1# 2# Copyright 2005 Sun Microsystems, Inc. All rights reserved. 3# Use is subject to license terms. 4# 5# CDDL HEADER START 6# 7# The contents of this file are subject to the terms of the 8# Common Development and Distribution License, Version 1.0 only 9# (the "License"). You may not use this file except in compliance 10# with the License. 11# 12# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 13# or http://www.opensolaris.org/os/licensing. 14# See the License for the specific language governing permissions 15# and limitations under the License. 16# 17# When distributing Covered Code, include this CDDL HEADER in each 18# file and include the License file at usr/src/OPENSOLARIS.LICENSE. 19# If applicable, add the following below this CDDL HEADER, with the 20# fields enclosed by brackets "[]" replaced with your own identifying 21# information: Portions Copyright [yyyy] [name of copyright owner] 22# 23# CDDL HEADER END 24# 25# This file should be copied to /etc/inet/ipsecinit.conf to enable IPsec 26# systemwide policy (and as a side-effect, load IPsec kernel modules). 27# Even if this file has no entries, IPsec will be loaded if 28# /etc/inet/ipsecinit.conf exists. 29# 30# Add entries to protect the traffic using IPSEC. The entries in this 31# file are currently configured using ipsecconf from inetinit script 32# after /usr is mounted. 33# 34# For example, 35# 36# {rport 23} ipsec {encr_algs des encr_auth_algs md5} 37# 38# Or, in the older (but still usable) syntax 39# 40# {dport 23} apply {encr_algs des encr_auth_algs md5 sa shared} 41# {sport 23} permit {encr_algs des encr_auth_algs md5} 42# 43# will protect the telnet traffic originating from the host with ESP using 44# DES and MD5. Also: 45# 46# {raddr 10.5.5.0/24} ipsec {auth_algs any} 47# 48# Or, in the older (but still usable) syntax 49# 50# {daddr 10.5.5.0/24} apply {auth_algs any sa shared} 51# {saddr 10.5.5.0/24} permit {auth_algs any} 52# 53# will protect traffic to/from the 10.5.5.0 subnet with AH using any available 54# algorithm. 55# 56# To do basic filtering, a drop rule may be used. For example: 57# 58# {lport 23 dir in} drop {} 59# {lport 23 dir out} drop {} 60# 61# will disallow any remote system from telnetting in. 62# 63# If you are using IPv6, it may be useful to bypass neighbor discovery 64# to allow in.iked to work properly with on-link neighbors. To do that, 65# add the following lines: 66# 67# {ulp ipv6-icmp type 133-137 dir both } pass { } 68# 69# This will allow neighbor discovery to work normally. 70# 71# WARNING: This file is read before default routes are established, and 72# before any naming services have been started. The 73# ipsecconf(8) command attempts to resolve names, but it will 74# fail unless the machine uses files, or DNS and the DNS server 75# is reachable via routing information before ipsecconf(8) 76# invocation. (E.g. the DNS server is on-subnet, or DHCP 77# has loaded up the default router already.) 78# 79# It is suggested that for this file, use hostnames only if 80# they are in /etc/hosts, or use numeric IP addresses. 81# 82# If DNS gets used, the DNS server is implicitly trusted, which 83# could lead to compromise of this machine if the DNS server 84# has been compromised. 85# 86