svn commit: r44631 - head/en_US.ISO8859-1/books/handbook/security
Dru Lavigne
dru at FreeBSD.org
Tue Apr 22 20:03:46 UTC 2014
Author: dru
Date: Tue Apr 22 20:03:45 2014
New Revision: 44631
URL: http://svnweb.freebsd.org/changeset/doc/44631
Log:
White space fix only. Translators can ignore.
Sponsored by: iXsystems
Modified:
head/en_US.ISO8859-1/books/handbook/security/chapter.xml
Modified: head/en_US.ISO8859-1/books/handbook/security/chapter.xml
==============================================================================
--- head/en_US.ISO8859-1/books/handbook/security/chapter.xml Tue Apr 22 19:43:18 2014 (r44630)
+++ head/en_US.ISO8859-1/books/handbook/security/chapter.xml Tue Apr 22 20:03:45 2014 (r44631)
@@ -1993,7 +1993,8 @@ Connection closed by foreign host.</scre
<sect1 xml:id="ipsec">
<info>
- <title><acronym>VPN</acronym> over <acronym>IPsec</acronym></title>
+ <title><acronym>VPN</acronym> over
+ <acronym>IPsec</acronym></title>
<authorgroup>
<author><personname><firstname>Nik</firstname><surname>Clayton</surname></personname><affiliation>
@@ -2012,183 +2013,190 @@ Connection closed by foreign host.</scre
<primary><acronym>IPsec</acronym></primary>
</indexterm>
- <para>Internet Protocol Security (<acronym>IPsec</acronym>) is a set of protocols which sit on
- top of the Internet Protocol (<acronym>IP</acronym>) layer.
- It allows two or more hosts to communicate in a secure manner
- by authenticating and encrypting each <acronym>IP</acronym> packet of a communication session.
- The &os; <acronym>IPsec</acronym> network stack is based on the
- <link xlink:href="http://www.kame.net/">http://www.kame.net/</link>
- implementation and supports both <acronym>IPv4</acronym> and
- <acronym>IPv6</acronym> sessions.</para>
+ <para>Internet Protocol Security (<acronym>IPsec</acronym>) is a
+ set of protocols which sit on top of the Internet Protocol
+ (<acronym>IP</acronym>) layer. It allows two or more hosts to
+ communicate in a secure manner by authenticating and encrypting
+ each <acronym>IP</acronym> packet of a communication session.
+ The &os; <acronym>IPsec</acronym> network stack is based on the
+ <link
+ xlink:href="http://www.kame.net/">http://www.kame.net/</link>
+ implementation and supports both <acronym>IPv4</acronym> and
+ <acronym>IPv6</acronym> sessions.</para>
- <indexterm>
- <primary><acronym>IPsec</acronym></primary>
- <secondary>ESP</secondary>
- </indexterm>
-
- <indexterm>
- <primary><acronym>IPsec</acronym></primary>
- <secondary>AH</secondary>
- </indexterm>
-
- <para><acronym>IPsec</acronym> is comprised of the following sub-protocols:</para>
+ <indexterm>
+ <primary><acronym>IPsec</acronym></primary>
+ <secondary>ESP</secondary>
+ </indexterm>
- <itemizedlist>
- <listitem>
- <para><emphasis>Encapsulated Security Payload
- (<acronym>ESP</acronym>)</emphasis>: this protocol
- protects the <acronym>IP</acronym> packet data from third party interference
- by encrypting the contents using symmetric cryptography
- algorithms such as Blowfish and <acronym>3DES</acronym>.</para>
- </listitem>
+ <indexterm>
+ <primary><acronym>IPsec</acronym></primary>
+ <secondary>AH</secondary>
+ </indexterm>
- <listitem>
- <para><emphasis>Authentication Header
- (<acronym>AH</acronym>)</emphasis>): this protocol
- protects the <acronym>IP</acronym> packet header from third party
- interference and spoofing by computing a cryptographic
- checksum and hashing the <acronym>IP </acronym> packet header fields with a
- secure hashing function. This is then followed by an
- additional header that contains the hash, to allow the
- information in the packet to be authenticated.</para>
- </listitem>
+ <para><acronym>IPsec</acronym> is comprised of the following
+ sub-protocols:</para>
- <listitem>
- <para><emphasis>IP Payload Compression Protocol
- (<acronym>IPComp</acronym></emphasis>): this protocol
