Linux Manuals

ipsec_spigrp – group/ungroup IPSEC Security Associations Synopsis ipsec spigrp ipsecspigrp [–label label] af1dst1spi1proto1 [af2dst2spi2proto2 [af3dst3spi3proto3 [af4dst4spi4proto4]]] ipsecspigrp [–label label] –said SA1 [SA2 [SA3 [SA4]]] ipsecspigrp –help ipsecspigrp –version Obsolete Note that spi is only supported on the classic KLIPS stack. It is not supported on any other stack and will be completely removed in future versions. A replacement command still needs…

ipsec_spi – manage IPSEC Security Associations Synopsis Note: In the following, <SA> means: –af (inet | inet6) –edst daddr –spi spi –proto proto OR –said said, <life> means: –life (soft | hard) allocations | bytes | addtime | usetime | packets | [value…] <SA> –src src –ah (hmac-md5-96 | hmac-sha1-96) [–replay_window replayw] [<life>] –authkey akey ipsec…

ipsec_showhostkey – show host’s authentication key Synopsis ipsec showhostkey [–verbose] {–version | –list | –dump | –left | –right | –ipseckey} [–ckaid ckaid | –rsaid rsaid] [–gateway gateway] [–precedence precedence] [–nssdir nssdir] [–password password] Description Showhostkey outputs (on standard output) a public key suitable for this host, in the format specified, using the host key information stored in the NSS database. In…

ipsec_setup – wrapper routine to the Libreswan init system Description setup is called (via ipsec setup) by the system administrator to perform init system related tasks to Libreswan, such as start, stop, status, reload, etc for the Internet Keying Exchange (IKE) daemon pluto. It is available for backwards compatibility with Openswan and FreeS/WAN. Supported Init…

ipsec_selinux – Security Enhanced Linux Policy for the ipsec processes Description Security-Enhanced Linux secures the ipsec processes via flexible mandatory access control. The ipsec processes execute with the ipsec_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier. For example: ps -eZ | grep…

ipsec_secrets – re-read the ipsec.secrets file Synopsis ipsec secrets Description secrets is an alias for ipsec auto –rereadsecrets and rereads all the secrets in the ipsec.secrets file. See Also ipsec.secrets(5) History Older versions of libreswan (and openswan) would allow the secrets files to contain filenames to encrypted RSA private keys. These are no longer supported…

ipsec_rsasigkey – generate RSA signature key Synopsis ipsec rsasigkey [–verbose] [–seeddev device] [–seed numbits] [–nssdir nssdir] [–password nsspassword] [–hostname hostname] [nbits] Description rsasigkey generates an RSA public/private key pair, suitable for digital signatures, of (exactly) nbits bits (that is, two primes each of exactly nbits/2 bits, and related numbers) and emits it on standard output as ASCII (mostly hex) data….

ipsec_readwriteconf – validate and output an Libreswan IPsec configuration file Synopsis ipsec readwriteconf [–config file] [–debug] [–verbose] [–rootdir dir] Description This program reads the given ipsec.conf style configuration file, interpreting the also= options, and outputs an equivalent ipsec.conf file. The purpose of this program is to validate the input processing. This can also be used to validate…

ipsec_pluto, ipsec_whack, pluto – ipsec whack : IPsec IKE keying daemon and control interface Synopsis ipsec pluto [–help] [–version] [–leak-detective] [–config filename] [–vendorid VID] [–nofork] [–stderrlog] [—-plutostderrlogtime] [–logfile filename] [–use-klips] [–use-mast] [–use-netkey] [–use-nostack] [–uniqueids] [–virtual-private network_list] [–keep-alive delay_sec] [–force-busy] [–nocrsend] [–strictcrlpolicy] [–crlcheckinterval] [–interface interfacename] [–listen ipaddr] [–ikeport portnumber] [–natikeport portnumber] [–ctlbase path] [–secretsfile secrets-file] [–nhelpers number] [–seedbits numbits] [–perpeerlog] [–perpeerlogbase dirname] [–ipsecdir dirname] [–nssdir dirname] [–coredir dirname] [–statsbin filename] [–secctx-attr-type number] ipsec whack [–help]…

ipsec_pf_key – shows pfkey messages emitted by the kernel when using the KLIPS or MAST stack. Synopsis pf_key –ah –esp –ipip –ipcomp –daemon filehmac-md5-96 | hmac-sha1-96 Stack Note that pf_key is only supported on the KLIPS and MAST stacks. It is not supported on any other stack. Description pf_key is a program to open a…

