Documentation: Libreswan Opportunistic IPsec using LetsEncrypt
Introduction
letsencrypt invokes several of the utilities involved in controlling the Opportunistic Encryption system, running the specified {command} with the specified [argument] as if it had been invoked directly. The command creates a secure Opportunistic Connection between the hosts commonly referred to as client and server. The client connects to the server and remains anonymous, whereas the server is authenticated before connecting to it. The server is not anonymous. The server uses Let's Encrypt certificates for authentication and encryption purposes.
More information about the utility is available at Libreswan Opportunistic IPsec using LetsEncrypt .
Prerequisite
The following packages are required to avail full features of the `letsencrypt` program:
1. IPsec - Libreswan
2. certutil
3. wget
4. certbot *
5. openssl *
* Required only for hosts acting as servers. Not required for hosts acting as clients.
Installation
To use the program one needs to have IPsec (Libreswan) installed. Libreswan installation instructions are available here
Available [arguments]
ipsec letsencrypt [arguments]
Available [arguments]
--server, --client, --test, --generate-certificate hostname, --renew hostname, --help, --disable
Note - To get the list of all acceptable arguments run ipsec letsencrypt --help
Configuration Used
There are 2 default configurations, one for the server (oe-letsencrypt-server.conf) and other for the client (oe-letsencrypt-client.conf).
1. The server configuration (oe-letsencrypt-server.conf) is as follows:
Note - please add your server dns name in the place of leftcert=YourServerDNSName. E.g. leftcert=letsencrypt.libreswan.org
conn clear-or-private
leftid=%fromcert
leftrsasigkey=%cert
# name of your generated letsencrypt certificate e.g. letsencrypt.libreswan.org
leftcert=YourServerDNSName
leftauth=rsasig
left=%defaultroute
#leftmodecfgclient=yes
#
rightid=%null
rightauth=null
right=%opportunisticgroup
#
negotiationshunt=passthrough
failureshunt=passthrough
type=tunnel
ikev2=insist
sendca=issuer
auto=add
#
rightaddresspool=100.64.0.1-100.64.255.254
rightmodecfgclient=yes
2. The client configuration (oe-letsencrypt-client.conf) is as follows:
conn private-or-clear rightid=%fromcert rightrsasigkey=%cert rightauth=rsasig right=%opportunisticgroup rightmodecfgclient=yes rightcat=yes # Any CA will do because we only load the LetsEncrypt CA rightca=%any # left=%defaultroute leftid=%null leftauth=null leftmodecfgclient=yes leftcat=yes # narrowing=yes type=tunnel ikev2=insist negotiationshunt=drop failureshunt=passthrough keyingtries=1 retransmit-timeout=3s auto=ondemand
- The default configuration file
private-or-clearpresent in /etc/ipsec.d/policies/ contains the following lines:
# The libreswan letsenccrypt test server - this can be left enabled at all times 193.110.157.131/32 # Attempt OE IPsec using letsencrypt for the entire Internet - Comment out to disable 0.0.0.0/0
If you are trying to connect to a server you should add the ip of the server to this file OR other configuration file which is being used.
Note - The OE attempt to the entire internet is enabled by default, This means, for every host you try to connect the OE connection establishing is always attempted. You can disable this by commenting the line 0.0.0.0/0 .
Functions of various [arguments]
Note - OE refers to Opportunistic Encryption.
1. ipsec letsencrypt --client
2. ipsec letsencrypt --server
For the initial setup, it is to be run when installing the project for the first time. This [argument] performs the following tasks:
- performs the 1st time server/client Installation.
- checks if the command is run as root.
- Sets and restores the secure umask at appropriate locations.
- Creates temporary directories for downloading the certificates.
- Checks for any existing OE connections.
- Downloads the LetsEncrypt CA and intermediate certificates.
- Checks if NSS database exists.
- Initializes the NSS database and import the LetsEncrypt certificates in it.
- Saves the required client/server configuration in the /etc/ipsec.d directory.
- Restores the security context of the saved configuration using restorecon (if it is available on the system).
- Establishes a secure OE connection by sending pings to the letsencrypt.libreswan.org server.
- Checks for the success of establishing the OE connection.
- Displays OE connection status to user.
Note - The command creates a secure Opportunistic Connection between the hosts commonly referred as client and server. The client connects to the server and remains anonymous, where as the server is authenticated before connecting to it. The server is not anonymous. The server uses Let's Encrypt certificates for authentication and encryption purposes.
Sample Output -
[root@linux]# ipsec letsencrypt --client Installing for Client. Downloading the letsencrypt certificates Importing the downloaded certificates into the database Saving the required configuration To confirm the success try running 'ipsec letsencrypt --test' on the client
3. ipsec letsencrypt --test
For testing the configuration/connections. This [argument] checks for the success of establishing an OE connection, and performs the following tasks:
- Check for any existing OE connections.
