1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<HTML>
<HEAD>
<TITLE>Introduction to FreeS/WAN</TITLE>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
<STYLE TYPE="text/css"><!--
BODY { font-family: serif }
H1 { font-family: sans-serif }
H2 { font-family: sans-serif }
H3 { font-family: sans-serif }
H4 { font-family: sans-serif }
H5 { font-family: sans-serif }
H6 { font-family: sans-serif }
SUB { font-size: smaller }
SUP { font-size: smaller }
PRE { font-family: monospace }
--></STYLE>
</HEAD>
<BODY>
<A HREF="toc.html">Contents</A>
<A HREF="adv_config.html">Previous</A>
<A HREF="config.html">Next</A>
<HR>
<H1><A name="install">Installing FreeS/WAN</A></H1>
<P>This document will teach you how to install Linux FreeS/WAN. If your
distribution comes with Linux FreeS/WAN, we offer tips to get you
started.</P>
<H2><A NAME="15_1">Requirements</A></H2>
<P>To install FreeS/WAN you must:</P>
<UL>
<LI>be running Linux with the 2.4 or 2.2 kernel series. See this<A HREF="http://www.freeswan.ca/download.php#contact">
kernel compatibility table</A>.
<BR>We also have experimental support for 2.6 kernels. Here are two
basic approaches:
<UL>
<LI> install FreeS/WAN, including its<A HREF="ipsec.html#parts"> KLIPS</A>
kernel code. This will remove the native IPsec stack and replace it
with KLIPS.</LI>
<LI> install the FreeS/WAN<A HREF="ipsec.html#parts"> userland tools</A>
(keying daemon and supporting scripts) for use with<A HREF="http://lartc.org/howto/lartc.ipsec.html">
2.6 kernel native IPsec</A>,</LI>
</UL>
See also these<A HREF="2.6.known-issues"> known issues with 2.6</A>.</LI>
<LI>have root access to your Linux box</LI>
<LI>choose the version of FreeS/WAN you wish to install based on<A HREF="http://www.freeswan.org/mail.html">
mailing list reports</A>
<!-- or
our updates page (coming soon)-->
</LI>
</UL>
<H2><A NAME="15_2">Choose your install method</A></H2>
<P>There are three basic ways to get FreeS/WAN onto your system:</P>
<UL>
<LI>activating and testing a FreeS/WAN that<A HREF="#distroinstall">
shipped with your Linux distribution</A></LI>
<LI><A HREF="#rpminstall">RPM install</A></LI>
<LI><A HREF="#srcinstall">Install from source</A></LI>
</UL>
<A NAME="distroinstall"></A>
<H2><A NAME="15_3">FreeS/WAN ships with some Linuxes</A></H2>
<P>FreeS/WAN comes with<A HREF="intro.html#distwith"> these
distributions</A>.</P>
<P>If you're running one of these, include FreeS/WAN in the choices you
make during installation, or add it later using the distribution's
tools.</P>
<H3><A NAME="15_3_1">FreeS/WAN may be altered...</A></H3>
<P>Your distribution may have integrated extra features, such as Andreas
Steffen's X.509 patch, into FreeS/WAN. It may also use custom startup
script locations or directory names.</P>
<H3><A NAME="15_3_2">You might need to create an authentication keypair</A>
</H3>
<P>If your FreeS/WAN came with your distribution, you may wish to
generate a fresh RSA key pair. FreeS/WAN will use these keys for
authentication.</P>
<P> To do this, become root, and type:</P>
<PRE> ipsec newhostkey --output /etc/ipsec.secrets --hostname xy.example.com
chmod 600 /etc/ipsec.secrets</PRE>
<P>where you replace xy.example.com with your machine's fully-qualified
domain name. Generate some randomness, for example by wiggling your
mouse, to speed the process.</P>
<P>The resulting ipsec.secrets looks like:</P>
<PRE>: RSA {
# RSA 2192 bits xy.example.com Sun Jun 8 13:42:19 2003
# for signatures only, UNSAFE FOR ENCRYPTION
#pubkey=0sAQOFppfeE3cC7wqJi...
Modulus: 0x85a697de137702ef0...
# everything after this point is secret
PrivateExponent: 0x16466ea5033e807...
Prime1: 0xdfb5003c8947b7cc88759065...
Prime2: 0x98f199b9149fde11ec956c814...
Exponent1: 0x9523557db0da7a885af90aee...
Exponent2: 0x65f6667b63153eb69db8f300dbb...
Coefficient: 0x90ad00415d3ca17bebff123413fc518...
