/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos-clients.conf.xml

  • Committer: Teddy Hogeborn
  • Date: 2012-06-22 23:33:56 UTC
  • mto: (237.7.272 trunk)
  • mto: This revision was merged to the branch mainline in revision 303.
  • Revision ID: teddy@recompile.se-20120622233356-odoqqt2ki2gssn37
* Makefile (check): Also check mandos-ctl.
* mandos-ctl: All options taking a time interval argument can now take
              an RFC 3339 duration.
  (rfc3339_duration_to_delta): New function.
  (string_to_delta): Try rfc3339_duration_to_delta first.
  (main): New "--check" option.
* mandos-ctl.xml (SYNOPSIS, OPTIONS): Document new "--check" option.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-clients.conf.xml
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY CONFNAME "mandos-clients.conf">
5
5
<!ENTITY CONFPATH "<filename>/etc/mandos/clients.conf</filename>">
6
 
<!ENTITY TIMESTAMP "2014-06-22">
 
6
<!ENTITY TIMESTAMP "2012-05-27">
7
7
<!ENTITY % common SYSTEM "common.ent">
8
8
%common;
9
9
]>
117
117
          <para>
118
118
            How long to wait for external approval before resorting to
119
119
            use the <option>approved_by_default</option> value.  The
120
 
            default is <quote>PT0S</quote>, i.e. not to wait.
 
120
            default is <quote>0s</quote>, i.e. not to wait.
121
121
          </para>
122
122
          <para>
123
123
            The format of <replaceable>TIME</replaceable> is the same
177
177
            <varname>PATH</varname> will be searched.  The default
178
178
            value for the checker command is <quote><literal
179
179
            ><command>fping</command> <option>-q</option> <option
180
 
            >--</option> %%(host)s</literal></quote>.  Note that
181
 
            <command>mandos-keygen</command>, when generating output
182
 
            to be inserted into this file, normally looks for an SSH
183
 
            server on the Mandos client, and, if it find one, outputs
184
 
            a <option>checker</option> option to check for the
185
 
            client’s key fingerprint – this is more secure against
186
 
            spoofing.
 
180
            >--</option> %%(host)s</literal></quote>.
187
181
          </para>
188
182
          <para>
189
183
            In addition to normal start time expansion, this option
341
335
            <option>extended_timeout</option> option.
342
336
          </para>
343
337
          <para>
344
 
            The <replaceable>TIME</replaceable> is specified as an RFC
345
 
            3339 duration; for example
346
 
            <quote><literal>P1Y2M3DT4H5M6S</literal></quote> meaning
347
 
            one year, two months, three days, four hours, five
348
 
            minutes, and six seconds.  Some values can be omitted, see
349
 
            RFC 3339 Appendix A for details.
 
338
            The <replaceable>TIME</replaceable> is specified as a
 
339
            space-separated number of values, each of which is a
 
340
            number and a one-character suffix.  The suffix must be one
 
341
            of <quote>d</quote>, <quote>s</quote>, <quote>m</quote>,
 
342
            <quote>h</quote>, and <quote>w</quote> for days, seconds,
 
343
            minutes, hours, and weeks, respectively.  The values are
 
344
            added together to give the total time value, so all of
 
345
            <quote><literal>330s</literal></quote>,
 
346
            <quote><literal>110s 110s 110s</literal></quote>, and
 
347
            <quote><literal>5m 30s</literal></quote> will give a value
 
348
            of five minutes and thirty seconds.
350
349
          </para>
351
350
        </listitem>
352
351
      </varlistentry>
466
465
    <informalexample>
467
466
      <programlisting>
468
467
[DEFAULT]
469
 
timeout = PT5M
470
 
interval = PT2M
 
468
timeout = 5m
 
469
interval = 2m
471
470
checker = fping -q -- %%(host)s
472
471
 
473
472
# Client "foo"
490
489
        4T2zw4dxS5NswXWU0sVEXxjs6PYxuIiCTL7vdpx8QjBkrPWDrAbcMyBr2O
491
490
        QlnHIvPzEArRQLo=
492
491
host = foo.example.org
493
 
interval = PT1M
 
492
interval = 1m
494
493
 
495
494
# Client "bar"
496
495
[bar]
497
496
fingerprint = 3e393aeaefb84c7e89e2f547b3a107558fca3a27
498
497
secfile = /etc/mandos/bar-secret
499
 
timeout = PT15M
 
498
timeout = 15m
500
499
approved_by_default = False
501
 
approval_delay = PT30S
 
500
approval_delay = 30s
502
501
      </programlisting>
503
502
    </informalexample>
504
503
  </refsect1>
517
516
      <citerefentry><refentrytitle>fping</refentrytitle>
518
517
      <manvolnum>8</manvolnum></citerefentry>
519
518
    </para>
520
 
    <variablelist>
521
 
      <varlistentry>
522
 
        <term>
523
 
          RFC 3339: <citetitle>Date and Time on the Internet:
524
 
          Timestamps</citetitle>
525
 
        </term>
526
 
      <listitem>
527
 
        <para>
528
 
          The time intervals are in the "duration" format, as
529
 
          specified in ABNF in Appendix A of RFC 3339.
530
 
        </para>
531
 
      </listitem>
532
 
      </varlistentry>
533
 
    </variablelist>
534
519
  </refsect1>
535
520
</refentry>
536
521
<!-- Local Variables: -->