Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'am trying to set up xauth with ipsec-tools on openwrt, my settings show below:
cat /etc/racoon.conf:

path include "/etc/racoon";
path pre_shared_key "/etc/racoon/psk.txt";
path certificate "/etc/racoon/cert";

listen {
    adminsock disabled;
}

timer
{
        natt_keepalive 10 sec;
}

remote anonymous
{
        exchange_mode aggressive,main;          #必须添加main,否则苹果的vpn client无法连接

        initial_contact on ;
        passive on ;

        proposal {
                encryption_algorithm aes;
                hash_algorithm sha1;
                authentication_method xauth_psk_server ;
                dh_group 2 ;
        }

        proposal_check obey;
        generate_policy on;
        dpd_delay 20;
        nat_traversal force;
        ike_frag on;
        esp_frag 552;
}

mode_cfg
{
        network4 211.153.68.231;              #VPN地址池
        pool_size 4;
        netmask4 255.255.255.0;
        auth_source system;                      #使用pam作为xauth的用户认证
        dns4 211.153.19.1;
        pfs_group 2;
        banner "/etc/racoon/motd" ;
}

sainfo anonymous
{
        pfs_group 2;
        lifetime time 1 hour ;
        encryption_algorithm aes ;
        authentication_algorithm hmac_sha1;
        compression_algorithm deflate ;
}

cat /etc/setkey.conf

flush;
spdflush;

spdadd 0.0.0.0/0[0] 0.0.0.0/0[1701] udp -P out ipsec esp/transport//require;
spdadd 0.0.0.0/0[1701] 0.0.0.0/0[0] udp -P in ipsec esp/transport//require;

cat /etc/racoon/psk.txt

test test

cat /etc/racoon/motd

welcome!

cat /etc/init.d/racoon

#!/bin/sh /etc/rc.common
# Copyright (C) 2009-2011 OpenWrt.org
# Copyright (C) 2011 Artem Makhutov

START=49

SERVICE_USE_PID=1

start() {
    mkdir -m 0700 -p /var/racoon
    [ -f /etc/ipsec.conf ] && /usr/sbin/setkey -f /etc/setkey.conf
    service_start /usr/sbin/racoon -f /etc/racoon.conf
}

stop() {
    service_stop /usr/sbin/racoon
}

then fire the server up:

root@OpenWrt:~# setkey -f /etc/setkey.conf
root@OpenWrt:~# racoon -F -f /etc/racoon.conf
Foreground mode.
2013-09-06 15:52:19: INFO: @(#)ipsec-tools 0.8.0 (http://ipsec-tools.sourceforge.net)
2013-09-06 15:52:19: INFO: @(#)This product linked OpenSSL 1.0.1e 11 Feb 2013 (http://www.openssl.org/)
2013-09-06 15:52:19: INFO: Reading configuration from "/etc/racoon.conf"
2013-09-06 15:52:19: WARNING: /etc/racoon.conf:33: "552" Your kernel does not support esp_frag
2013-09-06 15:52:19: INFO: Resize address pool from 0 to 4
2013-09-06 15:52:19: INFO: 10.129.228.201[500] used for NAT-T
2013-09-06 15:52:19: INFO: 10.129.228.201[500] used as isakmp port (fd=6)
2013-09-06 15:52:19: INFO: 10.129.228.201[4500] used for NAT-T
2013-09-06 15:52:19: INFO: 10.129.228.201[4500] used as isakmp port (fd=7)
2013-09-06 15:52:19: INFO: 127.0.0.0[500] used for NAT-T
2013-09-06 15:52:19: INFO: 127.0.0.0[500] used as isakmp port (fd=8)
2013-09-06 15:52:19: INFO: 127.0.0.0[4500] used for NAT-T
2013-09-06 15:52:19: INFO: 127.0.0.0[4500] used as isakmp port (fd=9)
2013-09-06 15:52:19: INFO: 127.0.0.1[500] used for NAT-T
2013-09-06 15:52:19: INFO: 127.0.0.1[500] used as isakmp port (fd=10)
2013-09-06 15:52:19: INFO: 127.0.0.1[4500] used for NAT-T
2013-09-06 15:52:19: INFO: 127.0.0.1[4500] used as isakmp port (fd=11)
2013-09-06 15:52:19: INFO: ::1[500] used as isakmp port (fd=12)
2013-09-06 15:52:19: INFO: ::1[4500] used as isakmp port (fd=13)
2013-09-06 15:52:19: INFO: fe80::a00:27ff:fec1:5c6b[500] used as isakmp port (fd=14)
2013-09-06 15:52:19: INFO: fe80::a00:27ff:fec1:5c6b[4500] used as isakmp port (fd=15)

I run it in foreground just for debug, then let's connect it with vpnc from another system of ubuntu12.04.2:

liunx@ubuntu:~$ sudo vpnc
[sudo] password for liunx:
Enter IPSec gateway address: 10.129.228.201
Enter IPSec ID for 10.129.228.201: test
Enter IPSec secret for test@10.129.228.201:(test)
Enter username for 10.129.228.201: root
Enter password for root@10.129.228.201:(123456)
vpnc: authentication unsuccessful

