<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-2022-jp">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hi All,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I have another new install on a raspberry pi (Raspbian stretch). With Version 3.22 I am unable to start ipsec:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The results of a verify for ipsec:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">root@rpiOnboardSK:~# /usr/local/sbin/ipsec verify<o:p></o:p></p>
<p class="MsoNormal">Verifying installed system and configuration files<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Version check and ipsec on-path [OK]<o:p></o:p></p>
<p class="MsoNormal">Libreswan 3.22 (netkey) on 4.9.41-v7+<o:p></o:p></p>
<p class="MsoNormal">Checking for IPsec support in kernel [OK]<o:p></o:p></p>
<p class="MsoNormal">NETKEY: Testing XFRM related proc values<o:p></o:p></p>
<p class="MsoNormal"> ICMP default/send_redirects [NOT DISABLED]<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> Disable /proc/sys/net/ipv4/conf/*/send_redirects or NETKEY will act on or cause sending of bogus ICMP redirects!<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> ICMP default/accept_redirects [NOT DISABLED]<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> Disable /proc/sys/net/ipv4/conf/*/accept_redirects or NETKEY will act on or cause sending of bogus ICMP redirects!<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> XFRM larval drop [OK]<o:p></o:p></p>
<p class="MsoNormal">Pluto ipsec.conf syntax [OK]<o:p></o:p></p>
<p class="MsoNormal">Two or more interfaces found, checking IP forwarding [OK]<o:p></o:p></p>
<p class="MsoNormal">Checking rp_filter [OK]<o:p></o:p></p>
<p class="MsoNormal">Checking that pluto is running [FAILED]<o:p></o:p></p>
<p class="MsoNormal">Checking 'ip' command [OK]<o:p></o:p></p>
<p class="MsoNormal">Checking 'iptables' command [OK]<o:p></o:p></p>
<p class="MsoNormal">Checking 'prelink' command does not interfere with FIPS [OK]<o:p></o:p></p>
<p class="MsoNormal">Checking for obsolete ipsec.conf options [OK]<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">ipsec verify: encountered 4 errors - see 'man ipsec_verify' for help<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">When I try to start ipsec:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">root@rpiOnboardSK:~# /usr/local/sbin/ipsec start<o:p></o:p></p>
<p class="MsoNormal">Redirecting to: systemctl start ipsec.service<o:p></o:p></p>
<p class="MsoNormal">Job for ipsec.service failed because a fatal signal was delivered to the control process.<o:p></o:p></p>
<p class="MsoNormal">See "systemctl status ipsec.service" and "journalctl -xe" for details.<o:p></o:p></p>
<p class="MsoNormal">root@rpiOnboardSK:~# systemctl status ipsec.service<o:p></o:p></p>
<p class="MsoNormal">● ipsec.service - Internet Key Exchange (IKE) Protocol Daemon for IPsec<o:p></o:p></p>
<p class="MsoNormal"> Loaded: loaded (/lib/systemd/system/ipsec.service; enabled; vendor preset: enabled)<o:p></o:p></p>
<p class="MsoNormal"> Active: failed (Result: signal) since Wed 2017-10-25 10:30:23 EDT; 6s ago<o:p></o:p></p>
<p class="MsoNormal"> Docs: man:ipsec(8)<o:p></o:p></p>
<p class="MsoNormal"> man:pluto(8)<o:p></o:p></p>
<p class="MsoNormal"> man:ipsec.conf(5)<o:p></o:p></p>
<p class="MsoNormal"> Process: 3419 ExecStopPost=/usr/local/sbin/ipsec --stopnflog (code=exited, status=0/SUCCESS)<o:p></o:p></p>
<p class="MsoNormal"> Process: 3416 ExecStopPost=/sbin/ip xfrm state flush (code=exited, status=0/SUCCESS)<o:p></o:p></p>
<p class="MsoNormal"> Process: 3413 ExecStopPost=/sbin/ip xfrm policy flush (code=exited, status=0/SUCCESS)<o:p></o:p></p>
<p class="MsoNormal"> Process: 3410 ExecStop=/usr/local/libexec/ipsec/whack --shutdown (code=exited, status=1/FAILURE)<o:p></o:p></p>
<p class="MsoNormal"> Process: 3407 ExecStart=/usr/local/libexec/ipsec/pluto --leak-detective --config /etc/ipsec.conf --nofork (code=killed, signal=SEGV)<o:p></o:p></p>
<p class="MsoNormal"> Process: 3395 ExecStartPre=/usr/local/sbin/ipsec --checknflog (code=exited, status=0/SUCCESS)<o:p></o:p></p>
<p class="MsoNormal"> Process: 3391 ExecStartPre=/usr/local/sbin/ipsec --checknss (code=exited, status=0/SUCCESS)<o:p></o:p></p>
<p class="MsoNormal"> Process: 3224 ExecStartPre=/usr/local/libexec/ipsec/_stackmanager start (code=exited, status=0/SUCCESS)<o:p></o:p></p>
<p class="MsoNormal"> Process: 3222 ExecStartPre=/usr/local/libexec/ipsec/addconn --config /etc/ipsec.conf --checkconfig (code=exited, status=0/SUCCESS)<o:p></o:p></p>
<p class="MsoNormal">Main PID: 3407 (code=killed, signal=SEGV)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Oct 25 10:30:23 rpiOnboardSK systemd[1]: ipsec.service: Unit entered failed state.<o:p></o:p></p>
<p class="MsoNormal">Oct 25 10:30:23 rpiOnboardSK systemd[1]: ipsec.service: Failed with result 'signal'.<o:p></o:p></p>
<p class="MsoNormal">Oct 25 10:30:23 rpiOnboardSK systemd[1]: ipsec.service: Service hold-off time over, scheduling restart.<o:p></o:p></p>
<p class="MsoNormal">Oct 25 10:30:23 rpiOnboardSK systemd[1]: Stopped Internet Key Exchange (IKE) Protocol Daemon for IPsec.<o:p></o:p></p>
<p class="MsoNormal">Oct 25 10:30:23 rpiOnboardSK systemd[1]: ipsec.service: Start request repeated too quickly.<o:p></o:p></p>
<p class="MsoNormal">Oct 25 10:30:23 rpiOnboardSK systemd[1]: Failed to start Internet Key Exchange (IKE) Protocol Daemon for IPsec.<o:p></o:p></p>
<p class="MsoNormal">Oct 25 10:30:23 rpiOnboardSK systemd[1]: ipsec.service: Unit entered failed state.<o:p></o:p></p>
<p class="MsoNormal">Oct 25 10:30:23 rpiOnboardSK systemd[1]: ipsec.service: Failed with result 'signal'.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">How can I troubleshoot?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">TIA<o:p></o:p></p>
</div>
</body>
</html>