DaustoCob wrote:
[...]
Now I'm forced to use Apple Cisto IPSec and it works very fine and fast, but Sys Administrators are not happy to reveal shared group key, they prefer distribute PCF files (which Apple/Cisco is not able to import!!).
I realize this is an old thread, but this statement implies a false and risky assumption that shared secrets in PCF files are (or even logically can be) safe from discovery. The encryption used to store group and user passwords in PCF files has to be reversible because the client needs to know the secret to use it. The mechanism has been widely known for almost 5 years and there's freely available C source code for a simple decryption program. The group shared secret is much less vulnerable when using Apple's client in Snow Leopard than it is when using Cisco's client with a PCF file, as is the user password if it is allowed to be saved in the PCF.
It is possible to create a network config file for the Snow Leopard VPN client so that users don't have to be given a shared secret to enter manually, but those files share the fundamental risk as a PCF: the encrypted secret can be decrypted. However, unlike PCF's they are only needed for distributing configurations. If you can get users to delete the distributed file once they've imported it, the overall risk of exposing the group shared secret is significantly less than with PCF's. It would be helpful if Apple imported PCF's directly, but given the need to decrypt passwords for that I would not expect them to do so.
