1 '\" te
2 .\" Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved.
3 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License. You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.
4 .\" See the License for the specific language governing permissions and limitations under the License. When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the
5 .\" fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
6 .TH IKE.CONFIG 4 "Apr 27, 2009"
7 .SH NAME
8 ike.config \- configuration file for IKE policy
9 .SH SYNOPSIS
10 .LP
11 .nf
12 \fB/etc/inet/ike/config\fR
13 .fi
14
15 .SH DESCRIPTION
16 .sp
17 .LP
18 The \fB/etc/inet/ike/config\fR file contains rules for matching inbound IKE
19 requests. It also contains rules for preparing outbound \fBIKE\fR requests.
20 .sp
21 .LP
22 You can test the syntactic correctness of an \fB/etc/inet/ike/config\fR file by
23 using the \fB-c\fR or \fB-f\fR options of \fBin.iked\fR(1M). You must use the
24 \fB-c\fR option to test a \fBconfig\fR file. You might need to use the \fB-f\fR
25 option if it is not in \fB/etc/inet/ike/config\fR.
26 .SS "Lexical Components"
27 .sp
28 .LP
29 On any line, an unquoted \fB#\fR character introduces a comment. The remainder
30 of that line is ignored. Additionally, on any line, an unquoted \fB//\fR
31 sequence introduces a comment. The remainder of that line is ignored.
32 .sp
33 .LP
34 There are several types of lexical tokens in the \fBike.config\fR file:
35 .sp
36 .ne 2
37 .na
38 \fB\fInum\fR\fR
39 .ad
40 .sp .6
41 .RS 4n
42 A decimal, hex, or octal number representation is as in 'C'.
43 .RE
44
45 .sp
46 .ne 2
47 .na
48 \fB\fIIPaddr\fR/\fIprefix\fR/\fIrange\fR\fR
49 .ad
50 .sp .6
51 .RS 4n
52 An IPv4 or IPv6 address with an optional /\fINNN\fR suffix, (where \fINNN\fR is
53 a \fInum\fR) that indicates an address (\fBCIDR\fR) prefix (for example,
54 \fB10.1.2.0/24\fR). An optional /\fIADDR\fR suffix (where \fIADDR\fR is a
55 second IP address) indicates an address/mask pair (for example,
56 \fB10.1.2.0/255.255.255.0\fR). An optional -\fIADDR\fR suffix (where \fIADDR\fR
57 is a second IPv4 address) indicates an inclusive range of addresses (for
58 example, \fB10.1.2.0-10.1.2.255\fR). The \fB/\fR or \fB-\fR can be surrounded
59 by an arbitrary amount of white space.
60 .RE
61
62 .sp
63 .ne 2
64 .na
65 \fB\fBXXX\fR | \fBYYY\fR | \fBZZZ\fR\fR
66 .ad
67 .sp .6
68 .RS 4n
69 Either the words \fBXX\fRX, \fBYYY\fR, or \fBZZZ\fR, for example, {yes,no}.
70 .RE
71
72 .sp
73 .ne 2
74 .na
75 \fBp1-id-type\fR
76 .ad
77 .sp .6
78 .RS 4n
79 An IKE phase 1 identity type. IKE phase 1 identity types include:
80 .br
81 .in +2
82 \fBdn, DN\fR
83 .in -2
84 .br
85 .in +2
86 \fBdns, DNS\fR
87 .in -2
88 .br
89 .in +2
90 \fBfqdn, FQDN\fR
91 .in -2
92 .br
93 .in +2
94 \fBgn, GN\fR
95 .in -2
96 .br
97 .in +2
98 \fBip, IP\fR
99 .in -2
100 .br
101 .in +2
102 \fBipv4\fR
103 .in -2
104 .br
105 .in +2
106 \fBipv4_prefix\fR
107 .in -2
108 .br
109 .in +2
110 \fBipv4_range\fR
111 .in -2
112 .br
113 .in +2
114 \fBipv6\fR
115 .in -2
116 .br
117 .in +2
118 \fBipv6_prefix\fR
119 .in -2
120 .br
121 .in +2
122 \fBipv6_range\fR
123 .in -2
124 .br
125 .in +2
126 \fBmbox, MBOX\fR
127 .in -2
128 .br
129 .in +2
130 \fBuser_fqdn\fR
131 .in -2
132 .RE
133
134 .sp
135 .ne 2
136 .na
137 \fB\fB"\fR\fIstring\fR\fB"\fR\fR
138 .ad
139 .sp .6
140 .RS 4n
141 A quoted string.
142 .sp
143 Examples include:\fB"Label foo"\fR, or \fB"C=US, OU=Sun Microsystems\\, Inc.,
144 N=olemcd@eng.example.com"\fR
145 .sp
146 A backslash (\fB\e\fR) is an escape character. If the string needs an actual
147 backslash, two must be specified.
