1

Is there a way to configure Libreswan to opportunistically create an IPSec SA with a remote host by preloading certificates or keys from hosts we trust?

I'm looking for Libreswan configuration that would allow a group of RHEL, CentOS, or Fedora hosts to establish IPSec SAs among themselves without having to specify a "conn" section for each host to host connection. To explain what I mean, I'll give an example. I have hosts alpha, bravo, charlie, and delta. Currently I have a configuration section similar to the following for each of the six connections (Alpha <--> Bravo, Alpha <--> Charlie, Alpha <--> Delta, Bravo <--> Charlie, Bravo <--> Delta, Charlie <--> Delta):

conn alpha+bravo
     [email protected]
     left=10.1.2.3
     leftrsasigkey=
     [email protected]
     right=10.1.2.4
     rightrsasigkey=
     authby=rsasig
     auto=start

While my current configuration that allows six hosts to communicate via IPSec works, I'm worried about its ability to scale since the number of configuration sections equals (n*(n-1))/2. For just 20 hosts I'd need 190 configuration sections! I wrote the following perl program to make it easy to generate the configuration from a CSV file with nickname, IP address, and key.

#!/usr/bin/perl

#use strict;
use warnings;

sub usage {
    $0 =~ /([^\/]+)$/;
    my $name = $&;
    print "$name [host+keyfile]
    each line of host+keyfile should contain the short hostname,
    IP address,
    and the key returned from 'ipsec showhostkey --left'\n
    This program then outputs ipsec.conf content to support
    all of the connections.
    \n";
    exit 1;
}

if ( !defined $ARGV[0] ) {
    usage;
}

open (STDI, "$ARGV[0]") or die "Can't open input file: $!";

my $section=0;

my @hosts = <STDI> ;
my (@a, @b) ;

#foreach $i (@hosts) {

for ($i = 0; $i < $#hosts ; $i++) {
    for ($j = $i+1 ; $j <= $#hosts ; $j++) {
        @a = split(/,/,$hosts[$i]);
        @b = split(/,/,$hosts[$j]);
        print "conn $a[0]+$b[0]\n";
        print "\tleftid=\@$a[0]\n";
        print "\tleft=$a[1]\n";
        print "\tleftrsasigkey=$a[2]";
        print "\trightid=\@$b[0]\n";
        print "\tright=$b[1]\n";
        print "\trightrsasigkey=$b[2]";
        print "\tauthby=rsasig\n";
        print "\tauto=start\n\n";
    }
}

close STDI;

So again, this worked for me, but for 100 hosts, my configuration file will be 19 MB! What I really want to know is what's the right way to use libreswan to set up host to host IPSec SAs / VPNs among a large number of hosts?

2
  • It's been a decade since I've touched IPSec, but this used to be called opportunistic encryption—does LibreSWAN not have it?
    – derobert
    Commented Dec 21, 2016 at 20:13
  • 1
    I believe it does, but I would like tunnels only to be set up when I have the remote host's public key stored locally. Otherwise the opportunistic encryption is vulnerable to MITM attacks.
    – Liczyrzepa
    Commented Dec 21, 2016 at 20:15

0

You must log in to answer this question.

Browse other questions tagged .