- tries to increase communication performance by compressing
- the <acronym>IP </acronym> payload in order ro reduce the
- amount of data sent.</para>
- </listitem>
- </itemizedlist>
+ <itemizedlist>
+ <listitem>
+ <para><emphasis>Encapsulated Security Payload
+ (<acronym>ESP</acronym>)</emphasis>: this protocol protects
+ the <acronym>IP</acronym> packet data from third party
+ interference by encrypting the contents using symmetric
+ cryptography algorithms such as Blowfish and
+ <acronym>3DES</acronym>.</para>
+ </listitem>
+
+ <listitem>
+ <para><emphasis>Authentication Header
+ (<acronym>AH</acronym>)</emphasis>): this protocol protects
+ the <acronym>IP</acronym> packet header from third party
+ interference and spoofing by computing a cryptographic
+ checksum and hashing the <acronym>IP </acronym> packet
+ header fields with a secure hashing function. This is then
+ followed by an additional header that contains the hash, to
+ allow the information in the packet to be
+ authenticated.</para>
+ </listitem>
+
+ <listitem>
+ <para><emphasis>IP Payload Compression Protocol
+ (<acronym>IPComp</acronym></emphasis>): this protocol tries
+ to increase communication performance by compressing the
+ <acronym>IP </acronym> payload in order ro reduce the
+ amount of data sent.</para>
+ </listitem>
+ </itemizedlist>
- <para>These protocols can
- either be used together or separately, depending on the
- environment.</para>
+ <para>These protocols can either be used together or separately,
+ depending on the environment.</para>
- <indexterm>
- <primary><acronym>VPN</acronym></primary>
- </indexterm>
+ <indexterm>
+ <primary><acronym>VPN</acronym></primary>
+ </indexterm>
- <indexterm>
- <primary>virtual private network</primary>
- <see>VPN</see>
- </indexterm>
+ <indexterm>
+ <primary>virtual private network</primary>
+ <see>VPN</see>
+ </indexterm>
- <para><acronym>IPsec</acronym> supports two modes of operation.
- The first mode, <firstterm>Transport Mode</firstterm>,
- protects communications between two hosts. The second mode,
- <firstterm>Tunnel Mode</firstterm>, is used to build virtual tunnels,
- commonly known as Virtual Private Networks
- (<acronym>VPN</acronym>s). Consult &man.ipsec.4;
- for detailed information on the <acronym>IPsec</acronym> subsystem in
- &os;.</para>
-
- <para>To add <acronym>IPsec</acronym> support to the kernel, add the following
- options to the custom kernel configuration file and rebuild
- the kernel using the instructions in <xref linkend="kernelconfig"/>:</para>
+ <para><acronym>IPsec</acronym> supports two modes of operation.
+ The first mode, <firstterm>Transport Mode</firstterm>, protects
+ communications between two hosts. The second mode,
+ <firstterm>Tunnel Mode</firstterm>, is used to build virtual
+ tunnels, commonly known as Virtual Private Networks
+ (<acronym>VPN</acronym>s). Consult &man.ipsec.4; for detailed
+ information on the <acronym>IPsec</acronym> subsystem in
+ &os;.</para>
+
+ <para>To add <acronym>IPsec</acronym> support to the kernel, add
+ the following options to the custom kernel configuration file
+ and rebuild the kernel using the instructions in <xref
+ linkend="kernelconfig"/>:</para>
- <indexterm>
- <primary>kernel options</primary>
- <secondary>IPSEC</secondary>
- </indexterm>
+ <indexterm>
+ <primary>kernel options</primary>
+ <secondary>IPSEC</secondary>
+ </indexterm>
- <screen>options IPSEC #IP security
+ <screen>options IPSEC #IP security
device crypto</screen>
- <indexterm>
- <primary>kernel options</primary>
- <secondary>IPSEC_DEBUG</secondary>
- </indexterm>
-
- <para>If <acronym>IPsec</acronym> debugging support is desired, the following
- kernel option should also be added:</para>
+ <indexterm>
+ <primary>kernel options</primary>
+ <secondary>IPSEC_DEBUG</secondary>
+ </indexterm>
- <screen>options IPSEC_DEBUG #debug for IP security</screen>
