Does it not more sense to make a symlink rather then copying the file..? / Nicolas On 10/13/07, carlopmart <carlopmart at gmail.com> wrote: > Buf ... Solved. Problem was that /etc/pam.d/racoon doesn't exists (I found > this > tip on NetBSD ipsec pages). Simply I have copied /etc/pam.d/passwd to > /etc/pam.d/racoon and now all works as expected. > > Many thanks for your help Ross. > > > > Ross S. W. Walker wrote: > > > > I think it might just use another one like /etc/pam.d/remote > > cause I audited the package and it wasn't there. > > > > Does the "users" group exist and charlie a member of it? > > > > -Ross > > > >> -----Original Message----- > >> From: carlopmart [mailto:carlopmart at gmail.com] > >> Sent: Friday, October 12, 2007 6:54 PM > >> To: Ross S. W. Walker > >> Subject: Re: [CentOS] OT: a very big problem with ipsec-tools > >> on CentOS5 > >> > >> hi ross, > >> > >> Yes I compiled with pam option. But I don't have any ipsec > >> config file on > >> /etc/pam.d ... I didn't find any sample on ipsec-tools 0.7 > >> source tree ... where > >> is it?? > >> > >> Ross S. W. Walker wrote: > >>> If you compiled ipsec tools yourself did you compile with > >> the pam option? > >>> If not then you can't tell it to use pam for authentication. > >>> > >>> If you did, did you setup the appropriate ipsec config file in > >>> /etc/pam.d? I believe there is an example one in the ipsec > >> source tree. > >>> -Ross > >>> > >>> > >>> -----Original Message----- > >>> From: centos-bounces at centos.org <centos-bounces at centos.org> > >>> To: centos at centos.org <centos at centos.org> > >>> Sent: Fri Oct 12 18:38:38 2007 > >>> Subject: [CentOS] OT: a very big problem with ipsec-tools on CentOS5 > >>> > >>> Hi all, > >>> > >>> I am trying to establish a vpn tunnel between one CentOS5 > >> IPSec server > >>> and a > >>> roadwarrior client, CentOS5 too. Roadwarrior use > >> ipsec-tools version 0.6.5-8 > >>> (that comes with CentOS5) and server uses version 0.7 > >> (downloaded from > >>> ipsec-tools website). > >>> > >>> My server configuration is: > >>> > >>> path include "/etc/racoon"; > >>> path certificate "/etc/racoon/certs"; > >>> path pre_shared_key "/etc/racoon/psk.txt"; > >>> path pidfile "/var/run/racoon.pid"; > >>> #log debug; > >>> > >>> listen { > >>> adminsock "/var/racoon/racoon.sock" "root" "nobody" 0660; > >>> isakmp 172.28.45.4 [500]; > >>> isakmp_natt 172.28.45.4 [4500]; > >>> } > >>> > >>> remote anonymous { > >>> exchange_mode aggressive; > >>> certificate_type x509 "gwenc.crt" "gwenc.key"; > >>> my_identifier asn1dn; > >>> proposal_check claim; > >>> generate_policy on; > >>> nat_traversal on; > >>> dpd_delay 20; > >>> ike_frag on; > >>> passive on; > >>> proposal { > >>> encryption_algorithm aes; > >>> hash_algorithm sha256; > >>> authentication_method hybrid_rsa_server; > >>> dh_group 2; > >>> } > >>> } > >>> > >>> mode_cfg { > >>> network4 172.31.78.5; > >>> netmask4 255.255.255.240; > >>> pool_size 6; > >>> dns4 172.25.50.1; > >>> auth_source pam; > >>> auth_groups "users"; > >>> group_source system; > >>> auth_throttle 10; > >>> pfs_group 2; > >>> } > >>> > >>> sainfo anonymous > >>> { > >>> pfs_group 2; > >>> lifetime time 1 hour; > >>> encryption_algorithm rijndael; > >>> authentication_algorithm hmac_sha256; > >>> compression_algorithm deflate; > >>> } > >>> > >>> When I try to connect from roadwarrior client using xauth, server > >>> returns me > >>> this errors: > >>> > >>> 2007-10-13 00:21:52: INFO: ISAKMP-SA established > >>> 172.28.45.4[4500]-172.17.35.3[4500] > >> spi:e3ff2f5a0873ff54:ad9b13f8035ec2f2 > >>> 2007-10-13 00:21:52: INFO: Using port 0 > >>> 2007-10-13 00:21:52: ERROR: pam_authenticate failed: > >> Authentication failure > >>> 2007-10-13 00:21:52: INFO: Released port 0 > >>> 2007-10-13 00:21:52: INFO: login failed for user "charlie" > >>> 2007-10-13 00:21:52: ERROR: Attempt to release an > >> unallocated address > >>> (port 0) > >>> 2007-10-13 00:21:52: ERROR: mode config 6 from > >> 172.17.35.3[4500], but we > >>> have no > >>> ISAKMP-SA. > >>> 2007-10-13 00:21:52: ERROR: unknown Informational exchange received. > >>> > >>> why? I don't understand. Well, yes, I think that server > >> doesn't use > >>> really pam > >>> libraries or problem is that linux use shadow for passwords instead > >>> passwd file. > >>> > >>> > >>> I see a lot of webs on this configuration works out of > >> the box, but > >>> not for > >>> me.... I am really desperated. > >>> > >>> Many thanks. > >>> > >>> P.D: On ipsec-tools mailing list i don't receive any response. > >>> -- > >>> CL Martinez > >>> carlopmart {at} gmail {d0t} com > >>> _______________________________________________ > >>> CentOS mailing list > >>> CentOS at centos.org > >>> http://lists.centos.org/mailman/listinfo/centos > >>> > >>> > >> -------------------------------------------------------------- > >> ---------- > >>> This e-mail, and any attachments thereto, is intended only > >> for use by > >>> the addressee(s) named herein and may contain legally > >> privileged and/or > >>> confidential information. If you are not the intended > >> recipient of this > >>> e-mail, you are hereby notified that any dissemination, > >> distribution or > >>> copying of this e-mail, and any attachments thereto, is strictly > >>> prohibited. If you have received this e-mail in error, please > >>> immediately notify the sender and permanently delete the > >> original and > >>> any copy or printout thereof. > >> > >> -- > >> CL Martinez > >> carlopmart {at} gmail {d0t} com > >> > > > > ______________________________________________________________________ > > This e-mail, and any attachments thereto, is intended only for use by > > the addressee(s) named herein and may contain legally privileged > > and/or confidential information. If you are not the intended recipient > > of this e-mail, you are hereby notified that any dissemination, > > distribution or copying of this e-mail, and any attachments thereto, > > is strictly prohibited. If you have received this e-mail in error, > > please immediately notify the sender and permanently delete the > > original and any copy or printout thereof. > > > > > > > -- > CL Martinez > carlopmart {at} gmail {d0t} com > _______________________________________________ > CentOS mailing list > CentOS at centos.org > http://lists.centos.org/mailman/listinfo/centos >