strongSwan Manager¶

strongSwan Manager is a web application that interacts with the IKEv2 daemon charon via an XML interface running the SMP information query and control protocol.

---

This application is deprecated in favor of the strongMan project, which is based on Versatile IKE Control Interface (VICI).

---

Building strongSwan Manager¶

The manager is based on a FastCGI application and uses the ClearSilver templating engine to build the web sites. Thus you will need

• ClearSilver including headers (Debian: clearsilver-dev)
• FastCGI headers and library (Debian: libfcgi-dev)
• SQLite3 with headers (Debian: libsqlite3-dev)

The FastCGI communicates through a Unix socket, which is group-writable. So the FastCGI user has to be in the group under which the daemon runs.
As you don't want to add that user to group 0, it's highly recommended to run strongSwan under a non-root group. Create a group for that purpose:

groupadd vpn

To build the manager, add the following options to ./configure

--enable-smp --enable-manager --enable-sqlite --with-group=vpn

strongSwan releases prior to 4.2.2 use numerical group IDs, use --with-gid instead.

Setting up Apache 2¶

As the manager uses FastCGI, any web server may be used to host the application. Here we look at the configuration of Apache2 using mod-fastcgi.

In addition to the Apache2 web server itself, you'll need

• mod-fastcgi (Debian: libapache2-mod-fastcgi)

Make sure to enable the new module and that the following fastcgi option is set (e.g. in mods-enabled/fastcgi.conf):

AddHandler fastcgi-script .fcgi

Static files are directly served by Apache, everything else is served by the FastCGI application. Add these two lines to your website:

Alias /manager/static /usr/local/libexec/ipsec/manager/templates/static
ScriptAlias /manager /usr/local/libexec/ipsec/manager/manager.fcgi

Adapt these paths according to your --prefix or --libexecdir installation settings.

Now you'll need to add the FastCGI user to group which is used by strongSwan:

usermod -a -G vpn www-data

This setup is only recommended if you don't run other websites, as it allows the apache user to control strongSwan. You really should consider a more
secure setup (e.g. separate user for Manager, suexec, etc.)!

Configure the manager¶

The manager uses a small database to do user authorization and gateway management. We have no frontend yet, so you'll need to set up this database yourself. It is tested with SQLite, but MySQL should work if you set up the database properly.

The manager uses the strongswan.conf configuration file installed in your sysconfdir (e.g. /etc):

manager {
  # path to your database
  database = sqlite:///etc/ipsec.d/manager.db
  # disable libfast debugging
  debug = false
  # number of threads to create in libfast
  threads = 5
  # session timeout
  timeout = 600
  # socket, if you want to run manager on console to debug. No socket lets apache create manager instances
  #socket = /var/lib/apache2/fastcgi/manager
}

To create the database tables and some test data, have a look at the SQLite SQL script (see source:src/manager/sqlite.sql). This script creates a user strongSwan with the password strongSwan.

To create an SQLite database, use something like:

wget https://wiki.strongswan.org/projects/strongswan/repository/revisions/master/raw/src/manager/sqlite.sql -q -O - | sqlite3 /etc/ipsec.d/manager.db
chmod g+w /etc/ipsec.d/manager.db
chgrp vpn /etc/ipsec.d/manager.db

The password is hashed in the configuration database. To update it to USERNAME and PASSWORD use something like this (on bash):

echo "update users set username = 'USERNAME', password = '`echo -n "USERNAMEPASSWORD" \
| sha1sum | awk '{ print $1 }'`';" | sqlite3 /etc/ipsec.d/manager.db

If for example USERNAME is foo and PASSWORD is barbara8x92 then the entry becomes

echo "update users set username = 'foo', password = '`echo -n "foobarbara8x92" \
| sha1sum | awk '{ print $1 }'`';" | sqlite3 /etc/ipsec.d/manager.db

Don't forget to set up write permissions for the apache user.

Logging in¶

Surf to

http://host/manager/status/ikesalist

and have fun.