/mandos/trunk : revision 24.1.64

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-clients.conf.xml

Committer: Björn Påhlsson
Date: 2008-08-24 10:55:21 UTC
mfrom: (100 mandos)
mto: (24.1.154 mandos) (237.4.3 mandos-release)
mto: This revision was merged to the branch mainline in revision 102.
Revision ID: belorn@braxen-20080824105521-k7g7hi13rn0c9wsc

merge

files removed:
.bzrignore

files modified:
Makefile

TODO

clients.conf

initramfs-tools-hook

mandos

mandos-clients.conf.xml

mandos-keygen

mandos-keygen.xml

mandos-options.xml

mandos.conf.xml

mandos.xml

plugin-runner.c

plugin-runner.xml

plugins.d/password-prompt.c

plugins.d/password-prompt.xml

plugins.d/password-request.xml

Show diffs side-by-side

added added

removed removed

mandos-clients.conf.xml

<!ENTITY VERSION "1.0">

<!ENTITY CONFNAME "mandos-clients.conf">

<!ENTITY CONFPATH "<filename>/etc/mandos/clients.conf</filename>">

<!ENTITY TIMESTAMP "2008-08-29">

<title>Mandos Manual</title>

<title>&CONFNAME;</title>

<productname>Mandos</productname>

<productname>&CONFNAME;</productname>

<productnumber>&VERSION;</productnumber>

<date>&TIMESTAMP;</date>

<firstname>Björn</firstname>

<title>DESCRIPTION</title>

<para>

The file &CONFPATH; is a configuration file for <citerefentry

The file &CONFPATH; is the configuration file for <citerefentry

><refentrytitle>mandos</refentrytitle>

<manvolnum>8</manvolnum></citerefentry>, read by it at startup.

The file needs to list all clients that should be able to use

the service. All clients listed will be regarded as valid, even

<manvolnum>8</manvolnum></citerefentry>, read by it at startup,

where each client that will be able to use the service needs to

be listed. All clients listed will be regarded as valid, even

if a client was declared invalid in a previous run of the

server.

</para>

113

111

114

112

<title>OPTIONS</title>

115

113

<para>

116

<emphasis>Note:</emphasis> all option values are subject to

117

start time expansion, see <xref linkend="expansion"/>.

118

</para>

119

<para>

120

Uknown options are ignored. The used options are as follows:

114

The possible options are:

121

115

</para>

122

116

123

117

181

175

<para>

182

176

This option allows you to override the default shell

183

177

command that the server will use to check if the client is

184

still up. Any output of the command will be ignored, only

185

the exit code is checked: If the exit code of the command

186

is zero, the client is considered up. The command will be

187

run using <quote><command><filename>/bin/sh</filename>

188

<option>-c</option></command></quote>, so

189

<varname>PATH</varname> will be searched. The default

190

value for the checker command is <quote><literal

191

><command>fping</command> <option>-q</option> <option

192

>--</option> %(host)s</literal></quote>.

178

still up. The output of the command will be ignored, only

179

the exit code is checked. The command will be run using

180

181

<option>-c</option></command></quote>. The default

182

command is <quote><literal><command>fping</command>

183

184

%(host)s</literal></quote>.

193

185

</para>

194

186

<para>

195

187

In addition to normal start time expansion, this option

226

218

to the client matching the above

227

219

<option>fingerprint</option>. This should, of course, be

228

220

OpenPGP encrypted data, decryptable only by the client.

229

The program <citerefentry><refentrytitle><command

230

>mandos-keygen</command></refentrytitle><manvolnum

231

>8</manvolnum></citerefentry> can, using its

232

<option>--password</option> option, be used to generate

233

this, if desired.

234

</para>

235

<para>

236

Note: this value of this option will probably be very

237

long. A useful feature to avoid having unreadably-long

238

lines is that a line beginning with white space adds to

239

the value of the previous line, RFC 822-style.

