Партнёры:
Хостинг:
ikeadm - manipulate Internet Key Exchange (IKE) parameters and state
ikeadm [-np]
ikeadm [-np] get [debug | priv | stats | defaults]
ikeadm [-np] set [debug | priv] [level] [file]
ikeadm [-np] [get | del] [p1 | rule | preshared] [id]
ikeadm [-np] add [rule | preshared] { description }
ikeadm [-np] [read | write] [rule | preshared] file
ikeadm [-np] [dump | pls | rule | preshared]
ikeadm [-np] flush p1
ikeadm help
[get | set | add | del | read | write | dump | flush]
The ikeadm utility retrieves information from and manipulates the configuration of the Internet Key Exchange (IKE) protocol daemon, in.iked(1M).
ikeadm supports a set of operations, which may be performed on one or more of the supported object types. When invoked without arguments, ikeadm enters interactive mode which prints a prompt to the standard output and accepts commands from the standard input until the end-of-file is reached.
Because ikeadm manipulates sensitive keying information, you must be superuser to use this command. Additionally, some of the commands available require that the daemon be running in a privileged mode, which is established when the daemon is started.
For details on how to use this command securely see .
The following options are supported:
-n
-p
The following commands are supported:
add
del
dump
flush
get
help
read
set
write
debug
| Description | Flag | Nickname |
| Certificate management | 0x0001 | cert |
| Key management | ||
| Operational | ||
| Phase 1 SA creation | ||
| Phase 2 SA creation | ||
| PF_KEY interface | ||
| Policy management | ||
| Proposal construction | ||
| Door interface | ||
| Config file processing | ||
| All debug flags | ||
When specifying the debug level, either a number (decimal or hexadecimal) or a string of nicknames may be given. For example, 88, 0x58, and phase1+phase2+policy are all equivalent, and will turn on debug for phase 1 sa creation, phase 2 sa creation, and policy management. A string of nicknames may also be used to remove certain types of information; all-op has the effect of turning on all debug except for operational messages; it is equivalent to the numbers 1019 or 0x3fb.
priv
Description Level Nickname Base level 0 base Access to preshared key info 1 modkeys Access to keying material 2 keymat
By default, in.iked is started at the base level. A command-line option can be used to start the daemon at a higher level. ikeadm can be used to lower the level, but it cannot be used to raise the level.
Either the numerical level or the nickname may be used to specify the target privilege level.
In order to get, add, delete, dump, read, or write preshared keys, the privilege level must at least give access to preshared key information. However, when viewing preshared keys (either using the get or dump command), the key itself will only be available if the privilege level gives access to keying material. This is also the case when viewing Phase 1 SAs.
stats
Reported statistics include:
defaults
Default values might be ignored in the event a peer system makes a valid alternative proposal or they can be overriden by per-rule values established in ike.config. In such instances, a get defaults command continues to display the default values, not the values used to override the defaults.
p1
rule
preshared
Commands like add, del, and get require that additional information be specified on the command line. In the case of the delete and get commands, all that is required is to minimally identify a given object; for the add command, the full object must be specified.
Minimal identification is accomplished in most cases by a pair of values. For IP addresses, the local addr and then the remote addr are specified, either in dot-notation for IPv4 addresses, colon-separated hexadecimal format for IPv6 addresses, or a host name present in the host name database. If a host name is given that expands to more than one address, the requested operation will be performed multiple times, once for each possible combination of addresses.
Identity pairs are made up of a local type-value pair, followed by the remote type-value pair. Valid types are:
prefix
fqdn
domain
user_fqdn
mailbox
A cookie pair is made up of the two cookies assigned to a Phase 1 Security Association (SA) when it is created; first is the initiator's, followed by the responder's. A cookie is a 64-bit number.
Finally, a label (which is used to identify a policy rule) is a character string assigned to the rule when it is created.
Formatting a rule or preshared key for the add command follows the format rules for the in.iked configuration files. Both are made up of a series of id-value pairs, contained in curly braces ({ and }). See ike.config(4) and ike.preshared(4) for details on the formatting of rules and preshared keys.
The ikeadm command allows a privileged user to enter cryptographic keying information. If an adversary gains access to such information, the security of IPsec traffic is compromised. The following issues should be taken into account when using the ikeadm command.
If it is, then the security of the keying material is the security of the network path for this TTY's traffic. Using ikeadm over a clear-text telnet or rlogin session is risky. Even local windows may be vulnerable to attacks where a concealed program that reads window events is present.
A network-mounted file can be sniffed by an adversary as it is being read. A world-readable file with keying material in it is also risky.
If your source address is a host that can be looked up over the network, and your naming system itself is compromised, then any names used will no longer be trustworthy.
Security weaknesses often lie in misapplication of tools, not the tools themselves. It is recommended that administrators are cautious when using the ikeadm command. The safest mode of operation is probably on a console, or other hard-connected TTY.
For additional information regarding this subject, see the afterward by Matt Blaze in Bruce Schneier's Applied Cryptography: Protocols, Algorithms, and Source Code in C.
Example 1 Emptying out all Phase 1 Security Associations
The following command empties out all Phase 1 Security Associations:
example# ikeadm flush p1
Example 2 Displaying all Phase 1 Security Associations
The following command displays all Phase 1 Security Associations:
example# ikeadm dump p1
Example 3 Deleting a Specific Phase 1 Security Association
The following command deletes the specified Phase 1 Security Associations:
example# ikeadm del p1 local_ip remote_ip
Example 4 Adding a Rule From a File
The following command adds a rule from a file:
example# ikeadm add rule rule_file
Example 5 Adding a Preshared Key
The following command adds a preshared key:
example# ikeadm
ikeadm> add preshared { localidtype ip localid local_ip
remoteidtype ip remoteid remote_ip ike_mode main
key 1234567890abcdef1234567890abcdef }
Example 6 Saving All Preshared Keys to a File
The following command saves all preshared keys to a file:
example# ikeadm write preshared target_file
Example 7 Viewing a Particular Rule
The following command views a particular rule:
example# ikeadm get rule rule_label
Example 8 Reading in New Rules from ike.config
The following command reads in new rules from the ike.config file:
example# ikeadm read rules
Example 9 Lowering the Privilege Level
The following command lowers the privilege level:
example# ikeadm set priv base
Example 10 Viewing the debug level
The following command shows the current debug level
example# ikeadm get debug
Example 11 Using stats to Verify Hardware Accelerator
The following example shows how stats may include an optional line at the end to indicate if IKE is using a PKCS#11 library to accelerate public-key operations, if applicable.
example# ikeadm get stats
Phase 1 SA counts:
Current: initiator: 0 responder: 0
Total: initiator: 21 responder: 27
Attempted:initiator: 21 responder: 27
Failed: initiator: 0 responder: 0
initiator fails include 0 time-out(s)
PKCS#11 library linked in from /opt/SUNWconn/lib/libpkcs11.so
example#
The following exit values are returned:
0
non-zero
See attributes(5) for descriptions of the following attributes:
| |||||||||
in.iked(1M), ike.config(4), ike.preshared(4), attributes(5), ipsec(7P)
Schneier, Bruce, Applied Cryptography: Protocols, Algorithms, and Source Code in C, Second Edition, John Wiley & Sons, New York, NY, 1996.
As in.iked can run only in the global zone and exclusive-IP zones, this command is not useful in shared-IP zones.
|
Закладки на сайте Проследить за страницей |
Created 1996-2024 by Maxim Chirkov Добавить, Поддержать, Вебмастеру |