Not if one intends to modify it to suite racoon's specific needs... -Ross > -----Original Message----- > From: Nicolas Sahlqvist [mailto:nicco77 at gmail.com] > Sent: Friday, October 12, 2007 8:04 PM > To: CentOS mailing list; Ross S. W. Walker > Subject: Re: [CentOS] OT: a very big problem with ipsec-tools > on CentOS5 (SOLVED) > > Does it not more sense to make a symlink rather then copying > the file..? > > > / Nicolas > > On 10/13/07, carlopmart <carlopmart at gmail.com> wrote: > > Buf ... Solved. Problem was that /etc/pam.d/racoon doesn't > exists (I found > > this > > tip on NetBSD ipsec pages). Simply I have copied > /etc/pam.d/passwd to > > /etc/pam.d/racoon and now all works as expected. > > > > Many thanks for your help Ross. > > > > > > > > Ross S. W. Walker wrote: > > > > > > I think it might just use another one like /etc/pam.d/remote > > > cause I audited the package and it wasn't there. > > > > > > Does the "users" group exist and charlie a member of it? > > > > > > -Ross > > > > > >> -----Original Message----- > > >> From: carlopmart [mailto:carlopmart at gmail.com] > > >> Sent: Friday, October 12, 2007 6:54 PM > > >> To: Ross S. W. Walker > > >> Subject: Re: [CentOS] OT: a very big problem with ipsec-tools > > >> on CentOS5 > > >> > > >> hi ross, > > >> > > >> Yes I compiled with pam option. But I don't have any ipsec > > >> config file on > > >> /etc/pam.d ... I didn't find any sample on ipsec-tools 0.7 > > >> source tree ... where > > >> is it?? > > >> > > >> Ross S. W. Walker wrote: > > >>> If you compiled ipsec tools yourself did you compile with > > >> the pam option? > > >>> If not then you can't tell it to use pam for authentication. > > >>> > > >>> If you did, did you setup the appropriate ipsec config file in > > >>> /etc/pam.d? I believe there is an example one in the ipsec > > >> source tree. > > >>> -Ross > > >>> > > >>> > > >>> -----Original Message----- > > >>> From: centos-bounces at centos.org <centos-bounces at centos.org> > > >>> To: centos at centos.org <centos at centos.org> > > >>> Sent: Fri Oct 12 18:38:38 2007 > > >>> Subject: [CentOS] OT: a very big problem with > ipsec-tools on CentOS5 > > >>> > > >>> Hi all, > > >>> > > >>> I am trying to establish a vpn tunnel between one CentOS5 > > >> IPSec server > > >>> and a > > >>> roadwarrior client, CentOS5 too. Roadwarrior use > > >> ipsec-tools version 0.6.5-8 > > >>> (that comes with CentOS5) and server uses version 0.7 > > >> (downloaded from > > >>> ipsec-tools website). > > >>> > > >>> My server configuration is: > > >>> > > >>> path include "/etc/racoon"; > > >>> path certificate "/etc/racoon/certs"; > > >>> path pre_shared_key "/etc/racoon/psk.txt"; > > >>> path pidfile "/var/run/racoon.pid"; > > >>> #log debug; > > >>> > > >>> listen { > > >>> adminsock "/var/racoon/racoon.sock" "root" > "nobody" 0660; > > >>> isakmp 172.28.45.4 [500]; > > >>> isakmp_natt 172.28.45.4 [4500]; > > >>> } > > >>> > > >>> remote anonymous { > > >>> exchange_mode aggressive; > > >>> certificate_type x509 "gwenc.crt" "gwenc.key"; > > >>> my_identifier asn1dn; > > >>> proposal_check claim; > > >>> generate_policy on; > > >>> nat_traversal on; > > >>> dpd_delay 20; > > >>> ike_frag on; > > >>> passive on; > > >>> proposal { > > >>> encryption_algorithm aes; > > >>> hash_algorithm sha256; > > >>> authentication_method hybrid_rsa_server; > > >>> dh_group 2; > > >>> } > > >>> } > > >>> > > >>> mode_cfg { > > >>> network4 172.31.78.5; > > >>> netmask4 255.255.255.240; > > >>> pool_size 6; > > >>> dns4 172.25.50.1; > > >>> auth_source pam; > > >>> auth_groups "users"; > > >>> group_source system; > > >>> auth_throttle 10; > > >>> pfs_group 2; > > >>> } > > >>> > > >>> sainfo anonymous > > >>> { > > >>> pfs_group 2; > > >>> lifetime time 1 hour; > > >>> encryption_algorithm