Configuring IKE With Preshared Keys

Preshared keys is the simplest authentication method for IKE. If you are configuring two systems to use IKE, and you are the administrator for both of the systems, using preshared keys is a good choice. However, unlike public key certificates, preshared keys are tied to particular IP addresses. You can associate preshared keys with subnets or ranges of IP addresses. Preshared keys cannot be used with mobile systems or systems that might be renumbered, unless the renumbering is within the previously determined range of IP addresses. Also, when you use preshared keys, you cannot offload IKE computations to attached hardware.

How to Configure IKE With Preshared Keys

The IKE implementation offers algorithms whose keys vary in length. The key length that you choose is determined by site security. In general, longer keys provide more security than shorter keys.

In this procedure, you generate keys in hexadecimal format. You can translate a hexadecimal key into ASCII format to interoperate with other vendors, as shown in Example 22-1. Alternatively, you can use an ASCII passphrase, as shown in Example 22-2. Also, you can use one key with a range of systems by using an IP prefix in the IKE rule. For an example, see Example 22-3.

These procedures use the system names enigma and partym. Substitute the names of your systems for the names enigma and partym.

Note - To use IPsec with labels on a Trusted Extensions system, see the extension of this procedure in How to Apply IPsec Protections in a Multilevel Trusted Extensions Network in Oracle Solaris Trusted Extensions Configuration and Administration.

Become an administrator.
For more information, see How to Obtain Administrative Rights in System Administration Guide: Security Services.

Note - Logging in remotely exposes security-critical traffic to eavesdropping. Even if you somehow protect the remote login, the security of the system is reduced to the security of the remote login session. Use the ssh command for a secure remote login. For an example, see Example 19-1.
On each system, copy the file /etc/inet/ike/config.sample to the file /etc/inet/ike/config.

Enter rules and global parameters in the ike/config file on each system.

The rules and global parameters in this file should permit the IPsec policy in the system's ipsecinit.conf file to succeed. The following ike/config examples work with the ipsecinit.conf examples in How to Secure Traffic Between Two Systems With IPsec.

For example, modify the /etc/inet/ike/config file on the enigma system:

### ike/config file on enigma, 192.168.116.16

## Global parameters
#
## Phase 1 transform defaults
p1_lifetime_secs 14400
p1_nonce_len 40
#
## Defaults that individual rules can override.
p1_xform
  { auth_method preshared oakley_group 5 auth_alg sha encr_alg des }
p2_pfs 2
#
## The rule to communicate with partym # Label must be unique { label "enigma-partym" local_addr 192.168.116.16 remote_addr 192.168.13.213 p1_xform { auth_method preshared oakley_group 5 auth_alg sha1 encr_alg aes } p2_pfs 5 }

Note - All arguments to the auth_method parameter must be on the same line.

Modify the /etc/inet/ike/config file on the partym system:

### ike/config file on partym, 192.168.13.213
## Global Parameters
#
p1_lifetime_secs 14400
p1_nonce_len 40
#
p1_xform
  { auth_method preshared oakley_group 5 auth_alg sha encr_alg des }
p2_pfs 2

## The rule to communicate with enigma # Label must be unique { label "partym-enigma" local_addr 192.168.13.213 remote_addr 192.168.116.16 p1_xform { auth_method preshared oakley_group 5 auth_alg sha1 encr_alg aes } p2_pfs 5 }

On each system, verify the syntax of the file.

# /usr/lib/inet/in.iked -c -f /etc/inet/ike/config

Generate random numbers for use as keying material.
If your site has a random number generator, use that generator. On a Solaris system, you can use the od command. For example, the following command prints two lines of hexadecimal numbers:
```
% od -X -A n /dev/random | head -2
         f47cb0f4 32e14480 951095f8 2b735ba8
         0a9467d0 8f92c880 68b6a40e 0efe067d
```
For an explanation of the od command, see How to Generate Random Numbers on a Solaris System and the od(1) man page.

Note - Other operating systems can require ASCII keying material. To generate the identical key in hexadecimal and ASCII formats, see Example 22-1.
From the output of Step 5, construct one key.
```
f47cb0f432e14480951095f82b735ba80a9467d08f92c88068b6a40e
```
The authentication algorithm in this procedure is SHA–1, as shown in Step 3. The size of the hash, that is, the size of the authentication algorithm's output, determines the minimum recommended size of a preshared key. The output of the SHA–1 algorithm is 160 bits, or 40 characters. The example key is 56 characters long, which provides additional keying material for IKE to use.

