6月 01 18:48:49 localhost.localdomain pluto[6380]: DH22 IKEv1: IKE ESP AH IKEv2: IKE ESP AH
6月 01 18:48:49 localhost.localdomain pluto[6380]: DH23 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS
6月 01 18:48:49 localhost.localdomain pluto[6380]: DH24 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS
6月 01 18:48:49 localhost.localdomain pluto[6380]: no crypto helpers will be started; all cryptographic operations will be done inline
6月 01 18:48:49 localhost.localdomain pluto[6380]: Using Linux XFRM/NETKEY IPsec interface code on 3.10.0-327.el7.x86_64
6月 01 18:48:49 localhost.localdomain pluto[6380]: | selinux support is enabled.
6月 01 18:48:49 localhost.localdomain pluto[6380]: systemd watchdog for ipsec service configured with timeout of 200000000 usecs
6月 01 18:48:49 localhost.localdomain pluto[6380]: watchdog: sending probes every 100 secs
6月 01 18:48:49 localhost.localdomain systemd[1]: Started Internet Key Exchange (IKE) Protocol Daemon for IPsec.
6月 01 18:48:49 localhost.localdomain systemd[1]: ipsec.service: main process exited, code=exited, status=1/FAILURE
[root@localhost ~]# ipsec verify
Verifying installed system and configuration files
Version check and ipsec on-path [OK]
Libreswan 3.25 (netkey) on 3.10.0-327.el7.x86_64
Checking for IPsec support in kernel [OK]
NETKEY: Testing XFRM related proc values
ICMP default/send_redirects [OK]
ICMP default/accept_redirects [OK]
XFRM larval drop [OK]
Pluto ipsec.conf syntax [OK]
Two or more interfaces found, checking IP forwarding [OK]
Checking rp_filter [OK]
Checking that pluto is running [FAILED]
Checking 'ip' command [OK]
Checking 'iptables' command [OK]
Checking 'prelink' command does not interfere with FIPS [OK]
Checking for obsolete ipsec.conf options [OK]
ipsec verify: encountered 2 errors - see 'man ipsec_verify' for help
[root@localhost ~]# systemctl status ipsec ● ipsec.service - Internet Key Exchange (IKE) Protocol Daemon for IPsec Loaded: loaded (/usr/lib/systemd/system/ipsec.service; enabled; vendor preset: disabled) Active: reloading (reload) (Result: exit-code) since 一 2020-06-01 18:48:49 CST; 10s ago Docs: man:ipsec(8) man:pluto(8) man:ipsec.conf(5) Process: 5303 ExecStopPost=/usr/sbin/ipsec --stopnflog (code=exited, status=0/SUCCESS) Process: 5301 ExecStopPost=/sbin/ip xfrm state flush (code=exited, status=0/SUCCESS) Process: 5300 ExecStopPost=/sbin/ip xfrm policy flush (code=exited, status=0/SUCCESS) Process: 4699 ExecStop=/usr/libexec/ipsec/whack --shutdown (code=exited, status=33) Process: 6380 ExecStart=/usr/libexec/ipsec/pluto --leak-detective --config /etc/ipsec.conf --nofork (code=exited, status=1/FAILURE) Process: 6368 ExecStartPre=/usr/sbin/ipsec --checknflog (code=exited, status=0/SUCCESS) Process: 6365 ExecStartPre=/usr/sbin/ipsec --checknss (code=exited, status=0/SUCCESS) Process: 6120 ExecStartPre=/usr/libexec/ipsec/_stackmanager start (code=exited, status=0/SUCCESS) Process: 6119 ExecStartPre=/usr/libexec/ipsec/addconn --config /etc/ipsec.conf --checkconfig (code=exited, status=0/SUCCESS) Main PID: 6380 (code=exited, status=1/FAILURE) Status: "Exited." Error: 1 (不允许的操作) Memory: 680.0K CGroup: /system.slice/ipsec.service
6月 01 18:48:49 localhost.localdomain pluto[6380]: DH22 IKEv1: IKE ESP AH IKEv2: IKE ESP AH 6月 01 18:48:49 localhost.localdomain pluto[6380]: DH23 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS 6月 01 18:48:49 localhost.localdomain pluto[6380]: DH24 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS 6月 01 18:48:49 localhost.localdomain pluto[6380]: no crypto helpers will be started; all cryptographic operations will be done inline 6月 01 18:48:49 localhost.localdomain pluto[6380]: Using Linux XFRM/NETKEY IPsec interface code on 3.10.0-327.el7.x86_64 6月 01 18:48:49 localhost.localdomain pluto[6380]: | selinux support is enabled. 6月 01 18:48:49 localhost.localdomain pluto[6380]: systemd watchdog for ipsec service configured with timeout of 200000000 usecs 6月 01 18:48:49 localhost.localdomain pluto[6380]: watchdog: sending probes every 100 secs 6月 01 18:48:49 localhost.localdomain systemd[1]: Started Internet Key Exchange (IKE) Protocol Daemon for IPsec. 6月 01 18:48:49 localhost.localdomain systemd[1]: ipsec.service: main process exited, code=exited, status=1/FAILURE [root@localhost ~]# ipsec verify Verifying installed system and configuration files
Version check and ipsec on-path [OK] Libreswan 3.25 (netkey) on 3.10.0-327.el7.x86_64 Checking for IPsec support in kernel [OK] NETKEY: Testing XFRM related proc values ICMP default/send_redirects [OK] ICMP default/accept_redirects [OK] XFRM larval drop [OK] Pluto ipsec.conf syntax [OK] Two or more interfaces found, checking IP forwarding [OK] Checking rp_filter [OK] Checking that pluto is running [FAILED] Checking 'ip' command [OK] Checking 'iptables' command [OK] Checking 'prelink' command does not interfere with FIPS [OK] Checking for obsolete ipsec.conf options [OK]
ipsec verify: encountered 2 errors - see 'man ipsec_verify' for help