&CONFNAME;

=== modified file 'TODO' --- TODO 2008-08-18 05:57:11 +0000 +++ TODO 2008-08-20 03:22:45 +0000 @@ -83,7 +83,6 @@ [[http://www.steve.org.uk/Reference/Unix/faq_4.html#SEC48][Unix Programming FAQ 3.1 How can I make my program not echo input?]] * mandos (server) -** [#A] Config file man page: man5/mandos.conf (mandos.conf) ** [#A] Config file man page: man5/mandos-clients.conf (clients.conf) ** [#A] /etc/init.d/mandos-server :teddy: ** [#B] Log level :bugs: === modified file 'clients.conf' --- clients.conf 2008-08-10 20:35:01 +0000 +++ clients.conf 2008-08-20 03:22:45 +0000 @@ -9,7 +9,7 @@ # How often to run the checker to confirm that a client is still up. # Note: a new checker will not be started if an old one is still # running. The server will wait for a checker to complete until the -# "timeout" above occurs, at which time the client will be marked +# above "timeout" occurs, at which time the client will be marked # invalid, and any running checker killed. ;interval = 5m === modified file 'mandos' --- mandos 2008-08-18 23:55:28 +0000 +++ mandos 2008-08-20 03:22:45 +0000 @@ -563,25 +563,30 @@ datetime.timedelta(1) >>> string_to_delta(u'1w') datetime.timedelta(7) + >>> string_to_delta('5m 30s') + datetime.timedelta(0, 330) """ - try: - suffix=unicode(interval[-1]) - value=int(interval[:-1]) - if suffix == u"d": - delta = datetime.timedelta(value) - elif suffix == u"s": - delta = datetime.timedelta(0, value) - elif suffix == u"m": - delta = datetime.timedelta(0, 0, 0, 0, value) - elif suffix == u"h": - delta = datetime.timedelta(0, 0, 0, 0, 0, value) - elif suffix == u"w": - delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value) - else: + timevalue = datetime.timedelta(0) + for s in interval.split(): + try: + suffix=unicode(s[-1]) + value=int(s[:-1]) + if suffix == u"d": + delta = datetime.timedelta(value) + elif suffix == u"s": + delta = datetime.timedelta(0, value) + elif suffix == u"m": + delta = datetime.timedelta(0, 0, 0, 0, value) + elif suffix == u"h": + delta = datetime.timedelta(0, 0, 0, 0, 0, value) + elif suffix == u"w": + delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value) + else: + raise ValueError + except (ValueError, IndexError): raise ValueError - except (ValueError, IndexError): - raise ValueError - return delta + timevalue += delta + return timevalue def server_state_changed(state): @@ -733,6 +738,7 @@ client_defaults = { "timeout": "1h", "interval": "5m", "checker": "fping -q -- %%(host)s", + "host": "", } client_config = ConfigParser.SafeConfigParser(client_defaults) client_config.read(os.path.join(server_settings["configdir"], === modified file 'mandos-clients.conf.xml' --- mandos-clients.conf.xml 2008-08-09 01:39:09 +0000 +++ mandos-clients.conf.xml 2008-08-20 03:22:45 +0000 @@ -1,6 +1,4 @@ - @@ -11,7 +9,7 @@ &CONFNAME; - + &CONFNAME; &VERSION; @@ -32,7 +30,8 @@ 2008 - Teddy Hogeborn & Björn Påhlsson + Teddy Hogeborn + Björn Påhlsson @@ -67,7 +66,7 @@ &CONFNAME; - Configuration file for Mandos clients + Configuration file for the Mandos server @@ -80,42 +79,85 @@ DESCRIPTION - The file &CONFPATH; is the configuration file for mandos where - each client that will be abel to use the service need to be - specified. The configuration file is looked on at the startup of - the service, so to reenable timedout clients one need to only - restart the server. The format starts with a section under [] - which is eather [DEFAULT] or a client - name. Values is set through the use of VAR = VALUE pair. Values - may not be empty. + The file &CONFPATH; is the configuration file for mandos + 8, read by it at startup, + where each client that will be able to use the service needs to + be listed. All clients listed will be regarded as valid, even + if a client was declared invalid in a previous run of the + server. + + + The format starts with a section under [] which is either + [DEFAULT] or [client + name]. Following the section is any + number of option=value entries, + with continuations in the style of RFC 822. option: value is also accepted. Note that + leading whitespace is removed from values. Values can contain + format strings which refer to other values in the same section, + or values in the DEFAULT section. Lines + beginning with # or ; are ignored + and may be used to provide comments. - - - DEFAULTS + + + OPTIONS - The paramters for [DEFAULT] are: + The possible options are: - + - timeout + timeout - - This option allows you to override the default timeout - that clients will get. By