Hi Michael,
For it to work, you simply need to generate a Roadwarrior connection per certificate. Then, change what is red, either replace cert by xauthrsasiget put ikev1 instead of ikev2.
[root@ipfire ~]# cat /var/ipfire/vpn/config 2,on,Xiaomi,Xiaomi,host,xauthrsasig,,off,, 192.168.10.0/255.255.255.0,,,10.0.10.0/29,off,,,off,3,1,aes256,sha2_512,1024|768,aes256,sha2_512,1024|768|none,on,,,clear,on ,ikev1,120,30,off,start,900
Here is the result in the file :
conn Xiaomi left=vpn.jbsky.fr leftsubnet=192.168.0.0/24 leftfirewall=yes lefthostaccess=yes right=%any leftcert=/var/ipfire/certs/hostcert.pem rightcert=/var/ipfire/certs/Xiaomicert.pem ike=aes256-sha2_512-modp1024,aes256-sha2_512-modp768!
esp=aes256-sha2_512-modp1024,aes256-sha2_512-modp768,aes256-sha2_512! keyexchange=ikev1 ikelifetime=3h keylife=1h dpdaction=clear dpddelay=30 dpdtimeout=120 authby=xauthrsasig xauth=server auto=add rightsourceip=10.0.10.0/29 fragmentation=yes
Why this patch? it allows to have a functional visual on VPN connections in the vpnmain.cgi page. Everything that is IOS or Android works with Xauth, you do not support this type of device.
2018-07-10 19:42 GMT+02:00 Michael Tremer michael.tremer@ipfire.org:
Hello Julien?!,
thanks for submitting this patch.
Could you go into more detail about what this patch is doing and why you need it?
Best, -Michael
On Mon, 2018-07-09 at 22:07 +0200, jbsky wrote:
Added xauthrsasig option instead of cert in /var/ipfire/vpn/config. By replacing cert with xauth in the 5th place option, the vpn connection
is
configured to support xauthrsasig, ikev1 is also to be changed manually
in the
file.
html/cgi-bin/vpnmain.cgi | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi index 378acb326..a5c50dbda 100644 --- a/html/cgi-bin/vpnmain.cgi +++ b/html/cgi-bin/vpnmain.cgi @@ -304,7 +304,7 @@ sub writeipsecfiles { }
# Local Cert and Remote Cert (unless auth is DN dn-auth)
if ($lconfighash{$key}[4] eq 'cert') {
if (($lconfighash{$key}[4] eq 'cert')||($lconfighash{$key}[4]
eq 'xauthrsasig')) { print CONF "\tleftcert=${General::swroot}/certs/hostcert.pem\n"; print CONF "\trightcert=${General::swroot}/certs/$lconfighash{$key}[1]cert.pem\n"
if
($lconfighash{$key}[2] ne '%auth-dn'); } @@ -408,7 +408,12 @@ sub writeipsecfiles { print SECRETS $psk_line; } print CONF "\tauthby=secret\n";
} else {
}elsif ($lconfighash{$key}[4] eq 'xauthrsasig') {print CONF "\tauthby=xauthrsasig\n";print CONF "\txauth=server\n";}else { print CONF "\tauthby=rsasig\n"; print CONF "\tleftrsasigkey=%cert\n"; print CONF "\trightrsasigkey=%cert\n";@@ -2841,7 +2846,7 @@ END print "<td align='center' nowrap='nowrap' $col>" . $Lang::tr{"$confighash{$key}[3]"} . " (" . $Lang::tr{"$confighash{$key}[4]"}
.
") $confighash{$key}[29]</td>"; if ($confighash{$key}[2] eq '%auth-dn') { print "<td align='left' nowrap='nowrap' $col>$confighash{$key}[9]</td>";
} elsif ($confighash{$key}[4] eq 'cert') {
} elsif (($confighash{$key}[4] eq 'cert')||($confighash{$key}[4] eq'xauthrsasig')) { print "<td align='left' nowrap='nowrap' $col>$confighash{$key}[2]</td>"; } else { print "<td align='left' $col> </td>"; @@ -2893,7 +2898,7 @@ END } else { print "<td width='2%' $col> </td>"; }
if ($confighash{$key}[4] eq 'cert' && -f"${General::swroot}/certs/$confighash{$key}[1].p12") {
if ((($confighash{$key}[4] eq 'cert')||($confighash{$key}[4] eq'xauthrsasig')) && -f "${General::swroot}/certs/$confighash{$key}[1].p12")
{
print <<END <td align='center' $col> <form method='post' action='$ENV{'SCRIPT_NAME'}'>@@ -2904,7 +2909,7 @@ END </td> END ;
} elsif (($confighash{$key}[4] eq 'cert') && ($confighash{$key}[2]ne
'%auth-dn')) {
} elsif ((($confighash{$key}[4] eq 'cert') && ($confighash{$key}[2]ne '%auth-dn'))||(($confighash{$key}[4] eq 'xauthrsasig') && ($confighash{$key}[2] ne '%auth-dn'))) { print <<END <td align='center' $col> <form method='post' action='$ENV{'SCRIPT_NAME'}'>