1 .TH @IPSEC_SCRIPT_UPPER@ 8 "2013-10-29" "@IPSEC_VERSION@" "strongSwan"
5 @IPSEC_SCRIPT@ \- invoke IPsec utilities
19 utility invokes any of several utilities involved in controlling and monitoring
20 the IPsec encryption/authentication system, running the specified \fIcommand\fP
21 with the specified \fIarguments\fP and \fIoptions\fP as if it had been invoked
22 directly. This largely eliminates possible name collisions with other software,
23 and also permits some centralized services.
25 All the commands described in this manual page are built-in and are used to
26 control and monitor IPsec connections as well as the IKE daemon.
32 with a suitable PATH environment variable,
33 and also provides the environment variables listed under
39 .BI "start [" "starter options" ]
42 which in turn parses \fIipsec.conf\fR and starts the IKE daemon \fIcharon\fR.
46 sends a \fIHUP\fR signal to
48 which in turn determines any changes in \fIipsec.conf\fR
49 and updates the configuration on the running IKE daemon \fIcharon\fR.
53 sends a \fIUSR1\fR signal to
55 which in turn reloads the whole configuration of the running IKE daemon
56 \fIcharon\fR based on the actual \fIipsec.conf\fR.
64 after a guard of 2 seconds.
68 terminates all IPsec connections and stops the IKE daemon \fIcharon\fR
69 by sending a \fITERM\fR signal to
74 tells the IKE daemon to start up connection \fIname\fP.
78 tells the IKE daemon to terminate connection \fIname\fP.
82 terminates IKEv1 Quick Mode and IKEv2 CHILD SA instance \fIn\fP of
83 connection \fIname\fP.
87 terminates all IKEv1 Quick Mode and IKEv2 CHILD SA instances of connection
92 terminates IKE SA instance \fIn\fP of connection \fIname\fP.
96 terminates all IKE SA instances of connection \fIname\fP.
99 .BI "down-srcip <" start "> [<" end ">]"
100 terminates all IKE SA instances with clients having virtual IPs in the range
105 tells the IKE daemon to insert an IPsec policy in the kernel
106 for connection \fIname\fP. The first payload packet matching the IPsec policy
107 will automatically trigger an IKE connection setup.
111 remove the IPsec policy in the kernel for connection \fIname\fP.
114 .BI "status [" name ]
115 returns concise status information either on connection
116 \fIname\fP or if the argument is lacking, on all connections.
119 .BI "statusall [" name ]
120 returns detailed status information either on connection
121 \fIname\fP or if the argument is lacking, on all connections.
126 .BI "leases [<" poolname "> [<" address ">]]"
127 returns the status of all or the selected IP address pool (or even a single
132 returns a list supported cryptographic algorithms usable for IKE, and their
133 corresponding plugin.
136 .BI "listpubkeys [" --utc ]
137 returns a list of RSA public keys that were either loaded in raw key format
138 or extracted from X.509 and|or OpenPGP certificates.
141 .BI "listcerts [" --utc ]
142 returns a list of X.509 and|or OpenPGP certificates that were either loaded
143 locally by the IKE daemon or received via the IKE protocol.
146 .BI "listcacerts [" --utc ]
147 returns a list of X.509 Certification Authority (CA) certificates that were
148 loaded locally by the IKE daemon from the \fI/etc/ipsec.d/cacerts/\fP
149 directory or received via the IKE protocol.
152 .BI "listaacerts [" --utc ]
153 returns a list of X.509 Authorization Authority (AA) certificates that were
154 loaded locally by the IKE daemon from the \fI/etc/ipsec.d/aacerts/\fP
158 .BI "listocspcerts [" --utc ]
159 returns a list of X.509 OCSP Signer certificates that were either loaded
160 locally by the IKE daemon from the \fI/etc/ipsec.d/ocspcerts/\fP
161 directory or were sent by an OCSP server.
164 .BI "listacerts [" --utc ]
165 returns a list of X.509 Attribute certificates that were loaded locally by
166 the IKE daemon from the \fI/etc/ipsec.d/acerts/\fP directory.
