1 # User authentication method. Could be set multiple times and in that case
3 # Options: certificate, pam.
7 # The plain option requires specifying a password file which contains
8 # entries of the following format.
9 # "username:groupname:encoded-password"
10 # One entry must be listed per line, and 'ocpasswd' can be used
11 # to generate password entries.
12 auth = "plain[/etc/ocserv/ocpasswd]"
14 # A banner to be displayed on clients
15 banner = "Welcome to OpenWRT"
17 # Use listen-host to limit to specific IPs or to the IPs of a provided
19 #listen-host = [IP|HOSTNAME]
21 # Limit the number of clients. Unset or set to zero for unlimited.
25 # Limit the number of client connections to one every X milliseconds
26 # (X is the provided value). Set to zero for no limit.
29 # Limit the number of identical clients (i.e., users connecting
30 # multiple times). Unset or set to zero for unlimited.
33 # TCP and UDP port number
37 # Keepalive in seconds
40 # Dead peer detection in seconds.
43 # Dead peer detection for mobile clients. The needs to
44 # be much higher to prevent such clients being awaken too
45 # often by the DPD messages, and save battery.
46 # (clients that send the X-AnyConnect-Identifier-DeviceType)
49 # MTU discovery (DPD must be enabled)
50 try-mtu-discovery = false
52 # The key and the certificates of the server
53 # The key may be a file, or any URL supported by GnuTLS (e.g.,
54 # tpmkey:uuid=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx;storage=user
55 # or pkcs11:object=my-vpn-key;object-type=private)
57 # There may be multiple certificate and key pairs and each key
58 # should correspond to the preceding certificate.
59 server-cert = /etc/ocserv/server-cert.pem
60 server-key = /etc/ocserv/server-key.pem
62 # Diffie-Hellman parameters. Only needed if you require support
63 # for the DHE ciphersuites (by default this server supports ECDHE).
64 # Can be generated using:
65 # certtool --generate-dh-params --outfile /path/to/dh.pem
66 #dh-params = /path/to/dh.pem
68 # If you have a certificate from a CA that provides an OCSP
69 # service you may provide a fresh OCSP status response within
70 # the TLS handshake. That will prevent the client from connecting
71 # independently on the OCSP server.
72 # You can update this response periodically using:
73 # ocsptool --ask --load-cert=your_cert --load-issuer=your_ca --outfile response
74 # Make sure that you replace the following file in an atomic way.
75 #ocsp-response = /path/to/ocsp.der
77 # In case PKCS #11 or TPM keys are used the PINs should be available
78 # in files. The srk-pin-file is applicable to TPM keys only, and is the
80 #pin-file = /path/to/pin.txt
81 #srk-pin-file = /path/to/srkpin.txt
83 # The Certificate Authority that will be used to verify
84 # client certificates (public keys) if certificate authentication
86 #ca-cert = /etc/ocserv/ca.pem
88 # The object identifier that will be used to read the user ID in the client
89 # certificate. The object identifier should be part of the certificate's DN
91 # CN = 2.5.4.3, UID = 0.9.2342.19200300.100.1.1
92 #cert-user-oid = 0.9.2342.19200300.100.1.1
94 # The object identifier that will be used to read the user group in the
95 # client certificate. The object identifier should be part of the certificate's
96 # DN. Useful OIDs are:
97 # OU (organizational unit) = 2.5.4.11
98 #cert-group-oid = 2.5.4.11
100 # The revocation list of the certificates issued by the 'ca-cert' above.
101 #crl = /etc/ocserv/crl.pem
103 # GnuTLS priority string
104 tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT"
106 # To enforce perfect forward secrecy (PFS) on the main channel.
107 #tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA"
109 # The time (in seconds) that a client is allowed to stay connected prior
113 # The time (in seconds) that a client is allowed to stay idle (no traffic)
114 # before being disconnected. Unset to disable.
117 # The time (in seconds) that a mobile client is allowed to stay idle (no
118 # traffic) before being disconnected. Unset to disable.
119 #mobile-idle-timeout = 2400
121 # The time (in seconds) that a client is not allowed to reconnect after
122 # a failed authentication attempt.
125 # Cookie validity time (in seconds)
126 # Once a client is authenticated he's provided a cookie with
127 # which he can reconnect. This option sets the maximum lifetime
129 cookie-validity = 86400
131 # ReKey time (in seconds)
132 # ocserv will ask the client to refresh keys periodically once
133 # this amount of seconds is elapsed. Set to zero to disable.
137 # Valid options: ssl, new-tunnel
138 # ssl: Will perform an efficient rehandshake on the channel allowing
139 # a seamless connection during rekey.
140 # new-tunnel: Will instruct the client to discard and re-establish the channel.
141 # Use this option only if the connecting clients have issues with the ssl
145 # Script to call when a client connects and obtains an IP
146 # Parameters are passed on the environment.
