| RACOON.CONF(5) | File Formats Manual | RACOON.CONF(5) |
{' and ‘}'. Lines beginning with ‘#' are comments.[' and ‘]') are used to show optional keywords and parameters. Note that you have to pay attention when this manual is describing port numbers. The port number is always enclosed by ‘[' and ‘]'. In this case, the port number is not an optional keyword. If it is possible to omit the port number, the expression becomes [[port]]. The vertical bar (‘|') is used to indicate a choice between optional parameters. Parentheses (‘(' and ‘)') are used to group keywords and parameters when necessary. Major parameters are listed below.
0x"' (double quotes).[' and ‘]'.
The PSK file, the private keys, and the hook scripts are accessed through the privileged instance of racoon(8) and do not need to be reachable in the chroot(2)'ed tree.
The listen section can also be used to specify the admin socket mode and ownership if racoon was built with support for admin port.
The default value of 0 leaves everything at the OS-specific default value. If the default buffer size is greater than what is specified here racoon will not decrease it.
This problem is known to be fixed in Linux 2.6.25 and later.
If connection is initiated using racoonctl, a unique match using the remote IP must be found or the remote block name has to be given. For received acquires (kernel notices traffic requiring a new SA) the remote IP and remoteid from matching sainfo block are used to decide the remoteblock. If no uniquely matching remoteblock is found using these criteria, no connection attempt is done.
When acting as responder, racoon picks the first proposal that has one or more acceptable remote configurations. When determining if a remote specification is matching the following information is checked:
Similarly, NAT-T is enabled if any of the initial remote configuration candidates allow NAT-T.
Sections with inherit parent statements (where parent is either address or a keyword anonymous) that have all values predefined to those of a given parent. In these sections it is enough to redefine only the changed parameters.
The following are valid statements.
Note that because PMTU discovery is broken on many sites, you will have to use MSS clamping if you want TCP to work correctly.
host/hostname' is used, where hostname is the value returned by the hostname(1) command.
This is equivalent to:
remote "address" [inherit "parent-address"] {
remote_address address;
}
The local_id and remote_id strings are constructed like:
address address [/ prefix] [[port]] ul_proto
or
subnet address [/ prefix] [[port]] ul_proto
An id string should be expressed to match the exact value of an ID payload. This is not like a filter rule. For example, if you define 3ffe:501:4819::/48 as local_id. 3ffe:501:4819:1000:/64 will not match. In the case of a longest prefix (selecting a single host), address instructs to send ID type of ADDRESS while subnet instructs to send ID type of SUBNET. Otherwise, these instructions are identical.
The anonymous keyword can be used to match any id. The clientaddr keyword can be used to match a remote id that is equal to either the peer ip address or the mode_cfg ip address (if assigned). This can be useful to restrict policy generation when racoon is acting as a client gateway for peers with dynamic ip addresses.
The from keyword allows an sainfo to only match for peers that use a specific phase1 id value during authentication. The group keyword allows an XAuth group membership check to be performed for this sainfo section. When the mode_cfg auth source is set to system or ldap, the XAuth user is verified to be a member of the specified group before allowing a matching SA to be negotiated.
racoon(8) does not have a list of security protocols to be negotiated. The list of security protocols are passed by SPD in the kernel. Therefore you have to define all of the potential algorithms in the phase 2 proposals even if there are algorithms which will not be used. These algorithms are define by using the following three directives, with a single comma as the separator. For algorithms that can take variable-length keys, algorithm names can be followed by a key length, like “blowfish 448”. racoon(8) will compute the actual phase 2 proposals by computing the permutation of the specified algorithms, and then combining them with the security protocol specified by the SPD. For example, if des, 3des, hmac_md5, and hmac_sha1 are specified as algorithms, we have four combinations for use with ESP, and two for AH. Then, based on the SPD settings, racoon(8) will construct the actual proposals. If the SPD entry asks for ESP only, there will be 4 proposals. If it asks for both AH and ESP, there will be 8 proposals. Note that the kernel may not support the algorithm you have specified.
The following are valid statements:
The following are valid statements:
The following are valid statements:
#' are ignored. Keys which start with ‘0x' are interpreted as hexadecimal strings. Note that the file must be owned by the user ID running racoon(8) (usually the privileged user), and must not be accessible by others.
path pre_shared_key "/usr/local/v6/etc/psk.txt" ;
remote anonymous
{
exchange_mode aggressive,main,base;
lifetime time 24 hour;
proposal {
encryption_algorithm 3des;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group 2;
}
}
sainfo anonymous
{
pfs_group 2;
lifetime time 12 hour ;
encryption_algorithm 3des, blowfish 448, twofish, rijndael ;
authentication_algorithm hmac_sha1, hmac_md5 ;
compression_algorithm deflate ;
}
If you are configuring plain RSA authentication, the remote directive should look like the following:
path certificate "/usr/local/v6/etc" ;
remote anonymous
{
exchange_mode main,base ;
lifetime time 12 hour ;
certificate_type plain_rsa "/usr/local/v6/etc/myrsakey.priv";
peers_certfile plain_rsa "/usr/local/v6/etc/yourrsakey.pub";
proposal {
encryption_algorithm aes ;
hash_algorithm sha1 ;
authentication_method rsasig ;
dh_group 2 ;
}
}
The following is a sample for the pre-shared key file.
10.160.94.3 mekmitasdigoat 172.16.1.133 0x12345678 194.100.55.1 whatcertificatereally 3ffe:501:410:ffff:200:86ff:fe05:80fa mekmitasdigoat 3ffe:501:410:ffff:210:4bff:fea2:8baa mekmitasdigoat foo@kame.net mekmitasdigoat foo.kame.net hoge
Diffie-Hellman computation can take a very long time, and may cause unwanted timeouts, specifically when a large D-H group is used.
http://www.kb.cert.org/vuls/id/886601.| November 15, 2011 | NetBSD 6.1 |