/mandos/release : revision 115

1

<?xml version="1.0" encoding="UTF-8"?>

1

<?xml version='1.0' encoding='UTF-8'?>

2

<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"

3

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

4

<!ENTITY VERSION "1.0">

5

<!ENTITY CONFNAME "mandos-clients.conf">

6

<!ENTITY CONFPATH "<filename>/etc/mandos/clients.conf</filename>">

7

<!ENTITY TIMESTAMP "2008-09-04">

7

<!ENTITY TIMESTAMP "2008-08-29">

8

]>

9

10

10

11

12

<title>Mandos Manual</title>

13

35

<holder>Teddy Hogeborn</holder>

36

<holder>Björn Påhlsson</holder>

37

</copyright>

38

<xi:include href="legalnotice.xml"/>

38

39

<para>

40

This manual page is free software: you can redistribute it

41

and/or modify it under the terms of the GNU General Public

42

License as published by the Free Software Foundation,

43

either version 3 of the License, or (at your option) any

44

later version.

45

</para>

46

47

<para>

48

This manual page is distributed in the hope that it will

49

be useful, but WITHOUT ANY WARRANTY; without even the

50

implied warranty of MERCHANTABILITY or FITNESS FOR A

51

PARTICULAR PURPOSE. See the GNU General Public License

52

for more details.

53

</para>

54

55

<para>

56

You should have received a copy of the GNU General Public

57

License along with this program; If not, see

58

<ulink url="http://www.gnu.org/licenses/"/>.

59

</para>

60

</legalnotice>

39

61

</refentryinfo>

40

62

41

63

51

73

</refnamediv>

52

74

53

75

54

<synopsis>&CONFPATH;</synopsis>

76

77

&CONFPATH;

78

</synopsis>

55

79

</refsynopsisdiv>

56

80

57

81

93

117

start time expansion, see <xref linkend="expansion"/>.

94

118

</para>

95

119

<para>

96

Unknown options are ignored. The used options are as follows:

120

Uknown options are ignored. The used options are as follows:

97

121

</para>

98

122

99

123

100

124

101

125

102

<term><option>timeout<literal> = </literal><replaceable

103

>TIME</replaceable></option></term>

126

<term><literal><varname>timeout</varname></literal></term>

104

127

105

<para>

106

This option is <emphasis>optional</emphasis>.

107

</para>

128

<synopsis><literal>timeout = </literal><replaceable

129

>TIME</replaceable>

130

</synopsis>

108

131

<para>

109

132

The timeout is how long the server will wait for a

110

133

successful checker run until a client is considered

128

151

</varlistentry>

129

152

130

153

131

<term><option>interval<literal> = </literal><replaceable

132

>TIME</replaceable></option></term>

154

<term><literal><varname>interval</varname></literal></term>

133

155

134

<para>

135

This option is <emphasis>optional</emphasis>.

136

</para>

156

<synopsis><literal>interval = </literal><replaceable

157

>TIME</replaceable>

158

</synopsis>

137

159

<para>

138

160

How often to run the checker to confirm that a client is

139

161

still up. <emphasis>Note:</emphasis> a new checker will

148

170

as for <varname>timeout</varname> above.

149

171

</para>

150

172

</listitem>

151

</varlistentry>

173

</varlistentry>

152

174

153

175

154

<term><option>checker<literal> = </literal><replaceable

155

>COMMAND</replaceable></option></term>

176

<term><literal>checker</literal></term>

156

177

157

<para>

158

This option is <emphasis>optional</emphasis>.

159

</para>

178

<synopsis><literal>checker = </literal><replaceable

179

>COMMAND</replaceable>

180

</synopsis>

160

181

<para>

161

182

This option allows you to override the default shell

162

183

command that the server will use to check if the client is

179

200

</varlistentry>

180

201

181

202

182

<term><option>fingerprint<literal> = </literal

183

><replaceable>HEXSTRING</replaceable></option></term>

203

<term><literal>fingerprint</literal></term>

184

204

185

<para>

186

This option is <emphasis>required</emphasis>.

187

</para>

205

<synopsis><literal>fingerprint = </literal><replaceable

206

>HEXSTRING</replaceable>

207

</synopsis>

188

208

<para>

189

209

This option sets the OpenPGP fingerprint that identifies

190

210

the public key that clients authenticate themselves with

195

215

</varlistentry>

196

216

197

217

198

<term><option>secret<literal> = </literal><replaceable

199

>BASE64_ENCODED_DATA</replaceable></option></term>

218

<term><literal>secret</literal></term>

200

219

201

<para>

202

If this option is not specified, the <option

203

>secfile</option> option is <emphasis>required</emphasis>

204

to be present.

205

</para>

220

<synopsis><literal>secret = </literal><replaceable

221

>BASE64_ENCODED_DATA</replaceable>

222

</synopsis>

206

223

<para>

207

224

If present, this option must be set to a string of

208

225

base64-encoded binary data. It will be decoded and sent

221

238

lines is that a line beginning with white space adds to

222

239

the value of the previous line, RFC 822-style.

223

240

</para>

224

</listitem>

225

</varlistentry>

226

227

228

<term><option>secfile<literal> = </literal><replaceable

229

>FILENAME</replaceable></option></term>

230

231

<para>

232

This option is only used if <option>secret</option> is not

233

specified, in which case this option is

234

<emphasis>required</emphasis>.

235

</para>

236

<para>

237

Similar to the <option>secret</option>, except the secret

238

data is in an external file. The contents of the file

239

should <emphasis>not</emphasis> be base64-encoded, but

240

will be sent to clients verbatim.

241

</para>

242

</listitem>

243

</varlistentry>

244

245

246

<term><option><literal>host = </literal><replaceable

247

>STRING</replaceable></option></term>

248

249

<para>

250

This option is <emphasis>optional</emphasis>, but highly

251

<emphasis>recommended</emphasis> unless the

252

<option>checker</option> option is modified to a

253

non-standard value without <quote>%(host)s</quote> in it.

254

</para>

241

<para>

242

If this option is not specified, the <option

243

>secfile</option> option is used instead, but one of them

244

<emphasis>must</emphasis> be present.

245

</para>

246

</listitem>

247

</varlistentry>

248

249

250

<term><literal>secfile</literal></term>

251

252

<synopsis><literal>secfile = </literal><replaceable

253

>FILENAME</replaceable>

254

</synopsis>

255

<para>

256

The same as <option>secret</option>, but the secret data

257

is in an external file. The contents of the file should

258

<emphasis>not</emphasis> be base64-encoded, but will be

259

sent to clients verbatim.

260

</para>

261

<para>

262

This option is only used, and <emphasis>must</emphasis> be

263

present, if <option>secret</option> is not specified.

264

</para>

265

</listitem>

266

</varlistentry>

267

268

269

270

271

<synopsis><literal>host = </literal><replaceable

272

>STRING</replaceable>

273

</synopsis>

255

274

<para>

256

275

Host name for this client. This is not used by the server

257

276

directly, but can be, and is by default, used by the

261

280

</varlistentry>

262

281

263

282

</variablelist>

264

</refsect1>

283

</refsect1>

265

284

266

285

267

286

<title>EXPANSION</title>

310

329

percent characters in a row (<quote>%%%%</quote>) must be

311

330

entered. Also, a bad format here will lead to an immediate

312

331

but <emphasis>silent</emphasis> run-time fatal exit; debug

313

mode is needed to expose an error of this kind.

332

mode is needed to track down an error of this kind.

314

333

</para>

315

334

</refsect2>

316

335

317

</refsect1>

336

</refsect1>

318

337

319

338

320

339

<title>FILES</title>

376

395

377

396

</programlisting>

378

397

</informalexample>

379

</refsect1>

398

</refsect1>

380

399

381

400

382

401