alexander-naumov / openiked-opensuse

RPM package of OpenIKED for openSUSE and SUSE Linux Enterprise

OpenIKED for openSUSE

OpenIKED is a FREE implementation of the Internet Key Exchange (IKEv2) protocol which performs mutual authentication and which establishes and maintains IPsec VPN security policies and associations (SAs) between peers.

OpenIKED supports only the IKEv2 protocol. It is defined in RFC 5996, which combines and updates the previous standards: ISAKMP/Oakley (RFC 2408), IKE (RFC 2409), and the Internet DOI (RFC 2407).

openSUSE

To install OpenIKED on openSUSE you will need to add the VPN repository:

$ sudo zypper addrepo https://download.opensuse.org/repositories/network:vpn/openSUSE_Tumbleweed/network:vpn.repo
$ sudo zypper refresh
$ sudo zypper install openiked

$ rpm -qi openiked
Name        : openiked
Version     : 7.3
Release     : 4.1
Architecture: x86_64
Install Date: Mi 27 Mär 2024 15:39:58 CET
Group       : Productivity/Networking/Security
Size        : 575710
License     : ISC
Signature   : RSA/SHA256, Mi 27 Mär 2024 15:36:41 CET, Key ID 62eb1a0917280ddf
Source RPM  : openiked-7.3-4.1.src.rpm
Build Date  : Mi 20 Mär 2024 16:09:22 CET
Build Host  : reproducible
Vendor      : obs://build.opensuse.org/network
URL         : https://github.com/openiked/openiked-portable
Summary     : Internet Key Exchange version 2 (IKEv2) daemon
Description :
OpenIKED is a FREE implementation of the Internet Key Exchange (IKEv2)
protocol which performs mutual authentication and which establishes and
maintains IPsec VPN security policies and associations (SAs) between peers.
Distribution: network:vpn / openSUSE_Tumbleweed

$ rpm -ql openiked
/etc/iked
/etc/iked.conf
/etc/iked/ca
/etc/iked/certs
/etc/iked/crls
/etc/iked/private
/etc/iked/pubkeys
/etc/iked/pubkeys/fqdn
/etc/iked/pubkeys/ipv4
/etc/iked/pubkeys/ipv6
/etc/iked/pubkeys/ufqdn
/etc/ssl/ikeca.cnf
/etc/ssl/ikex509v3.cnf
/usr/lib/systemd/system/openiked-keygen.service
/usr/lib/systemd/system/openiked-keygen.target
/usr/lib/systemd/system/openiked.service
/usr/libexec
/usr/libexec/openiked
/usr/libexec/openiked/openiked-keygen
/usr/sbin/ikectl
/usr/sbin/iked
/usr/share/licenses/openiked
/usr/share/licenses/openiked/LICENSE
/usr/share/man/man5/iked.conf.5.gz
/usr/share/man/man8/ikectl.8.gz
/usr/share/man/man8/iked.8.gz
/var/empty

Configuration process on openSUSE is similar with OpenBSD. The offical manual can be found here and here.

The RSA public key is generated by the openiked-keygen service:

# ls -la /etc/iked/local.pub
ls: cannot access '/etc/iked/local.pub': No such file or directory

# systemctl start openiked-keygen
○ openiked-keygen.service - OpenIKED Key Generation
     Loaded: loaded (/usr/lib/systemd/system/openiked-keygen.service; disabled; preset: disabled)
     Active: inactive (dead)

Mär 20 23:22:07 suse systemd[1]: Starting OpenIKED Key Generation...
Mär 20 23:22:07 suse openiked-keygen[1596]: read EC key
Mär 20 23:22:07 suse openiked-keygen[1596]: writing EC key
Mär 20 23:22:07 suse systemd[1]: openiked-keygen.service: Deactivated successfully.
Mär 20 23:22:07 suse systemd[1]: Finished OpenIKED Key Generation.

# ls -la /etc/iked/local.pub
-rw-r--r-- 1 root root 178 Mär 20 23:22 /etc/iked/local.pub

# cat /etc/iked/local.pub
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEmy+IwTy+W8WbrTrLqdzEh+PqQlAW
0m+Nj1gfBCgj0kfaNGJym2awfsl4MNf7pwfFtPsZ73znW9W4lZ3REm/kLg==
-----END PUBLIC KEY-----

openiked-opensuse's Issues

SLE12_SP5 has CMake v3.5.3, but v3.12 or higher is required

SLE12_SP5 has a build problem:

[   20s] CMake Error at CMakeLists.txt:15 (cmake_minimum_required):
[   20s]   CMake 3.12 or higher is required.  You are running version 3.5.2