Setkey

Setkey is a command-line utility that is part of the ipsec-tools package. It provides a user-space interface to the kernel IPsec stack through the PF_KEY interface, enabling administrators to configure and inspect the kernel’s IPsec data structures, notably the Security Association Database (SAD) and the Security Policy Database (SPD).

With setkey, users can create, delete, and list IPsec security associations and policies, and manage the cryptographic keys used by ESP and AH. The tool is designed for low-level, manual configuration and testing of IPsec setups and is commonly used on Linux and other Unix-like systems that implement PF_KEY, as well as on some BSD variants.

Typical usage involves expressing the desired policies (which traffic to protect and under what conditions) and the corresponding security associations (which algorithms, keys, and lifetimes to use), loading them into the kernel, and then querying the kernel to verify the current state. It is often used for debugging, troubleshooting, or in environments where automated IPsec management is not in use.

Limitations include reliance on PF_KEY2, which is an older interface with varying implementations across kernels. Modern IPsec deployments frequently rely on high-level IKE-based managers such as strongSwan or LibreSwan instead of setkey. Nevertheless, setkey remains valuable for manual configuration, testing, and scripting in environments that require direct kernel control.

See also: IPsec, PF_KEY, IPsec-tools, xfrm, strongSwan, LibreSwan.