I thought my configuration would work but I am getting MAC mismatch in the logs (not sure what MAC stands for).

I am trying to use pubkey (cert) on the server and psk (secret) on the client.

My configuration is as follows:

connections {
    default {
        version = 2
        send_cert = always
        unique = replace
        local {  #  left
            certs = vpnserver.crt
            auth = pubkey
            id = {server_dns_name} # must match CN/SAN in cert
        }
        remote {  # right
            id = %any
            auth = psk
        }
        children {
            net {
            }
        }
    }
}
secrets {
    ike-psk {
        secret = test123
        id = client
    }
}
include conf.d/*.conf

The certificate:

List of X.509 End Entity Certificates

  subject:  "CN={server_dns_name}"
  issuer:   "C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3"
  validity:  not before Oct 29 15:20:53 2019, ok
             not after  Jan 27 15:20:53 2020, ok (expires in 89 days)
  serial:    03:50:64:2f:7a:63:c2:2c:d6:a1:76:de:14:91:69:03:8d:e7
  altNames:  {server_dns_name}
  flags:     serverAuth clientAuth 
  OCSP URIs: http://ocsp.int-x3.letsencrypt.org
  certificatePolicies:
             2.23.140.1.2.1
             1.3.6.1.4.1.44947.1.1.1
             CPS: http://cps.letsencrypt.org
  authkeyId: a8:4a:6a:63:04:7d:dd:ba:e6:d1:39:b7:a6:45:65:ef:f3:a8:ec:a1
  subjkeyId: f5:73:d3:18:9c:82:ea:3f:82:32:d6:c5:30:bc:65:ff:94:0f:4a:71
  pubkey:    RSA 2048 bits, has private key
  keyid:     b3:c2:11:b7:a0:6f:dd:74:19:64:59:08:98:39:71:f4:13:ff:24:80
  subjkey:   f5:73:d3:18:9c:82:ea:3f:82:32:d6:c5:30:bc:65:ff:94:0f:4a:71

The connection:

ikev2-vpn: IKEv2, no reauthentication, no rekeying, dpd delay 300s
  local:  %any
  remote: %any
  local public key authentication:
    id: {server_dns_name}
    certs: CN={server_dns_name}
  remote pre-shared key authentication:
  ikev2-vpn: TUNNEL, no rekeying, dpd action is clear
    local:  0.0.0.0/0
    remote: dynamic

The logs:

Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal systemd[1]: Starting strongSwan IPsec IKEv1/IKEv2 daemon using swanctl...
Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: PKCS11 module '<name>' lacks library path
Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: openssl FIPS mode(2) - enabled 
Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: loading ca certificates from '/etc/strongswan/ipsec.d/cacerts'
Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: loading aa certificates from '/etc/strongswan/ipsec.d/aacerts'
Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: loading ocsp signer certificates from '/etc/strongswan/ipsec.d/ocspcerts'
Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: loading attribute certificates from '/etc/strongswan/ipsec.d/acerts'
Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: loading crls from '/etc/strongswan/ipsec.d/crls'
Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: loading secrets from '/etc/strongswan/ipsec.secrets'
Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: opening triplet file /etc/strongswan/ipsec.d/triplets.dat failed: No such file or directory
Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: loaded 0 RADIUS server configurations
Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: HA config misses local/remote address
Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: no script for ext-auth script defined, disabled
Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: loaded plugins: charon-systemd pkcs11 tpm aesni aes des rc2 sha2 sha1 md4 md5 mgf1 random nonce x509 revocation constraints acert pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl gcrypt fips-prf gmp curve25519 chapoly xcbc cmac hmac ctr ccm gcm curl attr kernel-netlink resolve socket-default farp stroke vici updown eap-identity eap-sim eap-aka eap-aka-3gpp eap-aka-3gpp2 eap-md5 eap-gtc eap-mschapv2 eap-dynamic eap-radius eap-tls eap-ttls eap-peap xauth-generic xauth-eap xauth-pam xauth-noauth dhcp led duplicheck unity counters
Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: spawning 16 worker threads
Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal swanctl[6627]: no files found matching '/etc/strongswan/swanctl/conf.d/*.conf'
Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: loaded certificate 'CN={server_dns_name}'
Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: loaded certificate 'C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3'
Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: loaded ANY private key
Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: loaded IKE shared key with id 'ike-psk' for: 'client'
Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal swanctl[6627]: no authorities found, 0 unloaded
Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal swanctl[6627]: no pools found, 0 unloaded
Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: added vici connection: default
Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal swanctl[6627]: loaded certificate from '/etc/strongswan/swanctl/x509/vpnserver.crt'
Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal swanctl[6627]: loaded certificate from '/etc/strongswan/swanctl/x509ca/letsencrypt.crt'
Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal swanctl[6627]: loaded private key from '/etc/strongswan/swanctl/private/vpnserver.key'
Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal swanctl[6627]: loaded ike secret 'ike-psk'
Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal swanctl[6627]: loaded connection 'default'
Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal swanctl[6627]: successfully loaded 1 connections, 0 unloaded
Oct 30 11:03:21 ip-172-31-32-116.eu-west-2.compute.internal systemd[1]: Started strongSwan IPsec IKEv1/IKEv2 daemon using swanctl.

Oct 30 11:04:10 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: received packet: from xx.xx.xx.xx[42452] to 172.31.32.116[500] (604 bytes)
Oct 30 11:04:10 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: parsed IKE_SA_INIT request 0 [ SA KE No N(REDIR_SUP) N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) ]
Oct 30 11:04:10 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: xx.xx.xx.xx is initiating an IKE_SA
Oct 30 11:04:10 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
Oct 30 11:04:10 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: local host is behind NAT, sending keep alives
Oct 30 11:04:10 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: remote host is behind NAT
Oct 30 11:04:10 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: sending cert request for "C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3"
Oct 30 11:04:10 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(MULT_AUTH) ]
Oct 30 11:04:10 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: sending packet: from 172.31.32.116[500] to xx.xx.xx.xx[42452] (473 bytes)
Oct 30 11:04:10 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: received packet: from xx.xx.xx.xx[46452] to 172.31.32.116[4500] (532 bytes)
Oct 30 11:04:10 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: parsed IKE_AUTH request 1 [ EF(1/2) ]
Oct 30 11:04:10 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: received fragment #1 of 2, waiting for complete IKE message
Oct 30 11:04:10 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: received packet: from xx.xx.xx.xx[46452] to 172.31.32.116[4500] (116 bytes)
Oct 30 11:04:10 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: parsed IKE_AUTH request 1 [ EF(2/2) ]
Oct 30 11:04:10 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: received fragment #2 of 2, reassembled fragmented IKE message (560 bytes)
Oct 30 11:04:10 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: unknown attribute type (25)
Oct 30 11:04:10 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH CPRQ(ADDR MASK DHCP DNS ADDR6 DHCP6 DNS6 (25)) N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) SA TSi TSr N(MOBIKE_SUP) ]
Oct 30 11:04:10 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: looking for peer configs matching 172.31.32.116[{server_dns_name}]...xx.xx.xx.xx[client]
Oct 30 11:04:10 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: selected peer config 'default'
Oct 30 11:04:10 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: tried 1 shared key for '{server_dns_name}' - 'client', but MAC mismatched
Oct 30 11:04:10 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding
Oct 30 11:04:10 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: peer supports MOBIKE
Oct 30 11:04:10 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]
Oct 30 11:04:10 ip-172-31-32-116.eu-west-2.compute.internal charon-systemd[6610]: sending packet: from 172.31.32.116[4500] to xx.xx.xx.xx[46452] (80 bytes)

Connection on the macbook

We run our infrastructure on AWS and have chosen to use their Managed Active Directory (which I’m beginning to think was a bad idea). They have blocked PowerShell remote access for a start.

Inside the VPC that the AD servers run in are VPC endpoints that have local private IPs.

Once we join a server to Active Directory, which we do by changing the DNS servers of the joining server to point to the AD servers and then issue a PowerShell AddComputer command, the VPC endpoints are no longer accessible because the DNS server on the AD servers only has a DNS Forwarder to 169.254.169.253 which points at AWS’ public DNS servers.

To resolve the issue, we have to add Remote DNS management to an AD member server, connect remotely to each AD server, remove the 169 address and add the local DNS address, for example, 10.0.0.2 - which already forwards queries to the public DNS so why AWS chose to set 169 seems like a design flaw.

As we have our entire infrastructure as code (terraform), we are having to now split, or pause, some rollout so we can manually change the forwarders. Is there a way to write some code that can magically do the change, after all, remote dns admin tools can do it ?‍♂️

——— Before you say the following, I’m aware I could add a further dns entry into each joining server to point to the local network default dns endpoint, but this creates a delay on first lookup that we are trying to avoid. We have even tried to install a dns server on each joining server and have conditional forwarders but the joining server then doesn’t register its revdns with the ad servers.

