/etc/mandos/clients.conf"> ]> &CONFNAME; &VERSION; Björn Påhlsson

belorn@fukt.bsnet.se

Teddy Hogeborn

teddy@fukt.bsnet.se

2008 Teddy Hogeborn Björn Påhlsson This manual page is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This manual page is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; If not, see . &CONFNAME; 5 &CONFNAME; Configuration file for the Mandos server &CONFPATH; The file &CONFPATH; is the configuration file for mandos 8, read by it at startup, where each client that will be able to use the service needs to be listed. All clients listed will be regarded as valid, even if a client was declared invalid in a previous run of the server. The format starts with a section under [] which is either [DEFAULT] or [client name]. Following the section is any number of option=value entries, with continuations in the style of RFC 822. option: value is also accepted. Note that leading whitespace is removed from values. Values can contain format strings which refer to other values in the same section, or values in the DEFAULT section. Lines beginning with # or ; are ignored and may be used to provide comments. The possible options are: timeout timeout = TIME The timeout is how long the server will wait for a successful checker run until a client is considered invalid - that is, ineligible to get the data this server holds. By default Mandos will use 1 hour. The TIME is specified as a space-separated number of values, each of which is a number and a one-character suffix. The suffix must be one of d, s, m, h, and w for days, seconds, minutes, hours, and weeks, respectively. The values are added together to give the total time value, so all of 330s, 110s 110s 110s, and 5m 30s will give a value of five minutes and thirty seconds. interval interval = TIME How often to run the checker to confirm that a client is still up. Note: a new checker will not be started if an old one is still running. The server will wait for a checker to complete until the above timeout occurs, at which time the client will be marked invalid, and any running checker killed. The default interval is 5 minutes. The format of TIME is the same as for timeout above. checker This option allows you to override the default shell command that the server will use to check up if the client is still up. By default mandos will "fping -q -- %%(host)s" fingerprint This option sets the openpgp fingerprint that identifies the public certificate that clients authenticates themself through gnutls. The string need to be in hex-decimal form. secret Base 64 encoded OpenPGP encrypted password encrypted by the clients openpgp certificate. secfile Base 64 encoded OpenPGP encrypted password encrypted by the clients openpgp certificate as a binary file. host Host name that can be used in for checking that the client is up. checker Shell command that the server will use to check up if a client is still up. timeout Duration that a client can be down whitout be removed from the client list. There are two forms of expansion: Start time expansion and runtime expansion. Any string in an option value of the form %(foo)s will be replaced by the value of the option foo either in the same section, or, if it does not exist there, the [DEFAULT] section. This is done at start time, when the configuration file is read. Note that this means that, in order to include an actual percent character (%) in an option value, two percent characters in a row (%%) must be entered. This is currently only done for the checker option. Any string in an option value of the form %%(foo)s will be replaced by the value of the attribute foo of the internal Client object. See the source code for details, and let the authors know of any attributes that are useful so they may be preserved to any new versions of this software. Note that this means that, in order to include an actual percent character (%) in a checker options, four percent characters in a row (%%%%) must be entered. Also, a bad format here will lead to an immediate but silent run-time fatal exit; debug mode is needed to track down an error of this kind. The file described here is &CONFPATH; The format for specifying times for timeout and interval is not very good. The difference between %%(foo)s and %(foo)s is obscure. [DEFAULT] timeout = 1h interval = 5m checker = fping -q -- %%(host)s # Client "foo" [foo] fingerprint = 7788 2722 5BA7 DE53 9C5A 7CFA 59CF F7CD BD9A 5920 secret = hQIOA6QdEjBs2L/HEAf/TCyrDe5Xnm9esa+Pb/vWF9CUqfn4srzVgSu234 REJMVv7lBSrPE2132Lmd2gqF1HeLKDJRSVxJpt6xoWOChGHg+TMyXDxK+N Xl89vGvdU1XfhKkVm9MDLOgT5ECDPysDGHFPDhqHOSu3Kaw2DWMV/iH9vz 3Z20erVNbdcvyBnuojcoWO/6yfB5EQO0BXp7kcyy00USA3CjD5FGZdoQGI Tb8A/ar0tVA5crSQmaSotm6KmNLhrFnZ5BxX+TiE+eTUTqSloWRY6VAvqW QHC7OASxK5E6RXPBuFH5IohUA2Qbk5AHt99pYvsIPX88j2rWauOokoiKZo t/9leJ8VxO5l3wf/U64IH8bkPIoWmWZfd/nqh4uwGNbCgKMyT+AnvH7kMJ 3i7DivfWl2mKLV0PyPHUNva0VQxX6yYjcOhj1R6fCr/at8/NSLe2OhLchz dC+Ls9h+kvJXgF8Sisv+Wk/1RadPLFmraRlqvJwt6Ww21LpiXqXHV2mIgq WnR98YgSvUi3TJHrUQiNc9YyBzuRo0AjgG2C9qiE3FM+Y28+iQ/sR3+bFs zYuZKVTObqiIslwXu7imO0cvvFRgJF/6u3HNFQ4LUTGhiM3FQmC6NNlF3/ vJM2hwRDMcJqDd54Twx90Wh+tYz0z7QMsK4ANXWHHWHR0JchnLWmenzbtW 5MHdW9AYsNJZAQSOpirE4Xi31CSlWAi9KV+cUCmWF5zOFy1x23P6PjdaRm 4T2zw4dxS5NswXWU0sVEXxjs6PYxuIiCTL7vdpx8QjBkrPWDrAbcMyBr2O QlnHIvPzEArRQLo= =iHhv host = foo.example.org interval = 5m # Client "bar" [bar] fingerprint = 3e393aeaefb84c7e89e2f547b3a107558fca3a27 secfile = /etc/mandos/bar-secret.txt.asc