{"id":771,"date":"2018-04-23T16:46:00","date_gmt":"2018-04-23T07:46:00","guid":{"rendered":"https:\/\/fsck.jp\/?p=771"},"modified":"2018-06-25T15:14:51","modified_gmt":"2018-06-25T06:14:51","slug":"ipv6-ipsec%e3%83%88%e3%83%b3%e3%83%8d%e3%83%ab%e8%a8%ad%e5%ae%9a-strongswan","status":"publish","type":"post","link":"https:\/\/fsck.jp\/?p=771","title":{"rendered":"Linux \u540c\u58eb\u306e IPv6 IPsec \u63a5\u7d9a"},"content":{"rendered":"

\u500b\u4eba\u7684\u306a\u3053\u3068\u3060\u304c\u3001\u81ea\u5b85\u306e\u30d5\u30ec\u30c3\u30c4\u56de\u7dda\u3068\u30d7\u30ed\u30d0\u30a4\u30c0\u304cIPv6\u30cd\u30a4\u30c6\u30a3\u30d6\u65b9\u5f0f (IPoE) \u306b\u5bfe\u5fdc\u3057\u305f\u305f\u3081\u3001\u81ea\u5b85\u5185\u306e\u30ce\u30fc\u30c9\u306b IPv6 \u30b0\u30ed\u30fc\u30d0\u30eb\u30a2\u30c9\u30ec\u30b9\u3092\u5272\u308a\u5f53\u3066\u3089\u308c\u308b\u3088\u3046\u306b\u306a\u3063\u305f\u3002<\/p>\n

\u3053\u308c\u3092\u5229\u7528\u3057\u3066\u3001\u81ea\u5206\u3067\u501f\u308a\u305f\u300c\u3055\u304f\u3089\u306e VPS\u300d\uff08\u3053\u3061\u3089\u3082 IPv6 \u30b0\u30ed\u30fc\u30d0\u30eb\u30a2\u30c9\u30ec\u30b9\u304c\u4ed8\u4e0e\u3055\u308c\u308b\uff09\u3068\u81ea\u5b85\u5185\u30b5\u30fc\u30d0\u306e\u9593\u306b IPv6 IPsec\u30c8\u30f3\u30cd\u30eb\u3092\u4f5c\u6210\u3057\u3066\u307f\u308b\u3002<\/p>\n

\u524d\u63d0\u74b0\u5883\uff1a
\n\u30fb\u81ea\u5b85\u30b5\u30fc\u30d0: Raspbian 9.4 + strongswan
\n\u30fbVPS: CentOS 7.5 + strongswan
\n\u30fb\u8a8d\u8a3c\u65b9\u5f0f: X.509 \u8a3c\u660e\u66f8<\/p>\n

\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u69cb\u6210\u56f3
\n\"\"<\/a><\/p>\n

1. \u8a3c\u660e\u66f8\u306e\u4f5c\u6210<\/h3>\n

myserver1 \u4e0a\u306b CA \u306e\u305f\u3081\u306e\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u3068\u8a2d\u5b9a\u3092\u6e96\u5099\u3059\u308b\u3002
\nuser@myserver1:~$ sudo mkdir \/etc\/ssl\/CA
\nuser@myserver1:~$ sudo mkdir \/etc\/ssl\/newcerts
\nuser@myserver1:~$ sudo sh -c \"echo '01' > \/etc\/ssl\/CA\/serial\"
\nuser@myserver1:~$ sudo sh -c \"echo '01' > \/etc\/ssl\/CA\/crlnumber\"
\nuser@myserver1:~$ sudo touch \/etc\/ssl\/CA\/index.txt
\nuser@myserver1:~$ sudo vi \/etc\/ssl\/openssl.cnf<\/code><\/p>\n

