strongSwan

https://docs.strongswan.org/
Admin
strongSwan is a complete IPsec solution providing encryption and authentication for VPN connections,...
Tokens:408,684
Snippets:3,252
Trust Score:10
Update:3 days ago
Show doc for...
Tokens:
Raw
### Configuration Example

Source: https://docs.strongswan.org/docs/latest/config/strongswanConf.html

A basic example demonstrating sections, subsections, key/value pairs, and comments.

```text
a = b
section-one {
  somevalue = asdf
  subsection {
    othervalue = xxx
  }
  # yei, a comment
  yetanother = zz
}
section-two {
  x = 12
}
```

--------------------------------

### Activate Installation Scripts

Source: https://docs.strongswan.org/docs/latest/tools/cert-enroll.html

Example of creating symbolic links in the cert-install.d directory to activate specific installation scripts.

```bash
# cd /etc/cert-enroll.d
# ln -s cert-install-available/cert-install-cockpit cert-install.d
# ln -s cert-install-available/cert-install-dirsrv  cert-install.d
# ln -s cert-install-available/cert-install-sssd    cert-install.d
```

--------------------------------

### Charon Initialization Logs

Source: https://docs.strongswan.org/docs/latest/tnc/tncServer.html

Example output showing the charon daemon loading plugins and executing start scripts for credentials, connections, and pools.

```text
00[LIB] loaded plugins: charon random nonce x509 constraints pubkey pem openssl sqlite kernel-netlink resolve socket-default vici updown eap-identity eap-md5 eap-ttls eap-tnc tnc-imv tnc-tnccs tnccs-20
00[JOB] spawning 16 worker threads

00[DMN] executing start script 'creds' (swanctl --load-creds)
01[CFG] loaded certificate 'C=CH, O=Cyber, CN=server.strongswan.org'
08[CFG] loaded certificate 'C=CH, O=Cyber, CN=Cyber Root CA'
12[CFG] loaded ECDSA private key
16[CFG] loaded EAP shared key with id 'eap-jane' for: 'jane'
09[CFG] loaded EAP shared key with id 'eap-hacker' for: 'hacker'
00[DMN] creds: loaded certificate from '/etc/swanctl/x509/serverCert.pem'
00[DMN] creds: loaded certificate from '/etc/swanctl/x509ca/caCert.pem'
00[DMN] creds: loaded ECDSA key from '/etc/swanctl/ecdsa/serverKey.pem'
00[DMN] creds: loaded eap secret 'eap-jane'
00[DMN] creds: loaded eap secret 'eap-hacker'

00[DMN] executing start script 'conns' (swanctl --load-conns)
07[CFG] added vici connection: tnc
00[DMN] conns: loaded connection 'tnc'
00[DMN] conns: successfully loaded 1 connections, 0 unloaded

00[DMN] executing start script 'pools' (swanctl --load-pools)
08[CFG] added vici pool rw_pool: 10.3.0.0, 254 entries
00[DMN] pools: loaded pool 'rw_pool'
00[DMN] pools: successfully loaded 1 pools, 0 unloaded
```

--------------------------------

### swanctl --install synopsis

Source: https://docs.strongswan.org/docs/latest/swanctl/swanctlInstall.html

Basic usage syntax for the install command.

```bash
swanctl --install --child <name> [--ike <name>]

swanctl --install --help
```

--------------------------------

### Load credentials example

Source: https://docs.strongswan.org/docs/latest/swanctl/swanctlLoadCreds.html

Example of loading credentials and the resulting output showing loaded certificates and keys.

```bash
$ swanctl --load-creds

loaded certificate from '/etc/swanctl/x509/carolCert.pem'
loaded certificate from '/etc/swanctl/x509ca/strongswanCert.pem'
loaded RSA key from '/etc/swanctl/rsa/carolKey.pem'
```

--------------------------------

### List strongSwan software version

Source: https://docs.strongswan.org/docs/latest/swanctl/swanctlVersion.html

Example command to display the installed strongSwan software version.

```bash
$ swanctl --version

strongSwan swanctl 5.9.5dr2
```

