/etc/grid-security/gsi.conf is in libglobus-gssapi-gsi4 13.4-1build1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 | # Minimum TLS protocol version. One of TLS1_VERSION, TLS1_1_VERSION,
# TLS1_2_VERSION or 0 for lowest (TLS1_VERSION). SSLv3 and below disallowed.
MIN_TLS_PROTOCOL=TLS1_VERSION
# Maximum TLS protocol version. One of TLS1_VERSION, TLS1_1_VERSION,
# TLS1_2_VERSION or 0 for highest. SSLv3 and below always disabled regardless.
MAX_TLS_PROTOCOL=0
# GSSAPI Name compatibility mode when trying to determine
# if a host certificate is legitimate. GSI predates RFC2818,
# so there are some old, less-secure, practices by default.
# The different modes are:
# STRICT_GT2:
# Strictly backward-compatible with GT 2.0 name matching.
# X.509 subjectAltName values are ignored. Names with
# hyphens are treated as wildcarded such that
# host-ANYTHING.example.com will match a certificate named
# host.example.com. The name matching will rely on canonical
# host (as resolved via getnameinfo) name associated with
# a connection's IP addresses.
# STRICT_RFC2818:
# Support RFC 2818 server identity processing. Hyphen
# characters are treated as normal part of a host name.
# dnsName and ipAddress subjectAltName extensions are matched
# against the host and port passed to GSSAPI. If subjectAltName
# is present, X.509 SubjectName is ignored.
# HYBRID:
# Support a hybrid of the two previous name matching algorithms,
# liberally matching both hyphen wildcards, canonical names
# associated with IP addresses, and subjectAltName extensions.
# This has been the default since GT 4.2
NAME_COMPATIBILITY=STRICT_RFC2818
# OpenSSL Cipher List. This is a preference-ordered list of OpenSSL cipher
# names in CIPHER LIST FORMAT specified in ciphers(1). Disregarded and
# 'eNULL:ALL:!COMPLEMENTOFDEFAULT' used instead, if GSS_C_CONF_FLAG not set
# by the application.
CIPHERS=HIGH
# If true, when choosing a cipher, a server will use its own preferred
# order instead of the cipher order presented by the client. When not set, the
# SSL server will always follow the clients preferences.
SERVER_CIPHER_ORDER=true
# If true, when computing a message integrity check, use the original
# implementation, which inspects internal OpenSSL structures. Otherwise,
# use keying material and sequence counters in the GSSAPI structures only.
# The true setting is only available for OpenSSL < 1.1.0
BACKWARD_COMPATIBLE_MIC=true
# If true, when verifying a message integrity check, accept MICs generated
# using the original implementation, which inspects internal OpenSSL
# structures. Otherwise, only use the new code which relies on use keying
# material and sequence counters in the GSSAPI structures only.
# The true setting is only available for OpenSSL < 1.1.0
ACCEPT_BACKWARD_COMPATIBLE_MIC=true
# If set to a non-root username, then files owned by that user are allowed
# to own credentials used by the root user
VHOST_CRED_OWNER=root
|