/mandos/trunk : revision 170

1

<?xml version='1.0' encoding='UTF-8'?>

1

<?xml version="1.0" encoding="UTF-8"?>

2

<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"

3

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

4

<!ENTITY VERSION "1.0">

5

<!ENTITY CONFNAME "mandos-clients.conf">

6

<!ENTITY CONFPATH "<filename>/etc/mandos/clients.conf</filename>">

7

<!ENTITY TIMESTAMP "2008-09-04">

7

8

]>

8

9

10

10

11

11

<title>&CONFNAME;</title>

12

<title>Mandos Manual</title>

12

13

13

<productname>&CONFNAME;</productname>

14

<productname>Mandos</productname>

14

15

<productnumber>&VERSION;</productnumber>

16

<date>&TIMESTAMP;</date>

15

17

16

18

17

19

<firstname>Björn</firstname>

33

35

<holder>Teddy Hogeborn</holder>

34

36

<holder>Björn Påhlsson</holder>

35

37

</copyright>

36

37

<para>

38

This manual page is free software: you can redistribute it

39

and/or modify it under the terms of the GNU General Public

40

License as published by the Free Software Foundation,

41

either version 3 of the License, or (at your option) any

42

later version.

43

</para>

44

45

<para>

46

This manual page is distributed in the hope that it will

47

be useful, but WITHOUT ANY WARRANTY; without even the

48

implied warranty of MERCHANTABILITY or FITNESS FOR A

49

PARTICULAR PURPOSE. See the GNU General Public License

50

for more details.

51

</para>

52

53

<para>

54

You should have received a copy of the GNU General Public

55

License along with this program; If not, see

56

<ulink url="http://www.gnu.org/licenses/"/>.

57

</para>

58

</legalnotice>

38

<xi:include href="legalnotice.xml"/>

59

39

</refentryinfo>

60

40

61

41

71

51

</refnamediv>

72

52

73

53

74

75

&CONFPATH;

76

</synopsis>

54

<synopsis>&CONFPATH;</synopsis>

77

55

</refsynopsisdiv>

78

56

79

57

115

93

start time expansion, see <xref linkend="expansion"/>.

116

94

</para>

117

95

<para>

118

Uknown options are ignored. The used options are as follows:

96

Unknown options are ignored. The used options are as follows:

119

97

</para>

120

98

121

99

122

100

123

101

124

<term><literal><varname>timeout</varname></literal></term>

102

<term><option>timeout<literal> = </literal><replaceable

103

>TIME</replaceable></option></term>

125

104

126

<synopsis><literal>timeout = </literal><replaceable

127

>TIME</replaceable>

128

</synopsis>

105

<para>

106

This option is <emphasis>optional</emphasis>.

107

</para>

129

108

<para>

130

109

The timeout is how long the server will wait for a

131

110

successful checker run until a client is considered

149

128

</varlistentry>

150

129

151

130

152

<term><literal><varname>interval</varname></literal></term>

131

<term><option>interval<literal> = </literal><replaceable

132

>TIME</replaceable></option></term>

153

133

154

<synopsis><literal>interval = </literal><replaceable

155

>TIME</replaceable>

156

</synopsis>

134

<para>

135

This option is <emphasis>optional</emphasis>.

136

</para>

157

137

<para>

158

138

How often to run the checker to confirm that a client is

159

139

still up. <emphasis>Note:</emphasis> a new checker will

168

148

as for <varname>timeout</varname> above.

169

149

</para>

170

150

</listitem>

171

</varlistentry>

151

</varlistentry>

172

152

173

153

174

<term><literal>checker</literal></term>

154

<term><option>checker<literal> = </literal><replaceable

155

>COMMAND</replaceable></option></term>

175

156

176

<synopsis><literal>checker = </literal><replaceable

177

>COMMAND</replaceable>

178

</synopsis>

157

<para>

158

This option is <emphasis>optional</emphasis>.

159

</para>

179

160

<para>

180

161

This option allows you to override the default shell

181

162

command that the server will use to check if the client is

198

179

</varlistentry>

199

180

200

181

201

<term><literal>fingerprint</literal></term>

182

<term><option>fingerprint<literal> = </literal

183

><replaceable>HEXSTRING</replaceable></option></term>

202

184

203

<synopsis><literal>fingerprint = </literal><replaceable

204

>HEXSTRING</replaceable>

205

</synopsis>

185

<para>

186

This option is <emphasis>required</emphasis>.