148 .RE
149
150 .sp
151 .ne 2
152 .na
153 \fB\fIcert-sel\fR\fR
154 .ad
155 .sp .6
156 .RS 4n
157 A certificate selector, a \fIstring\fR which specifies the identities of zero
158 or more certificates. The specifiers can conform to \fBX.509\fR naming
159 conventions.
160 .sp
161 A \fIcert-sel\fR can also use various shortcuts to match either subject
162 alternative names, the filename or \fBslot\fR of a certificate in
163 \fB/etc/inet/ike/publickeys\fR, or even the \fBISSUER\fR. For example:
164 .sp
165 .in +2
166 .nf
167 "SLOT=0"
168 "EMAIL=postmaster@domain.org"
169 "webmaster@domain.org" # Some just work w/o TYPE=
170 "IP=10.0.0.1"
171 "10.21.11.11" # Some just work w/o TYPE=
172 "DNS=www.domain.org"
173 "mailhost.domain.org" # Some just work w/o TYPE=
174 "ISSUER=C=US, O=Sun Microsystems\\, Inc., CN=Sun CA"
175 .fi
176 .in -2
177 .sp
178
179 Any \fIcert-sel\fR preceded by the character \fB!\fR indicates a negative
180 match, that is, not matching this specifier. These are the same kind of strings
181 used in \fBikecert\fR(1M).
182 .RE
183
184 .sp
185 .ne 2
186 .na
187 \fB\fIldap-list\fR\fR
188 .ad
189 .sp .6
190 .RS 4n
191 A quoted, comma-separated list of LDAP servers and ports.
192 .sp
193 For example, \fB"ldap1.example.com"\fR, \fB"ldap1.example.com:389"\fR,
194 \fB"ldap1.example.com:389,ldap2.example.com"\fR.
195 .sp
196 The default port for LDAP is \fB389\fR.
197 .RE
198
199 .sp
200 .ne 2
201 .na
202 \fB\fIparameter-list\fR\fR
203 .ad
204 .sp .6
205 .RS 4n
206 A list of parameters.
207 .RE
208
209 .SS "File Body Entries"
210 .sp
211 .LP
212 There are four main types of entries:
213 .RS +4
214 .TP
215 .ie t \(bu
216 .el o
217 global parameters
218 .RE
219 .RS +4
220 .TP
221 .ie t \(bu
222 .el o
223 IKE phase 1 transform defaults
224 .RE
225 .RS +4
226 .TP
227 .ie t \(bu
228 .el o
229 IKE rule defaults
230 .RE
231 .RS +4
232 .TP
233 .ie t \(bu
234 .el o
235 IKE rules
236 .RE
237 .sp
238 .LP
239 The global parameter entries are as follows:
240 .sp
241 .ne 2
242 .na
243 \fBcert_root \fIcert-sel\fR\fR
244 .ad
245 .sp .6
246 .RS 4n
247 The X.509 distinguished name of a certificate that is a trusted root CA
248 certificate.It must be encoded in a file in the \fB/etc/inet/ike/publickeys\fR
249 directory. It must have a CRL in \fB/etc/inet/ike/crl\fRs. Multiple
250 \fBcert_root\fR parameters aggregate.
251 .RE
252
253 .sp
254 .ne 2
255 .na
256 \fBcert_trust \fIcert-sel\fR\fR
257 .ad
258 .sp .6
259 .RS 4n
260 Specifies an X.509 distinguished name of a certificate that is self-signed, or
261 has otherwise been verified as trustworthy for signing IKE exchanges. It must
262 be encoded in a file in \fB/etc/inet/ike/publickeys\fR. Multiple
263 \fBcert_trust\fR parameters aggregate.
264 .RE
265
266 .sp
267 .ne 2
268 .na
269 \fBexpire_timer \fIinteger\fR\fR
270 .ad
271 .sp .6
272 .RS 4n
273 The number of seconds to let a not-yet-complete IKE Phase I (Main Mode)
274 negotiation linger before deleting it. Default value: 300 seconds.
