我需要使用原始 RSA 密钥进行 IKEv2 身份验证（出于测试目的），但无法配置 strongSwan（5.1.2）以“信任”它们进行远程身份验证。
ipsec.conf：
conn %default
left=%defaultroute
leftrsasigkey=/etc/ssh/hostkey
auto=add
conn pyike
right=%any
rightrsasigkey=/media/psf/Home/p/pyike/tests/strongswan.pem
authby=rsasig
ipsec.秘密：
: RSA /media/psf/Home/p/pyike/tests/strongswan.pem
daemon.log（charondebug 4）：
Apr 1 15:04:33 duke charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.1.1, Linux 3.2.0-4-amd64, x86_64)
Apr 1 15:04:33 duke charon: 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'
Apr 1 15:04:33 duke charon: 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'
Apr 1 15:04:33 duke charon: 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'
Apr 1 15:04:33 duke charon: 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'
Apr 1 15:04:33 duke charon: 00[CFG] loading crls from '/etc/ipsec.d/crls'
Apr 1 15:04:33 duke charon: 00[CFG] loading secrets from '/etc/ipsec.secrets'
Apr 1 15:04:33 duke charon: 00[CFG] expanding file expression '/var/lib/strongswan/ipsec.secrets.inc' failed
Apr 1 15:04:33 duke charon: 00[CFG] loaded IKE secret for %any
Apr 1 15:04:33 duke charon: 00[LIB] building CRED_PRIVATE_KEY - RSA failed, tried 9 builders
Apr 1 15:04:33 duke charon: 00[CFG] loading private key from '/media/psf/Home/p/pyike/tests/strongswan.pem' failed
Apr 1 15:04:33 duke charon: 00[LIB] loaded plugins: charon aes rc2 sha1 sha2 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default stroke updown
Apr 1 15:04:33 duke charon: 00[LIB] unable to load 3 plugin features (3 due to unmet dependencies)
Apr 1 15:04:33 duke charon: 00[LIB] dropped capabilities, running as uid 0, gid 0
Apr 1 15:04:33 duke charon: 00[JOB] spawning 16 worker threads
Apr 1 15:04:33 duke charon: 11[CFG] received stroke: add connection 'pyike'
Apr 1 15:04:33 duke charon: 11[CFG] left nor right host is our side, assuming left=local
Apr 1 15:04:33 duke charon: 11[LIB] file coded in unknown format, discarded
Apr 1 15:04:33 duke charon: 11[LIB] building CRED_CERTIFICATE - TRUSTED_PUBKEY failed, tried 3 builders
Apr 1 15:04:33 duke charon: 11[CFG] loading public key for "%any" from '/etc/ssh/hostkey' failed
Apr 1 15:04:33 duke charon: 11[CFG] loaded RSA public key for "%any" from '/media/psf/Home/p/pyike/tests/strongswan.pem'
Apr 1 15:04:33 duke charon: 11[CFG] added configuration 'pyike'
Apr 1 15:06:23 duke charon: 13[NET] received packet: from 10.1.48.48[51126] to 10.1.54.85[500] (424 bytes)
Apr 1 15:06:23 duke charon: 13[ENC] parsed IKE_SA_INIT request 0 [ SA KE No ]
Apr 1 15:06:23 duke charon: 13[IKE] 10.1.48.48 is initiating an IKE_SA
Apr 1 15:06:23 duke charon: 13[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(MULT_AUTH) ]
Apr 1 15:06:23 duke charon: 13[NET] sending packet: from 10.1.54.85[500] to 10.1.48.48[51126] (392 bytes)
Apr 1 15:06:23 duke charon: 14[NET] received packet: from 10.1.48.48[51126] to 10.1.54.85[500] (432 bytes)
Apr 1 15:06:23 duke charon: 14[ENC] parsed IKE_AUTH request 1 [ IDi AUTH SA TSi TSr ]
Apr 1 15:06:23 duke charon: 14[CFG] looking for peer configs matching 10.1.54.85[%any]...10.1.48.48[[email protected]]
Apr 1 15:06:23 duke charon: 14[CFG] selected peer config 'pyike'
Apr 1 15:06:23 duke charon: 14[IKE] no trusted RSA public key found for '[email protected]'
Apr 1 15:06:23 duke charon: 14[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]
Apr 1 15:06:23 duke charon: 14[NET] sending packet: from 10.1.54.85[500] to 10.1.48.48[51126] (80 bytes)
答案1
Apr 1 15:04:33 duke charon: 11[LIB] file coded in unknown format, discarded
Apr 1 15:04:33 duke charon: 11[LIB] building CRED_CERTIFICATE - TRUSTED_PUBKEY failed, tried 3 builders
Apr 1 15:04:33 duke charon: 11[CFG] loading public key for "%any" from '/etc/ssh/hostkey' failed
left|rightsigkey之前 strongSwan 不支持通过以下方式从文件加载 SSH 公钥版本 5.2.0。
作为一种解决方法，您可以按如下方式配置密钥：
leftsigkey=ssh:0sAAAAB3NzaC1yc2EA...
后面ssh:0s跟着 Base64 编码的 SSH 公钥。此语法的支持已添加到strongSwan 5.1.0。