---
name: "ionsecrc"
section: "5"
platform: "linux"
package: "ion"
version: "3.2.1+dfsg-1.1"
release: "Debian 9 (Stretch)"
platforms: ["linux"]
url: "https://new.carta.tech/ionsecrc"
---

# ionsecrc(5)

ION security policy management commands file

## NAME

ionsecrc - ION security policy management commands file

## DESCRIPTION

ION security policy management commands are passed to **ionsecadmin** either in a file of text lines or interactively at **ionsecadmin**'s command prompt (:).  Commands are interpreted line-by line, with exactly one command per line.  The formats and effects of the ION security policy management commands are described below.

A parameter identifed as an *eid\_expr* is an "endpoint ID expression."  For all commands, whenever the last character of an endpoint ID expression is the wild-card character '\*', an applicable endpoint ID "matches" this EID expression if all characters of the endpoint ID expression prior to the last one are equal to the corresponding characters of that endpoint ID.  Otherwise an applicable endpoint ID "matches" the EID expression only when all characters of the EID and EID expression are identical.

ION's security policy management encompasses both BP security and LTP authentication.

## COMMANDS

- **?**

  The **help** command.  This will display a listing of the commands and their formats.  It is the same as the **h** command.

- **#**

  Comment line.  Lines beginning with **#** are not interpreted.

- **e** { 1 \| 0 }

  Echo control.  Setting echo to 1 causes all output printed by ionsecadmin to be logged as well as sent to stdout.  Setting echo to 0 disables this behavior.

- **v**

  Version number.  Prints out the version of ION currently installed.  HINT: combine with **e 1** command to log the version number at startup.

- **1**

  The **initialize** command.  Until this command is executed, the local ION node has no security policy database and most *ionsecadmin* commands will fail.

- **a key** *key\_name* *file\_name*

  The **add key** command.  This command adds a named key value to the security policy database.  The content of *file\_name* is taken as the value of the key.  Named keys can be referenced by other elements of the security policy database.

- **c key** *key\_name* *file\_name*

  The **change key** command.  This command changes the value of the named key, obtaining the new key value from the content of *file\_name*.

- **d key** *key\_name*

  The **delete key** command.  This command deletes the key identified by *name*.

- **i key** *key\_name*

  This command will print information about the named key, i.e., the length of its current value.

- **l key**

  This command lists all keys in the security policy database.

- **a bspbabrule** *sender\_eid\_expr* *receiver\_eid\_expr* *{ '' \| ciphersuite\_name key\_name }*

  The **add bspbabrule** command.  This command adds a rule specifying the manner in which Bundle Authentication Block (BAB) validation will be applied to all bundles sent from any node whose endpoints' IDs match *sender\_eid\_expr* and received at any node whose endpoints' IDs match *receiver\_eid\_expr*.  Both *sender\_eid\_expr* and *receiver\_eid\_expr* should terminate in wild-card characters, because both the security source and security destination of a BAB are actually nodes rather than individual endpoints.

  If a zero-length string ('') is indicated instead of a *ciphersuite\_name* then BAB validation is disabled for this sender/receiver EID expression pair: all bundles sent from nodes with matching administrative endpoint IDs to nodes with matching administrative endpoint IDs will be immediately deemed authentic. Otherwise, a bundle from a node with matching administrative endpoint ID to a node with matching administrative endpoint ID will only be deemed authentic if it contains a BAB computed via the ciphersuite named by *ciphersuite\_name* using a key value that is identical to the current value of the key named *key\_name* in the local security policy database.

  **NOTE**: if the security policy database contains no BAB rules at all, then BAB authentication is disabled; all bundles received from all neighboring nodes are considered authentic.  Otherwise, BAB rules **must** be defined for all nodes from which bundles are to be received; all bundles received from any node for which no BAB rule is defined are considered inauthentic and are discarded.