I got error messages from racoon:

2013-09-06 15:55:14: INFO: respond new phase 1 negotiation: 10.129.228.201[500]<=>10.129.228.200[500]
2013-09-06 15:55:14: INFO: begin Aggressive mode.
2013-09-06 15:55:14: INFO: received Vendor ID: draft-ietf-ipsra-isakmp-xauth-06.txt
2013-09-06 15:55:14: INFO: received Vendor ID: CISCO-UNITY
2013-09-06 15:55:14: INFO: received Vendor ID: RFC 3947
2013-09-06 15:55:14: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-03
2013-09-06 15:55:14: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-02

2013-09-06 15:55:14: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-02
2013-09-06 15:55:14: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-01
2013-09-06 15:55:14: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-00
2013-09-06 15:55:14: INFO: received Vendor ID: DPD
2013-09-06 15:55:14: [10.129.228.200] INFO: Selected NAT-T version: RFC 3947
2013-09-06 15:55:14: ERROR: invalied encryption algorithm=0.
2013-09-06 15:55:14: ERROR: invalied encryption algorithm=0.
2013-09-06 15:55:14: ERROR: invalied encryption algorithm=0.
2013-09-06 15:55:14: ERROR: invalied encryption algorithm=0.
2013-09-06 15:55:14: INFO: Adding remote and local NAT-D payloads.
2013-09-06 15:55:14: [10.129.228.200] INFO: Hashing 10.129.228.200[500] with algo #2 (NAT-T forced)
2013-09-06 15:55:14: [10.129.228.201] INFO: Hashing 10.129.228.201[500] with algo #2 (NAT-T forced)
2013-09-06 15:55:14: INFO: Adding xauth VID payload.
2013-09-06 15:55:14: INFO: NAT-T: ports changed to: 10.129.228.200[4500]<->10.129.228.201[4500]
2013-09-06 15:55:14: [10.129.228.200] ERROR: notification INITIAL-CONTACT received in aggressive exchange.
2013-09-06 15:55:14: INFO: received Vendor ID: CISCO-UNITY
2013-09-06 15:55:14: INFO: NAT-D payload #0 doesn't match
2013-09-06 15:55:14: INFO: NAT-D payload #1 doesn't match
2013-09-06 15:55:14: INFO: NAT detected: ME PEER
2013-09-06 15:55:14: INFO: Sending Xauth request
2013-09-06 15:55:14: INFO: ISAKMP-SA established 10.129.228.201[4500]-10.129.228.200[4500] spi:5f0e764b2ee4a7bd:a65bc2a2089f47f3
2013-09-06 15:55:14: INFO: Using port 0
2013-09-06 15:55:14: INFO: Released port 0
2013-09-06 15:55:14: INFO: login failed for user "root"
2013-09-06 15:55:14: ERROR: Attempt to release an unallocated address (port 0)
2013-09-06 15:55:14: ERROR: mode config 6 from 10.129.228.200[4500], but we have no ISAKMP-SA.

I'm sure I had setup the root's password as "123456", but I failed, so any tips?

share|improve this question
    
It is also off topic because requests for tutorials and end-to-end setup are off topic, and also I'm not sure it's reasonable to use openwrt this way in a professional context. If you can isolate a specific problem (you haven't even told us it's not working), it might be possible to help you with that, though this might be more at home at superuser.com. –  Falcon Momot Sep 6 '13 at 4:46
    
It's sure to use openwrt in this way, because openwrt include many server packages, it's smaller than a ubuntu server, so I can make experiment more easy. –  liunx Sep 6 '13 at 6:35
    
With respect, if you're sure it's the right tool, then you don't need our help. If, in fact, you're not quite sure about how to glue this all together, then you need to be open to the suggestion that you may have made some fundamental mistakes in the architecture. You might want to heed Falcon's suggestion to get specific in your question, and be open to both specific and architectural criticisms once you have done so. –  MadHatter Sep 6 '13 at 6:40
    
Oh, I'm sorry for my off topic question, so I update the environment to just ubuntu system, I just want to get the answer to how to set up xauth with ipsec to archive the effect as I described above, so any tips? –  liunx Sep 6 '13 at 6:57
    
That is not a specific question; the degree of specificity of a question is determined not by the precision of the question but by the likely answers. "How do I create life?" is a short question to ask, but the answers are long and hideously varied. If you can edit your question down to a specific, such as "To achieve W, I am trying to set up X. I was following the tutorials at Y and Z, but when I did A I got B instead of C, as you can see from this output." and still be open to answers that say "X is the wrong way to achieve W, try V", then we might get somewhere. –  MadHatter Sep 6 '13 at 7:18

1 Answer 1

up vote 0 down vote accepted

It's the problem of shadow password, when configuration time, the ipsec-tools will detect the shadow password or not of system, if the ipsec-tools compile with _HAVE_SHADOW_H_, then it wont parse right password with non-shadow password, so it failed, or vice verse.I have compare to ubuntu system, buildroot, they all work well.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.