rijndael; > > >>> authentication_algorithm hmac_sha256; > > >>> compression_algorithm deflate; > > >>> } > > >>> > > >>> When I try to connect from roadwarrior client using > xauth, server > > >>> returns me > > >>> this errors: > > >>> > > >>> 2007-10-13 00:21:52: INFO: ISAKMP-SA established > > >>> 172.28.45.4[4500]-172.17.35.3[4500] > > >> spi:e3ff2f5a0873ff54:ad9b13f8035ec2f2 > > >>> 2007-10-13 00:21:52: INFO: Using port 0 > > >>> 2007-10-13 00:21:52: ERROR: pam_authenticate failed: > > >> Authentication failure > > >>> 2007-10-13 00:21:52: INFO: Released port 0 > > >>> 2007-10-13 00:21:52: INFO: login failed for user "charlie" > > >>> 2007-10-13 00:21:52: ERROR: Attempt to release an > > >> unallocated address > > >>> (port 0) > > >>> 2007-10-13 00:21:52: ERROR: mode config 6 from > > >> 172.17.35.3[4500], but we > > >>> have no > > >>> ISAKMP-SA. > > >>> 2007-10-13 00:21:52: ERROR: unknown Informational > exchange received. > > >>> > > >>> why? I don't understand. Well, yes, I think that server > > >> doesn't use > > >>> really pam > > >>> libraries or problem is that linux use shadow for > passwords instead > > >>> passwd file. > > >>> > > >>> > > >>> I see a lot of webs on this configuration works out of > > >> the box, but > > >>> not for > > >>> me.... I am really desperated. > > >>> > > >>> Many thanks. > > >>> > > >>> P.D: On ipsec-tools mailing list i don't receive any response. > > >>> -- > > >>> CL Martinez > > >>> carlopmart {at} gmail {d0t} com > > >>> _______________________________________________ > > >>> CentOS mailing list > > >>> CentOS at centos.org > > >>> http://lists.centos.org/mailman/listinfo/centos > > >>> > > >>> > > >> -------------------------------------------------------------- > > >> ---------- > > >>> This e-mail, and any attachments thereto, is intended only > > >> for use by > > >>> the addressee(s) named herein and may contain legally > > >> privileged and/or > > >>> confidential information. If you are not the intended > > >> recipient of this > > >>> e-mail, you are hereby notified that any dissemination, > > >> distribution or > > >>> copying of this e-mail, and any attachments thereto, is strictly > > >>> prohibited. If you have received this e-mail in error, please > > >>> immediately notify the sender and permanently delete the > > >> original and > > >>> any copy or printout thereof. > > >> > > >> -- > > >> CL Martinez > > >> carlopmart {at} gmail {d0t} com > > >> > > > > > > > ______________________________________________________________________ > > > This e-mail, and any attachments thereto, is intended > only for use by > > > the addressee(s) named herein and may contain legally privileged > > > and/or confidential information. If you are not the > intended recipient > > > of this e-mail, you are hereby notified that any dissemination, > > > distribution or copying of this e-mail, and any > attachments thereto, > > > is strictly prohibited. If you have received this e-mail in error, > > > please immediately notify the sender and permanently delete the > > > original and any copy or printout thereof. > > > > > > > > > > > > -- > > CL Martinez > > carlopmart {at} gmail {d0t} com > > _______________________________________________ > > CentOS mailing list > > CentOS at centos.org > > http://lists.centos.org/mailman/listinfo/centos > > > ______________________________________________________________________ This e-mail, and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail, you are hereby notified that any dissemination, distribution or copying of this e-mail, and any attachments thereto, is strictly prohibited. If you have received this e-mail in error, please immediately notify the sender and permanently delete the original and any copy or printout thereof.