aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--sysconfig.txt5
-rwxr-xr-xsysconfig/network-scripts/ifup-ipsec12
2 files changed, 15 insertions, 2 deletions
diff --git a/sysconfig.txt b/sysconfig.txt
index fbb11535..a9f45f70 100644
--- a/sysconfig.txt
+++ b/sysconfig.txt
@@ -870,6 +870,11 @@ Files in /etc/sysconfig/network-scripts/
one IPSEC configuration with the same DST), set KEYING=automatic and leave
all IKE_* parameters unspecified.
+ To override the identifier to use with a preshared key:
+
+ MYID_TYPE=address|fqdn|user_fqdn
+ MYID_VALUE=fqdn or user_fqdn string for this connection
+
Usage of AH or ESP may be disabled by setting {AH,ESP}_PROTO to "none".
Bonding-specific items
diff --git a/sysconfig/network-scripts/ifup-ipsec b/sysconfig/network-scripts/ifup-ipsec
index 882722fd..fc650daf 100755
--- a/sysconfig/network-scripts/ifup-ipsec
+++ b/sysconfig/network-scripts/ifup-ipsec
@@ -160,8 +160,16 @@ EOF
if [ "$KEYING" = "automatic" -a -n "$IKE_METHOD" ]; then
if [ "$IKE_METHOD" = "PSK" ]; then
+ MYID=address
+ if [ -n "$MYID_TYPE" ]; then
+ case "$MYID_TYPE" in
+ *fqdn*)
+ MYID="$MYID_TYPE \"$MYID_VALUE\""
+ ;;
+ esac
+ fi
tmpfile=`mktemp /etc/racoon/psk.XXXXXX`
- grep -v "^$DST" /etc/racoon/psk.txt > $tmpfile
+ grep -v "^$DST " /etc/racoon/psk.txt > $tmpfile
echo "$DST $IKE_PSK" >> $tmpfile
mv -f $tmpfile /etc/racoon/psk.txt
fi
@@ -174,7 +182,7 @@ EOF
case "$IKE_METHOD" in
PSK)
cat >> /etc/racoon/$DST.conf << EOF
- my_identifier address;
+ my_identifier $MYID;
proposal {
encryption_algorithm $ESP_PROTO;
hash_algorithm $AH_PROTO;