Project

General

Profile

Actions

Feature #2904

closed

Add checkbox or default option for "verify_identifier on;" on IPsec RSA VPNs

Added by Jorge Albarenque about 11 years ago. Updated about 10 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
-
Category:
IPsec
Target version:
Start date:
03/24/2013
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:

Description

The ASN1DN field on the "peers_identifier" option within racoon.conf can be used to specify which certificate or set of certificates should be allowed to connect. Anyway, for this to take effect, there's an additional option required on the racoon.conf file:

verify_identifier on;

The default value for this is off. I guess this can be set to always on without harm, and increased security. If the ASN1DN values are left blank, they will be taken and verified from the certificates themselves. If you specify an ASN1DN manually, it will be used for verification.

In case I am missing something else that might break by adding this as a default option, a checkbox to enable it will be great.

Check my post about the topic and the racoon.conf man page for more info.

Thanks!

Actions

Also available in: Atom PDF