275 .RE
276
277 .sp
278 .ne 2
279 .na
280 \fBignore_crls\fR
281 .ad
282 .sp .6
283 .RS 4n
284 If this keyword is present in the file, \fBin.iked\fR(1M) ignores Certificate
285 Revocation Lists (\fBCRL\fRs) for root \fBCA\fRs (as given in \fBcert_root\fR)
286 .RE
287
288 .sp
289 .ne 2
290 .na
291 \fBldap_server \fIldap-list\fR\fR
292 .ad
293 .sp .6
294 .RS 4n
295 A list of LDAP servers to query for certificates. The list can be additive.
296 .RE
297
298 .sp
299 .ne 2
300 .na
301 \fBpkcs11_path \fIstring\fR\fR
302 .ad
303 .sp .6
304 .RS 4n
305 The string that follows is a name of a shared object (\fB\&.so\fR) that
306 implements the PKCS#11 standard. The name is passed directly into
307 \fBdlopen\fR(3C) for linking, with all of the semantics of that library call.
308 By default, \fBin.iked\fR(1M) runs the same ISA as the running kernel, so a
309 library specified using \fBpkcs11_path\fR and an absolute pathname \fBmust\fR
310 match the same ISA as the kernel. One can use the start/exec SMF property (see
311 \fBsvccfg\fR(1M)) to change \fBin.iked\fR's ISA, but it is not recommended.
312 .sp
313 If this setting is not present, the default value is set to \fBlibpkcs11.so\fR.
314 Most cryptographic providers go through the default library, and this parameter
315 should only be used if a specialized provider of IKE-useful cryptographic
316 services cannot interface with the Solaris Cryptographic Framework. See
317 \fBcryptoadm\fR(1M).
318 .sp
319 This option is now deprecated, and may be removed in a future release.
320 .RE
321
322 .sp
323 .ne 2
324 .na
325 \fBretry_limit \fIinteger\fR\fR
326 .ad
327 .sp .6
328 .RS 4n
329 The number of retransmits before any IKE negotiation is aborted. Default value:
330 5 times.
331 .RE
332
333 .sp
334 .ne 2
335 .na
336 \fBretry_timer_init \fIinteger\fR or \fIfloat\fR\fR
337 .ad
338 .sp .6
339 .RS 4n
340 The initial interval (in seconds) between retransmits. This interval is doubled
341 until the \fBretry_timer_max\fR value (see below) is reached. Default value:
342 0.5 seconds.
343 .RE
344
345 .sp
346 .ne 2
347 .na
348 \fBretry_timer_max \fIinteger\fR or \fIfloat\fR\fR
349 .ad
350 .sp .6
351 .RS 4n
352 The maximum interval (in seconds) between retransmits. The doubling retransmit
353 interval stops growing at this limit. Default value: 30 seconds.
354 .LP
355 Note -
356 .sp
357 .RS 2
358 This value is never reached with the default configuration. The longest
359 interval is 8 (0.5 * 2 ^ (5 - 1)) seconds.
360 .RE
361 .RE
362
363 .sp
364 .ne 2
365 .na
366 \fBproxy \fIstring\fR\fR
367 .ad
368 .sp .6
369 .RS 4n
370 The string following this keyword must be a URL for an HTTP proxy, for example,
371 \fBhttp://proxy:8080\fR.
372 .RE
373
374 .sp
375 .ne 2
376 .na
377 \fBsocks \fIstring\fR\fR
378 .ad
379 .sp .6
380 .RS 4n
381 The string following this keyword must be a URL for a SOCKS proxy, for example,
382 \fBsocks://socks-proxy\fR.
383 .RE
384
385 .sp
386 .ne 2
387 .na
388 \fBuse_http\fR
389 .ad
390 .sp .6
391 .RS 4n
392 If this keyword is present in the file, \fBin.iked\fR(1M) uses HTTP to retrieve
393 Certificate Revocation Lists (\fBCRL\fRs).
394 .RE
395
396 .sp
397 .LP
398 The following IKE phase 1 transform parameters can be prefigured using
399 file-level defaults. Values specified within any given transform override these
400 defaults.
401 .sp
402 .LP
403 The IKE phase 1 transform defaults are as follows:
404 .sp
405 .ne 2
406 .na
407 \fBp1_lifetime_secs \fInum\fR\fR
408 .ad
409 .sp .6
410 .RS 4n
411 The proposed default lifetime, in seconds, of an IKE phase 1 security
412 association (\fBSA\fR).
413 .RE
414
415 .sp
416 .ne 2
417 .na
418 \fBp1_nonce_len \fInum\fR\fR
419 .ad
420 .sp .6
421 .RS 4n
422 The length in bytes of the phase 1 (quick mode) nonce data. This cannot be
423 specified on a per-rule basis.
424 .RE
425
426 .sp
427 .LP
428 The following IKE rule parameters can be prefigured using file-level defaults.
429 Values specified within any given rule override these defaults, unless a rule
430 cannot.
431 .sp
432 .ne 2
433 .na
434 \fBp2_lifetime_secs \fInum\fR\fR
435 .ad
436 .sp .6
437 .RS 4n
438 The proposed default lifetime, in seconds, of an IKE phase 2 security
439 association (SA). This value is optional. If omitted, a default value is used.
