Skip to content

Commit d03b20b

Browse files
strongX509strongX509
committed
Created rocky-strongswan docker image
1 parent 24e03c0 commit d03b20b

15 files changed

+246
-0
lines changed

‎rocky-strongswan/Dockerfile

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
FROM rockylinux
2+
MAINTAINER Andreas Steffen <[email protected]>
3+
4+
RUN \
5+
# install packages
6+
dnf install -y epel-release && \
7+
dnf makecache --refresh && dnf install -y strongswan
8+
# Expose IKE and NAT-T ports
9+
EXPOSE 500 4500

‎rocky-strongswan/caKey.pem

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
-----BEGIN EC PRIVATE KEY-----
2+
MIGkAgEBBDAjNX0721bMFzAxAkJBDgi0rZS42Z2f+ioWQL2gdVke1+/vuI6pvOs0
3+
ozsASY+GmOigBwYFK4EEACKhZANiAARpFOA0dr+prcP+aO8ev8Kvh/bQoeIbOVqs
4+
BeecOQNSdPv9gShYECiFiokU4565RzV2wiFdAU39VUs/4bJ/SlK7bvY3HuMDcjAR
5+
FXXZbtxXbdg1QlWk1alja3rVRaId6Hg=
6+
-----END EC PRIVATE KEY-----

‎rocky-strongswan/client/ecdsa/clientKey.pem

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
-----BEGIN EC PRIVATE KEY-----
2+
MIGkAgEBBDDkLe1KrVgC0FpshMBfagyVtPQ3kIemzZ3wXimPc0OTAIIV17nwul7b
3+
CPIuyJtn44ygBwYFK4EEACKhZANiAARRunfdxuvDneKS/OyDNhsHFBL+m1uT6tcK
4+
9NjMMvdKS7p2wm3ZQs5QXcVAVpIW6PSPiX/WTtlxJBHujg8T/lvs7UCIAT0co+ON
5+
SENyrHzaTj3k8MMX/+fGoP4QY46UMNQ=
6+
-----END EC PRIVATE KEY-----

‎rocky-strongswan/client/swanctl.conf

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
connections {
2+
3+
home {
4+
remote_addrs = 192.168.0.2
5+
6+
local {
7+
auth = pubkey
8+
certs = clientCert.pem
9+
id = client.strongswan.org
10+
}
11+
remote {
12+
auth = pubkey
13+
id = server.strongswan.org
14+
}
15+
children {
16+
net {
17+
remote_ts = 10.1.0.0/16
18+
19+
esp_proposals = aes256gcm128-ecp384
20+
rekey_time = 10m
21+
}
22+
}
23+
version = 2
24+
proposals = aes256-sha256-ecp384
25+
reauth_time = 15m
26+
mobike = no
27+
}
28+
}
29+

‎rocky-strongswan/client/x509/clientCert.pem

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIB/zCCAYWgAwIBAgIIBIWcaj4wj10wCgYIKoZIzj0EAwMwNTELMAkGA1UEBhMC
3+
Q0gxDjAMBgNVBAoTBUN5YmVyMRYwFAYDVQQDEw1DeWJlciBSb290IENBMB4XDTIy
4+
MDcyMTAzMDQwNVoXDTI2MDcyMTAzMDQwNVowPTELMAkGA1UEBhMCQ0gxDjAMBgNV
5+
BAoTBUN5YmVyMR4wHAYDVQQDExVjbGllbnQuc3Ryb25nc3dhbi5vcmcwdjAQBgcq
6+
hkjOPQIBBgUrgQQAIgNiAARRunfdxuvDneKS/OyDNhsHFBL+m1uT6tcK9NjMMvdK
7+
S7p2wm3ZQs5QXcVAVpIW6PSPiX/WTtlxJBHujg8T/lvs7UCIAT0co+ONSENyrHza
8+
Tj3k8MMX/+fGoP4QY46UMNSjWjBYMB8GA1UdIwQYMBaAFLjSYIqHz0jucV3YUSAj
9+
WsGq5feyMCAGA1UdEQQZMBeCFWNsaWVudC5zdHJvbmdzd2FuLm9yZzATBgNVHSUE
10+
DDAKBggrBgEFBQcDAjAKBggqhkjOPQQDAwNoADBlAjAMwc04NsXsXTY3JD41qyTs
11+
+K1zoozk66ifF60ESPaSL9YkWUkEe2eilg9vCKbfqEcCMQC/eCrNK03KPUV2CujQ
12+
Mr5TkJAVyIW/hhsajGLEL2IVSwL7eNeZrTzsUJrP6bByrpk=
13+
-----END CERTIFICATE-----

