1IPSEC_AUTO(8) [FIXME: manual] IPSEC_AUTO(8)
2
6 ipsec_auto - control automatically-keyed IPsec connections
7
9 ipsec auto [--show] [--showonly] [--asynchronous]
10 [--config configfile] [--verbose] operation connection
11 ipsec auto [--show] [--showonly] [--asynchronous]
14 [--config configfile] [--verbose] operation connection
15
18 ipsec auto { --add | --delete | --replace | --up | --down } connection
19 ipsec auto { --status | --ready }
21 ipsec auto { --route | --unroute } connection
23 ipsec auto [--utc] [--listall | --rereadall] [--rereadsecrets]
25 [--listcerts] [--listpubkeys] [--listcacerts | --rereadcacerts]
26 [--listcrls | --rereadcrls]
27 [[--listocspcerts | --rereadocspcerts ] [--listocsp | --purgeocsp ]]
28 [--listgroups | --rereadgroups]
29
31 Auto manipulates automatically-keyed Openswan IPsec connections,
32 setting them up and shutting them down based on the information in the
33 IPsec configuration file. In the normal usage, connection is the name
34 of a connection specification in the configuration file; operation is
35 --add, --delete, --replace, --up, --down, --route, or --unroute. The
36 --ready, --rereadsecrets, --rereadgroups, and --statusoperations do not
37 take a connection name. Auto generates suitable commands and feeds
38 them to a shell for execution.
39 The --add operation adds a connection specification to the internal
41 database within pluto; it will fail if pluto already has a
42 specification by that name. The --delete operation deletes a connection
43 specification from pluto's internal database (also tearing down any
44 connections based on it); it will fail if the specification does not
45 exist. The --replace operation is equivalent to --delete (if there is
46 already a specification by the given name) followed by --add, and is a
47 convenience for updating pluto's internal specification to match an
48 external one. (Note that a --rereadsecrets may also be needed.) The
49 --rereadgroups operation causes any changes to the policy group files
50 to take effect (this is currently a synonym for --ready, but that may
51 change). None of the other operations alters the internal database.
52 The --up operation asks pluto to establish a connection based on an
54 entry in its internal database. The --down operation tells pluto to
55 tear down such a connection.
56 Normally, pluto establishes a route to the destination specified for a
58 connection as part of the --up operation. However, the route and only
59 the route can be established with the --route operation. Until and
60 unless an actual connection is established, this discards any packets
61 sent there, which may be preferable to having them sent elsewhere based
62 on a more general route (e.g., a default route).
63 Normally, pluto's route to a destination remains in place when a --down
65 operation is used to take the connection down (or if connection setup,
66 or later automatic rekeying, fails). This permits establishing a new
67 connection (perhaps using a different specification; the route is
68 altered as necessary) without having a “window” in which packets might
69 go elsewhere based on a more general route. Such a route can be removed
70 using the --unroute operation (and is implicitly removed by --delete).
71 The --ready operation tells pluto to listen for connection-setup
73 requests from other hosts. Doing an --up operation before doing --ready
74 on both ends is futile and will not work, although this is now
75 automated as part of IPsec startup and should not normally be an issue.
76 The --status operation asks pluto for current connection status. The
78 output format is ad-hoc and likely to change.
79 The --rereadsecrets operation tells pluto to re-read the
81 /etc/ipsec.secrets secret-keys file, which it normally reads only at
82 startup time. (This is currently a synonym for --ready, but that may
83 change.)
84 The --rereadsecrets operation tells pluto to re-read the
86 /etc/ipsec.secrets secret-keys file, which it normally reads only at
87 startup time. (This is currently a synonym for --ready, but that may
88 change.)
89 The --rereadcacerts operation reads all certificate files contained in
91 the /etc/ipsec.d/cacerts directory and adds them to pluto's list of
92 Certification Authority (CA) certificates. This does not affect CA
93 certificates in the NSS database.
