/mandos/trunk : revision 112

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-clients.conf.xml

Committer: Teddy Hogeborn
Date: 2008-08-29 07:09:04 UTC
Revision ID: teddy@fukt.bsnet.se-20080829070904-i6u8xb0aueytvfii

* mandos-clients.conf.xml (/refentry/refentryinfo/title): Changed to
                                                          "Mandos
                                                          Manual".

  (/refentry/refentryinfo/productname): Changed to "Mandos".
* mandos-keygen.xml: - '' -
* mandos.conf.xml: - '' -
* mandos.xml: - '' -
* plugin-runner.xml: - '' -
* plugins.d/password-request.xml: - '' -

files added:
.bzrignore

files modified:
Makefile

TODO

clients.conf

initramfs-tools-hook

mandos

mandos-clients.conf.xml

mandos-keygen

mandos-keygen.xml

mandos-options.xml

mandos.conf.xml

mandos.xml

plugin-runner.c

plugin-runner.xml

plugins.d/password-prompt.c

plugins.d/password-prompt.xml

plugins.d/password-request.xml

Show diffs side-by-side

added added

removed removed

mandos-clients.conf.xml

<!ENTITY VERSION "1.0">

<!ENTITY CONFNAME "mandos-clients.conf">

<!ENTITY CONFPATH "<filename>/etc/mandos/clients.conf</filename>">

<!ENTITY TIMESTAMP "2008-08-29">

<title>&CONFNAME;</title>

<title>Mandos Manual</title>

<productname>&CONFNAME;</productname>

<productname>Mandos</productname>

<productnumber>&VERSION;</productnumber>

<date>&TIMESTAMP;</date>

<firstname>Björn</firstname>

<title>DESCRIPTION</title>

<para>

The file &CONFPATH; is the configuration file for <citerefentry

The file &CONFPATH; is a configuration file for <citerefentry

><refentrytitle>mandos</refentrytitle>

<manvolnum>8</manvolnum></citerefentry>, read by it at startup,

where each client that will be able to use the service needs to

be listed. All clients listed will be regarded as valid, even

<manvolnum>8</manvolnum></citerefentry>, read by it at startup.

The file needs to list all clients that should be able to use

the service. All clients listed will be regarded as valid, even

if a client was declared invalid in a previous run of the

server.

</para>

111

113

112

114

<title>OPTIONS</title>

113

115

<para>

114

The possible options are:

116

<emphasis>Note:</emphasis> all option values are subject to

117

start time expansion, see <xref linkend="expansion"/>.

118

</para>

119

<para>

120

Uknown options are ignored. The used options are as follows:

115

121

</para>

116

122

117

123

175

181

<para>

176

182

This option allows you to override the default shell

177

183

command that the server will use to check if the client is

178

still up. The output of the command will be ignored, only

179

the exit code is checked. The command will be run using

180

181

<option>-c</option></command></quote>. The default

182

command is <quote><literal><command>fping</command>

183

184

%(host)s</literal></quote>.

184

still up. Any output of the command will be ignored, only

185

the exit code is checked: If the exit code of the command

186

is zero, the client is considered up. The command will be

187

run using <quote><command><filename>/bin/sh</filename>

188

<option>-c</option></command></quote>, so

189

<varname>PATH</varname> will be searched. The default

190

value for the checker command is <quote><literal

191

><command>fping</command> <option>-q</option> <option

192

>--</option> %(host)s</literal></quote>.

185

193

</para>

186

194

<para>

187

195

In addition to normal start time expansion, this option

218

226

to the client matching the above

219

227

<option>fingerprint</option>. This should, of course, be

220

228

OpenPGP encrypted data, decryptable only by the client.

221

222

223

224

225

</para>

226

<para>

227

Note: this value of this option will probably run over

228

many lines, and will then have to use the fact that a line

229

beginning with white space adds to the value of the

230

previous line, RFC 822-style.