‎rocky-strongswan/client/x509ca/caCert.pem

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIB3zCCAWWgAwIBAgIIWWpjqeLZ9K8wCgYIKoZIzj0EAwMwNTELMAkGA1UEBhMC
3+
Q0gxDjAMBgNVBAoTBUN5YmVyMRYwFAYDVQQDEw1DeWJlciBSb290IENBMB4XDTIw
4+
MDMwOTEyMDIwOVoXDTMwMDMwOTEyMDIwOVowNTELMAkGA1UEBhMCQ0gxDjAMBgNV
5+
BAoTBUN5YmVyMRYwFAYDVQQDEw1DeWJlciBSb290IENBMHYwEAYHKoZIzj0CAQYF
6+
K4EEACIDYgAEaRTgNHa/qa3D/mjvHr/Cr4f20KHiGzlarAXnnDkDUnT7/YEoWBAo
7+
hYqJFOOeuUc1dsIhXQFN/VVLP+Gyf0pSu272Nx7jA3IwERV12W7cV23YNUJVpNWp
8+
Y2t61UWiHeh4o0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAd
9+
BgNVHQ4EFgQUuNJgiofPSO5xXdhRICNawarl97IwCgYIKoZIzj0EAwMDaAAwZQIw
10+
PR1T8MHS+aV9qSueIE9QfPRgEVyvuaz2g4q7DN51SUfypjYoAX+B6BqiR7vfgY2Y
11+
AjEA65R8XZy0N6LEYgAEPPbQSyCdJudoa4MwidaomSwwgiVDePN356onk/lhURmE
12+
QBaZ
13+
-----END CERTIFICATE-----

‎rocky-strongswan/docker-compose.yml

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
version: "3"
2+
3+
services:
4+
vpn-server:
5+
image: strongx509/rocky-linux:latest
6+
container_name: vpn-server
7+
cap_add:
8+
- NET_ADMIN
9+
- SYS_ADMIN
10+
- SYS_MODULE
11+
stdin_open: true
12+
tty: true
13+
volumes:
14+
- ./server:/etc/strongswan/swanctl
15+
- ./strongswan.conf:/etc/strongswan/strongswan.conf
16+
networks:
17+
internet:
18+
ipv4_address: 192.168.0.2
19+
intranet:
20+
ipv4_address: 10.1.0.2
21+
vpn-client:
22+
image: strongx509/rocky-linux:latest
23+
container_name: vpn-client
24+
depends_on:
25+
- vpn-server
26+
cap_add:
27+
- NET_ADMIN
28+
- SYS_ADMIN
29+
- SYS_MODULE
30+
stdin_open: true
31+
tty: true
32+
volumes:
33+
- ./client:/etc/strongswan/swanctl
34+
- ./strongswan.conf:/etc/strongswan/strongswan.conf
35+
networks:
36+
internet:
37+
ipv4_address: 192.168.0.3
38+
39+
networks:
40+
internet:
41+
ipam:
42+
driver: default
43+
config:
44+
- subnet: 192.168.0.0/24
45+
intranet:
46+
ipam:
47+
driver: default
48+
config:
49+
- subnet: 10.1.0.0/16

