Section 8: administration and privileged commands
ipsec_newhostkey – generate a new raw RSA authentication key for a host Synopsis ipsec newhostkey [[–quiet] | [–verbose]] [–nssdirnssdir] [–password password] [–bits bits] [–seeddev device] [–hostname hostname] [–output filename] Description newhostkey generates an RSA public/private key pair suitable for authenticating this host is generated and stored in the NSS database. See ipsec_showhostkey(8) for how to extract the public key from…
ipsec_mgmt_selinux – Security Enhanced Linux Policy for the ipsec_mgmt processes Description Security-Enhanced Linux secures the ipsec_mgmt processes via flexible mandatory access control. The ipsec_mgmt processes execute with the ipsec_mgmt_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier. For example: ps -eZ | grep…
ipsec_look – get a quick summary of Libreswan status Synopsis ipsec look Description Look is used to get a quick overview of what the status of Libreswan is. It is the equivalent to running the commands ipsec eroute, ipsec spigrp, ipsec tncfg, ipsec spi and netstat -rn. However a bit of processing is done to…
ipsec_klipsdebug – set KLIPS and MAST debug features and level. Other stacks are not supported. Synopsis ipsec klipsdebug ipsec klipsdebug –set flagname ipsec klipsdebug –clear flagname ipsec klipsdebug –all ipsec klipsdebug –none ipsec klipsdebug –help ipsec klipsdebug –version Description Klipsdebug sets and clears flags that control various parts of the debugging output of Klips (the…
ipsec_initnss – Initialise the IPsec NSS database Synopsis ipsec initnss [–nssdir /etc/ipsec.d] Description Initnss initialises the NSS database where all private keys for RSA and certificate keypairs are stored. If already initialised, it will return an error. To remove an existing IPsec NSS database, remove all the *.db files and pkcs11.txt from the NSS data directory…
ipsec_import – Import PKCS#12 (*.p12) files into the IPsec NSS database Synopsis ipsec import [–nssdir /etc/ipsec.d] Description ipsec import Import PKCS#12 files into the IPsec NSS database located at the ipsec NSS data directory (default: /etc/ipsec.d) See Also ipsec.conf(5), ipsec(8), ipsec_auto(8), route(8) Bugs none Author Paul Wouters
ipsec_ikeping – send/receive ISAKMP/IKE echo requests/replies Synopsis ipsec ikeping [–listen] [–verbose] [–wait time] [–exchangenum num] [–ikeport localport] [–ikeaddress address] [–inet] [–inet6] destaddr [/dstport…] Description Ikeping sends and receives ISAKMP/IKE echo request and echo reply packets. These packets are intended for diagnostics purposes, in a manner similar to ping(8) does for ICMP echo request/reply packets. At the time of this…
ipsec_eroute – manipulate IPSEC extended routing tables Synopsis ipsec eroute –add –eraf (inet | inet6) –src src/srcmaskbits|srcmask –dst dst/dstmaskbits|dstmask [[–transport-proto transport-protocol]] [–src-port source-port] [–dst-port dest-port] [<SAID>] ipsec eroute –replace –eraf (inet | inet6) –src src/srcmaskbits|srcmask –dst dst/dstmaskbits|dstmask [[–transport-proto transport-protocol]] [–src-port source-port] [–dst-port dest-port] [<SAID>] ipsec eroute –del–del–eraf (inet | inet6) –srcsrc/srcmaskbits|srcmask–dstdst/dstmaskbits|dstmask [[–transport-proto transport-protocol]] [–src-port source-port] [–dst-port dest-port] [<SAID>] ipsec eroute –clear ipsec eroute –help ipsec eroute –version Said Description Where <SAID> is –af (inet | inet6) –edst edst –spi spi –proto proto OR –said said OR –said (%passthrough | %passthrough4…
ipsec_barf – spew out collected IPsec debugging information Synopsis ipsec barf [–short –maxlines <100>] Description Barf outputs (on standard output) a collection of debugging information (contents of files, selections from logs, etc.) related to the IPsec encryption/authentication system. It is primarily a convenience for remote debugging, a single command which packages up (and labels) all information…
ipsec_auto – control automatically-keyed IPsec connections Synopsis ipsec auto [–showonly] [–asynchronous] [–config configfile] [–verbose] operation connection ipsec auto [–showonly] [–asynchronous] [–config configfile] [–verbose] operation connection Examples ipsec auto { –add | –delete | –replace | –start } connection ipsec auto { –up | –down } connection ipsec auto { –route | –unroute } connection ipsec auto { –status | –ready } ipsec auto [–utc] [–listall…
