/mandos/trunk

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"

	"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

<!ENTITY CONFNAME "mandos.conf">

<!ENTITY CONFPATH "<filename>/etc/mandos/mandos.conf</filename>">

<!ENTITY TIMESTAMP "2026-05-18">

<!ENTITY % common SYSTEM "common.ent">

%common;

]>

<refentry xmlns:xi="http://www.w3.org/2001/XInclude">

  <refentryinfo>

    <title>Mandos Manual</title>

    <!-- NWalsh’s docbook scripts use this to generate the footer: -->

    <productname>Mandos</productname>

    <productnumber>&version;</productnumber>

    <date>&TIMESTAMP;</date>

    <authorgroup>

      <author>

	<firstname>Björn</firstname>

	<surname>Påhlsson</surname>

	<address>

	  <email>belorn@recompile.se</email>

	</address>

      </author>

      <author>

	<firstname>Teddy</firstname>

	<surname>Hogeborn</surname>

	<address>

	  <email>teddy@recompile.se</email>

	</address>

      </author>

    </authorgroup>

    <copyright>

      <year>2008</year>

      <year>2009</year>

      <year>2010</year>

      <year>2011</year>

      <year>2012</year>

      <year>2013</year>

      <year>2014</year>

      <year>2015</year>

      <year>2016</year>

      <year>2017</year>

      <year>2018</year>

      <year>2019</year>

      <year>2020</year>

      <year>2021</year>

      <year>2022</year>

      <year>2023</year>

      <year>2024</year>

      <holder>Teddy Hogeborn</holder>

      <holder>Björn Påhlsson</holder>

    </copyright>

    <xi:include href="legalnotice.xml"/>

  </refentryinfo>

  <refmeta>

    <refentrytitle>&CONFNAME;</refentrytitle>

    <manvolnum>5</manvolnum>

  </refmeta>

  <refnamediv>

    <refname><filename>&CONFNAME;</filename></refname>

    <refpurpose>

      Configuration file for the Mandos server

    </refpurpose>

  </refnamediv>

  <refsynopsisdiv>

    <synopsis>&CONFPATH;</synopsis>

  </refsynopsisdiv>

  <refsect1 id="description">

    <title>DESCRIPTION</title>

    <para>

      The file &CONFPATH; is a configuration file for

      <citerefentry><refentrytitle>mandos</refentrytitle>

      <manvolnum>8</manvolnum></citerefentry>, and is read by it at

      startup.  The configuration file starts with <quote><literal

      >[DEFAULT]</literal></quote> on a line by itself, followed by

      any number of <quote><varname><replaceable>option</replaceable

      ></varname>=<replaceable>value</replaceable></quote> entries,

      with continuations in the style of RFC 822.  <quote><varname

      ><replaceable>option</replaceable></varname>: <replaceable

      >value</replaceable></quote> is also accepted.  Note that

      leading whitespace is removed from values.  Lines beginning with

      <quote>#</quote> or <quote>;</quote> are ignored and may be used

      to provide comments.

    </para>

  </refsect1>

  <refsect1>

    <title>OPTIONS</title>

    <variablelist>

      <varlistentry>

	<term><option>interface<literal> = </literal><replaceable

	>NAME</replaceable></option></term>

	<listitem>

	  <xi:include href="mandos-options.xml" xpointer="interface"/>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term><option>address<literal> = </literal><replaceable

	  >ADDRESS</replaceable></option></term>

	<listitem>

	  <xi:include href="mandos-options.xml" xpointer="address"/>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term><option>port<literal> = </literal><replaceable

	>NUMBER</replaceable></option></term>

	<listitem>

	  <xi:include href="mandos-options.xml" xpointer="port"/>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term><option>debug<literal> = </literal>{ <literal

	  >1</literal> | <literal>yes</literal> | <literal

	  >true</literal> | <literal>on</literal> | <literal

	  >0</literal> | <literal>no</literal> | <literal

	  >false</literal> | <literal>off</literal> }</option></term>

	<listitem>

	  <xi:include href="mandos-options.xml" xpointer="debug"/>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term><option>priority<literal> = </literal><replaceable

	>STRING</replaceable></option></term>

	<listitem>

	  <xi:include href="mandos-options.xml" xpointer="priority"/>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term><option>servicename<literal> = </literal

	><replaceable>NAME</replaceable></option></term>

	<listitem>

	  <xi:include href="mandos-options.xml"

		      xpointer="servicename"/>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term><option>use_dbus<literal> = </literal>{ <literal

	  >1</literal> | <literal>yes</literal> | <literal

	  >true</literal> | <literal>on</literal> | <literal

	  >0</literal> | <literal>no</literal> | <literal

	  >false</literal> | <literal>off</literal> }</option></term>

	<listitem>

	  <xi:include href="mandos-options.xml" xpointer="dbus"/>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term><option>use_ipv6<literal> = </literal>{ <literal

