1 manpage(SILCD_CONF) (5) (November 2 2002) (silc-server) (silc-server)
4 manpagename(silcd.conf) (format of configuration file for silcd)
6 manpagesection(CONFIGURATION FILE)
7 bf(Silcd) reads its configuration from /etc/silc/silcd.conf (or the file
8 specified with bf(-f)). The file contains sections, subsections and key-value
9 pairs. Each section or subsection is bound with a starting em({) and ending
10 em(}). Keys and values are of the format 'em(KEY)=em(VALUE);'. All statements
11 as well as sections must be terminated with a ';'.
13 Mandatory section in configuration file is em(ServerInfo). Other sections
14 are optional but recommended. If em(General) section is defined it must
15 be defined before the em(ConnectionParams) section. On the other hand,
16 the em(ConnectionParams) section must be defined before em(Client),
17 em(ServerConnection) and/or em(RouterConnection) sections. Other sections
18 can be in a free order in the configuration file.
20 nsect(SECTION: General)
22 em(General) section contains global settings for the silcd.
25 quote(Dynamic router connections. If this is set for normal SILC server
26 the connection to primary router is not created untill it is actually
27 needed. Giving for example em(/WHOIS foobar@silcnet.org) would then
28 create connection to the primary router to resolve user foobar.
29 On the other hand giving em(/WHOIS foobar) would try to search the
30 user foobar locally, without creating the connection. Note that
31 giving em(/JOIN foobar) will also created the connection as current
32 SILC Server version supports only global channels (all JOINs require
33 connection to router, if one is configured).)
35 bf(prefer_passphrase_auth)
36 quote(If both public key and passphrase authentication are set for a
37 connection, public key authentication is by default preferred. Setting this
38 value to em(true) causes silcd to prefer passphrase authentication in these
41 bf(require_reverse_lookup)
42 quote(Set this value to em(true) if all connecting hosts must have a fully
43 qualified domain name (FQDN). If set to true, a host without FQDN is not
44 allowed to connect to server.)
47 quote(Maximum number of incoming connections to this server. Any further
48 connections are refused.)
50 bf(connections_max_per_host)
51 quote(Maximum number of incoming connections from any single host. This
52 setting can be overridden on a connection-specific basis with
53 em(ConnectionParams).)
56 quote(Defines the minimum required version of protocol to allow connecting
57 to server. A client or server using this version of protocol or newer is
58 allowed to connect, one using anything older will be rejected. Leaving unset
59 allows all versions to connect. This can be overridden with
60 em(ConnectionParams).)
63 quote(Defines the minimum required version of software to allow connecting
64 to server. A client or server that is of this version or newer is allowed
65 to connect, one using anything older will be rejected. Leaving unset allows
66 all versions to connect. This can be overridden with em(ConnectionParams).)
68 bf(version_software_vendor)
69 quote(Defines the allowed software vendor string that is required to connect.
70 Usually this is either a build number or special client tag. Using this
71 requirement is not encouraged unless the server is in very limited use.
72 Leaving unset allows all versions regardless of their vendor to connect.
73 Can be overridden with em(ConnectionParams).)
75 bf(key_exchange_rekey)
76 quote(Defines the interval, in seconds, how often the session key will be
77 regenerated. This setting only applies to the connection initiator, as rekey
78 is always performed by the initiating party. Setting has effect only when
79 the server acts as an initiator, and can be overridden with
80 em(ConnectionParams).)
83 quote(Boolean value to determine, whether key-exchange is performed with
84 Perfect Forward Secrecy (PFS) or without. If set to em(true), the rekey
85 process will be somewhat slower, but more secure since the key is
86 entirely regenerated. Can be overridden with em(ConnectionParams).)
88 bf(key_exchange_timeout)
89 quote(Key exchange timeout in seconds. If the key exchange is not completed
90 within this time, the remote connection will be closed.)
93 quote(Connection authentication timeout in seconds. If the connection
94 authentication is not completed within this time, the remote connection
97 bf(channel_rekey_secs)
98 quote(Seconds, how often channel key will be regenerated. Note that channel
99 key is regenerated each time someone joins or leaves the channel. This is
100 the maximum time any channel can have the same key.)
103 quote(Boolean value controlling, whether clients are denied the use of DETACH
104 command. Default value is false (DETACH is allowed).)
107 quote(Time in seconds how long detached sessions will be available. By
108 default, detached sessions do not expire and as such, are persistent as long
109 as the server is running. If DETACH command is allowed, this value should
113 quote(Boolean value controlling, whether Quality of Service settings are
114 enabled. Default setting is false. NOTE: If you enable QoS in general section,
115 it applies to every connection the server has, including server connections.
116 This setting can be overridden with em(ConnectionParams) and in case of
117 server connections, it SHOULD BE overridden (server connections should not
121 quote(Limits read operations per second to given amount. Do note that one read
122 operation may read several SILC packets, so this setting does not
123 automatically correspond to amount of messages transmitted or accepted.)
