{"id":4008,"date":"2013-12-16T16:37:08","date_gmt":"2013-12-16T14:37:08","guid":{"rendered":"http:\/\/skeletor.org.ua\/?p=4008"},"modified":"2013-12-26T16:36:17","modified_gmt":"2013-12-26T14:36:17","slug":"ipsec-solaris-linux","status":"publish","type":"post","link":"https:\/\/skeletor.org.ua\/?p=4008","title":{"rendered":"IPSec: Solaris <--> Linux"},"content":{"rendered":"

\u0422\u0435\u0441\u0442\u043e\u0432\u044b\u0439 \u0441\u0442\u0435\u043d\u0434:<\/span><\/strong><\/em>\u00a0Solaris 11.1, Debian Linux 6 (kernel 3.2), ipsec transport mode with preshared keys<\/strong><\/p>\n

\u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u00a0IPSec<\/strong>\u00a0\u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 2-\u0445 \u0447\u0430\u0441\u0442\u0435\u0439: \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u00a0IPSec\u2019a<\/strong>\u00a0\u0438 \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u043e\u0431\u043c\u0435\u043d\u0430 \u043a\u043b\u044e\u0447\u0430\u043c\u0438 (ike<\/strong>).<\/p>\n

\u0418\u043c\u0435\u0435\u043c \u0441\u0430\u043c\u0443\u044e \u043e\u0431\u044b\u0447\u043d\u0443\u044e \u0441\u0445\u0435\u043c\u0443\u00a0Solaris (10.5.5.219) <\u2014> (10.5.5.78) Linux<\/strong><\/p>\n

\u0412 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043f\u043e\u0434\u0440\u0430\u0437\u0443\u043c\u0435\u0432\u0430\u0435\u0442\u0441\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0441 \u043d\u0443\u043b\u044f.<\/p>\n

<\/p>\n

Solaris<\/span><\/strong><\/h1>\n

1) \u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 IPSec\u2019a.<\/span><\/strong><\/p>\n

\u041f\u0440\u0438\u0432\u043e\u0434\u0438\u043c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0444\u0430\u0439\u043b\u0430\u00a0\/etc\/inet\/ipsecinit.conf<\/strong>\u00a0\u043a \u0442\u0430\u043a\u043e\u043c\u0443 \u0432\u0438\u0434\u0443:<\/p>\n

{laddr 10.5.5.219 raddr 10.5.5.220} ipsec {encr_algs 3des encr_auth_algs md5 sa shared}<\/code><\/p>\n

\u0417\u0434\u0435\u0441\u044c \u043c\u044b \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u043c \u0434\u043b\u044f \u043a\u0430\u043a\u0438\u0445 \u0445\u043e\u0441\u0442\u043e\u0432 \u0431\u0443\u0434\u0435\u0442 \u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u043e, \u0430 \u0442\u0430\u043a \u0436\u0435 \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u043c \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u043a\u0430\u043a\u0438\u0435 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u044b \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0440\u0438 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0438 \u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.<\/p>\n

\u041f\u043e\u0441\u043b\u0435 \u044d\u0442\u043e\u0433\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u043c \u043a\u043e\u043d\u0444\u0438\u0433 \u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u0438:<\/p>\n

# ipsecconf -f -c \/etc\/inet\/ipsecinit.conf
\nIPsec configuration does not contain any errors.
\nIPsec policy was not modified.<\/code><\/p>\n

\u0438 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0441\u043b\u0435 \u044d\u0442\u043e\u0433\u043e (\u0435\u0441\u043b\u0438 \u0435\u0441\u0442\u044c \u043e\u0448\u0438\u0431\u043a\u0438 \u2014 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c) \u043f\u0435\u0440\u0435\u0447\u0438\u0442\u044b\u0432\u0430\u0435\u043c \u043a\u043e\u043d\u0444\u0438\u0433 \u0447\u0435\u0440\u0435\u0437svcadm<\/strong>\u00a0(\u0438 \u0435\u0441\u043b\u0438 \u043d\u0435 \u0437\u0430\u043f\u0443\u0449\u0435\u043d \u2014 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043c \u0435\u0433\u043e):<\/p>\n

