Skip to content

Latest commit

 

History

History
478 lines (301 loc) · 10.7 KB

REFERENCE.md

File metadata and controls

478 lines (301 loc) · 10.7 KB

Reference

Table of Contents

Classes

Public Classes

Private Classes

  • strongswan::config: Manages Strongswan basic configuration
  • strongswan::package: This class manages Strongswan package installation
  • strongswan::params: Operating specific default parameters
  • strongswan::service: This class manages the Strongswan service

Defined types

Classes

strongswan

Installs and manages strongSwan

Parameters

The following parameters are available in the strongswan class:

package_name

Data type: Any

The strongswan package name.

Default value: 'strongswan'

package_ensure

Data type: Any

The desired package state. Can be used to install latest or a specific version etc.

Default value: 'installed'

service_name

Data type: Any

The strongswan service name.

Default value: $strongswan::params::service_name

service_ensure

Data type: Any

The desired ensure state for the service.

Default value: running

service_enable

Data type: Any

The desired enable state for the service.

Default value: true

ipsec_d_dir

Data type: Any

The directory for the ipsec configuration files. The default is operating system specific and you should not need to override this setting.

Default value: $strongswan::params::ipsec_d_dir

ipsec_conf

Data type: Any

The location of the ipsec.conf file. The default is operating system specific and you should not need to override this setting.

Default value: $strongswan::params::ipsec_conf

ipsec_secrets

Data type: Any

The location of the ipsec.secrets file. The default is operating system specific and you should not need to override this setting.

Default value: $strongswan::params::ipsec_secrets

charon_conf

Data type: Any

The location of the main charon.conf config file. WARNING, this option is not currently used.

Default value: $strongswan::params::charon_conf

strongswan::pki::ca

This class manages the Strongswan CA

Examples

Default CA configuration
include strongswan::pki::ca
Configure the CA with custom options
class {'strongswan::pki::ca':
  $common_name  => 'myVPN',
  $country_code => 'XX',
  $organization => 'myOrg',
}

Parameters

The following parameters are available in the strongswan::pki::ca class:

common_name

Data type: String[1]

The Certificate Authority Common Name (CN)

Default value: 'strongswanCA'

country_code

Data type: String[2]

The Certificate Authority Country Code (C)

Default value: 'GB'

organization

Data type: String[1]

The Certificate Authority Organization (O)

Default value: 'Strongswan'

strongswan::setup

Manages the Strongswan 'setup' section in ipsec.conf

Examples

Sample Usage
class { 'strongswan::setup':
  options => {
    'strictcrlpolicy' => 'yes',
    'uniqueids'       => 'never',
    }
  }
}

Parameters

The following parameters are available in the strongswan::setup class:

options

Data type: Hash

The hash of options to configure

Default value: {}

Defined types

strongswan::charon

Manage strongswan charon config files

Examples

Define file loggers in charon_log.conf file
strongswan::charon { 'log':
  options => {
    'filelog' => {
      '/var/log/strongswan.log' => {
        'time_format' => '%b %e %T',
        'ike_name'    => 'yes',
        'append'      => 'no',
        'default'     => '1',
        'flush_line'  => 'yes',
      },
      'stderr' => {
        'ike' => '2',
        'knl' => '2',
      },
    },
  },
}

Parameters

The following parameters are available in the strongswan::charon defined type:

options

Data type: Hash

charon options hash

Default value: {}

strongswan::charon::plugin

Configure charon plugin

Examples

enable plugin
strongswan::charon::plugin { 'eap-radius':
  options => {
    'load'   => 'yes',
    'secret' => '$ecRet',
  }
}
disable plugin
strongswan::charon::plugin { 'revocation':
  options => {
    'load' => 'no',
  }
}

Parameters

The following parameters are available in the strongswan::charon::plugin defined type:

options

Data type: Hash

plugin configuration options

Default value: {}

strongswan::conn

@example Configure IPsec-IKEv2 connection. strongswan::conn { 'IPsec-IKEv2': options => { 'rekey' => 'no', 'left' => '%any', 'leftsubnet' => '0.0.0.0/0', 'leftcert' => 'vpnHostCert.der', 'right' => '%any', 'rightdns' => '8.8.8.8,8.8.4.4', 'rightsourceip' => '10.10.10.0/24', 'auto' => 'add', } }

@example Configure IKEv2-EAP connection. strongswan::conn { 'IKEv2-EAP': options => { 'also' => 'IPSec-IKEv2', 'leftauth' => 'pubkey', 'leftsendcert' => 'always', 'rightauth' => 'eap-mschapv2', 'rightsendcert' => 'never', 'eap_identity' => '%any', }

Examples

Configure defaults for other connections
strongswan::conn { '%default':
  options => {
    'ike'         => 'aes128gcm128-prfsha256-ecp256!',
    'esp'         => 'aes128gcm128-ecp256!',
    'keyexchange' => 'ikev2',
    'ikelifetime' => '60m',
    'lifetime'    => '20m',
    'margintime'  => '3m',
    'closeaction' => 'restart',
    'dpdaction'   => 'restart',
  }
}

Parameters

The following parameters are available in the strongswan::conn defined type:

conn_name

Data type: String[1]

The name of the connection.

Default value: $title

options

Data type: Hash

A hash of configuration options for the connection.

Default value: {}

strongswan::pki::certificate

Manage strongswan certificates

Examples

Add a certificate
strongswan::pki::certificate {'server':
  common_name => 'myvpn.local',
  san         => ['@strongswan-1','strongswan-1','192.168.33.42', '@192.168.33.42']
}

Parameters

The following parameters are available in the strongswan::pki::certificate defined type:

common_name

Data type: String[1]

The certificate Common Name (CN)

Default value: $facts['networking']['fqdn']

country_code

Data type: String[2]

The certificate Country Code (C)

Default value: 'GB'

organization

Data type: String[1]

The certificate Organization (O)

Default value: 'Strongswan'

san

Data type: Array[String[1]]

An Array of Subject Alternative Names

Default value: ['localhost']

p12_password

Data type: Optional[String[1]]

An optional PKCS#12 password for the certificate

Default value: undef

strongswan::secrets

strongSwan secrets configuration.

Examples

Example 1
strongswan::secrets { '%any':
  options => {
    'RSA' => 'vpnHostKey.der keypass'
  }
}
Example 2
strongswan::secrets { 'John':
  options => {
    'EAP' => 'SuperSecretPass'
  }
}

Parameters

The following parameters are available in the strongswan::secrets defined type:

selectors

Data type: Array[String[1]]

List of selectors for current secret

Default value: [$title]

options

Data type: Hash

A hash of options to use with the secret

Default value: {}