ipsec.conf noma swanctl.conf? Khetha i-frontend eyodwa ye-strongSwan

Iphrofayela ye-IKEv1 esebenzayo evela kumhlahlandlela omdala ifika ku-Ubuntu 24.04, futhi umzamo wokuqala uyahluleka ngoba i-daemon ayikaze iyifunde leli fayela. Impendulo evamile ukuhlela iphrofayela futhi. Umbuzo wangempela ukuthi iyiphi i-frontend ye-strongSwan efakiwe nokuthi iyiphi esetshenziswa yisevisi esebenzayo. Kuze kube kuphendulwe lokho, zonke izinguquko zibhekisa kumgcini ongase ungabikho.

Amafayela amabili, abagcini ababili, i-daemon eyodwa

Isakhiwo sakudala se-starter sifunda i-ipsec.conf futhi sidlulisela ukuxhumana ku-charon ngokuhlangana kwaso sakudala kokuphatha. Indawo yaso yokungena yokusebenza umyalo we-ipsec.

Isakhiwo se-swanctl silayisha izincazelo nge-VICI, sifunda i-swanctl.conf, futhi siqhutshwa umyalo we-swanctl. I-daemon ye-charon eyakhelwe ku-systemd ihlangana nale ndlela.

Kokubili kungafakwa emshinini owodwa, futhi ukudideka kuqala khona lapho. Ifayela elingaphansi kwe-/etc likhombisa kuphela ukuthi othile walibhala, hhayi ukuthi inqubo esebenzayo ilifundile. Ukufaka zonke izindlela ukuze ubone okusebenzayo kwakha i-host enamathrekhi amabili okuphatha futhi engenaye umnikazi ocacile. Khetha isakhiwo esisodwa bese ususa noma ukhubaza esinye.

Funda amaphakethe nama-unit afakiwe

Qala ngendlela yokufunda kuphela. Amagama amaphakethe ku-Ubuntu 24.04 ahlukene: strongswan-starter, strongswan-swanctl ne-charon-systemd. Iphakethe elingekho ulwazi olusizayo, hhayi umyalo wokulifaka.

Bhala uhlu lwamaphakethe nama-unit ngokuhamba okukodwa:

dpkg-query -W strongswan-starter strongswan-swanctl charon-systemd
systemctl list-unit-files '*strongswan*'

Bese uhlola i-unit esebenzayo nomyalo wayo wokuqalisa. Igama le-unit litshela ukuthi iyiphi i-daemon ephethe ukucushwa, futhi umugqa womyalo uqinisekisa ukuthi yimaphi amafayela eyayitshelwe ukuwafunda. I-unit enikwe amandla kodwa engasebenzi ikhuluma indaba ehlukile kunaleya esebenzayo manje.

Uma i-unit esebenzayo iyi-strongswan-starter, ifayela elibalulekile yi-ipsec.conf. Uma kuyi-charon-systemd ene-swanctl, i-ipsec.conf iwumhlobiso nje.

Sebenzisa indlela yokuphatha efanele

Yonke i-frontend inombono wayo wokuxhumana nokuhlangana. I-swanctl --list-conns ikhombisa izincazelo ezilayishiwe futhi i-swanctl --list-sas ikhombisa ukuhlangana okusebenzayo. Indlela endala isebenzisa i-ipsec statusall.

Ukuzixuba kukhiqiza amaphutha adukisayo. Isokhethi ye-VICI engekho noma isicelo sokuphatha esenqatshiwe kuyinkinga yendlela yokuphatha, akubona ubufakazi bokuthi uhlangothi olulandelayo lwenqabile ukuqinisekisa.

Funda umbono ongowoku-daemon esebenzayo, bese utolika umphumela. Uma ukuxhumana kungekho kulo mbono, inkinga isekulayisheni, hhayi ezingxoxweni.

Ifomethi akuyona inguqulo ye-IKE

Iphrofayela endala ikhetha i-IKEv1 nge-keyexchange=ikev1. Ukuxhumana kwe-swanctl kusebenzisa isilungiselelo senguqulo, lapho u-1 ekhetha i-IKEv1. Lezi izichazamazwi ezimbili zomqondo owodwa, hhayi ukuguqulwa.

Amakheli ohlangothi olulandelayo, ubunikazi basendaweni nobude, imithombo yobufakazi, iziphakamiso nezinketho ze-child kufanele kuhlelwe ngamabomu. Ukunamathisela ibhlokhi ye-left/right kusintaksi ye-swanctl akwenzi lutho kulokho.

Ukushintsha inguqulo yephrothokholi kuphela ukufuduka okuhhafu okuvamile kakhulu. Kukhiqiza ifayela elilayishwayo bese lehluleka ukuqinisekisa ngenxa yezizathu ezingahlobene nenguqulo. I-IKEv1 ngokwayo isiphelelwe yisikhathi nge-RFC 9395, ngakho uhlangothi olulandelayo olukhona olusayifunayo lufanele ukuthola umkhawulo wokuhambisana obhaliwe nendlela yokufuduka, hhayi okuzenzakalelayo okusha.

Hlola umgcini ngaphambi kokuthinta iphrofayela

Qala ngokuhlola umgcini, bese ulayisha ukuxhumana okuhlosiwe, bese uhlola izingxoxo, ekugcineni indlela yokuhamba evikelwe. Isigaba ngasinye sinophawu lokwehluleka oluhlukile.

Izindlela ezimbili zokuphatha ziphendula ngqo umbuzo wokulayisha:

swanctl --list-conns
ipsec statusall

Kunomyalo owodwa kuphela kuleyo ewumyalo we-host yakho. Ukuqhuba kokubili nokuqhathanisa umphumela kuyindlela yokuthola ukuthi yikuphi okuqamba amanga kuwe, hhayi indlela yokuxilonga.

Thatha ubunikazi bamaphakethe, ukulayisha ukucushwa nokuhambisana kwephrothokholi njengemibuzo emithathu ehlukene. Ifayela elivumelekile ku-frontend eyodwa lizohlelwa kaningi ngesikhathi kuqhubeka enye i-daemon.