126 quote(Limits incoming SILC data to the specified number of bytes per second.)
129 quote(This value defines the timeout, in seconds, for the delay of received
130 data in case it was left in a QoS queue.)
133 quote(This value defines the timeout, in microseconds, for the delay of
134 received data for received data in case it was left in a QoS queue.)
136 nsect(SECTION: ServerInfo)
138 em(ServerInfo) contains values for bound interfaces and administrative info.
141 quote(Server's name (FQDN).)
144 quote(This is a descriptive text field, usually telling what the server and
148 quote(Descriptive field of server's geographic location.)
151 quote(Administrator's full name.)
154 quote(Administrator's email address.)
157 quote(The name of the user account silcd will be running on. This must be an
158 existing user. Silcd needs to executed as root; after binding the port it
159 will drop root privileges and use the account given here.)
162 quote(The name of the group silcd will be running on. This must be an existing
163 group. Silcd needs to be executed as root; after binding the port it will drop
164 root privileges and use the group given here.)
167 quote(Full path to server's public key file.)
170 quote(Full path to server's private key file.)
173 quote(Full path to MOTD (Message Of The Day) file, a text file that will be
174 displayed to each client upon connection.)
177 quote(Full path to file where silcd will write its PID.)
179 nsubsect(SUBSECTION: Primary)
181 This is the primary listener info. Each server can have no more than one em(Primary)
185 quote(Specifies the address silcd is listening on.)
188 quote(Specifies the port silcd is listening on.)
191 quote(Optional field. If your server is behind NAT this IP would be
192 the public IP address. The 'ip' field would include the internal IP
193 address. With this option it is possible to run silcd behind NAT
196 nsubsect(SUBSECTION: Secondary)
198 This is a secondary listener info. A server may have any amount of
199 em(Secondary) listener settings. These are needed only if silcd needs
200 to listen on several interfaces. em(Secondary) subsections have the same
201 information that em(Primary) does.
203 nsect(SECTION: Logging)
205 This section is used to set up various log files; their paths, maximum
206 sizes and individual logging options.
208 There are four defined logging channels. The log channels have an
209 importance value, and more important channels are always redirected to the
210 less important ones. Setting a valid logging file for em(Info) will ensure
211 logging for all channels, whereas a setting for em(Errors) would only ensure
212 logging for em(Errors) and em(Fatals).
215 quote(A boolean value that dictates whether log lines will have timestamps
216 prefixed. In general, this is a good idea. You might want to disable this
217 if you are running silcd under some special logging daemon, such as
221 quote(A boolean value that determines how often log files are updated. Setting
222 this to em(true) makes silcd log in real-time. Setting this to em(false) makes
223 silcd write to logs every em(FlushDelay) seconds. Real-time logging causes a
224 bit more CPU and HDD usage but reduces memory consumption.)
227 quote(Time in seconds, how often logs are flushed to logfiles. This setting
228 has effect only if em(QuickLogs) is disabled.)
230 nsubsect(SUBSECTION: Info)
231 nsubsect(SUBSECTION: Warnings)
232 nsubsect(SUBSECTION: Errors)
233 nsubsect(SUBSECTION: Fatals)
234 Each of these subsections has the same attributes, em(File) and em(Size).
235 Different levels of problems are logged to their respective channels
236 (em(Info), em(Warnings), em(Errors), em(Fatals)), depending on their need
240 quote(Full path to log file.)
243 quote(Limit the size the log file is allowed to grow to. Any further messages
244 to this file cause the oldest lines to be removed in order to keep the file
245 size within given limit.)
247 nsect(SECTION: ConnectionParams)
249 This section defines connection parameters. Each connection may have its own
250 set of em(ConnectionParams) but having one is in no way mandatory. If no
251 separate parameters have been assigned, the defaults and the ones from
252 em(General) section will be used. A silcd configuration may have any number of
253 em(ConnectionParams) sections.
256 quote(This is a unique name that separates bf(this) particular
257 em(ConnectionParams) section from all the others. It is also the name with
258 which settings are referred to a given set of parameters. This field is
262 quote(Limits how many concurrent connections are allowed. Any further
263 connections are simply refused. Note that this setting can not override the
264 figure given in em(General) section.)
266 bf(connections_max_per_host)
267 quote(Maximum number of connections allowed from any single host. If this
268 parameter is set for a block controlling server connections, it is highly
269 suggested to use a value of one (1).)
272 quote(Exactly the same as in em(General) section.)
275 quote(Exactly the same as in em(General) section.)
277 bf(version_software_vendor)
278 quote(Exactly the same as in em(General) section.)
281 quote(How often (seconds) to send HEARTBEAT packets to connected clients.)
284 quote(When connection is lost, how many times a reconnection is tried.)
286 bf(reconnect_interval)
287 quote(How often, in seconds, a reconnection is attempted.)