This is an odd issue which we can't find a solution for.

On AWS, we are running Microsoft Remote Desktop Services on Windows Server 2019. All servers are joined to an AWS AD Directory Services domain.

The RDC Host Servers have an IAM policy that allows all actions to S3.

We have two users in the domain, both assigned to the same group - the default group "Domain Users".

When we log in to a Session Host with one user, we have no problem calling "Get-S3Object". But when we log in with the second user and call "Get-S3Object", we get “No credentials specified or obtained from persisted/shell defaults” - permissions should be given by the IAM policy attached to the EC2 which works for the first user.

To fix the problem, we have found that if we delete the second users' Windows profile, then the next time the second user logs in, they are given a TEMP profile and they are able to call "Get-S3Object", so clearly there is a problem with the user profile.

The Windows Servers are practically a vanilla instance and it's strange that deleting the User's profile fixes the issue...

We have also created a new domain user which had the same problem on one Session Host but not on another. It's a very random issue.

Has anyone else come across this problem? What can be causing this to happen?

Is it possible to configure nginx (or apache) to use a different backend server based on the request domain?

For example:

For a request for srv1.pod1.mydomain.com should go to srv1.pod1.external  
For a request for srv1.pod2.mydomain.com should go to srv1.pod2.external  
...  
For a request for srv1.podN.mydomain.com should go to srv1.podN.external  

I was looking at the rewrite rule but it doesn't seem to rewrite the domain, just the path.

server {
        listen 80 ([^.]+).(\w+).mydomain.com;

        server_name _;

        root /usr/share/nginx/html;
        index index.html index.htm;

        location / {
                proxy_pass $1.$2.external;
        }
}

I am trying to run a command as the Admin user with elevated permissions but PowerShell doesn't support this method.

Start-Process 
-FilePath "powershell" 
-ArgumentList "-Command New-RDSessionDeployment -ConnectionBroker $server -WebAccessServer $server -SessionHost $server" 
-Verb RunAs 
-Credential $creds

Start-Process : Parameter set cannot be resolved using the specified named parameters.

The combination of Verb and Credential are not supported.

NAME
    Start-Process

SYNTAX
    Start-Process [-FilePath] <string> [[-ArgumentList] <string[]>] [-Credential <pscredential>] [-WorkingDirectory <string>] [-LoadUserProfile] [-NoNewWindow] [-PassThru] [-RedirectStandardError <string>]
    [-RedirectStandardInput <string>] [-RedirectStandardOutput <string>] [-WindowStyle {Normal | Hidden | Minimized | Maximized}] [-Wait] [-UseNewEnvironment]  [<CommonParameters>]

    Start-Process [-FilePath] <string> [[-ArgumentList] <string[]>] [-WorkingDirectory <string>] [-PassThru] [-Verb <string>] [-WindowStyle {Normal | Hidden | Minimized | Maximized}] [-Wait]  [<CommonParameters>]

So how can I run an elevated powershell as another user??

UPDATE: I've come up with this nasty solution but unfortunately it prompts me to approve Elevated permissions which of course is because of UAT.

Start-Process 
-Credential $creds 
-FilePath "powershell" 
-ArgumentList "Start-Process 
    -Verb RunAs 
    -FilePath powershell 
    -ArgumentList '-Command New-RDSessionDeployment -ConnectionBroker $server -WebAccessServer $server -SessionHost $server'"

Is there a way to run that above command as the Domain Admin for automated deployment??

I use strongSwan to authenticate against FreeRadius which it does but now I need FreeRadius to return the user's groups in the Class field so they can be checked by strongSwan [1].

I'm using winbind and ntlm_auth on freeradius to authenticate users, which is working.

I've managed to work out how to add extra fields to the response by putting an update reply in the file /etc/raddb/sites-available/default

post-auth {
   ...
   update reply {
       Class = "%{Group}"
   }
   ...
}

Is that the place to put it??

but as you can see below, the Class is null.

(3) Sent Access-Accept Id 223 from 10.0.0.247:1812 to 10.0.0.120:48653 length 0
(3)   MS-MPPE-Encryption-Policy = Encryption-Allowed
(3)   MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed
(3)   MS-MPPE-Send-Key = 0x316216f0c4d55abb0cb8c2c741cad90c
(3)   MS-MPPE-Recv-Key = 0x1ec76bc2958017969cbc3d67e716d4a4
(3)   EAP-Message = 0x03030004
(3)   Message-Authenticator = 0x00000000000000000000000000000000
(3)   User-Name = "christian.salway"
(3)   Class = 0x
(3) Finished request

How can I return the User's Active Directory groups in the Class field?

[1] https://wiki.strongswan.org/projects/strongswan/wiki/EapRadius#Group-selection