- **c bspbabrule** *sender\_eid\_expr* *receiver\_eid\_expr* *{ '' \| ciphersuite\_name key\_name }*

  The **change bspbabrule** command.  This command changes the ciphersuite name and/or key name for the BAB rule pertaining to the sender/receiver EID expression pair identified by *sender\_eid\_expr* and *receiver\_eid\_expr*. Note that the *eid\_expr*s must exactly match those of the rule that is to be modified, including any terminating wild-card character.

- **d bspbabrule** *sender\_eid\_expr* *receiver\_eid\_expr*

  The **delete bspbabrule** command.  This command deletes the BAB rule pertaining to the sender/receiver EID expression pair identified by *sender\_eid\_expr* and *receiver\_eid\_expr*.  Note that the *eid\_expr*s must exactly match those of the rule that is to be deleted, including any terminating wild-card character.

- **i bspbabrule** *sender\_eid\_expr* *receiver\_eid\_expr*

  This command will print information (the ciphersuite and key names) about the BAB rule pertaining to *sender\_eid\_expr* and *receiver\_eid\_expr*.

- **l bspbabrule**

  This command lists all BAB rules in the security policy database.

- **a bsppibrule** *sender\_eid\_expr* *receiver\_eid\_expr* *block type number* *{ '' \| ciphersuite\_name key\_name }*

  The **add bsppibrule** command.  This command adds a rule specifying the manner in which Payload Integrity Block (PIB) validation will be applied to all bundles sent from any node whose administrative endpoint ID matches *sender\_eid\_expr* and received at any node whose administrative endpoint ID ID matches *receiver\_eid\_expr*.

  If a zero-length string ('') is indicated instead of a *ciphersuite\_name* then PIB validation is disabled for this sender/receiver EID expression pair: all bundles sent from nodes with matching administrative endpoint IDs to nodes with matching administrative endpoint IDs will be immediately deemed valid. Otherwise, a bundle from a node with matching administrative endpoint ID to a node with matching administrative endpoint ID will only be deemed valid if it contains a PIB computed via the ciphersuite named by *ciphersuite\_name* using a key value that is identical to the current value of the key named *key\_name* in the local security policy database.

- **c bsppibrule** *sender\_eid\_expr* *receiver\_eid\_expr* *block type number* *{ '' \| ciphersuite\_name key\_name }*

  The **change bsppibrule** command.  This command changes the ciphersuite name and/or key name for the PIB rule pertaining to the sender/receiver EID expression pair identified by *sender\_eid\_expr* and *receiver\_eid\_expr*. Note that the *eid\_expr*s must exactly match those of the rule that is to be modified, including any terminating wild-card character.

- **d bsppibrule** *sender\_eid\_expr* *receiver\_eid\_expr* *block type number*

  The **delete bsppibrule** command.  This command deletes the PIB rule pertaining to the sender/receiver EID expression pair identified by *sender\_eid\_expr* and *receiver\_eid\_expr*.  Note that the *eid\_expr*s must exactly match those of the rule that is to be deleted, including any terminating wild-card character.

- **i bsppibrule** *sender\_eid\_expr* *receiver\_eid\_expr* *block type number*

  This command will print information (the ciphersuite and key names) about the PIB rule pertaining to *sender\_eid\_expr* and *receiver\_eid\_expr*.

- **l bsppibrule**

  This command lists all PIB rules in the security policy database.

- **a ltprecvauthrule** *ltp\_engine\_id* *ciphersuite\_nbr* *\[key\_name\]*

  The **add ltprecvauthrule** command.  This command adds a rule specifying the manner in which LTP segment authentication will be applied to LTP segments received from the indicated LTP engine.

  A segment from the indicated LTP engine will only be deemed authentic if it contains an authentication extension computed via the ciphersuite identified by *ciphersuite\_nbr* using the applicable key value.  If *ciphersuite\_nbr* is 255 then the applicable key value is a hard-coded constant and *key\_name* must be omitted; otherwise *key\_name* is required and the applicable key value is the current value of the key named *key\_name* in the local security policy database.