- checks if the command is run as root.
- Establish an OE connection.
- Sending pings to the letsencrypt.libreswan.org server.
- Checking the success of establishing OE connection.
- Displaying connection status to the user.
Sample Output -
[root@linux]# ipsec letsencrypt --test Existing OE Connections Found. Please stop the connections using 'ipsec restart' and try again. 006 #4: "private-or-clear#193.110.157.131/32"[2] 100.64.0.1/32=== ...193.110.157.131, type=ESP, add_time=1565535553, inBytes=0, outBytes=252, id='CN=letsencrypt.libreswan.org', lease=100.64.0.1/32
4. ipsec letsencrypt --generate-certificate hostname
Note - hostname refers to the name of the host. e.g. libreswan.org.
For generating the certificate. This [argument] is used for Generating the certificate using Certbot, and performing the following tasks:
- Check if certbot is installed.
- checks if the command is run as root.
- Sets and restores the secure umask at appropriate locations.
- Creates temporary directories for downloading the certificates.
- Generating #pkcs12 file and importing it in the nss database.
- Displays the certificates installed in nss database.
- Generates the certbot configuration for reusing the private key.
- Creates a crontab for automatic certificate renewals.
Sample Output -
[root@linux]# ipsec letsencrypt --generate-certificate letsencrypt.org
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Please enter in your domain name(s) (comma and/or space separated) (Enter 'c'
to cancel): letsencrypt.libreswan.org
Cert not yet due for renewal
You have an existing certificate that has exactly the same domains or certificate name you requested and isn't close to expiry.
(ref: /etc/letsencrypt/renewal/letsencrypt.libreswan.org.conf)
What would you like to do?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: Keep the existing certificate for now
2: Renew & replace the cert (limit ~5 per 7 days)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2
Renewing an existing certificate
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/letsencrypt.libreswan.org/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/letsencrypt.libreswan.org/privkey.pem
Your cert will expire on 2019-11-03. To obtain a new or tweaked
version of this certificate in the future, simply run certbot
again. To non-interactively renew *all* of your certificates, run
"certbot renew"
- If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
Enter Export Password:
Verifying - Enter Export Password:
Importing the certificate in database.
Enter password for PKCS12 file:
pk12util: PKCS12 IMPORT SUCCESSFUL
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
isrgrootx1 CT,,
trustid-x3-root CT,,
letsencryptauthorityx3 ,,
lets-encrypt-x3-cross-signed ,,
letsencrypt.libreswan.org u,u,u
To confirm the success try running 'ipsec letsencrypt -t' on the client
5. ipsec letsencrypt --renew hostname
Note -
1. hostname refers to the name of the host. e.g. libreswan.org.
2. The above command is an alias to certbot renew --deploy-hook 'ipsec letsencrypt -ug hostname'
For updating the generated certificate (keeping the private key same). This [argument] is used to update the certificate keeping the private key same, and performs the following tasks:
- checks if the command is run as root.
- Updating the certificate using Certbot keeping the private key same.
- Sets and restores the secure umask at appropriate locations.
- Creates temporary directories for downloading the certificates.
- Generating #pkcs12 file.
- Importing the certificate in nss database.
- Displaying the certificates installed in nss database.
- Restarting the IPsec to load the latest updated certificate.
Sample Output -
[root@linux]# ipsec letsencrypt --renew letsencrypt.org
Saving debug log to /var/log/letsencrypt/letsencrypt.log
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/letsencrypt.libreswan.org.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert not yet due for renewal
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
The following certs are not due for renewal yet:
/etc/letsencrypt/live/letsencrypt.libreswan.org/fullchain.pem expires on 2019-11-03 (skipped)
No renewals were attempted.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Enter Export Password:
Verifying - Enter Export Password:
Importing the certificate in the database.
Enter password for PKCS12 file:
pk12util: PKCS12 IMPORT SUCCESSFUL
Displaying the certificates installed in the database.
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
isrgrootx1 CT,,
trustid-x3-root CT,,
letsencryptauthorityx3 ,,
lets-encrypt-x3-cross-signed ,,
letsencrypt.libreswan.org u,u,u
To confirm the success try running 'ipsec letsencrypt -t' on the client
6. ipsec letsencrypt --disable
For disabling IPsec service.
Sample Output -
[root@linux]# ipsec letsencrypt --disable Please restart the IPsec service using 'ipsec restart' for changes to take effect.
7. ipsec letsencrypt --help
For providing information regarding various {commands} and [arguments].