+ <para>If <acronym>IPsec</acronym> debugging support is desired,
+ the following kernel option should also be added:</para>
- <para>This rest of this chapter demonstrates the process of
- setting up an <acronym>IPsec</acronym> <acronym>VPN</acronym>
- between a home network and a corporate
- network. In the example scenario:</para>
+ <screen>options IPSEC_DEBUG #debug for IP security</screen>
- <itemizedlist>
- <listitem>
- <para>Both sites are connected to the Internet through a
- gateway that is running &os;.</para>
- </listitem>
-
- <listitem>
- <para>The gateway on each network has at least one external
- <acronym>IP</acronym> address. In this example, the corporate <acronym>LAN</acronym>'s
- external <acronym>IP</acronym> address is <systemitem
+ <para>This rest of this chapter demonstrates the process of
+ setting up an <acronym>IPsec</acronym> <acronym>VPN</acronym>
+ between a home network and a corporate network. In the example
+ scenario:</para>
+
+ <itemizedlist>
+ <listitem>
+ <para>Both sites are connected to the Internet through a
+ gateway that is running &os;.</para>
+ </listitem>
+
+ <listitem>
+ <para>The gateway on each network has at least one external
+ <acronym>IP</acronym> address. In this example, the
+ corporate <acronym>LAN</acronym>'s external
+ <acronym>IP</acronym> address is <systemitem
class="ipaddress">172.16.5.4</systemitem> and the home
<acronym>LAN</acronym>'s external <acronym>IP</acronym>
address is <systemitem
class="ipaddress">192.168.1.12</systemitem>.</para>
- </listitem>
+ </listitem>
- <listitem>
- <para>The internal addresses of the two networks can be
- either public or private <acronym>IP</acronym> addresses. However, the
- address space must not collide. For example, both
- networks cannot use <systemitem
- class="ipaddress">192.168.1.x</systemitem>. In this
- example, the corporate <acronym>LAN</acronym>'s
- internal <acronym>IP</acronym> address is <systemitem
+ <listitem>
+ <para>The internal addresses of the two networks can be either
+ public or private <acronym>IP</acronym> addresses. However,
+ the address space must not collide. For example, both
+ networks cannot use <systemitem
+ class="ipaddress">192.168.1.x</systemitem>. In this
+ example, the corporate <acronym>LAN</acronym>'s internal
+ <acronym>IP</acronym> address is <systemitem
class="ipaddress">10.246.38.1</systemitem> and the home
<acronym>LAN</acronym>'s internal <acronym>IP</acronym>
- address is <systemitem class="ipaddress">10.0.0.5</systemitem>.</para>
- </listitem>
- </itemizedlist>
+ address is <systemitem
+ class="ipaddress">10.0.0.5</systemitem>.</para>
+ </listitem>
+ </itemizedlist>
- <sect2>
- <info>
- <title>Configuring a <acronym>VPN</acronym> on &os;</title>
+ <sect2>
+ <info>
+ <title>Configuring a <acronym>VPN</acronym> on &os;</title>
<authorgroup>
<author><personname><firstname>Tom</firstname><surname>Rhodes</surname></personname><affiliation>
<address><email>trhodes at FreeBSD.org</email></address>
</affiliation><contrib>Written by </contrib></author>
</authorgroup>
- </info>
+ </info>
- <para>To begin, <package>security/ipsec-tools</package>
- must be installed from the Ports Collection. This software
- provides a number of applications which support the
- configuration.</para>
-
- <para>The next requirement is to create two &man.gif.4;
- pseudo-devices which will be used to tunnel packets and
- allow both networks to communicate properly. As <systemitem
- class="username">root</systemitem>, run the following
- commands, replacing <replaceable>internal</replaceable> and
- <replaceable>external</replaceable> with the real IP
- addresses of the internal and external interfaces of the two
- gateways:</para>
+ <para>To begin, <package>security/ipsec-tools</package> must be
+ installed from the Ports Collection. This software provides a
