diff options
Diffstat (limited to 'bin/auditdistd/auditdistd.conf.5')
| -rw-r--r-- | bin/auditdistd/auditdistd.conf.5 | 97 |
1 files changed, 50 insertions, 47 deletions
diff --git a/bin/auditdistd/auditdistd.conf.5 b/bin/auditdistd/auditdistd.conf.5 index 13abb5a5c4c1f..c6ed2b58906b4 100644 --- a/bin/auditdistd/auditdistd.conf.5 +++ b/bin/auditdistd/auditdistd.conf.5 @@ -27,7 +27,7 @@ .\" .\" $FreeBSD$ .\" -.Dd March 22, 2011 +.Dd July 1, 2015 .Dt AUDITDISTD.CONF 5 .Os .Sh NAME @@ -37,19 +37,21 @@ daemon. .Sh DESCRIPTION Note: the configuration file may contain passwords. -Care should be taken to configure proper permissions on this file -.Li ( eg. 0600 ) . +Care should be taken to configure proper permissions for this file +.Li ( e.g., 0600 ) . .Pp -Every line starting with # is treated as comment and ignored. +Every line starting with +.Li # +gets treated as a comment and is ignored. .Sh CONFIGURATION FILE SYNTAX -General syntax of the +The general syntax of the .Nm -file is following: -.Bd -literal -offset +file is as follows: +.Bd -literal ## Global section. # Our name. -# The default is first part of the hostname. +# The default is the first part of the hostname. name "<name>" # Connection timeout. @@ -71,11 +73,11 @@ sender { # The default is /var/audit/dist. directory "<dir>" .\" -.\" # Checksum algorithm for data send over the wire. +.\" # Checksum algorithm for data sent over the wire. .\" # The default is none. .\" checksum "<algorithm>" .\" -.\" # Compression algorithm for data send over the wire. +.\" # Compression algorithm for data sent over the wire. .\" # The default is none. .\" compression "<algorithm>" @@ -86,7 +88,7 @@ sender { # Optional. source "<addr>" - # Address of auditdistd receiver. + # Address of the auditdistd receiver. # No default. Obligatory. remote "<addr>" @@ -95,7 +97,7 @@ sender { directory "<dir>" # Fingerprint of the receiver's public key when using TLS - # for connection. + # for connections. # Example fingerprint: # SHA256=8F:0A:FC:8A:3D:09:80:AF:D9:AA:38:CC:8A:86:53:E6:8F:B6:1C:55:30:14:D7:F9:AA:8B:3E:73:CD:F5:76:2B fingerprint "<algorithm=hash>" @@ -103,37 +105,37 @@ sender { # Password used to authenticate in front of the receiver. password "<password>" .\" -.\" # Checksum algorithm for data send over the wire. +.\" # Checksum algorithm for data sent over the wire. .\" # The default is none. .\" checksum "<algorithm>" .\" -.\" # Compression algorithm for data send over the wire. +.\" # Compression algorithm for data sent over the wire. .\" # The default is none. .\" compression "<algorithm>" } - # Currently local audit trail files can be send only to one remote + # Currently local audit trail files can be sent only to one remote # auditdistd receiver, but this can change in the future. } receiver { ## Receiver section. - # Address to listen on. Multiple listen addresses might be specified. + # Address to listen on. Multiple listen addresses may be specified. # The defaults are "tcp4://0.0.0.0:7878" and "tcp6://[::]:7878". listen "<addr>" # Base directory. - # If directory in host section is no absolute, it will be concatenated - # with this base directory. + # If the directory in the host section is not absolute, it will be + # concatenated with this base directory. # The default is "/var/audit/remote". directory "<basedir>" - # Path to receiver's certificate file. + # Path to the receiver's certificate file. # The default is "/etc/security/auditdistd.cert.pem". certfile "<path>" - # Path to receiver's private key file. + # Path to the receiver's private key file. # The default is "/etc/security/auditdistd.key.pem". keyfile "<path>" @@ -158,7 +160,7 @@ receiver { .Ed .Pp Most of the various available configuration parameters are optional. -If parameter is not defined in the particular section, it will be +If a parameter is not defined in the particular section, it will be inherited from the parent section if possible. For example, if the .Ic source @@ -172,14 +174,14 @@ In case the section does not define the .Ic source parameter at all, the default value will be used. -.Sh CONFIGURATION FILE DESCRIPTION +.Sh CONFIGURATION OPTION DESCRIPTION The following statements