The DTD of the broker configuration file is shown below:

<!-- secsh-broker.dtd                                                   -->
<!--                                                                    -->
<!-- Copyright (c) 2004-2006 SSH Communications Security, Finland       -->
<!--               All rights reserved.                                 -->
<!--                                                                    -->
<!-- Document type definition for the Connection Broker XML             -->
<!-- configuration files.                                               -->
<!--                                                                    -->

<!-- The top-level element -->
<!ELEMENT secsh-broker  (general?,default-settings?,profiles?,
                         static-tunnels?,gui?,
                         filter-engine?,logging?)>
<!ATTLIST secsh-broker
          version        CDATA #IMPLIED>

<!-- General element. -->
<!ELEMENT general      (crypto-lib?,cert-validation?,key-stores?,
                        strict-host-key-checking?,host-key-always-ask?,
                        accept-unknown-host-keys?,known-hosts?)>

<!-- Cryptographic library. -->
<!ELEMENT crypto-lib     EMPTY>
<!ATTLIST crypto-lib
          mode  (fips|standard) "standard">

<!-- PKI settings. -->
<!ELEMENT cert-validation      (ldap-server*,ocsp-responder*,dod-pki?,
                                ca-certificate*)>
<!ATTLIST cert-validation
          end-point-identity-check (yes|no|YES|NO) "yes"
          default-domain      CDATA   #IMPLIED
          http-proxy-url      CDATA   #IMPLIED
          socks-server-url    CDATA   #IMPLIED>

<!ELEMENT ldap-server    EMPTY>
<!ATTLIST ldap-server
          address        CDATA #REQUIRED
          port           CDATA "389">

<!ELEMENT ocsp-responder EMPTY>
<!ATTLIST ocsp-responder
          url             CDATA #REQUIRED
          validity-period CDATA "0">

<!-- CA certificates. -->
<!ELEMENT ca-certificate (#PCDATA)>
<!ATTLIST ca-certificate
          name            CDATA #REQUIRED
          file            CDATA #IMPLIED
          disable-crls   (yes|no|YES|NO) "no"
          use-expired-crls CDATA "0" >

<!-- Enable DoD PKI compliancy. -->
<!ELEMENT dod-pki        EMPTY>
<!ATTLIST dod-pki
          enable        (yes|no|YES|NO) "no" >

<!ELEMENT key-stores (key-store*)>

<!ELEMENT key-store      EMPTY>
<!ATTLIST key-store
          type           CDATA #REQUIRED
          init           CDATA #IMPLIED>

<!ELEMENT strict-host-key-checking EMPTY>
<!ATTLIST strict-host-key-checking
          enable        (yes|no|YES|NO) #REQUIRED>

<!ELEMENT host-key-always-ask EMPTY>
<!ATTLIST host-key-always-ask
          enable        (yes|no|YES|NO) #REQUIRED>

<!ELEMENT accept-unknown-host-keys EMPTY>
<!ATTLIST accept-unknown-host-keys
          enable        (yes|no|YES|NO) #REQUIRED>

<!ELEMENT known-hosts    EMPTY>
<!ATTLIST known-hosts
          path           CDATA #REQUIRED>

<!-- Default settings element. -->
<!ELEMENT default-settings     (ciphers?, macs?,
                                transport-distribution?, rekey?,
                                authentication-methods?,
                                compression?, proxy?, idle-timeout?,
                                server-banners?, forwards?)>

<!-- Server banners. -->
<!ELEMENT server-banners EMPTY>
<!ATTLIST server-banners  
          visible       (yes|no|YES|NO) "yes">

<!-- Ciphers element. -->
<!ELEMENT ciphers       (cipher*)>

<!-- Cipher. -->
<!ELEMENT cipher         EMPTY>
<!ATTLIST cipher
          name           CDATA #REQUIRED>

<!-- Macs element. -->
<!ELEMENT macs          (mac*)>

<!-- Mac. -->
<!ELEMENT mac            EMPTY>
<!ATTLIST mac
          name           CDATA #REQUIRED>

<!ELEMENT rekey          EMPTY>
<!ATTLIST rekey
          bytes          CDATA "0">

<!-- Authentication methods element. -->
<!ELEMENT authentication-methods (authentication-method*)>

<!-- Transport distribution. -->
<!ELEMENT transport-distribution EMPTY>
<!ATTLIST transport-distribution
          num-transports CDATA #REQUIRED>

<!-- Authentication method. -->
<!ELEMENT authentication-method  EMPTY>
<!ATTLIST authentication-method
          name           CDATA #REQUIRED

<!-- Proxy rules. -->
<!ELEMENT proxy  EMPTY>
<!ATTLIST proxy
          ruleset        CDATA #REQUIRED>

