Project

General

Profile

ipsec » History » Version 13

Tobias Brunner, 05.05.2009 18:37
trac conversion errors fixed

1 12 Martin Willi
h1. ipsec
2 1 Martin Willi
3 1 Martin Willi
4 12 Martin Willi
*ipsec* is actually an umbrella command comprising a collection of individual sub commands of the form 
5 1 Martin Willi
6 13 Tobias Brunner
p((. *ipsec _<command>_ [ _<argument>_ ]  [ _<options>_ ]*
7 12 Martin Willi
8 1 Martin Willi
that can be used to control and monitor IPsec connections as well as the IKE daemons.
9 1 Martin Willi
10 1 Martin Willi
11 12 Martin Willi
h2. Control Commands
12 1 Martin Willi
13 1 Martin Willi
14 1 Martin Willi
*ipsec start [ _<starter options>_ ]*
15 13 Tobias Brunner
p((. calls [[IpsecStarter|ipsec starter]] [ _<starter options>_ ]] which in turn parses [[IpsecConf|ipsec.conf]] and starts the IKEv1 pluto and IKEv2 charon daemons.
16 12 Martin Willi
17 12 Martin Willi
*ipsec stop*
18 13 Tobias Brunner
p((. terminates all IPsec connection and stops the IKEv1 pluto and IKEv2 charon daemons by sending a _TERM_ signal to [[IpsecStarter|ipsec starter]].
19 1 Martin Willi
20 12 Martin Willi
*ipsec restart [ _<starter options>_ ]*
21 13 Tobias Brunner
p((. is equivalent to *ipsec stop* followed by *ipsec start [ _<starter options>_ ]* after a guard period of 2 seconds.
22 1 Martin Willi
   
23 1 Martin Willi
*ipsec update*
24 13 Tobias Brunner
p((. sends a _HUP_ signal to [[IpsecStarter|ipsec starter]] which in turn determines any changes in [[IpsecConf|ipsec.conf]] and updates the configuration on the running IKEv1 pluto and IKEv2 charon daemons, correspondingly.
25 1 Martin Willi
26 12 Martin Willi
*ipsec reload*
27 13 Tobias Brunner
p((. sends a _USR1_ signal to [[IpsecStarter|ipsec starter]] which in turn reloads the whole configuration on the running IKEv1 pluto and IKEv2 charon daemons based on the actual [[IpsecConf|ipsec.conf]].
28 1 Martin Willi
29 13 Tobias Brunner
*ipsec up  _<name>_*
30 13 Tobias Brunner
p((. tells the responsible IKE daemon to start up connection _<name>_. Implemented by calling the [[IpsecWhack|ipsec whack]] --name _<name>_ --initiate and/or [[IpsecStroke|ipsec stroke]] up _<name>_ commands.
31 12 Martin Willi
32 13 Tobias Brunner
*ipsec down  _<name>_*
33 13 Tobias Brunner
p((.  tells the responsible IKE daemon to terminate connection _<name>_. Implemented by calling the [[IpsecWhack|ipsec whack]] --name _<name>_ --terminate and/or [[IpsecStroke|ipsec stroke]] down _<name>_ commands.
34 12 Martin Willi
35 13 Tobias Brunner
*ipsec route  _<name>_*
36 13 Tobias Brunner
p((. tells the responsible IKE daemon to insert an [[IpsecPolicy|IPsec policy]] in the kernel for connection _<name>_. The first payload packet matching the [[IpsecPolicy|IPsec policy]] will automatically trigger an IKE connection setup. Implemented by calling the [[IpsecWhack|ipsec whack]] --name _<name>_ --route and/or [[IpsecStroke|ipsec stroke]] route _<name>_ commands.
37 1 Martin Willi
38 13 Tobias Brunner
*ipsec unroute  _<name>_*
39 13 Tobias Brunner
p((. remove the [[IpsecPolicy|IPsec policy]] in the kernel for connection _<name>_. Implemented by calling the [[IpsecWhack|ipsec whack]] --name _<name>_ --unroute and/or [[IpsecStroke|ipsec stroke]] unroute _<name>_ commands.
40 5 Martin Willi
 
