Is there a way to configure Libreswan to opportunistically create an IPSec SA with a remote host by preloading certificates or keys from hosts we trust?
I'm looking for Libreswan configuration that would allow a group of RHEL, CentOS, or Fedora hosts to establish IPSec SAs among themselves without having to specify a "conn" section for each host to host connection. To explain what I mean, I'll give an example. I have hosts alpha, bravo, charlie, and delta. Currently I have a configuration section similar to the following for each of the six connections (Alpha <--> Bravo, Alpha <--> Charlie, Alpha <--> Delta, Bravo <--> Charlie, Bravo <--> Delta, Charlie <--> Delta):
conn alpha+bravo
[email protected]
left=10.1.2.3
leftrsasigkey=
[email protected]
right=10.1.2.4
rightrsasigkey=
authby=rsasig
auto=start
While my current configuration that allows six hosts to communicate via IPSec works, I'm worried about its ability to scale since the number of configuration sections equals (n*(n-1))/2. For just 20 hosts I'd need 190 configuration sections! I wrote the following perl program to make it easy to generate the configuration from a CSV file with nickname, IP address, and key.
#!/usr/bin/perl
#use strict;
use warnings;
sub usage {
$0 =~ /([^\/]+)$/;
my $name = $&;
print "$name [host+keyfile]
each line of host+keyfile should contain the short hostname,
IP address,
and the key returned from 'ipsec showhostkey --left'\n
This program then outputs ipsec.conf content to support
all of the connections.
\n";
exit 1;
}
if ( !defined $ARGV[0] ) {
usage;
}
open (STDI, "$ARGV[0]") or die "Can't open input file: $!";
my $section=0;
my @hosts = <STDI> ;
my (@a, @b) ;
#foreach $i (@hosts) {
for ($i = 0; $i < $#hosts ; $i++) {
for ($j = $i+1 ; $j <= $#hosts ; $j++) {
@a = split(/,/,$hosts[$i]);
@b = split(/,/,$hosts[$j]);
print "conn $a[0]+$b[0]\n";
print "\tleftid=\@$a[0]\n";
print "\tleft=$a[1]\n";
print "\tleftrsasigkey=$a[2]";
print "\trightid=\@$b[0]\n";
print "\tright=$b[1]\n";
print "\trightrsasigkey=$b[2]";
print "\tauthby=rsasig\n";
print "\tauto=start\n\n";
}
}
close STDI;
So again, this worked for me, but for 100 hosts, my configuration file will be 19 MB! What I really want to know is what's the right way to use libreswan to set up host to host IPSec SAs / VPNs among a large number of hosts?