usagi-linux24-stable-5安装与启用自动协商笔记

内核重新编译：

 

下面是在原来老的qmail机器上安装usagi的笔记纪录，该机器原来装有redhat-7.2 内核是2.4.2

 

1.在 www.linux-ipv6.org上 下载最新的usagi-linux24-stable-5版本

 

2.解压缩

 

    bzip2 -cd usagi-linux24-s2004XXX.tar.bz2 | tar xvf -

 

3.使用/sbin/lspci设备名称

4. Configure kernel

 

 % cd SOMEWHERE/usagi

 % make prepare TARGET=linux24

 % cd kernel
 % cd linux24
 % make mrproper
 % make menuconfig

 

针对需要scsi驱动的设备,aic7xxx机器 SCSI support ---> SCSI low-level drivers ---> aic7xxx support只能以模块方式编入。

 

因为aic7xxx以模块方式编入，所以在文件系统没有加载之前，是不能读取硬盘上/lib/modules上的模块的，所以必须做一个文件系统的影像，让lilo加载内核时，同时加载一个简单的文件系统的影像，在制作影像时，会同时把那些需要加载硬盘上真正根分区的驱动模组载入。这样，系统首先加载内核和简单文件影像，然后加载一些模组，最后加载真正根分区上的文件系统。

要注意的事，在让内核支持文件影像，必须在编译内核的时候选择block device-----ram disk support---initrid 支持，此处不能以模块方式编入 ;)

 

 % make dep

 % make bzImage
 % make modules
 % make modules_install

 % mkinitrd --ifneeded /boot/initrid-2.4.21.img 2.4.21

 % 修改 /etc/lilo.conf添加新加入的内核文件系统的影像到lilo.

 

(对于grub，如果是使用initrid-2.4.21.img 则所有启动选项均可复制原有的启动选项，root为/

如果不，则用df -k显示/目录所在，如果为/dev/hda3 则在grub中，root=/dev/hda3。

 % /sbin/lilo

 % 删除/boot下的System.map与vmlinuz连接。

 % make install 安装新的内核与文件影像。

 

IPSEC安装笔记：

 

1）  Building and installing userland applications

 

 % cd SOMEWHERE/usagi/usagi
 % ./configure
 % make
 % su
 # make install

 

2）  Installing USAGI include files (optional)

 

Installing USAGI include files of libinet6, you can use advanced
features of USAGI package when compiling other IPv6 applications.
If you are unsure the meaning, you should not install include
files.  Please skip the step.

 

Because USAGI package will overwrite some include files, you'd
better backup original include files. If you made the backup file
before, you should skip making backup.

 

 # cd /usr
 # tar cvzf include.orig.tar.gz include

 

 # cd SOMEWHERE/usagi/usagi
 # make install-includes

 

3)   Install the pfkey command

 

 % cd ANYWHERE/usagi/usagi/pfkey
 % ./configure --with-linux-kernel=ANYWHERE/usagi/kernel/linux24
   (default /usr/src/linux)
 # make install

 

4)  Install pluto

 % cd ANYWHERE/usagi/usagi/pluto
 % ./configure
 % make
 % su
 # make install

 

5)  配置静态ipv6地址

/etc/sysconfig/network 如下：

NETWORKING=yes
NETWORKING_IPV6=yes
HOSTNAME=usagi

IPV6_AUTOCONF=no
GATEWAY=22.195.172.129
/etc/sysconfig/network-scripts/ifcfg-eth0

DEVICE=eth0
BOOTPROTO=static
IPV6INIT=yes
BROADCAST=22.195.172.255
IPADDR=22.195.172.144
IPV6ADDR=3ffe:a:b:c:d::1/64
NETMASK=255.255.255.0
NETWORK=22.195.172.0
ONBOOT=yes

 

6)   显示，存储，导入ipsec的配置

#ipsec-conf show

#ipsec-conf restore filename

#ipsec-conf save filename

 

7)  手工添加sa spd entry的方法（见USAGI/usagi/doc/HOWTO/）

(SET Host A -> Host B flow at Host A)
 (SA for AH) 
 # pfkey -A sa -s 3ffe:a:b:c:d::1 -d 3ffe:a:b:c:d::2 -T ah -S 0x1234 -p udp /
  --auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef
 (SA for ESP)
 # pfkey -A sa -s 3ffe:a:b:c:d::1 -d 3ffe:a:b:c:d::2 -T esp -S 0x5678 -p udp /
  --auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef /
  --esp 3des-cbc --espkey 0xa7a36ebd91863edfba763fa7edcba64d89123ace6359eba7