Create the file /etc/inet/secret/ike.preshared on each system.

Put the preshared key in each file.

For example, on the enigma system, the ike.preshared file would appear similar to the following:

# ike.preshared on enigma, 192.168.116.16
#…
{ localidtype IP
    localid 192.168.116.16
    remoteidtype IP
    remoteid 192.168.13.213
    # enigma and partym's shared key in hex (192 bits)
    key f47cb0f432e14480951095f82b735ba80a9467d08f92c88068b6a40e
    }

On the partym system, the ike.preshared file would appear similar to the following:

# ike.preshared on partym, 192.168.13.213
#…
{ localidtype IP
    localid 192.168.13.213
    remoteidtype IP
    remoteid 192.168.116.16
    # partym and enigma's shared key in hex (192 bits)
    key f47cb0f432e14480951095f82b735ba80a9467d08f92c88068b6a40e
    }

Note - The preshared keys on each system must be identical.

Example 22-1 Generating Identical Keying Material for Two Systems With Different Operating Systems

Solaris IPsec interoperates with other operating systems. If your system is communicating with a system that requires ASCII preshared keys, you need to generate one key in two formats, hexadecimal and ASCII.

In this example, the Solaris system administrator wants 56 characters of keying material. The administrator uses the following command to generate a hexadecimal key from an ASCII passphrase. The option -tx1 prints the bytes one at a time on all Solaris systems.

# /bin/echo "papiermache with cashews and\c" | od -tx1 | cut -c 8-55 | \
tr -d '\n' | tr -d ' ' | awk '{print}'
7061706965726d616368652077697468206361736865777320616e64

By removing the offsets and concatenating the hexadecimal output, the hexadecimal key for the Solaris system is 7061706965726d616368652077697468206361736865777320616e64. The administrator places this value in the ike.preshared file on the Solaris system.

# Shared key in hex (192 bits)
key 7061706965726d616368652077697468206361736865777320616e64

On the system that requires ASCII preshared keys, the passphrase is the preshared key. The Solaris system administrator telephones the other administrator with the passphrase, papiermache with cashews and.

Example 22-2 Using ASCII Keying Material for IKE Preshared Keys

In this example, the Solaris system administrator wants to use a passphrase to create the keying material for the IKE preshared key. The administrator uses special characters to complicate the passphrase. The string is typed on one line. The backslash escapes the double quotation mark that is part of the passphrase.

First, the administrator places the passphrase in the preshared rule on the enigma system.

#…
{ localidtype IP
    localid 192.168.116.16
    remoteidtype IP
    remoteid 192.168.13.213
    # enigma and partym's shared passphrase for keying material 
key "LOooong key Th@t m^st Be Ch*angEd \"reguLarLy."
    }

Then, the administrator places the passphrase in the preshared rule on the partym system.

#…
{ localidtype IP
    localid 192.168.13.213
    remoteidtype IP
    remoteid 192.168.116.16
    # partym and enigma's shared passphrase for keying material 
key "LOooong key Th@t m^st Be Ch*angEd \"reguLarLy."
    }

Example 22-3 Using an IKE Preshared Key to Protect a Range of Systems

In this example, the Solaris system administrator wants to use one IKE preshared key to protect a range of hosts. The administrator uses a passphrase to generate the keying material as well as subnet addresses to specify the range of hosts that use the IKE preshared key.

First, the administrator places the following IKE rule on every host in the 192.168.116.0/24 subnet.

#…
{ localidtype IP
    localid 192.168.116.0/24
    remoteidtype IP
    remoteid 192.168.13.0/24
    # enigma and partym's shared passphrase for keying material 
key "LOooong key Th@t m^st Be Ch*angEd \"reguLarLy."
    }

The administrator places the following IKE rule on every host in the 192.168.13.0/24 subnet.

#…
{ localidtype IP
    localid 192.168.116.0/24
    remoteidtype IP
    remoteid 192.168.13.0/24
    # partym and enigma's shared passphrase for keying material 
key "LOooong key Th@t m^st Be Ch*angEd \"reguLarLy."
    }

How to Refresh IKE Preshared Keys

This procedure assumes that you want to replace an existing preshared key at regular intervals.

Become an administrator.
For more information, see How to Obtain Administrative Rights in System Administration Guide: Security Services.