default mandos will use 1hr. + timeout = TIME + + + The timeout is how long the server will wait for a + successful checker run until a client is considered + invalid - that is, ineligible to get the data this server + holds. By default Mandos will use 1 hour. + + + The TIME is specified as a + space-separated number of values, each of which is a + number and a one-character suffix. The suffix must be one + of d, s, m, + h, and w for days, seconds, + minutes, hours, and weeks, respectively. The values are + added together to give the total time value, so all of + 330s, + 110s 110s 110s, and + 5m 30s will give a value + of five minutes and thirty seconds. - interval + interval - - This option allows you to override the default interval - used between checkups for disconnected clients. By default - mandos will use 5m. + interval = TIME + + + How often to run the checker to confirm that a client is + still up. Note: a new checker will + not be started if an old one is still running. The server + will wait for a checker to complete until the above + timeout occurs, at which + time the client will be marked invalid, and any running + checker killed. The default interval is 5 minutes. + + + The format of TIME is the same + as for timeout above. @@ -131,17 +173,6 @@ - - - - - CLIENTS - - The paramters for clients are: - - - - fingerprint @@ -204,9 +235,83 @@ + + + EXPANSION + + There are two forms of expansion: Start time expansion and + runtime expansion. + + + START TIME EXPANSION + + Any string in an option value of the form + %(foo)s will be replaced by the value of the option + foo either in the same section, or, if it + does not exist there, the [DEFAULT] + section. This is done at start time, when the configuration + file is read. + + + Note that this means that, in order to include an actual + percent character (%) in an option value, two + percent characters in a row (%%) must be + entered. + + + + RUNTIME EXPANSION + + This is currently only done for the checker + option. + + + Any string in an option value of the form + %%(foo)s will be replaced by the value of the attribute + foo of the internal + Client object. See the + source code for details, and let the authors know of any + attributes that are useful so they may be preserved to any new + versions of this software. + + + Note that this means that, in order to include an actual + percent character (%) in a + checker options, four + percent characters in a row (%%%%) must be + entered. Also, a bad format here will lead to an immediate + but silent run-time fatal exit; debug + mode is needed to track down an error of this kind. + + - - EXAMPLES + + + + FILES + + The file described here is &CONFPATH; + + + + + BUGS + + The format for specifying times for timeout + and interval is not very good. + + + The difference between + %%(foo)s and + %(foo)s is + obscure. + + + + + EXAMPLE [DEFAULT] @@ -214,9 +319,9 @@ interval = 5m checker = fping -q -- %%(host)s -[example_client] +# Client "foo" +[foo] fingerprint = 7788 2722 5BA7 DE53 9C5A 7CFA 59CF F7CD BD9A 5920 - secret = hQIOA6QdEjBs2L/HEAf/TCyrDe5Xnm9esa+Pb/vWF9CUqfn4srzVgSu234 REJMVv7lBSrPE2132Lmd2gqF1HeLKDJRSVxJpt6xoWOChGHg+TMyXDxK+N @@ -234,17 +339,16 @@ 4T2zw4dxS5NswXWU0sVEXxjs6PYxuIiCTL7vdpx8QjBkrPWDrAbcMyBr2O QlnHIvPzEArRQLo= =iHhv - -host = localhost +host = foo.example.org interval = 5m + +# Client "bar" +[bar] +fingerprint = 3e393aeaefb84c7e89e2f547b3a107558fca3a27 +secfile = /etc/mandos/bar-secret.txt.asc + - - - FILES - - The file described here is &CONFPATH; - - + === modified file 'mandos.conf.xml' --- mandos.conf.xml 2008-08-20 00:35:41 +0000 +++ mandos.conf.xml 2008-08-20 03:22:45 +0000 @@ -4,7 +4,6 @@ /etc/mandos/mandos.conf"> - ]> @@ -83,16 +82,16 @@ The file &CONFPATH; is a simple configuration file for mandos 8, and is read by it at - startup. The configuration file starts with - [DEFAULT] on a line by itself, - followed by any number of - option=value - entries, with continuations in the style of RFC 822. - option: - value is also accepted. Note - that leading whitespace is removed from values. Lines beginning - with # or ; are ignored and may be - used to provide comments. + startup. The configuration file starts with [DEFAULT] on a line by itself, followed by + any number of option=value entries, + with continuations in the style of RFC 822. option: value is also accepted. Note that + leading whitespace is removed from values. Lines beginning with + # or ; are ignored and may be used + to provide comments.