+ number of applications which support the configuration.</para>
+
+ <para>The next requirement is to create two &man.gif.4;
+ pseudo-devices which will be used to tunnel packets and allow
+ both networks to communicate properly. As <systemitem
+ class="username">root</systemitem>, run the following
+ commands, replacing <replaceable>internal</replaceable> and
+ <replaceable>external</replaceable> with the real IP
+ addresses of the internal and external interfaces of the two
+ gateways:</para>
- <screen>&prompt.root; <userinput>ifconfig gif0 create</userinput>
+ <screen>&prompt.root; <userinput>ifconfig gif0 create</userinput>
&prompt.root; <userinput>ifconfig gif0 <replaceable>internal1 internal2</replaceable></userinput>
&prompt.root; <userinput>ifconfig gif0 tunnel <replaceable>external1 external2</replaceable></userinput></screen>
- <para>Verify the setup on each gateway, using
- <command>ifconfig</command>. Here is the output from Gateway 1:</para>
+ <para>Verify the setup on each gateway, using
+ <command>ifconfig</command>. Here is the output from Gateway
+ 1:</para>
- <programlisting>gif0: flags=8051 mtu 1280
+ <programlisting>gif0: flags=8051 mtu 1280
tunnel inet 172.16.5.4 --> 192.168.1.12
inet6 fe80::2e0:81ff:fe02:5881%gif0 prefixlen 64 scopeid 0x6
inet 10.246.38.1 --> 10.0.0.5 netmask 0xffffff00</programlisting>
- <para>Here is the output from Gateway 2:</para>
+ <para>Here is the output from Gateway 2:</para>
- <programlisting>gif0: flags=8051 mtu 1280
+ <programlisting>gif0: flags=8051 mtu 1280
tunnel inet 192.168.1.12 --> 172.16.5.4
inet 10.0.0.5 --> 10.246.38.1 netmask 0xffffff00
inet6 fe80::250:bfff:fe3a:c1f%gif0 prefixlen 64 scopeid 0x4</programlisting>
- <para>Once complete, both internal <acronym>IP</acronym>
- addresses should be reachable using &man.ping.8;:</para>
+ <para>Once complete, both internal <acronym>IP</acronym>
+ addresses should be reachable using &man.ping.8;:</para>
- <programlisting>priv-net# ping 10.0.0.5
+ <programlisting>priv-net# ping 10.0.0.5
PING 10.0.0.5 (10.0.0.5): 56 data bytes
64 bytes from 10.0.0.5: icmp_seq=0 ttl=64 time=42.786 ms
64 bytes from 10.0.0.5: icmp_seq=1 ttl=64 time=19.255 ms
@@ -2209,23 +2217,23 @@ PING 10.246.38.1 (10.246.38.1): 56 data
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 28.106/94.594/154.524/49.814 ms</programlisting>
- <para>As expected, both sides have the ability to send and
- receive <acronym>ICMP</acronym> packets from the privately
- configured addresses. Next, both gateways must be told how
- to route packets in order to correctly send traffic from
- either network. The following commands will achieve this
- goal:</para>
+ <para>As expected, both sides have the ability to send and
+ receive <acronym>ICMP</acronym> packets from the privately
+ configured addresses. Next, both gateways must be told how to
+ route packets in order to correctly send traffic from either
+ network. The following commands will achieve this
+ goal:</para>
- <screen>&prompt.root; <userinput>corp-net# route add <replaceable>10.0.0.0 10.0.0.5 255.255.255.0</replaceable></userinput>
+ <screen>&prompt.root; <userinput>corp-net# route add <replaceable>10.0.0.0 10.0.0.5 255.255.255.0</replaceable></userinput>
&prompt.root; <userinput>corp-net# route add net <replaceable>10.0.0.0: gateway 10.0.0.5</replaceable></userinput>
&prompt.root; <userinput>priv-net# route add <replaceable>10.246.38.0 10.246.38.1 255.255.255.0</replaceable></userinput>
&prompt.root; <userinput>priv-net# route add host <replaceable>10.246.38.0: gateway 10.246.38.1</replaceable></userinput></screen>
- <para>At this point, internal machines should be reachable
- from each gateway as well as from machines behind the
- gateways. Again, use &man.ping.8; to confirm:</para>
+ <para>At this point, internal machines should be reachable from
+ each gateway as well as from machines behind the gateways.
