I  N  T  E  R  N  E  T
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          |                               |
          |                               |
eth1: 212.96.165.122/28        lan: 212.96.165.121/28
     +---------+                    +-----------+
     | pikachu |                    |  yoghurt  |
     +---------+                    +-----------+
eth0: 10.16.66.53/19           virt: 10.225.64.2/19
virt: 10.225.64.1/19
          |
        L A N

Připravil jsem si všechny certifikáty. Jak certifikační autoritu (ca.crt), tak pro oba stroje (pikachu a yoghurt)

$ openssl req -new nodes -newkey rsa:1024 -sha1 -keyout ca.key -out ca.req
$ openssl x509 -req -days 9999 -in ca.req -signkey ca.key -out ca.crt
$ openssl req -new -nodes -newkey rsa:1024 -sha1 -keyout pikachu.key \
          -out pikachu.req
$ openssl x509 -req -days 370 -in pikachu.req -out pikachu.crt \
          -CA ca.crt -CAkey ca.key -CAcreateserial
$ openssl req -new -nodes -newkey rsa:1024 -sha1 -keyout yoghurt.key \
          -out yoghurt.req
$ openssl x509 -req -days 370 -in yoghurt.req -out yoghurt.crt \
          -CA ca.crt -CAkey ca.key -CAcreateserial

Na straně hosta pikachu je následující konfigurace. Soubor /etc/racoon/racoon.conf:

# Konfigurace s pouzitim certifikatu

#log debug;     #notify/debug/debug2
log notify;

path certificate "/etc/racoon/certs";
path pre_shared_key "/etc/racoon/psk.txt";

listen {
        isakmp 212.96.165.122;
}

remote anonymous
{
        exchange_mode aggressive,main;
        doi ipsec_doi;
        situation identity_only;

        lifetime time 24 hour;          # min/hour
        initial_contact on;

        my_identifier asn1dn;
        peers_identifier asn1dn;
        certificate_type x509 "pikachu.crt" "pikachu.key";
        
        proposal {
                encryption_algorithm 3des;
                hash_algorithm md5;
                #authentication_method rsasig;
                authentication_method pre_shared_key;
                dh_group modp1024;
        }
}

sainfo anonymous {
        pfs_group modp1024;
        lifetime time 1 hour;           # min/hour
        encryption_algorithm 3des;
        authentication_algorithm hmac_md5;
        compression_algorithm deflate;
}

V souboru /etc/racoon/spd.conf je

#!/usr/sbin/setkey -f
# pikachu:/etc/racoon/ipsec.conf
# Spojeni s yoghurt,jirkanb,trada

### Flush all
flush;
spdflush;

### Security Policy
# TUNNEL MODE
spdadd 10.16.64.0/19 10.225.64.0/19 any -P out ipsec
        esp/tunnel/10.16.66.53-10.225.64.3/require;
spdadd 10.225.64.0/19 10.16.64.0/19 any -P in ipsec
        esp/tunnel/10.225.64.3-10.16.66.53/require;

# Radek Yoghurt
spdadd 212.96.165.122 212.96.165.121 any -P out ipsec
        esp/transport//require;
spdadd 212.96.165.121 212.96.165.122 any -P in ipsec
        esp/transport//require;


# trada.firma.cz from gprs: 160.218.179.137
spdadd 212.96.165.122 160.218.179.137 any -P out ipsec
        esp/transport//require;
spdadd 160.218.179.137 212.96.165.122 any -P in ipsec
        esp/transport//require;

# trada.firma.cz from lan: 212.96.165.120/28
spdadd 212.96.165.122 212.96.165.120 any -P out ipsec
        esp/transport//require;
spdadd 212.96.165.120 212.96.165.122 any -P in ipsec
        esp/transport//require;

A certifikáty

pikachu:/etc/racoon# ls -l /etc/racoon/certs/
total 12
lrwxr-xr-x    1 root     root            6 Jan  3 13:07 6686505c.0 -> ca.crt
-rw-r--r--    1 root     root          985 Jan  3 13:00 ca.crt
-rw-r--r--    1 root     root          973 Jan  3 13:02 pikachu.crt
-rw-r--r--    1 root     root          887 Jan  3 13:02 pikachu.key
pikachu:/etc/racoon# 

Na straně hosta yoghurt je konfigurace následující. V souboru /etc/racoon/racoon.conf je

# Konfigurace s pouzitim certifikatu

log debug2;

path  certificate "/etc/racoon/certs";
path pre_shared_key "/etc/racoon/psk.txt";

remote anonymous
{
        exchange_mode aggressive,main;
        doi ipsec_doi;
        situation identity_only;

        lifetime time 2 min;
        initial_contact on;
        proposal_check obey;

        my_identifier asn1dn;
        peers_identifier asn1dn;
        certificate_type x509 "yoghurt.crt" "yoghurt.key";

        proposal {
                encryption_algorithm 3des;
                hash_algorithm md5;
                authentication_method pre_shared_key;
                dh_group modp1024;
        }
}

sainfo anonymous
{
        pfs_group modp1024;
        lifetime time 5 min;
        encryption_algorithm 3des;
        authentication_algorithm hmac_md5;
        compression_algorithm deflate;
}

V souboru /etc/racoon/spd.conf je:

#!/usr/sbin/setkey -f

flush;
spdflush;

spdadd 212.96.165.121 212.96.165.122 any -P out ipsec
        esp/transport//require;
spdadd 212.96.165.122 212.96.165.121 any -P in ipsec
        esp/transport//require;

A certifikáty:

yoda:/volume/d1/etc/racoon# ls -l certs/
total 12
lrwxr-xr-x    1 root     root            6 Jan  3 14:09 6686505c.0 -> ca.crt
-rw-r--r--    1 root     root          985 Jan  3 13:04 ca.crt
-rw-r--r--    1 root     root          956 Jan  3 13:04 yoghurt.crt
-rw-r--r--    1 root     root          891 Jan  3 13:04 yoghurt.key
yoda:/volume/d1/etc/racoon# 

Symbolický odkaz na certifikát ca.crt vytvoříme příkazem:

# ln -s ca.crt $(openssl x509 -noout -hash -in ca.crt).0

Spojení funguje. Z jednoho stroje pingám na druhý.