\/etc\/ssl\/openssl.cnf\u306e\u629c\u7c8b:<\/p>\n

\r\ndir\t\t= \/etc\/ssl\t\t# Where everything is kept\r\ndatabase\t= $dir\/CA\/index.txt\t# database index file.\r\ncertificate\t= $dir\/certs\/ca1.crt \t# The CA certificate\r\nserial\t\t= $dir\/CA\/serial \t\t# The current serial number\r\ncrlnumber\t= $dir\/CA\/crlnumber # the current crl number\r\n                    # must be commented out to leave a V1 CRL\r\ncrl     = $dir\/crl\/crl.pem\r\nprivate_key\t= $dir\/private\/ca1.key<\/pre>\n
CA \u9375\u30fb\u8a3c\u660e\u66f8\u3092\u4f5c\u6210\u3059\u308b\u3002
\nuser@myserver1:~$ sudo openssl req -new -x509 -extensions v3_ca -keyout \/etc\/ssl\/private\/ca1.key -out \/etc\/ssl\/certs\/ca1.crt -days 3652
\n(snip)
\nCountry Name (2 letter code) [AU]:JP
\nState or Province Name (full name) [Some-State]:Aichi
\nLocality Name (eg, city) []:Nagoya
\nOrganization Name (eg, company) [Internet Widgits Pty Ltd]:Home
\nOrganizational Unit Name (eg, section) []:CA
\nCommon Name (e.g. server FQDN or YOUR name) []:ca1.home.example.com
\nEmail Address []:<\/code><\/p>\n
myserver1 \u306e\u79d8\u5bc6\u9375\u3092\u4f5c\u6210\u3059\u308b\u3002
\nuser@myserver1:~$ openssl genrsa -aes256 -out \/etc\/ssl\/private\/myserver1.key 2048
\nEnter pass phrase for myserver1.key:********
\n(\u5f8c\u3067\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u524a\u9664\u3059\u308b\u306e\u3067\u3001\u30d1\u30b9\u30ef\u30fc\u30c9\u306f\u3053\u3053\u3067\u306f\u9069\u5f53\u306b\u6c7a\u3081\u308b)
\nVerifying - Enter pass phrase for myserver1.key:********<\/code><\/p>\n
\u79d8\u5bc6\u9375\u30d5\u30a1\u30a4\u30eb\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u524a\u9664\u3057\u3066\u304a\u304f\u3002
\nuser@myserver1:~$ openssl rsa -in \/etc\/ssl\/private\/myserver1.key -out \/etc\/ssl\/private\/myserver1.key
\nEnter pass phrase for myserver1.key:********
\nwriting RSA key<\/code><\/p>\n
myserver1 \u306e CSR \u3092\u4f5c\u6210\u3059\u308b\u3002
\nuser@myserver1:~$ openssl req -new -days 1826 -key \/etc\/ssl\/private\/myserver1.key -out \/etc\/ssl\/cert\/myserver1.csr
\n(snip)
\nCountry Name (2 letter code) [AU]:JP
\nState or Province Name (full name) [Some-State]:Aichi
\nLocality Name (eg, city) []:Nagoya
\nOrganization Name (eg, company) [Internet Widgits Pty Ltd]:Home
\nOrganizational Unit Name (eg, section) []:Server
\nCommon Name (e.g. server FQDN or YOUR name) []:myserver1.home.example.com
\nEmail Address []:
\nPlease enter the following 'extra' attributes
\nto be sent with your certificate request
\nA challenge password []:
\nAn optional company name []:<\/code><\/p>\n
CA \u9375\u3092\u4f7f\u3063\u3066 CSR \u306b\u7f72\u540d\u3059\u308b\u3002
\nuser@myserver1:~$ sudo openssl ca -in \/etc\/ssl\/cert\/myserver1.csr -config \/etc\/ssl\/openssl.cnf
\nEnter pass phrase for \/etc\/ssl\/private\/ca.key:********
\n(snip)
\nSign the certificate? [y\/n]:y
\n1 out of 1 certificate requests certified, commit? [y\/n]y
\n(snip)
\nData Base Updated<\/code><\/p>\n
CA \u8a3c\u660e\u66f8\u3068\u30db\u30b9\u30c8\u8a3c\u660e\u66f8\u30fb\u9375\u3092 strongswan \u7528\u306b\u914d\u7f6e\u3059\u308b\u3002
\nuser@myserver1:~$ sudo cp \/etc\/ssl\/certs\/ca1.crt \/etc\/ipsec.d\/cacerts\/