147 # REASON, USERNAME, GROUPNAME, HOSTNAME (the hostname selected by client),
148 # DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP
149 # in the P-t-P connection), IP_REMOTE (the VPN IP of the client),
150 # ID (a unique numeric ID); REASON may be "connect" or "disconnect".
151 #connect-script = /scripts/ocserv-script
152 #disconnect-script = /scripts/ocserv-script
157 # D-BUS usage. If disabled occtl tool cannot be used. If enabled
158 # then ocserv must have access to register org.infradead.ocserv
159 # D-BUS service. See doc/dbus/org.infradead.ocserv.conf
162 # PID file. It can be overriden in the command line.
163 pid-file = /var/run/ocserv.pid
165 # The default server directory. Does not require any devices present.
166 chroot-dir = /var/lib/ocserv
168 # socket file used for IPC, will be appended with .PID
169 # It must be accessible within the chroot environment (if any)
170 #socket-file = /var/run/ocserv-socket
171 socket-file = ocserv-socket
173 # The user the worker processes will be run as. It should be
174 # unique (no other services run as this user).
176 run-as-group = ocserv
178 # Set the protocol-defined priority (SO_PRIORITY) for packets to
179 # be sent. That is a number from 0 to 6 with 0 being the lowest
180 # priority. Alternatively this can be used to set the IP Type-
181 # Of-Service, by setting it to a hexadecimal number (e.g., 0x20).
182 # This can be set per user/group or globally.
185 # Set the VPN worker process into a specific cgroup. This is Linux
186 # specific and can be set per user/group or globally.
187 #cgroup = "cpuset,cpu:test"
193 # The name of the tun device
196 # The default domain to be advertised
197 default-domain = example.com
199 # The pool of addresses that leases will be given from.
200 ipv4-network = 192.168.1.0
201 ipv4-netmask = 255.255.255.0
203 # The advertized DNS server. Use multiple lines for
208 # The NBNS server (if any)
211 # The IPv6 subnet that leases will be given from.
212 #ipv6-network = fc00::
215 # The domains over which the provided DNS should be used. Use
216 # multiple lines for multiple domains.
217 #split-dns = example.com
219 # Prior to leasing any IP from the pool ping it to verify that
220 # it is not in use by another (unrelated to this server) host.
223 # Unset to assign the default MTU of the device
226 # Unset to enable bandwidth restrictions (in bytes/sec). The
227 # setting here is global, but can also be set per user or per group.
228 #rx-data-per-sec = 40000
229 #tx-data-per-sec = 40000
231 # The number of packets (of MTU size) that are available in
232 # the output buffer. The default is low to improve latency.
233 # Setting it higher will improve throughput.
236 # Routes to be forwarded to the client. If you need the
237 # client to forward routes to the server, you may use the
238 # config-per-user/group or even connect and disconnect scripts.
240 # To set the server as the default gateway for the client just
241 # comment out all routes from the server.
242 route = 192.168.1.0/255.255.255.0
243 route = 192.168.5.0/255.255.255.0
244 #route = fef4:db8:1000:1001::/64
246 # Configuration files that will be applied per user connection or
247 # per group. Each file name on these directories must match the username
249 # The options allowed in the configuration files are dns, nbns,
250 # ipv?-network, ipv4-netmask, ipv6-prefix, rx/tx-per-sec, iroute, route,
251 # net-priority and cgroup.
253 # Note that the 'iroute' option allows to add routes on the server
254 # based on a user or group. The syntax depends on the input accepted
255 # by the commands route-add-cmd and route-del-cmd (see below).
257 #config-per-user = /etc/ocserv/config-per-user/
258 #config-per-group = /etc/ocserv/config-per-group/
260 # The system command to use to setup a route. %R will be replaced with the
261 # route/mask and %D with the (tun) device.
263 # The following example is from linux systems. %R should be something
264 # like 192.168.2.0/24
266 #route-add-cmd = "ip route add %R dev %D"
267 #route-del-cmd = "ip route delete %R dev %D"
270 # The following options are for (experimental) AnyConnect client
273 # Client profile xml. A sample file exists in doc/profile.xml.
274 # This file must be accessible from inside the worker's chroot.
275 # It is not used by the openconnect client.
276 #user-profile = profile.xml
278 # Binary files that may be downloaded by the CISCO client. Must
279 # be within any chroot environment.
280 #binary-files = /path/to/binaries
282 # Unless set to false it is required for clients to present their
283 # certificate even if they are authenticating via a previously granted
284 # cookie and complete their authentication in the same TCP connection.
285 # Legacy CISCO clients do not do that, and thus this option should be
287 cisco-client-compat = true
291 # Option to allow sending arbitrary custom headers to the client after
292 # authentication and prior to VPN tunnel establishment.
293 #custom-header = "X-My-Header: hi there"