/mandos/trunk : revision 163

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-options.xml

Committer: Teddy Hogeborn
Date: 2008-09-05 16:24:33 UTC
Revision ID: teddy@fukt.bsnet.se-20080905162433-58fgx91ae9foxlh1

* Makefile (PIDDIR, USER, GROUP): Removed.
  (install-server): Do not create $(PIDDIR).
  (uninstall-server): Do not remove $(PIDDIR).

* init.d-mandos (PIDFILE): Changed to "/var/run/$NAME.pid".

* mandos (IPv6_TCPServer.enabled): New attribute.
  (IPv6_TCPServer.server_activate): Only call method of superclass if
                                    "self.enabled".
  (IPv6_TCPServer.enable): Set "self.enabled" to True.
  (main): Create client Set() early.  Create IPv6_TCPServer object
          early.  Switch to user and group "mandos", "nobody" or
          65534, if possible.  Enable IPv6_TCPServer *after* switching
          user.

* mandos-keygen (KEYDIR): Changed to "/etc/keys/mandos".

* mandos.xml (FILES): Changed PID file.
  (SECURITY): The server does need to be privileged, but switches to a
              non-privileged user.

* plugin-runner.xml (EXAMPLE): Changed long example to something more
                               realistic.

Show diffs side-by-side

added added

removed removed

mandos-options.xml

<!--

This file is used by both mandos(8) and mandos.conf(5), since these

options can be used both on the command line and in the config file.

It is also used for some texts by password-request(8mandos).

-->

If this is specified, the server will only announce the service

and listen to requests on network interface

<replaceable>IF</replaceable>. Default is to use all available

interfaces. <emphasis>Note:</emphasis> a failure to bind to the

specified interface is not considered critical, and the server

does not exit, but will instead continue starting normally.

and listen to requests on the specified network interface.

Default is to use all available interfaces. <emphasis

>Note:</emphasis> a failure to bind to the specified

interface is not considered critical, and the server will not

exit, but instead continue normally.

</para>

interface should be set, since a link-local address is only valid

on a single interface. By default, the server will listen to all

available addresses. If set, this must be an IPv6 address; an

IPv4 address can only be specified using the <quote><systemitem

class="ipaddress">::FFFF:192.0.2.3</systemitem ></quote> format.

IPv4 address can only be specified using IPv4-mapped IPv6 address

syntax: <quote><systemitem class="ipaddress"

>::FFFF:192.0.2.3</systemitem ></quote>.

</para>

If the server is run in debug mode, it will run in the foreground

and print a lot of debugging information. The default is

<emphasis>not</emphasis> to run in debug mode.

and print a lot of debugging information. The default is to

<emphasis>not</emphasis> run in debug mode.

</para>

GnuTLS priority string for the TLS handshake with the clients.

The default is

<quote><literal>SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP</literal></quote>.

See <citerefentry><refentrytitle>gnutls_priority_init

</refentrytitle><manvolnum>3</manvolnum></citerefentry> for the

syntax. <emphasis>Warning</emphasis>: changing this may make the

TLS handshake fail, making communication with clients impossible.

GnuTLS priority string for the <acronym>TLS</acronym> handshake.

The default is <quote><literal

>SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP</literal></quote>. See

<citerefentry><refentrytitle>gnutls_priority_init</refentrytitle>

<manvolnum>3</manvolnum></citerefentry> for the syntax.

<emphasis>Warning</emphasis>: changing this may make the

<acronym>TLS</acronym> handshake fail, making server-client

communication impossible.

</para>

Older »