+ Again, use &man.ping.8; to confirm:</para>
- <programlisting>corp-net# ping 10.0.0.8
+ <programlisting>corp-net# ping 10.0.0.8
PING 10.0.0.8 (10.0.0.8): 56 data bytes
64 bytes from 10.0.0.8: icmp_seq=0 ttl=63 time=92.391 ms
64 bytes from 10.0.0.8: icmp_seq=1 ttl=63 time=21.870 ms
@@ -2247,15 +2255,15 @@ PING 10.246.38.1 (10.246.38.107): 56 dat
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 21.145/31.721/53.491/12.179 ms</programlisting>
- <para>Setting up the tunnels is the easy part. Configuring a
- secure link is a more in depth process. The following
- configuration uses pre-shared (<acronym>PSK</acronym>)
- <acronym>RSA</acronym> keys. Other than the
- <acronym>IP</acronym> addresses, the
- <filename>/usr/local/etc/racoon/racoon.conf</filename> on
- both gateways will be identical and look similar to:</para>
+ <para>Setting up the tunnels is the easy part. Configuring a
+ secure link is a more in depth process. The following
+ configuration uses pre-shared (<acronym>PSK</acronym>)
+ <acronym>RSA</acronym> keys. Other than the
+ <acronym>IP</acronym> addresses, the
+ <filename>/usr/local/etc/racoon/racoon.conf</filename> on both
+ gateways will be identical and look similar to:</para>
- <programlisting>path pre_shared_key "/usr/local/etc/racoon/psk.txt"; #location of pre-shared key file
+ <programlisting>path pre_shared_key "/usr/local/etc/racoon/psk.txt"; #location of pre-shared key file
log debug; #log verbosity setting: set to 'notify' when testing and debugging is complete
padding # options are not to be changed
@@ -2313,33 +2321,33 @@ sainfo (address 10.246.38.0/24 any addr
compression_algorithm deflate;
}</programlisting>
- <para>For descriptions of each available option, refer to the
- manual page for <filename>racoon.conf</filename>.</para>
+ <para>For descriptions of each available option, refer to the
+ manual page for <filename>racoon.conf</filename>.</para>
- <para>The Security Policy Database (<acronym>SPD</acronym>)
- needs to be configured so that &os; and
- <application>racoon</application> are able to encrypt and
- decrypt network traffic between the hosts.</para>
-
- <para>This can be achieved with a shell script, similar to the
- following, on the corporate gateway. This file will be used
- during system initialization and should be saved as
- <filename>/usr/local/etc/racoon/setkey.conf</filename>.</para>
+ <para>The Security Policy Database (<acronym>SPD</acronym>)
+ needs to be configured so that &os; and
+ <application>racoon</application> are able to encrypt and
+ decrypt network traffic between the hosts.</para>
+
+ <para>This can be achieved with a shell script, similar to the
+ following, on the corporate gateway. This file will be used
+ during system initialization and should be saved as
+ <filename>/usr/local/etc/racoon/setkey.conf</filename>.</para>
- <programlisting>flush;
+ <programlisting>flush;
spdflush;
# To the home network
spdadd 10.246.38.0/24 10.0.0.0/24 any -P out ipsec esp/tunnel/172.16.5.4-192.168.1.12/use;
spdadd 10.0.0.0/24 10.246.38.0/24 any -P in ipsec esp/tunnel/192.168.1.12-172.16.5.4/use;</programlisting>
- <para>Once in place, <application>racoon</application> may be
- started on both gateways using the following command:</para>
+ <para>Once in place, <application>racoon</application> may be
+ started on both gateways using the following command:</para>
- <screen>&prompt.root; <userinput>/usr/local/sbin/racoon -F -f /usr/local/etc/racoon/racoon.conf -l /var/log/racoon.log</userinput></screen>
+ <screen>&prompt.root; <userinput>/usr/local/sbin/racoon -F -f /usr/local/etc/racoon/racoon.conf -l /var/log/racoon.log</userinput></screen>
- <para>The output should be similar to the following:</para>
+ <para>The output should be similar to the following:</para>
- <programlisting>corp-net# /usr/local/sbin/racoon -F -f /usr/local/etc/racoon/racoon.conf
+ <programlisting>corp-net# /usr/local/sbin/racoon -F -f /usr/local/etc/racoon/racoon.conf
Foreground mode.
2006-01-30 01:35:47: INFO: begin Identity Protection mode.
2006-01-30 01:35:48: INFO: received Vendor ID: KAME/racoon
@@ -2352,43 +2360,43 @@ Foreground mode.
