# Securing sessions

> TCP-MD5 keys, GTSM, and who may use the control socket and the API.

## TCP-MD5 (RFC 2385)

```toml
[[neighbor]]
address = "10.0.0.1"
asn = 64501
password_file = "keys/r1"    # or password = "..."
```

`password_file` is read at (re)load, relative to the config; one trailing newline is ignored.
The installer creates `/etc/ansage` as root:ansage with files 0640, since they may hold keys.

## GTSM (RFC 5082)

```toml
[[neighbor]]
address = "10.0.0.1"
asn = 64501
ttl_security = 1             # at most this many hops away (1 = directly connected)
```

Packets with a lower TTL are dropped.

The router needs the same key and GTSM setting, see [Router configs](/docs/guides/router-config.md#tcp-md5-and-gtsm).

## Local access

- **Control socket** (`control_socket`, default `/run/ansage/ansage.sock`, empty: off): members
  of group `ansage` may use it (`ansage show`, `announce`, `drain`, ...). The installer adds
  `--operator USER` to that group.
- **Metrics and API** (`metrics_listen`): include session details and routes, so bind them to an
  address only trusted hosts reach. See [Metrics and API](/docs/guides/metrics-api.md).
- **Own prefixes by default**: `export = "own"` and `import = "none"` (RFC 8212) are the
  defaults, so nothing learned is used or passed on unless you ask for it. Learned routes only go
  out through a filter, to neighbors with a `role`, and the roles (RFC 9234) keep routes from
  providers and peers away from other providers and peers. See
  [Transit and filters](/docs/guides/transit.md).