/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos-clients.conf.xml

* mandos (Client.runtime_expansions): New attribute containing the
                                      allowed runtime expansions.

* mandos-clients.conf.xml (OPTIONS): Reordered alphabetically.

* mandos-ctl: Bug fix: print timeout and interval values pretty again.

* mandos-ctl.xml (EXAMPLE): Added more examples.

Show diffs side-by-side

added added

removed removed

Lines of Context:
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY CONFNAME "mandos-clients.conf">
5
5
<!ENTITY CONFPATH "<filename>/etc/mandos/clients.conf</filename>">
6
 
<!ENTITY TIMESTAMP "2011-09-19">
 
6
<!ENTITY TIMESTAMP "2010-09-25">
7
7
<!ENTITY % common SYSTEM "common.ent">
8
8
%common;
9
9
]>
34
34
    <copyright>
35
35
      <year>2008</year>
36
36
      <year>2009</year>
37
 
      <year>2010</year>
38
 
      <year>2011</year>
39
37
      <holder>Teddy Hogeborn</holder>
40
38
      <holder>Björn Påhlsson</holder>
41
39
    </copyright>
182
180
      </varlistentry>
183
181
      
184
182
      <varlistentry>
185
 
        <term><option>extended_timeout<literal> = </literal><replaceable
186
 
        >TIME</replaceable></option></term>
187
 
        <listitem>
188
 
          <para>
189
 
            This option is <emphasis>optional</emphasis>.
190
 
          </para>
191
 
          <para>
192
 
            Extended timeout is an added timeout that is given once
193
 
            after a password has been sent sucessfully to a client.
194
 
            The timeout is by default longer than the normal timeout,
195
 
            and is used for handling the extra long downtime while a
196
 
            machine is booting up.  Time to take into consideration
197
 
            when changing this value is file system checks and quota
198
 
            checks.  The default value is 15 minutes.
199
 
          </para>
200
 
          <para>
201
 
            The format of <replaceable>TIME</replaceable> is the same
202
 
            as for <varname>timeout</varname> below.
203
 
          </para>
204
 
        </listitem>
205
 
      </varlistentry>
206
 
      
207
 
      <varlistentry>
208
183
        <term><option>fingerprint<literal> = </literal
209
184
        ><replaceable>HEXSTRING</replaceable></option></term>
210
185
        <listitem>
252
227
            will wait for a checker to complete until the below
253
228
            <quote><varname>timeout</varname></quote> occurs, at which
254
229
            time the client will be disabled, and any running checker
255
 
            killed.  The default interval is 2 minutes.
 
230
            killed.  The default interval is 5 minutes.
256
231
          </para>
257
232
          <para>
258
233
            The format of <replaceable>TIME</replaceable> is the same
325
300
            The timeout is how long the server will wait (for either a
326
301
            successful checker run or a client receiving its secret)
327
302
            until a client is disabled and not allowed to get the data
328
 
            this server holds.  By default Mandos will use 5 minutes.
 
303
            this server holds.  By default Mandos will use 1 hour.
329
304
          </para>
330
305
          <para>
331
306
            The <replaceable>TIME</replaceable> is specified as a
381
356
        <quote><literal>%%(<replaceable>foo</replaceable>)s</literal
382
357
        ></quote> will be replaced by the value of the attribute
383
358
        <varname>foo</varname> of the internal
384
 
        <quote><classname>Client</classname></quote> object in the
385
 
        Mandos server.  The currently allowed values for
386
 
        <replaceable>foo</replaceable> are:
387
 
        <quote><literal>approval_delay</literal></quote>,
388
 
        <quote><literal>approval_duration</literal></quote>,
389
 
        <quote><literal>created</literal></quote>,
390
 
        <quote><literal>enabled</literal></quote>,
391
 
        <quote><literal>fingerprint</literal></quote>,
392
 
        <quote><literal>host</literal></quote>,
393
 
        <quote><literal>interval</literal></quote>,
394
 
        <quote><literal>last_approval_request</literal></quote>,
395
 
        <quote><literal>last_checked_ok</literal></quote>,
396
 
        <quote><literal>last_enabled</literal></quote>,
397
 
        <quote><literal>name</literal></quote>,
398
 
        <quote><literal>timeout</literal></quote>, and, if using
399
 
        D-Bus, <quote><literal>dbus_object_path</literal></quote>.
400
 
        See the source code for details.  <emphasis role="strong"
401
 
        >Currently, <emphasis>none</emphasis> of these attributes
402
 
        except <quote><literal>host</literal></quote> are guaranteed
403
 
        to be valid in future versions.</emphasis> Therefore, please
404
 
        let the authors know of any attributes that are useful so they
405
 
        may be preserved to any new versions of this software.
 
359
        <quote><classname>Client</classname></quote> object.  See the
 
360
        source code for details, and let the authors know of any
 
361
        attributes that are useful so they may be preserved to any new
 
362
        versions of this software.
406
363
      </para>
407
364
      <para>
408
365
        Note that this means that, in order to include an actual
443
400
    <informalexample>
444
401
      <programlisting>
445
402
[DEFAULT]
446
 
timeout = 5m
447
 
interval = 2m
 
403
timeout = 1h
 
404
interval = 5m
448
405
checker = fping -q -- %%(host)s
449
406
 
450
407
# Client "foo"
483
440
  <refsect1 id="see_also">
484
441
    <title>SEE ALSO</title>
485
442
    <para>
486
 
      <citerefentry><refentrytitle>intro</refentrytitle>
487
 
      <manvolnum>8mandos</manvolnum></citerefentry>,
488
443
      <citerefentry><refentrytitle>mandos-keygen</refentrytitle>
489
444
      <manvolnum>8</manvolnum></citerefentry>,
490
445
      <citerefentry><refentrytitle>mandos.conf</refentrytitle>