--------------------------------

### Build and install strongSwan

Source: https://docs.strongswan.org/docs/latest/install/install.html

Compile the source code and install the binaries as root.

```bash
make
sudo make install
```

--------------------------------

### Example strongswan.conf configuration

Source: https://docs.strongswan.org/docs/latest/tnc/sw-collector.html

A complete example showing the sw-collector and libimcv sections configured within strongswan.conf.

```text
sw-collector {
   database = sqlite:///etc/pts/collector.db
   history = /var/log/apt/history.log
   first_file = /var/log/bootstrap.log
   first_time = 2016-04-22T20:55:14Z
   rest_api {
      uri = https://admin-user:strongSwan@tnc.example.com/api/
      timeout = 120
   }
}

libimcv {
  swid_gen {
    command = /usr/local/bin/swid_generator
    tag_creator {
      name = strongSwan Project
      regid = strongswan.org
    }
  }
}
```

--------------------------------

### Start the testing environment

Source: https://docs.strongswan.org/docs/latest/devs/testingEnvironment.html

Run this script to start the KVM instances after the build scripts have set up the environment.

```bash
testing/start-testing
```

--------------------------------

### swanctl --install options

Source: https://docs.strongswan.org/docs/latest/swanctl/swanctlInstall.html

List of available command line options for the install command.

```bash
--child    (-c)  CHILD_SA configuration to install
--ike      (-i)  name of the connection to which the child belongs

--raw      (-r)  dump raw response message
--pretty   (-P)  dump raw response message in pretty print
--debug    (-v)  set debug level, default: 1
--options  (-+)  read command line options from file
--uri      (-u)  service URI to connect to
--help     (-h)  show usage information
```

--------------------------------

### Configuration File Inclusion Example

Source: https://docs.strongswan.org/docs/latest/config/strongswanConf.html

Example showing how to split a configuration across multiple files using the include statement.

```text
a = b
section-one {
  somevalue = before include
  include include.conf
}
include other.conf
```

```text
# settings loaded from this file are added to section-one
# the following replaces the previous value
somevalue = asdf
subsection {
  othervalue = yyy
}
yetanother = zz
```

```text
# this extends section-one and subsection
section-one {
  subsection {
    # this replaces the previous value
    othervalue = xxx
  }
}
section-two {
  x = 12
}
```

--------------------------------

### Netfilter rules example

Source: https://docs.strongswan.org/docs/latest/plugins/connmark.html

Example of Netfilter rules installed by the plugin for two clients behind the same NAT router.

```text
Chain PREROUTING (policy ACCEPT 82 packets, 16106 bytes)
 pkts bytes target    prot opt in out  source       destination
   19  3920 MARK      udp  --  *  *    192.168.0.1  192.168.0.2  udp spt:1024 dpt:4500 MARK set 0x2
   16  3584 MARK      udp  --  *  *    192.168.0.1  192.168.0.2  udp spt:4500 dpt:4500 MARK set 0x1

Chain INPUT (policy ACCEPT 82 packets, 16106 bytes)
 pkts bytes target    prot opt in out  source       destination
   19  2803 CONNMARK  all  --  *  *    192.168.0.1  192.168.0.2  policy match dir in pol ipsec spi 0xb05370cd CONNMARK set 0x2
   16  2647 CONNMARK  all  --  *  *    192.168.0.1  192.168.0.2  policy match dir in pol ipsec spi 0x8ab8f2c3 CONNMARK set 0x1

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target    prot opt in out  source       destination

Chain OUTPUT (policy ACCEPT 91 packets, 17770 bytes)
 pkts bytes target    prot opt in out  source       destination
   73 14634 CONNMARK  all  --  *  *    192.168.0.2  192.168.0.1  CONNMARK restore
   75 16755 CONNMARK  all  --  *  *    192.168.0.2  192.168.0.1  CONNMARK restore
```