\nuser@myserver1:~$ sudo cp \/etc\/ssl\/newcerts\/01.pem \/etc\/ipsec.d\/certs\/myserver1.crt
\nuser@myserver1:~$ sudo cp \/etc\/ssl\/private\/myserver1.key \/etc\/ipsec.d\/private\/<\/code><\/p>\n
myvps1 \u7528\u306e\u8a3c\u660e\u66f8\u3082\u540c\u69d8\u306b\u4f5c\u6210\u3059\u308b\u3002
\nuser@myserver1:~$ openssl genrsa -aes256 -out \/etc\/ssl\/private\/myvps1.key 2048
\nuser@myserver1:~$ openssl rsa -in \/etc\/ssl\/private\/myvps1.key -out \/etc\/ssl\/private\/myvps1.key
\nuser@myserver1:~$ openssl req -new -days 1826 -key \/etc\/ssl\/private\/myvps1.key -out \/etc\/ssl\/cert\/myvps1.csr
\nuser@myserver1:~$ sudo openssl ca -in \/etc\/ssl\/cert\/myvps1.csr -config \/etc\/ssl\/openssl.cnf<\/code><\/p>\n
\u3044\u307e\u4f5c\u6210\u3057\u305f myvps1 \u7528\u306e\u30db\u30b9\u30c8\u8a3c\u660e\u66f8\u30fb\u9375\u3001CA\u8a3c\u660e\u66f8\u3092 myvps1 \u5074\u306b\u30b3\u30d4\u30fc\u3059\u308b\u3002
\nuser@myserver1:~$ cp \/etc\/ssl\/certs\/ca1.crt .
\nuser@myserver1:~$ cp \/etc\/ssl\/newcerts\/02.pem .\/myvps1.crt
\nuser@myserver1:~$ sudo cp \/etc\/ssl\/private\/myvps1.key .
\nuser@myserver1:~$ sudo chown user myvps1.key
\nuser@myserver1:~$ scp ca1.crt myvps1.crt myvps1.key myvps1:<\/code><\/p>\n
myvps1 \u4e0a\u3067\u8a3c\u660e\u66f8\u30fb\u9375\u3092\u914d\u7f6e\u3059\u308b\u3002
\n[user@myvps1 ~]$ sudo cp ca1.crt \/etc\/strongswan\/ipsec.d\/cacerts\/
\n[user@myvps1 ~]$ sudo cp myvps1.crt \/etc\/strongswan\/ipsec.d\/certs\/
\n[user@myvps1 ~]$ sudo cp myvps1.key \/etc\/strongswan\/ipsec.d\/private\/<\/code><\/p>\n
\u4f5c\u696d\u7528\u30d5\u30a1\u30a4\u30eb\u3092\u524a\u9664\u3059\u308b\u3002
\n[user@myvps1 ~]$ rm ca1.crt myvps1.crt myvps1.key
\nuser@myserver1:~$ rm ca1.crt myvps1.crt myvps1.key<\/code><\/p>\n
2. VPS \u5074\u306e IPsec \u8a2d\u5b9a<\/h3>\n
strongswan \u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b\u3002
\n[user@myvps1 ~]$ sudo yum install epel-release
\n[user@myvps1 ~]$ sudo yum install strongswan<\/code><\/p>\n
\u30ab\u30fc\u30cd\u30eb\u30e2\u30b8\u30e5\u30fc\u30eb\u3092\u30ed\u30fc\u30c9\u3059\u308b\u3002
\nstrongswan\u516c\u5f0f\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8<\/a>\u3092\u53c2\u7167\u3057\u3066\u3001\u5fc5\u8981\u306a\u30e2\u30b8\u30e5\u30fc\u30eb\u304c\u30ed\u30fc\u30c9\u3055\u308c\u3066\u3044\u306a\u3044\u5834\u5408\u306f\u624b\u52d5\u3067\u30ed\u30fc\u30c9\u3059\u308b\u3002
\n[user@myvps1 ~]$ sudo modprobe xfrm6_tunnel<\/code><\/p>\n
\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u3092\u7de8\u96c6\u3059\u308b\u3002
\n[user@myvps1 ~]$ vi \/etc\/strongswan\/ipsec.conf<\/code><\/p>\n
conn myhome-to-vps6\r\n        authby=rsasig\r\n        auto=add\r\n        closeaction=clear\r\n        dpdaction=clear\r\n        leftid=\"C=JP, ST=Aichi, O=Home, OU=Server, CN=myvps1.example.com\"\r\n        leftsubnet=2001:db8:abcd:efab:cdef:abcd:efab:cdef\/128\r\n        leftcert=myvps1.crt\r\n        right=%any\r\n        rightid=\"C=JP, ST=Aichi, O=Home, OU=Server, CN=myserver1.home.example.com\"\r\n        rightsubnet=2001:db8:1234:5678::\/64\r\n        ike=aes256-sha512-modp8192!\r\n        esp=aes256-sha512<\/pre>\n
[user@myvps1 ~]$ sudo vi \/etc\/strongswan\/ipsec.secrets<\/code><\/p>\n
: RSA myvps1.key<\/pre>\n
strongswan\u30b5\u30fc\u30d3\u30b9\u8d77\u52d5