Sample Output -
[root@linux]# ipsec letsencrypt --help Usage: ipsec letsencrypt [arguments] Available [arguments] --server, --client, --test, --generate-certificate hostname, --renew hostname, --help, --disable --client : For initial client setup. usage: 'ipsec letsencrypt --client' --server : For initial server setup. usage: 'ipsec letsencrypt --server' --test : For testing the configuration/connections. usage: 'ipsec letsencrypt --test' --generate-certificate hostname : For generating the certificate. usage: 'ipsec letsencrypt --generate-certificate hostname' --renew hostname : For updating the generated certificate (keeping the private key same) use the following command. usage: 'ipsec letsencrypt --renew hostname' --disable : For disabling IPsec service. usage: 'ipsec letsencrypt --disable'
Testing and Debugging
- To see all the active IPsec OE tunnels (and the amount of traffic encrypted)
sudo ipsec whack --trafficstatus
Sample Output -
006 #4: "private-or-clear#193.110.157.131/32"[2] 100.64.0.1/32=== ...193.110.157.131, type=ESP, add_time=1565535553, inBytes=0, outBytes=252, id='CN=letsencrypt.libreswan.org', lease=100.64.0.1/32
Note - Inactive tunnels are torn down (once an hour)
- To see all the IP addresses that were tried, but did not offer IPsec OE
sudo ipsec whack --shuntstatus
Sample Output -
000 Bare Shunt list: 000
- To see the inside state of the libreswan pluto daemon
sudo ipsec status
Sample Output -
000 using kernel interface: netkey . . . . 000 #4: "private-or-clear#193.110.157.131/32"[2] 100.64.0.1/32=== ...193.110.157.131 esp.affba9fa@193.110.157.131 esp.a390a2a8@192.168.43.235 tun.0@193.110.157.131 tun.0@192.168.43.235 ref=0 refhim=0 Traffic: ESPin=0B ESPout=252B! ESPmax=0B 000 000 Bare Shunt list: 000
- To restart IPsec OE
Note - It will destroy all your esisting OE connections.
sudo ipsec restart
- To verify IPsec (Libreswan) installation and check configuration files
sudo ipsec verify
Sample Output -
Verifying installed system and configuration files
Version check and ipsec on-path [OK]
Libreswan 3.29 (netkey) on 5.1.20-300.fc30.x86_64
Checking for IPsec support in kernel [OK]
NETKEY: Testing XFRM related proc values
ICMP default/send_redirects [OK]
ICMP default/accept_redirects [OK]
XFRM larval drop [OK]
Pluto ipsec.conf syntax [OK]
Checking rp_filter [OK]
Checking that pluto is running [OK]
Pluto listening for IKE on udp 500 [OK]
Pluto listening for IKE/NAT-T on udp 4500 [OK]
Pluto ipsec.secret syntax [OK]
Checking 'ip' command [OK]
Checking 'iptables' command [OK]
Checking 'prelink' command does not interfere with FIPS [OK]
Checking for obsolete ipsec.conf options [OK]
- Manual debug version of OE request
sudo ipsec restart sleep 5 sudo ipsec whack --oppohere YOURIP --oppothere REMOTEIP (ipsec whack --oppohere 169.149.111.125 --oppothere 193.110.157.131)
Sample Output -
002 initiate on demand from 142.93.216.119:0 to 193.110.157.131:0 proto=0 because: whack 133 "private-or-clear#193.110.157.131/32"[1] ...193.110.157.131 #1: initiate 002 "private-or-clear#193.110.157.131/32"[1] ...193.110.157.131: constructed local IKE proposals for private-or-clear#193.110.157.131/326, . . . HMAC_SHA2_256_128; ESN=DISABLED 5:ESP:ENCR=AES_CBC_128;INTEG=HMAC_SHA1_96;ESN=DISABLED (default) 002 "private-or-clear#193.110.157.131/32"[1] ...193.110.157.131 #2: certificate verified OK: CN=letsencrypt.libreswan.org 003 "private-or-clear#193.110.157.131/32"[1] ...193.110.157.131 #2: Authenticated using RSA 002 "private-or-clear#193.110.157.131/32"[1] ...193.110.157.131 #2: negotiated connection [142.93.216.119-142.93.216.119:0-65535 0] -> [193.110.157.131-193.110.157.131:0-65535 0]
Common Errors
- no routed template covers this pair error while running the command
sudo ipsec whack --oppohere 76.10.157.68 --oppothere 1.2.3.4
This is due to the fact that the target IP address (1.2.3.4) is not covered by /etc/ipsec.d/policies/private*
- Failed to establish an OE connection.
If you get this error. One of the possible reasons might be, you have more than one configuration(.conf) files in the /etc/ipsec.d directory.