summaryrefslogtreecommitdiff
path: root/sbin
diff options
context:
space:
mode:
Diffstat (limited to 'sbin')
-rw-r--r--sbin/isakmpd/isakmpd.conf.582
1 files changed, 44 insertions, 38 deletions
diff --git a/sbin/isakmpd/isakmpd.conf.5 b/sbin/isakmpd/isakmpd.conf.5
index 7a6ec9561b7..7641481cefe 100644
--- a/sbin/isakmpd/isakmpd.conf.5
+++ b/sbin/isakmpd/isakmpd.conf.5
@@ -1,4 +1,4 @@
-.\" $OpenBSD: isakmpd.conf.5,v 1.70 2002/11/27 14:36:20 ho Exp $
+.\" $OpenBSD: isakmpd.conf.5,v 1.71 2003/01/09 13:12:42 ho Exp $
.\" $EOM: isakmpd.conf.5,v 1.57 2000/12/21 14:43:17 ho Exp $
.\"
.\" Copyright (c) 1998, 1999, 2000 Niklas Hallqvist. All rights reserved.
@@ -114,7 +114,7 @@ use DH group 2. There are currently no predefined ESP+AH Quick Mode suites.
.Pp
The predefinitions include some default values for the special
sections "General", "Keynote", "X509-certificates", and
-"Default-Phase-1-Configuration".
+"Default-phase-1-configuration".
These default values are presented in the example below.
.Pp
All autogenerated values can be overridden by manual entries by using the
@@ -135,7 +135,7 @@ minutes (minimum 60 seconds, maximum 1 day).
.\"XXX Following empty .Ss works around a nroff bug, we want the new line."
.Ss
.Pp
-Also, the default Phase 1 ID can be set by creating a <Phase1-ID>
+Also, the default phase 1 ID can be set by creating a <Phase1-ID>
section, as shown below, and adding this tag under the "General"
section;
.Pp
@@ -155,38 +155,34 @@ Name= foo@bar.com
.It Em General
Generic global configuration parameters
.Bl -tag -width 12n
-.It Em Policy-file
-The name of the file that contains
-.Xr KeyNote 4
-policies.
-The default is "/etc/isakmpd/isakmpd.policy".
-.It Em Default-Phase-2-Suites
-A list of Phase 2 suites that will be used when establishing dynamic
+.It Em Default-phase-1-ID
+Optional default phase 1 ID name.
+.It Em Default-phase-1-lifetime
+The default lifetime for autogenerated transforms (phase 1).
+If unspecified, the value 3600,60:86400 is used as the default.
+.It Em Default-phase-2-lifetime
+The default lifetime for autogenerated suites (phase 2).
+If unspecified, the value 1200,60:86400 is used as the default.
+.It Em Default-phase-2-suites
+A list of phase 2 suites that will be used when establishing dynamic
SAs.
If left unspecified, QM-ESP-3DES-SHA-PFS-SUITE is used as the default.
-.It Em Retransmits
-How many times should a message be retransmitted before giving up.
.It Em Check-interval
The interval between watchdog checks of connections we want up at all times.
.It Em Exchange-max-time
-How many seconds should an exchange maximally take to setup
-before we give up.
+How many seconds should an exchange maximally take to setup before we
+give up.
.It Em Listen-on
A list of IP-addresses OK to listen on.
-This list is used as
-a filter for the set of addresses the interfaces configured
-provides.
-This means that we won't see if an address given
-here does not exist on this host, and thus no error is given for
-that case.
-.It Em Shared-SADB
-If this tag is defined, whatever the value is, some semantics of
-.Nm
-are changed so that multiple instances can run on top of one SADB
-and setup SAs with eachother.
-Specifically this means replay
-protection will not be asked for, and errors that can occur when
-updating an SA with its parameters a 2nd time will be ignored.
+This list is used as a filter for the set of addresses the interfaces
+configured provides.
+This means that we won't see if an address given here does not exist
+on this host, and thus no error is given for that case.