94 The --rereadocspcerts operation reads all certificate files contained
96 in the /etc/ipsec.d/ocspcerts directory and adds them to pluto's list
97 of OCSP signer certificates.
98 The --rereadcrls operation reads all certificate revocation list (CRL)
100 files contained in the /etc/ipsec.d/crls directory and adds them to
101 pluto's list of CRLs. This does not affect CRLs in the NSS database.
102 The --rereadall operation is equivalent to the execution of --rereadse-
104 crets, --rereadcacerts, --rereadocspcerts and --rereadcrls.
105 The --listpubkeys operation lists all RSA public keys either received
107 from peers via the IKE protocol embedded in authenticated certificate
108 payloads or loaded locally using the rightcert / leftcert or rightr-
109 sasigkey / leftrsasigkey parameters in ipsec.conf(5).
110 The --listcerts operation lists all X.509 and OpenPGP certificates
112 loaded locally using the rightcert and leftcert parameters in
113 ipsec.conf(5).
114 The --listcacerts operation lists all X.509 CA certificates either
116 loaded locally from the /etc/ipsec.d/cacerts directory or received in
117 PKCS#7-wrapped certificate payloads via the IKE protocol.
118 The --listocspcerts operation lists all OCSP signer certificates either
120 loaded locally from the /etc/ipsec.d/ocspcerts directory or received
121 via the Online Certificate Status Protocol from an OCSP server.
122 The --listgroups operation lists all groups that are either used in
124 connection definitions in ipsec.conf(5) or are embedded in loaded X.509
125 attributes certificates.
126 The --listcrls operation lists all Certificate Revocation Lists (CRLs)
128 either loaded locally from the /etc/ipsec.d/crls directory or fetched
129 dynamically from an HTTP or LDAP server.
130 The --listocsp operation lists the certicates status information
132 fetched from OCSP servers.
133 The --purgeocsp operation deletes any cached certificate status infor-
135 mation and pending OCSP fetch requests.
136 The --listall operation is equivalent to the execution of
138 --listpubkeys, --listcerts, --listcacerts, --listocspcerts,
139 --listgroups, --listcrls, --listocsp.
140 The --showonly option causes auto to show the commands it would run, on
142 standard output, and not run them.
143 The --asynchronous option, applicable only to the up operation, tells
145 pluto to attempt to establish the connection, but does not delay to
146 report results. This is especially useful to start multiple connections
147 in parallel when network links are slow.
148 The --verbose option instructs auto to pass through all output from
150 ipsec_whack(8), including log output that is normally filtered out as
151 uninteresting.
152 The --show option turns on the -x option of the shell used to execute
154 the commands, so each command is shown as it is executed.
155 The --config option specifies a non-standard location for the IPsec
157 configuration file (default /etc/ipsec.conf).
158 See ipsec.conf(5) for details of the configuration file.
160
162 /etc/ipsec.conf default IPSEC configuration file
163 /etc/ipsec.d/ X.509 and Opportunistic Encryption files
164 /var/run/pluto/ipsec.info %defaultroute information
165 /var/run/pluto/pluto.ctl Pluto command socket
166
169 ipsec.conf(5), ipsec(8), ipsec_pluto(8), ipsec_whack(8),
170 ipsec_manual(8)
171
173 Originally written for the FreeS/WAN project <http://www.freeswan.org>
174 by Henry Spencer.
175
177 Although an --up operation does connection setup on both ends, --down
178 tears only one end of the connection down (although the orphaned end
179 will eventually time out).
180 There is no support for passthrough connections.
182 A connection description which uses %defaultroute for one of its
184 nexthop parameters but not the other may be falsely rejected as
185 erroneous in some circumstances.
186 The exit status of --showonly does not always reflect errors discovered
188 during processing of the request. (This is fine for human inspection,
189 but not so good for use in scripts.)
190[FIXME: source] 06/05/2014 IPSEC_AUTO(8)