--------------------------------

### IMC loading and initialization logs

Source: https://docs.strongswan.org/docs/latest/tnc/attestationClient.html

Example log output showing the dynamic loading and initialization of the OS and Attestation IMCs.

```text
00[TNC] loading IMCs from '/etc/tnc_config'
00[TNC] added IETF attributes
00[TNC] added ITA-HSR attributes
00[TNC] added PWG attributes
00[TNC] added TCG attributes
00[PTS] added TCG functional component namespace
00[PTS] added ITA-HSR functional component namespace
00[PTS] added ITA-HSR functional component 'Trusted GRUB Boot Loader'
00[PTS] added ITA-HSR functional component 'Trusted Boot'
00[PTS] added ITA-HSR functional component 'Linux IMA'
00[LIB] libimcv initialized
00[IMC] IMC 1 "OS" initialized
00[IMC] processing "/etc/os-release" file
00[IMC] operating system type is 'Ubuntu'
00[IMC] operating system name is 'Ubuntu'
00[IMC] operating system version is '20.04 x86_64'
00[TNC] IMC 1 supports 1 message type: 'IETF/Operating System' 0x000000/0x00000001
00[TNC] IMC 1 "OS" loaded from '/usr/lib/ipsec/imcvs/imc-os.so'
00[IMC] IMC 2 "Attestation" initialized
00[PTS]   mandatory PTS measurement algorithm HASH_SHA1[openssl] available
00[PTS]   mandatory PTS measurement algorithm HASH_SHA2_256[openssl] available
00[PTS]   optional  PTS measurement algorithm HASH_SHA2_384[openssl] available
00[PTS]   optional  PTS measurement algorithm HASH_SHA2_512[openssl] available
00[PTS]   optional  PTS DH group MODP_2048[openssl] available
00[PTS]   optional  PTS DH group MODP_1536[openssl] available
00[PTS]   optional  PTS DH group MODP_1024[openssl] available
00[PTS]   mandatory PTS DH group ECP_256[openssl] available
00[PTS]   optional  PTS DH group ECP_384[openssl] available
00[TNC] IMC 2 supports 1 message type: 'TCG/PTS' 0x005597/0x00000001
00[TNC] IMC 2 "ATTESTATION" loaded from '/usr/lib/ipsec/imcvs/imc-attestation.so'
```

--------------------------------

### Netfilter rules for forecast

Source: https://docs.strongswan.org/docs/latest/plugins/forecast.html

Example of the Netfilter rules installed by the forecast plugin to manage packet marking for two clients.

```text
Chain PREROUTING (policy ACCEPT 55 packets, 8648 bytes)
 pkts bytes target  prot opt in out  source          destination
    1   112 MARK    all  --  *  *    0.0.0.0/0       10.1.0.130   MARK set 0x2
    3   488 MARK    esp  --  *  *    192.168.0.200   192.168.0.1  esp spi:3242273483 MARK set 0x2
    1   112 MARK    all  --  *  *    0.0.0.0/0       10.1.0.129   MARK set 0x1
    3   488 MAR     esp  --  *  *    192.168.0.100   192.168.0.1  esp spi:3416575175 MARK set 0x1

Chain INPUT (policy ACCEPT 50 packets, 8172 bytes)
 pkts bytes target  prot opt in out  source          destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target  prot opt in out  source          destination

Chain OUTPUT (policy ACCEPT 65 packets, 10840 bytes)
 pkts bytes target  prot opt in out  source          destination
    0     0 MARK    all  --  *  *    0.0.0.0/0       10.1.0.130   MARK set 0x2
    0     0 MARK    all  --  *  *    0.0.0.0/0       10.1.0.129   MARK set 0x1
```

--------------------------------

### Daemon Startup Logs

Source: https://docs.strongswan.org/docs/latest/tpm/tpm2Ike.html

Example logs showing the initialization of the charon-systemd daemon.

```text
Jan 04 15:18:38 systemd[1]: Starting strongSwan IPsec IKEv1/IKEv2 daemon using swanctl...
Jan 04 15:18:38 edu charon-systemd[648407]: loaded plugins: charon-systemd random nonce drbg x509 revocation constraints pubkey pkcs1 pkcs8 pkcs12 pem openssl curl tpm kernel-netl>
Jan 04 15:18:38 edu charon-systemd[648407]: spawning 16 worker threads
Jan 04 15:18:38 edu charon-systemd[648407]: loaded certificate 'C=CH, O=strongSec GmbH, OU=AK RSA, CN=edu.strongsec.com'
Jan 04 15:18:38 edu charon-systemd[648407]: loaded certificate 'C=CH, O=strongSec GmbH, CN=strongSec 2016 Root CA'
```

