Overview Repositories Revisions Requests Users Attributes Meta

OpenSource IPsec-based VPN Solution

Edit Package strongswan

StrongSwan is an OpenSource IPsec-based VPN Solution for Linux

* runs both on Linux 2.4 (KLIPS IPsec) and Linux 2.6 (NETKEY IPsec) kernels
* implements both the IKEv1 and IKEv2 (RFC 4306) key exchange protocols
* Fully tested support of IPv6 IPsec tunnel and transport connections
* Dynamical IP address and interface update with IKEv2 MOBIKE (RFC 4555)
* Automatic insertion and deletion of IPsec-policy-based firewall rules
* Strong 128/192/256 bit AES or Camellia encryption, 3DES support
* NAT-Traversal via UDP encapsulation and port floating (RFC 3947)
* Dead Peer Detection (DPD, RFC 3706) takes care of dangling tunnels
* Static virtual IPs and IKEv1 ModeConfig pull and push modes
* XAUTH server and client functionality on top of IKEv1 Main Mode authentication
* Virtual IP address pool managed by IKE daemon or SQL database
* Secure IKEv2 EAP user authentication (EAP-SIM, EAP-AKA, EAP-MSCHAPv2, etc.)
* Optional relaying of EAP messages to AAA server via EAP-RADIUS plugin
* Support of IKEv2 Multiple Authentication Exchanges (RFC 4739)
* Authentication based on X.509 certificates or preshared keys
* Generation of a default self-signed certificate during first strongSwan startup
* Retrieval and local caching of Certificate Revocation Lists via HTTP or LDAP
* Full support of the Online Certificate Status Protocol (OCSP, RCF 2560).
* CA management (OCSP and CRL URIs, default LDAP server)
* Powerful IPsec policies based on wildcards or intermediate CAs
* Group policies based on X.509 attribute certificates (RFC 3281)
* Storage of RSA private keys and certificates on a smartcard (PKCS #11 interface)
* Modular plugins for crypto algorithms and relational database interfaces
* Support of elliptic curve DH groups and ECDSA certificates (Suite B, RFC 4869)
* Optional built-in integrity and crypto tests for plugins and libraries
* Smooth Linux desktop integration via the strongSwan NetworkManager applet

This package triggers the installation of both, IKEv1 and IKEv2 daemons.

  • Developed at network:vpn
  • Sources inherited from project openSUSE:Factory
  • 5 derived packages
  • Download package
  • osc -A https://api.opensuse.org checkout openSUSE:Backports:SLE-15-SP4:FactoryCandidates/strongswan && cd $_
  • Create Badge
Refresh
Refresh
Source Files
Filename Size Changed
README.SUSE 0000001228 1.2 KB
strongswan-5.0.1-rpmlintrc 0000000428 428 Bytes
strongswan-5.0.1.tar.bz2 0003146776 3 MB
strongswan-5.0.1.tar.bz2.sig 0000000665 665 Bytes
strongswan.changes 0000050314 49.1 KB
strongswan.init.in 0000008747 8.54 KB
strongswan.spec 0000018369 17.9 KB
strongswan_ipsec_service.patch 0000000198 198 Bytes
strongswan_modprobe_syslog.patch 0000001869 1.83 KB
Revision 46 (latest revision is 96)
Ismail Dönmez's avatar Ismail Dönmez (namtrac) accepted request 139871 from Marius Tomaschewski's avatar Marius Tomaschewski (mtomaschewski) (revision 46) 
- Updated to strongSwan 5.0.1 release. Changes digest:
  - Introduced the sending of the standard IETF Assessment Result
    PA-TNC attribute by all strongSwan Integrity Measurement Verifiers.
  - Extended PTS Attestation IMC/IMV pair to provide full evidence of
    the Linux IMA measurement process. All pertinent file information
    of a Linux OS can be collected and stored in an SQL database.
  - The PA-TNC and PB-TNC protocols can now process huge data payloads.
  - The xauth-pam backend can authenticate IKEv1 XAuth and Hybrid
    authenticated clients against any PAM service.
  - The new unity plugin brings support for some parts of the IKEv1
    Cisco Unity Extensions.
  - The kernel-netlink plugin supports the new strongswan.conf option
    charon.install_virtual_ip_on.
  - Job handling in controller_t was fixed, which occasionally caused
    crashes on ipsec up/down.
  - Fixed transmission EAP-MSCHAPv2 user name if it contains a domain
    part.
  Changes digest from strongSwan 5.0.0 version:
  * The charon IKE daemon gained experimental support for the IKEv1
    protocol. Pluto has been removed from the 5.x series.
  * The NetworkManager charon plugin of previous releases is now
    provided by a separate executable (charon-nm) and it should work
    again with NM 0.9.
  * scepclient was updated and it now works fine with Windows Server
    2008 R2.
- Adopted spec file, enabled several plugins, e.g.: ccm, certexpire,
  coupling, ctr, duplicheck, eap-dynamic, eap-peap, eap-tls, eap-tnc,
  eap-ttls, gcm, nonce, radattr, tnc, tnccs, unity, xauth-eap and pam.
- Changed to install strongswan.service with alias to ipsec.service
  instead of the /etc/init.d/ipsec init script on openSUSE > 12.2.
Comments 0
openSUSE Build Service is sponsored by
Places