SQL configuration and credential plugin¶

The SQL plugin for charon allows to store the complete connection configuration in a relational database. Further, the daemon reads credentials, such as certificates, private keys or passwords from the database to do all kind of authentication. Logging to the database is also possible.

Status¶

The SQL plugin is still experimental and in developement (source:src/libcharon/plugins/sql). It currently works on top of MySQL or SQLite.
There is no frontend yet to configure the database, but we'll extend the manager to allow such tasks.

Database setup¶

There are three SQL scripts to help you in the database setup:

• MySQL tables source:src/libcharon/plugins/sql/mysql.sql
• SQLite tables source:src/libcharon/plugins/sql/sqlite.sql
• Test data source:src/libcharon/plugins/sql/test.sql

Configuration¶

Make sure to build strongSwan with the appropriate modules:

 ./configure --enable-sql --enable-mysql --enable-sqlite [...]

The plugin uses strongswan.conf for database configuration:

charon {
  plugins {
    sql {
      database = mysql://user:pass@localhost/database
      # or using sqlite:
      # database = sqlite:///etc/ipsec.d/ipsec.db
    }
  }
}