New subject: OT: a very big problem with ipsec-tools on CentOS5 (SOLVED)

12 Oct 2007


      Buf ... Solved. Problem was that /etc/pam.d/racoon doesn't exists (I found this 
tip on NetBSD ipsec pages). Simply I have copied /etc/pam.d/passwd to 
/etc/pam.d/racoon and now all works as expected.
Many thanks for your help Ross.
Ross S. W. Walker wrote:
...
I think it might just use another one like /etc/pam.d/remote
cause I audited the package and it wasn't there.
Does the "users" group exist and charlie a member of it?
-Ross
...
-----Original Message-----
From: carlopmart [mailto:carlopmart@gmail.com] 
Sent: Friday, October 12, 2007 6:54 PM
To: Ross S. W. Walker
Subject: Re: [CentOS] OT: a very big problem with ipsec-tools 
on CentOS5
hi ross,
Yes I compiled with pam option. But I don't have any ipsec 
config file on 
/etc/pam.d ... I didn't find any sample on ipsec-tools 0.7 
source tree ... where 
is it??
Ross S. W. Walker wrote:
...
If you compiled ipsec tools yourself did you compile with
the pam option?
...
If not then you can't tell it to use pam for authentication.
If you did, did you setup the appropriate ipsec config file in 
/etc/pam.d? I believe there is an example one in the ipsec
source tree.
...
-Ross
-----Original Message-----
From: centos-bounces@centos.org centos-bounces@centos.org
To: centos@centos.org centos@centos.org
Sent: Fri Oct 12 18:38:38 2007
Subject: [CentOS] OT: a very big problem with ipsec-tools on CentOS5
Hi all,
I am trying to establish a vpn tunnel between one CentOS5
IPSec server
...
and a
roadwarrior client, CentOS5 too. Roadwarrior use
ipsec-tools version 0.6.5-8
...
(that comes with CentOS5) and  server uses version 0.7
(downloaded from
...
ipsec-tools website).
My server configuration is:
path include "/etc/racoon";
path certificate "/etc/racoon/certs";
path pre_shared_key "/etc/racoon/psk.txt";
path pidfile "/var/run/racoon.pid";
#log debug;
listen {
         adminsock "/var/racoon/racoon.sock" "root" "nobody" 0660;
         isakmp 172.28.45.4 [500];
         isakmp_natt 172.28.45.4 [4500];
}
remote anonymous {
         exchange_mode aggressive;
         certificate_type x509 "gwenc.crt" "gwenc.key";
         my_identifier asn1dn;
         proposal_check claim;
         generate_policy on;
         nat_traversal on;
         dpd_delay 20;
         ike_frag on;
         passive on;
         proposal {
                 encryption_algorithm aes;
                 hash_algorithm sha256;
                 authentication_method hybrid_rsa_server;
                 dh_group 2;
         }
}
mode_cfg {
         network4 172.31.78.5;
         netmask4 255.255.255.240;
         pool_size 6;
         dns4 172.25.50.1;
         auth_source pam;
         auth_groups "users";
         group_source system;
         auth_throttle 10;
         pfs_group 2;
}
sainfo anonymous
{
         pfs_group 2;
         lifetime time 1 hour;
         encryption_algorithm rijndael;
         authentication_algorithm hmac_sha256;
         compression_algorithm deflate;
}
When I try to connect from roadwarrior client using xauth, server 
returns me
this errors:
2007-10-13 00:21:52: INFO: ISAKMP-SA established
172.28.45.4[4500]-172.17.35.3[4500]
spi:e3ff2f5a0873ff54:ad9b13f8035ec2f2
...
2007-10-13 00:21:52: INFO: Using port 0
2007-10-13 00:21:52: ERROR: pam_authenticate failed:
Authentication failure
...
2007-10-13 00:21:52: INFO: Released port 0
2007-10-13 00:21:52: INFO: login failed for user "charlie"
2007-10-13 00:21:52: ERROR: Attempt to release an
unallocated address
...
(port 0)
2007-10-13 00:21:52: ERROR: mode config 6 from
172.17.35.3[4500], but we
...
have no
ISAKMP-SA.
2007-10-13 00:21:52: ERROR: unknown Informational exchange received.
why? I don't understand. Well, yes, I think that server
doesn't use
...
really pam
libraries or problem is that linux use shadow for passwords instead 
passwd file.
I see a lot of webs on this configuration works out of
the box, but
...
not for
me.... I am really desperated.
Many thanks.
P.D: On ipsec-tools mailing list i don't receive any response.
CL Martinez
carlopmart {at} gmail {d0t} com
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos


...
This e-mail, and any attachments thereto, is intended only
for use by
...
the addressee(s) named herein and may contain legally
privileged and/or
...
confidential information. If you are not the intended
recipient of this
...
e-mail, you are hereby notified that any dissemination,
distribution or
...
copying of this e-mail, and any attachments thereto, is strictly 
prohibited. If you have received this e-mail in error, please 
immediately notify the sender and permanently delete the
original and
...
any copy or printout thereof.
-- 
CL Martinez
carlopmart {at} gmail {d0t} com

This e-mail, and any attachments thereto, is intended only for use by
the addressee(s) named herein and may contain legally privileged
and/or confidential information. If you are not the intended recipient
of this e-mail, you are hereby notified that any dissemination,
distribution or copying of this e-mail, and any attachments thereto,
is strictly prohibited. If you have received this e-mail in error,
please immediately notify the sender and permanently delete the
original and any copy or printout thereof.
-- 
CL Martinez
carlopmart {at} gmail {d0t} com

Re: [CentOS] OT: a very big problem with ipsec-tools on CentOS5 (SOLVED)

P.D: On ipsec-tools mailing list i don't receive any response.

P.D: On ipsec-tools mailing list i don't receive any response.

P.D: On ipsec-tools mailing list i don't receive any response.

P.D: On ipsec-tools mailing list i don't receive any response.