/mandos/trunk : revision 170

1

<?xml version='1.0' encoding='UTF-8'?>

1

<?xml version="1.0" encoding="UTF-8"?>

2

<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"

3

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

4

<!ENTITY VERSION "1.0">

5

<!ENTITY CONFNAME "mandos-clients.conf">

6

<!ENTITY CONFPATH "<filename>/etc/mandos/clients.conf</filename>">

7

<!ENTITY TIMESTAMP "2008-08-29">

7

<!ENTITY TIMESTAMP "2008-09-04">

8

]>

9

10

10

11

12

<title>Mandos Manual</title>

13

35

<holder>Teddy Hogeborn</holder>

36

<holder>Björn Påhlsson</holder>

37

</copyright>

38

39

<para>

40

This manual page is free software: you can redistribute it

41

and/or modify it under the terms of the GNU General Public

42

License as published by the Free Software Foundation,

43

either version 3 of the License, or (at your option) any

44

later version.

45

</para>

46

47

<para>

48

This manual page is distributed in the hope that it will

49

be useful, but WITHOUT ANY WARRANTY; without even the

50

implied warranty of MERCHANTABILITY or FITNESS FOR A

51

PARTICULAR PURPOSE. See the GNU General Public License

52

for more details.

53

</para>

54

55

<para>

56

You should have received a copy of the GNU General Public

57

License along with this program; If not, see

58

<ulink url="http://www.gnu.org/licenses/"/>.

59

</para>

60

</legalnotice>

38

<xi:include href="legalnotice.xml"/>

61

39

</refentryinfo>

62

40

63

41

73

51

</refnamediv>

74

52

75

53

76

77

&CONFPATH;

78

</synopsis>

54

<synopsis>&CONFPATH;</synopsis>

79

55

</refsynopsisdiv>

80

56

81

57

117

93

start time expansion, see <xref linkend="expansion"/>.

118

94

</para>

119

95

<para>

120

Uknown options are ignored. The used options are as follows:

96

Unknown options are ignored. The used options are as follows:

121

97

</para>

122

98

123

99

124

100

125

101

126

<term><literal><varname>timeout</varname></literal></term>

102

<term><option>timeout<literal> = </literal><replaceable

103

>TIME</replaceable></option></term>

127

104

128

<synopsis><literal>timeout = </literal><replaceable

129

>TIME</replaceable>

130

</synopsis>

105

<para>

106

This option is <emphasis>optional</emphasis>.

107

</para>

131

108

<para>

132

109

The timeout is how long the server will wait for a

133

110

successful checker run until a client is considered

151

128

</varlistentry>

152

129

153

130

154

<term><literal><varname>interval</varname></literal></term>

131

<term><option>interval<literal> = </literal><replaceable

132

>TIME</replaceable></option></term>

155

133

156

<synopsis><literal>interval = </literal><replaceable

157

>TIME</replaceable>

158

</synopsis>

134

<para>

135

This option is <emphasis>optional</emphasis>.

136

</para>

159

137

<para>

160

138

How often to run the checker to confirm that a client is

161

139

still up. <emphasis>Note:</emphasis> a new checker will

170

148

as for <varname>timeout</varname> above.

171

149

</para>

172

150

</listitem>

173

</varlistentry>

151

</varlistentry>

174

152

175

153

176

<term><literal>checker</literal></term>

154

<term><option>checker<literal> = </literal><replaceable

155

>COMMAND</replaceable></option></term>

177

156

178

<synopsis><literal>checker = </literal><replaceable

179

>COMMAND</replaceable>

180

</synopsis>

157

<para>

158

This option is <emphasis>optional</emphasis>.

159

</para>

181

160

<para>

182

161

This option allows you to override the default shell

183

162

command that the server will use to check if the client is

200

179

</varlistentry>

201

180

202

181

203

<term><literal>fingerprint</literal></term>

182

<term><option>fingerprint<literal> = </literal

183

><replaceable>HEXSTRING</replaceable></option></term>

204

184

205

<synopsis><literal>fingerprint = </literal><replaceable

206

>HEXSTRING</replaceable>

207

</synopsis>

185

<para>

186

This option is <emphasis>required</emphasis>.

