NM-SETTINGS-LIBRESWAN
Section: Misc. Reference Manual Pages (5)
Updated: 9 July 2018
Page Index
NAME
nm-setting-libreswan - NetworkManager Libreswan plugin supported options
DESCRIPTION
NetworkManager is based on the concept of connection profiles made up of settings
containing the network configuration (see
nm-settings(5)
for details).
The data and secret keys belonging to the vpn setting take dictionaries of key/value
pairs which depends on the specific VPN plugin. Here the list of the allowed key/value pairs
for the NetworkManager Libreswan plugin.
VPN.DATA
Many key/value pairs in the vpn.data property are passed unchanged to the Libreswan service.
The configuration is first validated by the NetworkManager plugin, which will also add some extra Libreswan
parameters and defaults as needed. There are some key/value pairs used for the plugin configuration only,
e.g., the flags used to manage the secrets needed by the connection.
Here the full list of the allowed parameters:
- right
-
contains the address of the remote VPN endpoint. Corresponds to the Libreswan parameter of the same name.
Always Required.
- rightid
-
specifies the remote identifier to be used during IKE negotiation. Corresponds to the Libreswan
parameter of the same name.
- rightrsasigkey
-
specifies the remote's public key for RSA authentication.
When the 'leftcert' key is defined a default value of "%cert" is assumed.
- left
-
contains the local address that should be used during IKE negotiation. If not specified, the value
"%defaultroute" is assumed. Corresponds to the Libreswan parameter of the same name.
- leftid
-
specifies the local identifier to be used during IKE negotiation. When this property is specified and the
IKEv1 protocol is used the key exchange will be performed in aggressive mode.
Corresponds to the Libreswan parameter of the same name.
- leftrsasigkey
-
specifies the local public key for RSA authentication. The key should be already installed in the *swan NSS database.
When the 'leftcert' key is defined a default value of "%cert" is assumed.
- leftcert
-
this defines the certificate nickname of your certificate in the NSS database.
The certificate should be already installed in the NSS database.
- leftxauthusername or leftusername
-
the username to be used during XAUTH authentication. If not specified, the
current user will be implicitly assumed. Corresponds to the Libreswan parameter
of the same name.
- dhgroup
-
ignored.
- pfsgroup
-
ignored.
- dpdtimeout
-
ignored.
- ike
-
allowed ciphers to be negotiatied to establish the IKE SAs. Corresponds to the
Libreswan parameter of the same name. Default value depends on Libreswan but for
IKEv1 aggressive negotiation: in that case the default is forced to 'aes256-sha1;modp1536'.
- esp
-
allowed ciphers for establishing phase2 SAs. Matches the Libreswan
parameter of the same name. Default value depends on Libreswan but for IKEv1 aggressive
negotiation: in that case the default is forced to 'aes256-sha1'.
- ikelifetime
-
how long the phase1 SA of a connection should last. Matches the Libreswan
parameter of the same name. Default value is '24h'.
- salifetime
-
how long the pashe2 SA of a connection should last. Matches the Libreswan
parameter of the same name. Default value is '24h'.
- vendor
-
when equals 'Cisco', the 'cisco-unity=yes' will be passed to Libreswan, to allow
ending the CISCO_UNITY payload to the peer. The option is ignored otherwise.
- rightsubnet
-
the destination subnet that should be reached throught the VPN. If omitted, will
be filled with '0.0.0.0/0'. Matches the Libreswan parameter of the same name.
- ikev2
-
use IKEv2 negotiation. Allowed values are: 'permit', 'no'/'never', 'yes'/'propose' and 'insist'.
Matches the Libreswan parameter of the same name.
- narrowing
-
only effective in IKEv2 negotiation. Allowed values are: 'yes' and 'no'.
Matches the Libreswan parameter of the same name.
- rekey
-
Allowed values are: 'yes' and 'no'.
Defaults to 'yes'.
Matches the Libreswan parameter of the same name.
- fragmentation
-
Allowed values are: 'yes' and 'no'.
Matches the Libreswan parameter of the same name.
- mobike
-
Allowed values are: 'yes' and 'no'.
Matches the Libreswan parameter of the same name.
- pskinputmodes
-
where the 'pskvalue' can be retrieved. Used internally by the plugin. Allowed values are: 'unused', 'save', 'ask'.
- xauthpasswordinputmodes
-
where the 'xauthpassword' can be retrieved. Used internally by the plugin. Allowed values are: 'unused', 'save', 'ask'.
- pskvalue-flags
-
how to handle the 'pskvalue' secret. See the "Secret flag type" section at
nm-settings(5)
for details.
- xauthpassword-flags
-
how to handle the 'xauthpassword' secret. See the "Secret flag type" section at
nm-settings(5)
for details.
VPN.SECRETS
The vpn.secrets property holds the secrets stored in the connection (if any).
The allowed keys are:
- pskvalue
-
if specified, its value is configured in the Libreswan secret file for the authentication
of the connection.
- xauthpassword
-
if specified, its value is provided to Libreswan during XAUTH authentication.
SEE ALSO
NetworkManager(8),
nm-settings(5).