+.It Em Policy-file
+The name of the file that contains
+.Xr KeyNote 4
+policies.
+The default is "/etc/isakmpd/isakmpd.policy".
.It Em Pubkey-directory
The directory in which
.Nm
@@ -195,6 +191,16 @@ The default is "/etc/isakmpd/pubkeys".
Read
.Xr isakmpd 8
for the required naming convention of the files in here.
+.It Em Retransmits
+How many times should a message be retransmitted before giving up.
+.It Em Shared-SADB
+If this tag is defined, whatever the value is, some semantics of
+.Nm
+are changed so that multiple instances can run on top of one SADB
+and setup SAs with eachother.
+Specifically this means replay
+protection will not be asked for, and errors that can occur when
+updating an SA with its parameters a 2nd time will be ignored.
.El
.It Em Phase 1
ISAKMP SA negotiation parameter root
@@ -203,7 +209,7 @@ ISAKMP SA negotiation parameter root
A name of the ISAKMP peer at the given IP-address.
.It Em Default
A name of the default ISAKMP peer.
-Incoming Phase 1 connections from other IP-addresses will use this peer name.
+Incoming phase 1 connections from other IP-addresses will use this peer name.
.It ""
This name is used as the section name for further information to be found.
Look at <ISAKMP-peer> below.
@@ -261,6 +267,10 @@ authentication.
.El
.It Em X509-Certificates
.Bl -tag -width 12n
+.It Em Accept-self-signed
+If this tag is defined, whatever the value is, certificates that
+do not originate from a trusted CA but are self-signed will be
+accepted.
.It Em Ca-directory
A directory containing PEM certificates of certification authorities
that we trust to sign other certificates.
@@ -277,10 +287,6 @@ and X.509 CA certificates) allows for maintenance of a list of
A directory containing PEM certificates that we trust to be valid.
These certificates are used in preference to those passed in messages and
are required to have a SubjectAltName extension.
-.It Em Accept-self-signed
-If this tag is defined, whatever the value is, certificates that
-do not originate from a trusted CA but are self-signed will be
-accepted.
.It Em Private-key
The private key matching the public key of our certificate (which should be
in the "Cert-directory", and have a subjectAltName matching our ID, so far
@@ -315,7 +321,7 @@ If existent, the IP-address of the peer.
.It Em Configuration
The name of the ISAKMP-configuration section to use.
Look at <ISAKMP-configuration> below.
-If unspecified, defaults to "Default-Phase-1-Configuration".
+If unspecified, defaults to "Default-phase-1-configuration".
.It Em Authentication
If existent, authentication data for this specific peer.
In the case of preshared key, this is the key value itself.
@@ -340,7 +346,7 @@ Currently there are no specific ISAKMP SA flags defined.
.Bl -tag -width 12n
.It Em ID-type
The ID type as given by the RFC specifications.
-For Phase 1 this is currently
+For phase 1 this is currently
.Li IPV4_ADDR ,
.Li IPV4_ADDR_SUBNET ,
.Li IPV6_ADDR ,
@@ -437,7 +443,7 @@ and
.Li EC_185 .
.It Em PRF
The algorithm to use for the keyed pseudo-random function (used for key
-derivation and authentication in Phase 1), or ANY.
+derivation and authentication in phase 1), or ANY.
.It Em Life
A list of lifetime descriptions, or ANY.
In the former case, each
@@ -679,7 +685,7 @@ Local-address= 10.1.0.2
Address= 10.1.0.1
#Port= isakmp
#Port= 500
-#Configuration= Default-Phase-1-Configuration
+#Configuration= Default-phase-1-configuration
Authentication= mekmitasdigoat
#Flags=
@@ -741,7 +747,7 @@ Private-key= /etc/isakmpd/private/local.key
# Default phase 1 description (Main Mode)
-[Default-Phase-1-Configuration]
+[Default-phase-1-configuration]
EXCHANGE_TYPE= ID_PROT
Transforms= 3DES-SHA