‎rocky-strongswan/scripts/gen_certs.sh

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
pki --gen --type ecdsa --size 384 --outform pem > caKey.pem
2+
3+
pki --self --type ecdsa --in caKey.pem --ca --lifetime 3652 \
4+
--dn "C=CH, O=Cyber, CN=Cyber Root CA" \
5+
--outform pem > caCert.pem
6+
7+
pki --gen --type ecdsa --size 384 --outform pem > serverKey.pem
8+
9+
pki --issue --cacert caCert.pem --cakey caKey.pem \
10+
--type ecdsa --in serverKey.pem --lifetime 1461 \
11+
--dn "C=CH, O=Cyber, CN=server.strongswan.org" \
12+
--san server.strongswan.org --flag serverAuth \
13+
--outform pem > serverCert.pem
14+
15+
pki --gen --type ecdsa --size 384 --outform pem > clientKey.pem
16+
17+
pki --issue --cacert caCert.pem --cakey caKey.pem \
18+
--type ecdsa --in clientKey.pem --lifetime 1461 \
19+
--dn "C=CH, O=Cyber, CN=client.strongswan.org" \
20+
--san client.strongswan.org --flag clientAuth \
21+
--outform pem > clientCert.pem

‎rocky-strongswan/scripts/gen_dirs.sh

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#! /bin/sh
2+
3+
for dir in client server
4+
do
5+
cd $dir
6+
mkdir -p bliss pkcs12 pkcs8 private pubkey rsa x509aa x509ac x509crl x509ocsp
7+
cd ..
8+
done

‎rocky-strongswan/scripts/renew_certs.sh

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
pki --gen --type ecdsa --size 384 --outform pem > serverKey.pem
2+
3+
pki --issue --cacert caCert.pem --cakey caKey.pem \
4+
--type ecdsa --in serverKey.pem --lifetime 1461 \
5+
--dn "C=CH, O=Cyber, CN=server.strongswan.org" \
6+
--san server.strongswan.org --flag serverAuth \
7+
--outform pem > serverCert.pem
8+
9+
pki --gen --type ecdsa --size 384 --outform pem > clientKey.pem
10+
11+
pki --issue --cacert caCert.pem --cakey caKey.pem \
12+
--type ecdsa --in clientKey.pem --lifetime 1461 \
13+
--dn "C=CH, O=Cyber, CN=client.strongswan.org" \
14+
--san client.strongswan.org --flag clientAuth \
15+
--outform pem > clientCert.pem

‎rocky-strongswan/server/ecdsa/serverKey.pem

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
-----BEGIN EC PRIVATE KEY-----
2+
MIGkAgEBBDDpohH7Pq5abXcTYtfa8Y1bEv2JWjGVnzZnkbcXbas2ZlB5bf43vxJ2
3+
8FP4XmLVkySgBwYFK4EEACKhZANiAAQSeu5884G2ZeQMK60f8mLyFrqn3I8hFxtu
4+
BhdsX+YGh24cimdOaLwQIGlNHgqusKcBnhOolAfe1YhOqZ8PjRctaopintt1qarF
5+
A3WGboXMT3MiclUhERdudlk9ATNeg1E=
6+
-----END EC PRIVATE KEY-----

‎rocky-strongswan/server/swanctl.conf

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
connections {
2+
3+
rw {
4+
local {
5+
auth = pubkey
6+
certs = serverCert.pem
7+
id = server.strongswan.org
8+
}
9+
remote {
10+
auth = pubkey
11+
cacerts = caCert.pem
12+
}
13+
children {
14+
net {
15+
local_ts = 10.1.0.0/24
16+
17+
esp_proposals = aes256gcm128-ecp384
18+
rekey_time = 10m
19+
dpd_action = trap
20+
}
21+
}
22+
version = 2
23+
proposals = aes256-sha256-ecp384
24+
reauth_time = 15m
25+
dpd_delay = 60s
26+
mobike = no
27+
}
28+
}
29+

