{"action":"created","issue":{"url":"https://api.github.com/repos/nm-l2tp/network-manager-l2tp/issues/101","repository_url":"https://api.github.com/repos/nm-l2tp/network-manager-l2tp","labels_url":"https://api.github.com/repos/nm-l2tp/network-manager-l2tp/issues/101/labels{/name}","comments_url":"https://api.github.com/repos/nm-l2tp/network-manager-l2tp/issues/101/comments","events_url":"https://api.github.com/repos/nm-l2tp/network-manager-l2tp/issues/101/events","html_url":"https://github.com/nm-l2tp/network-manager-l2tp/issues/101","id":391451673,"node_id":"MDU6SXNzdWUzOTE0NTE2NzM=","number":101,"title":"ipsec/l2tp cert auth backend","user":{"login":"foot3print","id":27106689,"node_id":"MDQ6VXNlcjI3MTA2Njg5","avatar_url":"https://avatars3.githubusercontent.com/u/27106689?v=4","gravatar_id":"","url":"https://api.github.com/users/foot3print","html_url":"https://github.com/foot3print","followers_url":"https://api.github.com/users/foot3print/followers","following_url":"https://api.github.com/users/foot3print/following{/other_user}","gists_url":"https://api.github.com/users/foot3print/gists{/gist_id}","starred_url":"https://api.github.com/users/foot3print/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/foot3print/subscriptions","organizations_url":"https://api.github.com/users/foot3print/orgs","repos_url":"https://api.github.com/users/foot3print/repos","events_url":"https://api.github.com/users/foot3print/events{/privacy}","received_events_url":"https://api.github.com/users/foot3print/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"dkosovic","id":2002761,"node_id":"MDQ6VXNlcjIwMDI3NjE=","avatar_url":"https://avatars0.githubusercontent.com/u/2002761?v=4","gravatar_id":"","url":"https://api.github.com/users/dkosovic","html_url":"https://github.com/dkosovic","followers_url":"https://api.github.com/users/dkosovic/followers","following_url":"https://api.github.com/users/dkosovic/following{/other_user}","gists_url":"https://api.github.com/users/dkosovic/gists{/gist_id}","starred_url":"https://api.github.com/users/dkosovic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dkosovic/subscriptions","organizations_url":"https://api.github.com/users/dkosovic/orgs","repos_url":"https://api.github.com/users/dkosovic/repos","events_url":"https://api.github.com/users/dkosovic/events{/privacy}","received_events_url":"https://api.github.com/users/dkosovic/received_events","type":"User","site_admin":false},"assignees":[{"login":"dkosovic","id":2002761,"node_id":"MDQ6VXNlcjIwMDI3NjE=","avatar_url":"https://avatars0.githubusercontent.com/u/2002761?v=4","gravatar_id":"","url":"https://api.github.com/users/dkosovic","html_url":"https://github.com/dkosovic","followers_url":"https://api.github.com/users/dkosovic/followers","following_url":"https://api.github.com/users/dkosovic/following{/other_user}","gists_url":"https://api.github.com/users/dkosovic/gists{/gist_id}","starred_url":"https://api.github.com/users/dkosovic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dkosovic/subscriptions","organizations_url":"https://api.github.com/users/dkosovic/orgs","repos_url":"https://api.github.com/users/dkosovic/repos","events_url":"https://api.github.com/users/dkosovic/events{/privacy}","received_events_url":"https://api.github.com/users/dkosovic/received_events","type":"User","site_admin":false}],"milestone":null,"comments":0,"created_at":"2018-12-16T09:58:19Z","updated_at":"2018-12-16T10:57:59Z","closed_at":null,"author_association":"NONE","body":"Hi,\r\n\r\nfirst i would like to thank you for your work. It is quite tricky configuring a linux client to use l2tp/ipsec and there are no gui to make it easier for end users. I am using ubuntu 18.04 to connect l2tp/ipsec with user and machine certs for the authentication.