1*0Sstevel@tonic-gate# 2*0Sstevel@tonic-gate#ident "%Z%%M% %I% %E% SMI" 3*0Sstevel@tonic-gate# 4*0Sstevel@tonic-gate# Copyright 2005 Sun Microsystems, Inc. All rights reserved. 5*0Sstevel@tonic-gate# Use is subject to license terms. 6*0Sstevel@tonic-gate# 7*0Sstevel@tonic-gate# CDDL HEADER START 8*0Sstevel@tonic-gate# 9*0Sstevel@tonic-gate# The contents of this file are subject to the terms of the 10*0Sstevel@tonic-gate# Common Development and Distribution License, Version 1.0 only 11*0Sstevel@tonic-gate# (the "License"). You may not use this file except in compliance 12*0Sstevel@tonic-gate# with the License. 13*0Sstevel@tonic-gate# 14*0Sstevel@tonic-gate# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 15*0Sstevel@tonic-gate# or http://www.opensolaris.org/os/licensing. 16*0Sstevel@tonic-gate# See the License for the specific language governing permissions 17*0Sstevel@tonic-gate# and limitations under the License. 18*0Sstevel@tonic-gate# 19*0Sstevel@tonic-gate# When distributing Covered Code, include this CDDL HEADER in each 20*0Sstevel@tonic-gate# file and include the License file at usr/src/OPENSOLARIS.LICENSE. 21*0Sstevel@tonic-gate# If applicable, add the following below this CDDL HEADER, with the 22*0Sstevel@tonic-gate# fields enclosed by brackets "[]" replaced with your own identifying 23*0Sstevel@tonic-gate# information: Portions Copyright [yyyy] [name of copyright owner] 24*0Sstevel@tonic-gate# 25*0Sstevel@tonic-gate# CDDL HEADER END 26*0Sstevel@tonic-gate# 27*0Sstevel@tonic-gate 28*0Sstevel@tonic-gate## 29*0Sstevel@tonic-gate## This file should be copied into /etc/inet/ike/config to enable the 30*0Sstevel@tonic-gate## launch of the IKE daemon, in.iked(1m), at boot time. You can also 31*0Sstevel@tonic-gate## launch the IKE daemon after creating this file without rebooting by 32*0Sstevel@tonic-gate## invoking /usr/lib/inet/in.iked with a root shell. 33*0Sstevel@tonic-gate## 34*0Sstevel@tonic-gate 35*0Sstevel@tonic-gate# Consult the ike.config(4) man page for further details. Here is a small 36*0Sstevel@tonic-gate# example from the man page. 37*0Sstevel@tonic-gate 38*0Sstevel@tonic-gate### BEGINNING OF FILE 39*0Sstevel@tonic-gate 40*0Sstevel@tonic-gate### First some global parameters... 41*0Sstevel@tonic-gate 42*0Sstevel@tonic-gate## Optional hardware acceleration parameters... 43*0Sstevel@tonic-gate## Use the pathname of a library that supports PKCS#11 in quotes. 44*0Sstevel@tonic-gate## The example path is for the Sun Crypto Accelerator 1000. 45*0Sstevel@tonic-gate# pkcs11_path "/opt/SUNWconn/lib/libpkcs11.so" 46*0Sstevel@tonic-gate 47*0Sstevel@tonic-gate## certificate parameters... 48*0Sstevel@tonic-gate 49*0Sstevel@tonic-gate# Root certificates. I SHOULD use a full Distinguished Name. 50*0Sstevel@tonic-gate# I MUST have this certificate in my local filesystem, see ikecert(1m). 51*0Sstevel@tonic-gatecert_root "C=US, O=Sun Microsystems\\, Inc., CN=Sun CA" 52*0Sstevel@tonic-gate 53*0Sstevel@tonic-gate# Explicitly trusted certs that need no signatures, or perhaps self-signed 54*0Sstevel@tonic-gate# ones. Like root certificates, use full DNs for them for now. 55*0Sstevel@tonic-gatecert_trust "EMAIL=root@domain.org" 56*0Sstevel@tonic-gate 57*0Sstevel@tonic-gate# Where do I send LDAP requests? 58*0Sstevel@tonic-gateldap_server "ldap1.domain.org,ldap2.domain.org:389" 59*0Sstevel@tonic-gate 60*0Sstevel@tonic-gate# Some PKI-specific tweaks... 