# svcadm refresh\u00a0svc:\/network\/ipsec\/policy:default
\n# svcadm enable svc:\/network\/ipsec\/policy:default<\/code><\/p>\n

\u041d\u0430\u043b\u0435\u0442\u0443 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u0442\u0430\u043a:<\/p>\n

# ipsecconf -a \/etc\/inet\/ipsecinit.conf<\/code><\/p>\n

\u0422\u0435\u043a\u0443\u0449\u0438\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u0442\u0430\u043a:<\/p>\n

# ipsecconf
\n#INDEX 154
\n{laddr 10.5.5.219 raddr 10.5.5.220} ipsec {encr_algs 3des encr_auth_algs md5 sa shared}<\/code><\/p>\n

2) \u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 ike<\/span><\/strong><\/p>\n

\u041f\u0440\u0438\u0432\u043e\u0434\u0438\u043c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0444\u0430\u0439\u043b\u0430\u00a0\/etc\/inet\/ike\/config<\/strong>\u00a0\u043a \u0442\u0430\u043a\u043e\u043c\u0443 \u0432\u0438\u0434\u0443:<\/p>\n

p1_lifetime_secs 14400
\np1_nonce_len 40
\np1_xform
\n{ auth_method preshared oakley_group 5 auth_alg sha encr_alg des }
\np2_pfs 5
\n{ label \"10.5.5.219-10.5.5.220\"
\nlocal_addr 10.5.5.219
\nremote_addr 10.5.5.220
\np1_xform
\n{ auth_method preshared oakley_group 2 auth_alg md5 encr_alg 3des }
\np2_pfs 5
\n}<\/code><\/p>\n

\u041f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u043c \u0441\u0438\u043d\u0442\u0430\u043a\u0441\u0438\u0441:<\/p>\n

# \/usr\/lib\/inet\/in.iked -c -f \/etc\/inet\/ike\/config
\nin.iked: Configuration file \/etc\/inet\/ike\/config syntactically checks out.<\/code><\/p>\n

\u0422\u0435\u043f\u0435\u0440\u044c \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u043c \u0443 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u044e \u043a\u043b\u044e\u0447\u0435\u0432\u043e\u0439 \u0444\u0440\u0430\u0437\u044b \u2014\u00a0preshared key<\/strong>. \u041f\u0440\u0438\u0432\u043e\u0434\u0438\u043c \u0444\u0430\u0439\u043b\/etc\/inet\/security\/ike.preshared<\/strong>\u00a0\u043a \u0442\u0430\u043a\u043e\u043c\u0443 \u0432\u0438\u0434\u0443:<\/p>\n

{
\nlocalidtype IP
\nlocalid 10.5.5.219
\nremoteidtype IP
\nremoteid 10.5.5.220
\nkey \"Very-Very-Secret-Key-1234567890\"
\n}<\/code><\/p>\n

\u041a\u043b\u044e\u0447 \u0443 \u043d\u0430\u0441 \u0432 \u041d\u0415 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0432\u0438\u0434\u0435.<\/p>\n

\u0422\u0435\u043f\u0435\u0440\u044c \u043f\u0435\u0440\u0435\u0447\u0438\u0442\u044b\u0432\u0430\u0435\u043c \u043a\u043e\u043d\u0444\u0438\u0433\u00a0ike<\/strong>\u00a0\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c \u0435\u0433\u043e:<\/p>\n

# svcadm refresh svc:\/network\/ipsec\/ike:default
\n# svcadm enable svc:\/network\/ipsec\/ike:default<\/code><\/p>\n

Linux<\/span><\/strong><\/h1>\n

\u0421\u0442\u0430\u0432\u0438\u043c racoon<\/strong>:<\/p>\n

# apt-get install racoon<\/code><\/p>\n

\u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0431\u0443\u0434\u0435\u0442 \u0437\u0430\u0434\u0430\u043d \u0432\u043e\u043f\u0440\u043e\u0441 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c: direct<\/strong> \u0438\u043b\u0438 ipsec-tools<\/strong>:<\/p>\n

Configuration mode for racoon IKE daemon.<\/code><\/p>\n

\u0412\u044b\u0431\u0438\u0440\u0430\u0435\u043c direct<\/strong><\/p>\n

\u041f\u043e\u0441\u043b\u0435 \u044d\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u043f\u0435\u0440\u0435\u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0443:<\/p>\n

