Unix Commands - Home

setkey Command in Linux

Quiz

The setkey command in Linux is part of the ipsec-tools suite and is used for configuring the IPsec Security Policy Database (SPD) and the Security Association Database (SAD). IPsec, or Internet Protocol Security, is a protocol suite for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet in a communication session.

Here is a comprehensive guide to the options available with the setkey command â

Understanding setkey Command
How to Use setkey Command in Linux?
Syntax for the Command setkey Command
setkey Command Options
Examples of setkey Command in Linux

Understanding setkey Command

The setkey command is used to define, modify, and delete security policies and security associations in the kernel's IPsec subsystem. It reads configuration data from standard input or from a file specified on the command line. The command is generally invoked with a file that contains IPsec policy definitions written in a specific format.

How to Use setkey Command in Linux

The setkey command in Linux is a utility used for configuring and managing the IPsec Security Associations (SAs) and Security Policies (SPs) in the kernel's key management system. It is commonly used in conjunction with the IPsec Tools package and is essential for setting up encrypted communication channels.

The command allows administrators to manually add, delete, or modify security policies and keys required for encrypted network traffic. By using a configuration file or issuing commands interactively, users can specify encryption algorithms, authentication keys, and other parameters necessary for securing IP communications.

Syntax for the setkey Command

The basic syntax of the setkey command is as follows:

setkey [options] [file]

setkey Command Options

-f − Specifies the file from which to read the IPsec policies.
-c − Clears all existing security policies and associations before processing the file.
-D − Dumps the current security policies.
-P − Dumps the current security associations.

Security Policies

Security policies (SP) define the rules for handling packets. Each policy specifies the source and destination addresses, the protocol, and the action to be taken (e.g., permit, deny, apply IPsec).

Example of a Security Policy Definition

spdadd 192.168.1.0/24 192.168.2.0/24 any -P out ipsec
        esp/transport//require;

This example adds a security policy that applies to packets going from the 192.168.1.0/24 network to the 192.168.2.0/24 network. The policy specifies that IPsec ESP (Encapsulating Security Payload) in transport mode is required for these packets.

Security Associations

Security associations (SA) define the cryptographic keys and algorithms used for IPsec. Each SA specifies the source and destination addresses, the protocol (e.g., ESP, AH), and the keys and algorithms to be used.

Example of a Security Association Definition

This example adds a security association for ESP (Encapsulating Security Payload) between the hosts 192.168.1.1 and 192.168.2.1. The SA specifies the use of the AES-CBC (Cipher Block Chaining) encryption algorithm with a specific key.

add 192.168.1.1 192.168.2.1 esp 0x1000 -E aes-cbc 
   0x000102030405060708090a0b0c0d0e0f;

Using setkey Command

To use the setkey command, you typically create a configuration file that contains the security policies and associations, and then invoke setkey with this file.

Example Configuration File

The command is often used in combination with racoon, a key management daemon that automates the negotiation of SAs.

# Security policies
spdadd 192.168.1.0/24 192.168.2.0/24 any -P out ipsec
        esp/transport//require;
spdadd 192.168.2.0/24 192.168.1.0/24 any -P in ipsec
        esp/transport//require;

# Security associations
add 192.168.1.1 192.168.2.1 esp 0x1000 -E aes-cbc 
   0x000102030405060708090a0b0c0d0e0f;
add 192.168.2.1 192.168.1.1 esp 0x2000 -E aes-cbc 
   0x0f0e0d0c0b0a09080706050403020100;

Invoking setkey with the Configuration File

setkey -f /path/to/configuration/file

Monitoring and Troubleshooting

You can monitor the current security policies and associations using the -D and -P options of setkey.

Dumping Security Policies

setkey -D

Dumping Security Associations

Since it directly modifies kernel settings, setkey requires superuser privileges and is an essential tool for system administrators implementing manual IPsec configurations.

setkey -P

One of the primary use cases of setkey is for managing Security Policies (SPs) that define how traffic should be treated (e.g., whether it should be encrypted or passed through). Additionally, it helps in configuring Security Associations (SAs), which store cryptographic keys and algorithms for protecting data exchanges between peers.

Examples of setkey command in Linux

Here are some more detailed examples of setkey usage.

Example 1: Configuring IPsec for a VPN

In this example, we are configuring IPsec for a VPN between the 10.0.0.0/24 network and the 192.168.10.0/24 network. The policies specify that ESP in transport mode is required for both outbound and inbound traffic. The SAs define the encryption keys and algorithms for ESP.

# Security policies for outbound traffic
spdadd 10.0.0.0/24 192.168.10.0/24 any -P out ipsec
        esp/transport//require;

# Security policies for inbound traffic
spdadd 192.168.10.0/24 10.0.0.0/24 any -P in ipsec
        esp/transport//require;

# Security associations for ESP
add 10.0.0.1 192.168.10.1 esp 0x3000 -E aes-cbc 
   0x00112233445566778899aabbccddeeff;
add 192.168.10.1 10.0.0.1 esp 0x4000 -E aes-cbc 
   0xffeeddccbbaa99887766554433221100;

Example 2: Configuring IPsec for a Web Server

In this example, we are configuring IPsec for a web server located in the 203.0.113.0/24 network. The policies specify that ESP in transport mode is required for TCP traffic on port 80 (HTTP) in both directions. The SAs define the encryption keys and algorithms for ESP.

# Security policies for outbound traffic to web server
spdadd 192.168.1.0/24 203.0.113.0/24 tcp 80 -P out ipsec
        esp/transport//require;

# Security policies for inbound traffic from web server
spdadd 203.0.113.0/24 192.168.1.0/24 tcp 80 -P in ipsec
        esp/transport//require;

# Security associations for ESP
add 192.168.1.1 203.0.113.1 esp 0x5000 -E aes-cbc 
   0x1234567890abcdef1234567890abcdef;
add 203.0.113.1 192.168.1.1 esp 0x6000 -E aes-cbc 
   0xfedcba0987654321fedcba0987654321;

Example 3: Configuring IPsec for a Database Server

In this example, we are configuring IPsec for a database server located in the 192.168.2.0/24 network. The policies specify that ESP in transport mode is required for TCP traffic on port 3306 (MySQL) in both directions. The SAs define the encryption keys and algorithms for ESP.

# Security policies for outbound traffic to database server
spdadd 192.168.1.0/24 192.168.2.0/24 tcp 3306 -P out ipsec
        esp/transport//require;

# Security policies for inbound traffic from database server
spdadd 192.168.2.0/24 192.168.1.0/24 tcp 3306 -P in ipsec
        esp/transport//require;

# Security associations for ESP
add 192.168.1.1 192.168.2.1 esp 0x7000 -E aes-cbc 
   0x0a0b0c0d0e0f10111213141516171819;
add 192.168.2.1 192.168.1.1 esp 0x8000 -E aes-cbc 
   0x191817161514131211100f0e0d0c0b0a;

Conclusion

The setkey command is a powerful tool for configuring IPsec security policies and associations in Linux. By defining security policies, you can specify which traffic requires IPsec protection. By defining security associations, you can specify the cryptographic keys and algorithms to be used for IPsec.

Print Page