}
# do not change the indenting of that "}"</PRE>
<P>In the actual file, the strings are much longer.</P>
<H3><A NAME="15_3_3">Start and test FreeS/WAN</A></H3>
<P>You can now<A HREF="install.html#starttest"> start FreeS/WAN and test
whether it's been successfully installed.</A>.</P>
<A NAME="rpminstall"></A>
<H2><A NAME="15_4">RPM install</A></H2>
<P>These instructions are for a recent Red Hat with a stock Red Hat
kernel. We know that Mandrake and SUSE also produce FreeS/WAN RPMs. If
you're running either, install using your distribution's tools.</P>
<H3><A NAME="15_4_1">Download RPMs</A></H3>
<P>Decide which functionality you need:</P>
<UL>
<LI>standard FreeS/WAN RPMs. Use these shortcuts:
<BR>
<UL>
<LI>(for 2.6 kernels: userland only)
<BR> ncftpget
ftp://ftp.xs4all.nl/pub/crypto/freeswan/binaries/RedHat-RPMs/\*userland*
</LI>
<LI>(for 2.4 kernels)
<BR> ncftpget
ftp://ftp.xs4all.nl/pub/crypto/freeswan/binaries/RedHat-RPMs/`uname -r
| tr -d 'a-wy-z'`/\*</LI>
<LI> or view all the offerings at our<A href="ftp://ftp.xs4all.nl/pub/crypto/freeswan/binaries/RedHat-RPMs">
FTP site</A>.</LI>
</UL>
</LI>
<LI>unofficial<A href="http://www.freeswan.ca/download.php"> Super
FreeS/WAN</A> RPMs, which include Andreas Steffen's X.509 patch and
more. Super FreeS/WAN RPMs do not currently include<A HREF="glossary.html#NAT.gloss">
Network Address Translation</A> (NAT) traversal, but Super FreeS/WAN
source does.</LI>
</UL>
<A NAME="2.6.rpm"></A>
<P>For 2.6 kernels, get the latest FreeS/WAN userland RPM, for example:</P>
<PRE> freeswan-userland-2.03.9-0.i386.rpm</PRE>
<P>Note: FreeS/WAN's support for 2.6 kernel IPsec is preliminary. Please
see<A HREf="2.6.known-issues"> 2.6.known-issues</A>, and the latest<A HREF="http://www.freeswan.org/mail.html">
mailing list reports</A>.</P>
<P>Change to your new FreeS/WAN directory, and make and install the</P>
<P>For 2.4 kernels, get both kernel and userland RPMs. Check your kernel
version with</P>
<PRE> uname -r</PRE>
<P>Get a kernel module which matches that version. For example:</P>
<PRE> freeswan-module-2.03_2.4.20_20.9-0.i386.rpm</PRE>
<P>Note: These modules<B> will only work on the Red Hat kernel they were
built for</B>, since they are very sensitive to small changes in the
kernel.</P>
<P>Get FreeS/WAN utilities to match. For example:</P>
<PRE> freeswan-userland-2.03_2.4.20_20.9-0.i386.rpm</PRE>
<H3><A NAME="15_4_2">For freeswan.org RPMs: check signatures</A></H3>
<P>While you're at our ftp site, grab the RPM signing key</P>
<PRE> freeswan-rpmsign.asc</PRE>
<P>If you're running RedHat 8.x or later, import this key into the RPM
database:</P>
<PRE> rpm --import freeswan-rpmsign.asc</PRE>
<P>For RedHat 7.x systems, you'll need to add it to your<A HREF="glossary.html#PGP">
PGP</A> keyring:</P>
<PRE> pgp -ka freeswan-rpmsign.asc</PRE>
<P>Check the digital signatures on both RPMs using:</P>
<PRE> rpm --checksig freeswan*.rpm </PRE>
<P>You should see that these signatures are good:</P>
<PRE> freeswan-module-2.03_2.4.20_20.9-0.i386.rpm: pgp md5 OK
freeswan-userland-2.03_2.4.20_20.9-0.i386.rpm: pgp md5 OK</PRE>
<H3><A NAME="15_4_3">Install the RPMs</A></H3>
<P>Become root:</P>
<PRE> su</PRE>
<P>For a first time install, use:</P>
<PRE> rpm -ivh freeswan*.rpm</PRE>
<P>To upgrade existing RPMs (and keep all .conf files in place), use:</P>
<PRE> rpm -Uvh freeswan*.rpm</PRE>
<P>If you're upgrading from FreeS/WAN 1.x to 2.x RPMs, and encounter
problems, see<A HREF="upgrading.html#upgrading.rpms"> this note</A>.</P>
<H3><A NAME="15_4_4">Start and Test FreeS/WAN</A></H3>
<P>Now,<A HREF="install.html#starttest"> start FreeS/WAN and test your
install</A>.</P>
<A NAME="srcinstall"></A>
<H2><A NAME="15_5">Install from Source</A></H2>
<!-- Most of this section, along with "Start and Test", can replace
INSTALL. -->
<H3><A NAME="15_5_1">Decide what functionality you need</A></H3>
<P>Your choices are:</P>
<UL>
<LI><A HREF="ftp://ftp.xs4all.nl/pub/crypto/freeswan">standard FreeS/WAN</A>
,</LI>
<LI>standard FreeS/WAN plus any of these<A HREF="web.html#patch">
user-supported patches</A>, or</LI>
<LI><A HREF="http://www.freeswan.ca/download">Super FreeS/WAN</A>, an
unofficial FreeS/WAN pre-patched with many of the above. Provides
additional algorithms, X.509, SA deletion, dead peer detection, and<A HREF="glossary.html#NAT.gloss">
Network Address Translation</A> (NAT) traversal.</LI>
</UL>
<H3><A NAME="15_5_2">Download FreeS/WAN</A></H3>
<P>Download the source tarball you've chosen, along with any patches.</P>
<H3><A NAME="15_5_3">For freeswan.org source: check its signature</A></H3>
<P>While you're at our ftp site, get our source signing key</P>
<PRE> freeswan-sigkey.asc</PRE>
<P>Add it to your PGP keyring:</P>
<PRE> pgp -ka freeswan-sigkey.asc</PRE>
<P>Check the signature using:</P>
<PRE> pgp freeswan-2.03.tar.gz.sig freeswan-2.03.tar.gz</PRE>
<P>You should see something like:</P>
<PRE> Good signature from user "Linux FreeS/WAN Software Team (build@freeswan.org)".
