/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-clients.conf.xml

  • Committer: Teddy Hogeborn
  • Date: 2014-05-12 13:14:57 UTC
  • mfrom: (237.4.43 release)
  • Revision ID: teddy@recompile.se-20140512131457-yupek8sqkke2ini8
Merge from release branch.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-clients.conf.xml
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY CONFNAME "mandos-clients.conf">
5
5
<!ENTITY CONFPATH "<filename>/etc/mandos/clients.conf</filename>">
6
 
<!ENTITY TIMESTAMP "2012-01-01">
 
6
<!ENTITY TIMESTAMP "2013-10-15">
7
7
<!ENTITY % common SYSTEM "common.ent">
8
8
%common;
9
9
]>
66
66
      ><refentrytitle>mandos</refentrytitle>
67
67
      <manvolnum>8</manvolnum></citerefentry>, read by it at startup.
68
68
      The file needs to list all clients that should be able to use
69
 
      the service.  All clients listed will be regarded as enabled,
70
 
      even if a client was disabled in a previous run of the server.
 
69
      the service.  The settings in this file can be overridden by
 
70
      runtime changes to the server, which it saves across restarts.
 
71
      (See the section called <quote>PERSISTENT STATE</quote> in
 
72
      <citerefentry><refentrytitle>mandos</refentrytitle><manvolnum
 
73
      >8</manvolnum></citerefentry>.)  However, any <emphasis
 
74
      >changes</emphasis> to this file (including adding and removing
 
75
      clients) will, at startup, override changes done during runtime.
71
76
    </para>
72
77
    <para>
73
78
      The format starts with a <literal>[<replaceable>section
112
117
          <para>
113
118
            How long to wait for external approval before resorting to
114
119
            use the <option>approved_by_default</option> value.  The
115
 
            default is <quote>0s</quote>, i.e. not to wait.
 
120
            default is <quote>PT0S</quote>, i.e. not to wait.
116
121
          </para>
117
122
          <para>
118
123
            The format of <replaceable>TIME</replaceable> is the same
162
167
            This option is <emphasis>optional</emphasis>.
163
168
          </para>
164
169
          <para>
165
 
            This option allows you to override the default shell
166
 
            command that the server will use to check if the client is
167
 
            still up.  Any output of the command will be ignored, only
168
 
            the exit code is checked:  If the exit code of the command
169
 
            is zero, the client is considered up.  The command will be
170
 
            run using <quote><command><filename>/bin/sh</filename>
 
170
            This option overrides the default shell command that the
 
171
            server will use to check if the client is still up.  Any
 
172
            output of the command will be ignored, only the exit code
 
173
            is checked:  If the exit code of the command is zero, the
 
174
            client is considered up.  The command will be run using
 
175
            <quote><command><filename>/bin/sh</filename>
171
176
            <option>-c</option></command></quote>, so
172
177
            <varname>PATH</varname> will be searched.  The default
173
178
            value for the checker command is <quote><literal
330
335
            <option>extended_timeout</option> option.
331
336
          </para>
332
337
          <para>
333
 
            The <replaceable>TIME</replaceable> is specified as a
334
 
            space-separated number of values, each of which is a
335
 
            number and a one-character suffix.  The suffix must be one
336
 
            of <quote>d</quote>, <quote>s</quote>, <quote>m</quote>,
337
 
            <quote>h</quote>, and <quote>w</quote> for days, seconds,
338
 
            minutes, hours, and weeks, respectively.  The values are
339
 
            added together to give the total time value, so all of
340
 
            <quote><literal>330s</literal></quote>,
341
 
            <quote><literal>110s 110s 110s</literal></quote>, and
342
 
            <quote><literal>5m 30s</literal></quote> will give a value
343
 
            of five minutes and thirty seconds.
 
338
            The <replaceable>TIME</replaceable> is specified as an RFC
 
339
            3339 duration; for example
 
340
            <quote><literal>P1Y2M3DT4H5M6S</literal></quote> meaning
 
341
            one year, two months, three days, four hours, five
 
342
            minutes, and six seconds.  Some values can be omitted, see
 
343
            RFC 3339 Appendix A for details.
344
344
          </para>
345
345
        </listitem>
346
346
      </varlistentry>
404
404
        <quote><literal>approval_duration</literal></quote>,
405
405
        <quote><literal>created</literal></quote>,
406
406
        <quote><literal>enabled</literal></quote>,
 
407
        <quote><literal>expires</literal></quote>,
407
408
        <quote><literal>fingerprint</literal></quote>,
408
409
        <quote><literal>host</literal></quote>,
409
410
        <quote><literal>interval</literal></quote>,
459
460
    <informalexample>
460
461
      <programlisting>
461
462
[DEFAULT]
462
 
timeout = 5m
463
 
interval = 2m
 
463
timeout = PT5M
 
464
interval = PT2M
464
465
checker = fping -q -- %%(host)s
465
466
 
466
467
# Client "foo"
483
484
        4T2zw4dxS5NswXWU0sVEXxjs6PYxuIiCTL7vdpx8QjBkrPWDrAbcMyBr2O
484
485
        QlnHIvPzEArRQLo=
485
486
host = foo.example.org
486
 
interval = 1m
 
487
interval = PT1M
487
488
 
488
489
# Client "bar"
489
490
[bar]
490
491
fingerprint = 3e393aeaefb84c7e89e2f547b3a107558fca3a27
491
492
secfile = /etc/mandos/bar-secret
492
 
timeout = 15m
 
493
timeout = PT15M
493
494
approved_by_default = False
494
 
approval_delay = 30s
 
495
approval_delay = PT30S
495
496
      </programlisting>
496
497
    </informalexample>
497
498
  </refsect1>
506
507
      <citerefentry><refentrytitle>mandos.conf</refentrytitle>
507
508
      <manvolnum>5</manvolnum></citerefentry>,
508
509
      <citerefentry><refentrytitle>mandos</refentrytitle>
 
510
      <manvolnum>8</manvolnum></citerefentry>,
 
511
      <citerefentry><refentrytitle>fping</refentrytitle>
509
512
      <manvolnum>8</manvolnum></citerefentry>
510
513
    </para>
 
514
    <variablelist>
 
515
      <varlistentry>
 
516
        <term>
 
517
          RFC 3339: <citetitle>Date and Time on the Internet:
 
518
          Timestamps</citetitle>
 
519
        </term>
 
520
      <listitem>
 
521
        <para>
 
522
          The time intervals are in the "duration" format, as
 
523
          specified in ABNF in Appendix A of RFC 3339.
 
524
        </para>
 
525
      </listitem>
 
526
      </varlistentry>
 
527
    </variablelist>
511
528
  </refsect1>
512
529
</refentry>
513
530
<!-- Local Variables: -->