A listener defines a service exposed by a set of interfaces serving certain protocols.
Multiple listeners can be configured.
A listener configuration comprises the following configuration
The listener configurations introduced by the <LISTENER> tag are children of the <ICSCONFIG> tag and define a service comprising a set of interfaces serving certain communication protocols.
Multiple listeners can be configured to expose an arbitrary number of services.
<?xml version="1.0" encoding="utf-8"?>
<ICSCONFIG VERSION="1.0">
<LISTENER>
<INTERFACE ...>
...
</INTERFACE>
<PROTOCOLSPECIFIC:CONFIG...>
...
</PROTOCOLSPECIFIC:CONFIG>
</LISTENER>
<LISTENER>
<INTERFACE ...>
...
</INTERFACE>
<PROTOCOLSPECIFIC:CONFIG...>
...
</PROTOCOLSPECIFIC:CONFIG>
</LISTENER>
</ICSCONFIG>
The interface configurations introduced by the <INTERACE> tag are children of the <LISTENER> tag and define the protocol and the network port used for a listener configuration.
Multiple interfaces can be configured for a listener.
The interface configuration can have several child tags that set certain aspects of the interface like ADDRESS or SECURECONTEXT.
<INTERFACE PORT="80" PROTOCOL="1" IDLETIMEOUT="30">
<ADDRESS>ALL</ADDRESS>
<EXCEPT>::1</EXCEPT>
<SECURECONTEXT>
...
</SECURECONTEXT>
</INTERFACE>
The INTERFACE tag itself comprises three attributes
The PORT attribute defines the port at which the server should listen for incoming requests.
The PROTOCOL attribute defines the protocol plug-in which should be used to serve the requests. See PROTOCOLS configuration for a reference of the protocols supported.
The IDLETIMEOUT attribute defines the timeout in seconds for idle connections opened via this interface.
Clients which do not perform any request within the configured timeout will be closed by the server.
IDLETIMEOUT set to 0 will deactivate the timeout. Default is 30 seconds.
The address configurations introduced by the <ADDRESS> tag are children of the <INTERFACE> tag and define the local network addresses listening on the port defined by the interface configuration.
The port defined by the INTERFACE configuration and the network addresses defined by the ADDRESS configuration specify the inbound channel that requests are received on.
With this if a server has multiple network addresses the listener can be restricted to specific addresses.
ALL will establish listener ports on all network interfaces available on the server.
Multiple addresses can be specified.
<ADDRESS>ALL</ADDRESS>
If a ALL address is specified all other address tags are ignored.
The except configurations introduced by the <EXCEPT> tag are children of the <INTERFACE> tag and define the local network addresses that should be ignored. Multiple addresses can be specified.
This entry can be used in combination to the ADRESS ALL configuration. To ignore listening on IPv6 interface add the following
<EXCEPT>::1</EXCEPT>
The secure context configuration introduced by the <SECURECONTEXT> tag is a child of the <INTERFACE> tag and defines the ssl server certificate, the key and the ssl configuration to use for establishing secure connections via this interface.
The server certificate can be specified by the <SSLCERT> tag.
It should point to a PEM-encoded X.509 certificate file. It must contain at least a leaf certificate but may also include intermediate CA certificates, sorted from leaf to root and obsoletes.
This file must have read access by the underprivileged user that the worker process is started with.
The certificate key file can be specified by the <SSLCERTKEY> tag.
It should point to a PEM-encoded private key file for the server.
The key file should have read-only access for the user that starts the ics control process, but not for the underprivileged or other users.
Specifying SSL protocols within the <SSLDISABLEPROT> tag disable their usage.
Within the <SSLCIPHERS> tag the ciphers to be used for establishing secure connections can be specified.
The ciphers can be specified separated by colon applying the following prefixes:
You can use
openssl ciphers -v
to build up the SSLCIPHERS directive. The default depends on the version of the OpenSSL libraries used.
The following displays an example of a secure context configuration.
<SECURECONTEXT>
<SSLCERT>/etc/cert/server.crt</SSLCERT>
<SSLCERTKEY>/etc/cert/yasiserver.pem</SSLCERTKEY>
<SSLDISABLEPROT>sslv2</SSLDISABLEPROT>
<SSLCIPHERS USESERVERCIPHERS="YES">ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS</SSLCIPHERS>
</SECURECONTEXT>
When using ciphers utilizing the Diffie-Hellman key exchange it is recommended to perform the general secure socket configuration.
Note:The implementation switches off SSLCompression by default as it mostly causes security issues.
Extension Library specific configurations are children of the LISTENER tag and have a extension library specific namespace prefix to distinguish the configuration settings.
For extension specific configuration see Extension Libraries.