# dpkg-reconfigure racoon<\/code><\/p>\n

\u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u043c \u0444\u0430\u0439\u043b\u00a0\/etc\/ipsec-tools.conf<\/strong> \u043a \u0442\u0430\u043a\u043e\u043c\u0443 \u0432\u0438\u0434\u0443 (\u044d\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0441\u043a\u0440\u0438\u043f\u0442)<\/p>\n

#!\/usr\/sbin\/setkey -f
\nflush;
\nspdflush;
\nspdadd 10.5.5.78 10.5.5.219 any -P out ipsec esp\/transport\/\/require;
\nspdadd 10.5.5.219 10.5.5.78 any -P in ipsec esp\/transport\/\/require;
\n<\/code>
\n\u0412\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c \u043f\u0430\u0440\u043e\u043b\u044c\u043d\u0443\u044e \u0444\u0440\u0430\u0437\u0443 \u0432 \u0444\u0430\u0439\u043b\u00a0\/etc\/racoon\/pks.txt<\/strong>:<\/p>\n

10.5.5.219 Very-Very-Secret-Key-1234567890<\/code><\/p>\n

\u041e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0442\u0430\u0432\u0438\u043c \u043f\u0440\u0430\u0432\u0430 \u043d\u0430 \u0444\u0430\u0439\u043b psk.txt 0600 \u0438 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0430 root. \u0411\u0435\u0437 \u044d\u0442\u043e\u0433\u043e \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 \u043d\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f, \u0430 racoon \u0431\u0443\u0434\u0435\u0442 \u0440\u0443\u0433\u0430\u0442\u044c\u0441\u044f.<\/span><\/em><\/p>\n

\u041f\u0440\u0438\u0432\u043e\u0434\u0438\u043c \u0433\u043b\u0430\u0432\u043d\u044b\u0439 \u0444\u0430\u0439\u043b\u00a0\/etc\/raccon.conf<\/strong> \u043a \u0442\u0430\u043a\u043e\u043c\u0443 \u0432\u0438\u0434\u0443:<\/p>\n

