Securing sessions

TCP-MD5 (RFC 2385)

[[neighbor]]
address = "10.0.0.1"
asn = 64501
password_file = "keys/r1"    # or password = "..."

password_file is read at (re)load, relative to the config; one trailing newline is ignored. The installer creates /etc/ansage as root:ansage with files 0640, since they may hold keys.

GTSM (RFC 5082)

[[neighbor]]
address = "10.0.0.1"
asn = 64501
ttl_security = 1             # at most this many hops away (1 = directly connected)

Packets with a lower TTL are dropped.

The router needs the same key and GTSM setting, see Router configs.

Local access

• Control socket (control_socket, default /run/ansage/ansage.sock, empty: off): members of group ansage may use it (ansage show, announce, drain, ...). The installer adds --operator USER to that group.
• Metrics and API (metrics_listen): include session details and routes, so bind them to an address only trusted hosts reach. See Metrics and API.
• Own prefixes by default: export = "own" and import = "none" (RFC 8212) are the defaults, so nothing learned is used or passed on unless you ask for it. Learned routes only go out through a filter, to neighbors with a role, and the roles (RFC 9234) keep routes from providers and peers away from other providers and peers. See Transit and filters.