Installing FreeS/WAN

Some Linux distributions, listed in the introduction, ship with FreeS/WAN included. If you are using one of them, you need not perform a FreeS/WAN installation. That should all be done for you already. All you have to do is:

Users of such distributions can skip ahead to our section on setting up FreeS/WAN.

Unfortunately, due to export laws restricting distribution of strong cryptography, not all distributions include FreeS/WAN. Moreover, the standard kernel does not include the kernel parts of FreeS/WAN. Many people will need to install FreeS/WAN, including patching and rebuilding their kernel.

Before starting the install

Configure, compile, install, and test a Linux kernel, without FreeS/WAN.

If you have not done this before, you will need to read the Kernel HowTo.

Choosing a kernel

2.2.x for most users

Most users should run the latest production version of the Linux kernel. At time of writing (September 2000), that is 2.2.17.

2.0.x should still work

In the older 2.0.x kernel series, we no longer support versions earlier than 2.0.38. 2.0.38 has fixes for a number of small security-related glitches, worth having on a security gateway machine.

Recent versions of FreeS/WAN are not heavily tested on 2.0 kernels. Most of both the development team and the user community are on 2.2 by now.

Development kernels

In the usual Linux convention, production kernels have an even second digit in the version number (2.0, 2.2, 2.4) and development kernels have an odd digit there (2.1, 2.3, 2.5).

Development kernels are not intended for production use. They change often and include new code which has not yet been thoroughly tested. This regularly breaks things. Fortunately we have a user who almost equally regularly fixes them (merci, Marc), and we fix some ourselves. However you will quite often need the latest patches, so if you are going to test FreeS/WAN with a development kernel, we recommend you use our latest snapshot.

At time of writing, there is a bit of an anomaly in the numbering. No more 2.3 kernels are being produced. The current development kernel is called 2.4-test7.

Our code does run on (at least the Intel architecture version of) several of the 2.4-test series, and we will patch it for later versions. We want to be ready when a final 2.4.0 is released. In the meanwhile, however, we would recommend 2.4-test kernels only for experimentation, not for actual use.

Getting kernel source

If you have a CD distribution of Linux, it should include kernel source. Use your distribution's tools to load:

If you CD is not recent, it may have an older kernel, in which case we suggest you load tools from the CD but get recent kernel source from the net.

There are many sources on the net for Linux kernels. All the major distribution vendors provide them. See for example:

For kernels direct from Linus, without any distribution vendor's modifications, see the kernel.org mirror list, or go directly to ftp.<your country>.kernel.org, with the appropriate two-letter country code inserted.

For any of these, choose a mirror that is close to you and bookmark it.

Using a kernel from your distribution vendor may save you some annoyance later.

Kernel source normally resides in /usr/src/linux, whether you load it from a distribution CD or download a tar file into /usr/src and untar it there.

We suggest the same procedure for FreeS/WAN. Put the tarfile under /usr/src. You will get a directory /usr/src/freeswan<version> when you untar.

Note that these methods don't work:

Kernel configuration

You need to configure the gateway kernels because some of our utilities rely on the results of configuration. This is done by giving one of the following commands in /usr/src/linux:

make config
command-line interface
make menuconfig
text menus (requires curses(3) libraries)
make xconfig
using the X window system (requires X, not recommended for gateways)

Any of these wiil do the job. If you have no established preference, we suggest trying menuconfig.

For more information on configuring your kernel, see our section on that topic.

Install and test a kernel before adding FreeS/WAN

You should compile, install and test the kernels as you have configured them, so that you have a known stable starting point. The series of commands involved is usually something like:

make menuconfig
choose kernel options, set up a kernel for your machine
make dep
find dependencies between files
make bzImage
build a loadable kernel image, compressed with bzip(1)
make install
install it
make modules
build modules which can be added to a running kernel
make modules_install
install them
lilo
ensure that the boot loader sees your changes

Doing this first means that if there is a problem after you add FreeS/WAN, tracking it down is much simpler.

If you need advice on this process, or general Linux background information, try our Linux web references. The most directly relevant document is the Kernel HowTo.

Building and installing the software

There are several ways to build and install the software. All of them:

You can do the whole install with two commands (recommended in most cases) or get into as much of the detail as you like.

Everything but kernel installation

To do everything except install the new kernel, cd into the freeswan directory and become root. Give any one of the following commands:

make oldgo
Uses FreeS/WAN's default settings for some kernel configuration options. Leaves all other options unchanged from your last kernel configuration.
make ogo
Invokes config so you can configure the kernel from the command line.
make menugo
Invokes menuconfig so you can configure the kernel with text-mode menus.
make xgo
Invokes xconfig so you can configure the kernel in an X window.

You must save the new configuration even if you make no changes. This ensures that the FreeS/WAN changes are actually seen by the system.

Our scripts save the output of make commands they call in files with names like out.kbuild or out.kinstall. The last command of each script checks the appropriate out.* file for error messages.

These scripts automatically build an RSA authentication key pair (a public key and the matching private key) for you, and put the result in /etc/ipsec.secrets. For information on using RSA authentication, see our configuration section. Here, we need only note that generating the key uses random(4) quite heavily and if random(4) runs out of randomness, it will block until it has enough input. You may need to provide input by moving the mouse around a lot, or going to another window and typing random characters, or using some command such as du -s /usr to generate disk activity.

Installing the new kernel

To install the kernel the easy way, just give this command in the FreeS/WAN directory:

make kinstall
Installs the new kernel and, if required, the modules to go with it.

Using that from the FreeS/WAN directory is equivalent to giving the following sequence of commands in /usr/src/linux:

If you prefer that sequence, use it instead.

If you have some unusual setup such that the above sequence of commands won't work on your system, then our make kinstall will not work either. Use whatever method does work on your system. See our implementation notes file for additional information that may help in such situations.

Make sure Lilo knows about the new kernel

Check your lilo.conf(5) file to ensure it points to the right kernel, then run lilo(8) to read lilo.conf(5) and set up the bootloader.

Testing to see if install succeeded

To check that you have a sucessful install, you can reboot and check (by watching messages during boot or by looking at them later with dmesg(8)) that:

You can also try the commands:

Of course any status information at this point should be uninteresting since you have not yet configured connections.

Links to other sections

See the following section for information on configuring connections.

Aleternately, you might want to look at background material on the protocols used before trying configuration.