169 .BI "listgroups [" --utc ]
170 returns a list of groups that are used to define user authorization profiles.
173 .BI "listcainfos [" --utc ]
174 returns certification authority information (CRL distribution points, OCSP URIs,
175 LDAP servers) that were defined by
177 sections in \fIipsec.conf\fP.
180 .BI "listcrls [" --utc ]
181 returns a list of Certificate Revocation Lists (CRLs) that were either loaded
182 by the IKE daemon from the \fI/etc/ipsec.d/crls\fP directory or fetched from
183 an HTTP- or LDAP-based CRL distribution point.
186 .BI "listocsp [" --utc ]
187 returns revocation information fetched from OCSP servers.
191 returns a list of all loaded plugin features.
194 .BI "listcounters [" name ]
195 returns a list of global or connection specific IKE counter values
196 collected since daemon startup.
199 .BI "listall [" --utc ]
200 returns all information generated by the list commands above. Each list command
201 can be called with the
203 option which displays all dates in UTC instead of local time.
209 flushes and rereads all secrets defined in \fIipsec.secrets\fP.
213 removes previously loaded CA certificates, reads all certificate files
214 contained in the \fI/etc/ipsec.d/cacerts\fP directory and adds them to the list
215 of Certification Authority (CA) certificates. This does not affect certificates
216 explicitly defined in a
218 ca section, which may be separately updated using the \fBupdate\fP command.
222 removes previously loaded AA certificates, reads all certificate files
223 contained in the \fI/etc/ipsec.d/aacerts\fP directory and adds them to the list
224 of Authorization Authority (AA) certificates.
228 reads all certificate files contained in the \fI/etc/ipsec.d/ocspcerts/\fP
229 directory and adds them to the list of OCSP signer certificates.
233 reads all certificate files contained in the \fI/etc/ipsec.d/acerts/\fP
234 directory and adds them to the list of attribute certificates.
238 reads all Certificate Revocation Lists (CRLs) contained in the
239 \fI/etc/ipsec.d/crls/\fP directory and adds them to the list of CRLs.
243 executes all reread commands listed above.
248 .BI "resetcounters [" name ]
249 resets global or connection specific counters.
255 purges all cached certificates.
259 purges all cached CRLs.
263 purges IKE SAs that don't have a Quick Mode or CHILD SA.
267 purges all cached OCSP information records.
273 returns the usage information for the
279 returns the version in the form of
280 .B Linux strongSwan U<strongSwan userland version>/K<Linux kernel version>
281 if strongSwan uses the native NETKEY IPsec stack of the Linux kernel it is
286 returns the version number in the form of
287 .B U<strongSwan userland version>/K<Linux kernel version>
288 if strongSwan uses the native NETKEY IPsec stack of the Linux kernel it is
293 returns the copyright information.
297 returns the \fILIBEXECDIR\fP directory as defined by the configure options.
301 returns the \fISYSCONFDIR\fP directory as defined by the configure options.
305 returns the \fIPIDDIR\fP directory as defined by the configure options.
309 @IPSEC_DIR@ utilities directory
313 When calling other commands the
315 command supplies the following environment variables.
319 IPSEC_DIR directory containing ipsec programs and utilities
320 IPSEC_BINDIR directory containing \fBpki\fP command
321 IPSEC_SBINDIR directory containing \fBipsec\fP command
322 IPSEC_CONFDIR directory containing configuration files
323 IPSEC_PIDDIR directory containing PID/socket files
324 IPSEC_SCRIPT name of the ipsec script
325 IPSEC_NAME name of ipsec distribution
326 IPSEC_VERSION version numer of ipsec userland and kernel
327 IPSEC_STARTER_PID PID file for ipsec starter
328 IPSEC_CHARON_PID PID file for IKE keying daemon
335 .BR ipsec.secrets (5)
338 Originally written for the FreeS/WAN project by Henry Spencer.
339 Updated and extended for the strongSwan project <http://www.strongswan.org> by
340 Tobias Brunner and Andreas Steffen.