41 13 Tobias Brunner
*ipsec status [ _<name>_ ]*
42 13 Tobias Brunner
p((.  returns concise status information either on connection _<name>_ or if the argument is lacking, on all connections. Implemented by calling the [[IpsecWhack|ipsec whack]] [ --name _<name>_ ] --status and/or [[IpsecStroke|ipsec stroke]] status [ _<name>_ ] commands.
43 12 Martin Willi
44 13 Tobias Brunner
*ipsec statusall [ _<name>_ ]*
45 13 Tobias Brunner
p((. returns detailed status information either on connection _<name>_ or if the argument is lacking, on all connections. Implemented by calling the [[IpsecWhack|ipsec whack]] [ --name _<name>_ ] statusall and/or [[IpsecStroke|ipsec stroke]] statusall [ _<name>_ ] commands.
46 12 Martin Willi
47 1 Martin Willi
48 12 Martin Willi
h2. Info Commands
49 1 Martin Willi
50 1 Martin Willi
51 12 Martin Willi
*ipsec version*
52 13 Tobias Brunner
p((. returns the ipsec version in the form of *Linux strongSwan U<strongSwan userland version>/K<Linux kernel version>* if strongSwan uses the native NETKEY IPsec stack of the Linux kernel it is running on.
53 1 Martin Willi
  
