Red Hat ENTERPRISE LINUX 5 - VIRTUAL SERVER ADMINISTRATION, Руководство по развертыванию

Страница: 713 / 848

IPsec Host-to-Host Configuration
687
• The IP address of each host
• A unique name, for example,
ipsec1
. This is used to identify the IPsec connection and to
distinguish it from other devices or connections.
• A fixed encryption key or one automatically generated by
racoon
.
• A pre-shared authentication key that is used during the initial stage of the connection and to
exchange encryption keys during the session.
For example, suppose Workstation A and Workstation B want to connect to each other through an
IPsec tunnel. They want to connect using a pre-shared key with the value of
Key_Value01
, and the
users agree to let
racoon
automatically generate and share an authentication key between each host.
Both host users decide to name their connections
ipsec1
.
Note
You should choose a PSK that uses a mixture of upper- and lower-case characters,
numbers and punctuation. An easily-guessable PSK constitutes a security risk.
It is not necessary to use the same connection name for each host. You should choose a
name that is convenient and meaningful for your installation.
The following is the IPsec configuration file for Workstation A for a host-to-host IPsec connection with
Workstation B. The unique name to identify the connection in this example is
ipsec1
, so the resulting
file is called
/etc/sysconfig/network-scripts/ifcfg-ipsec1
.
DST= X.X.X.X
TYPE=IPSEC
ONBOOT=no
IKE_METHOD=PSK
For Workstation A,
X.X.X.X
is the IP address of Workstation B. For Workstation B,
X.X.X.X
is the
IP address of Workstation A. This connection is not set to initiate on boot-up (
ONBOOT=no
) and it uses
the pre-shared key method of authentication (
IKE_METHOD=PSK
).
The following is the content of the pre-shared key file (called
/etc/sysconfig/network-
scripts/keys-ipsec1
) that both workstations need to authenticate each other. The contents of this
file should be identical on both workstations, and only the root user should be able to read or write this
file.
IKE_PSK=Key_Value01
Important
To change the
keys-ipsec1
file so that only the root user can read or edit the file, use
the following command after creating the file:
[root@myServer ~] # chmod 600 /etc/sysconfig/network-scripts/keys-ipsec1