187

</para>

208

188

<para>

209

189

This option sets the OpenPGP fingerprint that identifies

210

190

the public key that clients authenticate themselves with

215

195

</varlistentry>

216

196

217

197

218

<term><literal>secret</literal></term>

198

<term><option>secret<literal> = </literal><replaceable

199

>BASE64_ENCODED_DATA</replaceable></option></term>

219

200

220

<synopsis><literal>secret = </literal><replaceable

221

>BASE64_ENCODED_DATA</replaceable>

222

</synopsis>

201

<para>

202

If this option is not specified, the <option

203

>secfile</option> option is <emphasis>required</emphasis>

204

to be present.

205

</para>

223

206

<para>

224

207

If present, this option must be set to a string of

225

208

base64-encoded binary data. It will be decoded and sent

238

221

lines is that a line beginning with white space adds to

239

222

the value of the previous line, RFC 822-style.

240

223

</para>

241

<para>

242

If this option is not specified, the <option

243

>secfile</option> option is used instead, but one of them

244

<emphasis>must</emphasis> be present.

245

</para>

246

</listitem>

247

</varlistentry>

248

249

250

<term><literal>secfile</literal></term>

251

252

<synopsis><literal>secfile = </literal><replaceable

253

>FILENAME</replaceable>

254

</synopsis>

255

<para>

256

The same as <option>secret</option>, but the secret data

257

is in an external file. The contents of the file should

258

<emphasis>not</emphasis> be base64-encoded, but will be

259

sent to clients verbatim.

260

</para>

261

<para>

262

This option is only used, and <emphasis>must</emphasis> be

263

present, if <option>secret</option> is not specified.

264

</para>

265

</listitem>

266

</varlistentry>

267

268

269

270

271

<synopsis><literal>host = </literal><replaceable

272

>STRING</replaceable>

273

</synopsis>

224

</listitem>

225

</varlistentry>

226

227

228

<term><option>secfile<literal> = </literal><replaceable

229

>FILENAME</replaceable></option></term>

230

231

<para>

232

This option is only used if <option>secret</option> is not

233

specified, in which case this option is

234

<emphasis>required</emphasis>.

235

</para>

236

<para>

237

Similar to the <option>secret</option>, except the secret

238

data is in an external file. The contents of the file

239

should <emphasis>not</emphasis> be base64-encoded, but

240

will be sent to clients verbatim.

241

</para>

242

</listitem>

243

</varlistentry>

244

245

246

<term><option><literal>host = </literal><replaceable

247

>STRING</replaceable></option></term>

248

249

<para>

250

This option is <emphasis>optional</emphasis>, but highly

251

<emphasis>recommended</emphasis> unless the

252

<option>checker</option> option is modified to a

253

non-standard value without <quote>%(host)s</quote> in it.

254

</para>

274

255

<para>

275

256

Host name for this client. This is not used by the server

276

257

directly, but can be, and is by default, used by the

280

261

</varlistentry>

281

262

282

263

</variablelist>

283

</refsect1>

264

</refsect1>

284

265

285

266

286

267

<title>EXPANSION</title>

329

310

percent characters in a row (<quote>%%%%</quote>) must be

330

311

entered. Also, a bad format here will lead to an immediate

331

312

but <emphasis>silent</emphasis> run-time fatal exit; debug

332

mode is needed to track down an error of this kind.

313

mode is needed to expose an error of this kind.

333

314

</para>

334

315

</refsect2>

335

316

336

</refsect1>

317

</refsect1>

337

318

338

319

339

320

<title>FILES</title>

395

376

396

377

</programlisting>

397

378

</informalexample>

398

</refsect1>

379

</refsect1>

399

380

400

381

401

382