57
68
<refname><filename>&CONFNAME;</filename></refname>
59
Configuration file for the Mandos server
70
Configuration file for Mandos clients
64
<synopsis>&CONFPATH;</synopsis>
67
80
<refsect1 id="description">
68
81
<title>DESCRIPTION</title>
70
The file &CONFPATH; is a configuration file for <citerefentry
71
><refentrytitle>mandos</refentrytitle>
72
<manvolnum>8</manvolnum></citerefentry>, read by it at startup.
73
The file needs to list all clients that should be able to use
74
the service. The settings in this file can be overridden by
75
runtime changes to the server, which it saves across restarts.
76
(See the section called <quote>PERSISTENT STATE</quote> in
77
<citerefentry><refentrytitle>mandos</refentrytitle><manvolnum
78
>8</manvolnum></citerefentry>.) However, any <emphasis
79
>changes</emphasis> to this file (including adding and removing
80
clients) will, at startup, override changes done during runtime.
83
The format starts with a <literal>[<replaceable>section
84
header</replaceable>]</literal> which is either
85
<literal>[DEFAULT]</literal> or <literal>[<replaceable>client
86
name</replaceable>]</literal>. The <replaceable>client
87
name</replaceable> can be anything, and is not tied to a host
88
name. Following the section header is any number of
89
<quote><varname><replaceable>option</replaceable
90
></varname>=<replaceable>value</replaceable></quote> entries,
91
with continuations in the style of RFC 822. <quote><varname
92
><replaceable>option</replaceable></varname>: <replaceable
93
>value</replaceable></quote> is also accepted. Note that
94
leading whitespace is removed from values. Values can contain
95
format strings which refer to other values in the same section,
96
or values in the <quote>DEFAULT</quote> section (see <xref
97
linkend="expansion"/>). Lines beginning with <quote>#</quote>
98
or <quote>;</quote> are ignored and may be used to provide
103
<refsect1 id="options">
104
<title>OPTIONS</title>
106
<emphasis>Note:</emphasis> all option values are subject to
107
start time expansion, see <xref linkend="expansion"/>.
110
Unknown options are ignored. The used options are as follows:
116
<term><option>approval_delay<literal> = </literal><replaceable
117
>TIME</replaceable></option></term>
120
This option is <emphasis>optional</emphasis>.
123
How long to wait for external approval before resorting to
124
use the <option>approved_by_default</option> value. The
125
default is <quote>PT0S</quote>, i.e. not to wait.
128
The format of <replaceable>TIME</replaceable> is the same
129
as for <varname>timeout</varname> below.
135
<term><option>approval_duration<literal> = </literal
136
><replaceable>TIME</replaceable></option></term>
139
This option is <emphasis>optional</emphasis>.
142
How long an external approval lasts. The default is 1
146
The format of <replaceable>TIME</replaceable> is the same
147
as for <varname>timeout</varname> below.
153
<term><option>approved_by_default<literal> = </literal
154
>{ <literal >1</literal> | <literal>yes</literal> | <literal
155
>true</literal> | <literal>on</literal> | <literal
156
>0</literal> | <literal>no</literal> | <literal
157
>false</literal> | <literal>off</literal> }</option></term>
160
Whether to approve a client by default after
161
the <option>approval_delay</option>. The default
162
is <quote>True</quote>.
168
<term><option>checker<literal> = </literal><replaceable
169
>COMMAND</replaceable></option></term>
172
This option is <emphasis>optional</emphasis>.
175
This option overrides the default shell command that the
176
server will use to check if the client is still up. Any
177
output of the command will be ignored, only the exit code
178
is checked: If the exit code of the command is zero, the
179
client is considered up. The command will be run using
180
<quote><command><filename>/bin/sh</filename>
181
<option>-c</option></command></quote>, so
182
<varname>PATH</varname> will be searched. The default
183
value for the checker command is <quote><literal
184
><command>fping</command> <option>-q</option> <option
185
>--</option> %%(host)s</literal></quote>. Note that
186
<command>mandos-keygen</command>, when generating output
187
to be inserted into this file, normally looks for an SSH
188
server on the Mandos client, and, if it find one, outputs
189
a <option>checker</option> option to check for the
190
client’s key fingerprint – this is more secure against
194
In addition to normal start time expansion, this option
195
will also be subject to runtime expansion; see <xref
196
linkend="expansion"/>.
202
<term><option>extended_timeout<literal> = </literal><replaceable
203
>TIME</replaceable></option></term>
206
This option is <emphasis>optional</emphasis>.
209
Extended timeout is an added timeout that is given once
210
after a password has been sent successfully to a client.
211
The timeout is by default longer than the normal timeout,
212
and is used for handling the extra long downtime while a
213
machine is booting up. Time to take into consideration
214
when changing this value is file system checks and quota
215
checks. The default value is 15 minutes.