61*0Sstevel@tonic-gate# If you wish to ignore CRLs, uncomment this: 62*0Sstevel@tonic-gate#ignore_crls 63*0Sstevel@tonic-gate# If you wish to use HTTP (with name resolution) for URLs inside certs, 64*0Sstevel@tonic-gate# uncomment this: 65*0Sstevel@tonic-gate#use_http 66*0Sstevel@tonic-gate# HTTP proxy and socks URLs should also be indicated if needed... 67*0Sstevel@tonic-gatesocks "socks://socks-relay.domain.org" 68*0Sstevel@tonic-gate#proxy "http://http-proxy.domain.org:8080" 69*0Sstevel@tonic-gate 70*0Sstevel@tonic-gate## Phase 1 transform defaults... 71*0Sstevel@tonic-gate 72*0Sstevel@tonic-gatep1_lifetime_secs 14400 73*0Sstevel@tonic-gatep1_nonce_len 20 74*0Sstevel@tonic-gate 75*0Sstevel@tonic-gate## Parameters that may also show up in rules. 76*0Sstevel@tonic-gate 77*0Sstevel@tonic-gatep1_xform { auth_method preshared oakley_group 5 auth_alg sha encr_alg 3des } 78*0Sstevel@tonic-gatep2_pfs 2 79*0Sstevel@tonic-gate 80*0Sstevel@tonic-gate### Now some rules... 81*0Sstevel@tonic-gate 82*0Sstevel@tonic-gate{ 83*0Sstevel@tonic-gate label "simple inheritor" 84*0Sstevel@tonic-gate local_id_type ip 85*0Sstevel@tonic-gate local_addr 10.1.1.1 86*0Sstevel@tonic-gate remote_addr 10.1.1.2 87*0Sstevel@tonic-gate} 88*0Sstevel@tonic-gate 89*0Sstevel@tonic-gate{ 90*0Sstevel@tonic-gate # an index-only rule. If I'm a receiver, and all I 91*0Sstevel@tonic-gate # have are index-only rules, what do I do about inbound IKE requests? 92*0Sstevel@tonic-gate # Answer: Take them all! 93*0Sstevel@tonic-gate 94*0Sstevel@tonic-gate label "default rule" 95*0Sstevel@tonic-gate # Use whatever "host" (e.g. IP address) identity is appropriate 96*0Sstevel@tonic-gate local_id_type ipv4 97*0Sstevel@tonic-gate 98*0Sstevel@tonic-gate local_addr 0.0.0.0/0 99*0Sstevel@tonic-gate remote_addr 0.0.0.0/0 100*0Sstevel@tonic-gate 101*0Sstevel@tonic-gate p2_pfs 5 102*0Sstevel@tonic-gate 103*0Sstevel@tonic-gate # Now I'm going to have the p1_xforms 104*0Sstevel@tonic-gate p1_xform 105*0Sstevel@tonic-gate {auth_method preshared oakley_group 5 auth_alg md5 encr_alg blowfish } 106*0Sstevel@tonic-gate p1_xform 107*0Sstevel@tonic-gate {auth_method preshared oakley_group 5 auth_alg md5 encr_alg 3des } 108*0Sstevel@tonic-gate 109*0Sstevel@tonic-gate # After said list, another keyword (or a '}') will stop xform parsing. 110*0Sstevel@tonic-gate} 111*0Sstevel@tonic-gate 112*0Sstevel@tonic-gate{ 113*0Sstevel@tonic-gate # Let's try something a little more conventional. 114*0Sstevel@tonic-gate 115*0Sstevel@tonic-gate label "host to .80 subnet" 116*0Sstevel@tonic-gate local_id_type ip 117*0Sstevel@tonic-gate local_id "10.1.86.51" 118*0Sstevel@tonic-gate 119*0Sstevel@tonic-gate remote_id "" # Take any, use remote_addr for access control. 120*0Sstevel@tonic-gate 121*0Sstevel@tonic-gate local_addr 10.1.86.51 122*0Sstevel@tonic-gate remote_addr 10.1.80.0/24 123*0Sstevel@tonic-gate 124*0Sstevel@tonic-gate p1_xform 125*0Sstevel@tonic-gate { auth_method rsa_sig oakley_group 5 auth_alg md5 encr_alg 3des } 126*0Sstevel@tonic-gate p1_xform 127*0Sstevel@tonic-gate { auth_method rsa_sig oakley_group 5 auth_alg md5 encr_alg blowfish } 128*0Sstevel@tonic-gate p1_xform 129*0Sstevel@tonic-gate { auth_method rsa_sig oakley_group 5 auth_alg sha1 encr_alg 3des } 130*0Sstevel@tonic-gate p1_xform 131*0Sstevel@tonic-gate { auth_method rsa_sig oakley_group 5 auth_alg sha1 encr_alg blowfish } 132*0Sstevel@tonic-gate} 133*0Sstevel@tonic-gate 134