Note - Logging in remotely exposes security-critical traffic to eavesdropping. Even if you somehow protect the remote login, the security of the system is reduced to the security of the remote login session. Use the ssh command for a secure remote login. For an example, see Example 19-1.
Generate random numbers and construct a key of the appropriate length.
For details, see How to Generate Random Numbers on a Solaris System. If you are generating a preshared key for a Solaris system that is communicating with an operating system that requires ASCII, see Example 22-1.

Note - You can instead use an ASCII key for the preshared key, as in Example 22-2.
Replace the current key with a new key.
For example, on the hosts enigma and partym, you would replace the value of key in the /etc/inet/secret/ike.preshared file with a new number of the same length.
Refresh the IKE keys.
```
# svcadm refresh ike
```

How to View IKE Preshared Keys

By default, the ikeadm command prevents you from viewing the actual keys in a dump of a Phase 1 SA. Viewing the keys is useful during debugging.

To view the actual keys, you must increase the privilege level of the daemon. For a description of the privilege levels, see IKE Administration Command.

Before You Begin

IKE is configured and the ike service is running.

View the IKE preshared keys.
```
# ikeadm
ikeadm> dump preshared
```
If you get an error, increase the privilege level of the in.iked daemon.
1. Increase the privilege level of the in.iked daemon in the SMF repository.
```
# svcprop -p config/admin_privilege ike
base
# svccfg -s ike setprop config/admin_privilege=keymat
```
2. Increase the privilege level of the running in.iked daemon.
```
# svcadm refresh ike ; svcadm restart ike
```
3. (Optional) Confirm that the privilege level is keymat.
```
# svcprop -p config/admin_privilege ike
keymat
```
4. View the keys by running Step 1 again.
Return the IKE daemon to the base privilege level.
1. After you view the keys, return the privilege level to the default.
```
# svccfg -s ike setprop config/admin_privilege=base
```
2. Refresh and then restart IKE.
```
# svcadm refresh ike ; svcadm restart ike
```

How to Add an IKE Preshared Key for a New Policy Entry in `ipsecinit.conf`

If you add IPsec policy entries while IPsec and IKE are running, you restart the policy service and refresh the ike service after you add the new keys.

Before You Begin

This procedure assumes the following:

The enigma system is set up as described in How to Configure IKE With Preshared Keys.
The enigma system is going to protect its traffic with a new system, ada.
The in.iked daemon is running on both systems.
The systems' interfaces are included as entries in the /etc/hosts file on both systems. The following entry is an example.
```
192.168.15.7 ada
192.168.116.16 enigma
```
This procedure also works with an IPv6 address. IPv6 addresses are placed in the /etc/hosts file.

You have added a new policy entry to the /etc/inet/ipsecinit.conf file on both systems. The entries appear similar to the following:

# ipsecinit.conf file for enigma
{laddr enigma raddr ada} ipsec {auth_algs any encr_algs any sa shared}

# ipsecinit.conf file for ada
{laddr ada raddr enigma} ipsec {auth_algs any encr_algs any sa shared}

You have verified the syntax of the /etc/inet/ipsecinit.conf file on both systems by using the following:
```
# ipsecconf -c -f /etc/inet/ipsecinit.conf
```

Become an administrator.
For more information, see How to Obtain Administrative Rights in System Administration Guide: Security Services.

Note - Logging in remotely exposes security-critical traffic to eavesdropping. Even if you somehow protect the remote login, the security of the system is reduced to the security of the remote login session. Use the ssh command for a secure remote login. For an example, see Example 19-1.
On this system, generate random numbers and construct a key of 64 to 448 bits.
For details, see How to Generate Random Numbers on a Solaris System. If you are generating a preshared key for a Solaris system that is communicating with an operating system that requires ASCII, see Example 22-1.

Note - You can also instead an ASCII key for the preshared key, as in Example 22-2.
By some means, send the key to the administrator of the remote system.
You both need to add the same preshared key at the same time. Your key is only as safe as the safety of your transmission mechanism. An out-of-band mechanism, such as registered mail or a protected fax machine, is best. You can also use an ssh session to administer both systems.

Create a rule for IKE to manage the keys for enigma and ada.