440 .RE
441
442 .sp
443 .ne 2
444 .na
445 \fBp2_softlife_secs \fInum\fR\fR
446 .ad
447 .sp .6
448 .RS 4n
449 The soft lifetime of a phase 2 SA, in seconds. If this value is specified, the
450 SA soft expires after the number of seconds specified by
451 \fBp2_softlife_secs\fR. This causes \fBin.iked\fR to renegotiate a new phase 2
452 SA before the original SA expires.
453 .sp
454 This value is optional, if omitted soft expiry occurs after 90% of the lifetime
455 specified by \fBp2_lifetime_secs\fR. The value specified by
456 \fBp2_softlife_secs\fR is ignored if \fBp2_lifetime_secs\fR is not specified.
457 .sp
458 Setting \fBp2_softlife_secs\fR to the same value as \fBp2_lifetime_secs\fR
459 disables soft expires.
460 .RE
461
462 .sp
463 .ne 2
464 .na
465 \fBp2_idletime_secs \fInum\fR\fR
466 .ad
467 .sp .6
468 .RS 4n
469 The idle lifetime of a phase 2 SA, in seconds. If the value is specified, the
470 value specifies the lifetime of the SA, if the security association is not used
471 before the SA is revalidated.
472 .RE
473
474 .sp
475 .ne 2
476 .na
477 \fBp2_lifetime_kb \fInum\fR\fR
478 .ad
479 .sp .6
480 .RS 4n
481 The lifetime of an SA can optionally be specified in kilobytes. This parameter
482 specifies the default value. If lifetimes are specified in both seconds and
483 kilobytes, the SA expires when either the seconds or kilobyte threshholds are
484 passed.
485 .RE
486
487 .sp
488 .ne 2
489 .na
490 \fBp2_softlife_kb \fInum\fR\fR
491 .ad
492 .sp .6
493 .RS 4n
494 This value is the number of kilobytes that can be protected by an SA before a
495 soft expire occurs (see \fBp2_softlife_secs\fR, above).
496 .sp
497 This value is optional. If omitted, soft expiry occurs after 90% of the
498 lifetime specified by \fBp2_lifetime_kb\fR. The value specified by
499 \fBp2_softlife_kb\fR is ignored if \fBp2_lifetime_kb\fR is not specified.
500 .RE
501
502 .sp
503 .ne 2
504 .na
505 \fBp2_nonce_len \fInum\fR\fR
506 .ad
507 .sp .6
508 .RS 4n
509 The length in bytes of the phase 2 (quick mode) nonce data. This cannot be
510 specified on a per-rule basis.
511 .RE
512
513 .sp
514 .ne 2
515 .na
516 \fBlocal_id_type \fIp1-id-type\fR\fR
517 .ad
518 .sp .6
519 .RS 4n
520 The local identity for IKE requires a type. This identity type is reflected in
521 the IKE exchange. The type can be one of the following:
522 .RS +4
523 .TP
524 .ie t \(bu
525 .el o
526 an IP address (for example, \fB10.1.1.2\fR)
