1IPSEC_AUTO(8) [FIXME: manual] IPSEC_AUTO(8)
2
6 ipsec_auto - control automatically-keyed IPsec connections
7
9 ipsec auto [--show] [--showonly] [--asynchronous]
10 [--config configfile] [--verbose] operation connection
11 ipsec auto [--show] [--showonly] [--asynchronous]
14 [--config configfile] [--verbose] operation connection
15
18 ipsec auto { --add | --delete | --replace | --up | --down } connection
19 ipsec auto { --status | --ready } connection
21 ipsec auto { --route | --unroute } connection
23 ipsec auto [--utc] [--listall | --rereadall] [--rereadsecrets]
25 [--listcerts] [--listpubkeys] [--listcacerts | --rereadcacerts]
26 [--listcrls | --rereadcrls]
27 [[--listocspcerts | --rereadocspcerts ] [--listocsp | --purgeocsp ]]
28 [--listacerts | --rereadacerts] [--listaacerts | --rereadaacerts]
29 [--listgroups | --rereadgroups]
30
32 Auto manipulates automatically-keyed Openswan IPsec connections,
33 setting them up and shutting them down based on the information in the
34 IPsec configuration file. In the normal usage, connection is the name
35 of a connection specification in the configuration file; operation is
36 --add, --delete, --replace, --up, --down, --route, or --unroute. The
37 --ready, --rereadsecrets, --rereadgroups, and --status operations do
38 not take a connection name. Auto generates suitable commands and feeds
39 them to a shell for execution.
40 The --add operation adds a connection specification to the internal
42 database within pluto; it will fail if pluto already has a
43 specification by that name. The --delete operation deletes a connection
44 specification from pluto´s internal database (also tearing down any
45 connections based on it); it will fail if the specification does not
46 exist. The --replace operation is equivalent to --delete (if there is
47 already a specification by the given name) followed by --add, and is a
48 convenience for updating pluto´s internal specification to match an
49 external one. (Note that a --rereadsecrets may also be needed.) The
50 --rereadgroups operation causes any changes to the policy group files
51 to take effect (this is currently a synonym for --ready, but that may
52 change). None of the other operations alters the internal database.
53 The --up operation asks pluto to establish a connection based on an
55 entry in its internal database. The --down operation tells pluto to
56 tear down such a connection.
57 Normally, pluto establishes a route to the destination specified for a
59 connection as part of the --up operation. However, the route and only
60 the route can be established with the --route operation. Until and
61 unless an actual connection is established, this discards any packets
62 sent there, which may be preferable to having them sent elsewhere based
63 on a more general route (e.g., a default route).
64 Normally, pluto´s route to a destination remains in place when a --down
66 operation is used to take the connection down (or if connection setup,
67 or later automatic rekeying, fails). This permits establishing a new
68 connection (perhaps using a different specification; the route is
69 altered as necessary) without having a “window” in which packets might
70 go elsewhere based on a more general route. Such a route can be removed
71 using the --unroute operation (and is implicitly removed by --delete).
72 The --ready operation tells pluto to listen for connection-setup
74 requests from other hosts. Doing an --up operation before doing --ready
75 on both ends is futile and will not work, although this is now
76 automated as part of IPsec startup and should not normally be an issue.
77 The --status operation asks pluto for current connection status. The
79 output format is ad-hoc and likely to change.
80 The --rereadsecrets operation tells pluto to re-read the
82 /etc/ipsec.secrets secret-keys file, which it normally reads only at
83 startup time. (This is currently a synonym for --ready, but that may
84 change.)
85 The --rereadsecrets operation tells pluto to re-read the
87 /etc/ipsec.secrets secret-keys file, which it normally reads only at
88 startup time. (This is currently a synonym for --ready, but that may
89 change.)
90 The --rereadcacerts operation reads all certificate files contained in
92 the /etc/ipsec.d/cacerts directory and adds them to plutoâs list of
93 Certification Authority (CA) certificates.
94 The --rereadaacerts operation reads all certificate files contained in
96 the /etc/ipsec.d/aacerts directory and adds them to plutoâs list of
97 Authorization Authority (AA) certificates.
98 The --rereadocspcerts operation reads all certificate files contained
100 in the /etc/ipsec.d/ocspcerts directory and adds them to plutoâs list
101 of OCSP signer certificates.
