1

We have installed and configured a strongswan VPN server with username / password authentication. Is it possible to store the users' credentials in a MySQL backend and configure strongswan to use the backend for this purpose?

So far I just found a mysql plugin for configuration purposes and Xauth backends using AAA, radius, etc. . Unfortunately this is not what we need.

2

The sql plugin provides configuration details but also credentials stored in a database. It's not required to store everything in the database and the data can be combined with that provided by other plugins. So it is possible to use the stroke plugin to provide configurations from ipsec.conf and certificates from /etc/ipsec.d/ but define the username and passwords used for EAP/XAuth authentication in a database instead of in ipsec.secrets. The driver provided by the mysql plugin is required by the sql plugin to access MySQL databases.

As mentioned above, you are free to ignore the tables that provide configurations and instead just define the secrets and usernames in the shared_secrets and identities tables, respectively, and associated them via the shared_secret_identity table. The id2sql script (not installed but built in the scripts folder in the strongSwan build directory) provides an easy way to generate entries for the identities table.

Here is some example SQL data (more information regarding the types can be found here):

INSERT INTO identities (
  type, data
) VALUES ( /* type=ID_RFC822_ADDR, data=carol@strongswan.org */
  3, X'6361726f6c407374726f6e677377616e2e6f7267'
);

INSERT INTO shared_secrets (
  type, data
) VALUES ( /* type=SHARED_EAP/XAUTH, data=Ar3etTnp01qlpOgb */
  2, X'4172336574546e703031716c704f6762'
);

/* assumes the entries above are the first ones in their respective
 * tables, as their id column is auto_increment */
INSERT INTO shared_secret_identity (
  shared_secret, identity
) VALUES (
  1, 1 
);
2

For anyone that stumbles upon this, I used this excellent guide: https://www.cl.cam.ac.uk/~mas90/resources/strongswan to do the basic setup and then the setup the database entries as above.

Afterwards, I use free letsencrypt certificates and the CN="myvpnserver.mydomain.com" so I set leftcert=myvpnserver.mydomain.com in my ipsec.conf. I then added an entry into the mysql table identities with type '2' and data 'myvpnserver.mydomain.com' (have to use id2sql script from strongswan to convert the data entry). Then I got the automatically assigned id number for that entry from the my identities database and the shared secret id like the previous entry in order to make an entry into shared_secret_identity like this:

INSERT INTO shared_secret_identity (shared_secret, identity) VALUES ( id_of_user_logging_in_that_was_set_in_shared_secrets_database, automatically_assigned_id_number_for_myvpnser.mydomain.com_in_identities_database );

After that it worked.

0
# Configure StrongSwan + FreeRADIUS (MariaDB Backend) - CentOS7

# Install Require Packages :
[root@strongswan ~]# yum install -y epel-release
[root@strongswan ~]# yum update && yum install -y gcc gcc-c++ pam-devel zlib-devel systemd-devel openssl-devel
[root@strongswan ~]# yum install -y freeradius freeradius-mysql freeradius-utils mariadb mariadb-server

# Download StrongSwan :
[root@strongswan ~]# wget http://www.strongswan.org/download/strongswan-5.5.0.tar.gz
[root@strongswan ~]# tar zvxf strongswan-5.5.tar.gz
[root@strongswan ~]# cd strongswan-5.5.0

# Compile StrongSwan :
[root@strongswan ~]# ./configure --prefix=/usr --sysconfdir=/etc/strongswan --localstatedir=/var --enable-unity --enable-xauth-eap --enable-eap-identity --enable-eap-md5 --enable-xauth-pam --enable-eap-tls --enable-eap-radius --enable-eap-mschapv2 --enable-dhcp --enable-systemd --enable-eap-dynamic --enable-openssl --enable-addrblock --enable-certexpire --enable-radattr --enable-swanctl --disable-gmp
[root@strongswan ~]# make && make install

# Generate Certificates :
[root@strongswan ~]# cd /etc/strongswan/ipsec.d/
[root@strongswan ipsec.d]# ipsec pki --gen --type rsa --size 2048 --outform pem > private/strongswanKey.pem
[root@strongswan ipsec.d]# ipsec pki --self --ca --lifetime 3650 --in private/strongswanKey.pem --type rsa --dn "C=Ir, O=IT, CN=StrongSwanVPN" --outform pem > cacerts/strongswanCert.pem

[root@strongswan ipsec.d]# ipsec pki --gen --type rsa --size 2048 --outform pem > private/vpnHostKey.pem
[root@strongswan ipsec.d]# chmod 600 private/vpnHostKey.pem

[root@strongswan ipsec.d]# ipsec pki --pub --in private/vpnHostKey.pem --type rsa | ipsec pki --issue --lifetime 730 --cacert cacerts/strongswanCert.pem --cakey private/strongswanKey.pem --dn "C=Ir, O=IT, CN=StrongSwanVPN" --san 192.168.1.1 --flag serverAuth --outform pem > certs/vpnHostCert.pem

