web-dev-qa-db-ja.com

生のRSAキーを信頼するようにstrongSwanを構成する方法

IKEv2認証（テスト目的）に生のRSAキーを使用する必要がありますが、リモート認証用にそれらを「信頼」するようにstrongSwan（5.1.2）を構成できません。

ipsec.conf：

conn %default
     left=%defaultroute
     leftrsasigkey=/etc/ssh/hostkey
     auto=add

conn pyike
     right=%any
     rightrsasigkey=/media/psf/Home/p/pyike/tests/strongswan.pem
     authby=rsasig

ipsec.secrets：

: RSA /media/psf/Home/p/pyike/tests/strongswan.pem

demo.log（charondebug 4）：

Apr  1 15:04:33 duke charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.1.1, Linux 3.2.0-4-AMD64, x86_64)
Apr  1 15:04:33 duke charon: 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'
Apr  1 15:04:33 duke charon: 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'
Apr  1 15:04:33 duke charon: 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'
Apr  1 15:04:33 duke charon: 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'
Apr  1 15:04:33 duke charon: 00[CFG] loading crls from '/etc/ipsec.d/crls'
Apr  1 15:04:33 duke charon: 00[CFG] loading secrets from '/etc/ipsec.secrets'
Apr  1 15:04:33 duke charon: 00[CFG] expanding file expression '/var/lib/strongswan/ipsec.secrets.inc' failed
Apr  1 15:04:33 duke charon: 00[CFG]   loaded IKE secret for %any
Apr  1 15:04:33 duke charon: 00[LIB] building CRED_PRIVATE_KEY - RSA failed, tried 9 builders
Apr  1 15:04:33 duke charon: 00[CFG]   loading private key from '/media/psf/Home/p/pyike/tests/strongswan.pem' failed
Apr  1 15:04:33 duke charon: 00[LIB] loaded plugins: charon aes rc2 sha1 sha2 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default stroke updown
Apr  1 15:04:33 duke charon: 00[LIB] unable to load 3 plugin features (3 due to unmet dependencies)
Apr  1 15:04:33 duke charon: 00[LIB] dropped capabilities, running as uid 0, gid 0
Apr  1 15:04:33 duke charon: 00[JOB] spawning 16 worker threads
Apr  1 15:04:33 duke charon: 11[CFG] received stroke: add connection 'pyike'
Apr  1 15:04:33 duke charon: 11[CFG] left nor right Host is our side, assuming left=local
Apr  1 15:04:33 duke charon: 11[LIB]   file coded in unknown format, discarded
Apr  1 15:04:33 duke charon: 11[LIB] building CRED_CERTIFICATE - TRUSTED_PUBKEY failed, tried 3 builders
Apr  1 15:04:33 duke charon: 11[CFG]   loading public key for "%any" from '/etc/ssh/hostkey' failed
Apr  1 15:04:33 duke charon: 11[CFG]   loaded RSA public key for "%any" from '/media/psf/Home/p/pyike/tests/strongswan.pem'
Apr  1 15:04:33 duke charon: 11[CFG] added configuration 'pyike'


Apr  1 15:06:23 duke charon: 13[NET] received packet: from 10.1.48.48[51126] to 10.1.54.85[500] (424 bytes)
Apr  1 15:06:23 duke charon: 13[ENC] parsed IKE_SA_INIT request 0 [ SA KE No ]
Apr  1 15:06:23 duke charon: 13[IKE] 10.1.48.48 is initiating an IKE_SA
Apr  1 15:06:23 duke charon: 13[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(MULT_AUTH) ]
Apr  1 15:06:23 duke charon: 13[NET] sending packet: from 10.1.54.85[500] to 10.1.48.48[51126] (392 bytes)
Apr  1 15:06:23 duke charon: 14[NET] received packet: from 10.1.48.48[51126] to 10.1.54.85[500] (432 bytes)
Apr  1 15:06:23 duke charon: 14[ENC] parsed IKE_AUTH request 1 [ IDi AUTH SA TSi TSr ]
Apr  1 15:06:23 duke charon: 14[CFG] looking for peer configs matching 10.1.54.85[%any]...10.1.48.48[[email protected]]
Apr  1 15:06:23 duke charon: 14[CFG] selected peer config 'pyike'
Apr  1 15:06:23 duke charon: 14[IKE] no trusted RSA public key found for '[email protected]'
Apr  1 15:06:23 duke charon: 14[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]
Apr  1 15:06:23 duke charon: 14[NET] sending packet: from 10.1.54.85[500] to 10.1.48.48[51126] (80 bytes)
rsastrongswan
2
Kimvais
Apr  1 15:04:33 duke charon: 11[LIB]   file coded in unknown format, discarded
Apr  1 15:04:33 duke charon: 11[LIB] building CRED_CERTIFICATE - TRUSTED_PUBKEY failed, tried 3 builders
Apr  1 15:04:33 duke charon: 11[CFG]   loading public key for "%any" from '/etc/ssh/hostkey' failed

left|rightsigkeyを介したファイルからのSSH公開鍵のロードは、 バージョン5.2. より前のstrongSwanではサポートされていませんでした。

回避策として、次のようにキーを構成できます。

leftsigkey=ssh:0sAAAAB3NzaC1yc2EA...

ここで、ssh:0sの後にBase64でエンコードされたSSH公開鍵が続きます。この構文のサポートは strongSwan 5.1. で追加されました。

1
ecdsa