Estou tentando fazer com que um laptop Ubuntu se conecte ao nosso servidor VPN L2TP, tentei usar o 18.04 e o 19.04, seguindo alguns tutoriais que basicamente consistiam na instalação network-manager-l2tpe no network-manager-l2tp-gnome. Cheguei a este ponto:
May 17 12:34:14 lap-linux-001 NetworkManager[583]: <info> [1558110854.8704] audit: op="connection-activate" uuid="2dba1ee5-c86e-46e9-b0e4-5ce89738d380" name="ADS" pid=1509 uid=1000 result="success"
May 17 12:34:14 lap-linux-001 NetworkManager[583]: <info> [1558110854.8758] vpn-connection[0x5603ef4be7a0,2dba1ee5-c86e-46e9-b0e4-5ce89738d380,"ADS",0]: Started the VPN service, PID 8635
May 17 12:34:14 lap-linux-001 NetworkManager[583]: <info> [1558110854.8878] vpn-connection[0x5603ef4be7a0,2dba1ee5-c86e-46e9-b0e4-5ce89738d380,"ADS",0]: Saw the service appear; activating connection
May 17 12:34:18 lap-linux-001 systemd[1]: NetworkManager-dispatcher.service: Succeeded.
May 17 12:34:19 lap-linux-001 NetworkManager[583]: <info> [1558110859.3039] settings-connection[0x5603ef3ae480,2dba1ee5-c86e-46e9-b0e4-5ce89738d380]: write: successfully updated (keyfile: update /etc/NetworkManager/system-connections/ADS.nmconnection (2dba1ee5-c86e-46e9-b0e4-5ce89738d380,"ADS")), connection was modified in the process
May 17 12:34:19 lap-linux-001 NetworkManager[583]: <info> [1558110859.3085] vpn-connection[0x5603ef4be7a0,2dba1ee5-c86e-46e9-b0e4-5ce89738d380,"ADS",0]: VPN connection: (ConnectInteractive) reply received
May 17 12:34:19 lap-linux-001 nm-l2tp-service[8635]: Check port 1701
May 17 12:34:19 lap-linux-001 nm-l2tp-service[8635]: Can't bind to port 1701
May 17 12:34:19 lap-linux-001 NetworkManager[583]: Stopping strongSwan IPsec failed: starter is not running
May 17 12:34:21 lap-linux-001 NetworkManager[583]: Starting strongSwan 5.7.1 IPsec [starter]...
May 17 12:34:21 lap-linux-001 NetworkManager[583]: Loading config setup
May 17 12:34:21 lap-linux-001 NetworkManager[583]: Loading conn '2dba1ee5-c86e-46e9-b0e4-5ce89738d380'
May 17 12:34:21 lap-linux-001 NetworkManager[583]: found netkey IPsec stack
May 17 12:34:21 lap-linux-001 charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.7.1, Linux 5.0.0-13-generic, x86_64)
May 17 12:34:21 lap-linux-001 charon: 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'
May 17 12:34:21 lap-linux-001 charon: 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'
May 17 12:34:21 lap-linux-001 charon: 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'
May 17 12:34:21 lap-linux-001 charon: 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'
May 17 12:34:21 lap-linux-001 charon: 00[CFG] loading crls from '/etc/ipsec.d/crls'
May 17 12:34:21 lap-linux-001 charon: 00[CFG] loading secrets from '/etc/ipsec.secrets'
May 17 12:34:21 lap-linux-001 charon: 00[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-2dba1ee5-c86e-46e9-b0e4-5ce89738d380.secrets'
May 17 12:34:21 lap-linux-001 charon: 00[CFG] loaded IKE secret for %any
May 17 12:34:21 lap-linux-001 charon: 00[LIB] loaded plugins: charon aesni aes rc2 sha2 sha1 md4 md5 mgf1 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default connmark stroke updown eap-mschapv2 xauth-generic counters
May 17 12:34:21 lap-linux-001 charon: 00[LIB] dropped capabilities, running as uid 0, gid 0
May 17 12:34:21 lap-linux-001 charon: 00[JOB] spawning 16 worker threads