(0) Received Access-Request Id 179 from 10.0.0.120:46201 to 10.0.0.247:1812 length 159
(0)   User-Name = "christian.salway"
(0)   NAS-Port-Type = Virtual
(0)   Service-Type = Framed-User
(0)   NAS-Port = 4
(0)   NAS-Port-Id = "pod"
(0)   NAS-IP-Address = 10.0.0.120
(0)   Called-Station-Id = "10.0.0.120[4500]"
(0)   Calling-Station-Id = "148.252.225.26[46452]"
(0)   EAP-Message = 0x020000150163687269737469616e2e73616c776179
(0)   NAS-Identifier = "test.vpn"
(0)   Message-Authenticator = 0x3a5d4de82ee89b6e96ecaf7051593242
(0) # Executing section authorize from file /etc/raddb/sites-enabled/default
(0)   authorize {
(0)     policy filter_username {
(0)       if (&User-Name) {
(0)       if (&User-Name)  -> TRUE
(0)       if (&User-Name)  {
(0)         if (&User-Name =~ / /) {
(0)         if (&User-Name =~ / /)  -> FALSE
(0)         if (&User-Name =~ /@[^@]*@/ ) {
(0)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(0)         if (&User-Name =~ /\.\./ ) {
(0)         if (&User-Name =~ /\.\./ )  -> FALSE
(0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE
(0)         if (&User-Name =~ /\.$/)  {
(0)         if (&User-Name =~ /\.$/)   -> FALSE
(0)         if (&User-Name =~ /@\./)  {
(0)         if (&User-Name =~ /@\./)   -> FALSE
(0)       } # if (&User-Name)  = notfound
(0)     } # policy filter_username = notfound
(0)     [preprocess] = ok
(0)     [chap] = noop
(0)     [mschap] = noop
(0)     [digest] = noop
(0) suffix: Checking for suffix after "@"
(0) suffix: No '@' in User-Name = "christian.salway", looking up realm NULL
(0) suffix: No such realm "NULL"
(0)     [suffix] = noop
(0) eap: Peer sent EAP Response (code 2) ID 0 length 21
(0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize
(0)     [eap] = ok
(0)   } # authorize = ok
(0) Found Auth-Type = eap
(0) # Executing group from file /etc/raddb/sites-enabled/default
(0)   authenticate {
(0) eap: Peer sent packet with method EAP Identity (1)
(0) eap: Calling submodule eap_md5 to process data
(0) eap_md5: Issuing MD5 Challenge
(0) eap: Sending EAP Request (code 1) ID 1 length 22
(0) eap: EAP session adding &reply:State = 0x54b7902754b694bf
(0)     [eap] = handled
(0)   } # authenticate = handled
(0) Using Post-Auth-Type Challenge
(0) # Executing group from file /etc/raddb/sites-enabled/default
(0)   Challenge { ... } # empty sub-section is ignored
(0) Sent Access-Challenge Id 179 from 10.0.0.247:1812 to 10.0.0.120:46201 length 0
(0)   EAP-Message = 0x010100160410d6f72d6ea8b978ed7e177475d8235482
(0)   Message-Authenticator = 0x00000000000000000000000000000000
(0)   State = 0x54b7902754b694bfe21d25f70628a0fb
(0) Finished request
Waking up in 4.9 seconds.
(1) Received Access-Request Id 57 from 10.0.0.120:50205 to 10.0.0.247:1812 length 162
(1)   User-Name = "christian.salway"
(1)   NAS-Port-Type = Virtual
(1)   Service-Type = Framed-User
(1)   NAS-Port = 4
(1)   NAS-Port-Id = "pod"
(1)   NAS-IP-Address = 10.0.0.120
(1)   Called-Station-Id = "10.0.0.120[4500]"
(1)   Calling-Station-Id = "148.252.225.26[46452]"
(1)   EAP-Message = 0x02010006031a
(1)   NAS-Identifier = "test.vpn"
(1)   State = 0x54b7902754b694bfe21d25f70628a0fb
(1)   Message-Authenticator = 0xec9534905c7948436fba36fac34097e9
(1) session-state: No cached attributes
(1) # Executing section authorize from file /etc/raddb/sites-enabled/default
(1)   authorize {
(1)     policy filter_username {
(1)       if (&User-Name) {
(1)       if (&User-Name)  -> TRUE
(1)       if (&User-Name)  {
(1)         if (&User-Name =~ / /) {
(1)         if (&User-Name =~ / /)  -> FALSE
(1)         if (&User-Name =~ /@[^@]*@/ ) {
(1)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(1)         if (&User-Name =~ /\.\./ ) {
(1)         if (&User-Name =~ /\.\./ )  -> FALSE
(1)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(1)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE
(1)         if (&User-Name =~ /\.$/)  {
(1)         if (&User-Name =~ /\.$/)   -> FALSE
(1)         if (&User-Name =~ /@\./)  {
(1)         if (&User-Name =~ /@\./)   -> FALSE
(1)       } # if (&User-Name)  = notfound
(1)     } # policy filter_username = notfound
(1)     [preprocess] = ok
(1)     [chap] = noop
(1)     [mschap] = noop
(1)     [digest] = noop
(1) suffix: Checking for suffix after "@"
(1) suffix: No '@' in User-Name = "christian.salway", looking up realm NULL
(1) suffix: No such realm "NULL"
(1)     [suffix] = noop
(1) eap: Peer sent EAP Response (code 2) ID 1 length 6
(1) eap: No EAP Start, assuming it's an on-going EAP conversation
(1)     [eap] = updated
(1)     [files] = noop
rlm_ldap (ldap): Reserved connection (0)
(1) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}})
(1) ldap:    --> (uid=christian.salway)
(1) ldap: Performing search in "OU=Users,OU=directory,DC=directory,DC=local" with filter "(uid=christian.salway)", scope "sub"
(1) ldap: Waiting for search result...
(1) ldap: Search returned no results
rlm_ldap (ldap): Released connection (0)
Need 5 more connections to reach 10 spares
rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used
rlm_ldap (ldap): Connecting to ldap://10.0.14.211:389
TLSMC: MozNSS compatibility interception begins.
tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present.
tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only.
TLSMC: MozNSS compatibility interception ends.
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
(1)     [ldap] = notfound
(1)     [expiration] = noop
(1)     [logintime] = noop
(1)   } # authorize = updated
(1) Found Auth-Type = eap
(1) # Executing group from file /etc/raddb/sites-enabled/default
(1)   authenticate {
(1) eap: Expiring EAP session with state 0x54b7902754b694bf
(1) eap: Finished EAP session with state 0x54b7902754b694bf
(1) eap: Previous EAP request found for state 0x54b7902754b694bf, released from the list
(1) eap: Peer sent packet with method EAP NAK (3)
(1) eap: Found mutually acceptable type MSCHAPv2 (26)
(1) eap: Calling submodule eap_mschapv2 to process data
(1) eap_mschapv2: Issuing Challenge
(1) eap: Sending EAP Request (code 1) ID 2 length 43
(1) eap: EAP session adding &reply:State = 0x54b7902755b58abf
(1)     [eap] = handled
(1)   } # authenticate = handled
(1) Using Post-Auth-Type Challenge
(1) # Executing group from file /etc/raddb/sites-enabled/default
(1)   Challenge { ... } # empty sub-section is ignored
(1) Sent Access-Challenge Id 57 from 10.0.0.247:1812 to 10.0.0.120:50205 length 0
(1)   EAP-Message = 0x0102002b1a01020026100ebe1822b5ac80ccb4c6865f139ce768667265657261646975732d332e302e3133
(1)   Message-Authenticator = 0x00000000000000000000000000000000
(1)   State = 0x54b7902755b58abfe21d25f70628a0fb
(1) Finished request
Waking up in 4.9 seconds.
(2) Received Access-Request Id 49 from 10.0.0.120:58147 to 10.0.0.247:1812 length 231
(2)   User-Name = "christian.salway"
(2)   NAS-Port-Type = Virtual
(2)   Service-Type = Framed-User
(2)   NAS-Port = 4
(2)   NAS-Port-Id = "pod"
(2)   NAS-IP-Address = 10.0.0.120
(2)   Called-Station-Id = "10.0.0.120[4500]"
(2)   Calling-Station-Id = "148.252.225.26[46452]"
(2)   EAP-Message = 0x0202004b1a02020046313273ea09204ebe6c15324a74ef6c608600000000000000004e9f07d6254012928721219474ab36964e7ee601940acd530063687269737469616e2e73616c776179
(2)   NAS-Identifier = "test.vpn"
(2)   State = 0x54b7902755b58abfe21d25f70628a0fb
(2)   Message-Authenticator = 0xda48ace7787828ea6b17398cd2252839
(2) session-state: No cached attributes
(2) # Executing section authorize from file /etc/raddb/sites-enabled/default
(2)   authorize {
(2)     policy filter_username {
(2)       if (&User-Name) {
(2)       if (&User-Name)  -> TRUE
(2)       if (&User-Name)  {
(2)         if (&User-Name =~ / /) {
(2)         if (&User-Name =~ / /)  -> FALSE
(2)         if (&User-Name =~ /@[^@]*@/ ) {
(2)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(2)         if (&User-Name =~ /\.\./ ) {
(2)         if (&User-Name =~ /\.\./ )  -> FALSE
(2)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(2)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE
(2)         if (&User-Name =~ /\.$/)  {
(2)         if (&User-Name =~ /\.$/)   -> FALSE
(2)         if (&User-Name =~ /@\./)  {
(2)         if (&User-Name =~ /@\./)   -> FALSE
(2)       } # if (&User-Name)  = notfound
(2)     } # policy filter_username = notfound
(2)     [preprocess] = ok
(2)     [chap] = noop
(2)     [mschap] = noop
(2)     [digest] = noop
(2) suffix: Checking for suffix after "@"
(2) suffix: No '@' in User-Name = "christian.salway", looking up realm NULL
(2) suffix: No such realm "NULL"
(2)     [suffix] = noop
(2) eap: Peer sent EAP Response (code 2) ID 2 length 75
(2) eap: No EAP Start, assuming it's an on-going EAP conversation
(2)     [eap] = updated
(2)     [files] = noop
rlm_ldap (ldap): Reserved connection (1)
(2) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}})
(2) ldap:    --> (uid=christian.salway)
(2) ldap: Performing search in "OU=Users,OU=directory,DC=directory,DC=local" with filter "(uid=christian.salway)", scope "sub"
(2) ldap: Waiting for search result...
(2) ldap: Search returned no results
rlm_ldap (ldap): Released connection (1)
(2)     [ldap] = notfound
(2)     [expiration] = noop
(2)     [logintime] = noop
(2)   } # authorize = updated
(2) Found Auth-Type = eap
(2) # Executing group from file /etc/raddb/sites-enabled/default
(2)   authenticate {
(2) eap: Expiring EAP session with state 0x54b7902755b58abf
(2) eap: Finished EAP session with state 0x54b7902755b58abf
(2) eap: Previous EAP request found for state 0x54b7902755b58abf, released from the list
(2) eap: Peer sent packet with method EAP MSCHAPv2 (26)
(2) eap: Calling submodule eap_mschapv2 to process data
(2) eap_mschapv2: # Executing group from file /etc/raddb/sites-enabled/default
(2) eap_mschapv2:   authenticate {
(2) mschap: Creating challenge hash with username: christian.salway
(2) mschap: Client is using MS-CHAPv2
(2) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}:
(2) mschap: EXPAND --username=%{mschap:User-Name}
(2) mschap:    --> --username=christian.salway
(2) mschap: Creating challenge hash with username: christian.salway
(2) mschap: EXPAND --challenge=%{%{mschap:Challenge}:-00}
(2) mschap:    --> --challenge=901534adcf416acd
(2) mschap: EXPAND --nt-response=%{%{mschap:NT-Response}:-00}
(2) mschap:    --> --nt-response=4e9f07d6254012928721219474ab36964e7ee601940acd53
(2) mschap: Program returned code (0) and output 'NT_KEY: 7EAE67D582A054C071FC841CE38DCC98'
(2) mschap: Adding MS-CHAPv2 MPPE keys
(2)     [mschap] = ok
(2)   } # authenticate = ok
(2) MSCHAP Success
(2) eap: Sending EAP Request (code 1) ID 3 length 51
(2) eap: EAP session adding &reply:State = 0x54b7902756b48abf
(2)     [eap] = handled
(2)   } # authenticate = handled
(2) Using Post-Auth-Type Challenge
(2) # Executing group from file /etc/raddb/sites-enabled/default
(2)   Challenge { ... } # empty sub-section is ignored
(2) Sent Access-Challenge Id 49 from 10.0.0.247:1812 to 10.0.0.120:58147 length 0
(2)   EAP-Message = 0x010300331a0302002e533d35394541323943313237434245394134354338414433394535364535343233443236323045443943
(2)   Message-Authenticator = 0x00000000000000000000000000000000
(2)   State = 0x54b7902756b48abfe21d25f70628a0fb
(2) Finished request
Waking up in 4.9 seconds.
(3) Received Access-Request Id 197 from 10.0.0.120:49731 to 10.0.0.247:1812 length 162
(3)   User-Name = "christian.salway"
(3)   NAS-Port-Type = Virtual
(3)   Service-Type = Framed-User
(3)   NAS-Port = 4
(3)   NAS-Port-Id = "pod"
(3)   NAS-IP-Address = 10.0.0.120
(3)   Called-Station-Id = "10.0.0.120[4500]"
(3)   Calling-Station-Id = "148.252.225.26[46452]"
(3)   EAP-Message = 0x020300061a03
(3)   NAS-Identifier = "test.vpn"
(3)   State = 0x54b7902756b48abfe21d25f70628a0fb
(3)   Message-Authenticator = 0xefadb173cef56d9ee5ec66621fd0211f
(3) session-state: No cached attributes
(3) # Executing section authorize from file /etc/raddb/sites-enabled/default
(3)   authorize {
(3)     policy filter_username {
(3)       if (&User-Name) {
(3)       if (&User-Name)  -> TRUE
(3)       if (&User-Name)  {
(3)         if (&User-Name =~ / /) {
(3)         if (&User-Name =~ / /)  -> FALSE
(3)         if (&User-Name =~ /@[^@]*@/ ) {
(3)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(3)         if (&User-Name =~ /\.\./ ) {
(3)         if (&User-Name =~ /\.\./ )  -> FALSE
(3)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(3)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE
(3)         if (&User-Name =~ /\.$/)  {
(3)         if (&User-Name =~ /\.$/)   -> FALSE
(3)         if (&User-Name =~ /@\./)  {
(3)         if (&User-Name =~ /@\./)   -> FALSE
(3)       } # if (&User-Name)  = notfound
(3)     } # policy filter_username = notfound
(3)     [preprocess] = ok
(3)     [chap] = noop
(3)     [mschap] = noop
(3)     [digest] = noop
(3) suffix: Checking for suffix after "@"
(3) suffix: No '@' in User-Name = "christian.salway", looking up realm NULL
(3) suffix: No such realm "NULL"
(3)     [suffix] = noop
(3) eap: Peer sent EAP Response (code 2) ID 3 length 6
(3) eap: No EAP Start, assuming it's an on-going EAP conversation
(3)     [eap] = updated
(3)     [files] = noop
rlm_ldap (ldap): Reserved connection (2)
(3) ldap: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})
(3) ldap:    --> (samaccountname=christian.salway)
(3) ldap: Performing search in "OU=Users,OU=directory,DC=directory,DC=local" with filter "(samaccountname=christian.salway)", scope "sub"
(3) ldap: Waiting for search result...
(3) ldap: User object found at DN "CN=christian.salway,OU=Users,OU=directory,DC=directory,DC=local"
(3) ldap: Processing user attributes
(3) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute
(3) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure)
rlm_ldap (ldap): Released connection (2)
(3)     [ldap] = notfound
(3)     [expiration] = noop
(3)     [logintime] = noop
(3)   } # authorize = updated
(3) Found Auth-Type = eap
(3) # Executing group from file /etc/raddb/sites-enabled/default
(3)   authenticate {
(3) eap: Expiring EAP session with state 0x54b7902756b48abf
(3) eap: Finished EAP session with state 0x54b7902756b48abf
(3) eap: Previous EAP request found for state 0x54b7902756b48abf, released from the list
(3) eap: Peer sent packet with method EAP MSCHAPv2 (26)
(3) eap: Calling submodule eap_mschapv2 to process data
(3) eap: Sending EAP Success (code 3) ID 3 length 4
(3) eap: Freeing handler
(3)     [eap] = ok
(3)   } # authenticate = ok
(3) # Executing section post-auth from file /etc/raddb/sites-enabled/default
(3)   post-auth {
(3)     update {
(3)       No attributes updated
(3)     } # update = noop
(3)     [exec] = noop
(3)     update reply {
(3)       EXPAND %{Group}
(3)          --> 
(3)       Class = 0x
(3)     } # update reply = noop
(3)     policy remove_reply_message_if_eap {
(3)       if (&reply:EAP-Message && &reply:Reply-Message) {
(3)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(3)       else {
(3)         [noop] = noop
(3)       } # else = noop
(3)     } # policy remove_reply_message_if_eap = noop
(3)   } # post-auth = noop
(3) Sent Access-Accept Id 197 from 10.0.0.247:1812 to 10.0.0.120:49731 length 0
(3)   MS-MPPE-Encryption-Policy = Encryption-Allowed
(3)   MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed
(3)   MS-MPPE-Send-Key = 0xef26546a7c78d1dcd573403ab44047a3
(3)   MS-MPPE-Recv-Key = 0x0a30fd26c29498159842c0b946e7e724
(3)   EAP-Message = 0x03030004
(3)   Message-Authenticator = 0x00000000000000000000000000000000
(3)   User-Name = "christian.salway"
(3)   Class = 0x
(3) Finished request