	  >1</literal> | <literal>yes</literal> | <literal

	  >true</literal> | <literal>on</literal> | <literal

	  >0</literal> | <literal>no</literal> | <literal

	  >false</literal> | <literal>off</literal> }</option></term>

	<listitem>

	  <xi:include href="mandos-options.xml" xpointer="ipv6"/>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term><option>restore<literal> = </literal>{ <literal

	  >1</literal> | <literal>yes</literal> | <literal

	  >true</literal> | <literal>on</literal> | <literal

	  >0</literal> | <literal>no</literal> | <literal

	  >false</literal> | <literal>off</literal> }</option></term>

	<listitem>

	  <xi:include href="mandos-options.xml" xpointer="restore"/>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term><option>statedir<literal> = </literal><replaceable

	>DIRECTORY</replaceable></option></term>

	<listitem>

	  <xi:include href="mandos-options.xml" xpointer="statedir"/>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term><option>foreground<literal> = </literal>{ <literal

	  >1</literal> | <literal>yes</literal> | <literal

	  >true</literal> | <literal>on</literal> | <literal

	  >0</literal> | <literal>no</literal> | <literal

	  >false</literal> | <literal>off</literal> }</option></term>

	<listitem>

	  <xi:include href="mandos-options.xml"

		      xpointer="foreground"/>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term><option>socket<literal> = </literal><replaceable

	>NUMBER</replaceable></option></term>

	<listitem>

	  <xi:include href="mandos-options.xml" xpointer="socket"/>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term><option>zeroconf<literal> = </literal>{ <literal

	  >1</literal> | <literal>yes</literal> | <literal

	  >true</literal> | <literal>on</literal> | <literal

	  >0</literal> | <literal>no</literal> | <literal

	  >false</literal> | <literal>off</literal> }</option></term>

	<listitem>

	  <xi:include href="mandos-options.xml" xpointer="zeroconf"/>

	</listitem>

      </varlistentry>

    </variablelist>

  </refsect1>

  <refsect1 id="files">

    <title>FILES</title>

    <para>

      The file described here is &CONFPATH;

    </para>

  </refsect1>

  <refsect1 id="bugs">

    <title>BUGS</title>

    <para>

      The <literal>[DEFAULT]</literal> is necessary because the Python

      built-in module <systemitem class="library">ConfigParser</systemitem>

      requires it.

    </para>

    <xi:include href="bugs.xml"/>

  </refsect1>

  <refsect1 id="example">

    <title>EXAMPLE</title>

    <informalexample>

      <para>

	No options are actually required:

      </para>

      <programlisting>

[DEFAULT]

      </programlisting>

    </informalexample>

    <informalexample>

      <para>

	An example using all the options:

      </para>

      <programlisting>

[DEFAULT]

# A configuration example

interface = enp1s0

address = fe80::aede:48ff:fe71:f6f2

port = 1025

debug = True

priority = SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA:!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA

servicename = Daena

use_dbus = False

use_ipv6 = True

restore = True

statedir = /var/lib/mandos

      </programlisting>

    </informalexample>

  </refsect1>

  <refsect1 id="see_also">

    <title>SEE ALSO</title>

    <para>

      <citerefentry><refentrytitle>intro</refentrytitle>

      <manvolnum>8mandos</manvolnum></citerefentry>,

      <citerefentry><refentrytitle>gnutls_priority_init</refentrytitle

      ><manvolnum>3</manvolnum></citerefentry>,

      <citerefentry><refentrytitle>mandos</refentrytitle>

      <manvolnum>8</manvolnum></citerefentry>,

      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>

      <manvolnum>5</manvolnum></citerefentry>

    </para>

    <variablelist>

      <varlistentry>

	<term>

	  RFC 4291: <citetitle>IP Version 6 Addressing

	  Architecture</citetitle>

	</term>

	<listitem>

	  <variablelist>

	    <varlistentry>

	      <term>Section 2.2: <citetitle>Text Representation of

	      Addresses</citetitle></term>

	      <listitem><para/></listitem>

	    </varlistentry>

	    <varlistentry>

	      <term>Section 2.5.5.2: <citetitle>IPv4-Mapped IPv6

	      Address</citetitle></term>

	      <listitem><para/></listitem>

	    </varlistentry>

	    <varlistentry>

	    <term>Section 2.5.6, <citetitle>Link-Local IPv6 Unicast

	    Addresses</citetitle></term>

	    <listitem>

	      <para>

		The clients use IPv6 link-local addresses, which are

		immediately usable since a link-local addresses is

		automatically assigned to a network interface when it

		is brought up.

	      </para>

	    </listitem>

	    </varlistentry>

	  </variablelist>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term>

	  <ulink url="http://www.zeroconf.org/">Zeroconf</ulink>

	</term>

	<listitem>

	  <para>

	    Zeroconf is the network protocol standard used by clients

	    for finding the Mandos server on the local network.

	  </para>

	</listitem>

      </varlistentry>

    </variablelist>

  </refsect1>

</refentry>

<!-- Local Variables: -->

<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->

<!-- time-stamp-end: "[\"']>" -->

<!-- time-stamp-format: "%:y-%02m-%02d" -->

<!-- End: -->