527 .RE
528 .RS +4
529 .TP
530 .ie t \(bu
531 .el o
532 DNS name (for example, \fBtest.domain.com\fR)
533 .RE
534 .RS +4
535 .TP
536 .ie t \(bu
537 .el o
538 MBOX RFC 822 name (for example, \fBroot@domain.com\fR)
539 .RE
540 .RS +4
541 .TP
542 .ie t \(bu
543 .el o
544 DNX.509 distinguished name (for example, \fBC=US, O=Sun Microsystems\, Inc.,
545 CN=Sun Test cert\fR)
546 .RE
547 .RE
548
549 .sp
550 .ne 2
551 .na
552 \fBp1_xform '{' parameter-list '}\fR
553 .ad
554 .sp .6
555 .RS 4n
556 A phase 1 transform specifies a method for protecting an IKE phase 1 exchange.
557 An initiator offers up lists of phase 1 transforms, and a receiver is expected
558 to only accept such an entry if it matches one in a phase 1 rule. There can be
559 several of these, and they are additive. There must be either at least one
560 phase 1 transform in a rule or a global default phase 1 transform list. In a
561 configuration file without a global default phase 1 transform list \fBand\fR a
562 rule without a phase, transform list is an invalid file. Unless specified as
563 optional, elements in the parameter-list must occur exactly once within a given
564 transform's parameter-list:
565 .sp
566 .ne 2
567 .na
568 \fBoakley_group \fInumber\fR\fR
569 .ad
570 .sp .6
571 .RS 4n
572 The Oakley Diffie-Hellman group used for IKE SA key derivation. The group
573 numbers are defined in RFC 2409, Appendix A, and RFC 3526. Acceptable values
574 are currently:
575 .br
576 .in +2
577 1 (768-bit)
578 .in -2
579 .br
580 .in +2
581 2 (1024-bit)
582 .in -2
583 .br
584 .in +2
585 5 (1536-bit)
586 .in -2
587 .br
588 .in +2
589 14 (2048-bit)
590 .in -2
591 .br
592 .in +2
593 15 (3072-bit)
594 .in -2
595 .br
596 .in +2
597 16 (4096-bit)
598 .in -2
599 .RE
600
601 .sp
602 .ne 2
603 .na
604 \fBencr_alg {3des, 3des-cbc, blowfish, blowfish-cdc, des, des-cbc, aes,
605 aes-cbc}\fR
606 .ad
607 .sp .6
608 .RS 4n
609 An encryption algorithm, as in \fBipsecconf\fR(1M). However, of the ciphers
610 listed above, only \fBaes\fR and \fBaes-cbc\fR allow optional key-size setting,
611 using the "low value-to-high value" syntax. To specify a single AES key size,
612 the low value must equal the high value. If no range is specified, all three
613 AES key sizes are allowed.
614 .RE
615
616 .sp
617 .ne 2
618 .na
619 \fBauth_alg {md5, sha, sha1, sha256, sha384, sha512}\fR
620 .ad
621 .sp .6
622 .RS 4n
623 An authentication algorithm.
624 .sp
625 Use \fBipsecalgs\fR(1M) with the \fB-l\fR option to list the IPsec protocols
626 and algorithms currently defined on a system. The \fBcryptoadm list\fR command
627 diplays a list of installed providers and their mechanisms. See
628 \fBcryptoadm\fR(1M).
629 .RE
630
631 .sp
632 .ne 2
633 .na
634 \fBauth_method {preshared, rsa_sig, rsa_encrypt, dss_sig}\fR
635 .ad
636 .sp .6
637 .RS 4n
638 The authentication method used for IKE phase 1.
639 .RE
640
641 .sp
642 .ne 2
643 .na
644 \fBp1_lifetime_secs \fInum\fR\fR
645 .ad
646 .sp .6
647 .RS 4n
648 Optional. The lifetime for a phase 1 SA.
649 .RE
650
651 .RE
652
653 .sp
654 .ne 2
655 .na
656 \fBp2_lifetime_secs \fInum\fR\fR
657 .ad
658 .sp .6
659 .RS 4n
660 If configuring the kernel defaults is not sufficient for different tasks, this
661 parameter can be used on a per-rule basis to set the IPsec \fBSA\fR lifetimes
662 in seconds.
663 .RE
664
665 .sp
666 .ne 2
667 .na
668 \fBp2_pfs \fInum\fR\fR
669 .ad
670 .sp .6
671 .RS 4n
672 Use perfect forward secrecy for phase 2 (quick mode). If selected, the oakley
673 group specified is used for phase 2 PFS. Acceptable values are:
674 .br
675 .in +2
676 0 (do not use Perfect Forward Secrecy for IPsec SAs)
677 .in -2
678 .br
679 .in +2
680 1 (768-bit)
681 .in -2
682 .br
683 .in +2
684 2 (1024-bit)
685 .in -2
686 .br
687 .in +2
688 5 (1536-bit)
689 .in -2
690 .br
691 .in +2
692 14 (2048-bit)
693 .in -2
694 .br
695 .in +2
696 15 (3072-bit)
697 .in -2
698 .br
699 .in +2
700 16 (4096-bit)
701 .in -2
702 .RE
703
704 .sp
705 .LP
706 An IKE rule starts with a right-curly-brace (\fB{\fR), ends with a
707 left-curly-brace (\fB}\fR), and has the following parameters in between:
708 .sp
709 .ne 2
710 .na
711 \fBlabel \fIstring\fR\fR
712 .ad
713 .sp .6
714 .RS 4n
715 Required parameter. The administrative interface to \fBin.iked\fR looks up
716 phase 1 policy rules with the label as the search string. The administrative
717 interface also converts the label into an index, suitable for an extended
718 ACQUIRE message from PF_KEY - effectively tying IPsec policy to IKE policy in
719 the case of a node initiating traffic. Only one \fBlabel\fR parameter is
720 allowed per rule.
721 .RE
722
723 .sp
724 .ne 2
725 .na
726 \fBlocal_addr <\fIIPaddr\fR/\fIprefix\fR/\fIrange\fR>\fR
727 .ad
728 .sp .6
729 .RS 4n
730 Required parameter. The local address, address prefix, or address range for
731 this phase 1 rule. Multiple \fBlocal_addr\fR parameters accumulate within a
732 given rule.
