ipsec.conf ko swanctl.conf? Zaɓi frontend ɗaya na strongSwan

Bayanin IKEv1 mai aiki daga tsohon jagora ya sauka kan Ubuntu 24.04, kuma ƙoƙari na farko ya kasa domin daemon bai taɓa karanta fayil ɗin ba. Amsar da aka saba ita ce a sake gyara bayanin. Tambaya ta gaske ita ce wane frontend na strongSwan aka shigar kuma wanne sabis ɗin da ke gudana yake amfani da shi. Har sai an amsa wannan, kowane gyare-gyare yana fuskantar mai lodawa wanda wataƙila babu shi.

Fayiloli biyu, masu lodawa biyu, daemon ɗaya

Tsohon tsarin starter yana karanta ipsec.conf kuma yana ba da haɗin kai ga charon ta hanyar tsohuwar haɗin gwiwar gudanarwa. Matsayin shigarsa na aiki shi ne umarnin ipsec.

Tsarin swanctl yana loda ma'anoni ta VICI, yana karanta swanctl.conf, kuma umarnin swanctl ne ke tafiyar da shi. Daemon charon na asali na systemd yana haɗawa da wannan hanyar.

Dukansu ana iya shigar da su a na'ura ɗaya, kuma a nan ne ruɗani ya fara. Fayil a ƙarƙashin /etc yana tabbatar da cewa wani ya rubuta shi kawai, ba cewa tsarin da ke gudana ya loda shi ba. Shigar da kowane zaɓi don ganin wanne ke aiki yana haifar da host mai hanyoyin gudanarwa biyu kuma ba tare da mai shi bayyananne ba. Zaɓi tsari ɗaya ka cire ko ka kashe ɗayan.

Karanta fakitin da aka shigar da unit

Fara da yanayin karatu kawai. Sunayen fakitin a Ubuntu 24.04 daban ne: strongswan-starter, strongswan-swanctl da charon-systemd. Fakitin da ya ɓace bayani ne mai amfani, ba umarni ba ne a shigar da shi.

Yi lissafin fakitin da unit a lokaci ɗaya:

dpkg-query -W strongswan-starter strongswan-swanctl charon-systemd
systemctl list-unit-files '*strongswan*'

Sannan duba unit ɗin da ke aiki da umarnin farawarsa. Sunan unit yana gaya wane daemon ne ya mallaki saitin, kuma layin umarni yana tabbatar da waɗanne fayiloli aka umarce shi ya karanta. Unit da aka kunna amma ba ya aiki yana ba da wani labari daban da wanda ke gudana yanzu.

Idan unit ɗin da ke aiki shi ne strongswan-starter, fayil ɗin da ke da muhimmanci shi ne ipsec.conf. Idan charon-systemd ne tare da swanctl, to ipsec.conf kawai ado ne.

Yi amfani da hanyar sarrafawa da ta dace

Kowane frontend yana da nasa ra'ayi game da haɗin kai da ƙungiyoyi. swanctl --list-conns yana nuna ma'anoni da aka loda, swanctl --list-sas kuma yana nuna ƙungiyoyin da ke aiki. Tsohuwar hanya tana amfani da ipsec statusall.

Haɗa su yana haifar da kurakurai masu ruɗani. Rashin soket ɗin VICI ko ƙin buƙatar sarrafawa matsala ce ta hanyar gudanarwa, ba hujja ba ce cewa abokin ya ƙi tabbatarwa.

Karanta ra'ayin da ya shafi daemon ɗin da ke gudana, sannan ka fassara sakamakon. Idan haɗin ba ya cikin wannan ra'ayi, matsalar tana cikin lodawa, ba cikin tattaunawa ba.

Tsari ba sigar IKE ba ne

Tsohon bayani yana zaɓar IKEv1 da keyexchange=ikev1. Haɗin swanctl yana amfani da saitin siga, inda 1 ke zaɓar IKEv1. Waɗannan ƙamus biyu ne don tunani ɗaya, ba juyawa ba.

Adiresoshin abokin, asalin gida da na nesa, tushen shaidu, shawarwari da masu zaɓen child dole ne a tsara su da gangan. Manna blok ɗin left/right cikin tsarin swanctl ba ya yin kome daga ciki.

Canza sigar yarjejeniya kawai ita ce mafi yawan rabin ƙaura. Yana haifar da fayil da ke lodawa sannan ya kasa tabbatarwa saboda dalilai da ba su da alaƙa da sigar. IKEv1 da kansa RFC 9395 ya soke shi, don haka abokin da ke akwai wanda har yanzu yake buƙatarsa ya cancanci ƙayyadadden iyakar daidaituwa da aka rubuta da hanyar ƙaura, ba sabon tsoho ba.

Duba mai lodawa kafin ka taɓa bayanin

Fara gwajin mai lodawa, sannan ka loda haɗin da ake so, sannan ka tantance tattaunawa, sannan hanyar zirga-zirgar da aka kare. Kowane mataki yana da alamar gazawa daban.

Hanyoyin sarrafawa biyu suna amsa tambayar lodawa kai tsaye:

swanctl --list-conns
ipsec statusall

Ɗaya ne kawai daga cikin waɗannan umarnin na host ɗinka. Gudanar da duka biyu da kwatanta fitarwa hanya ce ta gano wanne ke yi maka ƙarya, ba hanyar bincike ba.

Dauki mallakar fakitin, lodawa saitin da daidaituwar yarjejeniya a matsayin tambayoyi uku daban. Fayil da ya inganta ga frontend ɗaya za a rika gyara shi akai-akai yayin da wani daemon ke gudana.