\r\n\r\nThis is rather a question than an issue. The current network-manager-l2tp supports l2tp/ipsec with cert authentication on the gnome networkmanager UI but not yet on the backend. Could you help me with the configs(ipsec, xl2tp) if I would connect my client with user and machine certs? I have added a couple of photos to show if I were to use the current network-manager-l2tp gnome UI with certs. I was thinking of ipsec.conf to be something like this:\r\n\r\nconn L2TP-CERT\r\n\tauthby=rsasig\r\n\tpfs=no\r\n\tleft=%defaultroute\r\n\tleftrsasigkey=%cert\r\n\tleftcert=/etc/ipsec.d/ssl/user-cert.pem\r\n\tleftprotoport=17/1701\r\n\tright=%any\r\n\trightrsasigkey=%cert\r\n\trightcert=????\r\n\trightprotoport=17/%any\r\n\tauto=add\r\n\tkeyingtries=3\r\n\toverlapip=yes\r\n\r\nbut I was confused where to put the machine certs for authentication as indicated on the Ipsec Settings (2nd Photo)\r\n\r\nCan you please help me on this?\r\n\r\nBest Regards,\r\n\r\n![pic0](https://user-images.githubusercontent.com/27106689/50052251-716c9200-0121-11e9-9fcc-468d2b9660cc.png)\r\n![pic2](https://user-images.githubusercontent.com/27106689/50052281-ce684800-0121-11e9-9f90-4662103bf074.png)"},"comment":{"url":"https://api.github.com/repos/nm-l2tp/network-manager-l2tp/issues/comments/447633893","html_url":"https://github.com/nm-l2tp/network-manager-l2tp/issues/101#issuecomment-447633893","issue_url":"https://api.github.com/repos/nm-l2tp/network-manager-l2tp/issues/101","id":447633893,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0NzYzMzg5Mw==","user":{"login":"dkosovic","id":2002761,"node_id":"MDQ6VXNlcjIwMDI3NjE=","avatar_url":"https://avatars0.githubusercontent.com/u/2002761?v=4","gravatar_id":"","url":"https://api.github.com/users/dkosovic","html_url":"https://github.com/dkosovic","followers_url":"https://api.github.com/users/dkosovic/followers","following_url":"https://api.github.com/users/dkosovic/following{/other_user}","gists_url":"https://api.github.com/users/dkosovic/gists{/gist_id}","starred_url":"https://api.github.com/users/dkosovic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dkosovic/subscriptions","organizations_url":"https://api.github.com/users/dkosovic/orgs","repos_url":"https://api.github.com/users/dkosovic/repos","events_url":"https://api.github.com/users/dkosovic/events{/privacy}","received_events_url":"https://api.github.com/users/dkosovic/received_events","type":"User","site_admin":false},"created_at":"2018-12-16T10:57:59Z","updated_at":"2018-12-16T10:57:59Z","author_association":"MEMBER","body":"`leftcert=` is the machine cert, not the user cert, it is sent to the VPN server. `rightcert=` doesn't need to be set, as the VPN server sends a different certificate to the client and can optionally be validated by the client with the Gateway ID, i.e. `rightid=`.\r\n\r\nThe user cert is for PPP (i.e. the xl2tpd part). I'm using the same terminology as what macOS and Windows use for machine and user certs with L2TP/IPsec connections.\r\n\r\nNetworkManager PKCS#11 support hasn't been released yet, it will provide an existing PKCS#11 hardware token or \"soft\" token/certificate store much like macOS or Windows do, see:\r\n* https://wiki.gnome.org/Projects/NetworkManager/PKCS11\r\n\r\nFor the GUI, I just implemented what NetworkManager-openvpn was doing with the certificates. I was hoping PKCS#11 support would have been released by now. As for your question, there is no standard location for the machine certs, it is up to the user.\r\n\r\nI'm close to completing the initial backend support. For the Libreswan and strongSwan machine certificate support, it supports PKCS#12 certificates, X.509 PEM and DER certs, PKCS#8 private keys as well as OpenSSL traditional RSA and ECDSA private keys. Now working on the user certificate support for the EAP TLS patch for pppd. For the Libreswan support, it imports certs and keys into a NSS database.\r\n\r\nMy main concern is that the OpenSSL license isn't compatible with the NetworkManager GPLv2 license, so have been dragging my feet waiting for the new OpenSSL Apache 2.0 license which is compatible. I will release the source code, but won't release any prebuilt binaries until the next OpenSSL version which has the  Apache 2.0 license."}}
{"actor":{"display_login":"dkosovic"}}