91
The format starts with a section under [] which is either
91
The format starts with a <literal>[<replaceable>section
92
header</replaceable>]</literal> which is either
92
93
<literal>[DEFAULT]</literal> or <literal>[<replaceable>client
93
name</replaceable>]</literal>. Following the section is any
94
number of <quote><varname><replaceable>option</replaceable
94
name</replaceable>]</literal>. The <replaceable>client
95
name</replaceable> can be anything, and is not tied to a host
96
name. Following the section header is any number of
97
<quote><varname><replaceable>option</replaceable
95
98
></varname>=<replaceable>value</replaceable></quote> entries,
96
99
with continuations in the style of RFC 822. <quote><varname
97
100
><replaceable>option</replaceable></varname>: <replaceable
98
101
>value</replaceable></quote> is also accepted. Note that
99
102
leading whitespace is removed from values. Values can contain
100
103
format strings which refer to other values in the same section,
101
or values in the <quote>DEFAULT</quote> section. Lines
102
beginning with <quote>#</quote> or <quote>;</quote> are ignored
103
and may be used to provide comments.
104
or values in the <quote>DEFAULT</quote> section (see <xref
105
linkend="expansion"/>). Lines beginning with <quote>#</quote>
106
or <quote>;</quote> are ignored and may be used to provide
166
170
<term><literal>checker</literal></term>
172
<synopsis><literal>checker = </literal><replaceable
173
>COMMAND</replaceable>
169
176
This option allows you to override the default shell
170
command that the server will use to check up if the client
171
is still up. By default mandos will "fping -q -- %%(host)s"
177
command that the server will use to check if the client is
178
still up. The output of the command will be ignored, only
179
the exit code is checked. The command will be run using
180
<quote><command><filename>/bin/sh</filename>
181
<option>-c</option></command></quote>. The default
182
command is <quote><literal><command>fping</command>
183
<option>-q</option> <option>--</option>
184
%(host)s</literal></quote>.
187
In addition to normal start time expansion, this option
188
will also be subject to runtime expansion; see <xref
189
linkend="expansion"/>.
177
195
<term><literal>fingerprint</literal></term>
197
<synopsis><literal>fingerprint = </literal><replaceable
198
>HEXSTRING</replaceable>
180
This option sets the openpgp fingerprint that identifies
181
the public certificate that clients authenticates themself
182
through gnutls. The string need to be in hex-decimal form.
201
This option sets the OpenPGP fingerprint that identifies
202
the public key that clients authenticate themselves with
203
through TLS. The string needs to be in hexidecimal form,
204
but spaces or upper/lower case are not significant.
188
210
<term><literal>secret</literal></term>
191
Base 64 encoded OpenPGP encrypted password encrypted by
192
the clients openpgp certificate.
212
<synopsis><literal>secret = </literal><replaceable
213
>BASE64_ENCODED_DATA</replaceable>
216
If present, this option must be set to a string of
217
base64-encoded binary data. It will be decoded and sent
218
to the client matching the above
219
<option>fingerprint</option>. This should, of course, be
220
OpenPGP encrypted data, decryptable only by the client.
221
<!-- The program <citerefentry><refentrytitle><command -->
222
<!-- >mandos-keygen</command></refentrytitle><manvolnum -->
223
<!-- >8</manvolnum></citerefentry> can be used to generate it, -->
227
Note: this value of this option will probably run over
228
many lines, and will then have to use the fact that a line
229
beginning with white space adds to the value of the
230
previous line, RFC 822-style.
added
removed
mandos-clients.conf.xml
