Return to README CVS log

Up to [ELWIX - Embedded LightWeight unIX -] / elwix / config / etc / default / racoon / roadwarrior

Annotation of elwix/config/etc/default/racoon/roadwarrior/README, revision 1.1

1.1     ! misho       1: This directory contains sample configurations files used for roadwarrior
        !             2: remote access using hybrid authentication. In this setup, the VPN 
        !             3: gateway authenticates to the client using a certificate, and the client
        !             4: authenticates to the VPN gateway using a login and a password.
        !             5: 
        !             6: Moreover, this setup makes use of ISAKMP mode config to autoconfigure 
        !             7: the client. After a successful login, the client will receive an 
        !             8: internal address, netmask and DNS from the VPN gateway.
        !             9: 
        !            10: 
        !            11: Server setups
        !            12: =============
        !            13: The server setups need racoon built with the following options:
        !            14: configure --enable-natt --enable-frag --enable-hybrid --enable-dpd \
        !            15:          --with-libradius --sysconfdir=/etc/racoon
        !            16: 
        !            17: The first server setup, in server/racoon.conf, is for a VPN gateway 
        !            18: using authentication against the system password database, and using 
        !            19: a locally configured pool of addresses. 
        !            20: 
        !            21: The second setup, server/racoon.conf-radius, uses a RADIUS server for 
        !            22: authentication, IP allocation and accounting. The address and secret
        !            23: to be used for the RADIUS server are configured in /etc/radius.conf, 
        !            24: see radius.conf(5).
        !            25: 
        !            26: Both configurations can be used with the Cisco VPN client if it
        !            27: is set up to use hybrid authentication (aka mutual group authentication,
        !            28: available in Cisco VPN client version 4.0.5 and above). The group 
        !            29: password configured in the Cisco VPN client is not used by racoon.
        !            30: 
        !            31: After you have installed /etc/racoon/racoon.conf, you will also have 
        !            32: to install a server certificate and key in /etc/openssl/certs/server.crt
        !            33: and /etc/openssl/certs/server.key
        !            34: 
        !            35: 
        !            36: Client setup
        !            37: ============
        !            38: The client setup needs racoon built with the following options:
        !            39: configure --enable-natt --enable-frag --enable-hybrid --enable-dpd \
        !            40:          --enable-adminport --sysconfdir=/etc/racoon --localstatedir=/var
        !            41: 
        !            42: You need to copy client/racoon.conf, client/phase1-up.sh and
        !            43: client/phase1-down.sh to /etc/racoon, and you need to copy the 
        !            44: certificate authority that signed the VPN gateway certificate in
        !            45: /etc/openssl/certs/root-ca.crt
        !            46: 
        !            47: Once this is done, you can run racoon, and then you can start
        !            48: the VPN using racoonctl:
        !            49: racoonctl vc -u username vpn-gateway.example.net
        !            50: 
        !            51: Where username is your login, and vpn-gateway.example.net is
        !            52: the DNS or IP address of the VPN gateway. racoonctl will prompt 
        !            53: you for the password.
        !            54: 
        !            55: The password can be stored in the psk.txt file. In that situation, 
        !            56: add this directive to the remote section of racoon.conf:
        !            57:         xauth_login "username";
        !            58: where username is your login.
        !            59: 
        !            60: Note that for now there is no feedback in racoonctl if the authentication
        !            61: fails. Peek at the racoon logs to discover what goes wrong.
        !            62: 
        !            63: In order to disconnect from the VPN, do this:
        !            64: racoonctl vd vpn-gateway.example.net
        !            65: 
        !            66: This configuration should be compatible with the Cisco VPN 3000 using 
        !            67: hybrid authentication, though this has not been tested.