---
name: "sasyncd.conf"
section: "5"
platform: "openbsd"
package: "man"
version: "8.0-current-20261101"
release: "OpenBSD 8.0-current (2026-11-01)"
platforms: ["openbsd"]
url: "https://new.carta.tech/sasyncd.conf"
---

# sasyncd.conf(5)

configuration file for sasyncd

## NAME

**sasyncd.conf** – configuration file for sasyncd

## DESCRIPTION

**sasyncd.conf** is the configuration file for the [sasyncd(8)](/sasyncd/8.md) daemon.

The current line can be extended over multiple lines using a backslash (‘\\’). Comments can be put anywhere in the file using a hash mark (‘#’), and extend to the end of the current line. Care should be taken when commenting out multi-line text: the comment is effective until the end of the entire block.

Since the file contains the shared secret key used to encrypt data between this host and the others, */etc/sasyncd.conf* must be owned either by “root” or the “\_isakmpd” pseudo user and be readable only by this owner, e.g.

```
# chown root /etc/sasyncd.conf
# chmod 0600 /etc/sasyncd.conf
```

The following configuration settings are understood:

-

  **interface** *interface* Specify which [carp(4)](/carp/4.md) interface [sasyncd(8)](/sasyncd/8.md) should track master/slave state on.

-

  **group** *group* Specify on which interface group [sasyncd(8)](/sasyncd/8.md) should increase the demotion counter. This has the effect of suppressing [carp(4)](/carp/4.md) preemption while initial [sasyncd(8)](/sasyncd/8.md) state is established. The default is to use the “carp” group.

  For more information on interface groups, see the **group** keyword in [ifconfig(8)](/ifconfig/8.md).

- **flushmode** **sync** \| **startup** \| **never**

  Controls how the [sasyncd(8)](/sasyncd/8.md) master host handles SADB\_FLUSH messages to its slaves.

  - **sync**

    Pass any SADB\_FLUSH messages along. For example, in this mode [sasyncd(8)](/sasyncd/8.md) will synchronize an **ipsecctl** **-F** command to all connected slaves. For more information, see [ipsecctl(8)](/ipsecctl/8.md).

  - **startup**

    Send a SADB\_FLUSH message to the slaves as they connect, and act as **sync** afterwards. This is the default.

  - **never**

    Never send SADB\_FLUSH messages.

-

  **listen** **on** *address* \[*family*\] \[**port** *port*\] Specify a local IP address, hostname, or interface the [sasyncd(8)](/sasyncd/8.md) daemon should listen on. The default is to listen on all local addresses. When using an interface name, *family* may be given as “inet” or “inet6” to only bind using the specified address family. Finally, *port* can be used to specify which TCP port [sasyncd(8)](/sasyncd/8.md) should listen to. The default is to listen to port 500.

- **mode** **master** \| **slave**

  Force the daemon to run as master or slave. Normally only intended for debugging use.

- **mode** **skipslave**

  Prevent the daemon from syncing SA or SPD messages where the source or destination address is one of the configured peers. Intended to permit IPsec [pfsync(4)](/pfsync/4.md) protection. This mode is experimental.

- **peer** *address*

  Specify a [sasyncd(8)](/sasyncd/8.md) peer IP address or hostname. May be specified multiple times. For example:

  ```
  peer 10.0.0.2
  peer 10.0.0.3
  peer 10.0.0.4
  ```

- **sharedkey** *key*

  The shared AES key used to encrypt messages between [sasyncd(8)](/sasyncd/8.md) hosts. This configuration setting is required and must be either 16, 24 or 32 bytes long (corresponding to AES using a 128, 192 or 256 bit key).

- **control** **isakmpd** \| **iked** \| **all** \| **none**

  By default, [sasyncd(8)](/sasyncd/8.md) tracks its local master/slave mode and toggles the passive mode of [isakmpd(8)](/isakmpd/8.md) accordingly. This option can be changed to control [iked(8)](/iked/8.md) instead, to control all supported daemons at the same time, or to turn it off to synchronize SAs only.

## FILES

- */etc/sasyncd.conf*

  - */etc/examples/sasyncd.conf*

  ## SEE ALSO

[chmod(1)](/chmod/1.md), [carp(4)](/carp/4.md), [chown(8)](/chown/8.md), [ipsecctl(8)](/ipsecctl/8.md), [sasyncd(8)](/sasyncd/8.md)

## HISTORY

The **sasyncd.conf** file format first appeared in OpenBSD 3.8.