From aaa0331ecf95ced1e913ac9be50168cf0e7cbb82 Mon Sep 17 00:00:00 2001 From: Rene Mayrhofer Date: Tue, 30 Jan 2007 12:21:07 +0000 Subject: [svn-upgrade] Integrating new upstream version, strongswan (2.8.2) --- doc/upgrading.html | 184 ----------------------------------------------------- 1 file changed, 184 deletions(-) delete mode 100644 doc/upgrading.html (limited to 'doc/upgrading.html') diff --git a/doc/upgrading.html b/doc/upgrading.html deleted file mode 100644 index ce9fba3d2..000000000 --- a/doc/upgrading.html +++ /dev/null @@ -1,184 +0,0 @@ - - - -Introduction to FreeS/WAN - - - - -Contents -Previous -Next -

- -

Upgrading to FreeS/WAN 2.x

New! Built in Opportunistic connections

Out of the box, FreeS/WAN 2.x will attempt to encrypt all your IP - traffic. It will try to establish IPsec connections for:

IP traffic from the Linux box on which you have installed - FreeS/WAN, and
outbound IP traffic routed through that Linux box (eg. from a - protected subnet).

FreeS/WAN 2.x uses hidden, automatically enabled- ipsec.conf connections to do this.

This behaviour is part of our campaign to get Opportunistic - Encryption (OE) widespread in the Linux world, so that any two Linux - boxes can encrypt to one another without prearrangement. There's one - catch, however: you must set up a - few DNS records to distribute RSA public keys and (if applicable) - IPsec gateway information.

If you start FreeS/WAN before you have set up these DNS records, your - connectivity will be slow, and messages relating to the built in - connections will clutter your logs. If you are unable to set up DNS for - OE, you will wish to - disable the hidden connections.

- -

Upgrading Opportunistic Encryption to 2.01 (or - later)

As of FreeS/WAN 2.01, Opportunistic Encryption (OE) uses DNS TXT - resource records (RRs) only (rather than TXT with KEY). This change - causes a "flag day". Users of FreeS/WAN 2.00 (or earlier) OE who are - upgrading may need to post additional resource records.

If you are running - initiate-only OE, you must put up a TXT record in any - forward domain as per our - quickstart instructions. This replaces your old forward KEY.

If you are running full OE, you require no updates. You already have - the needed TXT record in the reverse domain. However, to facilitate - future features, you may also wish to publish that TXT record in a - forward domain as instructed - here.

If you are running OE on a gateway (and encrypting on behalf of - subnetted boxes) you require no updates. You already have the required - TXT record in your gateway's reverse map, and the TXT records for any - subnetted boxes require no updating. However, to facilitate future - features, you may wish to publish your gateway's TXT record in a - forward domain as shown here -.

During the transition, you may wish to leave any old KEY records up - for some time. They will provide limited backward compatibility. - -

New! Policy Groups

We want to make it easy for you to declare security policy as it - applies to IPsec connections.

Policy Groups make it simple to say:

These are the folks I want to talk to in the clear.
These spammers' domains -- I don't want to talk to them at all.
To talk to the finance department, I must use IPsec.
For any other communication, try to encrypt, but it's okay if we - can't.

FreeS/WAN then implements these policies, creating OE connections if - and when needed. You can use Policy Groups along with connections you - explicitly define in ipsec.conf.

For more information, see our Policy - Group HOWTO.

New! Packetdefault Connection

Free/SWAN 2.x ships with the automatically enabled, hidden - connection packetdefault. This configures a - FreeS/WAN box as an OE gateway for any hosts located behind it. As - mentioned above, you must configure some DNS - records for OE to work.

As the name implies, this connection functions as a default. If you - have more specific connections, such as policy groups which configure - your FreeS/WAN box as an OE gateway for a local subnet, these will - apply before packetdefault. You can view packetdefault -'s specifics in man ipsec.conf -.

FreeS/WAN now disables Reverse Path Filtering

FreeS/WAN often doesn't work with reverse path filtering. At start - time, FreeS/WAN now turns rp_filter off, and logs a warning.

FreeS/WAN does not turn it back on again. You can do this yourself - with a command like:

   echo 1 > /proc/sys/net/ipv4/conf/eth0/rp_filter

For eth0, substitute the interface which FreeS/WAN was affecting.

- -

Revised `ipsec.conf`

No promise of compatibility

The FreeS/WAN team promised config-file compatibility throughout the - 1.x series. That means a 1.5 config file can be directly imported into - a fresh 1.99 install with no problems.

With FreeS/WAN 2.x, we've given ourselves permission to make the - config file easier to use. The cost: some FreeS/WAN 1.x configurations - will not work properly. Many of the new features are, however, backward - compatible.

Most `ipsec.conf` files will work fine

... so long as you paste this line, with no preceding - whitespace, at the top of your config file:

    version 2

Backward compatibility patch

If the new defaults bite you, use this- ipsec.conf fragment to simulate the old default values.

Details

We've obsoleted various directives which almost no one was using:

    dump
-    plutobackgroundload
-    no_eroute_pass
-    lifetime
-    rekeystart
-    rekeytries

For most of these, there is some other way to elicit the desired - behaviour. See - this post.

We've made some settings, which almost everyone was using, defaults. - For example:

    interfaces=%defaultroute
-    plutoload=%search
-    plutostart=%search
-    uniqueids=yes

We've also changed some default values to help with OE and Policy - Groups:

    authby=rsasig   ## not secret!!!
-    leftrsasigkey=%dnsondemand ## looks up missing keys in DNS when needed.
-    rightrsasigkey=%dnsondemand

Of course, you can still override any defaults by explictly - declaring something else in your connection.

- A post with a list of many ipsec.conf changes. -
Current ipsec.conf manual. -

- -

Upgrading from 1.x RPMs to 2.x RPMs

Note: When upgrading from 1-series to 2-series RPMs, rpm -U - will not work.

You must instead erase the 1.x RPMs, then install the 2.x set:

    rpm -e freeswan

    rpm -e freeswan-module

On erasing, your old ipsec.conf should be moved to- ipsec.conf.rpmsave. Keep this. You will probably want to copy - your existing connections to the end of your new 2.x file.

Install the RPMs suitable for your kernel version, such as:

    rpm -ivh freeswan-module-2.04_2.4.20_20.9-0.i386.rpm

    rpm -ivh freeswan-userland-2.04_2.4.20_20.9-0.i386.rpm

Or, to splice the files:

    cat /etc/ipsec.conf /etc/ipsec.conf.rpmsave > /etc/ipsec.conf.tmp
-    mv /etc/ipsec.conf.tmp /etc/ipsec.conf

Then, remove the redundant conn %default andconfig - setup sections. Unless you have done any special configuring - here, you'll likely want to remove the 1.x versions. Removeconn - OEself, if present.

-Contents -Previous -Next - - -- cgit v1.2.3