‎rocky-strongswan/server/x509/serverCert.pem

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIB/jCCAYWgAwIBAgIIcU8jP3aAjFgwCgYIKoZIzj0EAwMwNTELMAkGA1UEBhMC
3+
Q0gxDjAMBgNVBAoTBUN5YmVyMRYwFAYDVQQDEw1DeWJlciBSb290IENBMB4XDTIy
4+
MDcyMTAzMDQwNVoXDTI2MDcyMTAzMDQwNVowPTELMAkGA1UEBhMCQ0gxDjAMBgNV
5+
BAoTBUN5YmVyMR4wHAYDVQQDExVzZXJ2ZXIuc3Ryb25nc3dhbi5vcmcwdjAQBgcq
6+
hkjOPQIBBgUrgQQAIgNiAAQSeu5884G2ZeQMK60f8mLyFrqn3I8hFxtuBhdsX+YG
7+
h24cimdOaLwQIGlNHgqusKcBnhOolAfe1YhOqZ8PjRctaopintt1qarFA3WGboXM
8+
T3MiclUhERdudlk9ATNeg1GjWjBYMB8GA1UdIwQYMBaAFLjSYIqHz0jucV3YUSAj
9+
WsGq5feyMCAGA1UdEQQZMBeCFXNlcnZlci5zdHJvbmdzd2FuLm9yZzATBgNVHSUE
10+
DDAKBggrBgEFBQcDATAKBggqhkjOPQQDAwNnADBkAjA0x/9mckjUi2FbNBr/+U9F
11+
Ko6+2E11e6Bj9fc6aiwmblLdUrO5UfcC3HciHlHI7NQCMEgevkGwceM9XFebtP4A
12+
5ER/60lvkoJ1L5rvU7S91F07rMRB49iadEUb7JqqOaFxeQ==
13+
-----END CERTIFICATE-----

‎rocky-strongswan/server/x509ca/caCert.pem

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIB3zCCAWWgAwIBAgIIWWpjqeLZ9K8wCgYIKoZIzj0EAwMwNTELMAkGA1UEBhMC
3+
Q0gxDjAMBgNVBAoTBUN5YmVyMRYwFAYDVQQDEw1DeWJlciBSb290IENBMB4XDTIw
4+
MDMwOTEyMDIwOVoXDTMwMDMwOTEyMDIwOVowNTELMAkGA1UEBhMCQ0gxDjAMBgNV
5+
BAoTBUN5YmVyMRYwFAYDVQQDEw1DeWJlciBSb290IENBMHYwEAYHKoZIzj0CAQYF
6+
K4EEACIDYgAEaRTgNHa/qa3D/mjvHr/Cr4f20KHiGzlarAXnnDkDUnT7/YEoWBAo
7+
hYqJFOOeuUc1dsIhXQFN/VVLP+Gyf0pSu272Nx7jA3IwERV12W7cV23YNUJVpNWp
8+
Y2t61UWiHeh4o0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAd
9+
BgNVHQ4EFgQUuNJgiofPSO5xXdhRICNawarl97IwCgYIKoZIzj0EAwMDaAAwZQIw
10+
PR1T8MHS+aV9qSueIE9QfPRgEVyvuaz2g4q7DN51SUfypjYoAX+B6BqiR7vfgY2Y
11+
AjEA65R8XZy0N6LEYgAEPPbQSyCdJudoa4MwidaomSwwgiVDePN356onk/lhURmE
12+
QBaZ
13+
-----END CERTIFICATE-----

‎rocky-strongswan/strongswan.conf

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# strongSwan configuration file
2+
3+
charon {
4+
load = random nonce pem x509 openssl constraints pki socket-default kernel-netlink vici swanctl resolve
5+
6+
start-scripts {
7+
creds = swanctl --load-creds
8+
conns = swanctl --load-conns
9+
}
10+
filelog {
11+
stderr {
12+
default = 1
13+
}
14+
}
15+
# make_before_break = yes
16+
}

0 commit comments

Comments
 (0)