synopsis ipsec verify Description The ipsec verify examines the local system for a number of common system faults and configuration mistakes. History Written originally for the Linux FreeS/WAN project <m[blue]http://www.freeswan.orgm[]> by Michael Richardson. Rewritten in python by Paul Wouters Bugs Verify was converted from…
ipsec_tncfg – manipulate KLIPS virtual interfaces Synopsis ipsec tncfg ipsec tncfg –create virtual ipsec tncfg –delete virtual ipsec tncfg –attach –virtual virtual –physical physical ipsec tncfg –detach –virtual virtual ipsec tncfg –clear ipsec tncfg –version ipsec tncfg –help Klips Note that tncfg is only supported on the KLIPS stack which uses ipsecX interfaces bound to…
ipsec_spigrp – group/ungroup IPSEC Security Associations Synopsis ipsec spigrp ipsecspigrp [–label label] af1dst1spi1proto1 [af2dst2spi2proto2 [af3dst3spi3proto3 [af4dst4spi4proto4]]] ipsecspigrp [–label label] –said SA1 [SA2 [SA3 [SA4]]] ipsecspigrp –help ipsecspigrp –version Obsolete Note that spi is only supported on the classic KLIPS stack. It is not supported on any other stack and will be completely removed in future versions. A replacement command still needs…
ipsec_spi – manage IPSEC Security Associations Synopsis Note: In the following, <SA> means: –af (inet | inet6) –edst daddr –spi spi –proto proto OR –said said, <life> means: –life (soft | hard) allocations | bytes | addtime | usetime | packets | [value…] <SA> –src src –ah (hmac-md5-96 | hmac-sha1-96) [–replay_window replayw] [<life>] –authkey akey ipsec…
ipsec_showhostkey – show host’s authentication key Synopsis ipsec showhostkey [–verbose] {–version | –list | –dump | –left | –right | –ipseckey} [–ckaid ckaid | –rsaid rsaid] [–gateway gateway] [–precedence precedence] [–nssdir nssdir] [–password password] Description Showhostkey outputs (on standard output) a public key suitable for this host, in the format specified, using the host key information stored in the NSS database. In…
ipsec_setup – wrapper routine to the Libreswan init system Description setup is called (via ipsec setup) by the system administrator to perform init system related tasks to Libreswan, such as start, stop, status, reload, etc for the Internet Keying Exchange (IKE) daemon pluto. It is available for backwards compatibility with Openswan and FreeS/WAN. Supported Init…
ipsec_selinux – Security Enhanced Linux Policy for the ipsec processes Description Security-Enhanced Linux secures the ipsec processes via flexible mandatory access control. The ipsec processes execute with the ipsec_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier. For example: ps -eZ | grep…
ipsec_secrets – re-read the ipsec.secrets file Synopsis ipsec secrets Description secrets is an alias for ipsec auto –rereadsecrets and rereads all the secrets in the ipsec.secrets file. See Also ipsec.secrets(5) History Older versions of libreswan (and openswan) would allow the secrets files to contain filenames to encrypted RSA private keys. These are no longer supported…
ipsec_rsasigkey – generate RSA signature key Synopsis ipsec rsasigkey [–verbose] [–seeddev device] [–seed numbits] [–nssdir nssdir] [–password nsspassword] [–hostname hostname] [nbits] Description rsasigkey generates an RSA public/private key pair, suitable for digital signatures, of (exactly) nbits bits (that is, two primes each of exactly nbits/2 bits, and related numbers) and emits it on standard output as ASCII (mostly hex) data….
ipsec_readwriteconf – validate and output an Libreswan IPsec configuration file Synopsis ipsec readwriteconf [–config file] [–debug] [–verbose] [–rootdir dir] Description This program reads the given ipsec.conf style configuration file, interpreting the also= options, and outputs an equivalent ipsec.conf file. The purpose of this program is to validate the input processing. This can also be used to validate…
ipsec_pluto, ipsec_whack, pluto – ipsec whack : IPsec IKE keying daemon and control interface Synopsis ipsec pluto [–help] [–version] [–leak-detective] [–config filename] [–vendorid VID] [–nofork] [–stderrlog] [—-plutostderrlogtime] [–logfile filename] [–use-klips] [–use-mast] [–use-netkey] [–use-nostack] [–uniqueids] [–virtual-private network_list] [–keep-alive delay_sec] [–force-busy] [–nocrsend] [–strictcrlpolicy] [–crlcheckinterval] [–interface interfacename] [–listen ipaddr] [–ikeport portnumber] [–natikeport portnumber] [–ctlbase path] [–secretsfile secrets-file] [–nhelpers number] [–seedbits numbits] [–perpeerlog] [–perpeerlogbase dirname] [–ipsecdir dirname] [–nssdir dirname] [–coredir dirname] [–statsbin filename] [–secctx-attr-type number] ipsec whack [–help]…
ipsec_pf_key – shows pfkey messages emitted by the kernel when using the KLIPS or MAST stack. Synopsis pf_key –ah –esp –ipip –ipcomp –daemon filehmac-md5-96 | hmac-sha1-96 Stack Note that pf_key is only supported on the KLIPS and MAST stacks. It is not supported on any other stack. Description pf_key is a program to open a…