# configuration possibilities and may not actually give any sensible
# configuration. For real life example see the examples/ directory.
#
+# Most of the settings in this file are optional. If some setting is
+# mandatory it is mentioned separately. If some setting is omitted it means
+# that its builtin default value will be used. Boolean values, that is
+# setting something on or off, is done by setting either "true" or "false"
+# value, respectively.
+#
+# The ServerInfo section is mandatory section. Other sections are optional.
+# However, if General section is defined it must be defined before the
+# ConnectionParams sections. On the other hand, the ConnectionParams section
+# must be defined before Client, ServerConnection or RouterConnection
+# sections. Other sections can be in free order.
+#
#
# Include global algorithms from the "silcalgs.conf" file. This file
# General configuration options
#
# These defines the default behaviour of the server. Most of these values
-# can be overridden with ConnectionParam, which can be defined independently
+# can be overridden with ConnectionParams, which can be defined independently
# for different connections.
#
General {
#prefer_passphrase_auth = true;
# Set this to true if the server should require fully qualified
- # domain names (FQDN) for incoming connections.
- #require_reverse_lookup = false;
+ # domain names (FQDN) for incoming connections. If true, a host
+ # without FQDN cannot connect to the server.
+ #require_reverse_lookup = true;
+
+ # Maximum number of incoming connections allowed to this server.
+ # If more attempt to connect they will be refused.
+ connections_max = 1000;
+
+ # Maximum number of incoming connections allowed per single host.
+ # For example, if this is one (1) it means a host can link only
+ # once to the server. Attempting to connect more than once would be
+ # refused. This can be overridden with ConnectionParams.
+ #connections_max_per_host = 10;
+
+ # Required version of the remote. If these are specified then the
+ # remote must be of at least this version, or newer. If older then
+ # the connection will not be allowed.
+ #
+ # version_protocol - SILC protocol version ("majog.minor")
+ # version_software - software version ("major.minor")
+ # version_software_vendor - vendor specific version extension
+ #
+ # The version_software_vendor may be for example a string or a build
+ # number of the software. The string can be a regex string to match
+ # more widely. Usually the vendor version checking is not necessary
+ # and can be omitted. These can be overridden with ConnectionParams.
+ #version_protocol = "1.0";
+ #version_software = "1.3";
+ #version_software_vendor = "SomeVendor";
# Default keepalive frequency (seconds). This can be overridden
- # with ConnectionParam.
+ # with ConnectionParams.
keepalive_secs = 300;
# Default reconnection parameters defines how the server reconnect
# reconnect_count is reached (the interval
# will be reconnect_interval_max).
#
- # These can be overridden with ConnectionParam.
+ # These can be overridden with ConnectionParams.
reconnect_count = 7;
reconnect_interval = 10;
reconnect_interval_max = 600;
reconnect_keep_trying = true;
+
+ # Key exchange protocol rekey interval (seconds). How often to
+ # regenerate the session key with the remote. Initiator will perform
+ # the rekey and this setting affects only when connecting as intiator.
+ # This can be overridden with ConnectionParams.
+ #key_exchange_rekey = 3600;
+
+ # Key exchange with Perfect Forward Secrecy (PFS). This will perform
+ # the rekey process with PFS, making the new key more secure since it
+ # is not dependent in any way of the old key. This will make the rekey
+ # process somewhat slower, than without PFS. This can be overridden
+ # with ConnectionParams.
+ #key_exchange_pfs = true;
+
+ # Key exchange timeout (seconds). If the key exchange protocol is not
+ # finished in this time period the remote connection will be closed.
+ #key_exchange_timeout = 60;
+
+ # Connection authentication timeout (seconds). If the connection
+ # authentication protocol is not finished in this time period the
+ # remote connection will be closed.
+ #conn_auth_timeout = 60;
+
+ # Channel key rekey interval (seconds). How often channel key is
+ # regenerated. Note that channel key is regenerated also always when
+ # someone joins or leaves the channel.
