1IPSEC_AUTO(8) Executable programs IPSEC_AUTO(8)
2
6 ipsec_auto - control automatically-keyed IPsec connections
7
9 ipsec auto [--showonly] [--asynchronous]
10 [--config configfile] [--verbose] operation connection
11 ipsec auto [--showonly] [--asynchronous]
14 [--config configfile] [--verbose] operation connection
15
18 ipsec auto { --add | --delete | --replace | --up | --down } connection
19 ipsec auto { --status | --ready }
21 ipsec auto { --route | --unroute } connection
23 ipsec auto [--utc] [--listall | --rereadall] [--rereadsecrets]
25 [--listcerts] [--listpubkeys] [--checkpubkeys]
26 [--listcacerts | --rereadcacerts] [--listcrls | --rereadcrls]
27 [--listacerts | --rereadacerts] [--listaacerts | --rereadaacerts]
28 [--listgroups | --rereadgroups] [--purgeocsp]
29
31 Auto manipulates automatically-keyed Libreswan IPsec connections,
32 setting them up and shutting them down based on the information in the
33 IPsec configuration file. In the normal usage, connection is the name
34 of a connection specification in the configuration file; operation is
35 --add, --delete, --replace, --up, --down, --route, or --unroute. The
36 --ready, --rereadsecrets, --rereadgroups, and --status operations do
37 not take a connection name. Auto generates suitable commands and feeds
38 them to a shell for execution.
39 The --add operation adds a connection specification to the internal
41 database within pluto; it will fail if pluto already has a
42 specification by that name. The --delete operation deletes a connection
43 specification from pluto´s internal database (also tearing down any
44 connections based on it); The --replace operation is equivalent to
45 --delete (if there is already a loaded connection by the given name)
46 followed by --add, and is a convenience for updating pluto´s internal
47 specification to match an external one. (Note that a --rereadsecrets
48 may also be needed.) The --rereadgroups operation causes any changes to
49 the policy group files to take effect (this is currently a synonym for
50 --ready, but that may change). None of the other operations alters the
51 internal database.
52 The --up operation asks pluto to establish a connection based on an
54 entry in its internal database. The --down operation tells pluto to
55 tear down such a connection.
56 Normally, pluto establishes a route to the destination specified for a
58 connection as part of the --up operation. However, the route (for
59 KLIPS) and packet capture (KLIPS and NETKEY) can be established with
60 the --route operation. Until and unless an actual connection is
61 established, this discards any packets sent there, which may be
62 preferable to having them sent elsewhere based on a more general route
63 (e.g., a default route).
64 Normally, pluto´s route (KLIPS) or packet capture (NETKEY) to a
66 destination remains in place when a --down operation is used to take
67 the connection down (or if connection setup, or later automatic
68 rekeying, fails). This permits establishing a new connection (perhaps
69 using a different specification; the route is altered as necessary)
70 without having a “window” in which packets might go elsewhere based on
71 a more general route. Such a route can be removed using the --unroute
72 operation (and is implicitly removed by --delete).
73 The --ready operation tells pluto to listen for connection-setup
75 requests from other hosts. Doing an --up operation before doing --ready
76 on both ends is futile and will not work, although this is now
77 automated as part of IPsec startup and should not normally be an issue.
78 The --status operation asks pluto for current connection status. The
80 output format is ad-hoc and likely to change.
81 The --rereadsecrets operation tells pluto to re-read the
83 /etc/ipsec.secrets secret-keys file, which it normally reads only at
84 startup time. (This is currently a synonym for --ready, but that may
85 change.)
86 The --rereadsecrets operation tells pluto to re-read the
88 /etc/ipsec.secrets secret-keys file, which it normally reads only at
89 startup time. (This is currently a synonym for --ready, but that may
90 change.)
91 The --rereadcacerts operation reads all certificate files contained in
93 the /etc/ipsec.d/cacerts directory and adds them to pluto´s list of
94 Certification Authority (CA) certificates. Note CA certificates can and
95 should be stored inside NSS instead of in the /etc/ipsec.d/cacerts
96 directory which will result in automatic updates. This option will be
97 obsoleted in the near future.
98 The --rereadcrls operation reads all certificate revocation list (CRL)
100 files contained in the /etc/ipsec.d/crls directory and adds them to
101 pluto´s list of CRLs. Note CRLs can and should be stored inside NSS
102 instead of in the /etc/ipsec.d/crls directory which will result in
103 automatic updates. This option will be obsoleted in the near future.
104 The --rereadall operation is equivalent to the execution of
106 --rereadsecrets, --rereadcacerts and --rereadcrls.
107 The --listpubkeys operation lists all RSA public keys either received
109 from peers via the IKE protocol embedded in authenticated certificate
110 payloads or loaded locally using the rightcert / leftcert or rightr-
111 sasigkey / leftrsasigkey parameters in ipsec.conf(5).
112 The --listcerts operation lists all X.509 certificates loaded locally
114 using the rightcert and leftcert parameters in ipsec.conf(5). To see
115 all certificates in the NSS database, use certutil -d /etc/ipsec.d -L.
116 The --checkpubkeys operation lists all loaded X.509 certificates which
118 are about to expire or have been expired.
119 The --listcacerts operation lists all X.509 CA certificates contained
121 in the NSS database.
122 The --listgroups operation lists all groups that are either used in
124 connection definitions in ipsec.conf(5) or are embedded in loaded X.509
125 attributes certificates.
126 The --listcrls operation lists all Certificate Revocation Lists (CRLs)
128 either loaded locally from the /etc/ipsec.d/crls directory or fetched
129 dynamically from an HTTP or LDAP server.
130 The --listall operation is equivalent to the execution of
132 --listpubkeys, --listcerts, --listcacerts, --listgroups, --listcrls.
133 The --purgeocsp operation displays --listall and purges the NSS OCSP
135 cache.
136 The --showonly option causes auto to show the commands it would run, on
138 standard output, and not run them.
139 The --asynchronous option, applicable only to the up operation, tells
141 pluto to attempt to establish the connection, but does not delay to
142 report results. This is especially useful to start multiple connections
143 in parallel when network links are slow.
144 The --verbose option instructs auto to pass through all output from
146 ipsec_whack(8), including log output that is normally filtered out as
147 uninteresting.
148 The --config option specifies a non-standard location for the IPsec
150 configuration file (default /etc/ipsec.conf).
151 See ipsec.conf(5) for details of the configuration file.
153
155 /etc/ipsec.conf default IPSEC configuration file
156 /etc/ipsec.d/ X.509 and Opportunistic Encryption files
157 /var/run/pluto/pluto.ctl Pluto command socket
158
161 ipsec.conf(5), ipsec(8), ipsec_pluto(8), ipsec_whack(8)
162
164 Originally written for the FreeS/WAN project <http://www.freeswan.org>
165 by Henry Spencer.
166
168 Although an --up operation does connection setup on both ends, --down
169 tears only one end of the connection down (although the orphaned end
170 will eventually time out).
171 There is no support for passthrough connections.
173 A connection description which uses %defaultroute for one of its
175 nexthop parameters but not the other may be falsely rejected as
176 erroneous in some circumstances.
177 The exit status of --showonly does not always reflect errors discovered
179 during processing of the request. (This is fine for human inspection,
180 but not so good for use in scripts.)
181
183 Paul Wouters
184 placeholder to suppress warning
185libreswan 10/04/2017 IPSEC_AUTO(8)