95
93
start time expansion, see <xref linkend="expansion"/>.
98
Unknown options are ignored. The used options are as follows:
96
Uknown options are ignored. The used options are as follows:
104
<term><option>approval_delay<literal> = </literal><replaceable
105
>TIME</replaceable></option></term>
108
This option is <emphasis>optional</emphasis>.
111
How long to wait for external approval before resorting to
112
use the <option>approved_by_default</option> value. The
113
default is <quote>0s</quote>, i.e. not to wait.
116
The format of <replaceable>TIME</replaceable> is the same
117
as for <varname>timeout</varname> below.
123
<term><option>approval_duration<literal> = </literal
124
><replaceable>TIME</replaceable></option></term>
127
This option is <emphasis>optional</emphasis>.
130
How long an external approval lasts. The default is 1
134
The format of <replaceable>TIME</replaceable> is the same
135
as for <varname>timeout</varname> below.
141
<term><option>approved_by_default<literal> = </literal
142
>{ <literal >1</literal> | <literal>yes</literal> | <literal
143
>true</literal> | <literal>on</literal> | <literal
144
>0</literal> | <literal>no</literal> | <literal
145
>false</literal> | <literal>off</literal> }</option></term>
148
Whether to approve a client by default after
149
the <option>approval_delay</option>. The default
150
is <quote>True</quote>.
102
<term><option>timeout<literal> = </literal><replaceable
103
>TIME</replaceable></option></term>
106
The timeout is how long the server will wait for a
107
successful checker run until a client is considered
108
invalid - that is, ineligible to get the data this server
109
holds. By default Mandos will use 1 hour.
112
The <replaceable>TIME</replaceable> is specified as a
113
space-separated number of values, each of which is a
114
number and a one-character suffix. The suffix must be one
115
of <quote>d</quote>, <quote>s</quote>, <quote>m</quote>,
116
<quote>h</quote>, and <quote>w</quote> for days, seconds,
117
minutes, hours, and weeks, respectively. The values are
118
added together to give the total time value, so all of
119
<quote><literal>330s</literal></quote>,
120
<quote><literal>110s 110s 110s</literal></quote>, and
121
<quote><literal>5m 30s</literal></quote> will give a value
122
of five minutes and thirty seconds.
128
<term><option>interval<literal> = </literal><replaceable
129
>TIME</replaceable></option></term>
132
How often to run the checker to confirm that a client is
133
still up. <emphasis>Note:</emphasis> a new checker will
134
not be started if an old one is still running. The server
135
will wait for a checker to complete until the above
136
<quote><varname>timeout</varname></quote> occurs, at which
137
time the client will be marked invalid, and any running
138
checker killed. The default interval is 5 minutes.
141
The format of <replaceable>TIME</replaceable> is the same
142
as for <varname>timeout</varname> above.
156
148
<term><option>checker<literal> = </literal><replaceable
157
149
>COMMAND</replaceable></option></term>
160
This option is <emphasis>optional</emphasis>.
163
152
This option allows you to override the default shell
164
153
command that the server will use to check if the client is
165
154
still up. Any output of the command will be ignored, only
200
<term><option><literal>host = </literal><replaceable
201
>STRING</replaceable></option></term>
204
This option is <emphasis>optional</emphasis>, but highly
205
<emphasis>recommended</emphasis> unless the
206
<option>checker</option> option is modified to a
207
non-standard value without <quote>%%(host)s</quote> in it.
210
Host name for this client. This is not used by the server
211
directly, but can be, and is by default, used by the
212
checker. See the <option>checker</option> option.
218
<term><option>interval<literal> = </literal><replaceable
219
>TIME</replaceable></option></term>
222
This option is <emphasis>optional</emphasis>.
225
How often to run the checker to confirm that a client is
226
still up. <emphasis>Note:</emphasis> a new checker will
227
not be started if an old one is still running. The server
228
will wait for a checker to complete until the below
229
<quote><varname>timeout</varname></quote> occurs, at which
230
time the client will be disabled, and any running checker
231
killed. The default interval is 5 minutes.
234
The format of <replaceable>TIME</replaceable> is the same
235
as for <varname>timeout</varname> below.
241
<term><option>secfile<literal> = </literal><replaceable
242
>FILENAME</replaceable></option></term>
245
This option is only used if <option>secret</option> is not
246
specified, in which case this option is
247
<emphasis>required</emphasis>.
250
Similar to the <option>secret</option>, except the secret
251
data is in an external file. The contents of the file
252
should <emphasis>not</emphasis> be base64-encoded, but
253
will be sent to clients verbatim.
256
File names of the form <filename>~user/foo/bar</filename>
257
and <filename>$<envar>ENVVAR</envar>/foo/bar</filename>
264
186
<term><option>secret<literal> = </literal><replaceable
265
187
>BASE64_ENCODED_DATA</replaceable></option></term>
268
If this option is not specified, the <option
269
>secfile</option> option is <emphasis>required</emphasis>
273
190
If present, this option must be set to a string of
274
191
base64-encoded binary data. It will be decoded and sent
275
192
to the client matching the above
287
204
lines is that a line beginning with white space adds to
288
205
the value of the previous line, RFC 822-style.
294
<term><option>timeout<literal> = </literal><replaceable
295
>TIME</replaceable></option></term>
298
This option is <emphasis>optional</emphasis>.
301
The timeout is how long the server will wait (for either a
302
successful checker run or a client receiving its secret)
303
until a client is disabled and not allowed to get the data
304
this server holds. By default Mandos will use 1 hour.
307
The <replaceable>TIME</replaceable> is specified as a
308
space-separated number of values, each of which is a
309
number and a one-character suffix. The suffix must be one
310
of <quote>d</quote>, <quote>s</quote>, <quote>m</quote>,
311
<quote>h</quote>, and <quote>w</quote> for days, seconds,
312
minutes, hours, and weeks, respectively. The values are
313
added together to give the total time value, so all of
314
<quote><literal>330s</literal></quote>,
315
<quote><literal>110s 110s 110s</literal></quote>, and
316
<quote><literal>5m 30s</literal></quote> will give a value
317
of five minutes and thirty seconds.
208
If this option is not specified, the <option
209
>secfile</option> option is used instead, but one of them
210
<emphasis>must</emphasis> be present.
216
<term><option>secfile<literal> = </literal><replaceable
217
>FILENAME</replaceable></option></term>
220
Similar to the <option>secret</option>, except the secret
221
data is in an external file. The contents of the file
222
should <emphasis>not</emphasis> be base64-encoded, but
223
will be sent to clients verbatim.
226
This option is only used, and <emphasis>must</emphasis> be
227
present, if <option>secret</option> is not specified.
233
<term><option><literal>host = </literal><replaceable
234
>STRING</replaceable></option></term>
237
Host name for this client. This is not used by the server
238
directly, but can be, and is by default, used by the
239
checker. See the <option>checker</option> option.