ipsec-tools/racoon/racoon.8

   1 .\" $Id: racoon.8,v 1.3.10.1 2005/04/18 11:10:55 manubsd Exp $
   2 .\"
   3 .\" Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
   4 .\" All rights reserved.
   5 .\"
   6 .\" Redistribution and use in source and binary forms, with or without
   7 .\" modification, are permitted provided that the following conditions
   8 .\" are met:
   9 .\" 1. Redistributions of source code must retain the above copyright
  10 .\"    notice, this list of conditions and the following disclaimer.
  11 .\" 2. Redistributions in binary form must reproduce the above copyright
  12 .\"    notice, this list of conditions and the following disclaimer in the
  13 .\"    documentation and/or other materials provided with the distribution.
  14 .\" 3. Neither the name of the project nor the names of its contributors
  15 .\"    may be used to endorse or promote products derived from this software
  16 .\"    without specific prior written permission.
  17 .\"
  18 .\" THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  19 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  20 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  21 .\" ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  22 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  23 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  24 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  25 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  26 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  27 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  28 .\" SUCH DAMAGE.
  29 .\"
  30 .Dd November 20, 2000
  31 .Dt RACOON 8
  32 .Os
  33 .\"
  34 .Sh NAME
  35 .Nm racoon
  36 .Nd IKE (ISAKMP/Oakley) key management daemon
  37 .\"
  38 .Sh SYNOPSIS
  39 .Nm racoon
  40 .Bk -words
  41 .Op Fl 46BdFLv
  42 .Ek
  43 .Bk -words
  44 .Op Fl f Ar configfile
  45 .Ek
  46 .Bk -words
  47 .Op Fl l Ar logfile
  48 .Ek
  49 .Bk -words
  50 .Op Fl P Ar isakmp-natt-port
  51 .Ek
  52 .Bk -words
  53 .Op Fl p Ar isakmp-port
  54 .Ek
  55 .\"
  56 .Sh DESCRIPTION
  57 .Nm
  58 speaks the IKE
  59 .Pq ISAKMP/Oakley
  60 key management protocol,
  61 to establish security associations with other hosts.
  62 The SPD
  63 .Pq Security Policy Database
  64 in the kernel usually triggers
  65 .Nm .
  66 .Nm
  67 usually sends all informational messages, warnings and error messages to
  68 .Xr syslogd 8
  69 with the facility
  70 .Dv LOG_DAEMON
  71 and the priority
  72 .Dv LOG_INFO .
  73 Debugging messages are sent with the priority
  74 .Dv LOG_DEBUG .
  75 You should configure
  76 .Xr syslog.conf 5
  77 appropriately to see these messages.
  78 .Bl -tag -width Ds
  79 .It Fl 4
  80 .It Fl 6
  81 Specify the default address family for the sockets.
  82 .It Fl B
  83 Install SA(s) from the file which is specified in
  84 .Xr racoon.conf 5 .
  85 .It Fl d
  86 Increase the debug level.
  87 Multiple
  88 .Fl d
  89 arguments will increase the debug level even more.
  90 .It Fl F
  91 Run
  92 .Nm
  93 in the foreground.
  94 .It Fl f Ar configfile
  95 Use
  96 .Ar configfile
  97 as the configuration file instead of the default.
  98 .It Fl L
  99 Include
 100 .Ar file_name:line_number:function_name
 101 in all messages.
 102 .It Fl l Ar logfile
 103 Use
 104 .Ar logfile
 105 as the logging file instead of
 106 .Xr syslogd 8 .
 107 .It Fl P Ar isakmp-natt-port
 108 Use
 109 .Ar isakmp-natt-port
 110 for NAT-Traversal port-floating.
 111 The default is 4500.
 112 .It Fl p Ar isakmp-port
 113 Listen to the ISAKMP key exchange on port
 114 .Ar isakmp-port
 115 instead of the default port number, 500.
 116 .It Fl v
 117 This flag causes the packet dump be more verbose, with higher
 118 debugging level.
 119 .El
 120 .Pp
 121 .Nm
 122 assumes the presence of the kernel random number device
 123 .Xr rnd 4
 124 at
 125 .Pa /dev/urandom .
 126 .\"
 127 .Sh RETURN VALUES
 128 The command exits with 0 on success, and non-zero on errors.
 129 .\"
 130 .Sh FILES
 131 .Bl -tag -width /private/etc/racoon/remote/anonymous -compact
 132 .It Pa /private/etc/racoon/racoon.conf
 133 default configuration file.
 134 .It Pa /private/etc/racoon/psk.txt
 135 default pre-shared key file.
 136 .El
 137 .\"
 138 .Sh SEE ALSO
 139 .Xr ipsec 4 ,
 140 .Xr racoon.conf 5 ,
 141 .Xr syslog.conf 5 ,
 142 .Xr setkey 8 ,
 143 .Xr syslogd 8
 144 .\"
 145 .Sh HISTORY
 146 The
 147 .Nm
 148 command first appeared in the
 149 .Dq YIPS
 150 Yokogawa IPsec implementation.
 151 .\"
 152 .Sh SECURITY CONSIDERATIONS
 153 The use of IKE phase 1 aggressive mode is not recommended,
 154 as described in
 155 .Pa http://www.kb.cert.org/vuls/id/886601 .