2006-01-30 01:36:18: INFO: IPsec-SA established: ESP/Tunnel 192.168.1.12[0]->172.16.5.4[0] spi=124397467(0x76a279b)
2006-01-30 01:36:18: INFO: IPsec-SA established: ESP/Tunnel 172.16.5.4[0]->192.168.1.12[0] spi=175852902(0xa7b4d66)</programlisting>
- <para>To ensure the tunnel is working properly, switch to
- another console and use &man.tcpdump.1; to view network
- traffic using the following command. Replace
- <literal>em0</literal> with the network interface card as
- required:</para>
-
- <screen>&prompt.root; <userinput>tcpdump -i em0 host <replaceable>172.16.5.4 and dst 192.168.1.12</replaceable></userinput></screen>
-
- <para>Data similar to the following should appear on the
- console. If not, there is an issue and debugging the
- returned data will be required.</para>
+ <para>To ensure the tunnel is working properly, switch to
+ another console and use &man.tcpdump.1; to view network
+ traffic using the following command. Replace
+ <literal>em0</literal> with the network interface card as
+ required:</para>
+
+ <screen>&prompt.root; <userinput>tcpdump -i em0 host <replaceable>172.16.5.4 and dst 192.168.1.12</replaceable></userinput></screen>
+
+ <para>Data similar to the following should appear on the
+ console. If not, there is an issue and debugging the
+ returned data will be required.</para>
- <programlisting>01:47:32.021683 IP corporatenetwork.com > 192.168.1.12.privatenetwork.com: ESP(spi=0x02acbf9f,seq=0xa)
+ <programlisting>01:47:32.021683 IP corporatenetwork.com > 192.168.1.12.privatenetwork.com: ESP(spi=0x02acbf9f,seq=0xa)
01:47:33.022442 IP corporatenetwork.com > 192.168.1.12.privatenetwork.com: ESP(spi=0x02acbf9f,seq=0xb)
01:47:34.024218 IP corporatenetwork.com > 192.168.1.12.privatenetwork.com: ESP(spi=0x02acbf9f,seq=0xc)</programlisting>
- <para>At this point, both networks should be available and
- seem to be part of the same network. Most likely both
- networks are protected by a firewall. To allow traffic to
- flow between them, rules need to be added to pass packets.
- For the &man.ipfw.8; firewall, add the following lines to
- the firewall configuration file:</para>
+ <para>At this point, both networks should be available and seem
+ to be part of the same network. Most likely both networks are
+ protected by a firewall. To allow traffic to flow between
+ them, rules need to be added to pass packets. For the
+ &man.ipfw.8; firewall, add the following lines to the firewall
+ configuration file:</para>
- <programlisting>ipfw add 00201 allow log esp from any to any
+ <programlisting>ipfw add 00201 allow log esp from any to any
ipfw add 00202 allow log ah from any to any
ipfw add 00203 allow log ipencap from any to any
ipfw add 00204 allow log udp from any 500 to any</programlisting>
- <note>
- <para>The rule numbers may need to be altered depending on
- the current host configuration.</para>
- </note>
+ <note>
+ <para>The rule numbers may need to be altered depending on the
+ current host configuration.</para>
+ </note>
- <para>For users of &man.pf.4; or &man.ipf.8;, the following
- rules should do the trick:</para>
+ <para>For users of &man.pf.4; or &man.ipf.8;, the following
+ rules should do the trick:</para>
- <programlisting>pass in quick proto esp from any to any
+ <programlisting>pass in quick proto esp from any to any
pass in quick proto ah from any to any
pass in quick proto ipencap from any to any
pass in quick proto udp from any port = 500 to any port = 500
@@ -2399,11 +2407,11 @@ pass out quick proto ipencap from any to
pass out quick proto udp from any port = 500 to any port = 500
pass out quick on gif0 from any to any</programlisting>
- <para>Finally, to allow the machine to start support for the
- <acronym>VPN</acronym> during system initialization, add the
- following lines to <filename>/etc/rc.conf</filename>:</para>
+ <para>Finally, to allow the machine to start support for the
+ <acronym>VPN</acronym> during system initialization, add the
+ following lines to <filename>/etc/rc.conf</filename>:</para>
- <programlisting>ipsec_enable="YES"
+ <programlisting>ipsec_enable="YES"
ipsec_program="/usr/local/sbin/setkey"
ipsec_file="/usr/local/etc/racoon/setkey.conf" # allows setting up spd policies on boot
racoon_enable="yes"</programlisting>
More information about the svn-doc-head
mailing list