[ViewVC] Diff of: cvs/gvpe/doc/gvpe.conf.5.pod

Comparing gvpe/doc/gvpe.conf.5.pod (file contents):
Revision 1.28 by root, Sun Mar 6 19:40:27 2011 UTC vs.
Revision 1.32 by root, Tue Jul 16 16:44:36 2013 UTC

 is, they are in some sense node-specific (config files can set different
 values on different nodes using C<on>), but will affect the behaviour of
 the gvpe daemon and all connections it creates.
 =over 4
+=item chroot = path or /
+Tells GVPE to chroot(2) to the specified path after reading all necessary
+files, binding to sockets and running the C<if-up> script, but before
+running C<node-up> or any other scripts.
+The special path F</> instructs GVPE to create (and remove) an empty
+temporary directory to use as new root. This is most secure, but makes it
+impossible to use any scripts other than the C<if-up> one.
+=item chuid = numerical-uid
+=item chgid = numerical-gid
+These two options tell GVPE to change to the given user and/or group id
+after reading all necessary files, binding to sockets and running the
+C<if-up> script.
+Other scripts, such as C<node-up>, are run with the new user id or group id.
+=item chuser = username
+Alternative to C<chuid> and C<chgid>: Sets both C<chuid> and C<chgid>
+to the user and (primary) group ids of the specified user (for example,
+C<nobody>).
 =item dns-forw-host = hostname/ip
 The DNS server to forward DNS requests to for the DNS tunnel protocol
 (default: C<127.0.0.1>, changing it is highly recommended).
 =item keepalive = seconds
 Sets the keepalive probe interval in seconds (default: C<60>). After this
 many seconds of inactivity the daemon will start to send keepalive probe
-every 3 seconds until it receives a reply from the other end.  If no reply
+every 3 seconds until it receives a reply from the other end. If no reply
 is received within 15 seconds, the peer is considered unreachable and the
 connection is closed.
 =item loglevel = noise|trace|debug|info|notice|warn|error|critical
 Recommended values are 1500 (ethernet), 1492 (pppoe), 1472 (pptp).
 This value must be the minimum of the MTU values of all nodes.
+=item nfmark = integer
+This advanced option, when set to a nonzero value (default: C<0>), tries
+to set the netfilter mark (or fwmark) value on all sockets gvpe uses to
+send packets.
+This can be used to make gvpe use a different set of routing rules. For
+example, on GNU/Linux, the C<if-up> could set C<nfmark> to 1000 and then
+put all routing rules into table C<99> and then use an ip rule to make
+gvpe traffic avoid that routing table, in effect routing normal traffic
+via gvpe and gvpe traffic via the normal system routing tables:
+   ip rule add not fwmark 1000 lookup 99
 =item node = nickname
 Not really a config setting but introduces a node section. The nickname is
 used to select the right configuration section and must be passed as an
 argument to the gvpe daemon.
    #!/bin/sh
    {
      echo update delete $DESTNODE.lowttl.example.net. a
      echo update add $DESTNODE.lowttl.example.net. 1 in a $DESTIP
      echo
    } | nsupdate -d -k $CONFBASE:key.example.net.
 =item node-change = relative-or-absolute-path
 Same as C<node-change>, but gets called whenever something about a
 Same as C<node-up>, but gets called whenever a connection is lost.
 =item pid-file = path
 The path to the pid file to check and create
-(default: C<LOCALSTATEDIR/run/gvpe.pid>).
+(default: C<LOCALSTATEDIR/run/gvpe.pid>). The first C<%s> is replaced by
+the nodename - any other use of C<%> must be written as C<%%>.
 =item private-key = relative-path-to-key
 Sets the path (relative to the config directory) to the private key
 (default: C<hostkey>). This is a printf format string so every C<%> must
 private key file should be kept secret per-node to avoid spoofing, it is
 not recommended to use this feature.
 =item rekey = seconds
-Sets the rekeying interval in seconds (default: C<3600>). Connections are
+Sets the rekeying interval in seconds (default: C<3607>). Connections are
 reestablished every C<rekey> seconds, making them use a new encryption
 key.
-=item nfmark = integer
+=item seed-device = path
-This advanced option, when set to a nonzero value (default: C<0>), tries
+The random device used to initially and regularly seed the random
-to set the netfilter mark (or fwmark) value on all sockets gvpe uses to
+number generator (default: F</dev/urandom>). Randomness is of paramount
-send packets.
+importance to the security of the algorithms used in gvpe.
-This can be used to make gvpe use a different set of routing rules. For
+On program start and every seed-interval, gvpe will read 64 octets.
-example, on GNU/Linux, the C<if-up> could set C<nfmark> to 1000 and then
-put all routing rules into table C<99> and then use an ip rule to make
-gvpe traffic avoid that routing table, in effect routing normal traffic
-via gvpe and gvpe traffic via the normal system routing tables:
-   ip rule add not fwmark 1000 lookup 99
+Setting this path to the empty string will disable this functionality
+completely (the underlying crypto library will likely look for entropy
+sources on it's own though, so not all is lost).
+=item seed-interval = seconds
+The number of seconds between reseeds of the random number generator
+(default: C<3613>). A value of C<0> disables this regular reseeding.
 =back
 =head2 NODE SPECIFIC SETTINGS
 If used the node up or node-down scripts.
 =item hostkey
-The private key (taken from C<hostkeys/nodename>) of the current host.
+The (default path of the) private key of the current host.
 =item pubkey/nodename
 The public keys of the other nodes, one file per node.

Diff Legend

-–
+Removed lines
-+
+Added lines
-<
+Changed lines
->
+Changed lines

Comparing gvpe/doc/gvpe.conf.5.pod (file contents): Revision 1.28 by root, Sun Mar 6 19:40:27 2011 UTC vs. Revision 1.32 by root, Tue Jul 16 16:44:36 2013 UTC

Diff Legend

Comparing gvpe/doc/gvpe.conf.5.pod (file contents):
Revision 1.28 by root, Sun Mar 6 19:40:27 2011 UTC vs.
Revision 1.32 by root, Tue Jul 16 16:44:36 2013 UTC