He estado intentando conseguir que una computadora portátil Ubuntu se conecte a nuestro servidor VPN L2TP, intenté usar 18.04 y 19.04, siguiendo un par de tutoriales que básicamente consistían en instalar network-manager-l2tpy network-manager-l2tp-gnome. He llegado a este punto:
May 17 12:34:14 lap-linux-001 NetworkManager[583]: <info> [1558110854.8704] audit: op="connection-activate" uuid="2dba1ee5-c86e-46e9-b0e4-5ce89738d380" name="ADS" pid=1509 uid=1000 result="success"
May 17 12:34:14 lap-linux-001 NetworkManager[583]: <info> [1558110854.8758] vpn-connection[0x5603ef4be7a0,2dba1ee5-c86e-46e9-b0e4-5ce89738d380,"ADS",0]: Started the VPN service, PID 8635
May 17 12:34:14 lap-linux-001 NetworkManager[583]: <info> [1558110854.8878] vpn-connection[0x5603ef4be7a0,2dba1ee5-c86e-46e9-b0e4-5ce89738d380,"ADS",0]: Saw the service appear; activating connection
May 17 12:34:18 lap-linux-001 systemd[1]: NetworkManager-dispatcher.service: Succeeded.
May 17 12:34:19 lap-linux-001 NetworkManager[583]: <info> [1558110859.3039] settings-connection[0x5603ef3ae480,2dba1ee5-c86e-46e9-b0e4-5ce89738d380]: write: successfully updated (keyfile: update /etc/NetworkManager/system-connections/ADS.nmconnection (2dba1ee5-c86e-46e9-b0e4-5ce89738d380,"ADS")), connection was modified in the process
May 17 12:34:19 lap-linux-001 NetworkManager[583]: <info> [1558110859.3085] vpn-connection[0x5603ef4be7a0,2dba1ee5-c86e-46e9-b0e4-5ce89738d380,"ADS",0]: VPN connection: (ConnectInteractive) reply received
May 17 12:34:19 lap-linux-001 nm-l2tp-service[8635]: Check port 1701
May 17 12:34:19 lap-linux-001 nm-l2tp-service[8635]: Can't bind to port 1701
May 17 12:34:19 lap-linux-001 NetworkManager[583]: Stopping strongSwan IPsec failed: starter is not running
May 17 12:34:21 lap-linux-001 NetworkManager[583]: Starting strongSwan 5.7.1 IPsec [starter]...
May 17 12:34:21 lap-linux-001 NetworkManager[583]: Loading config setup
May 17 12:34:21 lap-linux-001 NetworkManager[583]: Loading conn '2dba1ee5-c86e-46e9-b0e4-5ce89738d380'
May 17 12:34:21 lap-linux-001 NetworkManager[583]: found netkey IPsec stack
May 17 12:34:21 lap-linux-001 charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.7.1, Linux 5.0.0-13-generic, x86_64)
May 17 12:34:21 lap-linux-001 charon: 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'
May 17 12:34:21 lap-linux-001 charon: 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'
May 17 12:34:21 lap-linux-001 charon: 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'
May 17 12:34:21 lap-linux-001 charon: 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'
May 17 12:34:21 lap-linux-001 charon: 00[CFG] loading crls from '/etc/ipsec.d/crls'
May 17 12:34:21 lap-linux-001 charon: 00[CFG] loading secrets from '/etc/ipsec.secrets'
May 17 12:34:21 lap-linux-001 charon: 00[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-2dba1ee5-c86e-46e9-b0e4-5ce89738d380.secrets'
May 17 12:34:21 lap-linux-001 charon: 00[CFG] loaded IKE secret for %any
May 17 12:34:21 lap-linux-001 charon: 00[LIB] loaded plugins: charon aesni aes rc2 sha2 sha1 md4 md5 mgf1 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default connmark stroke updown eap-mschapv2 xauth-generic counters
May 17 12:34:21 lap-linux-001 charon: 00[LIB] dropped capabilities, running as uid 0, gid 0
May 17 12:34:21 lap-linux-001 charon: 00[JOB] spawning 16 worker threads
