Форум системных администраторов

Код: Выделить всё

openssl genrsa -des3 -out ca.key 1024

Код: Выделить всё

openssl req -new -x509 -days 730 -key ca.key -out ca.crt

Код: Выделить всё

openssl genrsa -out ipsec-server.key 1024

Код: Выделить всё

openssl req -new -key ipsec-server.key -out ipsec-server.csr

Код: Выделить всё

openssl x509 -req -days 365 -in ipsec-server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out ipsec-server.crt 

Код: Выделить всё

openssl genrsa -out ipsec-client.key 1024

Код: Выделить всё

openssl req -new -key ipsec-client.key -out ipsec-client.csr

Код: Выделить всё

openssl x509 -req -days 365 -in ipsec-client.csr -CA ca.crt -CAkey ca.key –CAcreateserial -out ipsec-client.crt

Код: Выделить всё

openssl pkcs12 -export -inkey ipsec-client.key -certfile ca.crt -in ipsec-client.crt -out ipsec-client.p12

Код: Выделить всё

   options         IPSEC
   options         IPSEC_ESP
   options         IPSEC_DEBUG

Код: Выделить всё

cd /usr/ports/security/racoon
make
make install

Код: Выделить всё

cd /usr/local/etc/racoon
cp racoon.conf.dist racoon.conf
ee racoon.conf

Код: Выделить всё

# $KAME: racoon.conf.in,v 1.18 2001/08/16 06:33:40 itojun Exp $

# "path" must be placed before it should be used.
# You can overwrite which you defined, but it should not use due to confusing.
path include "/usr/local/etc/racoon" ;
#include "remote.conf" ;

# search this file for pre_shared_key with various ID key.
#path pre_shared_key "/usr/local/etc/racoon/psk.txt" ;

# racoon will look for certificate file in the directory,
# if the certificate/certificate request payload is received.
path certificate "/usr/local/etc/racoon/cert" ;

# "log" specifies logging level.  It is followed by either "notify", "debug"
# or "debug2".
log debug4;
#log notify;
#
# "padding" defines some parameter of padding.  You should not touch these.
padding
{
        maximum_length 20;      # maximum padding length.
        randomize off;          # enable randomize length.
        strict_check off;       # enable strict check.
        exclusive_tail off;     # extract last one octet.
}

# if no listen directive is specified, racoon will listen to all
# available interface addresses.
listen
{
        #isakmp ::1 [7000];
        isakmp 111.222.333.444 [500];
        #admin [7002];          # administrative's port by kmpstat.
        #strict_address;        # required all addresses must be bound.
}

# Specification of default various timer.
timer
{
        # These value can be changed per remote node.
        counter 5;              # maximum trying count to send.
        interval 20 sec;        # maximum interval to resend.
        persend 1;              # the number of packets per a send.

        # timer for waiting to complete each phase.
        phase1 30 sec;
        phase2 15 sec;
}

remote anonymous
{
        exchange_mode main,aggressive;
        doi ipsec_doi;
        situation identity_only;

        #my_identifier address;
        #my_identifier user_fqdn "sakane@kame.net";
        #my_identifier asn1dn;
        #peers_identifier user_fqdn "sakane@kame.net";
        #peers_identifier asn1dn;
        #verify_identifier off;
        #verify_identifier on;
        certificate_type x509 "ipsec-server.crt" "ipsec-server.key";
        peers_certfile "ipsec-client.crt";
        passive on;
        generate_policy on;

        nonce_size 16;
        lifetime time 60 min;   # sec,min,hour
        initial_contact on;
        #support_mip6 on;
        proposal_check obey;    # obey, strict or claim

        proposal {
                encryption_algorithm 3des;
                hash_algorithm sha1;
                authentication_method rsasig ;
                dh_group 2 ;
        }
}

sainfo anonymous
{
        pfs_group 1;
        lifetime time 30 sec;
        encryption_algorithm 3des, des ;
        authentication_algorithm hmac_sha1, hmac_md5;
        compression_algorithm deflate ;
}