Starting IPSec Command Hangs
https://askubuntu.com/questions/1074037/starting-ipsec-command-hangs
I am attempting to establish a VPN connection between two regions in AWS EC2 (two virtual machines) using StrongSwan within Docker. However, I am getting a ton of errors when trying to start the connection.
The commands sudo ipsec start --nofork and sudo ipsec restart give the following errors, respectively:
Starting strongSwan 5.3.5 IPsec [starter]...
ipsec_starter[374]: Starting strongSwan 5.3.5 IPsec [starter]...
00[LIB] expanding file pattern '/etc/strongswan.d/charon/*.conf' failed: Permission denied
00[LIB] expanding file pattern '/etc/strongswan.d/*.conf' failed: Permission denied
00[DMN] Starting IKE charon daemon (strongSwan 5.3.5, Linux 4.4.0-1065-aws, x86_64)
00[LIB] feature CUSTOM:libcharon in critical plugin 'charon' has unmet dependency: NONCE_GEN
00[LIB] feature CUSTOM:libcharon-receiver in critical plugin 'charon' has unmet dependency: HASHER:HASH_SHA1
00[LIB] feature CUSTOM:libcharon-sa-managers in critical plugin
'charon' has unmet dependency: HASHER:HASH_SHA1 00[LIB] failed to load 3 critical plugin features
00[DMN] initialization failed - aborting charon
charon has quit: initialization failed
ipsec_starter[374]: charon has quit: initialization failed
charon refused to be started
ipsec_starter[374]: charon refused to be started
ipsec starter stopped
ipsec_starter[374]: ipsec starter stopped
and
Stopping strongSwan IPsec failed: starter is not running
Starting strongSwan 5.3.5 IPsec [starter]...
ipsec_starter[389]: Starting strongSwan 5.3.5 IPsec [starter]...
root@b65e01b190f6:/etc# ipsec_starter[408]: charon has quit:
initialization failed
ipsec_starter[408]: charon refused to be started
ipsec_starter[408]: ipsec starter stopped
(The second one hangs after the last command and must be exited with Ctrl+C)
To fix some errors, I commented out the line:
load_modular = yes
in the file:
/etc/strongswan.conf
Now running the same commands output:
Starting strongSwan 5.3.5 IPsec [starter]...
ipsec_starter[413]: Starting strongSwan 5.3.5 IPsec [starter]...
00[LIB] expanding file pattern '/etc/strongswan.d/charon/*.conf' failed: Permission denied
00[LIB] expanding file pattern '/etc/strongswan.d/*.conf' failed: Permission denied
00[DMN] Starting IKE charon daemon (strongSwan 5.3.5, Linux 4.4.0-1065-aws, x86_64)
00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'
00[LIB] opening directory '/etc/ipsec.d/cacerts' failed: Permission denied
00[CFG] reading directory failed
00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'
00[LIB] opening directory '/etc/ipsec.d/aacerts' failed: Permission denied
00[CFG] reading directory failed
00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'
00[LIB] opening directory '/etc/ipsec.d/ocspcerts' failed: Permission denied
00[CFG] reading directory failed
00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'
00[LIB] opening directory '/etc/ipsec.d/acerts' failed: Permission denied
00[CFG] reading directory failed
00[CFG] loading crls from '/etc/ipsec.d/crls'
00[LIB] opening directory '/etc/ipsec.d/crls' failed: Permission denied
00[CFG] reading directory failed
00[CFG] loading secrets from '/etc/ipsec.secrets'
00[CFG] loaded IKE secret for B.B.B.B X.X.X.X
00[LIB] loaded plugins: charon test-vectors aes rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac ccm gcm attr kernel-netlink resolve socket-default connmark stroke updown
00[LIB] dropped capabilities, running as uid 0, gid 0
00[JOB] spawning 16 worker threads
charon (426) started after 20 ms
ipsec_starter[413]: charon (426) started after 20 ms
11[CFG] received stroke: add connection 'A-to-B'
11[CFG] left nor right host is our side, assuming left=local
11[CFG] algorithm 'sha_256' not recognized
11[CFG] skipped invalid proposal string: aes256-sha_256-modp1024
11[CFG] added configuration 'A-to-B'
13[CFG] received stroke: initiate 'A-to-B'
13[IKE] initiating IKE_SA A-to-B[1] to X.X.X.X
13[IKE] configured DH group MODP_NONE not supported
13[MGR] tried to check-in and delete nonexisting IKE_SA
and
Stopping strongSwan IPsec failed: starter is not running
Starting strongSwan 5.3.5 IPsec [starter]...
ipsec_starter[444]: Starting strongSwan 5.3.5 IPsec [starter]...
root@b65e01b190f6:/etc# ipsec_starter[463]: charon (464) started after 20 ms
Now both commands hang there and so I'm not sure if commenting out that line helped at all.
The expanding file pattern '/etc/strongswan.d/charon/*.conf' failed: Permission denied lines likely cause many of my errors but I'm not sure how to fix that since I am already root within Docker.