218
The format of <replaceable>TIME</replaceable> is the same
219
as for <varname>timeout</varname> below.
225
<term><option>fingerprint<literal> = </literal
226
><replaceable>HEXSTRING</replaceable></option></term>
229
This option is <emphasis>required</emphasis>.
232
This option sets the OpenPGP fingerprint that identifies
233
the public key that clients authenticate themselves with
234
through TLS. The string needs to be in hexadecimal form,
235
but spaces or upper/lower case are not significant.
241
<term><option><literal>host = </literal><replaceable
242
>STRING</replaceable></option></term>
245
This option is <emphasis>optional</emphasis>, but highly
246
<emphasis>recommended</emphasis> unless the
247
<option>checker</option> option is modified to a
248
non-standard value without <quote>%%(host)s</quote> in it.
251
Host name for this client. This is not used by the server
252
directly, but can be, and is by default, used by the
253
checker. See the <option>checker</option> option.
259
<term><option>interval<literal> = </literal><replaceable
260
>TIME</replaceable></option></term>
263
This option is <emphasis>optional</emphasis>.
266
How often to run the checker to confirm that a client is
267
still up. <emphasis>Note:</emphasis> a new checker will
268
not be started if an old one is still running. The server
269
will wait for a checker to complete until the below
270
<quote><varname>timeout</varname></quote> occurs, at which
271
time the client will be disabled, and any running checker
272
killed. The default interval is 2 minutes.
275
The format of <replaceable>TIME</replaceable> is the same
276
as for <varname>timeout</varname> below.
282
<term><option>secfile<literal> = </literal><replaceable
283
>FILENAME</replaceable></option></term>
286
This option is only used if <option>secret</option> is not
287
specified, in which case this option is
288
<emphasis>required</emphasis>.
291
Similar to the <option>secret</option>, except the secret
292
data is in an external file. The contents of the file
293
should <emphasis>not</emphasis> be base64-encoded, but
294
will be sent to clients verbatim.
297
File names of the form <filename>~user/foo/bar</filename>
298
and <filename>$<envar>ENVVAR</envar>/foo/bar</filename>
305
<term><option>secret<literal> = </literal><replaceable
306
>BASE64_ENCODED_DATA</replaceable></option></term>
309
If this option is not specified, the <option
310
>secfile</option> option is <emphasis>required</emphasis>
314
If present, this option must be set to a string of
315
base64-encoded binary data. It will be decoded and sent
316
to the client matching the above
317
<option>fingerprint</option>. This should, of course, be
318
OpenPGP encrypted data, decryptable only by the client.
319
The program <citerefentry><refentrytitle><command
320
>mandos-keygen</command></refentrytitle><manvolnum
321
>8</manvolnum></citerefentry> can, using its
322
<option>--password</option> option, be used to generate
326
Note: this value of this option will probably be very
327
long. A useful feature to avoid having unreadably-long
328
lines is that a line beginning with white space adds to
329
the value of the previous line, RFC 822-style.
335
<term><option>timeout<literal> = </literal><replaceable
336
>TIME</replaceable></option></term>
339
This option is <emphasis>optional</emphasis>.
342
The timeout is how long the server will wait, after a
343
successful checker run, until a client is disabled and not
344
allowed to get the data this server holds. By default
345
Mandos will use 5 minutes. See also the
346
<option>extended_timeout</option> option.
349
The <replaceable>TIME</replaceable> is specified as an RFC
350
3339 duration; for example
351
<quote><literal>P1Y2M3DT4H5M6S</literal></quote> meaning
352
one year, two months, three days, four hours, five
353
minutes, and six seconds. Some values can be omitted, see
354
RFC 3339 Appendix A for details.
360
<term><option>enabled<literal> = </literal>{ <literal
361
>1</literal> | <literal>yes</literal> | <literal>true</literal
362
> | <literal >on</literal> | <literal>0</literal> | <literal
363
>no</literal> | <literal>false</literal> | <literal
364
>off</literal> }</option></term>
367
Whether this client should be enabled by default. The
368
default is <quote>true</quote>.
