NAME | SYNOPSIS | DESCRIPTION | EXAMPLES | ATTRIBUTES | SEE ALSO
/etc/inet/ike/config
The /etc/inet/ike/config file contains rules for matching inbound IKE requests. It also contains rules for preparing outbound IKE requests.
You can test the syntactic correctness of an /etc/inet/ike/config file by using the -c or -f options of in.iked(1M). You must use the -c option to test a config file. You may need to use the -f option if it is not in /etc/inet/ike/config.
On any line, an unquoted # character introduces a comment. The remainder of that line is ignored. Additionally, on any line, an unquoted // sequence introduces a comment. The remainder of that line is ignored.
There are several types of lexical tokens in the ike.config file:
A decimal, hex, or octal number representation is as in 'C'.
An IPv4 or IPv6 address with an optional /NNN suffix, (where NNN is a num) and indicates an address (CIDR) prefix (for example, 10.1.2.0/24). An optional /ADDR suffix (where ADDR is a second IP address) indicates an address / mask pair (for example, 10.1.2.0/255.255.255.0). An optional -ADDR suffix (where ADDR is a second IP address) indicates an inclusive range of addresses (for example, 10.1.2.0-10.1.2.255). The / or - can be surrounded by an arbitrary amount of white space.
in.iked(1M) does not support IPv6.
Either the words XXX, YYY, or ZZZ, for example, {yes,no}.
An IKE phase 1 identity type. IKE phase 1 identity types include:
A quoted string.
Examples include:"Label foo", or "C=US, OU=Sun Microsystems\\, Inc., N=danmcd@eng.sun.com"
A backslash (\) is an escape character. If the string needs an actual backslash, two must be specified.
A certificate selector, a string which specifies the identities of zero or more certificates. The specifiers can conform to X.509 naming conventions.
A cert-sel can also use various shortcuts to match either subject alternative names, the filename or slot of a certificate in /etc/inet/ike/publickeys, or even the ISSUER. For example:
"SLOT=0" "EMAIL=postmaster@domain.org" "webmaster@domain.org" # Some just work w/o TYPE= "IP=10.0.0.1" "10.21.11.11" # Some just work w/o TYPE= "DNS=www.domain.org" "mailhost.domain.org" # Some just work w/o TYPE= "ISSUER=C=US, O=Sun Microsystems\\, Inc., CN=Sun CA" |
Any cert-sel preceded by the character ! indicates a negative match, that is, not matching this specifier. These are the same kind of strings used in ikecert(1M).
A quoted, comma-separated list of LDAP servers and ports.
For example, "ldap1.sun.com", "ldap1.sun.com:389", "ldap1.sun.com:389,ldap2.sun.com".
The default port for LDAP is 389.
A list of parameters.
There are four main types of entries:
global parameters
IKE phase 1 transform defaults
IKE rule defaults
IKE rules
The global parameter entries are as follows:
The X.509 distinguished name of a certificate that is a trusted root CA certificate.It must be encoded in a file in the /etc/inet/ike/publickeys directory. It must have a CRL in /etc/inet/ike/crls. Multiple cert_root parameters aggregate.
Specifies an X.509 distinguished name of a certificate that is self-signed, or has otherwise been verified as trustworthy for signing IKE exchanges. It must be encoded in a file in /etc/inet/ike/publickeys. Multiple cert_trust parameters aggregate.
If this keyword is present in the file, in.iked(1M) ignores Certificate Revocation Lists (CRLs) for root CAs (as given in cert_root)
A list of LDAP servers to query for certificates. The list can be additive.
The string following this keyword must be a URL for an HTTP proxy, for example, http://proxy:8080.
The string following this keyword must be a URL for a SOCKS proxy, for example, socks://socks-proxy.
If this keyword is present in the file, in.iked(1M) uses HTTP to retrieve Certificate Revocation Lists (CRLs).
The following IKE phase 1 transform parameters can be prefigured using file-level defaults. Values specified within any given transform override these defaults.
The IKE phase 1 transform defaults are as follows:
The proposed default lifetime, in seconds, of an IKE phase 1 security association (SA).
The length in bytes of the phase 2 (quick mode) nonce data. This cannot be specified on a per-rule basis.
The following IKE rule parameters can be prefigured using file-level defaults. Values specified within any given rule override these defaults, unless a rule cannot.
