Using StrongSwan with smart cards Introduction Prerequisites

More documents

Recommendations

Info

Using StrongSwan with smart cards: PIN %smartcard %promptwill prompt you for the PIN when you start up the first IPsec connection using the command$ ipsec up sunThe ipsec up command calls the whack function which in turn communicates with Pluto over a socket. Since the whack functioncall is executed from a command window, Pluto can prompt you for the PIN over this socket connection. Unfortunatelyroadwarrior connections which just wait passively for peers cannot be initiated via the command window:conn rwright=%anyrightrsasigkey=%certleft=%defaultrouteleftcert=%smartcard1:50auto=addBut if there is a corresponding entry: PIN %smartcard1:50 %promptin ipsec.secrets, then the standard command$ ipsec rereadsecretsor the alias$ ipsec secretscan be used to enter the PIN code for this connection interactively. The command$ ipsec listcardscan be executed at any time to check the current status of the PIN code[s].PIN-pad equipped smartcard readersSmartcard readers with an integrated PIN pad offer an increased security level because the PIN entry cannot be sniffed on thehost computer e.g. by a surrepticiously installed key logger. In order to tell pluto not to prompt for the PIN on the host itself, theentry: PIN %smartcard:50 %pinpadcan be used in ipsec.secrets. Because the key pad does not cache the PIN in the smartcard reader, it must be entered for everyPKCS #11 session login. By default pluto does a session logout after every RSA signature. In order to avoid the repeated entryof the PIN code during the periodic IKE main mode rekeyings, the following parameter can be set in the config setup section ofipsec.conf:config setuppkcs11keepstate=yesThe default setting ispkcs11keepstate=noCopyright GOOZE 2010-2011 http://www.gooze.eu 6 / 7
Using StrongSwan with smart cardsLinksYou may read this very good totorial (in German):http://mopoinfo.vpn.uni-freiburg.de/node/103 [4]Copyright GOOZE.EU 2011.Source URL: http://www.gooze.eu/howto/using-strongswan-with-smart-cardsLinks:[1] http://www.strongswan.org/[2] http://www.strongswan.org/uml/testresults43/ikev2/rw-cert/[3] http://www.gooze.eu/howto/smart-card-quickstarter-guide[4] http://mopoinfo.vpn.uni-freiburg.de/node/103Copyright GOOZE 2010-2011 http://www.gooze.eu 7 / 7
Page 1 and 2: Using StrongSwan with smart cardsPu
Page 4 and 5: Using StrongSwan with smart cardsFi

Using StrongSwan with smart cards Introduction Prerequisites

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?