376
<refsect1 id="expansion">
377
<title>EXPANSION</title>
379
There are two forms of expansion: Start time expansion and
382
<refsect2 id="start_time_expansion">
383
<title>START TIME EXPANSION</title>
385
Any string in an option value of the form
386
<quote><literal>%(<replaceable>foo</replaceable>)s</literal
387
></quote> will be replaced by the value of the option
388
<varname>foo</varname> either in the same section, or, if it
389
does not exist there, the <literal>[DEFAULT]</literal>
390
section. This is done at start time, when the configuration
394
Note that this means that, in order to include an actual
395
percent character (<quote>%</quote>) in an option value, two
396
percent characters in a row (<quote>%%</quote>) must be
400
<refsect2 id="runtime_expansion">
401
<title>RUNTIME EXPANSION</title>
403
This is currently only done for the <varname>checker</varname>
407
Any string in an option value of the form
408
<quote><literal>%%(<replaceable>foo</replaceable>)s</literal
409
></quote> will be replaced by the value of the attribute
410
<varname>foo</varname> of the internal
411
<quote><classname>Client</classname></quote> object in the
412
Mandos server. The currently allowed values for
413
<replaceable>foo</replaceable> are:
414
<quote><literal>approval_delay</literal></quote>,
415
<quote><literal>approval_duration</literal></quote>,
416
<quote><literal>created</literal></quote>,
417
<quote><literal>enabled</literal></quote>,
418
<quote><literal>expires</literal></quote>,
419
<quote><literal>fingerprint</literal></quote>,
420
<quote><literal>host</literal></quote>,
421
<quote><literal>interval</literal></quote>,
422
<quote><literal>last_approval_request</literal></quote>,
423
<quote><literal>last_checked_ok</literal></quote>,
424
<quote><literal>last_enabled</literal></quote>,
425
<quote><literal>name</literal></quote>,
426
<quote><literal>timeout</literal></quote>, and, if using
427
D-Bus, <quote><literal>dbus_object_path</literal></quote>.
428
See the source code for details. <emphasis role="strong"
429
>Currently, <emphasis>none</emphasis> of these attributes
430
except <quote><literal>host</literal></quote> are guaranteed
431
to be valid in future versions.</emphasis> Therefore, please
432
let the authors know of any attributes that are useful so they
433
may be preserved to any new versions of this software.
436
Note that this means that, in order to include an actual
437
percent character (<quote>%</quote>) in a
438
<varname>checker</varname> option, <emphasis>four</emphasis>
439
percent characters in a row (<quote>%%%%</quote>) must be
440
entered. Also, a bad format here will lead to an immediate
441
but <emphasis>silent</emphasis> run-time fatal exit; debug
442
mode is needed to expose an error of this kind.
448
<refsect1 id="files">
451
The file described here is &CONFPATH;
458
The format for specifying times for <varname>timeout</varname>
459
and <varname>interval</varname> is not very good.
462
The difference between
463
<literal>%%(<replaceable>foo</replaceable>)s</literal> and
464
<literal>%(<replaceable>foo</replaceable>)s</literal> is
467
<xi:include href="bugs.xml"/>
470
<refsect1 id="example">
471
<title>EXAMPLE</title>
83
The file &CONFPATH; is the configuration file for mandos where
84
each client that will be abel to use the service need to be
85
specified. The configuration file is looked on at the startup of
86
the service, so to reenable timedout clients one need to only
87
restart the server. The format starts with a section under []
88
which is eather <literal>[DEFAULT]</literal> or a client
89
name. Values is set through the use of VAR = VALUE pair. Values
94
<refsect1 id="default">
95
<title>DEFAULTS</title>
97
The paramters for <literal>[DEFAULT]</literal> are:
103
<term><literal>timeout</literal></term>
106
This option allows you to override the default timeout
107
that clients will get. By default mandos will use 1hr.
113
<term><literal>interval</literal></term>
116
This option allows you to override the default interval
117
used between checkups for disconnected clients. By default
124
<term><literal>checker</literal></term>
127
This option allows you to override the default shell
128
command that the server will use to check up if the client
129
is still up. By default mandos will "fping -q -- %%(host)s"
137
<refsect1 id="clients">
138
<title>CLIENTS</title>
140
The paramters for clients are:
146
<term><literal>fingerprint</literal></term>
149
This option sets the openpgp fingerprint that identifies
150
the public certificate that clients authenticates themself
151
through gnutls. The string need to be in hex-decimal form.
157
<term><literal>secret</literal></term>
160
Base 64 encoded OpenPGP encrypted password encrypted by
161
the clients openpgp certificate.
167
<term><literal>secfile</literal></term>
170
Base 64 encoded OpenPGP encrypted password encrypted by
171
the clients openpgp certificate as a binary file.
177
<term><literal>host</literal></term>
180
Host name that can be used in for checking that the client is up.
186
<term><literal>checker</literal></term>
189
Shell command that the server will use to check up if a
196
<term><literal>timeout</literal></term>
199
Duration that a client can be down whitout be removed from
208
<refsect1 id="examples">
209
<title>EXAMPLES</title>
472
210
<informalexample>
477
215
checker = fping -q -- %%(host)s
481
218
fingerprint = 7788 2722 5BA7 DE53 9C5A 7CFA 59CF F7CD BD9A 5920
483
221
hQIOA6QdEjBs2L/HEAf/TCyrDe5Xnm9esa+Pb/vWF9CUqfn4srzVgSu234
484
222
REJMVv7lBSrPE2132Lmd2gqF1HeLKDJRSVxJpt6xoWOChGHg+TMyXDxK+N