Default configuration parameters

Default parameters

Use the set of default parameters, prefixed with Default to set your configuration, and also configure multiple connections. The parameters have a set of default values that you can be change. The values can be applied to the parameters prefixed with Default and also to the connection parameters.

Table 1. Default parameter values
A three column table that provides the default values that all broker connections use if there are no additional connections defined.
Keyword	Default Value	Required
ServerURL	<blank>	Yes
ProxyURL	<blank>	No
DefaultPortToListen	<blank>	Yes
DefaultBindTo	0.0.0.0	No
DefaultBindTo6	::	No
DefaultRetryDelay	45	No
DefaultKeepAlive	900	No
DefaultTLSCertificate	server.pem	No
DefaultTLSCertificatePassphrase	<blank>	No
DefaultTLSCipherList	TLSv1+HIGH:!SSLv2:!aNULL:!eNULL :!3DES:@STRENGTH	No
DefaultHTTPSCipherList	TLSv1:!SSLv2:!aNULL:!eNULL :!3DES:@STRENGTH	No

The default values can be used to set values for all connections. However, values that are set for specific connections override the default value for that connection.

Example 1: Using a default value

DefaultKeepAlive = 300

Inbound.1.ConnectionType = Inbound
Inbound.1.PortToListen = 8887

Broker.1.ConnectionType = Broker
Broker.1.DestinationAddress = broker1.example.com
Broker.1.DestinationPort = 8887

Broker.2.ConenctionType = Broker
Broker.2.DestinationAddress = broker2.example.com
Broker.2.DestinationPort = 8887
Broker.2.KeepAlive = 100

In this example, the DefaultKeepAlive value of 300 is used for the Inbound.1 connection and the Broker.1 connection. Setting the default parameter means that you do not need to add the property to each specific connection. However, the Broker.2 connection uses the KeepAlive value of 100 since the Broker.2.KeepAlive property is set. The specific connection value overrides the default value.

Example 2: Using specific values

Inbound.1.ConnectionType = Inbound
Inbound.1.PortToListen = 8887
Inbound.1.KeepAlive = 300

Broker.1.ConnectionType = Broker
Broker.1.DestinationAddress = broker1.example.com
Broker1.DestinationPort = 8887
Broker.1.KeepAlive = 300

In this example, no DefaultKeepAlive value is set. A KeepAlive property value is set for each specific connection.

Required default parameters

Required parameters do not have a built-in default value. These parameters must be set either to the value given in the file or within the connection configurations. When a required parameter is set in the connection parameters, this value overrides any default values set for the same parameter.

Table 2. Required parameters values used
A three column table that provides values that are used for required parameters, depending on where the parameters are set.
Default parameter set	Connection parameter set	Value Used
No	No	Not defined, a required parameter must be defined in the configuration.
No	Yes	Connection parameter is used
Yes	No	Default parameter is used.
Yes	Yes	Connection parameter is used.

Optional default parameters

Optional parameters have a built-in default value. If the parameter is not set within the default parameters or within the connection parameters, the built-in default value is used. If the parameter is set within the default parameters, but is not set within the connection parameters, the default parameter value is used by any connections.

Table 3. Optional parameters
A three column table that provides the values that are used for optional parameters, depending on where the parameters are set.
Default parameter set	Connection parameter set	Value used
No	No	Built in default value is used
No	Yes	Connection parameter is used
Yes	No	Default parameter is used
Yes	Yes	Connection parameter is used

Parameter definitions

DefaultPortToListen

Defines the TCP port that endpoints must use to connect to this broker. The port for listening for inbound connections. Required parameter.

DefaultSourcePort

Defines the port that the outgoing connection is using. This parameter is optional. Default is 0.

DefaultBindTo

This parameter is optional. Defines the IP address that is used to create connections with.

For example: my\connection.BindTo=192.0.2.0

Default is 0.0.0.0. Optional parameter.

DefaultBindTo6

This parameter is optional. Defines the IP address that is used to create connections with in IPv6 networks. Default is ::. Optional parameter.

DefaultRetryDelay

inbound connections: Defines the time in seconds between attempts to open the configured port for listening for incoming connections. Default is 45 seconds.
broker connections: Defines the time in seconds between attempts to establish or re-establish the control connection. This parameter is optional. Default is 45 seconds.

DefaultKeepAlive

Defines the time in seconds between keepalive requests. This parameter is optional. Default is 900 seconds.

DefaultTLSCertificateFile

Filename or path to the TLS certificate for this broker. For more information on creating and managing broker certificates, see Certificate management. Default is server.pem.

DefaultTLSCertificatePassphrase

Password for the private key that is associated with the TLS certificate This parameter is optional. For security purposes, the password is automatically encrypted when you start the broker. For more information, see Automatic passphrase encryption.

DefaultTLSCipherList and DefaultHTTPSCipherList

Use this configuration keyword to override the selection of cipher suites that can be used to secure network connections to or from a broker. A cipher suite is a combination of four cryptographic algorithms that are used together to create a secure communication channel. These algorithms are provided by a cryptographic module included with the broker. This module also includes algorithms for compatibility with an earlier versions, even if they are now considered to offer little or no security. By default, the broker selects only cipher suites that offer strong security. The default selection can be overridden if necessary. This is normally not needed, but can be used, for example, to disable an algorithm against which a new cryptographic attack is discovered. The documentation for the syntax of the cipher list can be found on the OpenSSL website. http://www.openssl.org/docs/apps/ciphers.html#CIPHER_LIST_FORMAT

Default Cipher List

TLSv1+HIGH: Only ciphers from the TLSv1 cipher suite with key lengths larger than 128 bits and some cipher suites with 128-bit keys.
TLSv1: Only ciphers from the TLSv1 cipher suite.
!SSLv2: Permanently remove all ciphers from the SSLv2 cipher suite.
!aNULL: Permanently remove all ciphers without authentication.
!eNULL: Permanently remove all ciphers without encryption.
!3DES: Permanently remove all ciphers that use the triple DES encryption algorithm.
@STRENGTH: Order the cipher list in order of encryption algorithm key length.

Note: The broker supports only TLSv1. Support for SSLv2 and SSLv3 is disabled due to known vulnerabilities in those versions of the protocol, even if you include SSLv2 or SSLv3 in the cipher list.

Types of cryptographic algorithms

Authentication: Verify the identity of the client or server that is using digital certificates.
Key Exchange: Establish shared secrets to be used as encryption keys and message authentication keys for the session.
Encryption: Protects the session data from being accessed by unauthorized entities.
Message authentication: Protects the session data from being tampered with.

With the version of OpenSSL that is included with the broker component and the default cipher list, the following ciphers can be used:

Encryption

AES key length 256 bits
AES key length 128 bits

Authentication

Key Exchange

RSA
Diffie-Hellman

Message Authentication

SHA-1