NM-SETTINGS-LIBRESWAN

Section: Misc. Reference Manual Pages (5)
Updated: 9 July 2018
Page Index

 

NAME

nm-setting-libreswan - NetworkManager Libreswan plugin supported options

 

DESCRIPTION

NetworkManager is based on the concept of connection profiles made up of settings containing the network configuration (see nm-settings(5) for details). The data and secret keys belonging to the vpn setting take dictionaries of key/value pairs which depends on the specific VPN plugin. Here the list of the allowed key/value pairs for the NetworkManager Libreswan plugin.

 

VPN.DATA

Many key/value pairs in the vpn.data property are passed unchanged to the Libreswan service. The configuration is first validated by the NetworkManager plugin, which will also add some extra Libreswan parameters and defaults as needed. There are some key/value pairs used for the plugin configuration only, e.g., the flags used to manage the secrets needed by the connection. Here the full list of the allowed parameters:

right
contains the address of the remote VPN endpoint. Corresponds to the Libreswan parameter of the same name. Always Required.
rightid
specifies the remote identifier to be used during IKE negotiation. Corresponds to the Libreswan parameter of the same name.
rightrsasigkey
specifies the remote's public key for RSA authentication. When the 'leftcert' key is defined a default value of "%cert" is assumed.
left
contains the local address that should be used during IKE negotiation. If not specified, the value "%defaultroute" is assumed. Corresponds to the Libreswan parameter of the same name.
leftid
specifies the local identifier to be used during IKE negotiation. When this property is specified and the IKEv1 protocol is used the key exchange will be performed in aggressive mode. Corresponds to the Libreswan parameter of the same name.
leftrsasigkey
specifies the local public key for RSA authentication. The key should be already installed in the *swan NSS database. When the 'leftcert' key is defined a default value of "%cert" is assumed.
leftcert
this defines the certificate nickname of your certificate in the NSS database. The certificate should be already installed in the NSS database.
leftxauthusername
the username to be used during XAUTH authentication. If not specified, the current user will be implicitly assumed. Corresponds to the Libreswan parameter of the same name.
dhgroup
ignored.
pfsgroup
ignored.
dpdtimeout
ignored.
ike
allowed ciphers to be negotiatied to establish the IKE SAs. Corresponds to the Libreswan parameter of the same name. Default value depends on Libreswan but for IKEv1 aggressive negotiation: in that case the default is forced to 'aes256-sha1;modp1536'.
esp
allowed ciphers for establishing phase2 SAs. Matches the Libreswan parameter of the same name. Default value depends on Libreswan but for IKEv1 aggressive negotiation: in that case the default is forced to 'aes256-sha1'.
ikelifetime
how long the phase1 SA of a connection should last. Matches the Libreswan parameter of the same name. Default value is '24h'.
salifetime
how long the pashe2 SA of a connection should last. Matches the Libreswan parameter of the same name. Default value is '24h'.
vendor
when equals 'Cisco', the 'cisco-unity=yes' will be passed to Libreswan, to allow ending the CISCO_UNITY payload to the peer. The option is ignored otherwise.
rightsubnet
the destination subnet that should be reached throught the VPN. If omitted, will be filled with '0.0.0.0/0'. Matches the Libreswan parameter of the same name.
ikev2
use IKEv2 negotiation. Allowed values are: 'permit', 'no'/'never', 'yes'/'propose' and 'insist'. Matches the Libreswan parameter of the same name.
narrowing
only effective in IKEv2 negotiation. Allowed values are: 'yes' and 'no'. Matches the Libreswan parameter of the same name.
rekey
Allowed values are: 'yes' and 'no'. Defaults to 'yes'. Matches the Libreswan parameter of the same name.
fragmentation
Allowed values are: 'yes' and 'no'. Matches the Libreswan parameter of the same name.
mobike
Allowed values are: 'yes' and 'no'. Matches the Libreswan parameter of the same name.
pskinputmodes
where the 'pskvalue' can be retrieved. Used internally by the plugin. Allowed values are: 'unused', 'save', 'ask'.
xauthpasswordinputmodes
where the 'xauthpassword' can be retrieved. Used internally by the plugin. Allowed values are: 'unused', 'save', 'ask'.
pskvalue-flags
how to handle the 'pskvalue' secret. See the "Secret flag type" section at nm-settings(5) for details.
xauthpassword-flags
how to handle the 'xauthpassword' secret. See the "Secret flag type" section at nm-settings(5) for details.

 

VPN.SECRETS

The vpn.secrets property holds the secrets stored in the connection (if any). The allowed keys are:

pskvalue
if specified, its value is configured in the Libreswan secret file for the authentication of the connection.
xauthpassword
if specified, its value is provided to Libreswan during XAUTH authentication.

 

SEE ALSO

NetworkManager(8), nm-settings(5).


 

Index

NAME
DESCRIPTION
VPN.DATA
VPN.SECRETS
SEE ALSO
LinuxReviews : manual page archive : man5