--------------------------------

### Example subjectDistinguishedName

Source: https://docs.strongswan.org/docs/latest/interop/windowsCertRequirements.html

Example of a subjectDistinguishedName containing the gateway hostname.

```text
C=CH, O=strongSwan Project, CN=vpn.strongswan.org
```

--------------------------------

### Install strongSwan via Homebrew

Source: https://docs.strongswan.org/docs/latest/os/macos.html

Installs the current strongSwan release using the Homebrew formula. Sudo is not required for installation but is needed later when running swanctl or charon-cmd.

```bash
$ brew install strongswan

```

--------------------------------

### Start the strongswan service

Source: https://docs.strongswan.org/docs/latest/daemons/charon-systemd.html

Manually start the daemon using systemctl.

```bash
sudo systemctl start strongswan
```

--------------------------------

### strongSwan Startup Log

Source: https://docs.strongswan.org/docs/latest/interop/windowsEapServerStatus.html

Example output from the system journal showing the initialization of the strongSwan daemon and its plugins.

```text
Starting strongSwan IPsec IKEv1/IKEv2 daemon using swanctl...
loaded plugins: charon-systemd nonce pem openssl curl revocation vici eap-identity eap-tls eap-mschapv2 eap-dynamic kernel-netlink socket-default
spawning 16 worker threads
loaded certificate 'C=CH, O=strongSec GmbH, CN=vpn.strongswan.org'
loaded certificate 'C=CH, O=strongSec GmbH, CN=strongSec 2016 Root CA'
loaded ECDSA private key
loaded EAP shared key with id 'eap-andi' for: 'andi'
added vici pool ipv4: 10.10.1.64, 62 entries
added vici pool ipv6: 2a02:168:4407:1::, 62 entries
added vici connection: win
added vici connection: eap
Started strongSwan IPsec IKEv1/IKEv2 daemon using swanctl.
```

--------------------------------

### Check installed packages with sw-collector --unregistered --installed

Source: https://docs.strongswan.org/docs/latest/tnc/swimaClient.html

Use this command to identify installed software packages whose SWID tags are not yet registered in the strongTNC database.

```bash
# sw-collector --unregistered --installed
  sending request to 'http://xxxx@tnc/api/sessions/0/swid-measurement/'...
strongswan.org__Ubuntu_20.04-x86_64-adduser-3.118ubuntu2,1
strongswan.org__Ubuntu_20.04-x86_64-apt-2.0.4,1
strongswan.org__Ubuntu_20.04-x86_64-base-files-11ubuntu5.3,1
strongswan.org__Ubuntu_20.04-x86_64-base-passwd-3.5.47,1
strongswan.org__Ubuntu_20.04-x86_64-bash-5.0-6ubuntu1.1,1
...
strongswan.org__Ubuntu_20.04-x86_64-zlib1g-1~1.2.11.dfsg-2ubuntu1.3,1
strongswan.org__Ubuntu_20.04-x86_64-zlib1g-dev-1~1.2.11.dfsg-2ubuntu1.3,1
173 installed software identifiers not registered
```

--------------------------------

### Charon daemon startup log output

Source: https://docs.strongswan.org/docs/latest/tnc/tncServer.html

Example log output showing the successful loading and initialization of the OS and Scanner IMVs.

```text
00[DMN] Starting IKE charon daemon (strongSwan 5.9.7, Linux 5.13.0-35-generic, x86_64)
00[TNC] TNC recommendation policy is 'default'
00[TNC] loading IMVs from '/etc/tnc_config'
00[TNC] added IETF attributes
00[TNC] added ITA-HSR attributes
00[TNC] added PWG attributes
00[TNC] added TCG attributes
00[LIB] libimcv initialized
00[IMV] IMV 1 "OS" initialized
00[TNC] IMV 1 supports 1 message type: 'IETF/Operating System' 0x000000/0x00000001
00[TNC] IMV 1 "OS" loaded from '/usr/lib/ipsec/imcvs/imv-os.so'
00[IMV] IMV 2 "Scanner" initialized
00[TNC] IMV 2 supports 1 message type: 'IETF/Firewall' 0x000000/0x00000005
00[TNC] IMV 2 "Scanner" loaded from '/usr/lib/ipsec/imcvs/imv-scanner.so'
```

