skipd.conf(4)

NAME
skipd.conf - SKIP Key Manager configuration file

SYNOPSIS
skipd.conf

DESCRIPTION

The skipd daemon reads the /etc/skip/skipd.conf file on startup. skipd.conf options may be set with the skip_conf(1m) command.

The following options are supported:

enable_cdp[0|1]
    A value of 1 enables skipd to use the certificate discovery protocol to obtain certificates from remote hosts. A value of 0 disables certificate fetching; all certificates must be manually added to the local certificate database via the skipdb command.

enable_certd[0|1]
    A value of 1 enables skipd to answer certificate discovery requests from remote hosts. A value of 0 disables the certificate discovery server.

require_cdp_cookie[0|1]
    A value of 1 requires a "cookie exchange" to be completed by remote hosts which are communicating with the local certificate discovery server. This provides some additional assurance that the remote is not using a forged IP address, at the expense of requiring four exchanges instead of two to complete a CDP request.

cdp_retry_time<n>
    Number of seconds to wait between sending retry CDP packets.

cdp_max_retry<n>
    Number of CDP attempts to try before giving up.

max_cdp_queue<n>
    Specifies the maximum number of simultaneous outstanding CDP requests which are allowed.

serve_only_local[0|1]
    A value of 1 limits the local certificate server to only providing certificates which correspond to one of the identities for the local machine. Other certificates in the certificate database will not be given out.

disallow_cdp_put[0|1]
    A value of 1 will forbid remote hosts from pushing certificates on the locate certificate server.

max_certdb_size<n>
    Limits the certificate database to approximately <n> certificates. Certificates are usually around 1k bytes in length. The limit does not include certificates manually added to the database, only certificates obtained via CDP.

inactivity_timer<seconds>
    If the SKIP key manager receives no requests to generate or decrypt traffic keys for this interval, it will exit, disabling SKIP access.

ibutton_heartbeat<seconds>
    How often the SKIP key manager will probe to make sure a hardware iButton remains connected to the system, if iButton mode is being used. If the iButton is removed, the SKIP key manager will exit, disabling SKIP access. Set to 0 to disable probes for the iButton.

cdp_server<host>
    Specifies a host to contact via CDP to obtain certificates from. Multiple cdp_server lines may be present; the hosts will be tried in order until the desired certificate is obtained. Specifying @ (at-sign) for the host results in the peer site which communication is being attempted with to be asked for its own certificate. Specifying = (equal-sign) for the host results in the tunnel address being asked for the certificate.

rng_dev_audio[0|1]
    If set to 1, the random number generator will attempt to use /dev/audio for entropy collection.

ncounter_threshold<n>
    Allow processing of packets with n-counter values that are different from the current systems by no more than n. This option should be used with great caution as it increases vulnerability to replay and known key attacks.

ncounter_warnings<n>
    Warn about systems whose n-counters are different than this system by more than 1 but less than ncounter_threshold no more than 1 time every n seconds.

DEFAULTS
enable_cdp 1
enable_certd 1
require_cdp_cookie 0
cdp_max_retry 3
cdp_retry_time 5
max_cdp_queue 10
serve_only_local 0
disallow_cdp_put 0
max_certdb_size 0
cdp_server @
ncounter_threshold 1
ncounter_warnings 30

SEE ALSO
skip_conf(1m)

FILES

/etc/skip/skipd.conf