+ #channel_rekey_secs = 3600;
+
};
#
#
# Full admin name
#
- Admin = "Pekka Riikonen";
+ Admin = "Foo T. Bar";
#
# Admin's email address
#
- EMail = "priikone@poseidon.pspt.fi";
+ AdminEmail = "foo-admin@bar.com";
#
# Run SILC server as specific user and group. The server must be
# There are only four defined channels allowed for defining (see below).
# The log channels have an importance value, and most important channels
# are redirected on the less important ones, thus setting a valid logging
-# file for "infologfile" will ensure logging for all channels, while setting
-# logging file for "errorlogfile" will ensure logging for channels "error"
-# and "fatal"
+# file for "Info" will ensure logging for all channels, while setting
+# logging file for "Errors" will ensure logging for channels "Errors"
+# and "Fatals"
#
Logging {
- #
# If QuickLogs is true, then the logging files will be updated
# real-time. This causes a bit more CPU and HDD activity, but
- # reduces memory usage. (if unsure say true).
+ # reduces memory usage. By default it is false and log files are
+ # written with FlushDelay timeout.
#
- QuickLogs = false;
+ #QuickLogs = true;
- #
- # (Only if QuickLogs is false)
- # FlushDelay tells log files update delay in case you have chosen
- # buffering output.
+ # FlushDelay tells log files update delay (seconds) in case you
+ # have chosen buffering output. This setting has effect only if
+ # the QuickLogs is false.
#
FlushDelay = 180;
+ # Informational messages
Info {
File = "@LOGSDIR@/silcd.log";
Size = "50k";
};
+
+ # Warning messages
Warnings {
File = "@LOGSDIR@/silcd_warnings.log";
Size = "50k";
};
+
+ # Error messages
Errors {
File = "@LOGSDIR@/silcd_errors.log";
Size = "50k";
};
+
+ # Fatal messages
Fatals {
File = "@LOGSDIR@/silcd_fatals.log";
Size = "50k";
# (or values defined in General section). You can have multiple
# ConnectionParams blocks defined.
#
-ConnectionParam {
+ConnectionParams {
# unique name. The name is used to reference to this parameter
- # block from the connections.
+ # block from the connections. This field is mandatory.
name = "normal";
+ # Maximum number of connections allowed. More connections will be
+ # refused. This can be used for example to limit number of clients.
+ # Note that this never can be larger than the connections_max
+ # specified in General section.
+ connections_max = 200;
+
+ # Maximum number of connections allowed per host. For example, if
+ # this is one (1) it means a host can link only once to the server.
+ # Attempting to link more than once would be refused.
+ #
+ # If this connection parameters block is used with incoming server
+ # connections it is recommended that this value is set to one (1).
+ connections_max_per_host = 10;
+
+ # Required version of the remote. If these are specified then the
+ # remote must be of at least this version, or newer. If older then
+ # the connection will not be allowed.
+ #
+ # version_protocol - SILC protocol version
+ # version_software - software version
+ # version_software_vendor - vendor specific version extension
+ #
+ # The version_software_vendor may be for example a string or a build
+ # number of the software. The string can be a regex string to match
+ # more widely. Usually the vendor version checking is not necessary
+ # and can be omitted.
+ #version_protocol = "1.0";
+ #version_software = "1.3";
+ #version_software_vendor = "SomeVendor";
+
# Keepalive frequency (seconds).
keepalive_secs = 300;
reconnect_interval_max = 600;
reconnect_keep_trying = true;
- #TODO:
- #key_exchange_rekey - rekey timeout
- #key_exchange_pfs - rekey PFS
- #key_exchange_mutual_auth - SKE mutual auth
+ # Key exchange protocol rekey interval (seconds). How often to
+ # regenerate the session key with the remote. Initiator will perform
+ # the rekey and this setting affects only when connecting as initiator.
+ #key_exchange_rekey = 3600;
- #connections_max - max incoming connection
+ # Key exchange with Perfect Forward Secrecy (PFS). This will perform
+ # the rekey process with PFS, making the new key more secure since it
+ # is not dependent in any way of the old key. This will make the rekey
+ # process somewhat slower, than without PFS.
+ #key_exchange_pfs = true;
+
+ #TODO:
#connections_interval - incoming connection interval limit ?
};
#
# Configured client connections.
#
-# The "host" defines the incoming IP address or hostname of the client.
