1STRONGSWAN(8)                     strongSwan                     STRONGSWAN(8)
2
3
4

NAME

6       strongswan - invoke IPsec utilities
7

SYNOPSIS

9       strongswan command [arguments] [options]
10

DESCRIPTION

12       The  strongswan  utility  invokes  any of several utilities involved in
13       controlling and monitoring the IPsec encryption/authentication  system,
14       running  the specified command with the specified arguments and options
15       as if it had been invoked directly. This  largely  eliminates  possible
16       name  collisions with other software, and also permits some centralized
17       services.
18
19       All the commands described in this manual page  are  built-in  and  are
20       used  to  control and monitor IPsec connections as well as the IKE dae‐
21       mon.
22
23       For other commands strongswan supplies the invoked command with a suit‐
24       able PATH environment variable, and also provides the environment vari‐
25       ables listed under ENVIRONMENT.
26
27   CONTROL COMMANDS
28       start [starter options]
29              calls starter which in turn parses ipsec.conf and starts the IKE
30              daemon charon.
31
32       update sends  a  HUP  signal  to  starter  which in turn determines any
33              changes in ipsec.conf and updates the configuration on the  run‐
34              ning IKE daemon charon.
35
36       reload sends  a  USR1 signal to starter which in turn reloads the whole
37              configuration of the running IKE daemon charon based on the  ac‐
38              tual ipsec.conf.
39
40       restart
41              is  equivalent to stop followed by start after a guard of 2 sec‐
42              onds.
43
44       stop   terminates all IPsec connections and stops the IKE daemon charon
45              by sending a TERM signal to starter.
46
47       up name
48              tells the IKE daemon to start up connection name.
49
50       down name
51              tells the IKE daemon to terminate connection name.
52
53       down name{n}
54              terminates  IKEv1  Quick  Mode  and IKEv2 CHILD SA instance n of
55              connection name.
56
57       down name{*}
58              terminates all IKEv1 Quick Mode and  IKEv2 CHILD SA instances of
59              connection name.
60
61       down name[n]
62              terminates IKE SA instance n of connection name.
63
64       down name[*]
65              terminates all IKE SA instances of connection name.
66
67       down-srcip <start> [<end>]
68              terminates  all IKE SA instances with clients having virtual IPs
69              in the range start-end.
70
71       route name
72              tells the IKE daemon to insert an IPsec policy in the kernel for
73              connection  name.  The  first  payload packet matching the IPsec
74              policy will automatically trigger an IKE connection setup.
75
76       unroute name
77              remove the IPsec policy in the kernel for connection name.
78
79       status [name]
80              returns concise status information either on connection name  or
81              if the argument is lacking, on all connections.
82
83       statusall [name]
84              returns detailed status information either on connection name or
85              if the argument is lacking, on all connections.
86
87   LIST COMMANDS
88       leases [<poolname> [<address>]]
89              returns the status of all or the selected IP  address  pool  (or
90              even a single virtual IP address).
91
92       listalgs
93              returns  a  list  supported  cryptographic algorithms usable for
94              IKE, and their corresponding plugin.
95
96       listpubkeys [--utc]
97              returns a list of RSA public keys that were either loaded in raw
98              key format or extracted from X.509 and|or OpenPGP certificates.
99
100       listcerts [--utc]
101              returns  a  list  of X.509 and|or OpenPGP certificates that were
102              either loaded locally by the IKE daemon or received via the  IKE
103              protocol.
104
105       listcacerts [--utc]
106              returns  a  list  of X.509 Certification Authority (CA) certifi‐
107              cates that were loaded  locally  by  the  IKE  daemon  from  the
108              /etc/strongswan/ipsec.d/cacerts/  directory  or received via the
109              IKE protocol.
110
111       listaacerts [--utc]
112              returns a list of X.509 Authorization  Authority  (AA)  certifi‐
113              cates  that  were  loaded  locally  by  the  IKE daemon from the
114              /etc/strongswan/ipsec.d/aacerts/ directory.
115
116       listocspcerts [--utc]
117              returns a list of X.509 OCSP Signer certificates that  were  ei‐
118              ther    loaded    locally   by   the   IKE   daemon   from   the
119              /etc/strongswan/ipsec.d/ocspcerts/ directory or were sent by  an
120              OCSP server.
121
122       listacerts [--utc]
123              returns  a list of X.509 Attribute certificates that were loaded
124              locally by the IKE daemon from  the  /etc/strongswan/ipsec.d/ac‐
125              erts/ directory.
126
127       listgroups [--utc]
128              returns a list of groups that are used to define user authoriza‐
129              tion profiles.
130
131       listcainfos [--utc]
132              returns certification authority  information  (CRL  distribution
133              points,  OCSP  URIs,  LDAP servers) that were defined by ca sec‐