  Valid values of *ciphersuite\_nbr* are:

  0: HMAC-SHA1-80 1: RSA-SHA256 255: NULL

- **c ltprecvauthrule** *ltp\_engine\_id* *ciphersuite\_nbr* *\[key\_name\]*

  The **change ltprecvauthrule** command.  This command changes the parameters of the LTP segment authentication rule for the indicated LTP engine.

- **d ltprecvauthrule** *ltp\_engine\_id*

  The **delete ltprecvauthrule** command.  This command deletes the LTP segment authentication rule for the indicated LTP engine.

- **i ltprecvauthrule** *ltp\_engine\_id*

  This command will print information (the LTP engine id, ciphersuite number, and key name) about the LTP segment authentication rule for the indicated LTP engine.

- **l ltprecvauthrule**

  This command lists all LTP segment authentication rules in the security policy database.

- **a ltpxmitauthrule** *ltp\_engine\_id* *ciphersuite\_nbr* *\[key\_name\]*

  The **add ltpxmitauthrule** command.  This command adds a rule specifying the manner in which LTP segments transmitted to the indicated LTP engine must be signed.

  Signing a segment destined for the indicated LTP engine entails computing an authentication extension via the ciphersuite identified by *ciphersuite\_nbr* using the applicable key value.  If *ciphersuite\_nbr* is 255 then the applicable key value is a hard-coded constant and *key\_name* must be omitted; otherwise *key\_name* is required and the applicable key value is the current value of the key named *key\_name* in the local security policy database.

  Valid values of *ciphersuite\_nbr* are:

  0: HMAC\_SHA1-80 1: RSA\_SHA256 255: NULL

- **c ltpxmitauthrule** *ltp\_engine\_id* *ciphersuite\_nbr* *\[key\_name\]*

  The **change ltpxmitauthrule** command.  This command changes the parameters of the LTP segment signing rule for the indicated LTP engine.

- **d ltpxmitauthrule** *ltp\_engine\_id*

  The **delete ltpxmitauthrule** command.  This command deletes the LTP segment signing rule for the indicated LTP engine.

- **i ltpxmitauthrule** *ltp\_engine\_id*

  This command will print information (the LTP engine id, ciphersuite number, and key name) about the LTP segment signing rule for the indicated LTP engine.

- **l ltpxmitauthrule**

  This command lists all LTP segment signing rules in the security policy database.

- **x** *\[ { ~ \| sender\_eid\_expr } \[ { ~ \| receiver\_eid\_expr} \[ { ~ \| bab \| pib \| pcb \| esb } \] \] \]*

  This command will clear all rules for the indicated type of bundle security block between the indicated security source and security destination.  If block type is omitted it defaults to **~** signifying "all BSP blocks".  If both block type and security destination are omitted, security destination defaults to **~** signifying "all BSP security destinations".  If all three command-line parameters are omitted, then security source defaults to **~** signifying "all BSP security sources".

- **h**

  The **help** command.  This will display a listing of the commands and their formats.  It is the same as the **?** command.

## EXAMPLES

- a key BABKEY ./babkey.txt

  Adds a new key named "BABKEY" whose value is the content of the file "./babkey.txt".

- a bspbabrule ipn:19.\* ipn:11.\* HMAC\_SHA1 BABKEY

  Adds a BAB rule requiring that all bundles sent from node number 19 to node number 11 contain Bundle Authentication Blocks computed via the HMAC\_SHA1 ciphersuite using a key value that is identical to the current value of the key named "BABKEY" in the local security policy database.

- c bspbabrule ipn:19.\* ipn:11.\* ''

  Changes the BAB rule pertaining to all bundles sent from node number 19 to node number 11.  BAB checking is disabled; these bundles will be automatically deemed authentic.

## SEE ALSO

[*ionsecadmin*(1)](/ionsecadmin/1.md)