diff options
| -rw-r--r-- | sbin/isakmpd/isakmpd.conf.5 | 82 |
1 files changed, 44 insertions, 38 deletions
diff --git a/sbin/isakmpd/isakmpd.conf.5 b/sbin/isakmpd/isakmpd.conf.5 index 7a6ec9561b7..7641481cefe 100644 --- a/sbin/isakmpd/isakmpd.conf.5 +++ b/sbin/isakmpd/isakmpd.conf.5 @@ -1,4 +1,4 @@ -.\" $OpenBSD: isakmpd.conf.5,v 1.70 2002/11/27 14:36:20 ho Exp $ +.\" $OpenBSD: isakmpd.conf.5,v 1.71 2003/01/09 13:12:42 ho Exp $ .\" $EOM: isakmpd.conf.5,v 1.57 2000/12/21 14:43:17 ho Exp $ .\" .\" Copyright (c) 1998, 1999, 2000 Niklas Hallqvist. All rights reserved. @@ -114,7 +114,7 @@ use DH group 2. There are currently no predefined ESP+AH Quick Mode suites. .Pp The predefinitions include some default values for the special sections "General", "Keynote", "X509-certificates", and -"Default-Phase-1-Configuration". +"Default-phase-1-configuration". These default values are presented in the example below. .Pp All autogenerated values can be overridden by manual entries by using the @@ -135,7 +135,7 @@ minutes (minimum 60 seconds, maximum 1 day). .\"XXX Following empty .Ss works around a nroff bug, we want the new line." .Ss .Pp -Also, the default Phase 1 ID can be set by creating a <Phase1-ID> +Also, the default phase 1 ID can be set by creating a <Phase1-ID> section, as shown below, and adding this tag under the "General" section; .Pp @@ -155,38 +155,34 @@ Name= foo@bar.com .It Em General Generic global configuration parameters .Bl -tag -width 12n -.It Em Policy-file -The name of the file that contains -.Xr KeyNote 4 -policies. -The default is "/etc/isakmpd/isakmpd.policy". -.It Em Default-Phase-2-Suites -A list of Phase 2 suites that will be used when establishing dynamic +.It Em Default-phase-1-ID +Optional default phase 1 ID name. +.It Em Default-phase-1-lifetime +The default lifetime for autogenerated transforms (phase 1). +If unspecified, the value 3600,60:86400 is used as the default. +.It Em Default-phase-2-lifetime +The default lifetime for autogenerated suites (phase 2). +If unspecified, the value 1200,60:86400 is used as the default. +.It Em Default-phase-2-suites +A list of phase 2 suites that will be used when establishing dynamic SAs. If left unspecified, QM-ESP-3DES-SHA-PFS-SUITE is used as the default. -.It Em Retransmits -How many times should a message be retransmitted before giving up. .It Em Check-interval The interval between watchdog checks of connections we want up at all times. .It Em Exchange-max-time -How many seconds should an exchange maximally take to setup -before we give up. +How many seconds should an exchange maximally take to setup before we +give up. .It Em Listen-on A list of IP-addresses OK to listen on. -This list is used as -a filter for the set of addresses the interfaces configured -provides. -This means that we won't see if an address given -here does not exist on this host, and thus no error is given for -that case. -.It Em Shared-SADB -If this tag is defined, whatever the value is, some semantics of -.Nm -are changed so that multiple instances can run on top of one SADB -and setup SAs with eachother. -Specifically this means replay -protection will not be asked for, and errors that can occur when -updating an SA with its parameters a 2nd time will be ignored. +This list is used as a filter for the set of addresses the interfaces +configured provides. +This means that we won't see if an address given here does not exist +on this host, and thus no error is given for that case. +.It Em Policy-file +The name of the file that contains +.Xr KeyNote 4 +policies. +The default is "/etc/isakmpd/isakmpd.policy". .It Em Pubkey-directory The directory in which .Nm @@ -195,6 +191,16 @@ The default is "/etc/isakmpd/pubkeys". Read .Xr isakmpd 8 for the required naming convention of the files in here. +.It Em Retransmits +How many times should a message be retransmitted before giving up. +.It Em Shared-SADB +If this tag is defined, whatever the value is, some semantics of +.Nm +are changed so that multiple instances can run on top of one SADB +and setup SAs with eachother. +Specifically this means replay +protection will not be asked for, and errors that can occur when +updating an SA with its parameters a 2nd time will be ignored. .El .It Em Phase 1 ISAKMP SA negotiation parameter root @@ -203,7 +209,7 @@ ISAKMP SA negotiation parameter root A name of the ISAKMP peer at the given IP-address. .It Em Default A name of the default ISAKMP peer. -Incoming Phase 1 connections from other IP-addresses will use this peer name. +Incoming phase 1 connections from other IP-addresses will use this peer name. .It "" This name is used as the section name for further information to be found. Look at <ISAKMP-peer> below. @@ -261,6 +267,10 @@ authentication. .El .It Em X509-Certificates .Bl -tag -width 12n +.It Em Accept-self-signed +If this tag is defined, whatever the value is, certificates that +do not originate from a trusted CA but are self-signed will be +accepted. .It Em Ca-directory A directory containing PEM certificates of certification authorities that we trust to sign other certificates. @@ -277,10 +287,6 @@ and X.509 CA certificates) allows for maintenance of a list of A directory containing PEM certificates that we trust to be valid. These certificates are used in preference to those passed in messages and are required to have a SubjectAltName extension. -.It Em Accept-self-signed -If this tag is defined, whatever the value is, certificates that -do not originate from a trusted CA but are self-signed will be -accepted. .It Em Private-key The private key matching the public key of our certificate (which should be in the "Cert-directory", and have a subjectAltName matching our ID, so far @@ -315,7 +321,7 @@ If existent, the IP-address of the peer. .It Em Configuration The name of the ISAKMP-configuration section to use. Look at <ISAKMP-configuration> below. -If unspecified, defaults to "Default-Phase-1-Configuration". +If unspecified, defaults to "Default-phase-1-configuration". .It Em Authentication If existent, authentication data for this specific peer. In the case of preshared key, this is the key value itself. @@ -340,7 +346,7 @@ Currently there are no specific ISAKMP SA flags defined. .Bl -tag -width 12n .It Em ID-type The ID type as given by the RFC specifications. -For Phase 1 this is currently +For phase 1 this is currently .Li IPV4_ADDR , .Li IPV4_ADDR_SUBNET , .Li IPV6_ADDR , @@ -437,7 +443,7 @@ and .Li EC_185 . .It Em PRF The algorithm to use for the keyed pseudo-random function (used for key -derivation and authentication in Phase 1), or ANY. +derivation and authentication in phase 1), or ANY. .It Em Life A list of lifetime descriptions, or ANY. In the former case, each @@ -679,7 +685,7 @@ Local-address= 10.1.0.2 Address= 10.1.0.1 #Port= isakmp #Port= 500 -#Configuration= Default-Phase-1-Configuration +#Configuration= Default-phase-1-configuration Authentication= mekmitasdigoat #Flags= @@ -741,7 +747,7 @@ Private-key= /etc/isakmpd/private/local.key # Default phase 1 description (Main Mode) -[Default-Phase-1-Configuration] +[Default-phase-1-configuration] EXCHANGE_TYPE= ID_PROT Transforms= 3DES-SHA |