I'm trying to run strongSwan on an Amazon Linux instance with authentication against RADIUS but I receive an error when trying to start strongSwan

charon[9518]: 00[CFG] RADIUS initialization failed, HMAC/MD5/RNG required

To install strongSwan I ran

yum install strongswan

# swanctl --version strongSwan swanctl 5.7.1

# swanctl --stats loaded plugins: charon pkcs11 tpm aesni aes des rc2 sha2 sha1 md4 md5 mgf1 random nonce x509 revocation constraints acert pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl gcrypt fips-prf gmp curve25519 chapoly xcbc cmac hmac ctr ccm gcm curl sqlite attr kernel-netlink resolve socket-default farp stroke vici updown eap-identity eap-sim eap-aka eap-aka-3gpp eap-aka-3gpp2 eap-md5 eap-gtc eap-mschapv2 eap-dynamic eap-radius eap-tls eap-ttls eap-peap xauth-generic xauth-eap xauth-pam xauth-noauth dhcp led duplicheck unity counters

cat <<EOF > /etc/strongswan/strongswan.d/charon/eap-radius.conf
eap-radius {
    load = yes
    nas_identifier = ${DNSNAME}
    retransmit_timeout = 30
    retransmit_tries = 1
    servers {
        primary {
            preference = 99
            address = ${RADIUSFQDN}
            auth_port = 1812
            secret = ${RADIUSPSWD}
            sockets = 5
        }
    }
}
EOF