 

 (SP for AH)
 # pfkey -A sp -s 3ffe:a:b:c:d::1 -d 3ffe:a:b:c:d::2 -T ah -S 0x1234 -p udp
 (SP for ESP)
 # pfkey -A sp -s 3ffe:a:b:c:d::1 -d 3ffe:a:b:c:d::2 -T esp -S 0x5678 -p udp

 

 (SET Host B -> Host A flow at Host A)
 (SA for AH)
 # pfkey -A sa -d 3ffe:a:b:c:d::1 -s 3ffe:a:b:c:d::2 -T ah -S 0x9abc -p udp /
  --auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef
 (SA for ESP)
 # pfkey -A sa -d 3ffe:a:b:c:d::1 -s 3ffe:a:b:c:d::2 -T esp -S 0xdef0 -p udp /
  --auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef /
  --esp 3des-cbc --espkey 0xa7a36ebd91863edfba763fa7edcba64d89123ace6359eba7

 

 # pfkey -A sp -d 3ffe:a:b:c:d::1 -s 3ffe:a:b:c:d::2 -T ah -S 0x9abc -p udp
 # pfkey -A sp -d 3ffe:a:b:c:d::1 -s 3ffe:a:b:c:d::2 -T esp -S 0xdef0 -p udp

 

 Now on Host B do the same as above:
 (SET Host A -> Host B flow at Host B)
 (SET Host B -> Host A flow at Host B)

 

 You can also use the following options with the pfkey command:

 

 - "pfkey -L" to display current SA/SP status.
 - "pfkey -F any" to flush all the SAs and SPs.
 - "pfkey -D ..." to delete an SA or SP entry.
 - "pfkey --help" to display more help information.

 

 

8)  Using IKEd with manual configuration

 

8.1). See manual for pluto and ipsec.secrets, which is located in /usr/local/v6/man/{man5,man8}
 % man ipsec_pluto
 % man ipsec.secrets

 

 Start sequence:
 
8.2). Define a preshared key of both hosts in /usr/local/v6/etc/ipsec.secrets (default).
 
  3ffe:a:b:c:d::1 3ffe:a:b:c:d::2 : PSK "yfhuang"

(共享密钥可以使用简单的密钥或者rsa密钥)

 

8.3). Run pluto with any option

 

the two commands to use IKE are, "pluto" and "whack".
pluto is a daemon that runs the IKE protocol.
whack is a command used to communicate with a running pluto.

 

whack用来跟pluto交互，告知pluto一些机器的接口设置和共享密钥等。

 # pluto
 for debugging, run with "--nofork --stderrlog --debug-all" options.
 # pluto --nofork --stderrlog --debug-all

 

8.4). Check pluto is running or not with ps command or ls /var/run.
 # ls /var/run
 If there is a pluto.pid file, pluto is running.

 

8.5). Configure IKE with whack command. The parameter after --name is the
 name of a configuration. This parameter is used for initiation,
 termination, and delete. The configuration name "testv6" is used in the
 following examples.

    -- If you want to use authentication,
 # whack --name testv6 --ipv6 --host 3ffe:a:b:c:d::1 --to --host 3ffe:a:b:c:d::2 --authnticate
     -- If you want to use encryption,
 # whack --name testv6 --ipv6 --host 3ffe:a:b:c:d::1 --to --host 3ffe:a:b:c:d::2 --encrypt
     -- If you use both authentication and encryption,
 # whack --name testv6 --ipv6 --host 3ffe:a:b:c:d::1 --to --host 3ffe:a:b:c:d::2 --authnticate --encrypt

 

 You can use other options. Please see man pages for pluto.

 

 8.6). Make pluto listen
 # whack --listen
 Then pluto checks the interface and reads authentication keys from the file.

 

 8.7). Initiate key exchange with configuration name

 # whack --initiate --name testv6   :让IKE发起自动密钥协商
 Pluto will start key exchanges.
 You can see the IPsec information with
 % pfkey -L (or 'ipsec-conf show' is more friendly.)

 

 Shutdown sequence from here.

 

 8.8). Terminate IPsec between the hosts.
 # whack --terminate --name testv6

 

 8.9). Delete configuration
 # whack --delete --name testv6

 

 8.10). Shutdown pluto
 # whack --shutdown