Мне нужно использовать необработанные ключи RSA для аутентификации IKEv2 (в целях тестирования), но я не могу настроить strongSwan (5.1.2) для "доверия" им для удаленной аутентификации.
ipsec.conf:
conn %default
left=%defaultroute
leftrsasigkey=/etc/ssh/hostkey
auto=add
conn pyike
right=%any
rightrsasigkey=/media/psf/Home/p/pyike/tests/strongswan.pem
authby=rsasig
ipsec.secrets:
: RSA /media/psf/Home/p/pyike/tests/strongswan.pem
daemon.log (charondebug 4):
Apr 1 15:04:33 duke charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.1.1, Linux 3.2.0-4-amd64, x86_64)
Apr 1 15:04:33 duke charon: 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'
Apr 1 15:04:33 duke charon: 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'
Apr 1 15:04:33 duke charon: 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'
Apr 1 15:04:33 duke charon: 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'
Apr 1 15:04:33 duke charon: 00[CFG] loading crls from '/etc/ipsec.d/crls'
Apr 1 15:04:33 duke charon: 00[CFG] loading secrets from '/etc/ipsec.secrets'
Apr 1 15:04:33 duke charon: 00[CFG] expanding file expression '/var/lib/strongswan/ipsec.secrets.inc' failed
Apr 1 15:04:33 duke charon: 00[CFG] loaded IKE secret for %any
Apr 1 15:04:33 duke charon: 00[LIB] building CRED_PRIVATE_KEY - RSA failed, tried 9 builders
Apr 1 15:04:33 duke charon: 00[CFG] loading private key from '/media/psf/Home/p/pyike/tests/strongswan.pem' failed
Apr 1 15:04:33 duke charon: 00[LIB] loaded plugins: charon aes rc2 sha1 sha2 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default stroke updown
Apr 1 15:04:33 duke charon: 00[LIB] unable to load 3 plugin features (3 due to unmet dependencies)
Apr 1 15:04:33 duke charon: 00[LIB] dropped capabilities, running as uid 0, gid 0
Apr 1 15:04:33 duke charon: 00[JOB] spawning 16 worker threads
Apr 1 15:04:33 duke charon: 11[CFG] received stroke: add connection 'pyike'
Apr 1 15:04:33 duke charon: 11[CFG] left nor right host is our side, assuming left=local
Apr 1 15:04:33 duke charon: 11[LIB] file coded in unknown format, discarded
Apr 1 15:04:33 duke charon: 11[LIB] building CRED_CERTIFICATE - TRUSTED_PUBKEY failed, tried 3 builders
Apr 1 15:04:33 duke charon: 11[CFG] loading public key for "%any" from '/etc/ssh/hostkey' failed
Apr 1 15:04:33 duke charon: 11[CFG] loaded RSA public key for "%any" from '/media/psf/Home/p/pyike/tests/strongswan.pem'
Apr 1 15:04:33 duke charon: 11[CFG] added configuration 'pyike'
Apr 1 15:06:23 duke charon: 13[NET] received packet: from 10.1.48.48[51126] to 10.1.54.85[500] (424 bytes)
Apr 1 15:06:23 duke charon: 13[ENC] parsed IKE_SA_INIT request 0 [ SA KE No ]
Apr 1 15:06:23 duke charon: 13[IKE] 10.1.48.48 is initiating an IKE_SA
Apr 1 15:06:23 duke charon: 13[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(MULT_AUTH) ]
Apr 1 15:06:23 duke charon: 13[NET] sending packet: from 10.1.54.85[500] to 10.1.48.48[51126] (392 bytes)
Apr 1 15:06:23 duke charon: 14[NET] received packet: from 10.1.48.48[51126] to 10.1.54.85[500] (432 bytes)
Apr 1 15:06:23 duke charon: 14[ENC] parsed IKE_AUTH request 1 [ IDi AUTH SA TSi TSr ]
Apr 1 15:06:23 duke charon: 14[CFG] looking for peer configs matching 10.1.54.85[%any]...10.1.48.48[k@77.fi]
Apr 1 15:06:23 duke charon: 14[CFG] selected peer config 'pyike'
Apr 1 15:06:23 duke charon: 14[IKE] no trusted RSA public key found for 'test@77.fi'
Apr 1 15:06:23 duke charon: 14[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]
Apr 1 15:06:23 duke charon: 14[NET] sending packet: from 10.1.54.85[500] to 10.1.48.48[51126] (80 bytes)