The length in bytes of the phase 2 (quick mode) nonce data. This cannot be specified on a per-rule basis.
The local identity for IKE requires a type. This identity type is reflected in the IKE exchange. The type can be one of the following:
an IP address (for example, 10.1.1.2)
DNS name (for example, test.domain.com)
MBOX RFC 822 name (for example, root@domain.com)
DNX.509 distinguished name (for example, C=US, O=Sun Microsystems\, Inc., CN=Sun Test cert)
A phase 1 transform specifies a method for protecting an IKE phase 1 exchange. An initiator offers up lists of phase 1 transforms, and a receiver is expected to only accept such an entry if it matches one in a phase 1 rule. There can be several of these, and they are additive. There must be either at least one phase 1 transform in a rule or a global default phase 1 transform list. In a configuration file without a global default phase 1 transform list and a rule without a phase, transform list is an invalid file. Unless specified as optional, elements in the parameter-list must occur exactly once within a given transform's parameter-list:
The Oakley Diffie-Hellman group used for IKE SA key derivation. Acceptable values are currently 1 (768-bit), 2 (1024-bit), or 5 (1536-bit).
An encryption algorithm, as in ipsecconf(1M).
An authentication algorithm, as in ipsecconf(1M).
The authentication method used for IKE phase 1.
Optional. The lifetime for a phase 1 SA.
If configuring the kernel defaults is not sufficient for different tasks, this parameter can be used on a per-rule basis to set the IPsec SA lifetimes in seconds.
The Oakley Diffie-Hellman group used for IPsec SA key derivation. Acceptable values are 0 (do not use Perfect Forward Secrecy for IPsec SAs), 1 (768-bit), 2 (1024-bit), and 5 (1536-bit).
An IKE rule starts with a right-curly-brace ({), ends with a left-curly-brace (}), and has the following parameters in between:
Required parameter. The administrative interface to in.iked looks up phase 1 policy rules with the label as the search string. The administrative interface also converts the label into an index, suitable for an extended ACQUIRE message from PF_KEY - effectively tying IPsec policy to IKE policy in the case of a node initiating traffic. Only one label parameter is allowed per rule.
Required parameter. The local address, address prefix, or address range for this phase 1 rule. Multiple local_addr parameters accumulate within a given rule.
Required parameter. The remote address, address prefix, or address range for this phase 1 rule. Multiple remote_addr parameters accumulate within a given rule.
Which phase 1 identity type I uses. This is needed because a single certificate can contain multiple values for use in IKE phase 1. Within a given rule, all phase 1 transforms must either use preshared or non-preshared authentication (they cannot be mixed). For rules with preshared authentication, the local_id_type parameter is optional, and defaults to IP. For rules which use non-preshared authentication, the 'local_id_type' parameter is required. Multiple 'local_id_type' parameters within a rule are not allowed.
Disallowed for preshared authentication method; required parameter for non-preshared authentication method. The local identity string or certificate selector. Multiple local_id parameters accumulate within a given rule.
Disallowed for preshared authentication method; required parameter for non-preshared authentication method. Selector for which remote phase 1 identities are allowed by this rule. Multiple remote_id parameters accumulate within a given rule. If a single empty string ("") is given, then this accepts any remote ID for phase 1. It is recommended that certificate trust chains or address enforcement be configured strictly to prevent a breakdown in security if this value for remote_id is used.
If configuring the kernel defaults is not sufficient for different tasks, this parameter can be used on a per-rule basis to set the IPsec SA lifetimes in seconds.
Use perfect forward secrecy for phase 2 (quick mode). If selected, the oakley group specified is used for phase 2 PFS. Acceptable values are 0 (do not use Perfect Forward Secrecy for IPsec SAs), 1 (768-bit), 2 (1024-bit), and 5 (1536-bit).
A phase 1 transform specifies a method for protecting an IKE phase 1 exchange. An initiator offers up lists of phase 1 transforms, and a receiver is expected to only accept such an entry if it matches one in a phase 1 rule. There can be several of these, and they are additive. There must be either at least one phase 1 transform in a rule or a global default phase 1 transform list. A ike.config file without a global default phase 1transform list and a rule without a phase 1 transform list is an invalid file. Elements within the parameter-list; unless specified as optional, must occur exactly once within a given transform's parameter-list:
The Oakley Diffie-Hellman group used for IKE SA key derivation. Acceptable values are currently 1 (768-bit), 2 (1024-bit), or 5 (1536-bit).