\n[user@myvps1 ~]$ sudo systemctl enable strongswan
\n[user@myvps1 ~]$ sudo systemctl start strongswan<\/code><\/p>\n
3. \u81ea\u5b85\u5185\u30b5\u30fc\u30d0\u5074\u306e\u8a2d\u5b9a<\/h3>\n
strongswan\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b\u3002\u3053\u3061\u3089\u306f Raspbian \u306a\u306e\u3067 apt \u30b3\u30de\u30f3\u30c9\u3067\u3002
\nuser@myserver1:~$ sudo apt install strongswan<\/code><\/p>\n
\u5fc5\u8981\u306a\u30ab\u30fc\u30cd\u30eb\u30e2\u30b8\u30e5\u30fc\u30eb\u3092\u30ed\u30fc\u30c9\u3059\u308b\u3002
\nuser@myserver1:~$ sudo modprobe xfrm6_tunnel
\nuser@myserver1:~$ sudo modprobe esp6<\/code><\/p>\n
\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u3092\u7de8\u96c6\u3059\u308b\u3002
\nuser@myserver1:~$ sudo vi \/etc\/ipsec.conf<\/code><\/p>\n
conn myhome-to-vps6\r\n        authby=rsasig\r\n        auto=start\r\n        closeaction=restart\r\n        dpdaction=restart\r\n        leftid=\"C=JP, ST=Aichi, O=Home, OU=Server, CN=myserver1.home.example.com\"\r\n        leftsubnet=2001:db8:1234:5678::\/64\r\n        leftcert=myserver1.crt\r\n        right=2001:db8:abcd:efab:cdef:abcd:efab:cdef\r\n        rightid=\"C=JP, ST=Aichi, O=Home, OU=Server, CN=myvps1.example.com\"\r\n        rightsubnet=2001:db8:abcd:efab:cdef:abcd:efab:cdef\/128\r\n        ike=aes256-sha512-modp8192!\r\n        esp=aes256-sha512<\/pre>\n
user@myserver1:~$ sudo vi \/etc\/ipsec.secrets<\/code><\/p>\n
\r\n: RSA myserver1.key<\/pre>\n
strongswan\u30b5\u30fc\u30d3\u30b9\u3092\u8d77\u52d5\u3059\u308b\u3002
\nuser@myserver1:~$ sudo systemctl enable strongswan
\nuser@myserver1:~$ sudo systemctl start strongswan<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"
\u500b\u4eba\u7684\u306a\u3053\u3068\u3060\u304c\u3001\u81ea\u5b85\u306e\u30d5\u30ec\u30c3\u30c4\u56de\u7dda\u3068\u30d7\u30ed\u30d0\u30a4\u30c0\u304cIPv6\u30cd\u30a4\u30c6\u30a3\u30d6\u65b9\u5f0f (IPoE) \u306b\u5bfe\u5fdc\u3057\u305f\u305f\u3081\u3001\u81ea\u5b85\u5185\u306e\u30ce\u30fc\u30c9\u306b IPv6 \u30b0\u30ed\u30fc\u30d0\u30eb\u30a2\u30c9\u30ec\u30b9\u3092\u5272\u308a\u5f53\u3066\u3089\u308c\u308b\u3088\u3046\u306b\u306a\u3063\u305f\u3002 \u3053\u308c\u3092\u5229\u7528\u3057\u3066\u3001\u81ea\u5206\u3067\u501f\u308a\u305f\u300c\u3055\u304f\u3089\u306e […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[20,22,23,15,12,7],"tags":[],"_links":{"self":[{"href":"https:\/\/fsck.jp\/index.php?rest_route=\/wp\/v2\/posts\/771"}],"collection":[{"href":"https:\/\/fsck.jp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fsck.jp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fsck.jp\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fsck.jp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=771"}],"version-history":[{"count":0,"href":"https:\/\/fsck.jp\/index.php?rest_route=\/wp\/v2\/posts\/771\/revisions"}],"wp:attachment":[{"href":"https:\/\/fsck.jp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=771"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fsck.jp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=771"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fsck.jp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=771"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}