ipsec.conf mise swanctl.conf? Dooro hal frontend strongSwan ah

Borofil IKEv1 shaqaynaya oo ka yimid hagaha duug ah ayaa soo gaadha Ubuntu 24.04, isku daygii ugu horreeyayna wuu guuldarraystaa sababtoo ah daemon-ku waligiis ma akhriyin faylka. Jawaabta caadiga ah waa in borofilka mar kale la tafatirto. Su'aasha dhabta ah waa keeni frontend strongSwan ayaa lagu rakibay iyo kee ay isticmaasho adeegga socda. Ilaa taas laga jawaabo, tafatir kastaa wuxuu u jeedaa raraha laga yaabo inuusan jirin.

Laba fayl, laba raraha, hal daemon

Habka starter-ka duug ah wuxuu akhriyaa ipsec.conf oo isku xirka u gudbiyaa charon iyada oo loo marayo is-dhexgalka maamulka duug ah. Barta gelitaanka hawlgalku waa amarka ipsec.

Habka swanctl wuxuu qeexitaanno ku rarayaa VICI, akhriyaa swanctl.conf, waxaana maamula amarka swanctl. Daemon-ka charon ee asalka u ah systemd wuu la midoobaa habkan.

Labadaba waxaa lagu rakibi karaa isla mishiin, halkaasayna jahawareerku ka bilaabataa. Fayl ku jira /etc wuxuu caddeynayaa oo keliya in qof qoray, ma aha in hawsha socota ay rartay. Rakibidda beddel kasta si loo arko kee shaqeeya waxay abuurtaa marti-geli leh laba waddo oo maamul iyo milkiile aan caddayn. Dooro hal hab oo ka saar ama dami kan kale.

Akhri xirmooyinka iyo unit-yada la rakibay

Ku bilow qaab akhris-keliya. Magacyada xirmooyinka Ubuntu 24.04 way kala duwan yihiin: strongswan-starter, strongswan-swanctl iyo charon-systemd. Xirmo maqan waa macluumaad faa'iido leh, ma aha tilmaan in la rakibo.

Hal mar ku tax xirmooyinka iyo unit-yada:

dpkg-query -W strongswan-starter strongswan-swanctl charon-systemd
systemctl list-unit-files '*strongswan*'

Kadib fiiri unit-ka firfircoon iyo amarka bilowgiisa. Magaca unit-ku wuxuu sheegaa daemon-ka leh habaynta, khadka amarkuna wuxuu xaqiijiyaa faylasha la sheegay inuu akhriyo. Unit la daariyay laakiin aan firfircoonayn wuxuu sheegaa sheeko ka duwan kan hadda socda.

Haddii unit-ka firfircoon yahay strongswan-starter, faylka muhiimka ahi waa ipsec.conf. Haddii uu yahay charon-systemd oo swanctl la socda, ipsec.conf waa uun qurxin.

Isticmaal waddada kontoroolka ee ku habboon

Frontend kastaa wuxuu leeyahay aragtidiisa isku xirka iyo ururrada. swanctl --list-conns wuxuu muujiyaa qeexitaannada la raray, swanctl --list-sas-na ururrada firfircoon. Waddada duug ah waxay isticmaashaa ipsec statusall.

Isku qasiddoodu waxay abuurtaa khaladaad marin-habiil ah. Socket VICI maqan ama codsi kontorool oo la diiday waa dhibaato waddada maamulka, ma aha caddeyn in dhinaca kale uu diiday xaqiijinta.

Akhri aragtida u gaar ah daemon-ka socda, kadib fasir natiijada. Haddii isku xirku ka maqan yahay aragtidaas, dhibaatadu waa rarista, ma aha gorgortanka.

Qaabku ma aha nooca IKE

Borofil duug ah wuxuu doortaa IKEv1 isagoo isticmaalaya keyexchange=ikev1. Isku xirka swanctl wuxuu isticmaalaa dejinta nooca, halkaas oo 1 uu doorto IKEv1. Kuwani waa laba qaamuus oo isla fikrad ah, ma aha beddelaad.

Cinwaannada dhinaca kale, aqoonsiga gudaha iyo fog, ilaha aqoonsiga, soo jeedinta iyo doorashada child waa in si ula kac ah loo khariideeyaa. Ku dhejinta block left/right ee qoraalka swanctl wax kama qabato taas.

Beddelaadda nooca borotokoolka oo keliya waa kala-guurka badhka ee ugu caansan. Waxay abuurtaa fayl la raro oo kadib ku guuldarraysta xaqiijinta sababo aan la xiriirin nooca. IKEv1 laftiisa waa la duugay RFC 9395, sidaas darteed dhinaca kale ee jira ee wali u baahan wuxuu mudan yahay xaddidaad waafaqid la diiwaangeliyay iyo waddo kala-guur, ma aha caadi cusub.

Hubi raraha ka hor inta aadan taaban borofilka

Marka hore orod hubinta raraha, kadib rar isku xirka loogu talagalay, kadib qiimee gorgortanka, ugu dambayntiina waddada taraafikada la ilaaliyay. Marxalad kastaa waxay leedahay calaamad guuldarro oo kala duwan.

Laba waddo oo kontorool ayaa si toos ah uga jawaaba su'aasha rarista:

swanctl --list-conns
ipsec statusall

Kaliya mid ka mid ah amarradan ayaa leh marti-gelkaaga. Orod labadaba oo isbarbardhig wax soo saarka waa hab lagu ogaado kee kuu sheegaya been, ma aha hab baaritaan.

U qaado milkiilaha xirmooyinka, rarista habaynta iyo waafaqid borotokoolka saddex su'aalood oo kala duwan. Fayl ansax u ah hal frontend haddii kale waa dib loo tafatiri doonaa marar badan inta daemon kale socdo.