--------------------------------

### Charon daemon initialization logs

Source: https://docs.strongswan.org/docs/latest/tnc/attestationServer.html

Example output showing the charon daemon loading IMVs and initializing the Attestation IMV during startup.

```text
00[DMN] Starting IKE charon daemon (strongSwan 5.9.7, Linux 5.13.0-44-generic, x86_64)
00[TNC] TNC recommendation policy is 'default'
00[TNC] loading IMVs from '/etc/tnc_config'
00[TNC] added IETF attributes
00[TNC] added ITA-HSR attributes
00[TNC] added PWG attributes
00[TNC] added TCG attributes
00[PTS] added TCG functional component namespace
00[PTS] added ITA-HSR functional component namespace
00[PTS] added ITA-HSR functional component 'Trusted GRUB Boot Loader'
00[PTS] added ITA-HSR functional component 'Trusted Boot'
00[PTS] added ITA-HSR functional component 'Linux IMA'
00[LIB] libimcv initialized
00[IMV] IMV 1 "OS" initialized
00[TNC] IMV 1 supports 1 message type: 'IETF/Operating System' 0x000000/0x00000001
00[TNC] IMV 1 "OS" loaded from '/usr/lib/ipsec/imcvs/imv-os.so'
00[IMV] IMV 2 "Attestation" initialized
00[PTS] loading PTS ca certificates from '/etc/pts/cacerts'
00[PTS]   mandatory PTS measurement algorithm HASH_SHA1[openssl] available
00[PTS]   mandatory PTS measurement algorithm HASH_SHA2_256[openssl] available
00[PTS]   optional  PTS measurement algorithm HASH_SHA2_384[openssl] available
00[PTS]   optional  PTS measurement algorithm HASH_SHA2_512[openssl] available
00[PTS]   optional  PTS DH group MODP_2048[openssl] available
00[PTS]   optional  PTS DH group MODP_1536[openssl] available
00[PTS]   optional  PTS DH group MODP_1024[openssl] available
00[PTS]   mandatory PTS DH group ECP_256[openssl] available
00[PTS]   optional  PTS DH group ECP_384[openssl] available
00[TNC] IMV 2 supports 2 message types: 'TCG/PTS' 0x005597/0x00000001 'IETF/Operating System' 0x000000/0x00000001
00[TNC] IMV 2 "ATTESTATION" loaded from '/usr/lib/ipsec/imcvs/imv-attestation.so'
```

--------------------------------

### Systemd Service Started Log

Source: https://docs.strongswan.org/docs/latest/tpm/tpm2Ike.html

Log entry confirming the strongSwan service has started.

```text
Jan 04 15:18:38 edu systemd[1]: Started strongSwan IPsec IKEv1/IKEv2 daemon using swanctl.
```

--------------------------------

### Charon daemon startup logs

Source: https://docs.strongswan.org/docs/latest/tnc/swimaClient.html

Example log output showing the initialization and loading of IMCs during charon daemon startup.

```text
00[DMN] Starting IKE charon daemon (strongSwan 5.9.7, Linux 5.13.0-40-generic, x86_64)
00[TNC] loading IMCs from '/etc/tnc_config'
00[TNC] added IETF attributes
00[TNC] added ITA-HSR attributes
00[TNC] added PWG attributes
00[TNC] added TCG attributes
00[LIB] libimcv initialized
00[IMC] IMC 1 "OS" initialized
00[IMC] processing "/etc/os-release" file
00[IMC] operating system type is 'Ubuntu'
00[IMC] operating system name is 'Ubuntu'
00[IMC] operating system version is '20.04 x86_64'
00[TNC] IMC 1 supports 1 message type: 'IETF/Operating System' 0x000000/0x00000001
00[TNC] IMC 1 "OS" loaded from '/usr/lib/ipsec/imcvs/imc-os.so'
00[IMC] IMC 2 "SWIMA" initialized
00[TNC] IMC 2 supports 1 message type: 'IETF/SWIMA' 0x000000/0x00000009
00[TNC] IMC 2 "SWIMA" loaded from '/usr/lib/ipsec/imcvs/imc-swima.so'
```

