Re: IPsec: Default to rekey=no

[Michael Tremer <michael.tremer@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 1632 bytes --]

Hi,

obviously we cannot make this as a default option for anything. The
rekeying is a very important process in the security of a VPN. Without
that brute-force attacks are getting much more feasible and if they
succeed all the data that has been transferred in this session can be
decrypted afterwards.

The link that you provided does at no point say that disabling rekeying
is a recommended strategy to do that. It just points out some issues and
incompatibilities with the Windows client.

I CCed Wolfgang Apolinarski who recently worked on this whole matter. He
seems to use the rekey=no option, too. Maybe he can contribute some
insight why this is needed from his point of view.

Best,
-Michael

On Tue, 2015-05-19 at 17:19 +0200, Larsen wrote:
> Hi,
> 
> we noticed interruptions with our IPsec roadwarrriors. The problem turned  
> out to be caused by the server trying to rekey with the client that is  
> sitting behind a NAT (Windows 7 client at colleague's home). See  
> https://wiki.strongswan.org/projects/strongswan/wiki/Windows7#Rekeying-behavior
> 
> This was solved by adding "rekey=no" to "/etc/ipsec.user.conf" for each  
> connection.
> I wonder if this should be added by IPFire by default as I guess that all  
> roadwarriors behind a NAT (probably the majority) might have this problem.
> 
> So, adding
>      print CONF "\trekey=no\n";
> to
>      /srv/web/ipfire/cgi-bin/vpnmain.cgi
> 
> 
> Lars
> _______________________________________________
> Development mailing list
> Development(a)lists.ipfire.org
> http://lists.ipfire.org/mailman/listinfo/development

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]