Complete startup log

Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal charon[10493]: 06[MGR] tried to checkin and delete nonexisting IKE_SA
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal charon[10493]: 06[IKE] unable to resolve %any, initiate aborted
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal charon[10493]: 06[CFG] received stroke: initiate 'pod'
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal charon[10493]: 05[CFG] added configuration 'pod'
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal charon[10493]: 05[CFG]   loaded certificate "CN=vpn.test.dev.poddev.naimuri.uk" from 'vpnserver.crt'
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal charon[10493]: 05[CFG] adding virtual IP address pool 192.168.250.0/24
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal charon[10493]: 05[CFG] received stroke: add connection 'pod'
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal strongswan[10484]: charon (10493) started after 60 ms
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal ipsec_starter[10484]: charon (10493) started after 60 ms
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal charon[10493]: 00[JOB] spawning 16 worker threads
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal charon[10493]: 00[LIB] loaded plugins: charon pkcs11 tpm aesni aes des rc2 sha2 sha1 md4 md5 mgf1 random nonce x509 revocation const
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal charon[10493]: 00[CFG] no script for ext-auth script defined, disabled
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal charon[10493]: 00[CFG] HA config misses local/remote address
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal charon[10493]: 00[CFG] loaded 0 RADIUS server configurations
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal charon[10493]: 00[CFG] loading RADIUS server 'primary' failed, skipped
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal charon[10493]: 00[CFG] RADIUS initialization failed, HMAC/MD5/RNG required
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal charon[10493]: 00[CFG] opening triplet file /etc/strongswan/ipsec.d/triplets.dat failed: No such file or directory
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal charon[10493]: 00[CFG] sql plugin: database URI not set
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal charon[10493]: 00[CFG]   loaded RSA private key from '/etc/strongswan/ipsec.d/private/vpnserver.key'
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal charon[10493]: 00[CFG] loading secrets from '/etc/strongswan/ipsec.secrets'
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal charon[10493]: 00[CFG] loading crls from '/etc/strongswan/ipsec.d/crls'
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal charon[10493]: 00[CFG] loading attribute certificates from '/etc/strongswan/ipsec.d/acerts'
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal charon[10493]: 00[CFG] loading ocsp signer certificates from '/etc/strongswan/ipsec.d/ocspcerts'
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal charon[10493]: 00[CFG] loading aa certificates from '/etc/strongswan/ipsec.d/aacerts'
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal charon[10493]: 00[CFG]   loaded ca certificate "C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3" from '/etc/strongswan/ipsec.d/
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal charon[10493]: 00[CFG] loading ca certificates from '/etc/strongswan/ipsec.d/cacerts'
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal charon[10493]: 00[LIB] openssl FIPS mode(2) - enabled
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal charon[10493]: 00[CFG] PKCS11 module '<name>' lacks library path
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal charon[10493]: 00[DMN] Starting IKE charon daemon (strongSwan 5.7.1, Linux 4.14.72-73.55.amzn2.x86_64, x86_64)
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal ipsec_starter[10484]: Starting strongSwan 5.7.1 IPsec [starter]...
Nov 13 14:14:34 ip-10-0-0-218.eu-west-2.compute.internal strongswan[10484]: Starting strongSwan 5.7.1 IPsec [starter]...

On a new Ubuntu 18.04.1 LTS (GNU/Linux 4.15.0-1017-aws x86_64), I have installed Google Authenticator [1] and configured it in the following way

/etc/pam.d/sshd
#@include common-auth
...
auth required pam_google_authenticator.so nullok


/etc/ssh/sshd_config
...
ChallengeResponseAuthentication yes
...
AuthenticationMethods publickey,keyboard-interactive

Which works on Ubuntu 16, but not Ubuntu 18 with the following error when trying to log in:

$ ssh ubuntu@server
ubuntu@server: Permission denied (keyboard-interactive).

It seems something has changed with the new version of Ubuntu.

When i enable debug, there is no further information

Aug 17 11:40:31 ip-10-0-0-182 sshd(pam_google_authenticator)[6834]: debug: start of google_authenticator for "ubuntu"
Aug 17 11:40:31 ip-10-0-0-182 sshd[6832]: error: PAM: Permission denied for ubuntu from X.X.X.X
Aug 17 11:40:32 ip-10-0-0-182 sshd[6832]: Connection closed by authenticating user ubuntu X.X.X.X port 61076 [preauth]

ps. The home directory is NOT encrypted

[1] apt-get install libpam-google-authenticator

I have the following ipsec commands that generate certificates, but I dont have ipsec installed so looking for the openssl equivalent. Can anyone please help?

Create certificate authority cert

ipsec pki --gen --type rsa --size 4096 --outform pem > server-root-key.pem

ipsec pki --self --ca --lifetime 3650 \
--in server-root-key.pem \
--type rsa --dn "C=GB, O=Self Signed, CN=VPN Server Root CA" \
--outform pem > server-root-ca.pem

Create vpn server cert

ipsec pki --gen --type rsa --size 4096 --outform pem > vpn-server-key.pem

ipsec pki --pub --in vpn-server-key.pem \
--type rsa | ipsec pki --issue --lifetime 1825 \
--cacert /etc/swanctl/x509ca/server-root-ca.pem \
--cakey /etc/swanctl/private/server-root-key.pem \
--dn "C=GB, O=Self signed, CN=vpnserver" \
--san vpnserver \
--san dns:18.130.12.85 \
--flag serverAuth --flag ikeIntermediate \
--outform pem > vpn-server-cert.pem

Create user cert

ipsec pki --gen --type rsa --size 4096 --outform pem > vpn-$USER-key.pem

ipsec pki --pub --in vpn-$USER-key.pem \
--type rsa | ipsec pki --issue --lifetime 1825 \
--cacert /etc/swanctl/x509ca/server-root-ca.pem \
--cakey /etc/swanctl/private/server-root-key.pem \
--dn "C=GB, O=Self signed, CN=$USER" \
--san $USER \
--outform pem > vpn-$USER-cert.pem

I have StrongSwan 5.6.2 running on a Ubuntu 16.04 server which I am able to connect to from OSX Sierra using certificates, but I am not able to connect the same way from Windows 10. Can anyone please help?

I have opened UDP 500/4500 through the Firewall (AWS Security Group) and as mentioned, I can connect and authenticate to StrongSwan from OSX.

I have built StrongSwan from source using the following configuration:

./configure --prefix=/usr --sysconfdir=/etc \
  --enable-systemd --enable-swanctl \
  --disable-charon --disable-stroke --disable-scepclient \
  --enable-gcm --enable-eap-tls --enable-eap-identity

and my swanctl configuration file has the following setup:

connections {
   ikev2-cert {
      version = 2
      send_cert = always
      encap = yes
      pools = pool1
      dpd_delay = 60s
      unique = keep
      local {
         certs = vpn-server-cert.pem
         id = vpnserver
      }
      remote {
         auth = eap-tls
         eap_id = %any
      }
      children {
         net {
            local_ts  = 10.0.0.0/20
            inactivity = 120s
         }
      }
   }
}

pools {
   pool1 {
     addrs = 172.16.0.0/12 
   }
}

with the Server Certificate created with the flags --flag serverAuth --flag ikeIntermediate

ipsec pki --pub --in vpn-server-key.pem \
--type rsa | ipsec pki --issue --lifetime 1825 \
--cacert /etc/swanctl/x509ca/server-root-ca.pem \
--cakey /etc/swanctl/private/server-root-key.pem \
--dn "C=GB, O=Self signed, CN=VPN Server" \
--san vpnserver \
--flag serverAuth --flag ikeIntermediate \
--outform pem > vpn-server-cert.pem

I also had to set a registration key in Windows 10 so as to use better ciphers (head slap)

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rasman\Parameters [DWORD 32bit] NegotiateDH2048_AES256  1

The server log when the Windows 10 client tries to connect is as follows:

Apr 05 15:25:12 charon-systemd[1497]: 14[MGR] checkout IKEv2 SA by message with SPIs 6177fa9aadb3cdd5_i 0000000000000000_r
Apr 05 15:25:12 charon-systemd[1497]: received packet: from 35.36.37.38[42772] to 10.0.3.212[500] (624 bytes)
Apr 05 15:25:12 charon-systemd[1497]: 14[MGR] created IKE_SA (unnamed)[19]
Apr 05 15:25:12 charon-systemd[1497]: parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) V V V V ]
Apr 05 15:25:12 charon-systemd[1497]: 14[NET] received packet: from 35.36.37.38[42772] to 10.0.3.212[500] (624 bytes)
Apr 05 15:25:12 charon-systemd[1497]: received MS NT5 ISAKMPOAKLEY v9 vendor ID
Apr 05 15:25:12 charon-systemd[1497]: 14[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) V V V V ]
Apr 05 15:25:12 charon-systemd[1497]: received MS-Negotiation Discovery Capable vendor ID
Apr 05 15:25:12 charon-systemd[1497]: 14[CFG] looking for an ike config for 10.0.3.212...35.36.37.38
Apr 05 15:25:12 charon-systemd[1497]: received Vid-Initial-Contact vendor ID
Apr 05 15:25:12 charon-systemd[1497]: 14[CFG] ike config match: 28 (10.0.3.212 35.36.37.38 IKEv2)
Apr 05 15:25:12 charon-systemd[1497]: received unknown vendor ID: 01:52:8b:bb:c0:06:96:12:18:49:ab:9a:1c:5b:2a:51:00:00:00:02
Apr 05 15:25:12 charon-systemd[1497]: 14[CFG]   candidate: %any...%any, prio 28
Apr 05 15:25:12 charon-systemd[1497]: 35.36.37.38 is initiating an IKE_SA
Apr 05 15:25:12 charon-systemd[1497]: 14[CFG] found matching ike config: %any...%any with prio 28
Apr 05 15:25:12 charon-systemd[1497]: 14[IKE] received MS NT5 ISAKMPOAKLEY v9 vendor ID
Apr 05 15:25:12 charon-systemd[1497]: 14[IKE] received MS-Negotiation Discovery Capable vendor ID
Apr 05 15:25:12 charon-systemd[1497]: 14[IKE] received Vid-Initial-Contact vendor ID
Apr 05 15:25:12 charon-systemd[1497]: 14[ENC] received unknown vendor ID: 01:52:8b:bb:c0:06:96:12:18:49:ab:9a:1c:5b:2a:51:00:00:00:02
Apr 05 15:25:12 charon-systemd[1497]: 14[IKE] 35.36.37.38 is initiating an IKE_SA
Apr 05 15:25:12 charon-systemd[1497]: 14[IKE] IKE_SA (unnamed)[19] state change: CREATED => CONNECTING
Apr 05 15:25:12 charon-systemd[1497]: 14[CFG] selecting proposal:
Apr 05 15:25:12 charon-systemd[1497]: 14[CFG]   proposal matches
Apr 05 15:25:12 charon-systemd[1497]: 14[CFG] received proposals: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048, IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048, IKE:AES_CBC_256/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_2048
Apr 05 15:25:12 charon-systemd[1497]: 14[CFG] configured proposals: IKE:AES_CBC_128/AES_CBC_192/AES_CBC_256/3DES_CBC/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/AES_XCBC_96/AES_CMAC_96/HMAC_SHA1_96/PRF_AES128_XCBC/PRF_AES128_CMAC/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_HMAC_SHA1/CURVE_25519/MODP_3072/MODP_4096/MODP_6144/MODP_8192/MODP_2048, IKE:AES_GCM_16_128/AES_GCM_16_192/AES_GCM_16_256/AES_GCM_8_128/AES_GCM_8_192/AES_GCM_8_256/AES_GCM_12_128/AES_GCM_12_192/AES_GCM_12_256/PRF_AES128_XCBC/PRF_AES128_CMAC/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_HMAC_SHA1/CURVE_25519/MODP_3072/MODP_4096/MODP_6144/MODP_8192/MODP_2048
Apr 05 15:25:12 charon-systemd[1497]: 14[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048
Apr 05 15:25:12 charon-systemd[1497]: 14[LIB] size of DH secret exponent: 2047 bits
Apr 05 15:25:12 charon-systemd[1497]: 14[IKE] local host is behind NAT, sending keep alives
Apr 05 15:25:12 charon-systemd[1497]: local host is behind NAT, sending keep alives
Apr 05 15:25:12 charon-systemd[1497]: 01[JOB] next event in 19s 999ms, waiting
Apr 05 15:25:12 charon-systemd[1497]: 14[IKE] remote host is behind NAT
Apr 05 15:25:12 charon-systemd[1497]: remote host is behind NAT
Apr 05 15:25:12 charon-systemd[1497]: sending cert request for "C=GB, O=Self Signed, CN=VPN Server Root CA"
Apr 05 15:25:12 charon-systemd[1497]: 14[IKE]    0: 0E F2 A0 61 A3 44 38 E5 49 4A B1 50 BE 3C 7C 7B  ...a.D8.IJ.P.<|{
Apr 05 15:25:12 charon-systemd[1497]: generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(MULT_AUTH) ]
Apr 05 15:25:12 charon-systemd[1497]: 14[IKE]   16: E0 B4 5C C1                                      ..\.
Apr 05 15:25:12 charon-systemd[1497]: sending packet: from 10.0.3.212[500] to 35.36.37.38[42772] (465 bytes)
Apr 05 15:25:12 charon-systemd[1497]: 14[IKE] sending cert request for "C=GB, O=Self Signed, CN=VPN Server Root CA"
Apr 05 15:25:12 charon-systemd[1497]: 14[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(MULT_AUTH) ]
Apr 05 15:25:12 charon-systemd[1497]: 14[NET] sending packet: from 10.0.3.212[500] to 35.36.37.38[42772] (465 bytes)
Apr 05 15:25:12 charon-systemd[1497]: 01[JOB] next event in 19s 998ms, waiting
Apr 05 15:25:12 charon-systemd[1497]: 14[MGR] checkin IKE_SA (unnamed)[19]
Apr 05 15:25:12 charon-systemd[1497]: 14[MGR] checkin of IKE_SA successful
Apr 05 15:25:32 charon-systemd[1497]: 01[JOB] got event, queuing job for execution
Apr 05 15:25:32 charon-systemd[1497]: sending keep alive to 35.36.37.38[42772]
Apr 05 15:25:32 charon-systemd[1497]: 01[JOB] next event in 10s 1ms, waiting
Apr 05 15:25:32 charon-systemd[1497]: 16[MGR] checkout IKEv2 SA with SPIs 6177fa9aadb3cdd5_i 222d0fd2d78e519d_r
Apr 05 15:25:32 charon-systemd[1497]: 16[MGR] IKE_SA (unnamed)[19] successfully checked out
Apr 05 15:25:32 charon-systemd[1497]: 16[IKE] sending keep alive to 35.36.37.38[42772]
Apr 05 15:25:32 charon-systemd[1497]: 16[MGR] checkin IKE_SA (unnamed)[19]
Apr 05 15:25:32 charon-systemd[1497]: 16[MGR] checkin of IKE_SA successful
Apr 05 15:25:32 charon-systemd[1497]: 01[JOB] next event in 10s 0ms, waiting
Apr 05 15:25:42 charon-systemd[1497]: 01[JOB] got event, queuing job for execution
Apr 05 15:25:42 charon-systemd[1497]: deleting half open IKE_SA with 35.36.37.38 after timeout

I notice in the Windows 10 VPN configurator, that there is no where to set the Remote ID or the Local ID (as there is in OSX), so I'm guessing there's a magical way for Microsoft (as usual).

I've been asked to deploy an IPSEC server for a project and after doing some research, StrongSwan looks like a good candidate. Since this project requires top security, I decided to install the latest version of StrongSwan (5.6.2) as it seems to fix a few security issues and what-not.

So I've spent the past few days working out how to configure it, which I have been able to do using /etc/ipsec.conf, however, on reading StrongSwan's website, is now a legacy way of setting it up.

The recommended way of configuring strongSwan is via the powerful vici interface and the swanctl command line tool. The swanctl.conf configuration file used by swanctl is stored together with certificates and corresponding private keys in the swanctl directory. Global strongSwan settings as well as plugin-specific configurations are defined in strongswan.conf.

Alternatively the legacy ipsec stroke interface and its ipsec.conf and ipsec.secrets configuration files may be used.

So now I am in the process of trying to change the configuration to use a file stored in /etc/swanctl/conf.d instead...

So my question is this:

Does anyone know how to build StrongSwan from source and have it start with the Server (Ubuntu 16.04) and use the new configuration method?

My configure line looks like this

./configure --prefix=/usr --sysconfdir=/etc \
  --enable-systemd --enable-swanctl \
  --disable-charon --disable-stroke --disable-scepclient \
  --enable-gcm --enable-eap-tls

but this still doesnt start with the Server, nor can I find any strongswan or strongswan-swanctl for startup.

My current ipsec.conf looks like this

conn %default
 auto=add
 forceencaps=yes
 keyexchange=ikev2
 keyingtries=1
 ike=aes256-sha256-modp2048!
 esp=aes256-sha256,aes128-sha256!
 dpdaction=clear
 inactivity=120s
 leftsendcert=always
 leftcert=vpn-server-cert.pem
 leftsubnet=10.0.0.0/20
 leftid=@vpnserver
 rightsourceip=172.16.0.0/12
 eap_identity=%identity

conn ikev2-cert
 rightauth=eap-tls

which 'I think' translates to this

connections {
   rw {
      version = 2
      send_certreq = yes
      proposals = aes256-sha256-modp2048!
      encap = yes
      dpd_delay = 30s
      local {
         auth = eap-tls 
         certs = vpn-server-cert.pem
         id = vpnserver
      }
      remote {
         auth = eap-tls 
      }
      children {
         net {
            local_ts  = 172.16.0.0/12 
            esp_proposals = aes256-sha256,aes128-sha256!
            inactivity = 120s
         }
      }
   }
}

When sending a mail logged in as ec2-user to an unknown user:

echo "Subject: test" | /usr/lib/sendmail -v abc

the From:<> is blank when redirected to ec2-user's alias which is causing the external server to reject the mail. Even setting -f "ec2-user@internal" doesn't fix it.

