diff --git a/docs/ikev2-howto-zh.md b/docs/ikev2-howto-zh.md index 14f8157..55ec4b3 100644 --- a/docs/ikev2-howto-zh.md +++ b/docs/ikev2-howto-zh.md @@ -129,7 +129,7 @@ To customize IKEv2 or client options, run this script without arguments. 另外，你也可以手动创建 VPN 连接。详细步骤请看 这里。如果你在配置 IKEv2 时指定了服务器的域名（而不是 IP 地址），则必须在 **Internet地址** 字段中输入该域名。 -1. 为 IKEv2 启用更强的加密算法，通过修改一次注册表来实现。这一步是可选的，但推荐。请下载并导入下面的 `.reg` 文件，或者打开提升权限命令提示符并运行以下命令。更多信息请看 这里。 +1. （**此步骤为必须**，如果你手动创建了 VPN 连接）为 IKEv2 启用更强的加密算法，通过修改一次注册表来实现。请下载并导入下面的 `.reg` 文件，或者打开提升权限命令提示符并运行以下命令。更多信息请看 这里。 - 适用于 Windows 7, 8.x 和 10 ([下载 .reg 文件](https://dl.ls20.com/reg-files/v1/Enable_Stronger_Ciphers_for_IKEv2_on_Windows.reg)) @@ -555,7 +555,7 @@ sudo chmod 600 ikev2vpnca.cer vpnclient.cer vpnclient.key ikev2=insist rekey=no pfs=no - ike=aes256-sha2,aes128-sha2,aes256-sha1,aes128-sha1,aes256-sha2;modp1024,aes128-sha1;modp1024 + ike=aes256-sha2,aes128-sha2,aes256-sha1,aes128-sha1 phase2alg=aes_gcm-null,aes128-sha1,aes256-sha1,aes128-sha2,aes256-sha2 ikelifetime=24h salifetime=24h @@ -716,13 +716,13 @@ sudo chmod 600 ikev2vpnca.cer vpnclient.cer vpnclient.key 如果你忘记了客户端配置文件的密码，可以重新 [导出 IKEv2 客户端的配置](#导出一个已有的客户端的配置)。 -Ubuntu 18.04 用户在尝试将生成的 `.p12` 文件导入到 Windows 时可能会遇到错误 "输入的密码不正确"。这是由 `NSS` 中的一个问题导致的。更多信息请看 这里。 +Ubuntu 18.04 用户在尝试将生成的 `.p12` 文件导入到 Windows 时可能会遇到错误 "输入的密码不正确"。这是由 `NSS` 中的一个问题导致的。更多信息请看 这里。在 2021-01-21 已更新 IKEv2 辅助脚本以自动应用以下解决方法。
Ubuntu 18.04 上的 NSS 问题的解决方法 -**注：** 该解决方法仅适用于运行在 `x86_64` 架构下的 Ubuntu 18.04 系统。在 2021-01-21 已更新 IKEv2 辅助脚本以自动应用这个解决方法。 +**注：** 该解决方法仅适用于运行在 `x86_64` 架构下的 Ubuntu 18.04 系统。 首先安装更新版本的 `libnss3` 相关的软件包： diff --git a/docs/ikev2-howto.md b/docs/ikev2-howto.md index cfdb115..a2aa128 100644 --- a/docs/ikev2-howto.md +++ b/docs/ikev2-howto.md @@ -129,7 +129,7 @@ To customize IKEv2 or client options, run this script without arguments. Alternatively, you can manually create the VPN connection. Click here for instructions. If you specified the server's DNS name (instead of its IP address) during IKEv2 setup, you must enter the DNS name in the **Internet address** field. -1. Enable stronger ciphers for IKEv2 with a one-time registry change. This is optional, but recommended. Download and import the `.reg` file below, or run the following from an elevated command prompt. Read more here. +1. (**Required** if you manually created the VPN connection) Enable stronger ciphers for IKEv2 with a one-time registry change. Download and import the `.reg` file below, or run the following from an elevated command prompt. Read more here. - For Windows 7, 8.x and 10 ([download .reg file](https://dl.ls20.com/reg-files/v1/Enable_Stronger_Ciphers_for_IKEv2_on_Windows.reg)) @@ -557,7 +557,7 @@ The following example shows how to manually configure IKEv2 with Libreswan. Comm ikev2=insist rekey=no pfs=no - ike=aes256-sha2,aes128-sha2,aes256-sha1,aes128-sha1,aes256-sha2;modp1024,aes128-sha1;modp1024 + ike=aes256-sha2,aes128-sha2,aes256-sha1,aes128-sha1 phase2alg=aes_gcm-null,aes128-sha1,aes256-sha1,aes128-sha2,aes256-sha2 ikelifetime=24h salifetime=24h @@ -718,13 +718,13 @@ Before continuing, you **must** restart the IPsec service. The IKEv2 setup on th If you forgot the password for client config files, you may [export configuration for the IKEv2 client](#export-configuration-for-an-existing-client) again. -Ubuntu 18.04 users may encounter the error "The password you entered is incorrect" when trying to import the generated `.p12` file into Windows. This is due to a bug in `NSS`. Read more here. +Ubuntu 18.04 users may encounter the error "The password you entered is incorrect" when trying to import the generated `.p12` file into Windows. This is due to a bug in `NSS`. Read more here. As of 2021-01-21, the IKEv2 helper script was updated to automatically apply the workaround below.
Workaround for the NSS bug on Ubuntu 18.04 -**Note:** This workaround should only be used on Ubuntu 18.04 systems running on the `x86_64` architecture. As of 2021-01-21, the IKEv2 helper script was updated to automatically apply this workaround. +**Note:** This workaround should only be used on Ubuntu 18.04 systems running on the `x86_64` architecture. First, install newer versions of `libnss3` related packages: