mirror/setup-ipsec-vpn
1
0
Fork 0
mirror of synced 2025-02-07 07:49:25 +03:00
Code Issues Projects Releases Wiki Activity

Improve VPN ciphers

Browse Source 
- Consolidate VPN ciphers for "ike=" and "phase2alg=" in ipsec.conf.
This commit is contained in:
hwdsl2 2017-01-18 21:13:00 -06:00
parent e40dd6219b
commit 63697214b4
6 changed files with 22 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
docs/ikev2-howto-zh.md
View File

@ -58,8 +58,8 @@ Libreswan 支持通过使用 RSA 签名算法的 X.509 Machine Certificates 来
ikev2=insist ikev2=insist
rekey=no rekey=no
fragmentation=yes fragmentation=yes
ike=3des-sha1,3des-sha1;modp1024,aes-sha1,aes-sha1;modp1024,aes256-sha2_512,aes256-sha2_512;modp1024,aes256-sha2_256,aes256-sha2_256;modp1024 ike=3des-sha1,3des-sha1;modp1024,aes-sha1,aes-sha1;modp1024,aes-sha2,aes-sha2;modp1024
phase2alg=3des-sha1,aes-sha1,aes256-sha2_512,aes256-sha2_256 phase2alg=3des-sha1,aes-sha1,aes-sha2
EOF EOF
``` ```

4
docs/ikev2-howto.md
View File

@ -58,8 +58,8 @@ Before continuing, make sure you have successfully <a href="https://github.com/h
ikev2=insist ikev2=insist
rekey=no rekey=no
fragmentation=yes fragmentation=yes
ike=3des-sha1,3des-sha1;modp1024,aes-sha1,aes-sha1;modp1024,aes256-sha2_512,aes256-sha2_512;modp1024,aes256-sha2_256,aes256-sha2_256;modp1024 ike=3des-sha1,3des-sha1;modp1024,aes-sha1,aes-sha1;modp1024,aes-sha2,aes-sha2;modp1024
phase2alg=3des-sha1,aes-sha1,aes256-sha2_512,aes256-sha2_256 phase2alg=3des-sha1,aes-sha1,aes-sha2
EOF EOF
``` ```

12
extras/vpnupgrade.sh
View File

@ -87,8 +87,9 @@ Replace this line:
with the following: with the following:
encapsulation=yes encapsulation=yes
Re-add "MODP1024" to the list of allowed "ike=" ciphers. Consolidate VPN ciphers for "ike=" and "phase2alg=".
(Removed from the default list in Libreswan 3.19) Re-add "MODP1024" to the list of allowed "ike=" ciphers,
which was removed from defaults in Libreswan 3.19.
Your other VPN configuration files will not be modified. Your other VPN configuration files will not be modified.
@ -158,9 +159,10 @@ fi
# Update ipsec.conf options # Update ipsec.conf options
sed -i.old -e "s/auth=esp/phase2=esp/" -e "s/forceencaps=yes/encapsulation=yes/" \ sed -i.old -e "s/auth=esp/phase2=esp/" -e "s/forceencaps=yes/encapsulation=yes/" \
-e "s/ike=3des-sha1,aes-sha1,aes256-sha2_512,aes256-sha2_256/ike=3des-sha1,3des-sha1;modp1024,aes-sha1,aes-sha1;modp1024,aes256-sha2_512,aes256-sha2_512;modp1024,aes256-sha2_256,aes256-sha2_256;modp1024/" \ -e "s/ike=3des-sha1,aes-sha1,aes256-sha2_512,aes256-sha2_256/ike=3des-sha1,3des-sha1;modp1024,aes-sha1,aes-sha1;modp1024,aes-sha2,aes-sha2;modp1024/" \
-e "s/ike=3des-sha1,aes-sha1,aes256-sha2_256/ike=3des-sha1,3des-sha1;modp1024,aes-sha1,aes-sha1;modp1024,aes256-sha2_256,aes256-sha2_256;modp1024/" \ -e "s/ike=3des-sha1,aes-sha1,aes256-sha2_256/ike=3des-sha1,3des-sha1;modp1024,aes-sha1,aes-sha1;modp1024,aes-sha2,aes-sha2;modp1024/" \
/etc/ipsec.conf -e "s/phase2alg=3des-sha1,aes-sha1,aes256-sha2_512,aes256-sha2_256/phase2alg=3des-sha1,aes-sha1,aes-sha2/" \
-e "s/phase2alg=3des-sha1,aes-sha1,aes256-sha2_256/phase2alg=3des-sha1,aes-sha1,aes-sha2/" /etc/ipsec.conf
# Restart IPsec service # Restart IPsec service
service ipsec restart service ipsec restart