are available: .Bl -tag -width ".Ic xxxx" .It Ic name Aq name .Pp This host's name. -It is send to the receiver, so it can properly recognize us if there are -more than one sender coming from the same IP address. +It is sent to the receiver, so it can properly recognize us if there are +multiple senders coming from the same IP address. .It Ic timeout Aq seconds .Pp Connection timeout in seconds. @@ -198,17 +200,17 @@ The default value is Local address to bind to before connecting to the remote .Nm auditdistd daemon. -Format is the same as for the +The format is the same as for the .Ic listen statement. .It Ic directory Aq path .Pp -Directory where to look for audit trail files in case of sender mode or -directory where to store received audit trail files. +The directory where to look for audit trail files in case of sender mode, or +the directory where to store received audit trail files. The provided path has to be an absolute path. -The only exception is when directory is provided in the +The only exception is when the directory is provided in the .Ic receiver -section, then path provided in the +section; then the path provided in the .Ic host subsections can be relative to the directory in the .Ic receiver @@ -229,13 +231,13 @@ subsections in the .Ic receiver section where .Aq name -is host's name. +is the host's name. .\".It Ic checksum Aq algorithm .\".Pp .\"Checksum algorithm should be one of the following: .\".Bl -tag -width ".Ic sha256" .\".It Ic none -.\"No checksum will be calculated for the data being send over the network. +.\"No checksum will be calculated for the data being sent over the network. .\"This is the default setting. .\".It Ic crc32 .\"CRC32 checksum will be calculated. @@ -247,30 +249,30 @@ is host's name. .\"Compression algorithm should be one of the following: .\".Bl -tag -width ".Ic none" .\".It Ic none -.\"Data send over the network will not be compressed. +.\"Data sent over the network will not be compressed. .\"This is the default setting. .\".It Ic lzf .\"The .\".Nm LZF .\"algorithm by .\".An Marc Alexander Lehmann -.\"will be used to compress the data send over the network. +.\"will be used to compress the data sent over the network. .\".Nm LZF -.\"is very fast, general purpose compression algorithm. +.\"is a very fast, general purpose compression algorithm. .\".El .It Ic remote Aq addr .Pp Address of the remote .Nm auditdistd daemon. -Format is the same as for the +The format is the same as for the .Ic listen statement. -When operating in the +When operating in .Ic sender mode this address will be used to connect to the .Ic receiver . -When operating in the +When operating in .Ic receiver mode only connections from this address will be accepted. .It Ic listen Aq addr @@ -296,21 +298,22 @@ By default listens on .Pa tcp4://0.0.0.0:7878 and -.Pa tcp6://[::]:7878 -if kernel supports IPv4 and IPv6 respectively. +.Pa tcp6://[::]:7878 , +if the kernel supports IPv4 and IPv6 respectively. .It Ic keyfile Aq path .Pp -Path to a file that contains private key for TLS communication. +Path to a file that contains the private key for TLS communication. .It Ic certfile Aq path .Pp -Path to a file that contains certificate for TLS communication. +Path to a file that contains the certificate for TLS communication. .It Ic fingerprint Aq algo=hash .Pp -Finger print of the receiver's public key. -Currently only SHA256 algorithm is supported. -Certificate public key's fingerprint ready to be pasted into auditdistd +Fingerprint of the receiver's public key. +Currently only the SHA256 algorithm is supported. +The certificate public key's fingerprint ready to be pasted into the +.Nm auditdistd configuration file can be obtained by running: -.Bd -literal -offset +.Bd -literal # openssl x509 -in /etc/security/auditdistd.cert.pem -noout -fingerprint -sha256 | awk -F '[ =]' '{printf("%s=%s\\n", $1, $3)}' .Ed .It Ic password Aq password @@ -352,10 +355,10 @@ receiver { .Ed .Sh SEE ALSO .Xr audit 4 , -.Xr auditdistd 8 . +.Xr auditdistd 8 .Sh AUTHORS The .Nm auditdistd -was developed by +daemon was developed by .An Pawel Jakub Dawidek Aq pawel@dawidek.net under sponsorship of the FreeBSD Foundation. |