标签 strongSwan 下的文章

strongswan 5.9.8-3 要求较强的加密方法 - Windows 10 - ikev2

问题：在 debian 11 里安装了 strongswan 5.9.8-3，但Windows 10无法以ikev2方式连接，提示策略错误。查看 debian 的日志，部分内容如下：

debian charon: 13[IKE] x.x.x.x is initiating an IKE_SA debian charon:
13[CFG] received proposals:
IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024,
IKE:3DES_CBC/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024,
IKE:3DES_CBC/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024,
IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024,
IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024,
IKE:AES_CBC_128/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024,
IKE:AES_CBC_192/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024,
IKE:AES_CBC_192/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024,
IKE:AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024,
IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024,
IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024,
IKE:AES_CBC_256/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024,
IKE:AES_GCM_16_128/PRF_HMAC_SHA1/MODP_1024,
IKE:AES_GCM_16_128/PRF_HMAC_SHA2_256/MODP_1024,
IKE:AES_GCM_16_128/PRF_HMAC_SHA2_384/MODP_1024,
IKE:AES_GCM_16_256/PRF_HMAC_SHA1/MODP_1024,
IKE:AES_GCM_16_256/PRF_HMAC_SHA2_256/MODP_1024,
IKE:AES_GCM_16_256/PRF_HMAC_SHA2_384/MODP_1024 debian charon: 13[CFG]
configured proposals:
IKE:AES_CBC_128/AES_CBC_192/AES_CBC_256/AES_CTR_128/AES_CTR_192/AES_CTR_256/CAMELLIA_CBC_128/CAMELLIA_CBC_192/CAMELLIA_CBC_256/CAMELLIA_CTR_128/CAMELLIA_CTR_192/CAMELLIA_CTR_256/3DES_CBC/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/AES_XCBC_96/AES_CMAC_96/HMAC_SHA1_96/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_AES128_XCBC/PRF_AES128_CMAC/PRF_HMAC_SHA1/CURVE_25519/CURVE_448/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/MODP_3072/MODP_4096/MODP_6144/MODP_8192/MODP_2048,
IKE:AES_CCM_16_128/AES_CCM_16_192/AES_CCM_16_256/AES_GCM_16_128/AES_GCM_16_192/AES_GCM_16_256/CHACHA20_POLY1305/AES_CCM_8_128/AES_CCM_8_192/AES_CCM_8_256/AES_CCM_12_128/AES_CCM_12_192/AES_CCM_12_256/AES_GCM_8_128/AES_GCM_8_192/AES_GCM_8_256/AES_GCM_12_128/AES_GCM_12_192/AES_GCM_12_256/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_AES128_XCBC/PRF_AES128_CMAC/PRF_HMAC_SHA1/CURVE_25519/CURVE_448/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/MODP_3072/MODP_4096/MODP_6144/MODP_8192/MODP_2048

尝试：在 /etc/ipsec.conf 配置文件中，用 ike = 3des-aes128-aes192-aes256-sha1-sha256-sha384-modp1024 降低加密级别。

参考：https://docs.strongswan.org/docs/5.9/interop/windowsClients.html

在Debian 9 里安装 strongSwan

strongSwan能提供方便、快捷的加密和认证，适合远程办公，信息交换等场合。

环境：Debian 9，经典网络的阿里云ECS实例。
目的：服务端使用SSL证书，客户端凭用户名和密码登录。

过程：

  1. apt-get update # 更新软件仓库
  2. apt-get install strongswan # 安装 strongswan (5.5.1-4+deb9u1)
  3. apt-get install libcharon-extra-plugins # 安装额外的 plugin，支持Windows客户端常用的MSCHAPV2加密

  4. /etc/ipsec.conf # 编辑配置文件，添加相应的连接配置内容，如下例

     config setup
    # strictcrlpolicy=yes
    uniqueids=never

 conn sample-with-ca-cert
  left=%defaultroute
  leftsubnet=0.0.0.0/0
  leftcert=1_yun.anqun.org_bundle.crt
  right=%any
  rightauth=eap-mschapv2
  rightsourceip=10.2.0.0/16
  rightsendcert=never
  eap_identity=%any
  auto=add

 conn networkmanager-strongswan
  keyexchange=ikev2
  left=%defaultroute
  leftauth=pubkey
  leftsubnet=0.0.0.0/0
  leftcert=1_yun.anqun.org_bundle.crt
  right=%any
  rightauth=pubkey
  rightsourceip=10.2.0.0/16
  rightcert=client.cert.pem
  auto=add  

 conn ios_ikev2
  keyexchange=ikev2
  rekey=no
  leftid=yun.anqun.org
  leftsendcert=always
  leftsubnet=0.0.0.0/0
  leftcert=1_yun.anqun.org_bundle.crt
  right=%any
  rightauth=eap-mschapv2
  rightsourceip=10.2.0.0/16
  rightsendcert=never
  eap_identity=%any
  dpdaction=clear
  fragmentation=yes
  auto=add

 conn windows7
  keyexchange=ikev2
  rekey=no
  left=%defaultroute
  leftauth=pubkey
  leftsubnet=0.0.0.0/0
  leftcert=1_yun.anqun.org_bundle.crt
  leftsendcert=always
  right=%any
  rightauth=eap-mschapv2
  rightsourceip=10.2.0.0/16
  rightsendcert=never
  eap_identity=%any
  auto=add
  5. 将SSL证书中的ca文件保存在 /etc/ipsec.d/cacerts 目录，SSL证书中的服务器文件保存在 /etc/ipsec.d/certs , SSL证书的私匙保存在 /etc/ipsec.d/private
  6. /etc/ipsec.secrets # 编辑内容，写明私匙文件名称及用户名和密码等
  7. /etc/sysctl.conf # 如需经服务端转发，请在该文件中添加 net.ipv4.ip_forward=1
  8. iptables -t nat -A POSTROUTING -s 10.2.0.0/16 -o eth1 -j MASQUERADE # 如需iptables筛选流量，请根据出网网卡及用户端IP段设置
  9. 在Windows 7系统及安装有strongSwan应用的安卓手机里测试，可成功连接
  10. 如苹果客户设备没有收到DNS配置信息，可以在 /etc/strongswan.d/charon.conf 里设置dns1和dns2的值

参考：