From aaa0331ecf95ced1e913ac9be50168cf0e7cbb82 Mon Sep 17 00:00:00 2001 From: Rene Mayrhofer Date: Tue, 30 Jan 2007 12:21:07 +0000 Subject: [svn-upgrade] Integrating new upstream version, strongswan (2.8.2) --- doc/src/upgrading.html | 260 ------------------------------------------------- 1 file changed, 260 deletions(-) delete mode 100644 doc/src/upgrading.html (limited to 'doc/src/upgrading.html') diff --git a/doc/src/upgrading.html b/doc/src/upgrading.html deleted file mode 100644 index 0d6401b96..000000000 --- a/doc/src/upgrading.html +++ /dev/null @@ -1,260 +0,0 @@ - - - - Introduction to FreeS/WAN - - - - - -

Upgrading to FreeS/WAN 2.x

- - -

New! Built in Opportunistic connections

- -

Out of the box, FreeS/WAN 2.x will attempt to encrypt all your IP traffic. -It will try to establish IPsec connections for:

- -

FreeS/WAN 2.x uses hidden, automatically enabled - ipsec.conf connections to do this.

- -

This behaviour is part of our campaign to get Opportunistic -Encryption (OE) widespread in the Linux world, so that any two Linux boxes can -encrypt to one another without prearrangement. -There's one catch, however: you must set -up a few DNS records -to distribute RSA public keys and (if applicable) IPsec gateway -information.

- -

If you start FreeS/WAN before you have set up these DNS -records, your connectivity will be slow, and -messages relating to the built in connections will clutter your logs. -If you are unable to set up DNS for OE, you will wish to -disable the -hidden connections.

- - - -

Upgrading Opportunistic Encryption -to 2.01 (or later)

- -

As of FreeS/WAN 2.01, Opportunistic Encryption (OE) -uses DNS TXT resource records (RRs) only (rather than TXT with KEY). -This change causes a "flag day". -Users of FreeS/WAN 2.00 (or earlier) OE who are upgrading may -need to post additional resource records. -

- -

If you are running -initiate-only OE, -you must put up a TXT record in any forward domain as per our -quickstart instructions. This -replaces your old forward KEY. -

- -

-If you are running full OE, you require no updates. You already have -the needed TXT record in the reverse domain. -However, to facilitate future features, you -may also wish to publish that TXT record in a forward domain as -instructed here. -

- -

If you are running OE on a gateway (and encrypting on behalf of subnetted -boxes) you require no updates. -You already have the required TXT record in your gateway's reverse map, -and the TXT records for any subnetted boxes require no updating. -However, to facilitate future features, you may wish to publish your gateway's - TXT record in a forward domain as shown -here. - - -

-During the transition, you may wish to leave any old KEY records up for -some time. They will provide limited backward compatibility. - -

- -

New! Policy Groups

- -

We want to make it easy for you to declare security policy as it -applies to IPsec connections.

- -

Policy Groups make it simple to say: -

- - - -

FreeS/WAN then implements these policies, creating OE connections -if and when needed. -You can use Policy Groups along with connections you explicitly -define in ipsec.conf.

- -

For more information, see our -Policy Group HOWTO.

- - -

New! Packetdefault Connection

- -

Free/SWAN 2.x ships with the automatically enabled, hidden -connection packetdefault. This configures -a FreeS/WAN box as an OE gateway for any hosts located -behind it. As mentioned above, you must configure some -DNS records for -OE to work.

-

As the name implies, this connection functions as a default. If you -have more specific connections, such as policy groups which configure -your FreeS/WAN box as an OE gateway for a local subnet, these -will apply before packetdefault. You can view -packetdefault's specifics in -man ipsec.conf. -

- - -

FreeS/WAN now disables Reverse Path Filtering

- -

FreeS/WAN often doesn't work with reverse path filtering. At -start time, FreeS/WAN now turns rp_filter off, and logs a warning.

- -

FreeS/WAN does not turn it back on again. -You can do this yourself with a command like:

- -
   echo 1 > /proc/sys/net/ipv4/conf/eth0/rp_filter
- -

For eth0, substitute the interface which FreeS/WAN was affecting.

- - -

Revised ipsec.conf

- -

No promise of compatibility

- -

The FreeS/WAN team promised config-file compatibility throughout -the 1.x series. That means a 1.5 config file can be directly imported into -a fresh 1.99 install with no problems.

- -

With FreeS/WAN 2.x, we've given ourselves permission to make the config -file easier to use. The cost: some FreeS/WAN 1.x configurations will not -work properly. Many of the new features are, however, backward compatible.

- - -

Most ipsec.conf files will work fine

- -

... so long as you paste this line, with no preceding -whitespace, - at the top of your config file: -

- -
    version 2
- -

Backward compatibility patch

- -

If the new defaults bite you, use - -this ipsec.conf fragment to simulate the old default values.

- - -

Details

- -

-We've obsoleted various directives which almost no one was using: -

-
    dump
-    plutobackgroundload
-    no_eroute_pass
-    lifetime
-    rekeystart
-    rekeytries
- -

For most of these, there is some other way to elicit the desired behaviour. -See -this post. - -

-We've made some settings, which almost everyone was using, defaults. -For example: -

- -
    interfaces=%defaultroute
-    plutoload=%search
-    plutostart=%search
-    uniqueids=yes
- -

We've also changed some default values to help with OE and Policy Groups:

- -
    authby=rsasig   ## not secret!!!
-    leftrsasigkey=%dnsondemand ## looks up missing keys in DNS when needed.
-    rightrsasigkey=%dnsondemand
- -

-Of course, you can still override any defaults by explictly declaring something -else in your connection. -

- -

-A post with a list of many ipsec.conf changes.
-Current ipsec.conf manual. -

- - -

Upgrading from 1.x RPMs to 2.x RPMs

- -

Note: When upgrading from 1-series to 2-series RPMs, -rpm -U will not work.

- -

You must instead erase the 1.x RPMs, then install the 2.x set:

-
    rpm -e freeswan
-
    rpm -e freeswan-module
- -

On erasing, your old ipsec.conf should be moved to -ipsec.conf.rpmsave. -Keep this. You will probably want to copy your existing connections to the -end of your new 2.x file.

- -

Install the RPMs suitable for your kernel version, such as:

-
    rpm -ivh freeswan-module-2.04_2.4.20_20.9-0.i386.rpm
-
    rpm -ivh freeswan-userland-2.04_2.4.20_20.9-0.i386.rpm
- - - -

Or, to splice the files:

- -
    cat /etc/ipsec.conf /etc/ipsec.conf.rpmsave > /etc/ipsec.conf.tmp
-    mv /etc/ipsec.conf.tmp /etc/ipsec.conf
- -

Then, remove the redundant conn %default and -config setup -sections. Unless you have done any special configuring here, you'll likely -want to remove the 1.x versions. Remove conn OEself, if -present.

- - - - - -- cgit v1.2.3