<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>On 21.1.2022. 15:08, Paul Wouters wrote:<br>
</p>
<blockquote type="cite"
cite="mid:A06B4250-A229-4F69-8A8D-2D433E52AD5E@nohats.ca">Hello,
<blockquote type="cite">
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">I have installed the IKEv2 VPN connection at my colleague's laptop and he disappointingly noticed that there is no password authentication in addition to certificate.
This is also akward because we would have to change all certificates if i.e. one laptop configured for the Faculty VPN was lost or stolen. :-(
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
I don't think this is right. The certificate system (in general, not libreswan's specifically) is explicitly designed so that you don't have to do that.
Ref CRL (Certificate Revocation List).
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Exactly. You only need to revoke the laptop certificate. The CA certificate is on the laptop too but not the CA certificate’s private key, only the public key.
An additional password adds little security assuming there is already a login password, an automatic screen lock after a few minutes and whole disk encryption with a password.
The libreswan pam option for IKEv2 is only meant for the server to check authorization of the client ID (usually a cert), not authentication. This is so you can temporary lock out a user without (irrevocably) revoking their certificate. This is often used when a customer hasn’t paid their bill for instance, or could be used if a laptop is missing but most likely will be found again.</pre>
</blockquote>
<p>1. I agree this opportunity to temporary disable the login with a
certificate would be practical. I have generated the certificates
as proposed on the link:
<a class="moz-txt-link-freetext" href="https://libreswan.org/wiki/VPN_server_for_remote_clients_using_IKEv2#Example_certificate_generation_with_certutil">https://libreswan.org/wiki/VPN_server_for_remote_clients_using_IKEv2#Example_certificate_generation_with_certutil</a><br>
<br>
export PARM='--keyUsage digitalSignature,keyEncipherment
--extKeyUsage serverAuth,clientAuth'<br>
certutil -S -c "GRF-UNIZG CA" -n "laptop-marko.grf.hr" -s
"O=GRF-UNIZG,CN=laptop-marko.grf.hr" -k rsa -g 4096 -v 12 -d
sql:${HOME}/tmpdb -t ",," ${PARM} -8 "laptop-marko.grf.hr"<br>
pk12util -o laptop-marko.grf.hr.p12 -n "laptop-marko.grf.hr" -d
sql:${HOME}/tmpdb/</p>
<p>I have imported the cert into Windows 10 certificate manager in
the "Local Machine" keystore.</p>
<p>I can't seem to understand how to revoke such a local
certificate. It is not generated by Letsencrypt or Sectigo, so
where does ipsec check for revocation lists?</p>
<p>However, once it is revoked, the damage is done. I can't make it
alive again, can I? So, there is a justified question:</p>
<p>2. Can I get a pointer to the username/password file for the
certificates? I don't know if it should be in
/etc/ipsec.d/hostname.secrets, and what is the syntax considering
that the username contains spaces when expanded by certificate
check facility of I think pluto.</p>
<p>As the username is as it appears in the pluto log, what is the
location and syntax of the password file? And who would provide
password? Windows 10 client or else?<br>
</p>
<p>Jan 20 09:45:03.533787: | PAM: #1: PAM-process completed for user
'CN=pc-mtodorov.alu.hr, O=ALU-UNIZG' with result FAILURE</p>
<p>This would be a great feature to have.<br>
However, the manual ipsec.conf (5) only says this:</p>
<blockquote>
<p class="level0"><span class="bold">pam-authorize</span> </p>
<p class="level1">IKEv1 supports PAM authorization via XAUTH using
<span class="emphasis">xauthby=pam</span>. IKEv2 does not
support receiving a plaintext username and password. Libreswan
does not yet support EAP authentication methods for IKE. The
pam-authorize=yes option performs an authorization call via PAM,
but only includes the remote ID (not username or password). This
allows for backends to disallow an ID based on non-password
situations, such as "user disabled" or "user over quota". See
also <span class="emphasis">xauthby=pam<br>
</span></p>
</blockquote>
<p>It is not clear to me which file should provide remote ID list
with permissions? And the syntax.</p>
<p>My current /etc/pam.d/pluto looks like this:</p>
<p>root@domac:~# cat /etc/pam.d/pluto<br>
#%PAM-1.0<br>
auth required pam_unix.so<br>
auth required pam_nologin.so<br>
account required pam_unix.so<br>
password required pam_unix.so<br>
session required pam_unix.so<br>
session required pam_loginuid.so<br>
root@domac:~#<br>
</p>
<p>The 4.6 distribution original did not work for me either: it said
simply this:</p>
<p>Jan 20 09:07:48.551340: "MYCONN-ikev2-cp"[4] 193.198.186.218 #2:
IKEv2 FAILED during pam_authenticate with 'Permission denied' for<br>
state #2, MYCONN-ikev2-cp[4] user=CN=pc-mtodorov.alu.hr,
O=ALU-UNIZG.<br>
Jan 20 09:07:48.551600: | PAM: #2: PAM-process completed for user
'CN=pc-mtodorov.alu.hr, O=ALU-UNIZG' with result FAILURE<br>
Jan 20 09:07:48.552834: | processing signal PLUTO_SIGCHLD<br>
Jan 20 09:07:48.552890: | waitpid returned pid 2652 (exited with
status 1)<br>
Jan 20 09:07:48.552903: | suspend: restoring MD@0x55f56d8e5aa8
from state #2 (server_fork_sigchld_handler() +224
programs/pluto/ser<br>
ver_fork.c)<br>
Jan 20 09:07:48.552928: | #2 waited 0.010288 for 'pamauth' fork()<br>
Jan 20 09:07:48.552941: "MYCONN-ikev2-cp"[4] 193.198.186.218 #2:
PAM: authentication of user 'CN=pc-mtodorov.alu.hr, O=ALU-UNIZG'
FAILED after 0.01074 seconds</p>
<p>I would love this feature to work on my VPN server. Libreswan
team is very motivational for experimenting. As I said before, I
felt moved by the all-inclusive code of conduct for the project
:-)<br>
</p>
<blockquote type="cite"
cite="mid:A06B4250-A229-4F69-8A8D-2D433E52AD5E@nohats.ca">
<pre class="moz-quote-pre" wrap="">The next version of libreswan will add EAPTLS authentication, so windows won’t require administrative rights to add the IKEv2 connection. Once that it is, perhaps another EAP method - mschapv2 - will be added that does add a user / password method that can be used without certificates.</pre>
</blockquote>
This sounds great. Looking forward to testing it :-)
<pre class="moz-quote-pre" wrap="">Kind regards,
Mirsad
</pre>
<pre class="moz-signature" cols="72">--
Mirsad Todorovac
CARNet system engineer
Faculty of Graphic Arts | Academy of Fine Arts
University of Zagreb
Republic of Croatia, the European Union
--
CARNet sistem inženjer
Grafički fakultet | Akademija likovnih umjetnosti
Sveučilište u Zagrebu</pre>
</body>
</html>