<!-- Idle timeout. -->
<!ELEMENT idle-timeout   EMPTY>
<!ATTLIST idle-timeout
          type          (connection) "connection"
          time           CDATA #IMPLIED>

<!-- Forwards element. -->
<!ELEMENT forwards      (forward*)>

<!-- Forward. -->
<!ELEMENT forward        EMPTY>
<!ATTLIST forward
          type          (x11|agent)     #REQUIRED
          state         (on|off|denied) #REQUIRED>

<!-- Compression. -->
<!ELEMENT compression    EMPTY>
<!ATTLIST compression
          name           CDATA #IMPLIED
          level          CDATA #IMPLIED>

<!-- Profiles element. -->
<!ELEMENT profiles      (profile*)>

<!-- Connection profile. -->
<!ELEMENT profile       (hostkey?, ciphers?, macs?,
                         transport-distribution?, rekey?,
                         authentication-methods?,
                         compression?, proxy?, idle-timeout?,
                         server-banners?, forwards?, tunnels?)>
<!ATTLIST profile
          id             ID #REQUIRED
          name           CDATA #IMPLIED
          host           CDATA #REQUIRED
          port           CDATA "22"
          connect-on-startup (yes|no|YES|NO) "no"
          user           CDATA #IMPLIED
          gateway-profile CDATA #IMPLIED>

<!-- Hostkey. -->
<!ELEMENT hostkey       (#PCDATA)>
<!ATTLIST hostkey
          file           CDATA #IMPLIED>

<!-- Tunnels element. -->
<!ELEMENT tunnels       (local-tunnel*,remote-tunnel*)>

<!-- Local tunnel. -->
<!ELEMENT local-tunnel   EMPTY>
<!ATTLIST local-tunnel
          type           CDATA "tcp"
          listen-port    CDATA #REQUIRED
          dst-host       CDATA "127.0.0.1"
          dst-port       CDATA #REQUIRED
          allow-relay   (yes|no|YES|NO) "no">

<!-- Remote tunnel. -->
<!ELEMENT remote-tunnel  EMPTY>
<!ATTLIST remote-tunnel
          type           CDATA "tcp"
          listen-port    CDATA #REQUIRED
          dst-host       CDATA "127.0.0.1"
          dst-port       CDATA #REQUIRED
          allow-relay   (yes|no|YES|NO) "no">

<!-- Static tunnels element. -->
<!ELEMENT static-tunnels (tunnel*)>

<!-- Static tunnel. -->
<!ELEMENT tunnel         EMPTY>
<!ATTLIST tunnel
          type           CDATA "tcp"
          listen-port    CDATA #REQUIRED
          dst-host       CDATA "127.0.0.1"
          dst-port       CDATA #REQUIRED
          allow-relay   (yes|no|YES|NO) "no"
          profile        CDATA #REQUIRED>

<!-- GUI. -->
<!ELEMENT gui            EMPTY>
<!ATTLIST gui
          hide-tray-icon              (yes|no|YES|NO) #IMPLIED
          show-exit-button            (yes|no|YES|NO) #IMPLIED
          show-admin                  (yes|no|YES|NO) #IMPLIED
          enable-connector            (yes|no|YES|NO) #IMPLIED
          show-security-notification  (yes|no|YES|NO) #IMPLIED>

<!ELEMENT filter-engine      (network|dns|filter)*>
<!ATTLIST filter-engine
          ip-generate-start   CDATA #IMPLIED>

<!ELEMENT network        EMPTY>
<!ATTLIST network
          id                  ID    #REQUIRED
          address             CDATA #IMPLIED
          domain              CDATA #IMPLIED
          ip-generate-start   CDATA #IMPLIED>

<!ELEMENT dns EMPTY>
<!ATTLIST dns
          id                  ID    #REQUIRED
          network-id          IDREF #IMPLIED
          application         CDATA #IMPLIED
          host                CDATA #IMPLIED
          ip-address          CDATA #IMPLIED
          pseudo-ip          (yes|no|YES|NO) "no">

<!ELEMENT filter EMPTY>
<!ATTLIST filter
          dns-id              IDREF #REQUIRED
          ports               CDATA #REQUIRED
          action              CDATA #REQUIRED
          profile-id          CDATA #IMPLIED
          fallback-to-plain  (yes|no|YES|NO) "no">

<!ELEMENT logging            (log-events*)>

<!-- Log events. -->
<!-- Log event facility. -->
<!ENTITY default-log-event-facility    "normal">

<!-- Log event severity. -->
<!ENTITY default-log-event-severity    "notice">

<!ELEMENT log-events    (#PCDATA)>
<!ATTLIST log-events
          facility      (normal|daemon|user|auth|local0|local1|
                         local2|local3|local4|local5|local6|local7|discard)
                         "&default-log-event-facility;"
          severity      (informational|notice|warning|error|critical|
                         security-success|security-failure)
                         "&default-log-event-severity;">