ipsec_newhostkey – generate a new raw RSA authentication key for a host Synopsis ipsec newhostkey [[–quiet] | [–verbose]] [–nssdirnssdir] [–password password] [–bits bits] [–seeddev device] [–hostname hostname] [–output filename] Description newhostkey generates an RSA public/private key pair suitable for authenticating this host is generated and stored in the NSS database. See ipsec_showhostkey(8) for how to extract the public key from…

ipsec_mgmt_selinux – Security Enhanced Linux Policy for the ipsec_mgmt processes Description Security-Enhanced Linux secures the ipsec_mgmt processes via flexible mandatory access control. The ipsec_mgmt processes execute with the ipsec_mgmt_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier. For example: ps -eZ | grep…

ipsec_look – get a quick summary of Libreswan status Synopsis ipsec look Description Look is used to get a quick overview of what the status of Libreswan is. It is the equivalent to running the commands ipsec eroute, ipsec spigrp, ipsec tncfg, ipsec spi and netstat -rn. However a bit of processing is done to…

ipsec_klipsdebug – set KLIPS and MAST debug features and level. Other stacks are not supported. Synopsis ipsec klipsdebug ipsec klipsdebug –set flagname ipsec klipsdebug –clear flagname ipsec klipsdebug –all ipsec klipsdebug –none ipsec klipsdebug –help ipsec klipsdebug –version Description Klipsdebug sets and clears flags that control various parts of the debugging output of Klips (the…

ipsec_initnss – Initialise the IPsec NSS database Synopsis ipsec initnss [–nssdir /etc/ipsec.d] Description Initnss initialises the NSS database where all private keys for RSA and certificate keypairs are stored. If already initialised, it will return an error. To remove an existing IPsec NSS database, remove all the *.db files and pkcs11.txt from the NSS data directory…

ipsec_import – Import PKCS#12 (*.p12) files into the IPsec NSS database Synopsis ipsec import [–nssdir /etc/ipsec.d] Description ipsec import Import PKCS#12 files into the IPsec NSS database located at the ipsec NSS data directory (default: /etc/ipsec.d) See Also ipsec.conf(5), ipsec(8), ipsec_auto(8), route(8) Bugs none Author Paul Wouters

ipsec_ikeping – send/receive ISAKMP/IKE echo requests/replies Synopsis ipsec ikeping [–listen] [–verbose] [–wait time] [–exchangenum num] [–ikeport localport] [–ikeaddress address] [–inet] [–inet6] destaddr [/dstport…] Description Ikeping sends and receives ISAKMP/IKE echo request and echo reply packets. These packets are intended for diagnostics purposes, in a manner similar to ping(8) does for ICMP echo request/reply packets. At the time of this…

ipsec_eroute – manipulate IPSEC extended routing tables Synopsis ipsec eroute –add –eraf (inet | inet6) –src src/srcmaskbits|srcmask –dst dst/dstmaskbits|dstmask [[–transport-proto transport-protocol]] [–src-port source-port] [–dst-port dest-port] [<SAID>] ipsec eroute –replace –eraf (inet | inet6) –src src/srcmaskbits|srcmask –dst dst/dstmaskbits|dstmask [[–transport-proto transport-protocol]] [–src-port source-port] [–dst-port dest-port] [<SAID>] ipsec eroute –del–del–eraf (inet | inet6) –srcsrc/srcmaskbits|srcmask–dstdst/dstmaskbits|dstmask [[–transport-proto transport-protocol]] [–src-port source-port] [–dst-port dest-port] [<SAID>] ipsec eroute –clear ipsec eroute –help ipsec eroute –version Said Description Where <SAID> is –af (inet | inet6) –edst edst –spi spi –proto proto OR –said said OR –said (%passthrough | %passthrough4…

ipsec_barf – spew out collected IPsec debugging information Synopsis ipsec barf [–short –maxlines <100>] Description Barf outputs (on standard output) a collection of debugging information (contents of files, selections from logs, etc.) related to the IPsec encryption/authentication system. It is primarily a convenience for remote debugging, a single command which packages up (and labels) all information…

ipsec_auto – control automatically-keyed IPsec connections Synopsis ipsec auto [–showonly] [–asynchronous] [–config configfile] [–verbose] operation connection ipsec auto [–showonly] [–asynchronous] [–config configfile] [–verbose] operation connection Examples ipsec auto { –add | –delete | –replace | –start } connection ipsec auto { –up | –down } connection ipsec auto { –route | –unroute } connection ipsec auto { –status | –ready } ipsec auto [–utc] [–listall…