ipsec_addconn – load a given policy into the pluto IKE daemon Synopsis ipsec addconn –configsetup [–rootdir dir] [–config filename] [–ctlbase socketfile] [–verbose] [–noexport] [–warningsfatal] ipsec addconn –liststack [–rootdir dir] [–config filename] [–ctlbase socketfile] [–verbose] [–noexport] [–warningsfatal] ipsec addconn –checkconfig [–rootdir dir] [–config filename] [–ctlbase socketfile] [–verbose] [–warningsfatal] ipsec addconn –autoall [–rootdir dir] [–config filename] [–ctlbase socketfile] [–verbose] [–warningsfatal] ipsec addconn [–rootdir dir] [–config filename] [–ctlbase socketfile] [–verbose] [–warningsfatal] name1 [name2…
ipsec__updown – kernel and routing manipulation script Synopsis _updown is invoked by pluto when it has brought up a new connection. This script is used to insert the appropriate routing entries for IPsec operation on some kernel IPsec stacks, such as KLIPS and MAST, and may do other necessary work that is kernel or user…
ipsec__updown.netkey – klips manipulation script Synopsis _updown is invoked by pluto when it has brought up a new connection. This script is used to insert the appropriate routing entries for IPsec operation. The interface to the script is documented in the pluto man page. See Also ipsec(8), ipsec_pluto(8). History Man page written for the Linux…
ipsec__updown – klips manipulation script Synopsis _updown is invoked by pluto when it has brought up a new connection. This script is used to insert the appropriate routing entries for IPsec operation. The interface to the script is documented in the pluto man page. See Also ipsec(8), ipsec_pluto(8). History Man page written for the Linux…
ipsec__updown.klips – klips manipulation script Synopsis _updown is invoked by pluto when it has brought up a new connection. This script is used to insert the appropriate routing entries for IPsec operation. The interface to the script is documented in the pluto man page. See Also ipsec(8), ipsec_pluto(8). History Man page written for the Linux…
ipsec__stackmanager – internal script to bring up kernel components for Libreswan Synopsis ipsec _stackmanager start [–netkey] ipsec _stackmanager stop Description ipsec _stackmanager is called from within the init sub-system (systemd, upstart, sysv initscripts) to bring up the Libreswan kernel component as configured via the protostack= option in the ipsec.conf configuration file. This involves loading and optionally…
ipsec__secretcensor – internal routing to sanitize files Description _secretcensor is called by ipsec barf to process the /etc/ipsec.secrets file to remove the private key components from the file prior to revealing the contents. See Also ipsec(8), ipsec_barf(8). History Man page written for the Linux FreeS/WAN project <m[blue]http://www.freeswan.org/m[]> by Michael Richardson. Original program by Henry Spencer….
ipsec__plutorun – internal script to (re)start pluto on old SYSV initscript systems Description _plutorun is called by _realsetup to configure and bring up pluto(8). It invokes pluto, and watches to makes sure that pluto is restarted if it fails, as the SYSV initscripts do not provide a restart facility. When other init systems are used,…
ipsec__keycensor – internal routine to remove sensitive information Description _keycensor is used by ipsec barf to process the /etc/ipsec.secrets file, removing private key info. See Also ipsec(8), ipsec_barf(8) History Man page written for the Linux FreeS/WAN project <m[blue]http://www.freeswan.org/m[]> by Michael Richardson. Original program by Henry Spencer. Author Paul Wouters placeholder to suppress warning
ipsec__import_crl – helper program for importing a crl to the NSS database Description _import_crl is spawned by pluto in order to add or update a CRL in the NSS database (default: /etc/ipsec.d) See Also pluto(8). History Man page written for the Libreswan project <m[blue]http://www.libreswan.org/m[]> by Matt Rogers Author Matt Rogers placeholder to suppress warning