L2TP部署中ipsec verify出现问题的解决

来源：互联网发布：网络安全设备编辑：程序博客网时间：2024/06/05 19:27

L2TP部署中ipsec verify出现问题的解决

标签： L2TP

2015-05-30 02:12 1604人阅读评论(0) 收藏举报

 分类：
VPS（3） 

版权声明：本文为博主原创文章，未经博主允许不得转载。

运行环境：ubuntu 14.04 64位

首先，官方教程是必须的：

https://help.ubuntu.com/community/L2TPServer

没有安照这个做过了就先不要到处百度“如何部署L2TP”之类的了。先参阅Official Ubuntu Documentation。

主要的问题出在：

sudo ipsec verify

这一步。因为官方要求是得到一个没有任何错误的反馈。

在第一次测试的时候我出现了2个[FAILED]，具体情况如下：

Checking your system to see if IPsec got installed and started correctly:

Version check and ipsec on-path [OK]

Linux Openswan U2.6.38/K3.13.0-52-generic (netkey)

Checking for IPsec support in kernel [OK]

SAref kernel support [N/A]

NETKEY: Testing XFRM related proc values [FAILED]

Please disable /proc/sys/net/ipv4/conf/*/send_redirects

or NETKEY will cause the sending of bogus ICMP redirects!

[FAILED]

Please disable /proc/sys/net/ipv4/conf/*/accept_redirects

or NETKEY will accept bogus ICMP redirects!

[OK]

Hardware RNG detected, testing if used properly [FAILED]

Hardware RNG is present but 'rngd' or 'clrngd' is not running.

No harware random used!

Checking that pluto is running [OK]

Pluto listening for IKE on udp 500 [OK]

Pluto listening for NAT-T on udp 4500 [OK]

Checking for 'ip' command [OK]

Checking /bin/sh is not /bin/dash [WARNING]

Checking for 'iptables' command [OK]

Opportunistic Encryption Support [DISABLED]

我们先解决：

NETKEY: Testing XFRM related proc values [FAILED]

解决方案：在命令行里黏贴以下命令

for each in /proc/sys/net/ipv4/conf/*

> do

> echo 0 > $each/accept_redirects

> echo 0 > $each/send_redirects

> done

然后解决：

Hardware RNG detected, testing if used properly [FAILED]

Hardware RNG is present but 'rngd' or 'clrngd' is not running.

No harware random used!

解决方案：

sudo apt-get install rng-tools

0 0