1IPSEC_AUTO(8) IPSEC_AUTO(8)
2
6 ipsec auto - control automatically-keyed IPsec connections
7
9 ipsec auto [--show] [--showonly] [--asynchronous]
10 [--config configfile] [--verbose] operation connection
11 ipsec auto [--show] [--showonly] [--asynchronous]
14 [--config configfile] [--verbose] operation connection
15
19 ipsec auto { --add | --delete | --replace | --up | --down } connection
20 ipsec auto { --status | --ready } connection
22 ipsec auto { --route | --unroute } connection
24 ipsec auto [--utc] [--listall | --rereadall] [--rereadsecrets]
26 [--listcerts] [--listpubkeys] [--listcards]
27 [--listcacerts | --rereadcacerts] [--listcrls | --rereadcrls]
28 [[--listocspcerts | --rereadocspcerts] [--listocsp | --purgeocsp]]
29 [--listacerts | --rereadacerts] [--listaacerts | --rereadaacerts]
30 [--listgroups | --rereadgroups]
31
34 Auto manipulates automatically-keyed Openswan IPsec connections, set‐
35 ting them up and shutting them down based on the information in the
36 IPsec configuration file. In the normal usage, connection is the name
37 of a connection specification in the configuration file; operation is
38 --add, --delete, --replace, --up, --down, --route, or --unroute. The
39 --ready, --rereadsecrets, --rereadgroups, and --status operations do
40 not take a connection name. Auto generates suitable commands and feeds
41 them to a shell for execution.
42 The --add operation adds a connection specification to the internal
45 database within pluto; it will fail if pluto already has a specifica‐
46 tion by that name. The --delete operation deletes a connection specifi‐
47 cation from pluto's internal database (also tearing down any connec‐
48 tions based on it); it will fail if the specification does not exist.
49 The --replace operation is equivalent to --delete (if there is already
50 a specification by the given name) followed by --add, and is a conve‐
51 nience for updating pluto's internal specification to match an external
52 one. (Note that a --rereadsecrets may also be needed.) The --reread‐
53 groups operation causes any changes to the policy group files to take
54 effect (this is currently a synonym for --ready, but that may change).
55 None of the other operations alters the internal database.
56 The --up operation asks pluto to establish a connection based on an en‐
59 try in its internal database. The --down operation tells pluto to tear
60 down such a connection.
61 Normally, pluto establishes a route to the destination specified for a
64 connection as part of the --up operation. However, the route and only
65 the route can be established with the --route operation. Until and un‐
66 less an actual connection is established, this discards any packets
67 sent there, which may be preferable to having them sent elsewhere based
68 on a more general route (e.g., a default route).
69 Normally, pluto's route to a destination remains in place when a --down
72 operation is used to take the connection down (or if connection setup,
73 or later automatic rekeying, fails). This permits establishing a new
74 connection (perhaps using a different specification; the route is al‐
75 tered as necessary) without having a “window” in which packets might go
76 elsewhere based on a more general route. Such a route can be removed
77 using the --unroute operation (and is implicitly removed by --delete).
78 The --ready operation tells pluto to listen for connection-setup re‐
81 quests from other hosts. Doing an --up operation before doing --ready
82 on both ends is futile and will not work, although this is now automat‐
83 ed as part of IPsec startup and should not normally be an issue.
84 The --status operation asks pluto for current connection status. The
87 output format is ad-hoc and likely to change.
88 The --rereadsecrets operation tells pluto to re-read the /etc/ipsec.se‐
91 crets secret-keys file, which it normally reads only at startup time.
92 (This is currently a synonym for --ready, but that may change.)
93 The --rereadsecrets operation tells pluto to re-read the /etc/ipsec.se‐
96 crets secret-keys file, which it normally reads only at startup time.
97 (This is currently a synonym for --ready, but that may change.)
98 The --rereadcacerts operation reads all certificate files contained in
101 the /etc/ipsec.d/cacerts directory and adds them to plutoâs list of
102 Certification Authority (CA) certificates.
103 The --rereadaacerts operation reads all certificate files contained in
106 the /etc/ipsec.d/aacerts directory and adds them to plutoâs list of
107 Authorization Authority (AA) certificates.
108 The --rereadocspcerts operation reads all certificate files contained
111 in the /etc/ipsec.d/ocspcerts directory and adds them to plutoâs list
112 of OCSP signer certificates.
