IPSECKEY(1)

💖 IPSECKEY(1) 💖

Internet / DNS · bestie edition 🦋

---

✨ NAME ✨

ipseckey — the little icon that generates IPSECKEY records on your libreswan IPsec servers 💅

---

🎀 SYNTAX 🎀

ipseckey

That's it. That's the whole thing. No args, no drama, just vibes. 🫶

---

🌸 DESCRIPTION 🌸

okay so listen. ipseckey generates RFC-4025 IPSECKEY DNS records based on the public key of the IPsec server. Like, it looks at your key, and it's giving DNS record. iconic.

The IPsec software it fw: libreswan, and also some versions of openswan — but only depending on how that openswan implemented showhostkey. so like, ymmv, lowkey.

The record it displays will have the label of the hostname. That part is fully editable by hand if you want to switch it up. ✨

(TODO: allow specifying --hostname and allow --reverse for creating in-addr.arpa. entries) — not me exposing the roadmap but go off bestie 💀

---

💅 OPTIONS 💅

• -h / --help — spits out help info and dips. the classic.
• -v / --version — tells you the version and exits. short king behavior 👑

---

🍓 FILES 🍓

The NSS IPsec database lives in /etc/ipsec.d/*.db ✨

...or, for the older openswan crew that's running without NSS, it's /etc/ipsec.secrets 🎀

---

👑 REQUIREMENTS 👑

ipseckey MUST be run on the IPsec gateway itself, bestie. no remote. why? because unlike TLS, IPsec servers do not present their public RSA key to any client. it's giving mystery. it's giving unavailable. 😭

Currently, only libreswan IPsec is supported (https://libreswan.org) — although some versions of openswan might work as well. might. 🙈

You need root access, fr fr, because the public key is pulled from /etc/ipsec.secrets, and that file can contain secrets and is therefore only readable by root. (even though, with libreswan, ipsec.secrets doesn't actually contain any private RSA keys — but the permissions said no anyway 💀)

---

🦋 BUGS 🦋

Some other IPsec software is not yet supported. that's it. that's the bug. we're working on it (allegedly) 🌈

---

⭐ SEE ALSO ⭐

ipsec_showhostkey(8) and RFC-4025 — go read them, iykyk 💜

---

🧚 AUTHORS 🧚

Paul Wouters <pwouters@redhat.com> — absolute legend, main character energy 👑

---

🌈 COPYRIGHT 🌈

Copyright 2015 Paul Wouters

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License (file COPYING in the distribution) for more details.

not the ALL CAPS warranty disclaimer 😭 legally she is screaming but respectfully 💖

---

okay that's the whole page bestie, you're officially an IPSECKEY scholar now 🎓✨

Paul Wouters · January 5, 2015 · IPSECKEY(1) — mwah, go slay those DNS records 💅🫶