102 The --rereadacerts operation reads all certificate files contained in
104 the /etc/ipsec.d/acerts directory and adds them to plutoâs list of
105 attribute certificates.
106 The --rereadcrls operation reads all certificate revocation list (CRL)
108 files contained in the /etc/ipsec.d/crls directory and adds them to
109 plutoâs list of CRLs.
110 The --rereadall operation is equivalent to the execution of --rereadse-
112 crets, --rereadcacerts, --rereadaacerts, --rereadocspcerts, --rereadac-
113 erts, and --rereadcrls.
114 The --listpubkeys operation lists all RSA public keys either received
116 from peers via the IKE protocol embedded in authenticated certificate
117 payloads or loaded locally using the rightcert / leftcert or rightr-
118 sasigkey / leftrsasigkey parameters in ipsec.conf(5).
119 The --listcerts operation lists all X.509 and OpenPGP certificates
121 loaded locally using the rightcert and leftcert parameters in
122 ipsec.conf(5).
123 The --listcacerts operation lists all X.509 CA certificates either
125 loaded locally from the /etc/ipsec.d/cacerts directory or received in
126 PKCS#7-wrapped certificate payloads via the IKE protocol.
127 The --listaacerts operation lists all X.509 AA certificates loaded
129 locally from the /etc/ipsec.d/aacerts directory.
130 The --listocspcerts operation lists all OCSP signer certificates either
132 loaded locally from the /etc/ipsec.d/ocspcerts directory or received
133 via the Online Certificate Status Protocol from an OCSP server.
134 The --listacerts operation lists all X.509 attribute certificates
136 loaded locally from the /etc/ipsec.d/acerts directory.
137 The --listgropus operation lists all groups that are either used in
139 connection definitions in ipsec.conf(5) or are embedded in loaded X.509
140 attributes certificates.
141 The --listcainfos operation lists the certification authority informa-
143 tion specified in the ca sections of ipsec.conf(5).
144 The --listcrls operation lists all Certificate Revocation Lists (CRLs)
146 either loaded locally from the /etc/ipsec.d/crls directory or fetched
147 dynamically from an HTTP or LDAP server.
148 The --listocsp operation lists the certicates status information
150 fetched from OCSP servers.
151 The --purgeocsp operation deletes any cached certificate status infor-
153 mation and pending OCSP fetch requests.
154 The --listall operation is equivalent to the execution of
156 --listpubkeys, --listcerts, --listcacerts, --listaacerts, --listoc-
157 spcerts, --listacerts, --listgroups, --listcainfos, --listcrls, --lis-
158 tocsp.
159 The --showonly option causes auto to show the commands it would run, on
161 standard output, and not run them.
162 The --asynchronous option, applicable only to the up operation, tells
164 pluto to attempt to establish the connection, but does not delay to
165 report results. This is especially useful to start multiple connections
166 in parallel when network links are slow.
167 The --verbose option instructs auto to pass through all output from
169 ipsec_whack(8), including log output that is normally filtered out as
170 uninteresting.
171 The --show option turns on the -x option of the shell used to execute
173 the commands, so each command is shown as it is executed.
174 The --config option specifies a non-standard location for the IPsec
176 configuration file (default /etc/ipsec.conf).
177 See ipsec.conf(5) for details of the configuration file.
179
181 /etc/ipsec.conf default IPSEC configuration file
182 /etc/ipsec.d/ X.509 and Opportunistic Encryption files
183 /var/run/pluto/ipsec.info %defaultroute information
184 /var/run/pluto/pluto.ctl Pluto command socket
185
188 ipsec.conf(5), ipsec(8), ipsec_pluto(8), ipsec_whack(8),
189 ipsec_manual(8)
190
192 Originally written for the FreeS/WAN project <http://www.freeswan.org>
193 by Henry Spencer.
194
196 Although an --up operation does connection setup on both ends, --down
197 tears only one end of the connection down (although the orphaned end
198 will eventually time out).
199 There is no support for passthrough connections.
201 A connection description which uses %defaultroute for one of its
203 nexthop parameters but not the other may be falsely rejected as
204 erroneous in some circumstances.
205 The exit status of --showonly does not always reflect errors discovered
207 during processing of the request. (This is fine for human inspection,
208 but not so good for use in scripts.)
209[FIXME: source] 10/06/2010 IPSEC_AUTO(8)