path include \"\/etc\/racoon\";\r\npath pre_shared_key \"\/etc\/racoon\/psk.txt\";\r\nlog debug;\r\n\r\nremote 10.5.5.219 {\r\n        exchange_mode main;\r\n        proposal {\r\n                encryption_algorithm 3des;\r\n                hash_algorithm md5;\r\n                authentication_method pre_shared_key;\r\n                dh_group 2;\r\n                lifetime time 8 hour;\r\n        }\r\n}\r\n\r\nsainfo anonymous{\r\n        pfs_group 5;\r\n        lifetime time 8 hour;\r\n        encryption_algorithm 3des;\r\n        authentication_algorithm hmac_md5;\r\n        compression_algorithm deflate;\r\n}<\/pre>\n
\u041f\u043e\u0447\u0435\u043c\u0443-\u0442\u043e \u0443 \u043c\u0435\u043d\u044f \u043d\u0435 \u0441\u0442\u0430\u0440\u0442\u043e\u0432\u0430\u043b racoon<\/strong> \u0447\u0435\u0440\u0435\u0437 \u0441\u0442\u0430\u0440\u0442\u043e\u0432\u044b\u0435 \u0441\u043a\u0440\u0438\u043f\u0442\u044b, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043f\u0440\u0438\u0448\u043b\u043e\u0441\u044c \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0442\u044c \u0432 \/etc\/rc.local<\/strong> \u0442\u0430\u043a\u0438\u0435 \u0441\u0442\u0440\u043e\u043a\u0438.<\/p>\n
\/etc\/init.d\/setkey start
\n\/etc\/init.d\/racoon start<\/code><\/p>\n
\u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0433\u043e \u043f\u043e\u0434\u043d\u044f\u0442\u0438\u044f IPSec’a<\/strong> \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0443 \u043e\u0431\u043c\u0435\u043d\u0430:<\/p>\n
# setkey -D\r\n10.5.5.78 10.5.5.219 \r\n        esp mode=transport spi=2870989852(0xab1fd41c) reqid=0(0x00000000)\r\n        E: 3des-cbc  1d51101d 703954e3 855f6877 8bb5f44d 6d163841 fdc9c119\r\n        A: hmac-md5  dc2d1faf 4f190125 c641e65c c6a25a4c\r\n        seq=0x00000000 replay=4 flags=0x00000000 state=mature \r\n        created: Dec 16 07:05:38 2013   current: Dec 16 07:08:04 2013\r\n        diff: 146(s)    hard: 28800(s)  soft: 23040(s)\r\n        last: Dec 16 07:05:39 2013      hard: 0(s)      soft: 0(s)\r\n        current: 9280(bytes)    hard: 0(bytes)  soft: 0(bytes)\r\n        allocated: 145  hard: 0 soft: 0\r\n        sadb_seq=1 pid=2131 refcnt=0\r\n10.5.5.219 10.5.5.78 \r\n        esp mode=transport spi=21730685(0x014b957d) reqid=0(0x00000000)\r\n        E: 3des-cbc  aa59d451 4e11c9f1 e68952aa 6082fd81 ce0701ab a4b56784\r\n        A: hmac-md5  58e2404d 3fdfbda7 f87b52ae b37a48f0\r\n        seq=0x00000000 replay=4 flags=0x00000000 state=mature \r\n        created: Dec 16 07:05:38 2013   current: Dec 16 07:08:04 2013\r\n        diff: 146(s)    hard: 28800(s)  soft: 23040(s)\r\n        last: Dec 16 07:05:39 2013      hard: 0(s)      soft: 0(s)\r\n        current: 9280(bytes)    hard: 0(bytes)  soft: 0(bytes)\r\n        allocated: 145  hard: 0 soft: 0\r\n        sadb_seq=0 pid=2131 refcnt=0<\/pre>\n
\u0418 \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0447\u0435\u0440\u0435\u0437 snoop<\/strong>, \u0447\u0442\u043e \u0432\u0441\u0451 \u0448\u0438\u0444\u0440\u0443\u0435\u0442\u0441\u044f:<\/p>\n
snoop -d net0 host 10.5.5.78\r\n  10.5.5.219 -> 10.5.5.78    ESP SPI=0x14b957d Replay=157\r\n   10.5.5.78 -> 10.5.5.219   ESP SPI=0xab1fd41c Replay=156\r\n  10.5.5.219 -> 10.5.5.78    ESP SPI=0x14b957d Replay=158\r\n   10.5.5.78 -> 10.5.5.219   ESP SPI=0xab1fd41c Replay=157<\/pre>\n","protected":false},"excerpt":{"rendered":"
\u0422\u0435\u0441\u0442\u043e\u0432\u044b\u0439 \u0441\u0442\u0435\u043d\u0434:\u00a0Solaris 11.1, Debian Linux 6 (kernel 3.2), ipsec transport mode with preshared keys \u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u00a0IPSec\u00a0\u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 2-\u0445 \u0447\u0430\u0441\u0442\u0435\u0439: \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u00a0IPSec\u2019a\u00a0\u0438 \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u043e\u0431\u043c\u0435\u043d\u0430 \u043a\u043b\u044e\u0447\u0430\u043c\u0438 (ike). \u0418\u043c\u0435\u0435\u043c \u0441\u0430\u043c\u0443\u044e \u043e\u0431\u044b\u0447\u043d\u0443\u044e \u0441\u0445\u0435\u043c\u0443\u00a0Solaris (10.5.5.219) <\u2014> (10.5.5.78) Linux \u0412 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043f\u043e\u0434\u0440\u0430\u0437\u0443\u043c\u0435\u0432\u0430\u0435\u0442\u0441\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0441 \u043d\u0443\u043b\u044f.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,24],"tags":[],"class_list":["post-4008","post","type-post","status-publish","format-standard","hentry","category-linux","category-solaris"],"_links":{"self":[{"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/posts\/4008","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4008"}],"version-history":[{"count":5,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/posts\/4008\/revisions"}],"predecessor-version":[{"id":4038,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/posts\/4008\/revisions\/4038"}],"wp:attachment":[{"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4008"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4008"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4008"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}