Appendix G - IPSEC
396
BLACK BOX
®
Advanced Console Server
The Configuration File
Description
The
ipsec.conf
file specifies most configuration and control information for the FreeS/WAN
IPsec subsystem. (The major exception is secrets for authentication; ipsec.secrets) Its con-
tents are not security-sensitive
unless
manual keying is being done for more than just testing,
in which case the encryption/authentication keys in the descriptions for the manually-keyed
connections are very sensitive (and those connection descriptions are probably best kept in a
separate file, via the include facility described below).
The file is a text file, consisting of one or more
sections
. White space followed by # followed
by anything to the end of the line is a comment and is ignored, as are empty lines which are
not within a section.
A line which contains
include
and a file name, separated by white space, is replaced by the
contents of that file, preceded and followed by empty lines. If the file name is not a full path-
name, it is considered to be relative to the directory containing the including file. Such inclu-
sions can be nested. Only a single filename may be supplied, and it may not contain white
space, but it may include shell wildcards for example:
include ipsec.*.conf
The intention of the include facility is mostly to permit keeping information on connections,
or sets of connections, separate from the main configuration file. This permits such connec-
tion descriptions to be changed, copied to the other security gateways involved, etc., without
having to constantly extract them from the configuration file and then insert them back into
it. Note the
also
parameter (described below) which permits splitting a single logical section
(e.g., a connection description) into several actual sections.
A section begins with a line of the form:
type name
where
type
indicates what type of section follows, and
name
is an arbitrary name which dis-
tinguishes the section from others of the same type. (Names must start with a letter and may
contain only letters, digits, periods, underscores, and hyphens.) All subsequent non-empty
lines which begin with white space are part of the section; comments within a section must
