1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
|
<html>
<head>
<meta http-equiv="Content-Type" content="text/html">
<title>Installing FreeS/WAN</title>
<meta name="keywords"
content="Linux, IPsec, VPN, security, FreeSWAN, installation, quickstart">
<!--
Written by Claudia Schmeing for the Linux FreeS/WAN project
Freely distributable under the GNU General Public License
More information at www.freeswan.org
Feedback to users@lists.freeswan.org
CVS information:
RCS ID: $Id: install.html,v 1.1 2004/03/15 20:35:24 as Exp $
Last changed: $Date: 2004/03/15 20:35:24 $
Revision number: $Revision: 1.1 $
CVS revision numbers do not correspond to FreeS/WAN release numbers.
-->
</head>
<BODY>
<H1><A name="install">Installing FreeS/WAN</A></H1>
<P>This document will teach you how to install Linux FreeS/WAN.
If your distribution comes with Linux FreeS/WAN, we offer
tips to get you started.</P>
<H2>Requirements</H2>
<P>To install FreeS/WAN you must:</P>
<UL>
<LI>be running Linux with the 2.4 or 2.2 kernel series. See
this <A HREF="http://www.freeswan.ca/download.php#contact">kernel
compatibility table</A>.<BR>We also have experimental support for
2.6 kernels. Here are two basic approaches:
<UL><LI>
install FreeS/WAN, including its <A HREF="ipsec.html#parts">KLIPS</A>
kernel code. This will remove the native IPsec stack and replace it
with KLIPS.</LI>
<LI>
install the FreeS/WAN <A HREF="ipsec.html#parts">userland tools</A>
(keying daemon and supporting
scripts) for use with
<A HREF="http://lartc.org/howto/lartc.ipsec.html">2.6 kernel native IPsec</A>,
</LI>
</UL>
See also these <A HREF="2.6.known-issues">known issues with 2.6</A>.
<LI>have root access to your Linux box</LI>
<LI>choose the version of FreeS/WAN you wish to install based on
<A HREF="http://www.freeswan.org/mail.html">mailing list reports</A> <!-- or
our updates page (coming soon)--></LI>
</UL>
<H2>Choose your install method</H2>
<P>There are three basic ways to get FreeS/WAN onto your system:</P>
<UL>
<LI>activating and testing a FreeS/WAN that <A HREF="#distroinstall">shipped
with your Linux distribution</A></LI>
<LI><A HREF="#rpminstall">RPM install</A></LI>
<LI><A HREF="#srcinstall">Install from source</A></LI>
</UL>
<A NAME="distroinstall"></A><H2>FreeS/WAN ships with some Linuxes</H2>
<P>FreeS/WAN comes with <A HREF="intro.html#distwith">these distributions</A>.
<P>If you're running one of these, include FreeS/WAN in the choices you
make during installation, or add it later using the distribution's tools.
</P>
<H3>FreeS/WAN may be altered...</H3>
<P>Your distribution may have integrated extra features, such as Andreas
Steffen's X.509 patch, into FreeS/WAN. It may also use custom
startup script locations or directory names.</P>
<H3>You might need to create an authentication keypair</H3>
<P>If your FreeS/WAN came with your distribution, you may wish to
generate a fresh RSA key pair. FreeS/WAN will use these keys
for authentication.
<P>
To do this, become root, and type:
</P>
<PRE> ipsec newhostkey --output /etc/ipsec.secrets --hostname xy.example.com
chmod 600 /etc/ipsec.secrets</PRE>
<P>where you replace xy.example.com with your machine's fully-qualified
domain name. Generate some randomness, for example by wiggling your mouse,
to speed the process.
</P>
<P>The resulting ipsec.secrets looks like:</P>
<PRE>: RSA {
# RSA 2192 bits xy.example.com Sun Jun 8 13:42:19 2003
# for signatures only, UNSAFE FOR ENCRYPTION
#pubkey=0sAQOFppfeE3cC7wqJi...
Modulus: 0x85a697de137702ef0...
# everything after this point is secret
PrivateExponent: 0x16466ea5033e807...
Prime1: 0xdfb5003c8947b7cc88759065...
Prime2: 0x98f199b9149fde11ec956c814...
Exponent1: 0x9523557db0da7a885af90aee...
Exponent2: 0x65f6667b63153eb69db8f300dbb...
Coefficient: 0x90ad00415d3ca17bebff123413fc518...
}
# do not change the indenting of that "}"</PRE>
<P>In the actual file, the strings are much longer.</P>
<H3>Start and test FreeS/WAN</H3>
<P>You can now <A HREF="install.html#starttest">start FreeS/WAN and
test whether it's been successfully installed.</A>.</P>
<A NAME="rpminstall"></A><H2>RPM install</H2>
<P>These instructions are for a recent Red Hat with a stock Red Hat kernel.
