Transition to the new "modern" style Strongswan / How do you start the daemon?

[hytron00]

Hello,

I have been using Strongswan for many years now, and all is working great using the "old" ipsec model of commands. Recently I saw that the command set is moving to the new "modern" style (even though I dont know why as the current one that I am using is working so well and reliable) I am unable to get it to start, or I am missing something?

Currently and what I am using right now, you need /etc/ipsec.conf, /etc/ipsec.secrets configured properly and execute /usr/sbin/ipsec start and boom you are up and running in no time!

With the new set of commands, I have converted my current /etc/ipsec.conf and /etc/ipsec.secets to the new style /etc/swanctl/conf.d/swanctl.conf. The main question is...How do you start it? What is the replacement for "ipsec start" ? I have been looking through documentation and nowhere was mentioned (except the use of systemd - not all systems have systemd and I dont even know what it is)? Am I missing something?

Once you remove /etc/ipsec.conf and /etc/ipsec.secrets the command "ipsec start" will no longer work as it is looking for the "old" files.

/usr/sbin/swanctl with any options gives me connection refused (Because the daemon is not running).

I am running Slackware Linux 15.0 - Slackware does not have systemd.

I appreciate any help!

[strongX509]

Usually the strongSwan charon daemon is automatically started by systemd during the boot process. The strongswan.service has to be enabled and started for the first time with:

sudo systemctl enable --now strongswan.service

IPsec connections are managed by the swanctl command. E.g. swanctl --initiate --child <connection> for starting a connection or swanctl --terminate --ike <connection> for terminating the connection. For more details on the use of the swanctl command refer to the documentation

[hytron00]

Hello strongX509,

Thank you for the reply. I am using Slackware Linux (The oldest true UNIX-alike version of Linux) and Slackware does not use systemd. All current daemons run fine without use of systemd. Honestly I dont even know what systemd is, just read some things about it, and I dont even see the use for it, but apparently something that is part of some Linux distributions.

Just like the way I start it right now:

/usr/sbin/ipsec start

which started the following:

root 1843 0.0 0.0 5192 2168 ? Ss Apr24 0:00 /usr/libexec/ipsec/starter --daemon charon
root 1844 0.0 0.2 1125140 8228 ? Ssl Apr24 0:22 /usr/libexec/ipsec/charon --use-syslog

(the charon process forks in the background). I have been using this way for years and that was the preferred method until now. But with the change that Strongswan is implementing, how can I start the main Strongswan daemon with the new set of commands (swanctl)? Using just swanctl command gives me "Connection refused", so it is looking for a daemon that has to be started before swanctl can be used.

In simple words: What is the name of executable that executes when this command is invoked: sudo systemctl enable --now strongswan.service?

Thank you,
Darko

[tobiasbrunner]

You can continue to use the charon daemon (you don't technically need the starter daemon or the ipsec script, though, but you could use them as well). But what you do require to use swanctl is the vici plugin, which opens the socket that the tool connects to.