/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-clients.conf.xml

• browse files at revision 904
• compare with another revision
• download diff
• download tarball
• view history from revision 904

• reverse the comparison (904 to 567)
• stop comparing with revision 567

Show diffs side-by-side

added

removed

mandos-clients.conf.xml

3

3

        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

4

4

<!ENTITY CONFNAME "mandos-clients.conf">

5

5

<!ENTITY CONFPATH "<filename>/etc/mandos/clients.conf</filename>">

6

 

<!ENTITY TIMESTAMP "2012-01-01">

 

6

<!ENTITY TIMESTAMP "2017-02-23">

7

7

<!ENTITY % common SYSTEM "common.ent">

8

8

%common;

9

9

]>

37

37

      <year>2010</year>

38

38

      <year>2011</year>

39

39

      <year>2012</year>

 

40

      <year>2013</year>

 

41

      <year>2014</year>

 

42

      <year>2015</year>

 

43

      <year>2016</year>

 

44

      <year>2017</year>

40

45

      <holder>Teddy Hogeborn</holder>

41

46

      <holder>Björn Påhlsson</holder>

42

47

    </copyright>

117

122

          <para>

118

123

            How long to wait for external approval before resorting to

119

124

            use the <option>approved_by_default</option> value.  The

120

 

            default is <quote>0s</quote>, i.e. not to wait.

 

125

            default is <quote>PT0S</quote>, i.e. not to wait.

121

126

          </para>

122

127

          <para>

123

128

            The format of <replaceable>TIME</replaceable> is the same

167

172

            This option is <emphasis>optional</emphasis>.

168

173

          </para>

169

174

          <para>

170

 

            This option allows you to override the default shell

171

 

            command that the server will use to check if the client is

172

 

            still up.  Any output of the command will be ignored, only

173

 

            the exit code is checked:  If the exit code of the command

174

 

            is zero, the client is considered up.  The command will be

175

 

            run using <quote><command><filename>/bin/sh</filename>

 

175

            This option overrides the default shell command that the

 

176

            server will use to check if the client is still up.  Any

 

177

            output of the command will be ignored, only the exit code

 

178

            is checked:  If the exit code of the command is zero, the

 

179

            client is considered up.  The command will be run using

 

180

            <quote><command><filename>/bin/sh</filename>

176

181

            <option>-c</option></command></quote>, so

177

182

            <varname>PATH</varname> will be searched.  The default

178

183

            value for the checker command is <quote><literal

179

184

            ><command>fping</command> <option>-q</option> <option

180

 

            >--</option> %%(host)s</literal></quote>.

 

185

            >--</option> %%(host)s</literal></quote>.  Note that

 

186

            <command>mandos-keygen</command>, when generating output

 

187

            to be inserted into this file, normally looks for an SSH

 

188

            server on the Mandos client, and, if it find one, outputs

 

189

            a <option>checker</option> option to check for the

 

190

            client’s key fingerprint – this is more secure against

 

191

            spoofing.

181

192

          </para>

182

193

          <para>

183

194

            In addition to normal start time expansion, this option

220

231

          <para>

221

232

            This option sets the OpenPGP fingerprint that identifies

222

233

            the public key that clients authenticate themselves with

223

 

            through TLS.  The string needs to be in hexidecimal form,

 

234

            through TLS.  The string needs to be in hexadecimal form,

224

235

            but spaces or upper/lower case are not significant.

225

236

          </para>

226

237

        </listitem>

335

346

            <option>extended_timeout</option> option.

336

347

          </para>

337

348

          <para>

338

 

            The <replaceable>TIME</replaceable> is specified as a

339

 

            space-separated number of values, each of which is a

340

 

            number and a one-character suffix.  The suffix must be one

341

 

            of <quote>d</quote>, <quote>s</quote>, <quote>m</quote>,

342

 

            <quote>h</quote>, and <quote>w</quote> for days, seconds,

343

 

            minutes, hours, and weeks, respectively.  The values are

344

 

            added together to give the total time value, so all of

345

 

            <quote><literal>330s</literal></quote>,

346

 

            <quote><literal>110s 110s 110s</literal></quote>, and

347

 

            <quote><literal>5m 30s</literal></quote> will give a value

348

 

            of five minutes and thirty seconds.

 

349

            The <replaceable>TIME</replaceable> is specified as an RFC

 

350

            3339 duration; for example

 

351

            <quote><literal>P1Y2M3DT4H5M6S</literal></quote> meaning

 

352

            one year, two months, three days, four hours, five

 

353

            minutes, and six seconds.  Some values can be omitted, see

 

354

            RFC 3339 Appendix A for details.

349

355

          </para>

350

356

        </listitem>

351

357

      </varlistentry>

409

415

        <quote><literal>approval_duration</literal></quote>,

410

416

        <quote><literal>created</literal></quote>,

411

417

        <quote><literal>enabled</literal></quote>,

 

418

        <quote><literal>expires</literal></quote>,

412

419

        <quote><literal>fingerprint</literal></quote>,

413

420

        <quote><literal>host</literal></quote>,

414

421

        <quote><literal>interval</literal></quote>,

457

464

      <literal>%(<replaceable>foo</replaceable>)s</literal> is

458

465

      obscure.

459

466

    </para>

 

467

    <xi:include href="bugs.xml"/>

460

468

  </refsect1>

461

469

  

462

470

  <refsect1 id="example">

464

472

    <informalexample>

465

473

      <programlisting>

466

474

[DEFAULT]

467

 

timeout = 5m

468

 

interval = 2m

 

475

timeout = PT5M

 

476

interval = PT2M

469

477

checker = fping -q -- %%(host)s

470

478

 

471

479

# Client "foo"

488

496

        4T2zw4dxS5NswXWU0sVEXxjs6PYxuIiCTL7vdpx8QjBkrPWDrAbcMyBr2O

489

497

        QlnHIvPzEArRQLo=

490

498

host = foo.example.org

491

 

interval = 1m

 

499

interval = PT1M

492

500

 

493

501

# Client "bar"

494

502

[bar]

495

503

fingerprint = 3e393aeaefb84c7e89e2f547b3a107558fca3a27

496

504

secfile = /etc/mandos/bar-secret

497

 

timeout = 15m

 

505

timeout = PT15M

498

506

approved_by_default = False

499

 

approval_delay = 30s

 

507

approval_delay = PT30S

500

508

      </programlisting>

501

509

    </informalexample>

502

510

  </refsect1>

511

519

      <citerefentry><refentrytitle>mandos.conf</refentrytitle>

512

520

      <manvolnum>5</manvolnum></citerefentry>,

513

521

      <citerefentry><refentrytitle>mandos</refentrytitle>

 

522

      <manvolnum>8</manvolnum></citerefentry>,

 

523

      <citerefentry><refentrytitle>fping</refentrytitle>

514

524

      <manvolnum>8</manvolnum></citerefentry>

515

525

    </para>

 

526

    <variablelist>

 

527

      <varlistentry>

 

528

        <term>

 

529

          RFC 3339: <citetitle>Date and Time on the Internet:

 

530

          Timestamps</citetitle>

 

531

        </term>

 

532

      <listitem>

 

533

        <para>

 

534

          The time intervals are in the "duration" format, as

 

535

          specified in ABNF in Appendix A of RFC 3339.

 

536

        </para>

 

537

      </listitem>

 

538

      </varlistentry>

 

539

    </variablelist>

516

540

  </refsect1>

517

541

</refentry>

518

542

<!-- Local Variables: -->

• Older »

Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0