134              tions in ipsec.conf.
135
136       listcrls [--utc]
137              returns a list of Certificate Revocation Lists (CRLs) that  were
138              either     loaded     by     the    IKE    daemon    from    the
139              /etc/strongswan/ipsec.d/crls directory or fetched from an  HTTP-
140              or LDAP-based CRL distribution point.
141
142       listocsp [--utc]
143              returns revocation information fetched from OCSP servers.
144
145       listplugins
146              returns a list of all loaded plugin features.
147
148       listcounters [name]
149              returns a list of global or connection specific IKE counter val‐
150              ues collected since daemon startup.
151
152       listall [--utc]
153              returns all information generated by the  list  commands  above.
154              Each list command can be called with the --utc option which dis‐
155              plays all dates in UTC instead of local time.
156
157   REREAD COMMANDS
158       rereadsecrets
159              flushes and rereads all secrets defined in ipsec.secrets.
160
161       rereadcacerts
162              removes previously loaded CA certificates, reads all certificate
163              files contained in the /etc/strongswan/ipsec.d/cacerts directory
164              and adds them to the list of Certification Authority  (CA)  cer‐
165              tificates.  This does not affect certificates explicitly defined
166              in a ipsec.conf(5) ca section, which may be  separately  updated
167              using the update command.
168
169       rereadaacerts
170              removes previously loaded AA certificates, reads all certificate
171              files contained in the /etc/strongswan/ipsec.d/aacerts directory
172              and  adds  them to the list of Authorization Authority (AA) cer‐
173              tificates.
174
175       rereadocspcerts
176              reads    all    certificate    files    contained     in     the
177              /etc/strongswan/ipsec.d/ocspcerts/  directory  and  adds them to
178              the list of OCSP signer certificates.
179
180       rereadacerts
181              reads    all    certificate    files    contained     in     the
182              /etc/strongswan/ipsec.d/acerts/  directory  and adds them to the
183              list of attribute certificates.
184
185       rereadcrls
186              reads  all Certificate  Revocation Lists (CRLs) contained in the
187              /etc/strongswan/ipsec.d/crls/  directory  and  adds  them to the
188              list of CRLs.
189
190       rereadall
191              executes all reread commands listed above.
192
193   RESET COMMANDS
194       resetcounters [name]
195              resets global or connection specific counters.
196
197   PURGE COMMANDS
198       purgecerts
199              purges all cached certificates.
200
201       purgecrls
202              purges all cached CRLs.
203
204       purgeike
205              purges IKE SAs that don't have a Quick Mode or CHILD SA.
206
207       purgeocsp
208              purges all cached OCSP information records.
209
210   INFO COMMANDS
211       --help returns the usage information for the strongswan command.
212
213       --version
214              returns the version in the form of Linux strongSwan U<strongSwan
215              userland version>/K<Linux kernel version> if strongSwan uses the
216              native NETKEY IPsec stack of the Linux kernel it is running on.
217
218       --versioncode
219              returns the version number in the form of U<strongSwan  userland
220              version>/K<Linux  kernel  version> if strongSwan uses the native
221              NETKEY IPsec stack of the Linux kernel it is running on.
222
223       --copyright
224              returns the copyright information.
225
226       --directory
227              returns the LIBEXECDIR directory as defined by the configure op‐
228              tions.
229
230       --confdir
231              returns the SYSCONFDIR directory as defined by the configure op‐
232              tions.
233
234       --piddir
235              returns the PIDDIR directory as defined  by  the  configure  op‐
236              tions.
237

FILES

239       /usr/libexec/strongswan       utilities directory
240

ENVIRONMENT

242       When calling other commands the strongswan command supplies the follow‐
243       ing environment variables.
244
245       IPSEC_DIR               directory containing ipsec programs and utilities
246       IPSEC_BINDIR            directory containing pki command
247       IPSEC_SBINDIR           directory containing ipsec command
248       IPSEC_CONFDIR           directory containing configuration files
249       IPSEC_PIDDIR            directory containing PID/socket files
250       IPSEC_SCRIPT            name of the ipsec script
251       IPSEC_NAME              name of ipsec distribution
252       IPSEC_VERSION           version number of ipsec userland and kernel
253       IPSEC_STARTER_PID       PID file for ipsec starter
254       IPSEC_CHARON_PID        PID file for IKE keying daemon
255

SEE ALSO

257       ipsec.conf(5), ipsec.secrets(5)
258

HISTORY

260       Originally written for the FreeS/WAN project by Henry Spencer.  Updated
261       and  extended for the strongSwan project <http://www.strongswan.org> by
262       Tobias Brunner and Andreas Steffen.
263
264
265
2665.9.11                            2013-10-29                     STRONGSWAN(8)
Impressum