6.7. Protecting the IPsec NSS database with a password

Procedure

1. Enable password protection for the Libreswan NSS database:

   # certutil -W -d /var/lib/ipsec/nss/

2. Enter the current password:

   Enter Password or Pin for "NSS Certificate DB": <password>

   If the database is currently not protected by a password, press Enter.

3. Enter the new password:

   Enter new password: <new_password>
   Re-enter password: <new_password>

4. To unlock the database, the ipsec service requires the /etc/ipsec.d/nsspassword file. Create the file with the following content:

   • If the host does not run in FIPS mode:

     NSS Certificate DB:<password>

   • If the host runs in FIPS mode:

     NSS FIPS 140-2 Certificate DB:<password>

5. Set secure permissions on the /etc/ipsec.d/nsspassword file:

   # chmod 600 /etc/ipsec.d/nsspassword
   # chown root:root /etc/ipsec.d/nsspassword

6. Restart the ipsec service:

   # systemctl restart ipsec

Verification

1. Verify that the ipsec service is running:

   # systemctl is-active ipsec

   If the command returns active, the service successfully uses the password file to unlock the NSS database.

2. Perform an action on the NSS database that requires the password. For example, display the private keys:

   # certutil -K -d /var/lib/ipsec/nss/
   certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services"
   Enter Password or Pin for "NSS Certificate DB":

   Verify that the command prompts for the password.