303 lines
8.8 KiB
Plaintext
303 lines
8.8 KiB
Plaintext
.TH IPSEC 8 "2010-05-30" "@IPSEC_VERSION@" "strongSwan"
|
|
.SH NAME
|
|
ipsec \- invoke IPsec utilities
|
|
.SH SYNOPSIS
|
|
.B ipsec
|
|
\fIcommand\fP [ \fIarguments\fP ] [ \fIoptions\fP ]
|
|
.PP
|
|
.SH DESCRIPTION
|
|
The
|
|
.B ipsec
|
|
utility invokes any of several utilities involved in controlling and monitoring
|
|
the IPsec encryption/authentication system, running the specified \fIcommand\fP
|
|
with the specified \fIarguments\fP and \fIoptions\fP as if it had been invoked
|
|
directly. This largely eliminates possible name collisions with other software,
|
|
and also permits some centralized services.
|
|
.PP
|
|
All the commands described in this manual page are built-in and are used to
|
|
control and monitor IPsec connections as well as the IKE daemons.
|
|
.PP
|
|
For other commands
|
|
.I ipsec
|
|
supplies the invoked
|
|
.I command
|
|
with a suitable PATH environment variable,
|
|
and also provides IPSEC_DIR,
|
|
IPSEC_CONFS, and IPSEC_VERSION environment variables,
|
|
containing respectively
|
|
the full pathname of the directory where the IPsec utilities are stored,
|
|
the full pathname of the directory where the configuration files live,
|
|
and the IPsec version number.
|
|
.PP
|
|
.SS CONTROL COMMANDS
|
|
.TP
|
|
.B "ipsec start [ starter options ]"
|
|
calls
|
|
.BR "ipsec starter"
|
|
which in turn parses \fIipsec.conf\fR and starts the IKEv1 \fIpluto\fR and
|
|
IKEv2 \fIcharon\fR daemons.
|
|
.PP
|
|
.TP
|
|
.B "ipsec update"
|
|
sends a \fIHUP\fR signal to
|
|
.BR "ipsec starter"
|
|
which in turn determines any changes in \fIipsec.conf\fR
|
|
and updates the configuration on the running IKEv1 \fIpluto\fR and IKEv2
|
|
\fIcharon\fR daemons, correspondingly.
|
|
.PP
|
|
.TP
|
|
.B "ipsec reload"
|
|
sends a \fIUSR1\fR signal to
|
|
.BR "ipsec starter"
|
|
which in turn reloads the whole configuration on the running IKEv1 \fIpluto\fR
|
|
and IKEv2 \fIcharon\fR daemons based on the actual \fIipsec.conf\fR.
|
|
.PP
|
|
.TP
|
|
.B "ipsec restart"
|
|
is equivalent to
|
|
.B "ipsec stop"
|
|
followed by
|
|
.B "ipsec start"
|
|
after a guard of 2 seconds.
|
|
.PP
|
|
.TP
|
|
.B "ipsec stop"
|
|
terminates all IPsec connections and stops the IKEv1 \fIpluto\fR and IKEv2
|
|
\fIcharon\fR daemons by sending a \fITERM\fR signal to
|
|
.BR "ipsec starter".
|
|
.PP
|
|
.TP
|
|
.B "ipsec up \fIname\fP"
|
|
tells the responsible IKE daemon to start up connection \fIname\fP.
|
|
.PP
|
|
.TP
|
|
.B "ipsec down \fIname\fP"
|
|
tells the responsible IKE daemon to terminate connection \fIname\fP.
|
|
.PP
|
|
.TP
|
|
.B "ipsec down \fIname{n}\fP"
|
|
terminates IKEv2 CHILD SA instance \fIn\fP of connection \fIname\fP.
|
|
.PP
|
|
.TP
|
|
.B "ipsec down \fIname{*}\fP"
|
|
terminates all IKEv2 CHILD SA instances of connection \fIname\fP.
|
|
.PP
|
|
.TP
|
|
.B "ipsec down \fIname[n]\fP"
|
|
terminates all IKEv2 IKE SA instance \fIn\fP of connection \fIname\fP.
|
|
.PP
|
|
.TP
|
|
.B "ipsec down \fIname[*]\fP"
|
|
terminates all IKEv2 IKE SA instances of connection \fIname\fP.
|
|
.PP
|
|
.TP
|
|
.B "ipsec route \fIname\fP"
|
|
tells the responsible IKE daemon to insert an IPsec policy in the kernel
|
|
for connection \fIname\fP. The first payload packet matching the IPsec policy
|
|
will automatically trigger an IKE connection setup.
