1IPSEC_AUTO(8)                 Executable programs                IPSEC_AUTO(8)
2
3
4

NAME

6       ipsec_auto - control automatically-keyed IPsec connections
7

SYNOPSIS

9       ipsec auto [--showonly] [--asynchronous]
10             [--config configfile] [--verbose] operation connection
11
12
13       ipsec auto [--showonly] [--asynchronous]
14             [--config configfile] [--verbose] operation connection
15
16

EXAMPLES

18       ipsec auto { --add | --delete | --replace | --start } connection
19
20       ipsec auto { --up | --down } connection
21
22       ipsec auto { --route | --unroute | --ondemand } connection
23
24       ipsec auto { --status | --ready }
25
26       ipsec auto [--utc] [--listall | --rereadall] [--rereadsecrets]
27             [--listcerts] [--listpubkeys] [--checkpubkeys] [--listcacerts]
28             [--fetchcrls] [--listcrls] [--purgeocsp]
29

DESCRIPTION

31       Auto manipulates automatically-keyed Libreswan IPsec connections,
32       setting them up and shutting them down based on the information in the
33       IPsec configuration file. In the normal usage, connection is the name
34       of a connection specification in the configuration file; operation is
35       --add, --delete, --replace, --start, --up, --down, --route, --unroute,
36       or --ondemand. The --ready, --rereadsecrets, and --status operations do
37       not take a connection name.  Auto generates suitable commands and feeds
38       them to a shell for execution.
39
40       The --add operation adds a connection specification to the internal
41       database within pluto; it will fail if pluto already has a
42       specification by that name. The --delete operation deletes a connection
43       specification from pluto's internal database (also tearing down any
44       connections based on it); The --replace operation is equivalent to
45       --delete (if there is already a loaded connection by the given name)
46       followed by --add, and is a convenience for updating pluto's internal
47       specification to match an external one. (Note that a --rereadsecrets
48       may also be needed.) The --start operation is equivalent to running
49       first with --add and then with --up, causing same effect as connection
50       configuration option auto=start.
51
52       The --up operation asks pluto to establish a connection based on an
53       entry in its internal database. The --down operation tells pluto to
54       tear down such a connection.
55
56       Normally, pluto establishes a route to the destination specified for a
57       connection as part of the --up operation. However, the route (for
58       KLIPS) and packet capture (KLIPS and NETKEY) can be established with
59       the --route operation. Until and unless an actual connection is
60       established, this discards any packets sent there, which may be
61       preferable to having them sent elsewhere based on a more general route
62       (e.g., a default route).
63
64       Normally, pluto's route (KLIPS) or packet capture (NETKEY) to a
65       destination remains in place when a --down operation is used to take
66       the connection down (or if connection setup, or later automatic
67       rekeying, fails). This permits establishing a new connection (perhaps
68       using a different specification; the route is altered as necessary)
69       without having a “window” in which packets might go elsewhere based on
70       a more general route. Such a route can be removed using the --unroute
71       operation (and is implicitly removed by --delete).
72
73       The --ondemand operation is equivalent to running first with --add and
74       then with --route, causing same effect as connection configuration
75       option auto=ondemand.
76
77       The --ready operation tells pluto to listen for connection-setup
78       requests from other hosts. Doing an --up operation before doing --ready
79       on both ends is futile and will not work, although this is now
80       automated as part of IPsec startup and should not normally be an issue.
81
82       The --status operation asks pluto for current connection status. The
83       output format is ad-hoc and likely to change.
84
85       The --rereadsecrets operation tells pluto to re-read the
86       /etc/ipsec.secrets secret-keys file, which it normally reads only at
87       startup time. (This is currently a synonym for --ready, but that may
88       change.)
89
90       The --fetchcrls operation reads all certificate revocation list (CRL)
91       entries of loaded certificates and tries to fetch updates for these
92       from the CRL servers.
93
94       The --rereadall operation is equivalent to the execution of
95       --rereadsecrets (in the past there were other kinds of reread
96       operations)
97
98       The --listpubkeys operation lists all RSA public keys either received
99       from peers via the IKE protocol embedded in authenticated certificate
100       payloads or loaded locally using the rightcert / leftcert or rightr-
101       sasigkey / leftrsasigkey parameters in ipsec.conf(5).
102
103       The --listcerts operation lists all X.509 certificates loaded locally
104       using the rightcert and leftcert parameters in ipsec.conf(5). To see
105       all certificates in the NSS database, use certutil -d /etc/ipsec.d -L.
106
107       The --checkpubkeys operation lists all loaded X.509 certificates that
108       are about to expire or have expired.
109
110       The --listcacerts operation lists all X.509 CA certificates contained
111       in the NSS database.
112
113       The --listcrls operation lists all Certificate Revocation Lists (CRLs)
114       either loaded locally from the /etc/ipsec.d/crls directory or fetched
115       dynamically from an HTTP or LDAP server.
116
117       The --listall operation is equivalent to the execution of
118       --listpubkeys, --listcerts, --listcacerts, --listcrls.
119
120       The --purgeocsp operation displays --listall and purges the NSS OCSP
121       cache.
122
123       The --showonly option causes auto to show the commands it would run, on
124       standard output, and not run them.
125
126       The --asynchronous option, applicable only to the up operation, tells
127       pluto to attempt to establish the connection, but does not delay to
128       report results. This is especially useful to start multiple connections
129       in parallel when network links are slow.
130
131       The --verbose option instructs auto to pass through all output from
132       ipsec_whack(8), including log output that is normally filtered out as
133       uninteresting.
134
135       The --config option specifies a non-standard location for the IPsec
136       configuration file (default /etc/ipsec.conf).
137
138       See ipsec.conf(5) for details of the configuration file.
139

FILES

141           /etc/ipsec.conf               default IPSEC configuration file
142           /etc/ipsec.d             X.509 and Opportunistic Encryption files
143           /var/run/pluto/pluto.ctl Pluto command socket
144
145

SEE ALSO

147       ipsec.conf(5), ipsec(8), ipsec_pluto(8), ipsec_whack(8)
148

HISTORY

150       Originally written for the FreeS/WAN project <https://www.freeswan.org>
151       by Henry Spencer.
152

BUGS

154       Although an --up operation does connection setup on both ends, --down
155       tears only one end of the connection down (although the orphaned end
156       will eventually time out).
157
158       There is no support for passthrough connections.
159
160       A connection description that uses %defaultroute for one of its nexthop
161       parameters but not the other may be falsely rejected as erroneous in
162       some circumstances.
163
164       The exit status of --showonly does not always reflect errors discovered
165       during processing of the request. (This is fine for human inspection,
166       but not so good for use in scripts.)
167

AUTHOR

169       Paul Wouters
170           placeholder to suppress warning
171
172
173
174libreswan                         06/10/2019                     IPSEC_AUTO(8)
Impressum