733 .RE
734
735 .sp
736 .ne 2
737 .na
738 \fBremote_addr <\fIIPaddr\fR/\fIprefix\fR/\fIrang\fRe>\fR
739 .ad
740 .sp .6
741 .RS 4n
742 Required parameter. The remote address, address prefix, or address range for
743 this phase 1 rule. Multiple \fBremote_addr\fR parameters accumulate within a
744 given rule.
745 .RE
746
747 .sp
748 .ne 2
749 .na
750 \fBlocal_id_type \fIp1-id-type\fR\fR
751 .ad
752 .sp .6
753 .RS 4n
754 Which phase 1 identity type I uses. This is needed because a single certificate
755 can contain multiple values for use in IKE phase 1. Within a given rule, all
756 phase 1 transforms must either use preshared or non-preshared authentication
757 (they cannot be mixed). For rules with preshared authentication, the
758 \fBlocal_id_type\fR parameter is optional, and defaults to \fBIP\fR. For rules
759 which use non-preshared authentication, the 'local_id_type' parameter is
760 required. Multiple 'local_id_type' parameters within a rule are not allowed.
761 .RE
762
763 .sp
764 .ne 2
765 .na
766 \fBlocal_id \fIcert-sel\fR\fR
767 .ad
768 .sp .6
769 .RS 4n
770 Disallowed for preshared authentication method; required parameter for
771 non-preshared authentication method. The local identity string or certificate
772 selector. Only one local identity per rule is used, the first one stated.
773 .RE
774
775 .sp
776 .ne 2
777 .na
778 \fBremote_id \fIcert-sel\fR\fR
779 .ad
780 .sp .6
781 .RS 4n
782 Disallowed for preshared authentication method; required parameter for
783 non-preshared authentication method. Selector for which remote phase 1
784 identities are allowed by this rule. Multiple \fBremote_id\fR parameters
785 accumulate within a given rule. If a single empty string (\fB""\fR) is given,
786 then this accepts any remote \fBID\fR for phase 1. It is recommended that
787 certificate trust chains or address enforcement be configured strictly to
788 prevent a breakdown in security if this value for \fBremote_id\fR is used.
789 .RE
790
791 .sp
792 .ne 2
793 .na
794 \fBp2_lifetime_secs \fInum\fR\fR
795 .ad
796 .sp .6
797 .RS 4n
798 If configuring the kernel defaults is not sufficient for different tasks, this
799 parameter can be used on a per-rule basis to set the IPsec \fBSA\fR lifetimes
800 in seconds.
801 .RE
802
803 .sp
804 .ne 2
805 .na
806 \fBp2_pfs \fInum\fR\fR
807 .ad
808 .sp .6
809 .RS 4n
810 Use perfect forward secrecy for phase 2 (quick mode). If selected, the oakley
811 group specified is used for phase 2 PFS. Acceptable values are:
812 .br
813 .in +2
814 0 (do not use Perfect Forward Secrecy for IPsec SAs)
815 .in -2
816 .br
817 .in +2
818 1 (768-bit)
819 .in -2
820 .br
821 .in +2
822 2 (1024-bit)
823 .in -2
824 .br
825 .in +2
826 5 (1536-bit)
827 .in -2
828 .br
829 .in +2
830 14 (2048-bit)
831 .in -2
832 .br
833 .in +2
834 15 (3072-bit)
835 .in -2
836 .br
837 .in +2
838 16 (4096-bit)
839 .in -2
840 .RE
841
842 .sp
843 .ne 2
844 .na
845 \fBp1_xform \fB{\fR \fIparameter-list\fR \fB}\fR\fR
846 .ad
847 .sp .6
848 .RS 4n
849 A phase 1 transform specifies a method for protecting an IKE phase 1 exchange.
850 An initiator offers up lists of phase 1 transforms, and a receiver is expected
851 to only accept such an entry if it matches one in a phase 1 rule. There can be
852 several of these, and they are additive. There must be either at least one
853 phase 1 transform in a rule or a global default phase 1 transform list. A
854 \fBike.config\fR file without a global default phase 1transform list \fBand\fR
855 a rule without a phase 1 transform list is an invalid file. Elements within the
856 parameter-list; unless specified as optional, must occur exactly once within a
857 given transform's parameter-list:
