Entering the PIN code

Since the smartcard signing operation needed to sign the hash with the RSA private key during IKE Main Mode is protected by a PIN code, the secret PIN must be made available to Pluto.

For gateways that must be able to start IPsec tunnels automatically in unattended mode after a reboot, the secret PIN can be stored statically in ipsec.secrets

or with the general notation

or alternatively

On a personal notebook computer that could get stolen, you wouldn't want to store your PIN in ipsec.secrets.

Thus the alternative form

will prompt you for the PIN when you start up the first IPsec connection using the command

The ipsec up command calls the whack function which in turn communicates with Pluto over a socket. Since the whack function call is executed from a command window, Pluto can prompt you for the PIN over this socket connection. Unfortunately roadwarrior connections which just wait passively for peers cannot be initiated via the command window:

But if there is a corresponding entry

in ipsec.secrets, then the standard command

or the alias

can be used to enter the PIN code for this connection interactively. The command

can be executed at any time to check the current status of the PIN code[s].
PIN-pad equipped smartcard readers¶

Smartcard readers with an integrated PIN pad offer an increased security level because the PIN entry cannot be sniffed on the host computer e.g. by a surrepticiously installed key logger. In order to tell pluto not to prompt for the PIN on the host itself, the entry

can be used in ipsec.secrets. Because the key pad does not cache the PIN in the smartcard reader, it must be entered for every PKCS #11 session login. By default pluto does a session logout after every RSA signature. In order to avoid the repeated entry of the PIN code during the periodic IKE main mode rekeyings, the following parameter can be set in the config setup section of ipsec.conf:

The default setting is