187

</para>

206

188

<para>

207

189

This option sets the OpenPGP fingerprint that identifies

208

190

the public key that clients authenticate themselves with

213

195

</varlistentry>

214

196

215

197

216

<term><literal>secret</literal></term>

198

<term><option>secret<literal> = </literal><replaceable

199

>BASE64_ENCODED_DATA</replaceable></option></term>

217

200

218

<synopsis><literal>secret = </literal><replaceable

219

>BASE64_ENCODED_DATA</replaceable>

220

</synopsis>

201

<para>

202

If this option is not specified, the <option

203

>secfile</option> option is <emphasis>required</emphasis>

204

to be present.

205

</para>

221

206

<para>

222

207

If present, this option must be set to a string of

223

208

base64-encoded binary data. It will be decoded and sent

236

221

lines is that a line beginning with white space adds to

237

222

the value of the previous line, RFC 822-style.

238

223

</para>

239

<para>

240

If this option is not specified, the <option

241

>secfile</option> option is used instead, but one of them

242

<emphasis>must</emphasis> be present.

243

</para>

244

</listitem>

245

</varlistentry>

246

247

248

<term><literal>secfile</literal></term>

249

250

<synopsis><literal>secfile = </literal><replaceable

251

>FILENAME</replaceable>

252

</synopsis>

253

<para>

254

The same as <option>secret</option>, but the secret data

255

is in an external file. The contents of the file should

256

<emphasis>not</emphasis> be base64-encoded, but will be

257

sent to clients verbatim.

258

</para>

259

<para>

260

This option is only used, and <emphasis>must</emphasis> be

261

present, if <option>secret</option> is not specified.

262

</para>

263

</listitem>

264

</varlistentry>

265

266

267

268

269

<synopsis><literal>host = </literal><replaceable

270

>STRING</replaceable>

271

</synopsis>

224

</listitem>

225

</varlistentry>

226

227

228

<term><option>secfile<literal> = </literal><replaceable

229

>FILENAME</replaceable></option></term>

230

231

<para>

232

This option is only used if <option>secret</option> is not

233

specified, in which case this option is

234

<emphasis>required</emphasis>.

235

</para>

236

<para>

237

Similar to the <option>secret</option>, except the secret

238

data is in an external file. The contents of the file

239

should <emphasis>not</emphasis> be base64-encoded, but

240

will be sent to clients verbatim.

241

</para>

242

</listitem>

243

</varlistentry>

244

245

246

<term><option><literal>host = </literal><replaceable

247

>STRING</replaceable></option></term>

248

249

<para>

250

This option is <emphasis>optional</emphasis>, but highly

251

<emphasis>recommended</emphasis> unless the

252

<option>checker</option> option is modified to a

253

non-standard value without <quote>%(host)s</quote> in it.

254

</para>

272

255

<para>

273

256

Host name for this client. This is not used by the server

274

257

directly, but can be, and is by default, used by the

278

261

</varlistentry>

279

262

280

263

</variablelist>

281

</refsect1>

264

</refsect1>

282

265

283

266

284

267

<title>EXPANSION</title>

327

310

percent characters in a row (<quote>%%%%</quote>) must be

328

311

entered. Also, a bad format here will lead to an immediate

329

312

but <emphasis>silent</emphasis> run-time fatal exit; debug

330

mode is needed to track down an error of this kind.

313

mode is needed to expose an error of this kind.

331

314

</para>

332

315

</refsect2>

333

316

334

</refsect1>

317

</refsect1>

335

318

336

319

337

320

<title>FILES</title>

393

376

394

377

</programlisting>

395

378

</informalexample>

396

</refsect1>

379

</refsect1>

397

380

398

381

399

382

400

383

<para>

401

402

<refentrytitle>mandos</refentrytitle>

403

404

<refentrytitle>mandos-keygen</refentrytitle>

405

406

<refentrytitle>mandos.conf</refentrytitle>

407

384

<citerefentry><refentrytitle>mandos-keygen</refentrytitle>

385

<manvolnum>8</manvolnum></citerefentry>,

386

<citerefentry><refentrytitle>mandos.conf</refentrytitle>

387

<manvolnum>5</manvolnum></citerefentry>,

388

<citerefentry><refentrytitle>mandos</refentrytitle>

389

408

390

</para>

409

391

</refsect1>

410

392

</refentry>

393

394

395

396

397