We know that Mandrake and SUSE also produce FreeS/WAN RPMs. If you're
running either, install using your distribution's tools.</P>
<H3>Download RPMs</H3>
<P>Decide which functionality you need:</P>
<UL>
<LI>standard FreeS/WAN RPMs. Use these shortcuts:<BR>
<UL>
<LI>(for 2.6 kernels: userland only)<BR>
ncftpget ftp://ftp.xs4all.nl/pub/crypto/freeswan/binaries/RedHat-RPMs/\*userland*</LI>
<LI>(for 2.4 kernels)<BR>
ncftpget ftp://ftp.xs4all.nl/pub/crypto/freeswan/binaries/RedHat-RPMs/`uname -r | tr -d 'a-wy-z'`/\*</LI>
<LI>
or view all the offerings at our
<A href="ftp://ftp.xs4all.nl/pub/crypto/freeswan/binaries/RedHat-RPMs">FTP site</A>.
</LI></UL>
</LI>
<LI>unofficial
<A href="http://www.freeswan.ca/download.php">Super FreeS/WAN</A>
RPMs, which include Andreas Steffen's X.509 patch and more.
Super FreeS/WAN RPMs do not currently include
<A HREF="glossary.html#NAT.gloss">Network Address Translation</A>
(NAT) traversal, but Super FreeS/WAN source does.</LI>
</UL>
<A NAME="2.6.rpm"></A>
<P>For 2.6 kernels, get the latest FreeS/WAN userland RPM, for example:</P>
<PRE> freeswan-userland-2.04.9-0.i386.rpm</PRE>
<P>Note: FreeS/WAN's support for 2.6 kernel IPsec is preliminary. Please see
<A HREf="2.6.known-issues">2.6.known-issues</A>, and the latest
<A HREF="http://www.freeswan.org/mail.html">mailing list reports</A>.</P>
<P>Change to your new FreeS/WAN directory, and make and install the
<P>For 2.4 kernels, get both kernel and userland RPMs.
Check your kernel version with</P>
<PRE> uname -r</PRE>
<P>Get a kernel module which matches that version. For example:</P>
<PRE> freeswan-module-2.04_2.4.20_20.9-0.i386.rpm</PRE>
<P>Note: These modules
<B>will only work on the Red Hat kernel they were built for</B>,
since they are very sensitive to small changes in the kernel.</P>
<P>Get FreeS/WAN utilities to match. For example:</P>
<PRE> freeswan-userland-2.04_2.4.20_20.9-0.i386.rpm</PRE>
<H3>For freeswan.org RPMs: check signatures</H3>
<P>While you're at our ftp site, grab the RPM signing key</P>
<PRE> freeswan-rpmsign.asc</PRE>
<P>If you're running RedHat 8.x or later, import this key into the RPM
database:</P>
<PRE> rpm --import freeswan-rpmsign.asc</PRE>
<P>For RedHat 7.x systems, you'll need to add it to your
<A HREF="glossary.html#PGP">PGP</A> keyring:</P>
<PRE> pgp -ka freeswan-rpmsign.asc</PRE>
<P>Check the digital signatures on both RPMs using:</P>
<PRE> rpm --checksig freeswan*.rpm </PRE>
<P>You should see that these signatures are good:</P>
<PRE> freeswan-module-2.04_2.4.20_20.9-0.i386.rpm: pgp md5 OK
freeswan-userland-2.04_2.4.20_20.9-0.i386.rpm: pgp md5 OK</PRE>
<H3>Install the RPMs</H3>
<P>Become root:</P>
<PRE> su</PRE>
<P>For a first time install, use:</P>
<PRE> rpm -ivh freeswan*.rpm</PRE>
<P>To upgrade existing RPMs (and keep all .conf files in place), use:</P>
<PRE> rpm -Uvh freeswan*.rpm</PRE>
<P>If you're upgrading from FreeS/WAN 1.x to 2.x RPMs, and encounter problems,
see <A HREF="upgrading.html#upgrading.rpms">this note</A>.</P>
<H3>Start and Test FreeS/WAN</H3>
<P>Now, <A HREF="install.html#starttest">start FreeS/WAN and test your
install</A>.</P>
<A NAME="srcinstall"></A><H2>Install from Source</H2>
<!-- Most of this section, along with "Start and Test", can replace
INSTALL. -->
<H3>Decide what functionality you need</H3>
<P>Your choices are:</P>
<UL>
<LI><A HREF="ftp://ftp.xs4all.nl/pub/crypto/freeswan">standard
FreeS/WAN</A>,</LI>
<LI>standard FreeS/WAN plus any of these
<A HREF="web.html#patch">user-supported patches</A>, or</LI>
<LI><A HREF="http://www.freeswan.ca/download">Super FreeS/WAN</A>,
an unofficial FreeS/WAN pre-patched with many of the above. Provides
additional algorithms, X.509, SA deletion, dead peer detection, and
<A HREF="glossary.html#NAT.gloss">Network Address Translation</A>
(NAT) traversal.</LI>
</UL>
<H3>Download FreeS/WAN</H3>
<P>Download the source tarball you've chosen, along with any patches.</P>
<H3>For freeswan.org source: check its signature</H3>
<P>While you're at our ftp site, get our source signing key</P>
<PRE> freeswan-sigkey.asc</PRE>
<P>Add it to your PGP keyring:</P>
<PRE> pgp -ka freeswan-sigkey.asc</PRE>
<P>Check the signature using:</P>
<PRE> pgp freeswan-2.04.tar.gz.sig freeswan-2.04.tar.gz</PRE>
<P>You should see something like:</P>
<PRE> Good signature from user "Linux FreeS/WAN Software Team (build@freeswan.org)".