|
|
.PP
|
|
.TP
|
|
.B "ipsec unroute \fIname\fP"
|
|
remove the IPsec policy in the kernel for connection \fIname\fP.
|
|
.PP
|
|
.TP
|
|
.B "ipsec status [ \fIname\fP ]"
|
|
returns concise status information either on connection
|
|
\fIname\fP or if the argument is lacking, on all connections.
|
|
.PP
|
|
.TP
|
|
.B "ipsec statusall [ \fIname\fP ]"
|
|
returns detailed status information either on connection
|
|
\fIname\fP or if the argument is lacking, on all connections.
|
|
.PP
|
|
.SS LIST COMMANDS
|
|
.TP
|
|
.B "ipsec listalgs"
|
|
returns a list all supported IKE encryption and hash algorithms, the available
|
|
Diffie-Hellman groups, as well as all supported ESP encryption and
|
|
authentication algorithms registered via the Linux kernel's Crypto API.
|
|
.br
|
|
Supported by the IKEv1 \fIpluto\fP daemon only.
|
|
.PP
|
|
.TP
|
|
.B "ipsec listpubkeys [ --utc ]"
|
|
returns a list of RSA public keys that were either loaded in raw key format
|
|
or extracted from X.509 and|or OpenPGP certificates.
|
|
.br
|
|
Supported by the IKEv1 \fIpluto\fP daemon only.
|
|
.PP
|
|
.TP
|
|
.B "ipsec listcerts [ --utc ]"
|
|
returns a list of X.509 and|or OpenPGP certificates that were either loaded
|
|
locally by the IKE daemon or received via the IKEv2 protocol.
|
|
.PP
|
|
.TP
|
|
.B "ipsec listcacerts [ --utc ]"
|
|
returns a list of X.509 Certification Authority (CA) certificates that were
|
|
loaded locally by the IKE daemon from the \fI/etc/ipsec.d/cacerts/\fP
|
|
directory or received in PKCS#7-wrapped certificate payloads via the IKE
|
|
protocol.
|
|
.PP
|
|
.TP
|
|
.B "ipsec listaacerts [ --utc ]"
|
|
returns a list of X.509 Authorization Authority (AA) certificates that were
|
|
loaded locally by the IKE daemon from the \fI/etc/ipsec.d/aacerts/\fP
|
|
directory.
|
|
.PP
|
|
.TP
|
|
.B "ipsec listocspcerts [ --utc ]"
|
|
returns a list of X.509 OCSP Signer certificates that were either loaded
|
|
locally by the IKE daemon from the \fI/etc/ipsec.d/ocspcerts/\fP
|
|
directory or were sent by an OCSP server.
|
|
.PP
|
|
.TP
|
|
.B "ipsec listacerts [ --utc ]"
|
|
returns a list of X.509 Attribute certificates that were loaded locally by
|
|
the IKE daemon from the \fI/etc/ipsec.d/acerts/\fP directory.
|
|
.PP
|
|
.TP
|
|
.B "ipsec listgroups [ --utc ]"
|
|
returns a list of groups that are used to define user authorization profiles.
|
|
.br
|
|
Supported by the IKEv1 \fIpluto\fP daemon only.
|
|
.PP
|
|
.TP
|
|
.B "ipsec listcainfos [ --utc ]"
|
|
returns certification authority information (CRL distribution points, OCSP URIs,
|
|
LDAP servers) that were defined by
|
|
.BR ca
|
|
sections in \fIipsec.conf\fP.
|
|
.PP
|
|
.TP
|
|
.B "ipsec listcrls [ --utc ]"
|
|
returns a list of Certificate Revocation Lists (CRLs) that were either loaded
|
|
by the IKE daemon from the \fI/etc/ipsec.d/crls\fP directory or fetched from
|
|
an HTTP- or LDAP-based CRL distribution point.
|
|
.PP
|
|
.TP
|
|
.B "ipsec listocsp [ --utc ]"
|
|
returns revocation information fetched from OCSP servers.
|
|
.PP
|
|
.TP
|
|
.B "ipsec listcards [ --utc ]"
|
|
list all certificates found on attached smart cards.
|
|
.br
|
|
Supported by the IKEv1 \fIpluto\fP daemon only.
|
|
.PP
|
|
.TP
|
|
.B "ipsec listall [ --utc ]"
|
|
returns all information generated by the list commands above. Each list command
|
|
can be called with the
|
|
\fB\-\-utc\fP
|
|
option which displays all dates in UTC instead of local time.
|
|
.PP
|
|
.SS REREAD COMMANDS
|
|
.TP
|
|
.B "ipsec rereadsecrets"
|
|
flushes and rereads all secrets defined in \fIipsec.secrets\fP.
