globus_gssapi_gsi  12.17
gsi.conf.h
1 static char *globus_l_gsi_conf_string =
2 "# Minimum TLS protocol version. One of TLS1_VERSION, TLS1_1_VERSION,\n"
3 "# TLS1_2_VERSION or 0 for lowest (TLS1_VERSION). SSLv3 and below disallowed.\n"
4 "MIN_TLS_PROTOCOL=TLS1_VERSION\n"
5 "# Maximum TLS protocol version. One of TLS1_VERSION, TLS1_1_VERSION,\n"
6 "# TLS1_2_VERSION or 0 for highest. SSLv3 and below always disabled regardless.\n"
7 "MAX_TLS_PROTOCOL=0\n"
8 "# GSSAPI Name compatibility mode when trying to determine\n"
9 "# if a host certificate is legitimate. GSI predates RFC2818,\n"
10 "# so there are some old, less-secure, practices by default.\n"
11 "# The different modes are:\n"
12 "# STRICT_GT2:\n"
13 "# Strictly backward-compatible with GT 2.0 name matching. \n"
14 "# X.509 subjectAltName values are ignored. Names with\n"
15 "# hyphens are treated as wildcarded such that \n"
16 "# host-ANYTHING.example.com will match a certificate named\n"
17 "# host.example.com. The name matching will rely on canonical\n"
18 "# host (as resolved via getnameinfo) name associated with\n"
19 "# a connection's IP addresses.\n"
20 "# STRICT_RFC2818:\n"
21 "# Support RFC 2818 server identity processing. Hyphen \n"
22 "# characters are treated as normal part of a host name. \n"
23 "# dnsName and ipAddress subjectAltName extensions are matched\n"
24 "# against the host and port passed to GSSAPI. If subjectAltName \n"
25 "# is present, X.509 SubjectName is ignored. \n"
26 "# HYBRID:\n"
27 "# Support a hybrid of the two previous name matching algorithms,\n"
28 "# liberally matching both hyphen wildcards, canonical names\n"
29 "# associated with IP addresses, and subjectAltName extensions.\n"
30 "# This has been the default since GT 4.2\n"
31 "NAME_COMPATIBILITY=STRICT_RFC2818\n"
32 "# OpenSSL Cipher List. This is a preference-ordered list of OpenSSL cipher\n"
33 "# names in CIPHER LIST FORMAT specified in ciphers(1). Disregarded and\n"
34 "# 'eNULL:ALL:!COMPLEMENTOFDEFAULT' used instead, if GSS_C_CONF_FLAG not set\n"
35 "# by the application.\n"
36 "CIPHERS=HIGH\n"
37 "# If true, when choosing a cipher, a server will use its own preferred\n"
38 "# order instead of the cipher order presented by the client. When not set, the\n"
39 "# SSL server will always follow the clients preferences.\n"
40 "SERVER_CIPHER_ORDER=true\n"
41 "# If true, when computing a message integrity check, use the original\n"
42 "# implementation, which inspects internal OpenSSL structures. Otherwise,\n"
43 "# use keying material and sequence counters in the GSSAPI structures only.\n"
44 "# The true setting is only available for OpenSSL < 1.1.0\n"
45 "BACKWARD_COMPATIBLE_MIC=true\n"
46 "# If true, when verifying a message integrity check, accept MICs generated\n"
47 "# using the original implementation, which inspects internal OpenSSL\n"
48 "# structures. Otherwise, only use the new code which relies on use keying\n"
49 "# material and sequence counters in the GSSAPI structures only.\n"
50 "# The true setting is only available for OpenSSL < 1.1.0\n"
51 "ACCEPT_BACKWARD_COMPATIBLE_MIC=true\n"
52 ;