I have just seen that StrongSwan is installed and the service is enabled on my Raspberry Pi. But I have never used Strongswan before. Is there any way to research when it was installed? I just use the Raspi for OMV 5 with Portainer and various Docker containers. Should I be concerned that the package is installed without my active action?
EDIT:
I did some further investigation and found this commands in my .bash_history. This was approximately one year ago. Maybe I wanted to test something that I cannot remember. But interesting that despite those apt purge commands strongswan was still installed and running.
sudo apt install strongswan
sudo apt install strongswan-pki
sudo apt install libstrongswan-extra-plugins
sudo apt purge strongswan
sudo apt purge strongswan-pki
sudo apt purge libstrongswan-extra-plugins
The strongswan installation itself doesn’t seem to be malicous.
It looks like these packages were installed via the apt repositories: strongswan-starter
strongswan-libcharon
strongswan-charon
libstrongswan
Check /var/log/dpkg.log. See when they were installed, probably alongside something you wanted.