Allow to set auth_type for VRRP group
Keepalived supports two auth_types: PASS and AH
* PASS - is a plaintext authentication, attacker
can get password by simply sniffing traffic
* AH - IPSEC-AH uses IPSEC Authentication Header
This patch allows to set auth_type per VRRP instance and change
default value to AH
Related-Prod: PROD-16096
Change-Id: I55b914b44df5963cb66062449b0cee4234ee2fd5
diff --git a/README.rst b/README.rst
index 17410a4..eccd9a0 100644
--- a/README.rst
+++ b/README.rst
@@ -20,6 +20,7 @@
nopreempt: True
priority: 100 (highest priority must be on primary server, different for cluster members)
virtual_router_id: 51
+ auth_type: AH
password: pass
address: 192.168.10.1
interface: eth0
@@ -27,6 +28,7 @@
nopreempt: True
priority: 150 (highest priority must be on primary server, different for cluster members)
virtual_router_id: 52
+ auth_type: PASS
password: pass
address: 10.0.0.5
interface: eth1
diff --git a/keepalived/files/keepalived.conf b/keepalived/files/keepalived.conf
index bb88504..cdff79c 100644
--- a/keepalived/files/keepalived.conf
+++ b/keepalived/files/keepalived.conf
@@ -46,7 +46,7 @@
{%- endif %}
advert_int 1
authentication {
- auth_type PASS
+ auth_type {{ instance.get('auth_type', 'AH') }}
auth_pass {{ instance.password }}
}
virtual_ipaddress {