113 The --rereadacerts operation reads all certificate files contained in
116 the /etc/ipsec.d/acerts directory and adds them to plutoâs list of
117 attribute certificates.
118 The --rereadcrls operation reads all certificate revocation list (CRL)
121 files contained in the /etc/ipsec.d/crls directory and adds them to
122 plutoâs list of CRLs.
123 The --rereadall operation is equivalent to the execution of --rereadse-
126 crets, --rereadcacerts, --rereadaacerts, --rereadocspcerts, --rereadac-
127 erts, and --rereadcrls.
128 The --listpubkeys operation lists all RSA public keys either received
131 from peers via the IKE protocol embedded in authenticated certificate
132 payloads or loaded locally using the rightcert / leftcert or rightr-
133 sasigkey / leftrsasigkey parameters in ipsec.conf(5).
134 The --listcerts operation lists all X.509 and OpenPGP certificates
137 loaded locally using the rightcert and leftcert parameters in
138 ipsec.conf(5).
139 The --listcacerts operation lists all X.509 CA certificates either
142 loaded locally from the /etc/ipsec.d/cacerts directory or received in
143 PKCS#7-wrapped certificate payloads via the IKE protocol.
144 The --listaacerts operation lists all X.509 AA certificates loaded lo‐
147 cally from the /etc/ipsec.d/aacerts directory.
148 The --listocspcerts operation lists all OCSP signer certificates either
151 loaded locally from the /etc/ipsec.d/ocspcerts directory or received
152 via the Online Certificate Status Protocol from an OCSP server.
153 The --listacerts operation lists all X.509 attribute certificates load‐
156 ed locally from the /etc/ipsec.d/acerts directory.
157 The --listgropus operation lists all groups that are either used in
160 connection definitions in ipsec.conf(5) or are embedded in loaded X.509
161 attributes certificates.
162 The --listcainfos operation lists the certification authority informa-
165 tion specified in the ca sections of ipsec.conf(5).
166 The --listcrls operation lists all Certificate Revocation Lists (CRLs)
169 either loaded locally from the /etc/ipsec.d/crls directory or fetched
170 dynamically from an HTTP or LDAP server.
171 The --listocsp operation lists the certicates status information
174 fetched from OCSP servers.
175 The --purgeocsp operation deletes any cached certificate status infor-
178 mation and pending OCSP fetch requests.
179 The --listcards operation lists information about attached smartcards
182 or crypto tokens.
183 The --listall operation is equivalent to the execution of --listpub‐
186 keys, --listcerts, --listcacerts, --listaacerts, --listoc- spcerts,
187 --listacerts, --listgroups, --listcainfos, --listcrls, --lis- tocsp,
188 and --listcards.
189 The --showonly option causes auto to show the commands it would run, on
192 standard output, and not run them.
193 The --asynchronous option, applicable only to the up operation, tells
196 pluto to attempt to establish the connection, but does not delay to re‐
197 port results. This is especially useful to start multiple connections
198 in parallel when network links are slow.
199 The --verbose option instructs auto to pass through all output from
202 ipsec_whack(8), including log output that is normally filtered out as
203 uninteresting.
204 The --show option turns on the -x option of the shell used to execute
207 the commands, so each command is shown as it is executed.
208 The --config option specifies a non-standard location for the IPsec
211 configuration file (default /etc/ipsec.conf).
212 See ipsec.conf(5) for details of the configuration file.
215
218 /etc/ipsec.conf default IPSEC configuration file
219 /etc/ipsec.d/ X.509 and Opportunistic Encryption files
220 /var/run/pluto/ipsec.info %defaultroute information
221 /var/run/pluto/pluto.ctl Pluto command socket
222
227 ipsec.conf(5), ipsec(8), ipsec_pluto(8), ipsec_whack(8), ipsec_manu‐
228 al(8)
229
232 Originally written for the FreeS/WAN project <http://www.freeswan.org:
233 http://www.freeswan.org> by Henry Spencer.
234
237 Although an --up operation does connection setup on both ends, --down
238 tears only one end of the connection down (although the orphaned end
239 will eventually time out).
240 There is no support for passthrough connections.
243 A connection description which uses %defaultroute for one of its nex‐
246 thop parameters but not the other may be falsely rejected as erroneous
247 in some circumstances.
248 The exit status of --showonly does not always reflect errors discovered
251 during processing of the request. (This is fine for human inspection,
252 but not so good for use in scripts.)
253 IPSEC_AUTO(8)