229

The program <citerefentry><refentrytitle><command

230

>mandos-keygen</command></refentrytitle><manvolnum

231

>8</manvolnum></citerefentry> can, using its

232

<option>--password</option> option, be used to generate

233

this, if desired.

234

</para>

235

<para>

236

Note: this value of this option will probably be very

237

long. A useful feature to avoid having unreadably-long

238

lines is that a line beginning with white space adds to

239

the value of the previous line, RFC 822-style.

240

</para>

241

<para>

242

If this option is not specified, the <option

243

>secfile</option> option is used instead, but one of them

244

<emphasis>must</emphasis> be present.

231

245

</para>

232

246

</listitem>

233

247

</varlistentry>

235

249

236

250

<term><literal>secfile</literal></term>

237

251

238

<para>

239

Base 64 encoded OpenPGP encrypted password encrypted by

240

the clients openpgp certificate as a binary file.

252

<synopsis><literal>secfile = </literal><replaceable

253

>FILENAME</replaceable>

254

</synopsis>

255

<para>

256

The same as <option>secret</option>, but the secret data

257

is in an external file. The contents of the file should

258

<emphasis>not</emphasis> be base64-encoded, but will be

259

sent to clients verbatim.

260

</para>

261

<para>

262

This option is only used, and <emphasis>must</emphasis> be

263

present, if <option>secret</option> is not specified.

241

264

</para>

242

265

</listitem>

243

266

</varlistentry>

245

268

246

269

247

270

271

<synopsis><literal>host = </literal><replaceable

272

>STRING</replaceable>

273

</synopsis>

248

274

<para>

249

Host name that can be used in for checking that the client is up.

275

Host name for this client. This is not used by the server

276

directly, but can be, and is by default, used by the

277

checker. See the <option>checker</option> option.

250

278

</para>

251

279

</listitem>

252

280

</varlistentry>

253

254

255

<term><literal>checker</literal></term>

256

257

<para>

258

Shell command that the server will use to check up if a

259

client is still up.

260

</para>

261

</listitem>

262

</varlistentry>

263

264

265

<term><literal>timeout</literal></term>

266

267

<para>

268

Duration that a client can be down whitout be removed from

269

the client list.

270

</para>

271

</listitem>

272

</varlistentry>

273

281

274

282

</variablelist>

275

283

</refsect1>

317

325

<para>

318

326

Note that this means that, in order to include an actual

319

327

percent character (<quote>%</quote>) in a

320

<varname>checker</varname> options, <emphasis>four</emphasis>

328

<varname>checker</varname> option, <emphasis>four</emphasis>

321

329

percent characters in a row (<quote>%%%%</quote>) must be

322

330

entered. Also, a bad format here will lead to an immediate

323

331

but <emphasis>silent</emphasis> run-time fatal exit; debug

376

384

5MHdW9AYsNJZAQSOpirE4Xi31CSlWAi9KV+cUCmWF5zOFy1x23P6PjdaRm

377

385

4T2zw4dxS5NswXWU0sVEXxjs6PYxuIiCTL7vdpx8QjBkrPWDrAbcMyBr2O

378

386

QlnHIvPzEArRQLo=

379

=iHhv

380

387

host = foo.example.org

381

interval = 5m

388

interval = 1m

382

389

383

390

# Client "bar"

384

391

[bar]

385

392

fingerprint = 3e393aeaefb84c7e89e2f547b3a107558fca3a27

386

secfile = /etc/mandos/bar-secret.txt.asc

393

secfile = /etc/mandos/bar-secret

394

timeout = 15m

387

395

388

396

</programlisting>

389

397

</informalexample>

390

398

</refsect1>

391

399

400

401

402

<para>

403

404

<refentrytitle>mandos</refentrytitle>

405

406

<refentrytitle>mandos-keygen</refentrytitle>

407

408

<refentrytitle>mandos.conf</refentrytitle>

409

410

</para>

411

</refsect1>

392

412

</refentry>

413

414

415

416

417

Older »