Inside my /etc/aliases I have

root:     webmaster@external
ec2-user: webmaster@external

The verbose output displays the following:

abc... Connecting to [127.0.0.1] via relay...
220 internal ESMTP Sendmail 8.14.4/8.14.4; Thu, 24 Mar 2016 16:42:37 GMT
>>> EHLO internal
250-internal Hello localhost [127.0.0.1], pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-8BITMIME
250-SIZE
250-DSN
250-ETRN
250-DELIVERBY
250 HELP
>>> MAIL From:<ec2-user@internal> SIZE=14
250 2.1.0 <ec2-user@internal>... Sender ok
>>> RCPT To:<abc@internal>
>>> DATA
550 5.1.1 <abc@internal>... User unknown
503 5.0.0 Need RCPT (recipient)
>>> RSET
250 2.0.0 Reset state
>>> RSET
250 2.0.0 Reset state
ec2-user... Using cached ESMTP connection to [127.0.0.1] via relay...
>>> MAIL From:<> SIZE=1038
250 2.1.0 <>... Sender ok
>>> RCPT To:<ec2-user@internal>
>>> DATA
250 2.1.5 <ec2-user@internal>... Recipient ok
354 Enter mail, end with "." on a line by itself
>>> .
250 2.0.0 u2OGgbZL022963 Message accepted for delivery
ec2-user... Sent (u2OGgbZL022963 Message accepted for delivery)
Closing connection to [127.0.0.1]
>>> QUIT
221 2.0.0 internal closing connection

When I send a mail to a known user, such as to the ec2-user or root, the mail is received.

How can I configure sendmail to set the From address when relaying in this way?

I have several servers (web, mysql, java) that have postfix installed which are set up to relay to a smarthost postfix server.

DYNAMIC IP                              STATIC IP            INTERNET
[PHP -> sendmail -> 25:postfix:2525] -> [2525:postfix:25] -> [25:external]

The problem is the first servers have dynamic ip addresses, so i cant simply add their ip addresses to mynetworks setting in the main.cf of the middle postfix server.

I think the solution is SASL, but i cant figure out how to set a username:password on the first and have it authenticated on the second.

This is what I have on the relay

apt-get install postfix libsasl2-modules

cat > /etc/postfix/main.cf << 'EOF'
myhostname = a-eu1-test-http
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
relayhost = [smarthost]:2525
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mydestination = a-eu1-test-http, localhost
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = loopback-only

smtpd_banner = $myhostname ESMTP $mail_name
biff = no
append_dot_mydomain = no
readme_directory = no

smtp_tls_security_level = encrypt
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/relay_password
smtp_sasl_security_options = noanonymous
EOF

This is what I have on the smarthost, but i dont know how to define the sasl users:

apt-get install postfix libsasl2-modules

cat > /etc/postfix/main.cf << 'EOF'
myorigin = /etc/mailname
myhostname = smarthost
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mydestination = smarthost, localhost
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all

smtpd_banner = $myhostname ESMTP $mail_name
biff = no
append_dot_mydomain = no
readme_directory = no

smtpd_tls_security_level = encrypt
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache

smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname

smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
EOF

Is there any tweak for monit or another way to monitor whether one server can access mysql on another server?

I tried it with monit but as you probably know, after 10 attempts, mysql blocks the server.

check host db1.server with address db1.server
   if failed port 3306 protocol mysql then alert

.

mysqli: host <host> is blocked because of many connection errors; unblock with mysqladmin flush-hosts

I've got monit running on a server to alert by email with the following config

set mailserver 127.0.0.1
 using hostname "vps1.sender.com"

set mail-format { from: [email protected] }

set alert [email protected]

but the mails are still coming through with a hostname of localhost

 Aug  7 08:40:55 mx1 postfix/smtpd[31060]: NOQUEUE: reject: RCPT from
 vps1.sender.com[xx.xx.xx.xx]: 504 5.5.2 <localhost>: Helo command
 rejected: need fully-qualified hostname; from=<[email protected]>
 to=<[email protected]> proto=ESMTP helo=<localhost>

It's the only config file I have.

What am I missing?

ok - i give up trying to find the answer to this so here i am :)

I have postfix/dovecot setup using virtual accounts. I basically followed this guide http://pietervogelaar.nl/ubuntu-12-04-install-postfix-dovecot-and-vimbadmin/

But what I ideally want is to set up a mail server to be an endpoint for some domains, whilst relay others.

Example

example.com is a virtual domain hosted locally on the mail server. [email protected] is an email address on the local server so mails are stored in /var/vmail/example.com/info

otherdomain.com is a domain that needs all messages relayed to some.other-server.com whilst going through spam/av checking first. no mails or accounts are stored locally.

EDIT

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
broken_sasl_auth_clients = yes
config_directory = /etc/postfix
content_filter = amavis:[127.0.0.1]:10024
dovecot_destination_recipient_limit = 1
enable_original_recipient = no
header_checks = regexp:/etc/postfix/header_checks
inet_interfaces = all
mailbox_size_limit = 0
mydestination = mx1.itmanx.com, localhost, localhost.localdomain, localhost
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
myorigin = /etc/mailname
readme_directory = no
recipient_delimiter = +
relayhost =
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_invalid_hostname, reject_unauth_pipelining, reject_non_fqdn_sender, reject_unknown_sender_domain, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_rbl_client sbl.spamhaus.org, permit
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous, noplaintext
smtpd_sasl_tls_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes
virtual_alias_maps = mysql:/etc/postfix/mysql/virtual-aliases.cf
virtual_gid_maps = static:5000
virtual_mailbox_domains = mysql:/etc/postfix/mysql/virtual-domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql/virtual-mailboxes.cf
virtual_transport = dovecot
virtual_uid_maps = static:5000

I have a CentOS 6.3 installed with httpd running and vsftpd but I am unable to balance permission between the user able to upload over ftp and their website working.

What I do:

I create a user with their home directory as `/home/username` 
I create a sub folder called `html` for their website
I chown their directory `chown -R username:apache /home/username`
I chmod their directory `chmod -R 750 /home/username`
I chcon their directory `chcon -R -t httpd_sys_rw_content_t /home/username` 

and their website loads fine but they are unable to ftp, but if I do the following, they can ftp but their website doesnt load:

chcon -R -t user_home_dir_t /home/username

If I disable selinux, the user can ftp and the website loads. so what is the answer to keep selinux?

EDIT

Interestingly I followed Michael's comments below and just ran restorecon and it worked. But then I rebooted and now vsftp is fine and httpd can read fine, but httpd can not write.

This is my ls -Z response

drwxr-x---. itmanx apache unconfined_u:object_r:user_home_dir_t:s0 itmanx

These are the set booleans

allow_console_login                         on
allow_daemons_dump_core                     on
allow_daemons_use_tty                       on
allow_domain_fd_use                         on
allow_execmem                               on
allow_execmod                               on
allow_execstack                             on
allow_gssd_read_tmp                         on
allow_kerberos                              on
allow_mount_anyfile                         on
allow_nsplugin_execmem                      on
allow_postfix_local_write_mail_spool        on
allow_staff_exec_content                    on
allow_sysadm_exec_content                   on
allow_user_exec_content                     on
allow_zebra_write_config                    on
ftp_home_dir                                on
httpd_builtin_scripting                     on
httpd_can_network_connect_db                on
httpd_can_sendmail                          on
httpd_dbus_avahi                            on
httpd_enable_cgi                            on
httpd_enable_homedirs                       on
httpd_tty_comm                              on
httpd_unified                               on
init_upstart                                on
nscd_use_shm                                on
nsplugin_can_network                        on
openvpn_enable_homedirs                     on
privoxy_connect_any                         on
qemu_full_network                           on
qemu_use_cifs                               on
qemu_use_nfs                                on
qemu_use_usb                                on
sepgsql_enable_users_ddl                    on
sepgsql_unconfined_dbadm                    on
spamd_enable_home_dirs                      on
squid_connect_any                           on
unconfined_login                            on
use_nfs_home_dirs                           on
user_direct_dri                             on
user_ping                                   on
user_rw_noexattrfile                        on
user_setrlimit                              on
virt_use_sysfs                              on
virt_use_usb                                on
xguest_connect_network                      on
xguest_mount_media                          on
xguest_use_bluetooth                        on

