The way isakmpd goes about its work is by maintaining an internal configuration as well as a policy database which describes what kinds of SAs to negotiate, and by listening for different events that trigger these negotiations. The events that control isakmpd consist of negotiation initiations from a remote party, user input via a FIFO or by signals, upcalls from the kernel via a PF_KEY socket, and lastly by scheduled events triggered by timers running out.
Most uses of isakmpd will be to implement so called "virtual private networks" or VPNs for short. The vpn(8) manual page describes how to set up isakmpd for a simple VPN. For other uses, some more knowledge of IKE as a protocol is required. One source of information are the RFCs mentioned below.
On startup isakmpd forks into two processes for privilege separation. The unprivileged child jails itself with chroot(8) to /var/empty The privileged process communicates with the child, reads configuration files and PKI information and binds to privileged ports on its behalf. See Sx CAVEATS section below.
The options are as follows:
Valid values for class are as follows:
Currently used values for level are 0 to 99.
# openssl genrsa -out /etc/ssl/private/ca.key 1024
# openssl req -new -key /etc/ssl/private/ca.key \
-out /etc/ssl/private/ca.csr
You are then asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name (DN). There are quite a few fields but you can leave some blank. For some fields there will be a default value; if you enter `.' the field will be left blank.
# openssl x509 -req -days 365 -in /etc/ssl/private/ca.csr \
-signkey /etc/ssl/private/ca.key \
-extfile /etc/ssl/x509v3.cnf -extensions x509v3_CA \
-out /etc/ssl/ca.crt
# openssl genrsa -out /etc/isakmpd/private/local.key 1024
# openssl req -new -key /etc/isakmpd/private/local.key \
-out /etc/isakmpd/private/10.0.0.1.csr
Now take these certificate signing requests to your CA and process them like below. You have to add a subjectAltName extension field to the certificate in order to make it usable by isakmpd There are two possible ways to add the extensions to the certificate. Either you have to run certpatch(8) or you have to make use of an OpenSSL configuration file, for example /etc/ssl/x509v3.cnf Replace 10.0.0.1 with the IP-address which isakmpd will use as the certificate identity.
To use certpatch(8), do the following
# openssl x509 -req -days 365 -in 10.0.0.1.csr -CA /etc/ssl/ca.crt \
-CAkey /etc/ssl/private/ca.key -CAcreateserial \
-out 10.0.0.1.crt
# certpatch -i 10.0.0.1 -k /etc/ssl/private/ca.key \
10.0.0.1.crt 10.0.0.1.crt
Otherwise do
# setenv CERTIP 10.0.0.1
# openssl x509 -req -days 365 -in 10.0.0.1.csr -CA /etc/ssl/ca.crt \
-CAkey /etc/ssl/private/ca.key -CAcreateserial \
-extfile /etc/ssl/x509v3.cnf -extensions x509v3_IPAddr \
-out 10.0.0.1.crt
For a FQDN certificate, do
# setenv CERTFQDN somehost.somedomain
# openssl x509 -req -days 365 -in somehost.somedomain.csr \
-CA /etc/ssl/ca.crt -CAkey /etc/ssl/private/ca.key \
-CAcreateserial \
-extfile /etc/ssl/x509v3.cnf -extensions x509v3_FQDN \
-out somehost.somedomain.crt
or with certpatch(8)
# certpatch -t fqdn -i somehost.somedomain \
-k /etc/ssl/private/ca.key \
somehost.somedomain.crt somehost.somedomain.crt
(This assumes the previous steps were used to create a request for somehost.somedomain instead of 10.0.0.1)
Put the certificate (the file ending in .crt) in /etc/isakmpd/certs/ on your local system. Also carry over the CA cert /etc/ssl/ca.crt and put it in /etc/isakmpd/ca/
To revoke certificates, create a Certificate Revocation List (CRL) file and install it in the /etc/isakmpd/crls/ directory. See openssl(1) and the `crl' subcommand for more info.
It is also possible to store trusted public keys to make them directly usable by isakmpd The keys should be saved in PEM format (see openssl(1)) and named and stored after this easy formula:
NOTE: Sending isakmpd a SIGHUP or an "R" through the FIFO will void any updates done to the configuration.