240

</para>

241

<para>

242

If this option is not specified, the <option

243

>secfile</option> option is used instead, but one of them

244

<emphasis>must</emphasis> be present.

221

222

223

224

225

</para>

226

<para>

227

Note: this value of this option will probably run over

228

many lines, and will then have to use the fact that a line

229

beginning with white space adds to the value of the

230

previous line, RFC 822-style.

245

231

</para>

246

232

</listitem>

247

233

</varlistentry>

249

235

250

236

<term><literal>secfile</literal></term>

251

237

252

<synopsis><literal>secfile = </literal><replaceable

253

>FILENAME</replaceable>

254

</synopsis>

255

<para>

256

The same as <option>secret</option>, but the secret data

257

is in an external file. The contents of the file should

258

<emphasis>not</emphasis> be base64-encoded, but will be

259

sent to clients verbatim.

260

</para>

261

<para>

262

This option is only used, and <emphasis>must</emphasis> be

263

present, if <option>secret</option> is not specified.

238

<para>

239

Base 64 encoded OpenPGP encrypted password encrypted by

240

the clients openpgp certificate as a binary file.

264

241

</para>

265

242

</listitem>

266

243

</varlistentry>

268

245

269

246

270

247

271

<synopsis><literal>host = </literal><replaceable

272

>STRING</replaceable>

273

</synopsis>

274

248

<para>

275

Host name for this client. This is not used by the server

276

directly, but can be, and is by default, used by the

277

checker. See the <option>checker</option> option.

249

Host name that can be used in for checking that the client is up.

278

250

</para>

279

251

</listitem>

280

252

</varlistentry>

253

254

255

<term><literal>checker</literal></term>

256

257

<para>

258

Shell command that the server will use to check up if a

259

client is still up.

260

</para>

261

</listitem>

262

</varlistentry>

263

264

265

<term><literal>timeout</literal></term>

266

267

<para>

268

Duration that a client can be down whitout be removed from

269

the client list.

270

</para>

271

</listitem>

272

</varlistentry>

281

273

282

274

</variablelist>

283

275

</refsect1>

325

317

<para>

326

318

Note that this means that, in order to include an actual

327

319

percent character (<quote>%</quote>) in a

328

<varname>checker</varname> option, <emphasis>four</emphasis>

320

<varname>checker</varname> options, <emphasis>four</emphasis>

329

321

percent characters in a row (<quote>%%%%</quote>) must be

330

322

entered. Also, a bad format here will lead to an immediate

331

323

but <emphasis>silent</emphasis> run-time fatal exit; debug

384

376

5MHdW9AYsNJZAQSOpirE4Xi31CSlWAi9KV+cUCmWF5zOFy1x23P6PjdaRm

385

377

4T2zw4dxS5NswXWU0sVEXxjs6PYxuIiCTL7vdpx8QjBkrPWDrAbcMyBr2O

386

378

QlnHIvPzEArRQLo=

379

=iHhv

387

380

host = foo.example.org

388

interval = 1m

381

interval = 5m

389

382

390

383

# Client "bar"

391

384

[bar]

392

385

fingerprint = 3e393aeaefb84c7e89e2f547b3a107558fca3a27

393

secfile = /etc/mandos/bar-secret

394

timeout = 15m

386

secfile = /etc/mandos/bar-secret.txt.asc

395

387

396

388

</programlisting>

397

389

</informalexample>

398

390

</refsect1>

399

400

401

402

<para>

403

<citerefentry><refentrytitle>mandos-keygen</refentrytitle>

404

<manvolnum>8</manvolnum></citerefentry>,

405

<citerefentry><refentrytitle>mandos.conf</refentrytitle>

406

<manvolnum>5</manvolnum></citerefentry>,

407

<citerefentry><refentrytitle>mandos</refentrytitle>

408

409

</para>

410

</refsect1>

391

411

392

</refentry>

412

413

414

415

416

Older »