Signature made 2002/06/26 21:04 GMT using 2047-bit key, key ID 46EAFCE1</PRE>
<!-- Note to self: build@freeswan.org has angled brackets in the original.
Changed because it conflicts with HTML tags. -->
<H3>Untar, unzip</H3>
<P>As root, unpack your FreeS/WAN source into <VAR>/usr/src</VAR>.</P>
<PRE> su
mv freeswan-2.04.tar.gz /usr/src
cd /usr/src
tar -xzf freeswan-2.04.tar.gz
</PRE>
<H3>Patch if desired</H3>
<P>Now's the time to add any patches. The contributor may have special
instructions, or you may simply use the patch command.</P>
<H3>... and Make</H3>
<P>Choose one of the methods below.</P>
<H4>Userland-only Install for 2.6 kernels</H4>
<A NAME="2.6.src"></A>
<P>Note: FreeS/WAN's support for 2.6 kernel IPsec is preliminary. Please see
<A HREf="2.6.known-issues">2.6.known-issues</A>, and the latest
<A HREF="http://www.freeswan.org/mail.html">mailing list reports</A>.</P>
<P>Change to your new FreeS/WAN directory, and make and install the
FreeS/WAN userland tools.</P>
<PRE> cd /usr/src/freeswan-2.04
make programs
make install</PRE>
<P>Now, <A HREF="install.html#starttest">start FreeS/WAN and
test your install</A>.</P>
<H4>KLIPS install for 2.2, 2.4, or 2.6 kernels</H4>
<A NAME="modinstall"></A>
<P>To make a modular version of KLIPS, along with other FreeS/WAN programs
you'll need, use the command sequence below. This will
change to your new FreeS/WAN directory, make the FreeS/WAN module (and other
stuff), and install it all.</P>
<PRE> cd /usr/src/freeswan-2.04
make oldmod
make minstall</PRE>
<P><A HREF="install.html#starttest">Start FreeS/WAN and
test your install</A>.</P>
<P>To link KLIPS statically into your kernel (using your old kernel settings),
and install other FreeS/WAN components, do:
</P>
<PRE> cd /usr/src/freeswan-2.04
make oldmod
make minstall</PRE>
<P>Reboot your system and <A HREF="install.html#testonly">test your
install</A>.</P>
<P>For other ways to compile KLIPS, see our Makefile.</P>
<A name="starttest"></A><H2>Start FreeS/WAN and test your install</H2>
<P>Bring FreeS/WAN up with:</P>
<PRE> service ipsec start</PRE>
<P>This is not necessary if you've rebooted.</P>
<A name="testonly"></A><H2>Test your install</H2>
<P>To check that you have a successful install, run:</P>
<PRE> ipsec verify</PRE>
<P>You should see at least:</P>
<PRE>
Checking your system to see if IPsec got installed and started correctly
Version check and ipsec on-path [OK]
Checking for KLIPS support in kernel [OK]
Checking for RSA private key (/etc/ipsec.secrets) [OK]
Checking that pluto is running [OK]
</PRE>
<P>If any of these first four checks fails, see our
<A href="trouble.html#install.check">troubleshooting guide</A>.
</P>
<H2>Making FreeS/WAN play well with others</H2>
<P>There are at least a couple of things on your system that might
interfere with FreeS/WAN, and now's a good time to check these:</P>
<UL>
<LI>Firewalling. You need to allow UDP 500 through your firewall, plus
ESP (protocol 50) and AH (protocol 51). For more information, see our
updated firewalls document (coming soon).
</LI>
<LI>Network address translation.
Do not NAT the packets you will be tunneling.</LI>
</UL>
<H2>Configure for your needs</H2>
<P>You'll need to configure FreeS/WAN for your local site. Have a look at our
<A HREF="quickstart.html">opportunism quickstart guide</A> to see if that
easy method is right for your needs. Or, see how to <A HREF="config.html">
configure a network-to-network or Road Warrior style VPN</A>.
</P>
</BODY>
</HTML>
|
