mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-26 17:01:14 -06:00
9101cfa60f
Tickets: https://fedorahosted.org/freeipa/ticket/3801 https://fedorahosted.org/freeipa/ticket/4417 Design: https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
151 lines
3.2 KiB
XML
151 lines
3.2 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
|
|
<!--
|
|
|
|
NOTE: The default policy below is a TEMPLATE ONLY and should be reviewed
|
|
before used in any production environment. The administrator should
|
|
consult the OpenDNSSEC documentation before changing any parameters.
|
|
|
|
If you can read this message, it is likely that this file has not
|
|
been reviewed nor updated.
|
|
|
|
-->
|
|
|
|
<KASP>
|
|
|
|
<Policy name="default">
|
|
<Description>A default policy that will amaze you and your friends</Description>
|
|
<Signatures>
|
|
<Resign>PT2H</Resign>
|
|
<Refresh>P3D</Refresh>
|
|
<Validity>
|
|
<Default>P14D</Default>
|
|
<Denial>P14D</Denial>
|
|
</Validity>
|
|
<Jitter>PT12H</Jitter>
|
|
<InceptionOffset>PT3600S</InceptionOffset>
|
|
</Signatures>
|
|
|
|
<Denial>
|
|
<NSEC3>
|
|
<!-- <TTL>PT0S</TTL> -->
|
|
<!-- <OptOut/> -->
|
|
<Resalt>P100D</Resalt>
|
|
<Hash>
|
|
<Algorithm>1</Algorithm>
|
|
<Iterations>5</Iterations>
|
|
<Salt length="8"/>
|
|
</Hash>
|
|
</NSEC3>
|
|
</Denial>
|
|
|
|
<Keys>
|
|
<!-- Parameters for both KSK and ZSK -->
|
|
<TTL>PT3600S</TTL>
|
|
<RetireSafety>PT3600S</RetireSafety>
|
|
<PublishSafety>PT3600S</PublishSafety>
|
|
<!-- <ShareKeys/> -->
|
|
<Purge>P14D</Purge>
|
|
|
|
<!-- Parameters for KSK only -->
|
|
<KSK>
|
|
<Algorithm length="2048">8</Algorithm>
|
|
<Lifetime>P1Y</Lifetime>
|
|
<Repository>SoftHSM</Repository>
|
|
</KSK>
|
|
|
|
<!-- Parameters for ZSK only -->
|
|
<ZSK>
|
|
<Algorithm length="2048">8</Algorithm>
|
|
<Lifetime>P90D</Lifetime>
|
|
<Repository>SoftHSM</Repository>
|
|
<!-- <ManualRollover/> -->
|
|
</ZSK>
|
|
</Keys>
|
|
|
|
<Zone>
|
|
<PropagationDelay>PT43200S</PropagationDelay>
|
|
<SOA>
|
|
<TTL>PT3600S</TTL>
|
|
<Minimum>PT3600S</Minimum>
|
|
<Serial>unixtime</Serial>
|
|
</SOA>
|
|
</Zone>
|
|
|
|
<Parent>
|
|
<PropagationDelay>PT9999S</PropagationDelay>
|
|
<DS>
|
|
<TTL>PT3600S</TTL>
|
|
</DS>
|
|
<SOA>
|
|
<TTL>PT172800S</TTL>
|
|
<Minimum>PT10800S</Minimum>
|
|
</SOA>
|
|
</Parent>
|
|
|
|
</Policy>
|
|
|
|
<Policy name="lab">
|
|
<Description>Quick turnaround policy for lab work</Description>
|
|
<Signatures>
|
|
<Resign>PT10M</Resign>
|
|
<Refresh>PT30M</Refresh>
|
|
<Validity>
|
|
<Default>PT1H</Default>
|
|
<Denial>PT1H</Denial>
|
|
</Validity>
|
|
<Jitter>PT1M</Jitter>
|
|
<InceptionOffset>PT3600S</InceptionOffset>
|
|
</Signatures>
|
|
|
|
<Denial>
|
|
<NSEC/>
|
|
</Denial>
|
|
|
|
<Keys>
|
|
<!-- Parameters for both KSK and ZSK -->
|
|
<TTL>PT300S</TTL>
|
|
<RetireSafety>PT360S</RetireSafety>
|
|
<PublishSafety>PT360S</PublishSafety>
|
|
<!-- <ShareKeys/> -->
|
|
<Purge>P14D</Purge>
|
|
|
|
<!-- Parameters for KSK only -->
|
|
<KSK>
|
|
<Algorithm length="2048">8</Algorithm>
|
|
<Lifetime>P1Y</Lifetime>
|
|
<Repository>SoftHSM</Repository>
|
|
</KSK>
|
|
|
|
<!-- Parameters for ZSK only -->
|
|
<ZSK>
|
|
<Algorithm length="2048">8</Algorithm>
|
|
<Lifetime>PT4H</Lifetime>
|
|
<Repository>SoftHSM</Repository>
|
|
<!-- <ManualRollover/> -->
|
|
</ZSK>
|
|
</Keys>
|
|
|
|
<Zone>
|
|
<PropagationDelay>PT300S</PropagationDelay>
|
|
<SOA>
|
|
<TTL>PT300S</TTL>
|
|
<Minimum>PT300S</Minimum>
|
|
<Serial>unixtime</Serial>
|
|
</SOA>
|
|
</Zone>
|
|
|
|
<Parent>
|
|
<PropagationDelay>PT9999S</PropagationDelay>
|
|
<DS>
|
|
<TTL>PT3600S</TTL>
|
|
</DS>
|
|
<SOA>
|
|
<TTL>PT172800S</TTL>
|
|
<Minimum>PT10800S</Minimum>
|
|
</SOA>
|
|
</Parent>
|
|
|
|
</Policy>
|
|
</KASP>
|