Contained WithinFind More DocumentationFeatured Support Resources |  Download this book in PDF (9905 KB)
ikeadm(1M)Name | Synopsis | Description | Options | Usage | Security | Examples | Exit Status | Attributes | See Also | Notes Name
Synopsisikeadm [-np] ikeadm [-np] get [debug | priv | stats | defaults] ikeadm [-np] set [debug | priv] [level] [file] ikeadm [-np] [get | del] [p1 | rule | preshared] [id]
ikeadm [-np] add [rule | preshared] { description }
ikeadm [-np] token [login | logout] PKCS#11_Token_Object ikeadm [-np] [read | write] [rule | preshared | certcache] file ikeadm [-np] [dump | pls | rule | preshared] ikeadm [-np] flush [p1 | certcache]
ikeadm help
[get | set | add | del | read | write | dump | flush | token]
DescriptionThe ikeadm utility retrieves information from and manipulates the configuration of the Internet Key Exchange (IKE) protocol daemon, in.iked(1M). ikeadm supports a set of operations, which may be performed on one or more of the supported object types. When invoked without arguments, ikeadm enters interactive mode which prints a prompt to the standard output and accepts commands from the standard input until the end-of-file is reached. Because ikeadm manipulates sensitive keying information, you must be superuser to use this command. Additionally, some of the commands available require that the daemon be running in a privileged mode, which is established when the daemon is started. For details on how to use this command securely see Security. Options
The following options are supported: Usage
CommandsThe following commands are supported: Object TypesId FormatsCommands like add, del, and get require that additional information be specified on the command line. In the case of the delete and get commands, all that is required is to minimally identify a given object; for the add command, the full object must be specified. Minimal identification is accomplished in most cases by a pair of values. For IP addresses, the local addr and then the remote addr are specified, either in dot-notation for IPv4 addresses, colon-separated hexadecimal format for IPv6 addresses, or a host name present in the host name database. If a host name is given that expands to more than one address, the requested operation will be performed multiple times, once for each possible combination of addresses. Identity pairs are made up of a local type-value pair, followed by the remote type-value pair. Valid types are: A cookie pair is made up of the two cookies assigned to a Phase 1 Security Association (SA) when it is created; first is the initiator's, followed by the responder's. A cookie is a 64-bit number. Finally, a label (which is used to identify a policy rule) is a character string assigned to the rule when it is created. Formatting a rule or preshared key for the add command follows the format rules for the in.iked configuration files. Both are made up of a series of id-value pairs, contained in curly braces ({ and }). See ike.config(4) and ike.preshared(4) for details on the formatting of rules and preshared keys. Security
The ikeadm command allows a privileged user to enter cryptographic keying information. If an adversary gains access to such information, the security of IPsec traffic is compromised. The following issues should be taken into account when using the ikeadm command. If your source address is a host that can be looked up over the network, and your naming system itself is compromised, then any names used will no longer be trustworthy. Security weaknesses often lie in misapplication of tools, not the tools themselves. It is recommended that administrators are cautious when using the ikeadm command. The safest mode of operation is probably on a console, or other hard-connected TTY. For additional information regarding this subject, see the afterward by Matt Blaze in Bruce Schneier's Applied Cryptography: Protocols, Algorithms, and Source Code in C. ExamplesExample 1 Emptying out all Phase 1 Security AssociationsThe following command empties out all Phase 1 Security Associations:
Example 2 Displaying all Phase 1 Security AssociationsThe following command displays all Phase 1 Security Associations:
Example 3 Deleting a Specific Phase 1 Security AssociationThe following command deletes the specified Phase 1 Security Associations:
Example 4 Adding a Rule From a FileThe following command adds a rule from a file:
Example 5 Adding a Preshared KeyThe following command adds a preshared key:
Example 6 Saving All Preshared Keys to a FileThe following command saves all preshared keys to a file:
Example 7 Viewing a Particular RuleThe following command views a particular rule:
Example 8 Reading in New Rules from ike.configThe following command reads in new rules from the ike.config file:
Example 9 Lowering the Privilege LevelThe following command lowers the privilege level:
Example 10 Viewing the Debug LevelThe following command shows the current debug level
Example 11 Using stats to Verify Hardware AcceleratorThe following example shows how stats may include an optional line at the end to indicate if IKE is using a PKCS#11 library to accelerate public-key operations, if applicable.
Example 12 Displaying the Certificate CacheThe following command shows the certificate cache and the status of associated private keys, if applicable:
Example 13 Logging into a PKCS#11 TokenThe following command shows logging into a PKCS#11 token object and unlocking private keys:
Exit Status
The following exit values are returned: AttributesSee attributes(5) for descriptions of the following attributes:
See Alsoin.iked(1M), ike.config(4), ike.preshared(4), attributes(5), ipsec(7P) Schneier, Bruce, Applied Cryptography: Protocols, Algorithms, and Source Code in C, Second Edition, John Wiley & Sons, New York, NY, 1996. NotesAs in.iked can run only in the global zone and exclusive-IP zones, this command is not useful in shared-IP zones. Name | Synopsis | Description | Options | Usage | Security | Examples | Exit Status | Attributes | See Also | Notes |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|