|
|
IPSec using racoon w/ kerberos authentication
|
|
ipsec_migrate(1M) ipsec_migrate(1M) NAME
ipsec_migrate - HP-UX IPSec configuration file migration tool SYNOPSIS
DESCRIPTION
is a utility for migrating HP-UX IPSec configuration files to the current version. The utility stores backup copies of the following files in the directory before converting them: If the certificate data files and exist on the system, prompts for the HP-UX IPSec password and uses the password to decrypt the certifi- cate data files. The utility then converts and stores the certificate data in new files under the directory. requires the optional HP-UX IPSec software. Migrating HP-UX IPSec version A.02.01 to version A.03.00 The utility performs the following tasks when migrating configuration data from HP-UX IPSec version A.02.01 to version A.03.00: o Converts policies to policy objects. The utility ignores the IKE authentication value in policies. IKEv1 policies do not include a value for the IKE authentica- tion method. The IKE authentication method is specified in authentication records using the and arguments. The converts the value to a value for perfect forward secrecy IKEv1 policies do not include a value for maximum quick modes. If the value is 1, creates an policy with If the value is greater than 1, creates an IKEv1 policy with Note: Do not enable IKEv1 PFS with a system using an HP-UX IPSec release prior to A.03.00. The converts values in the hash field to IKE DES encryption is obsolete. o Adds a priority value to authentication records. The utility sorts existing authentication records using the address prefix length (longest to shortest). The migration utility sets the priority for the first record to the value of the priority parameter value in the AuthPolicy-Defaults section of the HP-UX IPSec profile file; the default priority value is 10. The utility increments the priority value for each subsequent record by the priority value. o Replaces DES transforms and nested transforms in host and tunnel policies with the default actions in the file. For host poli- cies, the default action is For tunnel policies, the default action is the transform. o If the and files exist, the extracts and converts the private key, local certificate, and CA certificate from these files and stores them in new files under the directory. o If the file exists, creates a softlink to the file. The file is a script that retrieves the CRL from an LDAP directory and can be executed from a cron job. RETURN VALUE
Upon successful completion, returns 0; otherwise it returns 1. ERRORS
fails if any of the following conditions is encountered: o Command used incorrectly - Usage message is returned. o The user is not the superuser. o The file specified in the option does not exist. o The file specified in the option is not a regular file. o The file specified in the option is not readable. o The file specified in the option is not an valid configuration file. o The file specified in the option exists. o The file is missing or corrupted. o Based on the information in cannot build a valid set of transformations to transform the file specified in the option to the file specified in the option. WARNINGS
requires the optional HP-UX IPSec software. AUTHOR
was developed by HP. FILES
SEE ALSO ipsec_config(1M), ipsec_config_add(1M), ipsec_config_batch(1M), ipsec_config_delete(1M), ipsec_config_export(1M), ipsec_con- fig_show(1M), ipsec_policy(1M), ipsec_report(1M). HP-UX IPSec Software Required ipsec_migrate(1M)