|
|
.PP
|
|
.TP
|
|
.B "ipsec rereadcacerts"
|
|
reads all certificate files contained in the \fI/etc/ipsec.d/cacerts\fP
|
|
directory and adds them to the list of Certification Authority (CA)
|
|
certificates.
|
|
.PP
|
|
.TP
|
|
.B "ipsec rereadaacerts"
|
|
reads all certificate files contained in the \fI/etc/ipsec.d/aacerts\fP
|
|
directory and adds them to the list of Authorization Authority (AA)
|
|
certificates.
|
|
.PP
|
|
.TP
|
|
.B "ipsec rereadocspcerts"
|
|
reads all certificate files contained in the \fI/etc/ipsec.d/ocspcerts/\fP
|
|
directory and adds them to the list of OCSP signer certificates.
|
|
.PP
|
|
.TP
|
|
.B "ipsec rereadacerts"
|
|
reads all certificate files contained in the \fI/etc/ipsec.d/acerts/\fP
|
|
directory and adds them to the list of attribute certificates.
|
|
.PP
|
|
.TP
|
|
.B "ipsec rereadcrls"
|
|
reads all Certificate Revocation Lists (CRLs) contained in the
|
|
\fI/etc/ipsec.d/crls/\fP directory and adds them to the list of CRLs.
|
|
.PP
|
|
.TP
|
|
.B "ipsec rereadall"
|
|
executes all reread commands listed above.
|
|
.PP
|
|
.SS PURGE COMMANDS
|
|
.TP
|
|
.B "ipsec purgeike"
|
|
purges IKEv2 SAs that don't have a CHILD SA.
|
|
.PP
|
|
.TP
|
|
.B "ipsec purgeocsp"
|
|
purges all cached OCSP information records.
|
|
.PP
|
|
.SS INFO COMMANDS
|
|
.TP
|
|
.B "ipsec \-\-help"
|
|
returns the usage information for the ipsec command.
|
|
.PP
|
|
.TP
|
|
.B "ipsec \-\-version"
|
|
returns the version in the form of
|
|
.B Linux strongSwan U<strongSwan userland version>/K<Linux kernel version>
|
|
if strongSwan uses the native NETKEY IPsec stack of the Linux kernel it is
|
|
running on.
|
|
.PP
|
|
.TP
|
|
.B "ipsec \-\-versioncode"
|
|
returns the version number in the form of
|
|
.B U<strongSwan userland version>/K<Linux kernel version>
|
|
if strongSwan uses the native NETKEY IPsec stack of the Linux kernel it is
|
|
running on.
|
|
.PP
|
|
.TP
|
|
.B "ipsec \-\-copyright"
|
|
returns the copyright information.
|
|
.PP
|
|
.TP
|
|
.B "ipsec \-\-directory"
|
|
returns the \fILIBEXECDIR\fP directory as defined by the configure options.
|
|
.PP
|
|
.TP
|
|
.B "ipsec \-\-confdir"
|
|
returns the \fISYSCONFDIR\fP directory as defined by the configure options.
|
|
.SH FILES
|
|
/usr/local/lib/ipsec usual utilities directory
|
|
.SH ENVIRONMENT
|
|
.PP
|
|
The following environment variables control where strongSwan finds its
|
|
components.
|
|
The
|
|
.B ipsec
|
|
command sets them if they are not already set.
|
|
.nf
|
|
.na
|
|
|
|
IPSEC_DIR directory containing ipsec programs and utilities
|
|
IPSEC_SBINDIR directory containing \fBipsec\fP command
|
|
IPSEC_CONFDIR directory containing configuration files
|
|
IPSEC_PIDDIR directory containing PID files
|
|
IPSEC_NAME name of ipsec distribution
|
|
IPSEC_VERSION version numer of ipsec userland and kernel
|
|
IPSEC_STARTER_PID PID file for ipsec starter
|
|
IPSEC_PLUTO_PID PID file for IKEv1 keying daemon
|
|
IPSEC_CHARON_PID PID file for IKEv2 keying daemon
|
|
.ad
|
|
.fi
|
|
.SH SEE ALSO
|
|
.hy 0
|
|
.na
|
|
ipsec.conf(5), ipsec.secrets(5)
|
|
.ad
|
|
.hy
|
|
.PP
|
|
.SH HISTORY
|
|
Originally written for the FreeS/WAN project by Henry Spencer.
|
|
Updated and extended for the strongSwan project <http://www.strongswan.org> by
|
|
Tobias Brunner and Andreas Steffen.
|