+# The "Host" defines the incoming IP address or hostname of the client.
# If it is omitted all hosts will match this client connection. The
-# "param" is optional and can be used to set specific connection parameters
+# "Params" is optional and can be used to set specific connection parameters
# for this connection.
#
-# The authentication data is specified by Passphrase and/or Publickey.
+# The authentication data is specified by Passphrase and/or PublicKey.
# If both are provided then both password and public key based authentication
# is allowed. If the Publickey is used it includes the file path to the
# public key file. If none of them is provided then authentication is not
-# required.
+# required. The PublicKey can be set multiple times to set multiple
+# public keys for one connection.
#
# Next example connection will match to all incoming client connections,
-# and no authentication is required
-#
-Client {
- #host = "";
- #passphrase = "secret";
- #publickey = "/path/to/the/public.key";
- param = "normal";
+# and no authentication is required.
+#
+Client {
+ #Host = "10.1.*";
+ #Passphrase = "secret";
+ #PublicKey = "/path/to/the/user_my.key";
+ #PublicKey = "/path/to/the/user_221.key";
+ #PublicKey = "/path/to/the/user_313.key";
+ Params = "normal";
};
#
# The fields "Host", "User", and "Nick", are optional but you are encouraged
# in using them to better identify your admins.
#
-# The authentication data is specified by Passphrase and/or Publickey.
+# The authentication data is specified by Passphrase and/or PublicKey.
# If both are provided then both password and public key based authentication
-# is allowed. If the Publickey is used it includes the file path to the
+# is allowed. If the PublicKey is used it includes the file path to the
# public key file. If none of them is provided then authentication is not
# required.
#
User = "priikone";
Nick = "pekka";
Passphrase = "verysecret";
- # Publickey = "/path/to/the/public.key";
+ # PublicKey = "/path/to/the/public.key";
};
#
# Thus, if this server is not router do not configure this section. If
# your server is router, this must be configured.
#
-# The authentication data is specified by Passphrase and/or Publickey.
+# The authentication data is specified by Passphrase and/or PublicKey.
# If both are provided then both password and public key based authentication
-# is allowed. If the Publickey is used it includes the file path to the
+# is allowed. If the PublicKey is used it includes the file path to the
# public key file. If none of them is provided then authentication is not
# required.
#
ServerConnection {
Host = "10.2.1.7";
Passphrase = "verysecret";
- # Publickey = "/path/to/the/public.key";
- VersionID = 1;
- Param = "normal";
+ #PublicKey = "/path/to/the/public.key";
+ Params = "normal";
Backup = false;
};
# this section includes all configured router connections. The first
# configured connection is the primary route.
#
-# The authentication data is specified by Passphrase and/or Publickey.
+# The authentication data is specified by Passphrase and/or PublicKey.
# If both are provided then both password and public key based authentication
-# is allowed. If the Publickey is used it includes the file path to the
+# is allowed. If the PublicKey is used it includes the file path to the
# public key file. If none of them is provided then authentication is not
# required.
#
# option to the IP address of the router that the backup router will
# replace if it becomes unavailable. Set also the router's port to the
# "BackupPort" option. For normal connection leave both commented. If this
-# backup router is in our cell then set the "LocalBackup" option to true.
+# backup router is in our cell then set the "BackupLocal" option to true.
# If the backup router is in other cell then set it to false.
#
RouterConnection {
Host = "10.2.1.100";
Port = 706;
Passphrase = "verysecret";
- # Publickey = "/path/to/the/public.key";
- VersionID = 1;
- Param = "normal";
+ #PublicKey = "/path/to/the/public.key";
+ Params = "normal";
Initiator = true;
#BackupHost = "10.2.1.6";
#BackupPort = 706;
- #LocalBackup = true;
+ #BackupLocal = true;
};
#
#
# These connections are denied to connect to our server.
#
-# The "Reason" field is mandatory, while the "Host" and "Port" fields can be
-# omitted to match everything.
+# The "Reason" field is mandatory, while the "Host" field can be omitted to
+# match everything.
#
#Deny {
# Host = "10.2.1.99";
-# Port = 706;
# Reason = "Go away spammer";
#};
#Deny {
projects / silc.git / blobdiff