# Generate Client Certificate :
[root@strongswan ipsec.d]# ipsec pki --gen --type rsa --size 2048 --outform pem > private/ClientKey.pem
[root@strongswan ipsec.d]# chmod 600 private/ClientKey.pem
[root@strongswan ipsec.d]# ipsec pki --pub --in private/ClientKey.pem --type rsa | ipsec pki --issue --lifetime 730 --cacert cacerts/strongswanCert.pem --cakey private/strongswanKey.pem --dn "C=Ir, O=IT, CN=StrongSwanVPN" --outform pem > certs/ClientCert.pem

# Export CLIENT CERTIFICATE As a PKCS#12 File :
[root@strongswan ipsec.d]# openssl pkcs12 -export -inkey private/ClientKey.pem -in certs/ClientCert.pem -name "Client's VPN Certificate" -certfile cacerts/strongswanCert.pem -caname "strongSwan Root CA" -out Client.p12

# Configure StrongSwan :
[root@strongswan ~]# vim /etc/strongswan/ipsec.conf
------------------------
config setup
   uniqueids=no

conn    standard_ikev2
        keyexchange=ikev2
        ike=aes256-sha256-modp1024,3des-sha1-modp1024,aes256-sha1-modp1024!
        esp=aes256-sha256,3des-sha1,aes256-sha1!
        fragmentation=no
        rekey=no
        left=192.168.1.1
        leftsendcert=always
        leftfirewall=yes
        leftsubnet=0.0.0.0/0
        leftcert=vpnHostCert.pem
        right=%any
        rightauth=eap-radius
        rightsourceip=10.0.0.0/24
        eap_identity=%any
        dpdaction=clear
        auto=add
------------------------
[root@strongswan ~]# vim /etc/strongswan/ipsec.secrets
: RSA vpnHostKey.pem

[root@strongswan ~]# vim /etc/strongswan/strongswan.conf
------------------------
charon {
      load_modular = yes  
      compress = yes
         plugins {
            include strongswan.d/charon/*.conf
               eap-radius {
                    servers {
                        server-a {
                            accounting = yes
                            secret = 123456
                            address = 192.168.1.1
                            auth_port = 1812
                            acct_port = 1813
                        }
                    }
                }
        }

    include strongswan.d/*.conf
}
------------------------
[root@strongswan ~]# vim /etc/sysctl.conf
net.ipv4.ip_forward = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0

# start strongswan service :
[root@strongswan ~]# systemctl start strongswan && systemctl enable strongswan

# Configure FreeRADIUS :
[root@strongswan ~]# vim /etc/raddb/mods-available/sql
------------------------
database = "mysql"
driver = "rlm_sql_mysql"
server = "localhost"
port = 3306
login = "radius"
password = "radius-password"
radius_db = "radius"
read_clients = yes
------------------------

# Enable sql Module :
[root@strongswan ~]# ln -s /etc/raddb/mods-available/sql /etc/raddb/mods-enabled/sql

# Comment "files" and Uncomment "sql" :
[root@strongswan ~]# vim /etc/raddb/sites-available/default

# Comment -> "files" and Uncomment -> "sql" :
[root@strongswan ~]# vim /etc/raddb/sites-available/inner-tunnel

[root@strongswan ~]# vim /etc/raddb/client.conf
------------------------
client 0.0.0.0 {
        secret          = 123456
        nas_type        = other
        shortname       = 0.0.0.0
        require_message_authenticator = no
}
------------------------
[root@strongswan ~]# cat /etc/strongswan/ipsec.d/cacerts/strongswanCert.pem > /etc/raddb/certs/ca.pem
[root@strongswan ~]# cat /etc/strongswan/ipsec.d/certs/vpnHostCert.pem > /etc/raddb/certs/server.pem
[root@strongswan ~]# cat /etc/strongswan/ipsec.d/private/vpnHostKey.pem > /etc/raddb/certs/server.key
[root@strongswan ~]# cat /etc/raddb/certs/server.key >> /etc/raddb/certs/server.pem

# start radiusd service :
[root@strongswan ~]# systemctl start radiusd && systemctl enable radiusd

## Configure MariaDB :
[root@strongswan ~]# systemctl start mariadb && systemctl enable mariadb
[root@strongswan ~]# mysql_secure_installation

[root@strongswan ~]# mysql -u root -p
Enter Password: ******

MariaDB> create database radius;
MariaDB> grant all privileges on radius.* to radius@localhost identified by "radius-password";
MariaDB> flush privileges;
MariaDB> use radius;
MariaDB> source /etc/raddb/mods-config/sql/main/mysql/schema.sql;

# add username|password :
MariaDB> INSERT INTO radcheck (username,attribute,op,VALUE) VALUES ('ehsan','Cleartext-Password',':=','eh@12345');
MariaDB> INSERT INTO radcheck (username,attribute,op,VALUE) VALUES ('alireza','Cleartext-Password',':=','abc123');

protected by Community Aug 7 at 17:43

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.