/mandos/trunk

<?xml version='1.0' encoding='UTF-8'?>

<?xml-stylesheet type="text/xsl"

	href="http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl"?>

<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"

	"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

<!ENTITY VERSION "1.0">

<!ENTITY CONFNAME "mandos-clients.conf">

<!ENTITY CONFPATH "<filename>/etc/mandos/clients.conf</filename>">

]>

<refentry>

  <refentryinfo>

    <title>&CONFNAME;</title>

    <!-- NWalsh's docbook scripts use this to generate the footer: -->

    <productname>&CONFNAME;</productname>

    <productnumber>&VERSION;</productnumber>

    <authorgroup>

      <author>

	<firstname>Björn</firstname>

	<surname>Påhlsson</surname>

	<address>

	  <email>belorn@fukt.bsnet.se</email>

	</address>

      </author>

      <author>

	<firstname>Teddy</firstname>

	<surname>Hogeborn</surname>

	<address>

	  <email>teddy@fukt.bsnet.se</email>

	</address>

      </author>

    </authorgroup>

    <copyright>

      <year>2008</year>

      <holder>Teddy Hogeborn &amp; Björn Påhlsson</holder>

    </copyright>

    <legalnotice>

      <para>

	This manual page is free software: you can redistribute it

	and/or modify it under the terms of the GNU General Public

	License as published by the Free Software Foundation,

	either version 3 of the License, or (at your option) any

	later version.

      </para>

      <para>

	This manual page is distributed in the hope that it will

	be useful, but WITHOUT ANY WARRANTY; without even the

	implied warranty of MERCHANTABILITY or FITNESS FOR A

	PARTICULAR PURPOSE.  See the GNU General Public License

	for more details.

      </para>

      <para>

	You should have received a copy of the GNU General Public

	License along with this program; If not, see

	<ulink url="http://www.gnu.org/licenses/"/>.

      </para>

    </legalnotice>

  </refentryinfo>

  <refmeta>

    <refentrytitle>&CONFNAME;</refentrytitle>

    <manvolnum>5</manvolnum>

  </refmeta>

  <refnamediv>

    <refname><filename>&CONFNAME;</filename></refname>

    <refpurpose>

      Configuration file for Mandos clients

    </refpurpose>

  </refnamediv>

  <refsynopsisdiv>

    <synopsis>

      &CONFPATH;

    </synopsis>

  </refsynopsisdiv>

  <refsect1 id="description">

    <title>DESCRIPTION</title>

    <para>

      The file &CONFPATH; is the configuration file for mandos where

      each client that will be abel to use the service need to be

      specified. The configuration file is looked on at the startup of

      the service, so to reenable timedout clients one need to only

      restart the server. The format starts with a section under []

      which is eather <literal>[DEFAULT]</literal> or a client

      name. Values is set through the use of VAR = VALUE pair. Values

      may not be empty.

    </para>

  </refsect1>

  <refsect1 id="default">

    <title>DEFAULTS</title>

    <para>

      The paramters for <literal>[DEFAULT]</literal> are:

    </para>

    <variablelist>

      <varlistentry>

	<term><literal>timeout</literal></term>

	<listitem>

	  <para>

	    This option allows you to override the default timeout

	    that clients will get. By default mandos will use 1hr.

	  </para>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term><literal>interval</literal></term>

	<listitem>

	  <para>

	    This option allows you to override the default interval

	    used between checkups for disconnected clients. By default

	    mandos will use 5m.

	  </para>

	</listitem>

      </varlistentry>      

      <varlistentry>

	<term><literal>checker</literal></term>

	<listitem>

	  <para>

	    This option allows you to override the default shell

	    command that the server will use to check up if the client

	    is still up. By default mandos will "fping -q -- %%(fqdn)s"

	  </para>

	</listitem>

      </varlistentry>

    </variablelist>

  </refsect1>

  <refsect1 id="clients">

    <title>CLIENTS</title>

    <para>

      The paramters for clients are:

    </para>

    <variablelist>

      <varlistentry>

	<term><literal>fingerprint</literal></term>

	<listitem>

	  <para>

	    This option sets the openpgp fingerprint that identifies

	    the public certificate that clients authenticates themself

	    through gnutls. The string need to be in hex-decimal form.

