skipd.conf.conf(4)

NAME
skipd.conf - SKIP Key Manager configuration file

SYNOPSYS
skipd.conf

DESCRIPTION

The skipd daemon reads the skipd.conf file on startup. The following options are supported:

enable_cdp[0|1]
    A value of 1 enables skipd to use the certificate discovery protocol to obtain certificates from remote hosts. A value of 0 disables certificate fetching; all certificates must be manually added to the local certificate database via the skipdb command.

enable_certd[0|1]
    A value of 1 enables skipd to answer certificate discovery requests from remote hosts. A value of 0 disables the certificate discovery server.

require_cdp_cookie[0|1]
    A value of 1 requires a "cookie exchange" to be completed by remote hosts which are communicating with the local certificate discovery server. This provides some additional assurance that the remote is not using a forged IP address, at the expense of requiring four exchanges instead of two to complete a CDP request.

cdp_retry_time<n>
    Number of seconds to wait between sending retry CDP packets.

cdp_max_retry<n>
    Number of CDP attempts to try before giving up.

max_cdp_queue<n>
    Specifies the maximum number of simultaneous outstanding CDP requests which are allowed.

serve_only_local[0|1]
    A value of 1 limits the local certificate server to only providing certificates which correspond to one of the identities for the local machine. Other certificates in the certificate database will not be given out.

disallow_cdp_put[0|1]
    A value of 1 will forbid remote hosts from pushing certificates on the locate certificate server.

max_certdb_size<n>
    Limits the certificate database to approximately <n> certificates. Certificates are usually around 1k bytes in length. The limit does not include certificates manually added to the database, only certificates obtained via CDP.

cdp_server<host>
    Specifies a host to contact via CDP to obtain certificates from. Multiple cdp_server lines may be present; the hosts will be tried in order until the desired certificate is obtained. Specifying @ (at-sign) for the host results in the peer site which communication is being attempted with to be asked for its own certificate. Specifying = (equal-sign) for the host results in the tunnel address being asked for the certificate.

rng_dev_audio[0|1]
    If set to 1, the random number generator will attempt to use /dev/audio for entropy collection.

DEFAULTS
enable_cdp 1
    enable_certd 1
    require_cdp_cookie 0
    cdp_max_retry 3
    cdp_retry_time 5
    max_cdp_queue 10
    serve_only_local 0
    disallow_cdp_put 0
    max_certdb_size 0
    cdp_server @

SEE ALSO
skipd.conf options may be set with the skip_conf command.

FILES

/usr/local/etc/skip/skipd.conf