☰

在 Ubuntu 上安装并配置 StrongSwan 客户端

tag-icon • tag-icon networking vpn client ipsec
在 Ubuntu 上安装并配置 StrongSwan 客户端

我在尝试在 Ubuntu 上设置 StrongSwan 客户端时遇到了麻烦。

以下是我遵循的步骤：

导出用户证书：

openssl pkcs12 -in [email protected] -out username-cert.pem -clcerts -nokeys

导出用户私钥：

openssl pkcs12 -in [email protected] -out username-key.pem -nocerts -nodes

重命名CA证书：

mv cert_export_CA.crt cacert.pem

将证书和密钥文件复制到适当的目录：

cp username-cert.pem /etc/ipsec.d/certs
cp username-key.pem /etc/ipsec.d/private
cp cacert.pem /etc/ipsec.d/cacerts

编辑 /etc/ipsec.conf 文件：

conn %default
    ikelifetime=60m
    keylife=20m
    rekeymargin=3m
    keyingtries=1
    keyexchange=ikev2
conn "DOMAIN"
    leftsourceip=%config
    leftcert=username-cert.pem
    [email protected]
    leftfirewall=yes
    right=vpn.domain.com
    rightid=cvpn.domain.com
    rightsubnet=0.0.0.0/0
    auto=start

编辑/etc/ipsec.secrets：

: RSA username-key.pem "passphrase"

重新启动 ipsec 守护进程：

sudo ipsec restart

检查连接是否建立：

sudo ipsec status

返回：安全关联（0 个启动，0 个连接）：无

ip a

返回：

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000   
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00    
    inet 127.0.0.1/8 scope host lo   
       valid_lft forever preferred_lft forever    
    inet6 ::1/128 scope host     
       valid_lft forever preferred_lft forever    
2: enp2s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000    
    link/ether 8c:8c:aa:49:56:b0 brd ff:ff:ff:ff:ff:ff    
3: wlp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000   
    link/ether b0:a4:60:d9:2c:a4 brd ff:ff:ff:ff:ff:ff  
    inet <ip>/24 brd <ip> scope global dynamic noprefixroute wlp3s0 
       valid_lft 168sec preferred_lft 168sec    
    inet6 <ip>/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever

这意味着我无法连接。

当我运行 ipsec up DOMAIN 时我得到以下输出：

initiating IKE_SA DOMAIN[2] to xxx.xxx.xxx.xxx
generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
sending packet: from xxx.xxx.xxx.xxx[500] to xxx.xxx.xxx.xxx[500] (936 bytes)
received packet: from xxx.xxx.xxx.xxx[500] to xxx.xxx.xxx.xxx[500] (38 bytes)
parsed IKE_SA_INIT response 0 [ N(INVAL_KE) ]
peer didn't accept DH group ECP_256, it requested MODP_2048
initiating IKE_SA DOMAIN[2] to xxx.xxx.xxx.xxx
generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
sending packet: from xxx.xxx.xxx.xxx[500] to xxx.xxx.xxx.xxx[500] (1128 bytes)
received packet: from 1xxx.xxx.xxx.xxx[500] to xxx.xxx.xxx.xxx[500] (437 bytes)
parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) CERTREQ ]
selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
sending cert request for "O=domain.com, CN=vpn.domain.com"
authentication of '[email protected]' (myself) with RSA signature successful
sending end entity cert "O=domain.com, CN=Template-User"
establishing CHILD_SA DOMAIN{2}
generating IKE_AUTH request 1 [ IDi CERT N(INIT_CONTACT) CERTREQ IDr AUTH CPRQ(ADDR DNS) SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
splitting IKE message (1536 bytes) into 2 fragments
generating IKE_AUTH request 1 [ EF(1/2) ]
generating IKE_AUTH request 1 [ EF(2/2) ]
sending packet: from xxx.xxx.xxx.xxx[4500] to xxx.xxx.xxx.xxx[4500] (1236 bytes)
sending packet: from xxx.xxx.xxx.xxx[4500] to xxx.xxx.xxx.xxx[4500] (372 bytes)
received packet: from xxx.xxx.xxx.xxx[4500] to xxx.xxx.xxx.xxx[4500] (1204 bytes)
parsed IKE_AUTH response 1 [ EF(1/2) ]
received fragment #1 of 2, waiting for complete IKE message
received packet: from xxx.xxx.xxx.xxx[4500] to xxx.xxx.xxx.xxx[4500] (564 bytes)
parsed IKE_AUTH response 1 [ EF(2/2) ]
received fragment #2 of 2, reassembled fragmented IKE message (1408 bytes)
parsed IKE_AUTH response 1 [ CERT IDr AUTH CPRP(ADDR MASK SUBNET) TSi TSr SA ]
received end entity cert "O=domain.com, CN=vpn.domain.com"
  using trusted certificate "O=domain.com, CN=vpn.domain.com"
signature validation failed, looking for another key
  using certificate "O=domain.com, CN=vpn.domain.com"
  using trusted ca certificate "O=domain.com, CN=vpn.domain.com"
checking certificate status of "O=domain.com, CN=vpn.domain.com"
certificate status is not available
  reached self-signed root ca with a path length of 0
authentication of 'vpn.domain.com' with RSA signature successful
constraint check failed: identity 'cvpn.domain.com' required 
selected peer config 'DOMAIN' unacceptable: constraint checking failed
no alternative config found
generating INFORMATIONAL request 2 [ N(AUTH_FAILED) ]
sending packet: from xxx.xxx.xxx.xxx[4500] to xxx.xxx.xxx.xxx[4500] (80 bytes)
establishing connection 'DOMAIN' failed

答案1

rightid=cvpn.domain.com

应该可能是

rightid=vpn.domain.com

相关内容