mirror/setup-ipsec-vpn
1
0
Fork 0
mirror of synced 2025-02-12 10:09:24 +03:00
Code Issues Projects Releases Wiki Activity

Improve upgrade scripts

Browse Source 
- Better handling of updating ipsec.conf for Libreswan >= 3.19
- Other minor changes
This commit is contained in:
hwdsl2 2017-02-07 20:59:47 -06:00
parent 8c0940f63b
commit e31c378b44
2 changed files with 16 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
extras/vpnupgrade.sh
View File

@ -72,9 +72,9 @@ This is intended for use on servers running an older version of Libreswan.
EOF EOF
cat <<'EOF' cat <<'EOF'
!!! IMPORTANT NOTE !!! IMPORTANT NOTES:
The new Libreswan version 3.19 requires some configuration changes. Libreswan versions 3.19 and newer require some configuration changes.
This script will make the following changes to your /etc/ipsec.conf: This script will make the following changes to your /etc/ipsec.conf:
Replace this line: Replace this line:
@ -89,7 +89,7 @@ with the following:
Consolidate VPN ciphers for "ike=" and "phase2alg=". Consolidate VPN ciphers for "ike=" and "phase2alg=".
Re-add "MODP1024" to the list of allowed "ike=" ciphers, Re-add "MODP1024" to the list of allowed "ike=" ciphers,
which was removed from defaults in Libreswan 3.19. which was removed from the defaults in Libreswan 3.19.
Your other VPN configuration files will not be modified. Your other VPN configuration files will not be modified.
@ -157,15 +157,14 @@ if ! /usr/local/sbin/ipsec --version 2>/dev/null | grep -qs -F "$swan_ver"; then
exiterr "Libreswan $swan_ver failed to build." exiterr "Libreswan $swan_ver failed to build."
fi fi
# Update ipsec.conf options # Update ipsec.conf for Libreswan 3.19 and newer
IKE_NEW=" ike=3des-sha1,3des-sha1;modp1024,aes-sha1,aes-sha1;modp1024,aes-sha2,aes-sha2;modp1024" IKE_NEW=" ike=3des-sha1,3des-sha1;modp1024,aes-sha1,aes-sha1;modp1024,aes-sha2,aes-sha2;modp1024"
PHASE2_NEW=" phase2alg=3des-sha1,aes-sha1,aes-sha2" PHASE2_NEW=" phase2alg=3des-sha1,aes-sha1,aes-sha2"
sed -i.old -e "s/^[[:space:]]\+auth=esp\$/ phase2=esp/" \ sed -i".old-$(date +%Y-%m-%d-%H:%M:%S)" \
-e "s/^[[:space:]]\+auth=esp\$/ phase2=esp/" \
-e "s/^[[:space:]]\+forceencaps=yes\$/ encapsulation=yes/" \ -e "s/^[[:space:]]\+forceencaps=yes\$/ encapsulation=yes/" \
-e "s/^[[:space:]]\+ike=3des-sha1,aes-sha1\$/$IKE_NEW/" \ -e "s/^[[:space:]]\+ike=.\+\$/$IKE_NEW/" \
-e "s/^[[:space:]]\+ike=3des-sha1,aes-sha1,aes256-sha2_512,aes256-sha2_256\$/$IKE_NEW/" \ -e "s/^[[:space:]]\+phase2alg=.\+\$/$PHASE2_NEW/" /etc/ipsec.conf
-e "s/^[[:space:]]\+phase2alg=3des-sha1,aes-sha1\$/$PHASE2_NEW/" \
-e "s/^[[:space:]]\+phase2alg=3des-sha1,aes-sha1,aes256-sha2_512,aes256-sha2_256\$/$PHASE2_NEW/" /etc/ipsec.conf
# Restart IPsec service # Restart IPsec service
service ipsec restart service ipsec restart

17
extras/vpnupgrade_centos.sh
View File

@ -68,9 +68,9 @@ This is intended for use on servers running an older version of Libreswan.
EOF EOF
cat <<'EOF' cat <<'EOF'
!!! IMPORTANT NOTE !!! IMPORTANT NOTES:
The new Libreswan version 3.19 requires some configuration changes. Libreswan versions 3.19 and newer require some configuration changes.
This script will make the following changes to your /etc/ipsec.conf: This script will make the following changes to your /etc/ipsec.conf:
Replace this line: Replace this line:
@ -85,7 +85,7 @@ with the following:
Consolidate VPN ciphers for "ike=" and "phase2alg=". Consolidate VPN ciphers for "ike=" and "phase2alg=".
Re-add "MODP1024" to the list of allowed "ike=" ciphers, Re-add "MODP1024" to the list of allowed "ike=" ciphers,
which was removed from defaults in Libreswan 3.19. which was removed from the defaults in Libreswan 3.19.
Your other VPN configuration files will not be modified. Your other VPN configuration files will not be modified.
@ -154,15 +154,14 @@ restorecon /etc/ipsec.d/*db 2>/dev/null
restorecon /usr/local/sbin -Rv 2>/dev/null restorecon /usr/local/sbin -Rv 2>/dev/null
restorecon /usr/local/libexec/ipsec -Rv 2>/dev/null restorecon /usr/local/libexec/ipsec -Rv 2>/dev/null
# Update ipsec.conf options # Update ipsec.conf for Libreswan 3.19 and newer
IKE_NEW=" ike=3des-sha1,3des-sha1;modp1024,aes-sha1,aes-sha1;modp1024,aes-sha2,aes-sha2;modp1024" IKE_NEW=" ike=3des-sha1,3des-sha1;modp1024,aes-sha1,aes-sha1;modp1024,aes-sha2,aes-sha2;modp1024"
PHASE2_NEW=" phase2alg=3des-sha1,aes-sha1,aes-sha2" PHASE2_NEW=" phase2alg=3des-sha1,aes-sha1,aes-sha2"
sed -i.old -e "s/^[[:space:]]\+auth=esp\$/ phase2=esp/" \ sed -i".old-$(date +%Y-%m-%d-%H:%M:%S)" \
-e "s/^[[:space:]]\+auth=esp\$/ phase2=esp/" \
-e "s/^[[:space:]]\+forceencaps=yes\$/ encapsulation=yes/" \ -e "s/^[[:space:]]\+forceencaps=yes\$/ encapsulation=yes/" \
-e "s/^[[:space:]]\+ike=3des-sha1,aes-sha1\$/$IKE_NEW/" \ -e "s/^[[:space:]]\+ike=.\+\$/$IKE_NEW/" \
-e "s/^[[:space:]]\+ike=3des-sha1,aes-sha1,aes256-sha2_512,aes256-sha2_256\$/$IKE_NEW/" \ -e "s/^[[:space:]]\+phase2alg=.\+\$/$PHASE2_NEW/" /etc/ipsec.conf
-e "s/^[[:space:]]\+phase2alg=3des-sha1,aes-sha1\$/$PHASE2_NEW/" \
-e "s/^[[:space:]]\+phase2alg=3des-sha1,aes-sha1,aes256-sha2_512,aes256-sha2_256\$/$PHASE2_NEW/" /etc/ipsec.conf
# Restart IPsec service # Restart IPsec service
service ipsec restart service ipsec restart