ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/doc/gvpe.conf.5.pod
(Generate patch)

Comparing gvpe/doc/gvpe.conf.5.pod (file contents):
Revision 1.28 by root, Sun Mar 6 19:40:27 2011 UTC vs.
Revision 1.31 by root, Sat Jul 13 04:10:29 2013 UTC

… …
97is, they are in some sense node-specific (config files can set different 97is, they are in some sense node-specific (config files can set different
98values on different nodes using C<on>), but will affect the behaviour of 98values on different nodes using C<on>), but will affect the behaviour of
99the gvpe daemon and all connections it creates. 99the gvpe daemon and all connections it creates.
100 100
101=over 4 101=over 4
102
103=item chroot = path or /
104
105Tells GVPE to chroot(2) to the specified path after reading all necessary
106files, binding to sockets and running the C<if-up> script, but before
107running C<node-up> or any other scripts.
108
109The special path F</> instructs GVPE to create (and remove) an empty
110temporary directory to use as new root. This is most secure, but makes it
111impossible to use any scripts other than the C<if-up> one.
112
113=item chuid = numerical-uid
114
115=item chgid = numerical-gid
116
117These two options tell GVPE to change to the given user and/or group id
118after reading all necessary files, binding to sockets and running the
119C<if-up> script.
120
121Other scripts, such as C<node-up>, are run with the new user id or group id.
122
123=item chuser = username
124
125Alternative to C<chuid> and C<chgid>: Sets both C<chuid> and C<chgid>
126to the user and (primary) group ids of the specified user (for example,
127C<nobody>).
102 128
103=item dns-forw-host = hostname/ip 129=item dns-forw-host = hostname/ip
104 130
105The DNS server to forward DNS requests to for the DNS tunnel protocol 131The DNS server to forward DNS requests to for the DNS tunnel protocol
106(default: C<127.0.0.1>, changing it is highly recommended). 132(default: C<127.0.0.1>, changing it is highly recommended).
… …
324 350
325=item keepalive = seconds 351=item keepalive = seconds
326 352
327Sets the keepalive probe interval in seconds (default: C<60>). After this 353Sets the keepalive probe interval in seconds (default: C<60>). After this
328many seconds of inactivity the daemon will start to send keepalive probe 354many seconds of inactivity the daemon will start to send keepalive probe
329every 3 seconds until it receives a reply from the other end. If no reply 355every 3 seconds until it receives a reply from the other end. If no reply
330is received within 15 seconds, the peer is considered unreachable and the 356is received within 15 seconds, the peer is considered unreachable and the
331connection is closed. 357connection is closed.
332 358
333=item loglevel = noise|trace|debug|info|notice|warn|error|critical 359=item loglevel = noise|trace|debug|info|notice|warn|error|critical
334 360
… …
344 370
345Recommended values are 1500 (ethernet), 1492 (pppoe), 1472 (pptp). 371Recommended values are 1500 (ethernet), 1492 (pppoe), 1472 (pptp).
346 372
347This value must be the minimum of the MTU values of all nodes. 373This value must be the minimum of the MTU values of all nodes.
348 374
375=item nfmark = integer
376
377This advanced option, when set to a nonzero value (default: C<0>), tries
378to set the netfilter mark (or fwmark) value on all sockets gvpe uses to
379send packets.
380
381This can be used to make gvpe use a different set of routing rules. For
382example, on GNU/Linux, the C<if-up> could set C<nfmark> to 1000 and then
383put all routing rules into table C<99> and then use an ip rule to make
384gvpe traffic avoid that routing table, in effect routing normal traffic
385via gvpe and gvpe traffic via the normal system routing tables:
386
387 ip rule add not fwmark 1000 lookup 99
388
349=item node = nickname 389=item node = nickname
350 390
351Not really a config setting but introduces a node section. The nickname is 391Not really a config setting but introduces a node section. The nickname is
352used to select the right configuration section and must be passed as an 392used to select the right configuration section and must be passed as an
353argument to the gvpe daemon. 393argument to the gvpe daemon.
… …
398 438
399 #!/bin/sh 439 #!/bin/sh
400 { 440 {
401 echo update delete $DESTNODE.lowttl.example.net. a 441 echo update delete $DESTNODE.lowttl.example.net. a
402 echo update add $DESTNODE.lowttl.example.net. 1 in a $DESTIP 442 echo update add $DESTNODE.lowttl.example.net. 1 in a $DESTIP
403 echo 443 echo
404 } | nsupdate -d -k $CONFBASE:key.example.net. 444 } | nsupdate -d -k $CONFBASE:key.example.net.
405 445
406=item node-change = relative-or-absolute-path 446=item node-change = relative-or-absolute-path
407 447
408Same as C<node-change>, but gets called whenever something about a 448Same as C<node-change>, but gets called whenever something about a
… …
429private key file should be kept secret per-node to avoid spoofing, it is 469private key file should be kept secret per-node to avoid spoofing, it is
430not recommended to use this feature. 470not recommended to use this feature.
431 471
432=item rekey = seconds 472=item rekey = seconds
433 473
434Sets the rekeying interval in seconds (default: C<3600>). Connections are 474Sets the rekeying interval in seconds (default: C<3607>). Connections are
435reestablished every C<rekey> seconds, making them use a new encryption 475reestablished every C<rekey> seconds, making them use a new encryption
436key. 476key.
437 477
438=item nfmark = integer 478=item seed-device = path
439 479
440This advanced option, when set to a nonzero value (default: C<0>), tries 480The random device used to initially and regularly seed the random
441to set the netfilter mark (or fwmark) value on all sockets gvpe uses to 481number generator (default: F</dev/urandom>). Randomness is of paramount
442send packets. 482importance to the security of the algorithms used in gvpe.
443 483
444This can be used to make gvpe use a different set of routing rules. For 484On program start and every seed-interval, gvpe will read 64 octets.
445example, on GNU/Linux, the C<if-up> could set C<nfmark> to 1000 and then
446put all routing rules into table C<99> and then use an ip rule to make
447gvpe traffic avoid that routing table, in effect routing normal traffic
448via gvpe and gvpe traffic via the normal system routing tables:
449 485
450 ip rule add not fwmark 1000 lookup 99 486Setting this path to the empty string will disable this functionality
487completely (the underlying crypto library will likely look for entropy
488sources on it's own though, so not all is lost).
489
490=item seed-interval = seconds
491
492The number of seconds between reseeds of the random number generator
493(default: C<3613>). A value of C<0> disables this regular reseeding.
451 494
452=back 495=back
453 496
454=head2 NODE SPECIFIC SETTINGS 497=head2 NODE SPECIFIC SETTINGS
455 498

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines