/mandos/release : revision 237.2.208

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos-clients.conf.xml

Committer: Teddy Hogeborn
Date: 2010-09-26 21:27:28 UTC
mto: (24.1.168 mandos) (237.12.2 mandos-persistent) (299.1.1 release) (300.1.1 release) (301.1.1 release)
mto: This revision was merged to the branch mainline in revision 270.
Revision ID: teddy@fukt.bsnet.se-20100926212728-ej205k5037nfhz2g

Update copyright year to "2010" wherever appropriate.

* plugin-runner.c: - '' -
* plugins.d/mandos-client.c: - '' -

Show diffs side-by-side

added added

removed removed

mandos-clients.conf.xml

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

<!ENTITY CONFNAME "mandos-clients.conf">

<!ENTITY CONFPATH "<filename>/etc/mandos/clients.conf</filename>">

<!ENTITY TIMESTAMP "2009-12-09">

<!ENTITY TIMESTAMP "2010-09-26">

<!ENTITY % common SYSTEM "common.ent">

%common;

<holder>Teddy Hogeborn</holder>

<holder>Björn Påhlsson</holder>

</copyright>

100

101

101

102

103

103

<term><option>timeout<literal> = </literal><replaceable

104

>TIME</replaceable></option></term>

105

106

<para>

107

This option is <emphasis>optional</emphasis>.

108

</para>

109

<para>

110

The timeout is how long the server will wait (for either a

111

successful checker run or a client receiving its secret)

112

until a client is disabled and not allowed to get the data

113

this server holds. By default Mandos will use 1 hour.

114

</para>

115

<para>

116

The <replaceable>TIME</replaceable> is specified as a

117

space-separated number of values, each of which is a

118

number and a one-character suffix. The suffix must be one

119

of <quote>d</quote>, <quote>s</quote>, <quote>m</quote>,

120

<quote>h</quote>, and <quote>w</quote> for days, seconds,

121

minutes, hours, and weeks, respectively. The values are

122

added together to give the total time value, so all of

123

<quote><literal>330s</literal></quote>,

124

<quote><literal>110s 110s 110s</literal></quote>, and

125

<quote><literal>5m 30s</literal></quote> will give a value

126

of five minutes and thirty seconds.

127

</para>

128

</listitem>

129

</varlistentry>

130

131

132

<term><option>interval<literal> = </literal><replaceable

133

>TIME</replaceable></option></term>

134

135

<para>

136

This option is <emphasis>optional</emphasis>.

137

</para>

138

<para>

139

How often to run the checker to confirm that a client is

140

still up. <emphasis>Note:</emphasis> a new checker will

141

not be started if an old one is still running. The server

142

will wait for a checker to complete until the above

143

<quote><varname>timeout</varname></quote> occurs, at which

144

time the client will be disabled, and any running checker

145

killed. The default interval is 5 minutes.

146

</para>

147

<para>

148

The format of <replaceable>TIME</replaceable> is the same

149

as for <varname>timeout</varname> above.

104

<term><option>approval_delay<literal> = </literal><replaceable

105

>TIME</replaceable></option></term>

106

107

<para>

108

This option is <emphasis>optional</emphasis>.

109

</para>

110

<para>

111

How long to wait for external approval before resorting to

112

use the <option>approved_by_default</option> value. The

113

default is <quote>0s</quote>, i.e. not to wait.

114

</para>

115

<para>

116

The format of <replaceable>TIME</replaceable> is the same

117

as for <varname>timeout</varname> below.

118

</para>

119

</listitem>

120

</varlistentry>

121

122

123

<term><option>approval_duration<literal> = </literal

124

><replaceable>TIME</replaceable></option></term>

125

126

<para>

127

This option is <emphasis>optional</emphasis>.

128

</para>

129

<para>

130

How long an external approval lasts. The default is 1

131

second.

132

</para>

133

<para>

134

The format of <replaceable>TIME</replaceable> is the same

135

as for <varname>timeout</varname> below.

136

</para>

137

</listitem>

138

</varlistentry>

139

140

141

<term><option>approved_by_default<literal> = </literal

142

>{ <literal >1</literal> | <literal>yes</literal> | <literal

143

>true</literal> | <literal>on</literal> | <literal

144

>0</literal> | <literal>no</literal> | <literal

145

>false</literal> | <literal>off</literal> }</option></term>

146

147

<para>

148

Whether to approve a client by default after

149

the <option>approval_delay</option>. The default

150

is <quote>True</quote>.

150

151

</para>

151

152

</listitem>

152

153

</varlistentry>

196

197

</varlistentry>

197

198

199

200

<term><option><literal>host = </literal><replaceable

201

>STRING</replaceable></option></term>

202

203

<para>

204

This option is <emphasis>optional</emphasis>, but highly

205

<emphasis>recommended</emphasis> unless the

206

<option>checker</option> option is modified to a

207

non-standard value without <quote>%%(host)s</quote> in it.

208

</para>

209

<para>

210

Host name for this client. This is not used by the server

211

directly, but can be, and is by default, used by the

212

checker. See the <option>checker</option> option.

213

</para>

214

</listitem>

215

</varlistentry>

216

217

218

<term><option>interval<literal> = </literal><replaceable

219

>TIME</replaceable></option></term>

220

221

<para>

222

This option is <emphasis>optional</emphasis>.

223

</para>

224

<para>

225

How often to run the checker to confirm that a client is

226

still up. <emphasis>Note:</emphasis> a new checker will

227

not be started if an old one is still running. The server

228

will wait for a checker to complete until the below

229

<quote><varname>timeout</varname></quote> occurs, at which

230

time the client will be disabled, and any running checker

231

killed. The default interval is 5 minutes.

232

</para>

233

<para>

234

The format of <replaceable>TIME</replaceable> is the same

235

as for <varname>timeout</varname> below.

236

</para>

237

</listitem>

238

</varlistentry>

239

240

241

<term><option>secfile<literal> = </literal><replaceable

242

>FILENAME</replaceable></option></term>

243

244

<para>

245

This option is only used if <option>secret</option> is not

246

specified, in which case this option is

247

<emphasis>required</emphasis>.

248

</para>

249

<para>

250

Similar to the <option>secret</option>, except the secret

251

data is in an external file. The contents of the file

252

should <emphasis>not</emphasis> be base64-encoded, but

253

will be sent to clients verbatim.

254

</para>

255

<para>

256

File names of the form <filename>~user/foo/bar</filename>

257

and <filename>$<envar>ENVVAR</envar>/foo/bar</filename>

258

are supported.

259

</para>

260

</listitem>

261

</varlistentry>

262

263

199

264

<term><option>secret<literal> = </literal><replaceable

200

265

>BASE64_ENCODED_DATA</replaceable></option></term>

201

266

226

291

</varlistentry>

227

292

228

293

229

<term><option>secfile<literal> = </literal><replaceable

230

>FILENAME</replaceable></option></term>

231

232

<para>

233

This option is only used if <option>secret</option> is not

234

specified, in which case this option is

235

<emphasis>required</emphasis>.

236

</para>

237

<para>

238

Similar to the <option>secret</option>, except the secret

239

data is in an external file. The contents of the file

240

should <emphasis>not</emphasis> be base64-encoded, but

241

will be sent to clients verbatim.

242

</para>

243

<para>

244

File names of the form <filename>~user/foo/bar</filename>

245

and <filename>$<envar>ENVVAR</envar>/foo/bar</filename>

246

are supported.

247

</para>

248

</listitem>

249

</varlistentry>

250

251

252

<term><option><literal>host = </literal><replaceable

253

>STRING</replaceable></option></term>

254

255

<para>

256

This option is <emphasis>optional</emphasis>, but highly

257

<emphasis>recommended</emphasis> unless the

258

<option>checker</option> option is modified to a

259

non-standard value without <quote>%%(host)s</quote> in it.

260

</para>

261

<para>

262

Host name for this client. This is not used by the server

263

directly, but can be, and is by default, used by the

264

checker. See the <option>checker</option> option.

294

<term><option>timeout<literal> = </literal><replaceable

295

>TIME</replaceable></option></term>

296

297

<para>

298

This option is <emphasis>optional</emphasis>.

299

</para>

300

<para>

301

The timeout is how long the server will wait (for either a

302

successful checker run or a client receiving its secret)

303

until a client is disabled and not allowed to get the data

304

this server holds. By default Mandos will use 1 hour.

305

</para>

306

<para>

307

The <replaceable>TIME</replaceable> is specified as a

308

space-separated number of values, each of which is a

309

number and a one-character suffix. The suffix must be one

310

of <quote>d</quote>, <quote>s</quote>, <quote>m</quote>,

311

<quote>h</quote>, and <quote>w</quote> for days, seconds,

312

minutes, hours, and weeks, respectively. The values are

313

added together to give the total time value, so all of

314

<quote><literal>330s</literal></quote>,

315

<quote><literal>110s 110s 110s</literal></quote>, and

316

<quote><literal>5m 30s</literal></quote> will give a value

317

of five minutes and thirty seconds.

265

318

</para>

266

319

</listitem>

267

320

</varlistentry>

379

432

fingerprint = 3e393aeaefb84c7e89e2f547b3a107558fca3a27

380

433

secfile = /etc/mandos/bar-secret

381

434

timeout = 15m

435

approved_by_default = False

436

approval_delay = 30s

382

437

</programlisting>

383

438

</informalexample>

384

439

</refsect1>

Older »