May 17 12:34:21 lap-linux-001 charon: 06[CFG] received stroke: add connection '2dba1ee5-c86e-46e9-b0e4-5ce89738d380'
May 17 12:34:21 lap-linux-001 charon: 06[CFG] algorithm 'ecp_384' not recognized
May 17 12:34:21 lap-linux-001 charon: 06[CFG] skipped invalid proposal string: aes256-sha1-ecp_384
May 17 12:34:22 lap-linux-001 charon: 08[CFG] rereading secrets
May 17 12:34:22 lap-linux-001 charon: 08[CFG] loading secrets from '/etc/ipsec.secrets'
May 17 12:34:22 lap-linux-001 charon: 08[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-2dba1ee5-c86e-46e9-b0e4-5ce89738d380.secrets'
May 17 12:34:22 lap-linux-001 charon: 08[CFG] loaded IKE secret for %any
May 17 12:34:22 lap-linux-001 charon: 09[CFG] received stroke: initiate '2dba1ee5-c86e-46e9-b0e4-5ce89738d380'
May 17 12:34:22 lap-linux-001 charon: 09[CFG] no config named '2dba1ee5-c86e-46e9-b0e4-5ce89738d380'
May 17 12:34:22 lap-linux-001 NetworkManager[583]: no config named '2dba1ee5-c86e-46e9-b0e4-5ce89738d380'
May 17 12:34:22 lap-linux-001 NetworkManager[583]: Stopping strongSwan IPsec...
May 17 12:34:22 lap-linux-001 charon: 00[DMN] signal of type SIGINT received. Shutting down
May 17 12:34:22 lap-linux-001 nm-l2tp-service[8635]: g_dbus_method_invocation_take_error: assertion 'error != NULL' failed
May 17 12:34:22 lap-linux-001 NetworkManager[583]: <info> [1558110862.8278] vpn-connection[0x5603ef4be7a0,2dba1ee5-c86e-46e9-b0e4-5ce89738d380,"ADS",0]: VPN plugin: state changed: stopped (6)
May 17 12:34:22 lap-linux-001 NetworkManager[583]: <info> [1558110862.8313] vpn-connection[0x5603ef4be7a0,2dba1ee5-c86e-46e9-b0e4-5ce89738d380,"ADS",0]: VPN service disappeared
May 17 12:34:22 lap-linux-001 NetworkManager[583]: <warn> [1558110862.8326] vpn-connection[0x5603ef4be7a0,2dba1ee5-c86e-46e9-b0e4-5ce89738d380,"ADS",0]: VPN connection: failed to connect: 'Message recipient disconnected from message bus without replying'
Também consegui fazer a conexão funcionar no Fedora, então tenho certeza de que estou usando as opções de configuração corretas, mas nem vejo uma opção para desabilitar o PFS no lado do Ubuntu.
Pelo que estou lendo parece que está procurando uma configuração que não existe? Mas não tenho certeza de onde ele quer que eu coloque/crie/adicione. Talvez ipsec.conf? Mas a string não se parece com nenhum outro exemplo que já vi.
Não tenho muita experiência com Linux, mas é a primeira vez que me intrometo na VPN. Obrigado por ler isso, qualquer ajuda será apreciada.
Responder1
Posso fornecer as etapas necessárias para que minha VPN ipsec funcione (em 18.04).
sudo apt install strongswan
Em seguida, instale libcharon-extra-plugins e libstrongswan-extra-plugins. Eu fiz isso com o gerenciador de pacotes sinápticos. Eu precisava disso para o módulo eap-identity. Crie o /etc/ipsec.conf correto, com base nas configurações de VPN. Crie ou modifique ipsec.secrets
Algumas etapas extras que eu precisava, mas isso pode depender da VPN:
em /etc/strongswan.d/charon/constraints.conf, altere 'load = yes' para 'load = no'
alterar certificados
sudo rmdir /etc/ipsec.d/cacerts (maybe make a backup first) sudo ln -s /etc/ssl/certs /etc/ipsec.d/cacertsPessoalmente, preciso da próxima operação de DNS durante VPN
sudo apt install resolvconf sudo dpkg-reconfigure resolvconf reboot
Finalmente :
sudo ipsec restart
sudo ipsec up <vpn-name>
Espero que isso ajude você um pouco mais.