An encryption algorithm, as in ipsecconf(1M).
An authentication algorithm, as specified in ipseckey(1M).
The authentication method used for IKE phase 1.
Optional. The lifetime for a phase 1 SA.
### BEGINNING OF FILE ### First some global parameters... ### certificate parameters... # Root certificates. I SHOULD use a full Distinguished Name. # I must have this certificate in my local filesystem, see ikecert(1m). cert_root "C=US, O=Sun Microsystems\\, Inc., CN=Sun CA" # Explicitly trusted certs that need no signatures, or perhaps self-signed # ones. Like root certificates, use full DNs for them for now. cert_trust "EMAIL=root@domain.org" # Where do I send LDAP requests? ldap_server "ldap1.domain.org,ldap2.domain.org:389" ## phase 1 transform defaults... p1_lifetime_secs 14400 p1_nonce_len 20 ## Parameters that may also show up in rules. p1_xform { auth_method preshared oakley_group 5 auth_alg sha encr_alg 3des } p2_pfs 2 ### Now some rules... { label "simple inheritor" local_id_type ip local_addr 10.1.1.1 remote_addr 10.1.1.2 } { # an index-only rule. If I'm a receiver, and all I # have are index-only rules, what do I do about inbound IKE requests? # Answer: Take them all! label "default rule" # Use whatever "host" (e.g. IP address) identity is appropriate local_id_type ipv4 local_addr 0.0.0.0/0 remote_addr 0.0.0.0/0 p2_pfs 5 # Now I'm going to have the p1_xforms p1_xform {auth_method preshared oakley_group 5 auth_alg md5 encr_alg blowfish } p1_xform {auth_method preshared oakley_group 5 auth_alg md5 encr_alg 3des } # After said list, another keyword (or a '}') will stop xform parsing. } { # Let's try something a little more conventional. label "host to .80 subnet" local_id_type ip local_id "10.1.86.51" remote_id "" # Take any, use remote_addr for access control. local_addr 10.1.86.51 remote_addr 10.1.80.0/24 p1_xform { auth_method rsa_sig oakley_group 5 auth_alg md5 encr_alg 3des } p1_xform { auth_method rsa_sig oakley_group 5 auth_alg md5 encr_alg blowfish } p1_xform { auth_method rsa_sig oakley_group 5 auth_alg sha1 encr_alg 3des } p1_xform { auth_method rsa_sig oakley_group 5 auth_alg sha1 encr_alg blowfish } } { # How 'bout something with a different cert type and name? label "punchin-point" local_id_type mbox local_id "ipsec-wizard@domain.org" remote_id "10.5.5.128" local_addr 0.0.0.0/0 remote_addr 10.5.5.128 p1_xform { auth_method rsa_sig oakley_group 5 auth_alg md5 encr_alg blowfish } } { label "receiver side" remote_id "ipsec-wizard@domain.org" local_id_type ip local_id "10.5.5.128" local_addr 10.5.5.128 remote_addr 0.0.0.0/0 p1_xform { auth_method rsa_sig oakley_group 5 auth_alg md5 encr_alg blowfish } # NOTE: Specifying preshared null-and-voids the remote_id/local_id # fields. p1_xform { auth_method preshared oakley_group 5 auth_alg md5 encr_alg blowfish} }
See attributes(5) for descriptions of the following attributes:
ATTRIBUTE TYPE | ATTRIBUTE VALUE |
---|---|
Availability |
SUNWcsr |
ikeadm(1M), in.iked(1M), ikecert(1M), ipseckey(1M), ipsecconf(1M), attributes(5), random(7D)
Harkins, Dan and Carrel, Dave, Internet Key Exchange (IKE), RFC 2409, Cisco Systems., November 1998.
Maughan, Douglas et. al, Internet Security Association and Key Management Protocol (ISAKMP), RFC 2408, National Security Agency, Ft. Meade, MD, November 1998.
Piper, Derrell, The Internet IP Security Domain of Interpretation for ISAKMP, RFC 2407, Network Alchemy, Santa Cruz, California, November 1998.
NAME | SYNOPSIS | DESCRIPTION | EXAMPLES | ATTRIBUTES | SEE ALSO