This is my first time posting on this forum. I have been using fedora for quite some time now and am a big fan of the distro- cheers!
Just want to report some discrepancies with strongswan/ipsec on Fedora 30. Not sure if this has already been addressed in fedora-31…
Recently installed strongswan on Fedora30- xfce to connect to my VPN provider using ipsec/ikev2. The binary installs as /usr/sbin/strongswan. The “strongswan” command starts ipsec and the VPN connections. Everything finally worked, but there appears to be potential for confusion…
If I view the manpages for strongswan, it references the “ipsec” command instead of the “strongswan” command! In other distros like Debian and Arch, the “ipsec” command indeed controls the strongswan package, but not in fedora! In fedora, it is “strongswan” command. There is no reference to this in the manpage…
Also the config files for strongswan in fedora are in the /etc/strongswan/ directory. In other distros it is in /etc . Manpages refer to config files in /etc (and not /etc/strongswan/ ,like it should be).
Also, in the fedora-xfce spin, the “ipsec” command actually links to what appears to be the legacy “openswan” package. The config files for openswan is located in /etc/, which adds to the confusion.
Until one figures out that the “strongswan” command controls strongswan/ipsec and that the config files are in /etc/strongswan/, there is a lot of confusion between strongswan and openswan. Leads to a lot of frustration …
Has anyone else experienced this? Just wanted to bring this to the community’s attention…
I don’t know anything in particular about strongswan. But if the manual pages and the actual implementation differ, I think it is worth a bugzilla . If the packager has changed the installation from the default, possibly in order to follow the Fedora packaging guidelines, then the manual pages should also be adjusted accordingly.
Thank you. I was wondering what I was doing wrong. Both the fact that the ipsec executable has been renamed to strongswan and the config has been moved to /etc/strongswan/ should definitely be better documented.
Strongswan on Fedora uses strongswan instead of ipsec throughout. I’m not the maintainer so I can’t tell for certain, but the reason most likely is that Fedora’s default ipsec implementation is libreswan, which uses the ipsec name, and since the two are very different, strongswan can’t just provide the ipsec binary.
Anyway, the man pages should agree with the actually installed software, so by all means, file a bugzilla ticket about this.
For reference:
main binary: /usr/sbin/strongswan
other binaries: /usr/libexecdir/strongswan/*
config: /etc/strongswan/*
libraries: /usr/lib/strongswan/*
systemd service: strongswan
…
