From aa0f5b38aec14428b4b80e06f90ff781f8bca5f1 Mon Sep 17 00:00:00 2001 From: Rene Mayrhofer Date: Mon, 22 May 2006 05:12:18 +0000 Subject: Import initial strongswan 2.7.0 version into SVN. --- doc/src/upgrading.html | 260 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 260 insertions(+) create mode 100644 doc/src/upgrading.html (limited to 'doc/src/upgrading.html') diff --git a/doc/src/upgrading.html b/doc/src/upgrading.html new file mode 100644 index 000000000..0d6401b96 --- /dev/null +++ b/doc/src/upgrading.html @@ -0,0 +1,260 @@ + + + + Introduction to FreeS/WAN + + + + + +

Upgrading to FreeS/WAN 2.x

+ + +

New! Built in Opportunistic connections

+ +

Out of the box, FreeS/WAN 2.x will attempt to encrypt all your IP traffic. +It will try to establish IPsec connections for:

+ +

FreeS/WAN 2.x uses hidden, automatically enabled + ipsec.conf connections to do this.

+ +

This behaviour is part of our campaign to get Opportunistic +Encryption (OE) widespread in the Linux world, so that any two Linux boxes can +encrypt to one another without prearrangement. +There's one catch, however: you must set +up a few DNS records +to distribute RSA public keys and (if applicable) IPsec gateway +information.

+ +

If you start FreeS/WAN before you have set up these DNS +records, your connectivity will be slow, and +messages relating to the built in connections will clutter your logs. +If you are unable to set up DNS for OE, you will wish to +disable the +hidden connections.

+ + + +

Upgrading Opportunistic Encryption +to 2.01 (or later)

+ +

As of FreeS/WAN 2.01, Opportunistic Encryption (OE) +uses DNS TXT resource records (RRs) only (rather than TXT with KEY). +This change causes a "flag day". +Users of FreeS/WAN 2.00 (or earlier) OE who are upgrading may +need to post additional resource records. +

+ +

If you are running +initiate-only OE, +you must put up a TXT record in any forward domain as per our +quickstart instructions. This +replaces your old forward KEY. +

+ +

+If you are running full OE, you require no updates. You already have +the needed TXT record in the reverse domain. +However, to facilitate future features, you +may also wish to publish that TXT record in a forward domain as +instructed here. +

+ +

If you are running OE on a gateway (and encrypting on behalf of subnetted +boxes) you require no updates. +You already have the required TXT record in your gateway's reverse map, +and the TXT records for any subnetted boxes require no updating. +However, to facilitate future features, you may wish to publish your gateway's + TXT record in a forward domain as shown +here. + + +

+During the transition, you may wish to leave any old KEY records up for +some time. They will provide limited backward compatibility. + +

+ +

New! Policy Groups

+ +

We want to make it easy for you to declare security policy as it +applies to IPsec connections.

+ +

Policy Groups make it simple to say: +

+ + + +

FreeS/WAN then implements these policies, creating OE connections +if and when needed. +You can use Policy Groups along with connections you explicitly +define in ipsec.conf.

+ +

For more information, see our +Policy Group HOWTO.

+ + +

New! Packetdefault Connection

+ +

Free/SWAN 2.x ships with the automatically enabled, hidden +connection packetdefault. This configures +a FreeS/WAN box as an OE gateway for any hosts located +behind it. As mentioned above, you must configure some +DNS records for +OE to work.

+

As the name implies, this connection functions as a default. If you +have more specific connections, such as policy groups which configure +your FreeS/WAN box as an OE gateway for a local subnet, these +will apply before packetdefault. You can view +packetdefault's specifics in +man ipsec.conf. +

+ + +

FreeS/WAN now disables Reverse Path Filtering

+ +

FreeS/WAN often doesn't work with reverse path filtering. At +start time, FreeS/WAN now turns rp_filter off, and logs a warning.

+ +

FreeS/WAN does not turn it back on again. +You can do this yourself with a command like:

+ +
   echo 1 > /proc/sys/net/ipv4/conf/eth0/rp_filter
+ +

For eth0, substitute the interface which FreeS/WAN was affecting.

+ + +

Revised ipsec.conf

+ +

No promise of compatibility

+ +

The FreeS/WAN team promised config-file compatibility throughout +the 1.x series. That means a 1.5 config file can be directly imported into +a fresh 1.99 install with no problems.

+ +

With FreeS/WAN 2.x, we've given ourselves permission to make the config +file easier to use. The cost: some FreeS/WAN 1.x configurations will not +work properly. Many of the new features are, however, backward compatible.

+ + +

Most ipsec.conf files will work fine

+ +

... so long as you paste this line, with no preceding +whitespace, + at the top of your config file: +

+ +
    version 2
+ +

Backward compatibility patch

+ +

If the new defaults bite you, use + +this ipsec.conf fragment to simulate the old default values.

+ + +

Details

+ +

+We've obsoleted various directives which almost no one was using: +

+
    dump
+    plutobackgroundload
+    no_eroute_pass
+    lifetime
+    rekeystart
+    rekeytries
+ +

For most of these, there is some other way to elicit the desired behaviour. +See +this post. + +

+We've made some settings, which almost everyone was using, defaults. +For example: +

+ +
    interfaces=%defaultroute
+    plutoload=%search
+    plutostart=%search
+    uniqueids=yes
+ +

We've also changed some default values to help with OE and Policy Groups:

+ +
    authby=rsasig   ## not secret!!!
+    leftrsasigkey=%dnsondemand ## looks up missing keys in DNS when needed.
+    rightrsasigkey=%dnsondemand
+ +

+Of course, you can still override any defaults by explictly declaring something +else in your connection. +

+ +

+A post with a list of many ipsec.conf changes.
+Current ipsec.conf manual. +

+ + +

Upgrading from 1.x RPMs to 2.x RPMs

+ +

Note: When upgrading from 1-series to 2-series RPMs, +rpm -U will not work.

+ +

You must instead erase the 1.x RPMs, then install the 2.x set:

+
    rpm -e freeswan
+
    rpm -e freeswan-module
+ +

On erasing, your old ipsec.conf should be moved to +ipsec.conf.rpmsave. +Keep this. You will probably want to copy your existing connections to the +end of your new 2.x file.

+ +

Install the RPMs suitable for your kernel version, such as:

+
    rpm -ivh freeswan-module-2.04_2.4.20_20.9-0.i386.rpm
+
    rpm -ivh freeswan-userland-2.04_2.4.20_20.9-0.i386.rpm
+ + + +

Or, to splice the files:

+ +
    cat /etc/ipsec.conf /etc/ipsec.conf.rpmsave > /etc/ipsec.conf.tmp
+    mv /etc/ipsec.conf.tmp /etc/ipsec.conf
+ +

Then, remove the redundant conn %default and +config setup +sections. Unless you have done any special configuring here, you'll likely +want to remove the 1.x versions. Remove conn OEself, if +present.

+ + + + + -- cgit v1.2.3