diff options
| -rw-r--r-- | sysconfig.txt | 5 | ||||
| -rwxr-xr-x | sysconfig/network-scripts/ifup-ipsec | 12 |
2 files changed, 15 insertions, 2 deletions
diff --git a/sysconfig.txt b/sysconfig.txt index fbb11535..a9f45f70 100644 --- a/sysconfig.txt +++ b/sysconfig.txt @@ -870,6 +870,11 @@ Files in /etc/sysconfig/network-scripts/ one IPSEC configuration with the same DST), set KEYING=automatic and leave all IKE_* parameters unspecified. + To override the identifier to use with a preshared key: + + MYID_TYPE=address|fqdn|user_fqdn + MYID_VALUE=fqdn or user_fqdn string for this connection + Usage of AH or ESP may be disabled by setting {AH,ESP}_PROTO to "none". Bonding-specific items diff --git a/sysconfig/network-scripts/ifup-ipsec b/sysconfig/network-scripts/ifup-ipsec index 882722fd..fc650daf 100755 --- a/sysconfig/network-scripts/ifup-ipsec +++ b/sysconfig/network-scripts/ifup-ipsec @@ -160,8 +160,16 @@ EOF if [ "$KEYING" = "automatic" -a -n "$IKE_METHOD" ]; then if [ "$IKE_METHOD" = "PSK" ]; then + MYID=address + if [ -n "$MYID_TYPE" ]; then + case "$MYID_TYPE" in + *fqdn*) + MYID="$MYID_TYPE \"$MYID_VALUE\"" + ;; + esac + fi tmpfile=`mktemp /etc/racoon/psk.XXXXXX` - grep -v "^$DST" /etc/racoon/psk.txt > $tmpfile + grep -v "^$DST " /etc/racoon/psk.txt > $tmpfile echo "$DST $IKE_PSK" >> $tmpfile mv -f $tmpfile /etc/racoon/psk.txt fi @@ -174,7 +182,7 @@ EOF case "$IKE_METHOD" in PSK) cat >> /etc/racoon/$DST.conf << EOF - my_identifier address; + my_identifier $MYID; proposal { encryption_algorithm $ESP_PROTO; hash_algorithm $AH_PROTO; |