<div dir="ltr">Thanks Doug!<div>I'll open a ticket with the gentoo devs!</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Oct 23, 2020 at 5:04 AM Douglas Kosovic <<a href="mailto:doug@uq.edu.au">doug@uq.edu.au</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-AU">
<div class="gmail-m_7112057225677112820WordSection1">
<p class="MsoNormal"><span>Hi Brian,<u></u><u></u></span></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<p class="gmail-m_7112057225677112820MsoPlainText">With Libreswan >= 4.0, the default NSS database files (*.db) have moved from /etc/ipsec.d to /var/lib/ipsec/nss<u></u><u></u></p>
<p class="gmail-m_7112057225677112820MsoPlainText"><u></u> <u></u></p>
<p class="gmail-m_7112057225677112820MsoPlainText">Try the following Libreswan command to see if you get an error :<u></u><u></u></p>
<p class="gmail-m_7112057225677112820MsoPlainText"><u></u> <u></u></p>
<p class="gmail-m_7112057225677112820MsoPlainText"> $ sudo ipsec initnss<u></u><u></u></p>
<p class="gmail-m_7112057225677112820MsoPlainText"> ERROR: destination directory "/var/lib/ipsec/nss" is missing or permission denied<u></u><u></u></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<p class="MsoNormal"><span>pkg_postinst() in the gentoo ebuild is still using
</span>/etc/ipsec.d for the NSS database files :<u></u><u></u></p>
<p class="MsoNormal"> <a href="https://gitweb.gentoo.org/repo/gentoo.git/tree/net-vpn/libreswan/libreswan-4.1.ebuild" target="_blank">
https://gitweb.gentoo.org/repo/gentoo.git/tree/net-vpn/libreswan/libreswan-4.1.ebuild</a><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">you could fix the aforementioned <span>
pkg_postinst(), or</span> issue the following as a workaround:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"> sudo mkdir -p /var/lib/ipsec/nss<u></u><u></u></p>
<p class="MsoNormal"> sudo chmod 700 /var/lib/ipsec/nss<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">then try sudo ipsec initnss again.<u></u><u></u></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<p class="MsoNormal">If you are using SELinux or AppArmor, a new rule might be required for /var/lib/ipsec/nss<span><u></u><u></u></span></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<p class="MsoNormal"><span>Cheers,<u></u><u></u></span></p>
<p class="MsoNormal"><span>Doug<u></u><u></u></span></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Swan <<a href="mailto:swan-bounces@lists.libreswan.org" target="_blank">swan-bounces@lists.libreswan.org</a>>
<b>On Behalf Of </b>Brian McKee<br>
<b>Sent:</b> Friday, 23 October 2020 6:06 PM<br>
<b>To:</b> <a href="mailto:swan@lists.libreswan.org" target="_blank">swan@lists.libreswan.org</a><br>
<b>Subject:</b> [Swan] Issue with networkmanager and l2tp<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Hello everyone,<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I'm a Gentoo linux user. My work uses a linux based VPN server (Centos 7) that is probably pretty out of date. It uses l2tp protocol.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">My Gentoo box is running Networkmanager 1.26.0 and until a recent update I was running libreswan-3.32-r1 which contains a patch to fix an NSS version issue. libreswan-3.32 without the patch fails to connect to my work because of the NSS
issue.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Networkmanager requires libreswan for l2tp protocol connections.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">In the latest update of my machine libreswan 4.1 installed and I could no longer connect to work. There was absolutely no useful messages from Networkmanager. This is what I got in /var/log/messages:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12pt"><span style="font-family:"Courier New";color:black">Oct 22 21:30:16 threads NetworkManager[4579]: <info> [1603427416.4884] audit: op="connection-activate" uuid="9a088450-2a7b-4012-befe-facf564c77e0" name="wtec-SJ"
pid=5647 uid=1000 result</span><span style="font-family:"Courier New""><br>
="success" <br>
Oct 22 21:30:16 threads NetworkManager[4579]: <info> [1603427416.4920] vpn-connection[0x56488972c2b0,9a088450-2a7b-4012-befe-facf564c77e0,"wtec-SJ",0]: Started the VPN service, PID 10712
<br>
Oct 22 21:30:16 threads NetworkManager[4579]: <info> [1603427416.4984] vpn-connection[0x56488972c2b0,9a088450-2a7b-4012-befe-facf564c77e0,"wtec-SJ",0]: Saw the service appear; activating<br>
connection <br>
Oct 22 21:30:17 threads NetworkManager[4579]: <info> [1603427417.1234] audit: op="statistics" arg="refresh-rate-ms" pid=5647 uid=1000 result="success"
<br>
Oct 22 21:30:27 threads NetworkManager[4579]: <info> [1603427427.7335] vpn-connection[0x56488972c2b0,9a088450-2a7b-4012-befe-facf564c77e0,"wtec-SJ",0]: VPN plugin: state changed: stopped<br>
(6) <br>
Oct 22 21:30:27 threads NetworkManager[4579]: <info> [1603427427.7361] vpn-connection[0x56488972c2b0,9a088450-2a7b-4012-befe-facf564c77e0,"wtec-SJ",0]: VPN service disappeared
<br>
Oct 22 21:30:27 threads NetworkManager[4579]: <warn> [1603427427.7372] vpn-connection[0x56488972c2b0,9a088450-2a7b-4012-befe-facf564c77e0,"wtec-SJ",0]: VPN connection: failed to connect:<br>
'Message recipient disconnected from message bus without replying'</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Courier New"">I figure I have a configuration issue, except that it works fine with the old version of libreswan.</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Courier New"">I'm hoping you guys have some idea what I'm talking about. I can email you any information on my machine and I can probably get the configuration for the (openvpn, I think) VPN server.</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Courier New"">I know that me using the old version of libreswan is eventually going to become a problem so I'd like to proactively figure out what's wrong and fix my system so my work flow isn't interrupted.</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Courier New"">I don't hand edit the config files, I let KDE configure network manager, so I figure there is something I need to change in that configuration.</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Courier New"">Anyway, thanks for reading and thanks in advance for any help you can offer.</span><u></u><u></u></p>
</div>
</div>
</div>
</div>
_______________________________________________<br>
Swan mailing list<br>
<a href="mailto:Swan@lists.libreswan.org" target="_blank">Swan@lists.libreswan.org</a><br>
<a href="https://lists.libreswan.org/mailman/listinfo/swan" rel="noreferrer" target="_blank">https://lists.libreswan.org/mailman/listinfo/swan</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature">-- Consciousness moves everything.</div>