Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to setup a host-host configuration using strongSwan. I did manage to set it up using certificates and now I wish to set it up using certificates + EAP authentication.

I mixed this configuration with my previous certificate configuration and connected successfully. However, this configuration requires that the client will save the password locally. I must say that I don't understand why should I use a password instead of a certificate if it's saved locally anyway. What I want is to use 2 factor authentication - clients without a valid certificate should not be able to authenticate even if they know the password, and clients with a valid certificate should be prompted for a password when trying to connect. If I understand correctly, my options are:

  1. Use NetworkManager which can prompt for a password
  2. Use md5-id-prompt

I don't want to be bound to NetworkManager if I don't have to. The second option didn't work as ipsec stroke command on my machine doesn't have user-creds subcommand. This might be because I use strongSwan 4.x. Even if it did work, there are two major problems with this:

  1. The password has to be entered in the command line instead of being interactivly prompted by ipsec, which is a bad security practice.
  2. If I understand correctly, once the password was entered the ipsec daemon will remember it until it's restarted, instead of prompting for it in each connection.

Is there any way to accomplish my goal without using NetworkManager?

share|improve this question
add comment

1 Answer 1

up vote 1 down vote accepted

Is there any way to accomplish my goal without using NetworkManager?

Definitely not with strongSwan 4.x. In newer releases (since 5.1.0) you could use charon-cmd, which is a simple command line IKE client that will prompt you for EAP passwords.

The password has to be entered in the command line instead of being interactivly prompted by ipsec, which is a bad security practice.

The rw-eap-md5-id-prompt example is an automated test case, so naturally the password is provided directly on the command line when calling ipsec stroke user-creds. But if you don't do that you will be prompted for it interactively.

If I understand correctly, once the password was entered the ipsec daemon will remember it until it's restarted, instead of prompting for it in each connection.

Yes, that's correct. The username and password are cached until the daemon is restarted.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.