	  </para>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term><literal>secret</literal></term>

	<listitem>

	  <para>

	    Base 64 encoded OpenPGP encrypted password encrypted by

	    the clients openpgp certificate.

	  </para>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term><literal>secfile</literal></term>

	<listitem>

	  <para>

	    Base 64 encoded OpenPGP encrypted password encrypted by

	    the clients openpgp certificate as a binary file.

	  </para>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term><literal>fqdn</literal></term>

	<listitem>

	  <para>

	    FQDN, that can be used in for checking that the client is up.

	  </para>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term><literal>checker</literal></term>

	<listitem>

	  <para>

	    Shell command that the server will use to check up if a

	    client is still up.

	  </para>

	</listitem>

      </varlistentry>      

      <varlistentry>

	<term><literal>timeout</literal></term>

	<listitem>

	  <para>

	    Duration that a client can be down whitout be removed from

	    the client list.

	  </para>

	</listitem>

      </varlistentry> 

    </variablelist>

  </refsect1>  

  <refsect1 id="examples">

    <title>EXAMPLES</title>

    <informalexample>

      <programlisting>

[DEFAULT]

timeout = 1h

interval = 5m

checker = fping -q -- %%(fqdn)s

[example_client]

fingerprint =  7788 2722 5BA7 DE53 9C5A  7CFA 59CF F7CD BD9A 5920

secret =

        hQIOA6QdEjBs2L/HEAf/TCyrDe5Xnm9esa+Pb/vWF9CUqfn4srzVgSu234

        REJMVv7lBSrPE2132Lmd2gqF1HeLKDJRSVxJpt6xoWOChGHg+TMyXDxK+N

        Xl89vGvdU1XfhKkVm9MDLOgT5ECDPysDGHFPDhqHOSu3Kaw2DWMV/iH9vz

        3Z20erVNbdcvyBnuojcoWO/6yfB5EQO0BXp7kcyy00USA3CjD5FGZdoQGI

        Tb8A/ar0tVA5crSQmaSotm6KmNLhrFnZ5BxX+TiE+eTUTqSloWRY6VAvqW

        QHC7OASxK5E6RXPBuFH5IohUA2Qbk5AHt99pYvsIPX88j2rWauOokoiKZo

        t/9leJ8VxO5l3wf/U64IH8bkPIoWmWZfd/nqh4uwGNbCgKMyT+AnvH7kMJ

        3i7DivfWl2mKLV0PyPHUNva0VQxX6yYjcOhj1R6fCr/at8/NSLe2OhLchz

        dC+Ls9h+kvJXgF8Sisv+Wk/1RadPLFmraRlqvJwt6Ww21LpiXqXHV2mIgq

        WnR98YgSvUi3TJHrUQiNc9YyBzuRo0AjgG2C9qiE3FM+Y28+iQ/sR3+bFs

        zYuZKVTObqiIslwXu7imO0cvvFRgJF/6u3HNFQ4LUTGhiM3FQmC6NNlF3/

        vJM2hwRDMcJqDd54Twx90Wh+tYz0z7QMsK4ANXWHHWHR0JchnLWmenzbtW

        5MHdW9AYsNJZAQSOpirE4Xi31CSlWAi9KV+cUCmWF5zOFy1x23P6PjdaRm

        4T2zw4dxS5NswXWU0sVEXxjs6PYxuIiCTL7vdpx8QjBkrPWDrAbcMyBr2O

        QlnHIvPzEArRQLo=

        =iHhv

fqdn = localhost

interval = 5m

      </programlisting>

    </informalexample>

  </refsect1>  

  <refsect1 id="files">

    <title>FILES</title>

    <para>

      The file described here is &CONFPATH;

    </para>

  </refsect1>

</refentry>