Appendix G - IPSEC
User Guide
395
Generating an RSA key pair
The Console Server doesn't have an RSA key pair by default. It will be generated on the first
reboot after you have uncommented the IPsec lines in the file
/etc/inittab
. You also can gen-
erate your key pair by issuing the following commands as root:
/usr/local/sbin/ipsec newhostkey --bits <key length> --output /etc/ipsec.secrets
chmod 600 /etc/ipsec.secrets
Key generation may take some time. In addition, the Console Server needs a lot of random
numbers and therefore needs and uses traffic on the Ethernet to generate them. It is also pos-
sible to use keys in other formats, not generated by FreeS/WAN. This may be necessary for
interoperation with other IPsec implementations.
Exchanging authentication keys
Once your BLACK BOX ® Advanced Console Server's key is in ipsec.secrets, the next step is
to send your public key to everyone you need to set up connections with and collect their
public keys. The other players will be:
•
For a VPN: each BLACK BOX
®
Advanced Console Server administrator needs public
keys for all gateways his or her BLACK BOX
®
Advanced Console Server talks to.
•
For a Road Warrior: the BLACK BOX
®
Advanced Console Server needs public keys for
all Warriors that connect to it, and each Warrior needs the BLACK BOX
®
Advanced Con-
sole Server public key.
You need to extract the public part in a suitable format. This is done with the
ipsec_showhostkey command. For VPN or Road Warrior applications, use one of the follow-
ing:
/usr/local/sbin/ipsec showhostkey --left
/usr/local/sbin/ipsec showhostkey --right
These two produce the key formatted for insertion in an ipsec.conf file. Public keys need not
be protected as fanatically as private keys. They are intended to be made public; the system is
designed to work even if an enemy knows all the public keys used. You can safely make them
publicly accessible. For example, put a gateway key on a Web page or make it available in
DNS
,
or transmit it via an insecure method such as email.
