1IPSEC_AUTO(8) Executable programs IPSEC_AUTO(8)
2
6 ipsec_auto - control automatically-keyed IPsec connections
7
9 ipsec auto [--showonly] [--asynchronous]
10 [--config configfile] [--verbose] operation connection
11 ipsec auto [--showonly] [--asynchronous]
14 [--config configfile] [--verbose] operation connection
15
18 ipsec auto { --add | --delete | --replace | --start } connection
19 ipsec auto { --up | --down } connection
21 ipsec auto { --route | --unroute | --ondemand } connection
23 ipsec auto { --status | --ready }
25 ipsec auto [--utc] [--listall | --rereadall] [--rereadsecrets]
27 [--listcerts] [--listpubkeys] [--checkpubkeys] [--listcacerts]
28 [--fetchcrls] [--listcrls] [--purgeocsp]
29 ipsec auto [--utc] [--rereadcerts] connection
31
33 Auto manipulates automatically-keyed Libreswan IPsec connections,
34 setting them up and shutting them down based on the information in the
35 IPsec configuration file. In the normal usage, connection is the name
36 of a connection specification in the configuration file; operation is
37 --add, --delete, --replace, --start, --up, --down, --route, --unroute,
38 --ondemand, The --ready, --rereadsecrets, and --status operations do
39 not take a connection name. Auto generates suitable commands and feeds
40 them to a shell for execution.
41 The --add operation adds a connection specification to the internal
43 database within pluto; it will fail if pluto already has a
44 specification by that name. The --delete operation deletes a connection
45 specification from pluto's internal database (also tearing down any
46 connections based on it); The --replace operation is equivalent to
47 --delete (if there is already a loaded connection by the given name)
48 followed by --add, and is a convenience for updating pluto's internal
49 specification to match an external one. (Note that a --rereadsecrets
50 may also be needed.) The --start operation is equivalent to running
51 first with --add and then with --up, causing same effect as connection
52 configuration option auto=start.
53 The --up operation asks pluto to establish a connection based on an
55 entry in its internal database. The --down operation tells pluto to
56 tear down such a connection.
57 Normally, pluto establishes a route to the destination specified for a
59 connection as part of the --up operation. However, the route can be
60 established with the --route operation. Until and unless an actual
61 connection is established, this discards any packets sent there, which
62 may be preferable to having them sent elsewhere based on a more general
63 route (e.g., a default route).
64 Normally, pluto's route to a destination remains in place when a --down
66 operation is used to take the connection down (or if connection setup,
67 or later automatic rekeying, fails). This permits establishing a new
68 connection (perhaps using a different specification; the route is
69 altered as necessary) without having a “window” in which packets might
70 go elsewhere based on a more general route. Such a route can be removed
71 using the --unroute operation (and is implicitly removed by --delete).
72 The --ondemand operation is equivalent to running first with --add and
74 then with --route, causing same effect as connection configuration
75 option auto=ondemand.
76 The --ready operation tells pluto to listen for connection-setup
78 requests from other hosts. Doing an --up operation before doing --ready
79 on both ends is futile and will not work, although this is now
80 automated as part of IPsec startup and should not normally be an issue.
81 The --status operation asks pluto for current connection status. The
83 output format is ad-hoc and likely to change.
84 The --rereadsecrets operation tells pluto to re-read the
86 /etc/ipsec.secrets secret-keys file, which it normally reads only at
87 startup time. (This is currently a synonym for --ready, but that may
88 change.)
89 The --fetchcrls operation reads all certificate revocation list (CRL)
91 entries of loaded certificates and tries to fetch updates for these
92 from the CRL servers.
93 The --rereadall operation is equivalent to the execution of
95 --rereadsecrets (in the past there were other kinds of reread
96 operations)
97 The --listpubkeys operation lists all RSA public keys either received
99 from peers via the IKE protocol embedded in authenticated certificate
100 payloads or loaded locally using the rightcert / leftcert or rightr-
101 sasigkey / leftrsasigkey parameters in ipsec.conf(5).
102 The --listcerts operation lists all X.509 certificates loaded locally
104 using the rightcert and leftcert parameters in ipsec.conf(5). To see
105 all certificates in the NSS database, use certutil -d
106 /var/lib/ipsec/nss -L.
107 The --checkpubkeys operation lists all loaded X.509 certificates that
109 are about to expire or have expired.
110 The --listcacerts operation lists all X.509 CA certificates contained
112 in the NSS database.
113 The --listcrls operation lists all Certificate Revocation Lists (CRLs)
115 either loaded locally from the /etc/ipsec.d/crls directory or fetched
116 dynamically from an HTTP or LDAP server.
117 The --listall operation is equivalent to the execution of
119 --listpubkeys, --listcerts, --listcacerts, --listcrls.
120 The --purgeocsp operation displays --listall and purges the NSS OCSP
122 cache.
123 The --showonly option causes auto to show the commands it would run, on
125 standard output, and not run them.
126 The --asynchronous option, applicable only to the up operation, tells
128 pluto to attempt to establish the connection, but does not delay to
129 report results. This is especially useful to start multiple connections
130 in parallel when network links are slow.
131 The --verbose option instructs auto to pass through all output from
133 ipsec_whack(8), including log output that is normally filtered out as
134 uninteresting.
135 The --config option specifies a non-standard location for the IPsec
137 configuration file (default /etc/ipsec.conf).
138 See ipsec.conf(5) for details of the configuration file.
140
142 /etc/ipsec.conf default IPSEC configuration file
143 /var/lib/ipsec/nss X.509 and Opportunistic Encryption files
144 /var/run/pluto/pluto.ctl Pluto command socket
145
148 ipsec.conf(5), ipsec(8), ipsec_pluto(8), ipsec_whack(8)
149
151 Originally written for the FreeS/WAN project <https://www.freeswan.org>
152 by Henry Spencer.
153
155 Although an --up operation does connection setup on both ends, --down
156 tears only one end of the connection down (although the orphaned end
157 will eventually time out).
158 There is no support for passthrough connections.
160 A connection description that uses %defaultroute for one of its nexthop
162 parameters but not the other may be falsely rejected as erroneous in
163 some circumstances.
164 The exit status of --showonly does not always reflect errors discovered
166 during processing of the request. (This is fine for human inspection,
167 but not so good for use in scripts.)
168
170 Paul Wouters
171 placeholder to suppress warning
172libreswan 02/21/2021 IPSEC_AUTO(8)