Signature made 2002/06/26 21:04 GMT using 2047-bit key, key ID 46EAFCE1</PRE>
<!-- Note to self: build@freeswan.org has angled brackets in the original.
Changed because it conflicts with HTML tags. -->
<H3><A NAME="15_5_4">Untar, unzip</A></H3>
<P>As root, unpack your FreeS/WAN source into<VAR> /usr/src</VAR>.</P>
<PRE> su
mv freeswan-2.03.tar.gz /usr/src
cd /usr/src
tar -xzf freeswan-2.03.tar.gz
</PRE>
<H3><A NAME="15_5_5">Patch if desired</A></H3>
<P>Now's the time to add any patches. The contributor may have special
instructions, or you may simply use the patch command.</P>
<H3><A NAME="15_5_6">... and Make</A></H3>
<P>Choose one of the methods below.</P>
<H4>Userland-only Install for 2.6 kernels</H4>
<A NAME="2.6.src"></A>
<P>Note: FreeS/WAN's support for 2.6 kernel IPsec is preliminary. Please
see<A HREf="2.6.known-issues"> 2.6.known-issues</A>, and the latest<A HREF="http://www.freeswan.org/mail.html">
mailing list reports</A>.</P>
<P>Change to your new FreeS/WAN directory, and make and install the
FreeS/WAN userland tools.</P>
<PRE> cd /usr/src/freeswan-2.03
make programs
make install</PRE>
<P>Now,<A HREF="install.html#starttest"> start FreeS/WAN and test your
install</A>.</P>
<H4>KLIPS install for 2.2, 2.4, or 2.6 kernels</H4>
<A NAME="modinstall"></A>
<P>To make a modular version of KLIPS, along with other FreeS/WAN
programs you'll need, use the command sequence below. This will change
to your new FreeS/WAN directory, make the FreeS/WAN module (and other
stuff), and install it all.</P>
<PRE> cd /usr/src/freeswan-2.03
make oldmod
make minstall</PRE>
<P><A HREF="install.html#starttest">Start FreeS/WAN and test your
install</A>.</P>
<P>To link KLIPS statically into your kernel (using your old kernel
settings), and install other FreeS/WAN components, do:</P>
<PRE> cd /usr/src/freeswan-2.03
make oldmod
make minstall</PRE>
<P>Reboot your system and<A HREF="install.html#testonly"> test your
install</A>.</P>
<P>For other ways to compile KLIPS, see our Makefile.</P>
<A name="starttest"></A>
<H2><A NAME="15_6">Start FreeS/WAN and test your install</A></H2>
<P>Bring FreeS/WAN up with:</P>
<PRE> service ipsec start</PRE>
<P>This is not necessary if you've rebooted.</P>
<A name="testonly"></A>
<H2><A NAME="15_7">Test your install</A></H2>
<P>To check that you have a successful install, run:</P>
<PRE> ipsec verify</PRE>
<P>You should see at least:</P>
<PRE>
Checking your system to see if IPsec got installed and started correctly
Version check and ipsec on-path [OK]
Checking for KLIPS support in kernel [OK]
Checking for RSA private key (/etc/ipsec.secrets) [OK]
Checking that pluto is running [OK]
</PRE>
<P>If any of these first four checks fails, see our<A href="trouble.html#install.check">
troubleshooting guide</A>.</P>
<H2><A NAME="15_8">Making FreeS/WAN play well with others</A></H2>
<P>There are at least a couple of things on your system that might
interfere with FreeS/WAN, and now's a good time to check these:</P>
<UL>
<LI>Firewalling. You need to allow UDP 500 through your firewall, plus
ESP (protocol 50) and AH (protocol 51). For more information, see our
updated firewalls document (coming soon).</LI>
<LI>Network address translation. Do not NAT the packets you will be
tunneling.</LI>
</UL>
<H2><A NAME="15_9">Configure for your needs</A></H2>
<P>You'll need to configure FreeS/WAN for your local site. Have a look
at our<A HREF="quickstart.html"> opportunism quickstart guide</A> to
see if that easy method is right for your needs. Or, see how to<A HREF="config.html">
configure a network-to-network or Road Warrior style VPN</A>.</P>
<HR>
<A HREF="toc.html">Contents</A>
<A HREF="adv_config.html">Previous</A>
<A HREF="config.html">Next</A>
</BODY>
</HTML>
|