54 1 Martin Willi
55 1 Martin Willi
*ipsec copyright*
56 13 Tobias Brunner
p((. returns the copyright information.
57 12 Martin Willi
58 1 Martin Willi
*ipsec --confdir*
59 13 Tobias Brunner
p((. returns the _SYSCONFDIR_ directory as defined by the [[InstallationDocumentation|configure]] options.
60 1 Martin Willi
61 1 Martin Willi
*ipsec --directory*
62 13 Tobias Brunner
p((. returns the _LIBEXECDIR_ directory as defined by the [[InstallationDocumentation|configure]] options.
63 1 Martin Willi
64 1 Martin Willi
*ipsec --help*
65 13 Tobias Brunner
p((. returns the usage information for the ipsec command.
66 12 Martin Willi
67 12 Martin Willi
*ipsec --versioncode*
68 13 Tobias Brunner
p((. returns the ipsec version number in the form of *U<strongSwan userland version>/K<Linux kernel version>* if strongSwan uses the native NETKEY IPsec stack of the Linux kernel it is running on.
69 1 Martin Willi
70 10 Martin Willi
71 12 Martin Willi
h2. List Commands
72 1 Martin Willi
73 10 Martin Willi
74 12 Martin Willi
*ipsec listaacerts [ --utc ]*
75 13 Tobias Brunner
p((. returns a list of X.509 Authorization Authority (AA) certificates that were loaded locally by the IKE daemon from the [[IpsecDirectoryAacerts|/etc/ipsec.d/aacerts]] directory. Implemented by calling the [[IpsecWhack|ipsec whack]] --listaacerts and/or [[IpsecStroke|ipsec stroke]] listaacerts commands.
76 1 Martin Willi
77 12 Martin Willi
*ipsec listacerts [ --utc ]*
78 13 Tobias Brunner
p((. returns a list of X.509 Attribute certificates that were loaded locally by the IKE daemon from the [[IpsecDirectoryAcerts|/etc/ipsec.d/acerts]] directory. Implemented by calling the [[IpsecWhack|ipsec whack] --listacerts andor [wikiIpsecStroke ipsec stroke]] listacerts commands.
79 12 Martin Willi
80 12 Martin Willi
*ipsec listalgs*
81 13 Tobias Brunner
p((. returns a list of all supported IKE encryption and hash algorithms, the available Diffie-Hellman groups, as well as all ESP encryption and authentication algorithms registered via the Linux kernel's Crypto API. Supported by the IKEv1 pluto daemon only. Implemented by calling the [[IpsecWhack|ipsec whack]] --listalgs command.
82 10 Martin Willi
83 4 Martin Willi
*ipsec listcacerts [ --utc ]*
84 13 Tobias Brunner
p((. returns a list of X.509 Certification Authority (CA) certificates that were loaded locally by the IKE daemon from the [[IpsecDirectoryCacerts|/etc/ipsec.d/cacerts]] directory or received in PKCS#7-wrapped certificate payloads via the IKE protocol. Implemented by calling the [[IpsecWhack|ipsec whack]] --listcacerts and/or [[IpsecStroke|ipsec stroke]] listcacerts commands.
85 8 Martin Willi
86 12 Martin Willi
*ipsec listcainfos [ --utc ]*
87 13 Tobias Brunner
p((. returns Certification Authority information (CRL distribution points, OCSP URIs, LDAP servers) that were defined by [[CaSection|ca sections]] in [[IpsecConf|ipsec.conf]]. Implemented by calling the [[IpsecWhack|ipsec whack]] --listcainfos and/or [[IpsecStroke|ipsec stroke]] listcainfos commands.
88 11 Martin Willi
89 12 Martin Willi
*ipsec listcards [ --utc ]*
90 13 Tobias Brunner
p((. lists all certificates found on attached smart cards. Supported by the IKEv1 pluto daemon only. Implemented by calling the [[IpsecWhack|ipsec whack]] --listcards command.
91 8 Martin Willi
92 12 Martin Willi
*ipsec listcrls [ --utc ]*
93 13 Tobias Brunner
p((. returns a list of Certificate Revocation Lists (CRLs) that were either loaded by the IKE daemon from the [[IpsecDirectoryCrls|etcipsecdcrls]] directory or fetched from an HTTP- or LDAP-based CRL distribution point. Implemented by calling the [[IpsecWhack|ipsec whack]] --listcrls and/or [[IpsecStroke|ipsec stroke]] listcrls commands.
94 12 Martin Willi
95 4 Martin Willi
*ipsec listcerts [ --utc ]*
96 13 Tobias Brunner
p((. returns a list of X.509 and/or OpenPGP certificates that were either loaded locally by the IKE daemon or received via the IKEv2 protocol. Implemented by calling the [[IpsecWhack|ipsec whack]] --listcerts and/or [[IpsecStroke|ipsec stroke]] listcerts commands.
97 11 Martin Willi
98 12 Martin Willi
*ipsec listgroups [ --utc ]*
99 13 Tobias Brunner
p((. returns a list of all groups that are used to define user authorization profiles. Supported by the IKEv1 pluto daemon only. Implemented by calling the [[IpsecWhack|ipsec whack]] --listgroups command.
100 12 Martin Willi
101 12 Martin Willi
*ipsec listocsp [ --utc ]*
102 13 Tobias Brunner
p((. returns cached revocation information fetched from OCSP servers. Implemented by calling the [[IpsecWhack|ipsec whack] --listocps and/or [[IpsecStroke|ipsec stroke]] listocsp commands.
103 1 Martin Willi
104 12 Martin Willi
*ipsec listocspcerts [ --utc ]*
105 13 Tobias Brunner
p((. returns a list of X.509 OCSP Signer certificates that were either loaded locally by the IKE daemon from the [[IpsecDirectoryOcspcerts|/etc/ipsec.d/ocspcerts]] directory or were sent by an OCSP server. Implemented by calling the [[IpsecWhack|ipsec whack]] --listocspcerts and/or [[IpsecStroke|ipsec stroke]] listocspcerts commands.
106 2 Martin Willi
107 8 Martin Willi
*ipsec listpubkeys [ --utc ]*
108 13 Tobias Brunner
p((. returns a list of RSA public keys that were either loaded in raw key format or extracted from X.509 and/or OpenPGP certificates. Supported by the IKEv1 pluto daemon only. Implemented by calling the [[IpsecWhack|ipsec whack]] --listpubkeys command.
109 12 Martin Willi
110 12 Martin Willi
*ipsec listall [ --utc ]*
111 13 Tobias Brunner
p((. returns  all information generated by the list commands above. Each list command can be called with the _--utc_ option which displays all dates in UTC instead of local time. Implemented by calling the [[IpsecWhack|ipsec whack]] --listall and/or [[IpsecStroke|ipsec stroke]] listall commands.
112 12 Martin Willi
113 1 Martin Willi
114 12 Martin Willi
h2. Reread Commands
115 12 Martin Willi
116 12 Martin Willi
117 1 Martin Willi
*ipsec rereadaacerts*
118 13 Tobias Brunner
p((. reads all certificate files contained in the [[IpsecDirectoryAacerts|/etc/ipsec.d/aacerts]] directory and adds them to the list of Authorization Authority (AA) certificates. Implemented by calling the [[IpsecWhack|ipsec whack]] --readaacerts and/or [[IpsecStroke|ipsec stroke]] rereadaacerts commands.
119 1 Martin Willi
120 12 Martin Willi
*ipsec rereadacerts*
121 13 Tobias Brunner
p((. reads all certificate files contained in the [[IpsecDirectoryAcerts|/etc/ipsec.d/acerts]] directory and adds them to the list of attribute certificates. Implemented by calling the [[IpsecWhack|ipsec whack]] --rereadacerts and/or [[IpsecStroke|ipsec stroke]] rereadacerts commands.
122 12 Martin Willi
123 1 Martin Willi
*ipsec rereadcacerts*
124 13 Tobias Brunner
p((. reads all certificate files contained in  the [[IpsecDirectoryCacerts|/etc/ipsec.d/cacerts]] directory  and adds them to the list of Certification Authority (CA) certificates. Implemented by calling the [[IpsecWhack|ipsec whack]] --rereadcacerts and/or [[IpsecStroke|ipsec stroke]] rereadcacerts commands.
125 12 Martin Willi
126 12 Martin Willi
*ipsec rereadcrls*
127 13 Tobias Brunner
p((. reads all Certificate Revocation Lists (CRLs) contained in the [[IpsecDirectoryCrls|/etc/ipsec.d/crls]] directory and adds them to the list of CRLs. Older CRLs are replaced by newer ones. Implemented by calling the [[IpsecWhack|ipsec whack]] --rereadcrls and/or [[IpsecStroke|ipsec stroke]] rereadcrls commands.
128 1 Martin Willi
129 12 Martin Willi
*ipsec rereadocspcerts*
130 13 Tobias Brunner
p((. reads all certificate files contained in the [[IpsecDirectoryOcspcerts|/etc/ipsec.d/ocspcerts]] directory and adds them to the list of OCSP signer certificates. Implemented by calling the [[IpsecWhack|ipsec whack]] --rereadocspcerts and/or [[IpsecStroke|ipsec stroke]] rereadocspcerts commands.
131 1 Martin Willi
 
