https://wiki.fnord.greeley.co.us/mediawiki/index.php?action=history&feed=atom&title=IPSEC
IPSEC - Revision history
2026-05-06T14:24:51Z
Revision history for this page on the wiki
MediaWiki 1.39.17
https://wiki.fnord.greeley.co.us/mediawiki/index.php?title=IPSEC&diff=216&oldid=prev
Adj: /* Turn on Opportunistic Encryption */
2012-09-22T23:52:13Z
<p><span dir="auto"><span class="autocomment">Turn on Opportunistic Encryption</span></span></p>
<table style="background-color: #fff; color: #202122;" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="en">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 23:52, 22 September 2012</td>
</tr><tr>
<td colspan="2" class="diff-lineno">Line 20:</td>
<td colspan="2" class="diff-lineno">Line 20:</td>
</tr>
<tr>
<td class="diff-marker"></td>
<td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== Turn on Opportunistic Encryption ==</div></td>
<td class="diff-marker"></td>
<td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== Turn on Opportunistic Encryption ==</div></td>
</tr>
<tr>
<td class="diff-marker"></td>
<td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Find the "'''<code>oe=off</code>'''" line in the setup section of /etc/ipsec.conf. Change it to read "'''<code>oe=on</code>'''". Restart the IPSEC daemons '''<code>/etc/init.d/ipsec restart</code>'''.</div></td>
<td class="diff-marker"></td>
<td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Find the "'''<code>oe=off</code>'''" line in the setup section of /etc/ipsec.conf. Change it to read "'''<code>oe=on</code>'''". Restart the IPSEC daemons '''<code>/etc/init.d/ipsec restart</code>'''.</div></td>
</tr>
<tr>
<td colspan="2" class="diff-empty diff-side-deleted"></td>
<td class="diff-marker" data-marker="+"></td>
<td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><br /></td>
</tr>
<tr>
<td colspan="2" class="diff-empty diff-side-deleted"></td>
<td class="diff-marker" data-marker="+"></td>
<td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>== Build the required kernel modules ==</div></td>
</tr>
<tr>
<td colspan="2" class="diff-empty diff-side-deleted"></td>
<td class="diff-marker" data-marker="+"></td>
<td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>(This should've been done '''before''' we tried to fire up pluto, the IKE daemon.)</div></td>
</tr>
</table>
Adj
https://wiki.fnord.greeley.co.us/mediawiki/index.php?title=IPSEC&diff=215&oldid=prev
Adj: Created page with "== Package Installation == apt-get install openswan openswan-doc == sysctl variables == This should be added to /etc/sysctl.conf: net.ipv4.conf.all.accept_redirects=0 net.ipv…"
2012-09-22T22:53:05Z
<p>Created page with "== Package Installation == apt-get install openswan openswan-doc == sysctl variables == This should be added to /etc/sysctl.conf: net.ipv4.conf.all.accept_redirects=0 net.ipv…"</p>
<p><b>New page</b></p><div>== Package Installation ==<br />
apt-get install openswan openswan-doc<br />
<br />
== sysctl variables ==<br />
This should be added to /etc/sysctl.conf:<br />
net.ipv4.conf.all.accept_redirects=0<br />
net.ipv4.conf.default.accept_redirects=0<br />
net.ipv4.conf.all.send_redirects=0<br />
net.ipv4.conf.default.send_redirects=0<br />
Followed by:<br />
sysctl -p /etc/sysctl.conf<br />
<br />
== Key records in DNS for opportunistic encryption ==<br />
Add the output of <br />
ipsec showhostkey --txt @yesdear.fnord.greeley.co.us<br />
to your DNS zones. This would be better with DNSSEC turned on, but that isn't a requirement. (Without DNSSEC, a malicious DNS server could provide you with a bogus host key, and impersonate your communications partner.)<br />
<br />
This procedure needs to be repeated for the reverse lookup zones as well.<br />
<br />
== Turn on Opportunistic Encryption ==<br />
Find the "'''<code>oe=off</code>'''" line in the setup section of /etc/ipsec.conf. Change it to read "'''<code>oe=on</code>'''". Restart the IPSEC daemons '''<code>/etc/init.d/ipsec restart</code>'''.</div>
Adj