/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-clients.conf.xml

• browse files at revision 237.4.26
• compare with another revision
• download diff
• download tarball
• view history from revision 237.4.26

• reverse the comparison (237.4.26 to 898)
• stop comparing with revision 898

Show diffs side-by-side

added

removed

mandos-clients.conf.xml

3

3

        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

4

4

<!ENTITY CONFNAME "mandos-clients.conf">

5

5

<!ENTITY CONFPATH "<filename>/etc/mandos/clients.conf</filename>">

6

 

<!ENTITY TIMESTAMP "2016-06-23">

 

6

<!ENTITY TIMESTAMP "2012-01-01">

7

7

<!ENTITY % common SYSTEM "common.ent">

8

8

%common;

9

9

]>

37

37

      <year>2010</year>

38

38

      <year>2011</year>

39

39

      <year>2012</year>

40

 

      <year>2013</year>

41

 

      <year>2014</year>

42

 

      <year>2015</year>

43

 

      <year>2016</year>

44

40

      <holder>Teddy Hogeborn</holder>

45

41

      <holder>Björn Påhlsson</holder>

46

42

    </copyright>

121

117

          <para>

122

118

            How long to wait for external approval before resorting to

123

119

            use the <option>approved_by_default</option> value.  The

124

 

            default is <quote>PT0S</quote>, i.e. not to wait.

 

120

            default is <quote>0s</quote>, i.e. not to wait.

125

121

          </para>

126

122

          <para>

127

123

            The format of <replaceable>TIME</replaceable> is the same

171

167

            This option is <emphasis>optional</emphasis>.

172

168

          </para>

173

169

          <para>

174

 

            This option overrides the default shell command that the

175

 

            server will use to check if the client is still up.  Any

176

 

            output of the command will be ignored, only the exit code

177

 

            is checked:  If the exit code of the command is zero, the

178

 

            client is considered up.  The command will be run using

179

 

            <quote><command><filename>/bin/sh</filename>

 

170

            This option allows you to override the default shell

 

171

            command that the server will use to check if the client is

 

172

            still up.  Any output of the command will be ignored, only

 

173

            the exit code is checked:  If the exit code of the command

 

174

            is zero, the client is considered up.  The command will be

 

175

            run using <quote><command><filename>/bin/sh</filename>

180

176

            <option>-c</option></command></quote>, so

181

177

            <varname>PATH</varname> will be searched.  The default

182

178

            value for the checker command is <quote><literal

183

179

            ><command>fping</command> <option>-q</option> <option

184

 

            >--</option> %%(host)s</literal></quote>.  Note that

185

 

            <command>mandos-keygen</command>, when generating output

186

 

            to be inserted into this file, normally looks for an SSH

187

 

            server on the Mandos client, and, if it find one, outputs

188

 

            a <option>checker</option> option to check for the

189

 

            client’s key fingerprint – this is more secure against

190

 

            spoofing.

 

180

            >--</option> %%(host)s</literal></quote>.

191

181

          </para>

192

182

          <para>

193

183

            In addition to normal start time expansion, this option

230

220

          <para>

231

221

            This option sets the OpenPGP fingerprint that identifies

232

222

            the public key that clients authenticate themselves with

233

 

            through TLS.  The string needs to be in hexadecimal form,

 

223

            through TLS.  The string needs to be in hexidecimal form,

234

224

            but spaces or upper/lower case are not significant.

235

225

          </para>

236

226

        </listitem>

345

335

            <option>extended_timeout</option> option.

346

336

          </para>

347

337

          <para>

348

 

            The <replaceable>TIME</replaceable> is specified as an RFC

349

 

            3339 duration; for example

350

 

            <quote><literal>P1Y2M3DT4H5M6S</literal></quote> meaning

351

 

            one year, two months, three days, four hours, five

352

 

            minutes, and six seconds.  Some values can be omitted, see

353

 

            RFC 3339 Appendix A for details.

 

338

            The <replaceable>TIME</replaceable> is specified as a

 

339

            space-separated number of values, each of which is a

 

340

            number and a one-character suffix.  The suffix must be one

 

341

            of <quote>d</quote>, <quote>s</quote>, <quote>m</quote>,

 

342

            <quote>h</quote>, and <quote>w</quote> for days, seconds,

 

343

            minutes, hours, and weeks, respectively.  The values are

 

344

            added together to give the total time value, so all of

 

345

            <quote><literal>330s</literal></quote>,

 

346

            <quote><literal>110s 110s 110s</literal></quote>, and

 

347

            <quote><literal>5m 30s</literal></quote> will give a value

 

348

            of five minutes and thirty seconds.

354

349

          </para>

355

350

        </listitem>

356

351

      </varlistentry>

414

409

        <quote><literal>approval_duration</literal></quote>,

415

410

        <quote><literal>created</literal></quote>,

416

411

        <quote><literal>enabled</literal></quote>,

417

 

        <quote><literal>expires</literal></quote>,

418

412

        <quote><literal>fingerprint</literal></quote>,

419

413

        <quote><literal>host</literal></quote>,

420

414

        <quote><literal>interval</literal></quote>,

463

457

      <literal>%(<replaceable>foo</replaceable>)s</literal> is

464

458

      obscure.

465

459

    </para>

466

 

    <xi:include href="bugs.xml"/>

467

460

  </refsect1>

468

461

  

469

462

  <refsect1 id="example">

471

464

    <informalexample>

472

465

      <programlisting>

473

466

[DEFAULT]

474

 

timeout = PT5M

475

 

interval = PT2M

 

467

timeout = 5m

 

468

interval = 2m

476

469

checker = fping -q -- %%(host)s

477

470

 

478

471

# Client "foo"

495

488

        4T2zw4dxS5NswXWU0sVEXxjs6PYxuIiCTL7vdpx8QjBkrPWDrAbcMyBr2O

496

489

        QlnHIvPzEArRQLo=

497

490

host = foo.example.org

498

 

interval = PT1M

 

491

interval = 1m

499

492

 

500

493

# Client "bar"

501

494

[bar]

502

495

fingerprint = 3e393aeaefb84c7e89e2f547b3a107558fca3a27

503

496

secfile = /etc/mandos/bar-secret

504

 

timeout = PT15M

 

497

timeout = 15m

505

498

approved_by_default = False

506

 

approval_delay = PT30S

 

499

approval_delay = 30s

507

500

      </programlisting>

508

501

    </informalexample>

509

502

  </refsect1>

518

511

      <citerefentry><refentrytitle>mandos.conf</refentrytitle>

519

512

      <manvolnum>5</manvolnum></citerefentry>,

520

513

      <citerefentry><refentrytitle>mandos</refentrytitle>

521

 

      <manvolnum>8</manvolnum></citerefentry>,

522

 

      <citerefentry><refentrytitle>fping</refentrytitle>

523

514

      <manvolnum>8</manvolnum></citerefentry>

524

515

    </para>

525

 

    <variablelist>

526

 

      <varlistentry>

527

 

        <term>

528

 

          RFC 3339: <citetitle>Date and Time on the Internet:

529

 

          Timestamps</citetitle>

530

 

        </term>

531

 

      <listitem>

532

 

        <para>

533

 

          The time intervals are in the "duration" format, as

534

 

          specified in ABNF in Appendix A of RFC 3339.

535

 

        </para>

536

 

      </listitem>

537

 

      </varlistentry>

538

 

    </variablelist>

539

516

  </refsect1>

540

517

</refentry>

541

518

<!-- Local Variables: -->

• Older »

Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0