Annotation of embedaddon/ipsec-tools/src/racoon/samples/racoon.conf.sample, revision 1.1
1.1 ! misho 1: # $KAME: racoon.conf.sample,v 1.28 2002/10/18 14:33:28 itojun Exp $
! 2:
! 3: # "path" affects "include" directives. "path" must be specified before any
! 4: # "include" directive with relative file path.
! 5: # you can overwrite "path" directive afterwards, however, doing so may add
! 6: # more confusion.
! 7: #path include "/usr/local/v6/etc" ;
! 8: #include "remote.conf" ;
! 9:
! 10: # the file should contain key ID/key pairs, for pre-shared key authentication.
! 11: path pre_shared_key "/usr/local/v6/etc/psk.txt" ;
! 12:
! 13: # racoon will look for certificate file in the directory,
! 14: # if the certificate/certificate request payload is received.
! 15: #path certificate "/usr/local/openssl/certs" ;
! 16:
! 17: # "log" specifies logging level. It is followed by either "notify", "debug"
! 18: # or "debug2".
! 19: #log debug;
! 20:
! 21: remote anonymous
! 22: {
! 23: #exchange_mode main,aggressive,base;
! 24: exchange_mode main,base;
! 25:
! 26: #my_identifier fqdn "server.kame.net";
! 27: #certificate_type x509 "foo@kame.net.cert" "foo@kame.net.priv" ;
! 28:
! 29: lifetime time 24 hour ; # sec,min,hour
! 30:
! 31: #initial_contact off ;
! 32: #passive on ;
! 33:
! 34: # phase 1 proposal (for ISAKMP SA)
! 35: proposal {
! 36: encryption_algorithm 3des;
! 37: hash_algorithm sha1;
! 38: authentication_method pre_shared_key ;
! 39: dh_group 2 ;
! 40: }
! 41:
! 42: # the configuration could makes racoon (as a responder)
! 43: # to obey the initiator's lifetime and PFS group proposal,
! 44: # by setting proposal_check to obey.
! 45: # this would makes testing "so much easier", but is really
! 46: # *not* secure !!!
! 47: proposal_check strict;
! 48: }
! 49:
! 50: # phase 2 proposal (for IPsec SA).
! 51: # actual phase 2 proposal will obey the following items:
! 52: # - kernel IPsec policy configuration (like "esp/transport//use)
! 53: # - permutation of the crypto/hash/compression algorithms presented below
! 54: sainfo anonymous
! 55: {
! 56: pfs_group 2;
! 57: lifetime time 12 hour ;
! 58: encryption_algorithm 3des, cast128, blowfish 448, des, rijndael ;
! 59: authentication_algorithm hmac_sha1, hmac_md5 ;
! 60: compression_algorithm deflate ;
! 61: }
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>