858 .sp
859 .ne 2
860 .na
861 \fBoakley_group \fInumber\fR\fR
862 .ad
863 .sp .6
864 .RS 4n
865 The Oakley Diffie-Hellman group used for \fBIKE SA\fR key derivation.
866 Acceptable values are currently:
867 .br
868 .in +2
869 1 (768-bit)
870 .in -2
871 .br
872 .in +2
873 2 (1024-bit)
874 .in -2
875 .br
876 .in +2
877 5 (1536-bit)
878 .in -2
879 .br
880 .in +2
881 14 (2048-bit)
882 .in -2
883 .br
884 .in +2
885 15 (3072-bit)
886 .in -2
887 .br
888 .in +2
889 16 (4096-bit)
890 .in -2
891 .RE
892
893 .sp
894 .ne 2
895 .na
896 \fBencr_alg {3des, 3des-cbc, blowfish, blowfish-cdc, des, des-cbc, aes,
897 aes-cbc}\fR
898 .ad
899 .sp .6
900 .RS 4n
901 An encryption algorithm, as in \fBipsecconf\fR(1M). However, of the ciphers
902 listed above, only \fBaes\fR and \fBaes-cbc\fR allow optional key-size setting,
903 using the "low value-to-high value" syntax. To specify a single AES key size,
904 the low value must equal the high value. If no range is specified, all three
905 AES key sizes are allowed.
906 .RE
907
908 .sp
909 .ne 2
910 .na
911 \fBauth_alg {md5, sha, sha1}\fR
912 .ad
913 .sp .6
914 .RS 4n
915 An authentication algorithm, as specified in \fBipseckey\fR(1M).
916 .RE
917
918 .sp
919 .ne 2
920 .na
921 \fBauth_method {preshared, rsa_sig, rsa_encrypt, dss_sig}\fR
922 .ad
923 .sp .6
924 .RS 4n
925 The authentication method used for IKE phase 1.
926 .RE
927
928 .sp
929 .ne 2
930 .na
931 \fBp1_lifetime_secs \fInum\fR\fR
932 .ad
933 .sp .6
934 .RS 4n
935 Optional. The lifetime for a phase 1 SA.
936 .RE
937
938 .RE
939
940 .SH EXAMPLES
941 .LP
942 \fBExample 1 \fRA Sample \fBike.config\fR File
943 .sp
944 .LP
945 The following is an example of an \fBike.config\fR file:
946
947 .sp
948 .in +2
949 .nf
950
951 ### BEGINNING OF FILE
952
953 ### First some global parameters...
954
955 ### certificate parameters...
956
957 # Root certificates. I SHOULD use a full Distinguished Name.
958 # I must have this certificate in my local filesystem, see ikecert(1m).
959 cert_root "C=US, O=Sun Microsystems\\, Inc., CN=Sun CA"
960
961 # Explicitly trusted certs that need no signatures, or perhaps
962 # self-signed ones. Like root certificates, use full DNs for them
963 # for now.
964 cert_trust "EMAIL=root@domain.org"
965
966 # Where do I send LDAP requests?
967 ldap_server "ldap1.domain.org,ldap2.domain.org:389"
968
969 ## phase 1 transform defaults...
970
971 p1_lifetime_secs 14400
972 p1_nonce_len 20
973
974 ## Parameters that might also show up in rules.
975
976 p1_xform { auth_method preshared oakley_group 5 auth_alg sha
977 encr_alg 3des }
978 p2_pfs 2
979
980
981
982 ### Now some rules...
983
984 {
985 label "simple inheritor"
986 local_id_type ip
987 local_addr 10.1.1.1
988 remote_addr 10.1.1.2
989 }
990 {
991 label "simple inheritor IPv6"
992 local_id_type ipv6
993 local_addr fe80::a00:20ff:fe7d:6
994 remote_addr fe80::a00:20ff:fefb:3780
995 }
996
997 {
998 # an index-only rule. If I'm a receiver, and all I
999 # have are index-only rules, what do I do about inbound IKE requests?
1000 # Answer: Take them all!
1001
1002 label "default rule"
1003 # Use whatever "host" (e.g. IP address) identity is appropriate
1004 local_id_type ipv4
1005
1006 local_addr 0.0.0.0/0
1007 remote_addr 0.0.0.0/0
1008
1009 p2_pfs 5
1010
1011 # Now I'm going to have the p1_xforms
1012 p1_xform
1013 {auth_method preshared oakley_group 5 auth_alg md5 encr_alg \e
1014 blowfish } p1_xform
1015 {auth_method preshared oakley_group 5 auth_alg md5 encr_alg 3des }
1016
1017 # After said list, another keyword (or a '}') stops xform
1018 # parsing.
1019 }
1020
1021 {
1022 # Let's try something a little more conventional.
1023
1024 label "host to .80 subnet"
1025 local_id_type ip
1026 local_id "10.1.86.51"
1027
1028 remote_id "" # Take any, use remote_addr for access control.
