79
80
<refsect1 id="description">
80
81
<title>DESCRIPTION</title>
82
The file &CONFPATH; is the configuration file for <citerefentry
83
><refentrytitle>mandos</refentrytitle>
84
<manvolnum>8</manvolnum></citerefentry>, read by it at startup,
85
where each client that will be able to use the service needs to
86
be listed. All clients listed will be regarded as valid, even
87
if a client was declared invalid in a previous run of the
91
The format starts with a section under [] which is either
92
<literal>[DEFAULT]</literal> or <literal>[<replaceable>client
93
name</replaceable>]</literal>. Following the section is any
94
number of <quote><varname><replaceable>option</replaceable
95
></varname>=<replaceable>value</replaceable></quote> entries,
96
with continuations in the style of RFC 822. <quote><varname
97
><replaceable>option</replaceable></varname>: <replaceable
98
>value</replaceable></quote> is also accepted. Note that
99
leading whitespace is removed from values. Values can contain
100
format strings which refer to other values in the same section,
101
or values in the <quote>DEFAULT</quote> section. Lines
102
beginning with <quote>#</quote> or <quote>;</quote> are ignored
103
and may be used to provide comments.
83
The file &CONFPATH; is the configuration file for mandos where
84
each client that will be abel to use the service need to be
85
specified. The configuration file is looked on at the startup of
86
the service, so to reenable timedout clients one need to only
87
restart the server. The format starts with a section under []
88
which is eather <literal>[DEFAULT]</literal> or a client
89
name. Values is set through the use of VAR = VALUE pair. Values
107
<refsect1 id="options">
108
<title>OPTIONS</title>
94
<refsect1 id="default">
95
<title>DEFAULTS</title>
110
The possible options are:
97
The paramters for <literal>[DEFAULT]</literal> are:
116
<term><literal><varname>timeout</varname></literal></term>
103
<term><literal>timeout</literal></term>
118
<synopsis><literal>timeout = </literal><replaceable
122
The timeout is how long the server will wait for a
123
successful checker run until a client is considered
124
invalid - that is, ineligible to get the data this server
125
holds. By default Mandos will use 1 hour.
128
The <replaceable>TIME</replaceable> is specified as a
129
space-separated number of values, each of which is a
130
number and a one-character suffix. The suffix must be one
131
of <quote>d</quote>, <quote>s</quote>, <quote>m</quote>,
132
<quote>h</quote>, and <quote>w</quote> for days, seconds,
133
minutes, hours, and weeks, respectively. The values are
134
added together to give the total time value, so all of
135
<quote><literal>330s</literal></quote>,
136
<quote><literal>110s 110s 110s</literal></quote>, and
137
<quote><literal>5m 30s</literal></quote> will give a value
138
of five minutes and thirty seconds.
106
This option allows you to override the default timeout
107
that clients will get. By default mandos will use 1hr.
144
<term><literal><varname>interval</varname></literal></term>
113
<term><literal>interval</literal></term>
146
<synopsis><literal>interval = </literal><replaceable
150
How often to run the checker to confirm that a client is
151
still up. <emphasis>Note:</emphasis> a new checker will
152
not be started if an old one is still running. The server
153
will wait for a checker to complete until the above
154
<quote><varname>timeout</varname></quote> occurs, at which
155
time the client will be marked invalid, and any running
156
checker killed. The default interval is 5 minutes.
159
The format of <replaceable>TIME</replaceable> is the same
160
as for <varname>timeout</varname> above.
116
This option allows you to override the default interval
117
used between checkups for disconnected clients. By default
239
<refsect1 id="expansion">
240
<title>EXPANSION</title>
242
There are two forms of expansion: Start time expansion and
246
<title>START TIME EXPANSION</title>
248
Any string in an option value of the form
249
<quote><literal>%(<replaceable>foo</replaceable>)s</literal
250
></quote> will be replaced by the value of the option
251
<varname>foo</varname> either in the same section, or, if it
252
does not exist there, the <literal>[DEFAULT]</literal>
253
section. This is done at start time, when the configuration
257
Note that this means that, in order to include an actual
258
percent character (<quote>%</quote>) in an option value, two
259
percent characters in a row (<quote>%%</quote>) must be
264
<title>RUNTIME EXPANSION</title>
266
This is currently only done for the <varname>checker</varname>
270
Any string in an option value of the form
271
<quote><literal>%%(<replaceable>foo</replaceable>)s</literal
272
></quote> will be replaced by the value of the attribute
273
<varname>foo</varname> of the internal
274
<quote><classname>Client</classname></quote> object. See the
275
source code for details, and let the authors know of any
276
attributes that are useful so they may be preserved to any new
277
versions of this software.
280
Note that this means that, in order to include an actual
281
percent character (<quote>%</quote>) in a
282
<varname>checker</varname> options, <emphasis>four</emphasis>
283
percent characters in a row (<quote>%%%%</quote>) must be
284
entered. Also, a bad format here will lead to an immediate
285
but <emphasis>silent</emphasis> run-time fatal exit; debug
286
mode is needed to track down an error of this kind.
292
<refsect1 id="files">
295
The file described here is &CONFPATH;
302
The format for specifying times for <varname>timeout</varname>
303
and <varname>interval</varname> is not very good.
306
The difference between
307
<literal>%%(<replaceable>foo</replaceable>)s</literal> and
308
<literal>%(<replaceable>foo</replaceable>)s</literal> is
313
<refsect1 id="example">
314
<title>EXAMPLE</title>
208
<refsect1 id="examples">
209
<title>EXAMPLES</title>
315
210
<informalexample>
320
checker = fping -q -- %%(host)s
215
checker = fping -q -- %%(fqdn)s
324
218
fingerprint = 7788 2722 5BA7 DE53 9C5A 7CFA 59CF F7CD BD9A 5920
326
221
hQIOA6QdEjBs2L/HEAf/TCyrDe5Xnm9esa+Pb/vWF9CUqfn4srzVgSu234
327
222
REJMVv7lBSrPE2132Lmd2gqF1HeLKDJRSVxJpt6xoWOChGHg+TMyXDxK+N