132 12 Martin Willi
*ipsec rereadsecrets*
133 13 Tobias Brunner
p((. flushes and rereads all secrets defined in [[IpsecSecrets|ipsec.secrets]]. Implemented by calling the [[IpsecWhack|ipsec whack]] --rereadsecrets and/or [[IpsecStroke|ipsec stroke]] rereadsecrets commands.
134 12 Martin Willi
135 12 Martin Willi
*ipsec secrets*
136 13 Tobias Brunner
p((. is equivalent to *ipsec rereadsecrets*.
137 1 Martin Willi
138 12 Martin Willi
*ipsec rereadall*
139 13 Tobias Brunner
p((. executes all reread commands listed above. Implemented by calling the [[IpsecWhack|ipsec whack]] --rereadall and/or [[IpsecStroke|ipsec stroke]] rereadall commands.
140 12 Martin Willi
141 12 Martin Willi
142 1 Martin Willi
h2. Purge Commands
143 12 Martin Willi
144 12 Martin Willi
145 1 Martin Willi
*ipsec purgeocsp*
146 13 Tobias Brunner
p((. purges all cached OCSP information records. Implemented by calling the [[IpsecWhack|ipsec whack]] --purgeocsp and/or [[IpsecStroke|ipsec stroke]] purgeocsp commands.
147 12 Martin Willi
148 12 Martin Willi
149 12 Martin Willi
h2. PKCS11 Proxy Commands
150 12 Martin Willi
151 12 Martin Willi
152 1 Martin Willi
*ipsec scencrypt _<value>_ [ --inbase _<base>_ ] [ --outbase _<base>_ ] [ --keyid _<id>_ ]*
153 13 Tobias Brunner
p((. Supported by the IKEv1 pluto daemon only. Implemented by calling the [[IpsecWhack|ipsec whack]] --scencrypt command.
154 12 Martin Willi
155 12 Martin Willi
*ipsec scdecrypt _<value>_ [ --inbase <base> ] [ --outbase _<base>_ ] [ --keyid _<id>_ ]*
156 13 Tobias Brunner
p((. Supported by the IKEv1 pluto daemon only. Implemented by calling the [[IpsecWhack|ipsec whack]] --scdecrypt command.