  <varlistentry>
  <term><emphasis remap='B'>xauthby</emphasis></term>
  <listitem>
<para>When IKEv1 XAUTH support is available, set the method used by XAUTH to authenticate
the user with IKEv1. The currently supported values are <emphasis remap='I'>file</emphasis> (the default),
 <emphasis remap='I'>pam</emphasis> or  <emphasis remap='I'>alwaysok</emphasis>.
The password file is located at <emphasis remap='I'>/etc/ipsec.d/passwd</emphasis>,
and follows a syntax similar to the Apache htpasswd file, except an additional connection
name argument (and optional static IP address) are also present:
</para>
<para>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <emphasis remap='I'>username:password:conname:ipaddress</emphasis></para>
<para>For supported password hashing methods, see <citerefentry><refentrytitle>crypt</refentrytitle>
<manvolnum>3</manvolnum></citerefentry>. If pluto is running in FIPS mode, some hash methods,
such as MD5, might not be available. Threads are used
to launch an xauth authentication helper for file as well as PAM methods.
</para>
<para>The <emphasis remap='I'>alwaysok</emphasis> should only be used if the XAUTH user authentication is not really
used, but is required for interoperability, as it defeats the whole point of XAUTH which is to rely on a secret only
known by a human.
See also <emphasis remap='I'>pam-authorize=yes</emphasis>
</para>
</listitem>
  </varlistentry>
