/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-clients.conf.xml

• browse files at revision 572
• compare with another revision
• download diff
• download tarball
• view history from revision 572

• reverse the comparison (572 to 905)
• stop comparing with revision 905

Show diffs side-by-side

added

removed

mandos-clients.conf.xml

3

3

        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

4

4

<!ENTITY CONFNAME "mandos-clients.conf">

5

5

<!ENTITY CONFPATH "<filename>/etc/mandos/clients.conf</filename>">

6

 

<!ENTITY TIMESTAMP "2017-02-23">

 

6

<!ENTITY TIMESTAMP "2012-01-01">

7

7

<!ENTITY % common SYSTEM "common.ent">

8

8

%common;

9

9

]>

37

37

      <year>2010</year>

38

38

      <year>2011</year>

39

39

      <year>2012</year>

40

 

      <year>2013</year>

41

 

      <year>2014</year>

42

 

      <year>2015</year>

43

 

      <year>2016</year>

44

 

      <year>2017</year>

45

40

      <holder>Teddy Hogeborn</holder>

46

41

      <holder>Björn Påhlsson</holder>

47

42

    </copyright>

122

117

          <para>

123

118

            How long to wait for external approval before resorting to

124

119

            use the <option>approved_by_default</option> value.  The

125

 

            default is <quote>PT0S</quote>, i.e. not to wait.

 

120

            default is <quote>0s</quote>, i.e. not to wait.

126

121

          </para>

127

122

          <para>

128

123

            The format of <replaceable>TIME</replaceable> is the same

172

167

            This option is <emphasis>optional</emphasis>.

173

168

          </para>

174

169

          <para>

175

 

            This option overrides the default shell command that the

176

 

            server will use to check if the client is still up.  Any

177

 

            output of the command will be ignored, only the exit code

178

 

            is checked:  If the exit code of the command is zero, the

179

 

            client is considered up.  The command will be run using

180

 

            <quote><command><filename>/bin/sh</filename>

 

170

            This option allows you to override the default shell

 

171

            command that the server will use to check if the client is

 

172

            still up.  Any output of the command will be ignored, only

 

173

            the exit code is checked:  If the exit code of the command

 

174

            is zero, the client is considered up.  The command will be

 

175

            run using <quote><command><filename>/bin/sh</filename>

181

176

            <option>-c</option></command></quote>, so

182

177

            <varname>PATH</varname> will be searched.  The default

183

178

            value for the checker command is <quote><literal

184

179

            ><command>fping</command> <option>-q</option> <option

185

 

            >--</option> %%(host)s</literal></quote>.  Note that

186

 

            <command>mandos-keygen</command>, when generating output

187

 

            to be inserted into this file, normally looks for an SSH

188

 

            server on the Mandos client, and, if it find one, outputs

189

 

            a <option>checker</option> option to check for the

190

 

            client’s key fingerprint – this is more secure against

191

 

            spoofing.

 

180

            >--</option> %%(host)s</literal></quote>.

192

181

          </para>

193

182

          <para>

194

183

            In addition to normal start time expansion, this option

231

220

          <para>

232

221

            This option sets the OpenPGP fingerprint that identifies

233

222

            the public key that clients authenticate themselves with

234

 

            through TLS.  The string needs to be in hexadecimal form,

 

223

            through TLS.  The string needs to be in hexidecimal form,

235

224

            but spaces or upper/lower case are not significant.

236

225

          </para>

237

226

        </listitem>

346

335

            <option>extended_timeout</option> option.

347

336

          </para>

348

337

          <para>

349

 

            The <replaceable>TIME</replaceable> is specified as an RFC

350

 

            3339 duration; for example

351

 

            <quote><literal>P1Y2M3DT4H5M6S</literal></quote> meaning

352

 

            one year, two months, three days, four hours, five

353

 

            minutes, and six seconds.  Some values can be omitted, see

354

 

            RFC 3339 Appendix A for details.

 

338

            The <replaceable>TIME</replaceable> is specified as a

 

339

            space-separated number of values, each of which is a

 

340

            number and a one-character suffix.  The suffix must be one

 

341

            of <quote>d</quote>, <quote>s</quote>, <quote>m</quote>,

 

342

            <quote>h</quote>, and <quote>w</quote> for days, seconds,

 

343

            minutes, hours, and weeks, respectively.  The values are

 

344

            added together to give the total time value, so all of

 

345

            <quote><literal>330s</literal></quote>,

 

346

            <quote><literal>110s 110s 110s</literal></quote>, and

 

347

            <quote><literal>5m 30s</literal></quote> will give a value

 

348

            of five minutes and thirty seconds.

355

349

          </para>

356

350

        </listitem>

357

351

      </varlistentry>

415

409

        <quote><literal>approval_duration</literal></quote>,

416

410

        <quote><literal>created</literal></quote>,

417

411

        <quote><literal>enabled</literal></quote>,

418

 

        <quote><literal>expires</literal></quote>,

419

412

        <quote><literal>fingerprint</literal></quote>,

420

413

        <quote><literal>host</literal></quote>,

421

414

        <quote><literal>interval</literal></quote>,

464

457

      <literal>%(<replaceable>foo</replaceable>)s</literal> is

465

458

      obscure.

466

459

    </para>

467

 

    <xi:include href="bugs.xml"/>

468

460

  </refsect1>

469

461

  

470

462

  <refsect1 id="example">

472

464

    <informalexample>

473

465

      <programlisting>

474

466

[DEFAULT]

475

 

timeout = PT5M

476

 

interval = PT2M

 

467

timeout = 5m

 

468

interval = 2m

477

469

checker = fping -q -- %%(host)s

478

470

 

479

471

# Client "foo"

496

488

        4T2zw4dxS5NswXWU0sVEXxjs6PYxuIiCTL7vdpx8QjBkrPWDrAbcMyBr2O

497

489

        QlnHIvPzEArRQLo=

498

490

host = foo.example.org

499

 

interval = PT1M

 

491

interval = 1m

500

492

 

501

493

# Client "bar"

502

494

[bar]

503

495

fingerprint = 3e393aeaefb84c7e89e2f547b3a107558fca3a27

504

496

secfile = /etc/mandos/bar-secret

505

 

timeout = PT15M

 

497

timeout = 15m

506

498

approved_by_default = False

507

 

approval_delay = PT30S

 

499

approval_delay = 30s

508

500

      </programlisting>

509

501

    </informalexample>

510

502

  </refsect1>

519

511

      <citerefentry><refentrytitle>mandos.conf</refentrytitle>

520

512

      <manvolnum>5</manvolnum></citerefentry>,

521

513

      <citerefentry><refentrytitle>mandos</refentrytitle>

522

 

      <manvolnum>8</manvolnum></citerefentry>,

523

 

      <citerefentry><refentrytitle>fping</refentrytitle>

524

514

      <manvolnum>8</manvolnum></citerefentry>

525

515

    </para>

526

 

    <variablelist>

527

 

      <varlistentry>

528

 

        <term>

529

 

          RFC 3339: <citetitle>Date and Time on the Internet:

530

 

          Timestamps</citetitle>

531

 

        </term>

532

 

      <listitem>

533

 

        <para>

534

 

          The time intervals are in the "duration" format, as

535

 

          specified in ABNF in Appendix A of RFC 3339.

536

 

        </para>

537

 

      </listitem>

538

 

      </varlistentry>

539

 

    </variablelist>

540

516

  </refsect1>

541

517

</refentry>

542

518

<!-- Local Variables: -->

• Older »

Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0