12
extras/vpnupgrade_centos.sh
View File

@ -83,8 +83,9 @@ Replace this line:
with the following: with the following:
encapsulation=yes encapsulation=yes
Re-add "MODP1024" to the list of allowed "ike=" ciphers. Consolidate VPN ciphers for "ike=" and "phase2alg=".
(Removed from the default list in Libreswan 3.19) Re-add "MODP1024" to the list of allowed "ike=" ciphers,
which was removed from defaults in Libreswan 3.19.
Your other VPN configuration files will not be modified. Your other VPN configuration files will not be modified.
@ -155,9 +156,10 @@ restorecon /usr/local/libexec/ipsec -Rv 2>/dev/null
# Update ipsec.conf options # Update ipsec.conf options
sed -i.old -e "s/auth=esp/phase2=esp/" -e "s/forceencaps=yes/encapsulation=yes/" \ sed -i.old -e "s/auth=esp/phase2=esp/" -e "s/forceencaps=yes/encapsulation=yes/" \
-e "s/ike=3des-sha1,aes-sha1,aes256-sha2_512,aes256-sha2_256/ike=3des-sha1,3des-sha1;modp1024,aes-sha1,aes-sha1;modp1024,aes256-sha2_512,aes256-sha2_512;modp1024,aes256-sha2_256,aes256-sha2_256;modp1024/" \ -e "s/ike=3des-sha1,aes-sha1,aes256-sha2_512,aes256-sha2_256/ike=3des-sha1,3des-sha1;modp1024,aes-sha1,aes-sha1;modp1024,aes-sha2,aes-sha2;modp1024/" \
-e "s/ike=3des-sha1,aes-sha1,aes256-sha2_256/ike=3des-sha1,3des-sha1;modp1024,aes-sha1,aes-sha1;modp1024,aes256-sha2_256,aes256-sha2_256;modp1024/" \ -e "s/ike=3des-sha1,aes-sha1,aes256-sha2_256/ike=3des-sha1,3des-sha1;modp1024,aes-sha1,aes-sha1;modp1024,aes-sha2,aes-sha2;modp1024/" \
/etc/ipsec.conf -e "s/phase2alg=3des-sha1,aes-sha1,aes256-sha2_512,aes256-sha2_256/phase2alg=3des-sha1,aes-sha1,aes-sha2/" \
-e "s/phase2alg=3des-sha1,aes-sha1,aes256-sha2_256/phase2alg=3des-sha1,aes-sha1,aes-sha2/" /etc/ipsec.conf
# Restart IPsec service # Restart IPsec service
service ipsec restart service ipsec restart

4
vpnsetup.sh
View File

@ -219,8 +219,8 @@ conn shared
dpddelay=30 dpddelay=30
dpdtimeout=120 dpdtimeout=120
dpdaction=clear dpdaction=clear
ike=3des-sha1,3des-sha1;modp1024,aes-sha1,aes-sha1;modp1024,aes256-sha2_512,aes256-sha2_512;modp1024,aes256-sha2_256,aes256-sha2_256;modp1024 ike=3des-sha1,3des-sha1;modp1024,aes-sha1,aes-sha1;modp1024,aes-sha2,aes-sha2;modp1024
phase2alg=3des-sha1,aes-sha1,aes256-sha2_512,aes256-sha2_256 phase2alg=3des-sha1,aes-sha1,aes-sha2
sha2-truncbug=yes sha2-truncbug=yes
conn l2tp-psk conn l2tp-psk

4
vpnsetup_centos.sh
View File

@ -206,8 +206,8 @@ conn shared
dpddelay=30 dpddelay=30
dpdtimeout=120 dpdtimeout=120
dpdaction=clear dpdaction=clear
ike=3des-sha1,3des-sha1;modp1024,aes-sha1,aes-sha1;modp1024,aes256-sha2_512,aes256-sha2_512;modp1024,aes256-sha2_256,aes256-sha2_256;modp1024 ike=3des-sha1,3des-sha1;modp1024,aes-sha1,aes-sha1;modp1024,aes-sha2,aes-sha2;modp1024
phase2alg=3des-sha1,aes-sha1,aes256-sha2_512,aes256-sha2_256 phase2alg=3des-sha1,aes-sha1,aes-sha2
sha2-truncbug=yes sha2-truncbug=yes
conn l2tp-psk conn l2tp-psk