AUDIT LOG

type=SYSCALL msg=audit(1350111166.254:3204): arch=40000003 syscall=4 success=yes exit=2 a0=1 a1=b778e000 a2=2 a3=2 items=0 ppid=4114 pid=4119 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=96 comm="bash" exe="/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1350111180.584:3205): avc:  denied  { write } for  pid=2376 comm="httpd" name="cache" dev=dm-2 ino=11012856 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.584:3205): arch=40000003 syscall=10 success=no exit=-13 a0=b5ef0e64 a1=3234 a2=b776cad8 a3=b5ef0e64 items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1350111180.584:3206): avc:  denied  { write } for  pid=2376 comm="httpd" name="logs" dev=dm-2 ino=11012903 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.584:3206): arch=40000003 syscall=5 success=no exit=-13 a0=b5e6fcfc a1=442 a2=1b6 a3=b5e6fcfc items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1350111180.586:3207): avc:  denied  { write } for  pid=2376 comm="httpd" name="cache" dev=dm-2 ino=11012856 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.586:3207): arch=40000003 syscall=10 success=no exit=-13 a0=b5ef0e64 a1=3234 a2=b776cad8 a3=b5ef0e64 items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1350111180.586:3208): avc:  denied  { write } for  pid=2376 comm="httpd" name="logs" dev=dm-2 ino=11012903 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.586:3208): arch=40000003 syscall=5 success=no exit=-13 a0=b5e6b9a0 a1=442 a2=1b6 a3=b5e6b9a0 items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1350111180.586:3209): avc:  denied  { write } for  pid=2376 comm="httpd" name="cache" dev=dm-2 ino=11012856 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.586:3209): arch=40000003 syscall=5 success=no exit=-13 a0=b5f05f5c a1=241 a2=1b6 a3=b5f05f5c items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1350111180.587:3210): avc:  denied  { write } for  pid=2376 comm="httpd" name="logs" dev=dm-2 ino=11012903 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.587:3210): arch=40000003 syscall=5 success=no exit=-13 a0=b5e6d9d0 a1=442 a2=1b6 a3=b5e6d9d0 items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1350111180.587:3211): avc:  denied  { write } for  pid=2376 comm="httpd" name="logs" dev=dm-2 ino=11012903 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.587:3211): arch=40000003 syscall=5 success=no exit=-13 a0=b5e6d9d0 a1=442 a2=1b6 a3=b5e6d9d0 items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1350111180.587:3212): avc:  denied  { write } for  pid=2376 comm="httpd" name="logs" dev=dm-2 ino=11012903 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.587:3212): arch=40000003 syscall=5 success=no exit=-13 a0=b5e6d9d0 a1=442 a2=1b6 a3=b5e6d9d0 items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1350111180.588:3213): avc:  denied  { write } for  pid=2376 comm="httpd" name="cache" dev=dm-2 ino=11012856 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.588:3213): arch=40000003 syscall=10 success=no exit=-13 a0=b5ef0e64 a1=3430 a2=b776cad8 a3=b5ef0e64 items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1350111180.588:3214): avc:  denied  { write } for  pid=2376 comm="httpd" name="logs" dev=dm-2 ino=11012903 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.588:3214): arch=40000003 syscall=5 success=no exit=-13 a0=b5e6d9d0 a1=442 a2=1b6 a3=b5e6d9d0 items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1350111180.592:3215): avc:  denied  { write } for  pid=2376 comm="httpd" name="cache" dev=dm-2 ino=11012856 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.592:3215): arch=40000003 syscall=10 success=no exit=-13 a0=b5ef0e64 a1=3234 a2=b776cad8 a3=b5ef0e64 items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1350111180.592:3216): avc:  denied  { write } for  pid=2376 comm="httpd" name="logs" dev=dm-2 ino=11012903 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.592:3216): arch=40000003 syscall=5 success=no exit=-13 a0=b5e6af14 a1=442 a2=1b6 a3=b5e6af14 items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1350111180.593:3217): avc:  denied  { write } for  pid=2376 comm="httpd" name="cache" dev=dm-2 ino=11012856 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.593:3217): arch=40000003 syscall=10 success=no exit=-13 a0=b5ef0e64 a1=3234 a2=b776cad8 a3=b5ef0e64 items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1350111180.593:3218): avc:  denied  { write } for  pid=2376 comm="httpd" name="logs" dev=dm-2 ino=11012903 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.593:3218): arch=40000003 syscall=5 success=no exit=-13 a0=b5e6aaf0 a1=442 a2=1b6 a3=b5e6aaf0 items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1350111180.594:3219): avc:  denied  { write } for  pid=2376 comm="httpd" name="cache" dev=dm-2 ino=11012856 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.594:3219): arch=40000003 syscall=5 success=no exit=-13 a0=b5f05f5c a1=241 a2=1b6 a3=b5f05f5c items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)

I just reinstalled my Windows OS 7 and forgot to backup my Email Certificate for Outlook 2010 beforehand. Now I can't read any encrypted emails. When I try, it says "Cannot open this item. Your Digital ID name cannot be found by the underlying security system."

The certificate was issued by our internal Windows Certificate Authority and I can see it still in there but I don't suppose there is any way to import it back into my computer or any other way to read those encrypted emails?

The certificate is also in the GAL if that makes any difference but I just tried to export it and no PFX option :(

I have a very simple script to log when new files are created, in fact, for test purposes I told it to watch for any event.

#!/bin/sh                               

WATCHED_DIR="/var/www/html/magento/media/tmp/catalog/product"

echo "Watching directory: $WATCHED_DIR for events"
inotifywait -m -q -r "$WATCHED_DIR" --format "%|e %w%f" |
  while read resp
  do 
    echo "$resp" >> watcher.log
  done

when i create a file within the watch directory, it reacts and logs

CREATE /var/www/html/magento/media/tmp/catalog/product/2/1/new file
OPEN /var/www/html/magento/media/tmp/catalog/product/2/1/new file
CLOSE_WRITE|CLOSE /var/www/html/magento/media/tmp/catalog/product/2/1/new file
OPEN /var/www/html/magento/media/tmp/catalog/product/2/1/new file
CLOSE_NOWRITE|CLOSE /var/www/html/magento/media/tmp/catalog/product/2/1/new file
OPEN|ISDIR /var/www/html/magento/media/tmp/catalog/product/2/1
OPEN|ISDIR /var/www/html/magento/media/tmp/catalog/product/2/1/
OPEN /var/www/html/magento/media/tmp/catalog/product/2/1/new file
CLOSE_NOWRITE|CLOSE /var/www/html/magento/media/tmp/catalog/product/2/1/new file
CLOSE_NOWRITE|CLOSE|ISDIR /var/www/html/magento/media/tmp/catalog/product/2/1
CLOSE_NOWRITE|CLOSE|ISDIR /var/www/html/magento/media/tmp/catalog/product/2/1/
OPEN /var/www/html/magento/media/tmp/catalog/product/2/1/new file
CLOSE_NOWRITE|CLOSE /var/www/html/magento/media/tmp/catalog/product/2/1/new file
OPEN /var/www/html/magento/media/tmp/catalog/product/2/1/new file
CLOSE_NOWRITE|CLOSE /var/www/html/magento/media/tmp/catalog/product/2/1/new file

but when apache creates a file, nothing is logged

The only difference I can spot is when apache creates the file, the file is owned by apache, where as when i create the file, it is owned by root.

-rwxrwxrwx. 1 apache apache 55659 Feb 11 16:46 2164.jpg
-rw-rw-r--. 1 root   root       0 Feb 11 17:02 new file

The watcher script is run as root.

F S   UID   PID  PPID  C PRI  NI ADDR SZ WCHAN  TTY          TIME CMD
0 S     0 29137  2705  0  80   0 - 26538 wait   pts/14   00:00:00 test.sh
1 S     0 29139 29137  0  80   0 - 26538 pipe_w pts/14   00:00:00 test.sh

Does anyone know the solution?

Running: CentOS6 x64

When I restart httpd, I get the following error. What am I missing?

[root@localhost ~]# service httpd restart
Stopping httpd:                                            [  OK  ]
Starting httpd: Syntax error on line 22 of /etc/httpd/conf.d/sites.conf:
Invalid command 'SSLEngine', perhaps misspelled or defined by a module not included in the server configuration

I have installed mod_ssl using yum install mod_ssl

Package 1:mod_ssl-2.2.15-15.el6.centos.x86_64 already installed and latest version

My sites.conf looks like this

<VirtualHost *:80>
#    ServerName shop.itmanx.com
    ServerAdmin [email protected]

    DocumentRoot /var/www/html/magento
    <Directory /var/www/html>
        Options -Indexes
        AllowOverride All
    </Directory>

    ErrorLog logs/shop-error.log
    CustomLog logs/shop-access.log
</VirtualHost>

<VirtualHost *:443>
    ServerName secure.itmanx.com
    ServerAdmin [email protected]

    SSLEngine on
    SSLCertificateFile /etc/httpd/ssl/secure.itmanx.com/server.crt
    SSLCertificateKeyFile /etc/httpd/ssl/secure.itmanx.com/server.key
    SSLCertificateChainFile /etc/httpd/ssl/secure.itmanx.com/chain.crt

    DocumentRoot /var/www/html/magento
    <Directory /var/www/html>
        Options -Indexes
        AllowOverride All
    </Directory>

    ErrorLog logs/shop-ssl-error.log
    CustomLog logs/shop-ssl-access.log    
</VirtualHost>