1029
1030 local_addr 10.1.86.51
1031 remote_addr 10.1.80.0/24
1032
1033 p1_xform
1034 { auth_method rsa_sig oakley_group 5 auth_alg md5 encr_alg 3des }
1035 p1_xform
1036 { auth_method rsa_sig oakley_group 5 auth_alg md5 encr_alg \e
1037 blowfish }
1038 p1_xform
1039 { auth_method rsa_sig oakley_group 5 auth_alg sha1 encr_alg 3des }
1040 p1_xform
1041 { auth_method rsa_sig oakley_group 5 auth_alg sha1 encr_alg \e
1042 blowfish }
1043 }
1044
1045 {
1046 # Let's try something a little more conventional, but with ipv6.
1047
1048 label "host to fe80::/10 subnet"
1049 local_id_type ip
1050 local_id "fe80::a00:20ff:fe7d:6"
1051
1052 remote_id "" # Take any, use remote_addr for access control.
1053
1054 local_addr fe80::a00:20ff:fe7d:6
1055 remote_addr fe80::/10
1056
1057 p1_xform
1058 { auth_method rsa_sig oakley_group 5 auth_alg md5 encr_alg 3des }
1059 p1_xform
1060 { auth_method rsa_sig oakley_group 5 auth_alg md5 encr_alg \e
1061 blowfish }
1062 p1_xform
1063 { auth_method rsa_sig oakley_group 5 auth_alg sha1 encr_alg \e
1064 3des }
1065 p1_xform
1066 { auth_method rsa_sig oakley_group 5 auth_alg sha1 encr_alg \e
1067 blowfish }
1068 }
1069
1070 {
1071 # How 'bout something with a different cert type and name?
1072
1073 label "punchin-point"
1074 local_id_type mbox
1075 local_id "ipsec-wizard@domain.org"
1076
1077 remote_id "10.5.5.128"
1078
1079 local_addr 0.0.0.0/0
1080 remote_addr 10.5.5.128
1081
1082 p1_xform
1083 { auth_method rsa_sig oakley_group 5 auth_alg md5 encr_alg \e
1084 blowfish }
1085 }
1086
1087 {
1088 label "receiver side"
1089
1090 remote_id "ipsec-wizard@domain.org"
1091
1092 local_id_type ip
1093 local_id "10.5.5.128"
1094
1095 local_addr 10.5.5.128
1096 remote_addr 0.0.0.0/0
1097
1098 p1_xform
1099 { auth_method rsa_sig oakley_group 5 auth_alg md5 encr_alg blowfish }
1100 # NOTE: Specifying preshared null-and-voids the remote_id/local_id
1101 # fields.
1102 p1_xform
1103 { auth_method preshared oakley_group 5 auth_alg md5 encr_alg \e
1104 blowfish}
1105
1106 }
1107 .fi
1108 .in -2
1109
1110 .SH ATTRIBUTES
1111 .sp
1112 .LP
1113 See \fBattributes\fR(5) for descriptions of the following attributes:
1114 .sp
1115
1116 .sp
1117 .TS
1118 box;
1119 c | c
1120 l | l .
1121 ATTRIBUTE TYPE ATTRIBUTE VALUE
1122 _
1123 Interface Stability Committed
1124 .TE
1125
1126 .SH SEE ALSO
1127 .sp
1128 .LP
1129 \fBcryptoadm\fR(1M), \fBikeadm\fR(1M), \fBin.iked\fR(1M), \fBikecert\fR(1M),
1130 \fBipseckey\fR(1M), \fBipsecalgs\fR(1M), \fBipsecconf\fR(1M), \fBsvccfg\fR(1M),
1131 \fBdlopen\fR(3C), \fBattributes\fR(5), \fBrandom\fR(7D)
1132 .sp
1133 .LP
1134 Harkins, Dan and Carrel, Dave. \fIRFC 2409, Internet Key Exchange (IKE)\fR.
1135 Cisco Systems, November 1998.
1136 .sp
1137 .LP
1138 Maughan, Douglas et. al. \fIRFC 2408, Internet Security Association and Key
1139 Management Protocol (ISAKMP)\fR. National Security Agency, Ft. Meade, MD.
1140 November 1998.
1141 .sp
1142 .LP
1143 Piper, Derrell. \fIRFC 2407, The Internet IP Security Domain of Interpretation
1144 for ISAKMP\fR. Network Alchemy. Santa Cruz, California. November 1998.
1145 .sp
1146 .LP
1147 Kivinen, T. \fIRFC 3526, More Modular Exponential (MODP) Diffie-Hellman Groups
1148 for Internet Key Exchange (IKE)\fR. The Internet Society, Network Working
1149 Group. May 2003.