On the enigma system, add the following rule to the /etc/inet/ike/config file:

### ike/config file on enigma, 192.168.116.16
 
## The rule to communicate with ada

{label "enigma-to-ada"
 local_addr 192.168.116.16
 remote_addr 192.168.15.7
 p1_xform
 {auth_method preshared oakley_group 5 auth_alg sha1 encr_alg blowfish}
 p2_pfs 5
    }

On the ada system, add the following rule:

### ike/config file on ada, 192.168.15.7
 
## The rule to communicate with enigma

{label "ada-to-enigma"
 local_addr 192.168.15.7
 remote_addr 192.168.116.16
 p1_xform
 {auth_method preshared oakley_group 5 auth_alg sha1 encr_alg blowfish}
 p2_pfs 5
}

Ensure that IKE preshared keys are available at reboot.

On the enigma system, add the following information to the /etc/inet/secret/ike.preshared file:

Note - If you created an ASCII key, place it in quotation marks as the argument to the key parameter.

# ike.preshared on enigma for the ada interface
# 
{ localidtype IP
  localid 192.168.116.16
  remoteidtype IP
  remoteid 192.168.15.7
  # enigma and ada's shared key in hex (32 - 448 bits required)
  key 8d1fb4ee500e2bea071deb2e781cb48374411af5a9671714672bb1749ad9364d
}

On the ada system, add the following information to the ike.preshared file:

# ike.preshared on ada for the enigma interface
# 
{ localidtype IP
  localid 192.168.15.7
  remoteidtype IP
  remoteid 192.168.116.16
  # ada and enigma's shared key in hex (32 - 448 bits required)
  key 8d1fb4ee500e2bea071deb2e781cb48374411af5a9671714672bb1749ad9364d
}

On each system, restart the IPsec policy service to secure the added interface.
```
# svcadm restart policy
```
On each system, refresh the ike service.
```
# svcadm refresh ike
```
Verify that the systems can communicate.
See How to Verify That IKE Preshared Keys Are Identical.

Example 22-4 Adding an IKE Preshared Key for a New IPsec Policy Entry

In the following example, the administrator is adding preshared key to a Solaris system that is not running the current Solaris release. The administrator follows the preceding procedure to modify the ike/config and ike.preshared files, and to generate keys and contact the remote system. The administrator uses different commands to read the new IPsec policy and IKE rules into the kernel.

Before generating the new key, the administrator sets the privilege level of the in.iked daemon to 2.
```
# pkill in.iked
# /usr/lib/inet/in.iked -p 2
Setting privilege level to 2
```
After sending the key to the other system and adding the new key to the system, the administrator lowers the privilege level.
```
# ikeadm set priv base
```
Then, the administrator reads the new IPsec policy into the kernel.
```
# ipsecconf -a /etc/inet/ipsecinit.conf
```
Finally, the administrator reads the new IKE rules into the kernel.
```
# ikeadm read rules
```

How to Verify That IKE Preshared Keys Are Identical

If the preshared keys on the communicating systems are not identical, the systems cannot authenticate.

Before You Begin

IPsec has been configured and is enabled between the two systems that you are testing.

On each system, check the privilege level of the in.iked daemon.
```
# svcprop -p config/admin_privilege ike
base
```
- If the privilege level is keymat, continue with Step 2.
- If the privilege level is base or modkeys, increase the privilege level.
  Then, refresh and restart the ike service.
```
# svccfg -s ike setprop config/admin_privilege=keymat
# svcadm refresh ike ; svcadm restart ike
# svcprop -p config/admin_privilege ike
keymat
```

On each system, view the preshared key information.

# ikeadm dump preshared
PSKEY: Preshared key (24 bytes): f47cb…/192
LOCIP: AF_INET: port 0, 192.168.116.16 (enigma).
REMIP: AF_INET: port 0, 192.168.13.213 (partym).

Compare the two dumps.
If the preshared keys are not identical, replace one key with the other key in the /etc/inet/secret/ike.preshared file.
When the verification is complete, return the privilege level to the default on each system.
```
# svccfg -s ike setprop config/admin_privilege=base
# svcadm restart ike
```

Skip Navigation Links
Exit Print View
	System Administration Guide: IP Services Oracle Solaris 11 Express 11/10

Configuring IKE With Preshared Keys

How to Configure IKE With Preshared Keys

How to Refresh IKE Preshared Keys

How to View IKE Preshared Keys

Before You Begin

How to Add an IKE Preshared Key for a New Policy Entry in ipsecinit.conf

Before You Begin

How to Verify That IKE Preshared Keys Are Identical

Before You Begin

How to Add an IKE Preshared Key for a New Policy Entry in `ipsecinit.conf`