289 bf(reconnect_interval_max)
290 quote(Reconnection time is lengthened each time an unsuccessful attempt
291 occurs. This value defines the maximum interval to which the delay may
294 bf(reconnect_keep_trying)
295 quote(Boolean value controlling whether server eventually gives up trying
296 to reconnect. If set to em(false), server will give up once em(reconnect_count)
297 is reached or, even at maximum interval no connection is established.)
299 bf(key_exchange_rekey)
300 quote(Exactly the same as in em(General) section.)
303 quote(Exactly the same as in em(General) section.)
306 quote(This boolean setting has meaning only to client connections. If set to
307 em(true), client connections using this em(ConnectionParams) block will have
308 their username and host scrambled. The client will also have an anonymous mode
312 quote(Exactly the same as in em(General) section NOTE: For server
313 connection this should be set to em(false) value.)
316 quote(Exactly the same as in em(General) section.)
319 quote(Exactly the same as in em(General) section.)
322 quote(Exactly the same as in em(General) section.)
325 quote(Exactly the same as in em(General) section.)
327 nsect(SECTION: Client)
329 This section defines how incoming client connections are handled. There can
330 be several em(Client) sections, each with their own requirements. A bf(silcd)
331 admin could for example require that connections from certain IP-address space
332 must supply a connection password.
335 quote(An address or wildcarded set of addresses, either in numeric IP-address
336 fashion or as hostnames. For example em("10.1.*") or
337 em("*.mydomain.domain.org").)
340 quote(The required passphrase to allow client connection.)
343 quote(The path to a file containing the client's public key. There can be any
344 number of em(PublicKey) statements in one em(Client) section. Matching any of
348 quote(Name of client connection parameters.)
350 nsect(SECTION: ServerConnection)
352 This section defines a configured server connection. A regular SILC
353 server does not need one at all. If this block exists, it means that the
354 server is a SILC router. There must be one em(ServerConnection) for each
355 SILC server that connects to this router.
358 quote(Either an FQDN or strict IP-address of the connecting server.)
361 quote(If server connection requires passphrase authentication, set it here.)
364 quote(This is a path to connecting server's public key. If server connection
365 requires public key authentication, set this value. If both em(Passphrase)
366 and em(PublicKey) are set, then either of them will be accepted.)
369 quote(Connection parameters.)
372 quote(A boolean value controlling whether this server acts as a backup. Set
373 to em(false) for normal servers. If set to em(true), this server is a backup
376 nsect(SECTION: RouterConnection)
377 This section covers router connections. Stand-alone servers won't have this
378 section, and regular servers should only have one.
380 Router servers need one em(RouterConnection) for each other router they have
381 been configured to connect to. First configured section is the primary route.
384 quote(If em(Initiator) is set tro em(true), this setting defines the remote
385 port in which to connect. if em(Initiator) is set to false, then this defines
386 the local (listening) port.)
389 quote(If connecting server requires a passphrase authentication, it is set
393 quote(If connecting to server requires public key authentication, the path
394 to server's public key file is set here.)
397 quote(Connection parameters.)
400 quote(A boolean setting that defines whether this server is the connecting
404 quote(If the configured connection is a backup connection, set this to the
405 address of the main router that will be replaced. For normal router connection
406 leave this option out.)
409 quote(If the configured connection is a backup connection, set this to the
410 remote port which to connect to. For normal router connection, leave this
414 quote(A boolean value. If this setting is em(true), then the backup router
415 is in the same cell. If the backup router is in another cell, set this
416 to em(false). Needless to say, for normal router connection, leave this
419 nsect(SECTION: Admin)
421 This section defines configured administration connections.
424 quote(Either FQDN or a strict IP-address to the origin of connection.
425 This field is optional.)
428 quote(Username that the connecting client announces. This field is optional.)
431 quote(Nickname that the connecting client announces. This field is optional.)
434 quote(Passphrase required to obtain server operator privileges.)
437 quote(Path to administrator's public key file. If both em(Passphrase) and
438 em(PublicKey) are defined, either one can be used.)
441 This section defines denied incoming connections. They apply equally to both
442 client and server connections, so make sure you know what you add here. Each
443 em(Deny) section covers one instance of denied connection(s). There may be any
444 number of em(Deny) sections.
447 quote(Address or wildcarded addresses of denied connections. bf(NOTE!) This
448 field is not mandatory, but highly recommended. If you don't specify em(Host)
449 at all, or give it a value of "*", you have a silcd that denies every single
450 incoming connection.)
453 quote(A string giving the reason as to why the connecting party is not allowed
454 to connect. Unlike em(Host), this field IS mandatory.)
466 SILC is designed and written by Pekka Riikonen <priikone@iki.fi> and rest
469 Configuration file format and parser is by Giovanni Giacobbi
470 <giovanni@giacobbi.net>.
472 This manpage was written by Mika 'Bostik' Boström <bostik@lut.fi>
474 See bf(CREDITS) for full list of contributors.