I am including part of my Dockerfile as well incase that may help:
FROM ubuntu:16.04
RUN apt update && apt install -y --no-install-recommends apt-utils
RUN apt -y install sudo
RUN apt upgrade -y
RUN apt install strongswan -y
RUN apt install nano -y
RUN apt install openssh-client -y
RUN apt install kmod
RUN echo "IdentityFile ~/.ssh/id_rsa" >> /etc/ssh/ssh_config
RUN sudo rm /etc/ipsec.conf
RUN touch /etc/ipsec.conf
RUN echo "# basic configuration" >> /etc/ipsec.conf \
&& echo "config setup" >> /etc/ipsec.conf \
&& echo ' charondebug="all"' >> /etc/ipsec.conf \
&& echo " uniqueids=yes" >> /etc/ipsec.conf \
&& echo " strictcrlpolicy=no" >> /etc/ipsec.conf \
&& echo "" >> /etc/ipsec.conf \
&& echo "conn A-to-B" >> /etc/ipsec.conf \
&& echo " authby=secret" >> /etc/ipsec.conf \
&& echo " left=A.A.A.A" >> /etc/ipsec.conf \
&& echo " leftid=B.B.B.B" >> /etc/ipsec.conf \
&& echo " leftsubnet=A.C.C.C/16" >> /etc/ipsec.conf \
&& echo " right=X.X.X.X" >> /etc/ipsec.conf \
&& echo " rightsubnet=Y.Y.Y.Y/16" >> /etc/ipsec.conf \
&& echo " ike=aes256-sha_256-modp1024!" >> /etc/ipsec.conf \
&& echo " esp=aes256-sha2_256!" >> /etc/ipsec.conf \
&& echo " keyingtries=0" >> /etc/ipsec.conf \
&& echo " ikelifetime=1h" >> /etc/ipsec.conf \
&& echo " lifetime=8h" >> /etc/ipsec.conf \
&& echo " dpddelay=30" >> /etc/ipsec.conf \
&& echo " dpdtimeout=120" >> /etc/ipsec.conf \
&& echo " dpdaction=restart" >> /etc/ipsec.conf \
&& echo " auto=start" >> /etc/ipsec.conf
RUN sudo rm /etc/ipsec.secrets
RUN touch /etc/ipsec.secrets
RUN echo "'B.B.B.B X.X.X.X : PSK "mykey"' >> /etc/ipsec.secrets
RUN echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
RUN sudo sysctl -p /etc/sysctl.conf
The Dockerfile on the other instance is pretty much the same thing with the IPs swapped.
EDIT: UPDATE (NOT PART OF ORIGINAL QUESTION)
I switched encryption algorithms because mod1024 is not strong enough for strongSwan's standards anymore. I am now using:
ike=aes128gcm16-prfsha256-ecp256,aes256gcm16-prfsha384-ecp384!
esp=aes128gcm16-ecp256,aes256gcm16-ecp384!
and that fixed a few errors. I also was using the command:
sudo docker run -itv ~:/mnt/ nameHere bash
but added the tag --cap-add=NET_ADMIN and all the pre-connecting errors have gone away. However, there is a new error when trying to connect where the connection will time out after 5 attempts.
root@aaaaaaaaaa:/etc# sudo ipsec start --nofork
Starting strongSwan 5.3.5 IPsec [starter]...
ipsec_starter[482]: Starting strongSwan 5.3.5 IPsec [starter]...
00[DMN] Starting IKE charon daemon (strongSwan 5.3.5, Linux 4.4.0-1065-aws, x86_64)
00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'
00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'
00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'
00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'
00[CFG] loading crls from '/etc/ipsec.d/crls'
00[CFG] loading secrets from '/etc/ipsec.secrets'
00[CFG] loaded IKE secret for X.X.X.X Y.Y.Y.Y
00[LIB] loaded plugins: charon test-vectors aes rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default connmark stroke updown
00[LIB] dropped capabilities, running as uid 0, gid 0
00[JOB] spawning 16 worker threads
charon (495) started after 20 ms
ipsec_starter[482]: charon (495) started after 20 ms
11[CFG] received stroke: add connection 'A-to-B'
11[CFG] left nor right host is our side, assuming left=local
11[CFG] added configuration 'A-to-B'
13[CFG] received stroke: initiate 'A-to-B'
13[IKE] initiating IKE_SA A-to-B[1] to Y.Y.Y.Y
13[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(HASH_ALG) ]
13[NET] sending packet: from X.X.X.X[500] to Y.Y.Y.Y[500] (284 bytes)
10[NET] error writing to socket: Invalid argument
15[IKE] retransmit 1 of request with message ID 0
15[NET] sending packet: from X.X.X.X (private ip)[500] to Y.Y.Y.Y (public ip of other connection)[500] (284 bytes)
10[NET] error writing to socket: Invalid argument
.
.
.
04[IKE] retransmit 5 of request with message ID 0
04[NET] sending packet: from X.X.X.X (private ip)[500] to Y.Y.Y.Y (public ip of other connection)[500] (284 bytes)
10[NET] error writing to socket: Invalid argument
03[IKE] giving up after 5 retransmits
03[IKE] establishing IKE_SA failed, peer not responding
And it is now hanging here until I kill it with another CTRL+C. Any ideas would be greatly appreciated.
