I have a working Strongswan IKEv2 VPN, i uses eap-mschapv2 as right auth. It's working fine as long as I use the ipsec.secrets file to store the user credentials.

# ipsec.secrets file
: RSA vpn-server-key.pem
arav %any : EAP "accessit"

But I want to change it to store these secrets in a MySQL database. I've connected the mysql database in the sql.conf file i just want to know how to insert these user credentials in MySQL table.

On refering this guide: https://wiki.strongswan.org/projects/strongswan/wiki/SQLite

It doesn't store the secrets in plain text but it uses any kind of encryption to do so. Can anyone tell me how to do that ?

Any help will be appreciated


It doesn't store the secrets in plain text but it uses any kind of encryption to do so.

That's not the case. The secrets are stored in plain text. So just insert the shared secrets and identities as indicated on the referenced wiki page (using your example data):

/* type: ID_FQDN, data: arav */
INSERT INTO identities (type, data) VALUES (2, X'61726176');
/* type: SHARED_EAP, data: accessit */
INSERT INTO shared_secrets (type, data) VALUES (2, X'6361656373737469');
/* to associate the identity with the secret, use the actual ids of the two rows above */
INSERT INTO shared_secret_identity (shared_secret, identity) VALUES (1, 1);
  • I followed your steps but still receiving the same error Aug 4 11:42:03 ip-172-31-34-103 charon: 07[IKE] no EAP key found for hosts '' - 'arav' – Varun Taliyan Aug 4 '17 at 12:15
  • the code in sql.conf file is sql { load = yes database = mysql://ipsec:accessit@localhost/ipsec } – Varun Taliyan Aug 4 '17 at 12:17
  • Check the log for errors when the sql plugin is initialized (make sure that it is actually loaded in the first place). – ecdsa Aug 4 '17 at 14:26
  • using ipsec statusall, it shows that it is being loaded, but I'm not sure whether it is pulling the secrets from the database or not? When i place my username in the database it get connected and when i dont, it refused to connect and says the authetication failed in logs. – Varun Taliyan Aug 8 '17 at 4:19
  • You obviously have to associate the password with the username (as outlined in my answer), how else could the password be found? – ecdsa Aug 8 '17 at 6:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.