May 17 12:34:21 lap-linux-001 charon: 06[CFG] received stroke: add connection '2dba1ee5-c86e-46e9-b0e4-5ce89738d380'
May 17 12:34:21 lap-linux-001 charon: 06[CFG] algorithm 'ecp_384' not recognized
May 17 12:34:21 lap-linux-001 charon: 06[CFG] skipped invalid proposal string: aes256-sha1-ecp_384
May 17 12:34:22 lap-linux-001 charon: 08[CFG] rereading secrets
May 17 12:34:22 lap-linux-001 charon: 08[CFG] loading secrets from '/etc/ipsec.secrets'
May 17 12:34:22 lap-linux-001 charon: 08[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-2dba1ee5-c86e-46e9-b0e4-5ce89738d380.secrets'
May 17 12:34:22 lap-linux-001 charon: 08[CFG] loaded IKE secret for %any
May 17 12:34:22 lap-linux-001 charon: 09[CFG] received stroke: initiate '2dba1ee5-c86e-46e9-b0e4-5ce89738d380'
May 17 12:34:22 lap-linux-001 charon: 09[CFG] no config named '2dba1ee5-c86e-46e9-b0e4-5ce89738d380'
May 17 12:34:22 lap-linux-001 NetworkManager[583]: no config named '2dba1ee5-c86e-46e9-b0e4-5ce89738d380'
May 17 12:34:22 lap-linux-001 NetworkManager[583]: Stopping strongSwan IPsec...
May 17 12:34:22 lap-linux-001 charon: 00[DMN] signal of type SIGINT received. Shutting down
May 17 12:34:22 lap-linux-001 nm-l2tp-service[8635]: g_dbus_method_invocation_take_error: assertion 'error != NULL' failed
May 17 12:34:22 lap-linux-001 NetworkManager[583]: <info> [1558110862.8278] vpn-connection[0x5603ef4be7a0,2dba1ee5-c86e-46e9-b0e4-5ce89738d380,"ADS",0]: VPN plugin: state changed: stopped (6)
May 17 12:34:22 lap-linux-001 NetworkManager[583]: <info> [1558110862.8313] vpn-connection[0x5603ef4be7a0,2dba1ee5-c86e-46e9-b0e4-5ce89738d380,"ADS",0]: VPN service disappeared
May 17 12:34:22 lap-linux-001 NetworkManager[583]: <warn> [1558110862.8326] vpn-connection[0x5603ef4be7a0,2dba1ee5-c86e-46e9-b0e4-5ce89738d380,"ADS",0]: VPN connection: failed to connect: 'Message recipient disconnected from message bus without replying'
También pude hacer que la conexión funcione en Fedora, por lo que estoy bastante seguro de que estoy usando las opciones de configuración correctas, pero ni siquiera veo una opción para deshabilitar PFS en el lado de Ubuntu.
Por lo que estoy leyendo, ¿parece que está buscando una configuración que no existe? Pero no estoy seguro de dónde quiere que lo coloque/cree/agregue. ¿Quizás ipsec.conf? Pero la cadena no se parece a ningún otro ejemplo que haya visto.
No tengo mucha experiencia con Linux, pero esta es la primera vez que me entrometo con la VPN. Gracias por leer esto, cualquier ayuda será apreciada.
Respuesta1
Puedo darte los pasos que necesitaba para que mi VPN ipsec funcione (en 18.04).
sudo apt install strongswan
Luego instale libcharon-extra-plugins y libstrongswan-extra-plugins. Hice esto con el administrador de paquetes synaptic. Los necesitaba para el módulo eap-identity. Cree /etc/ipsec.conf correcto, según la configuración de VPN. Crear o modificar ipsec.secrets
Necesitaba algunos pasos adicionales, pero esto puede depender de VPN:
en /etc/strongswan.d/charon/constraints.conf, cambie 'cargar = sí' por 'cargar = no'
cambiar certificados
sudo rmdir /etc/ipsec.d/cacerts (maybe make a backup first) sudo ln -s /etc/ssl/certs /etc/ipsec.d/cacertsPersonalmente, necesito el siguiente para la operación DNS durante VPN
sudo apt install resolvconf sudo dpkg-reconfigure resolvconf reboot
Finalmente :
sudo ipsec restart
sudo ipsec up <vpn-name>
Espero que esto te ayude un poco más.