00001 static char *globus_l_gsi_conf_string = 00002 "# Minimum TLS protocol version. One of TLS1_VERSION, TLS1_1_VERSION,\n" 00003 "# TLS1_2_VERSION or 0 for lowest (TLS1_VERSION). SSLv3 and below disallowed.\n" 00004 "MIN_TLS_PROTOCOL=TLS1_VERSION\n" 00005 "# Maximum TLS protocol version. One of TLS1_VERSION, TLS1_1_VERSION,\n" 00006 "# TLS1_2_VERSION or 0 for highest. SSLv3 and below always disabled regardless.\n" 00007 "MAX_TLS_PROTOCOL=0\n" 00008 "# GSSAPI Name compatibility mode when trying to determine\n" 00009 "# if a host certificate is legitimate. GSI predates RFC2818,\n" 00010 "# so there are some old, less-secure, practices by default.\n" 00011 "# The different modes are:\n" 00012 "# STRICT_GT2:\n" 00013 "# Strictly backward-compatible with GT 2.0 name matching. \n" 00014 "# X.509 subjectAltName values are ignored. Names with\n" 00015 "# hyphens are treated as wildcarded such that \n" 00016 "# host-ANYTHING.example.com will match a certificate named\n" 00017 "# host.example.com. The name matching will rely on canonical\n" 00018 "# host (as resolved via getnameinfo) name associated with\n" 00019 "# a connection's IP addresses.\n" 00020 "# STRICT_RFC2818:\n" 00021 "# Support RFC 2818 server identity processing. Hyphen \n" 00022 "# characters are treated as normal part of a host name. \n" 00023 "# dnsName and ipAddress subjectAltName extensions are matched\n" 00024 "# against the host and port passed to GSSAPI. If subjectAltName \n" 00025 "# is present, X.509 SubjectName is ignored. \n" 00026 "# HYBRID:\n" 00027 "# Support a hybrid of the two previous name matching algorithms,\n" 00028 "# liberally matching both hyphen wildcards, canonical names\n" 00029 "# associated with IP addresses, and subjectAltName extensions.\n" 00030 "# This has been the default since GT 4.2\n" 00031 "NAME_COMPATIBILITY=STRICT_RFC2818\n" 00032 "# OpenSSL Cipher List. This is a preference-ordered list of OpenSSL cipher\n" 00033 "# names in CIPHER LIST FORMAT specified in ciphers(1). Disregarded and\n" 00034 "# 'eNULL:ALL:!COMPLEMENTOFDEFAULT' used instead, if GSS_C_CONF_FLAG not set\n" 00035 "# by the application.\n" 00036 "CIPHERS=HIGH\n" 00037 "# If true, when choosing a cipher, a server will use its own preferred\n" 00038 "# order instead of the cipher order presented by the client. When not set, the\n" 00039 "# SSL server will always follow the clients preferences.\n" 00040 "SERVER_CIPHER_ORDER=true\n" 00041 "# If true, when computing a message integrity check, use the original\n" 00042 "# implementation, which inspects internal OpenSSL structures. Otherwise,\n" 00043 "# use keying material and sequence counters in the GSSAPI structures only.\n" 00044 "# The true setting is only available for OpenSSL < 1.1.0\n" 00045 "BACKWARD_COMPATIBLE_MIC=true\n" 00046 "# If true, when verifying a message integrity check, accept MICs generated\n" 00047 "# using the original implementation, which inspects internal OpenSSL\n" 00048 "# structures. Otherwise, only use the new code which relies on use keying\n" 00049 "# material and sequence counters in the GSSAPI structures only.\n" 00050 "# The true setting is only available for OpenSSL < 1.1.0\n" 00051 "ACCEPT_BACKWARD_COMPATIBLE_MIC=true\n" 00052 "# If set to a non-root username, then files owned by that user are allowed\n" 00053 "# to own credentials used by the root user\n" 00054 "VHOST_CRED_OWNER=root\n" 00055 ;