--------------------------------

### Warning log when starting charon-systemd with systemctl start strongswan

Source: https://docs.strongswan.org/docs/latest/plugins/save-keys.html

Shows the warning logged when the charon-systemd daemon starts with the save-keys plugin active, indicating that secret IKE and ESP keys are being permanently stored in /root/.config/wireshark.

```text
moon charon-systemd: 00[DMN] !!
moon charon-systemd: 00[DMN] !! WARNING: SAVING IKE AND ESP KEYS TO '/root/.config/wireshark'
moon charon-systemd: 00[DMN] !!
moon charon-systemd: 00[LIB] loaded plugins: charon-systemd random nonce openssl pem pkcs1 revocation curl kernel-netlink socket-default updown vici save-keys
```

--------------------------------

### IMC Configuration file example

Source: https://docs.strongswan.org/docs/latest/tnc/pt-tls-client.html

Example configuration for /etc/tnc_config defining the IMCs to be loaded by the pt-tls-client.

```text
#IMC-Configuration

IMC "OS"          /usr/lib/ipsec/imcvs/imc-os.so
IMC "SWIMA"       /usr/lib/ipsec/imcvs/imc-swima.so
IMC "ATTESTATION" /usr/lib/ipsec/imcvs/imc-attestation.so
```

--------------------------------

### secrets.private configuration example

Source: https://docs.strongswan.org/docs/latest/swanctl/swanctlConf.html

Example configuration for a private key decryption passphrase in the private folder.

```text
secrets {
    # only necessary if the key is encrypted and the passphrase is not passed interactively
    private-carol {
        file = carolKey.pem
        secret = "nH5ZQEWtku0RJEZ6"
    }
}
```

--------------------------------

### Install Python Requirements

Source: https://docs.strongswan.org/docs/latest/tnc/strongTnc.html

Install the required Python modules for strongTNC within the /var/www/tnc directory.

```bash
sudo pip3 install -r requirements.txt
```

--------------------------------

### pki --keyid Usage Example

Source: https://docs.strongswan.org/docs/latest/pki/pkiKeyid.html

Demonstrates how to compute key identifiers for a private key file named myKey.der.

```bash
pki --keyid --type priv --in myKey.der
subjkey (SHA-1 of subjectPublicKey):
             5f:36:bd:33:57:51:f4:1d:8e:66:be:b4:04:92:e1:60:93:4a:32:f1
keyid (SHA-1 of subjectPublicKeyInfo):
             4a:ea:13:89:12:dc:96:b4:35:79:14:00:ee:d6:59:4d:f3:6b:63:bd
```

--------------------------------

### Install Python and Django Dependencies

Source: https://docs.strongswan.org/docs/latest/tnc/strongTnc.html

Install the required Python 3 packages and development libraries.

```bash
sudo apt install python3 python3-pip python3-dev libxml2-dev libxslt1-dev
```

--------------------------------

### List all configured pools

Source: https://docs.strongswan.org/docs/latest/swanctl/swanctlListPools.html

Example output when listing all configured address pools.

```bash
$ swanctl --list-pools

pool_v4              10.3.0.0                             1 / 0 / 14
pool_v6              fec3::                              1 / 0 / 254
```

--------------------------------

### Install strongTNC from GitHub

Source: https://docs.strongswan.org/docs/latest/tnc/strongTnc.html

Download, extract, and set up the strongTNC directory permissions.

```bash
wget https://github.com/strongswan/strongTNC/archive/master.zip
unzip master.zip
sudo mv strongTNC-master /var/www/tnc
sudo chgrp -R www-data /var/www/tnc
sudo chmod g+sw /var/www/tnc
```
Tokens:
Raw