1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
|
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE reference PUBLIC "-//OASIS//DTD DocBook V4.4//EN"
"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
<reference>
<title>GssProxy Manual pages</title>
<refentry>
<refentryinfo>
<productname>GSS Proxy</productname>
<orgname>GSS-Proxy - http://fedorahosted.org/gss-proxy</orgname>
</refentryinfo>
<refmeta>
<refentrytitle>gssproxy.conf</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv id='name'>
<refname>gssproxy.conf</refname>
<refpurpose>GssProxy Daemon Configuration file</refpurpose>
</refnamediv>
<refsect1 id='description'>
<title>DESCRIPTION</title>
<para>
Optional configuration directives for the gssproxy daemon.
</para>
<para>
The gssproxy.conf file is a classic ini-style configuration file.
Each option consist of a key = value pair.
Any characters behind '#' will be treated as comments and will be ignored.
Boolean parameters accept "1", "true", "yes" and "on" as
positive values. All other values will be considered as negative
values.
</para>
</refsect1>
<refsect1 id='sections'>
<title>SECTIONS</title>
<para>
A section in the gssproxy.conf file is identified by the sectionname in square brackets ([sectionname]).
</para>
<para>
There is one special section for global gssproxy settings, called
[gssproxy].
</para>
<para>
Services such as nfs, apache, ssh, etc. are represented by
sections like [service/nfs], [service/apache], etc. and are
identified by the "euid" setting (see below).
</para>
</refsect1>
<refsect1 id='substitutions'>
<title>VARIABLE SUBSTITUTIONS</title>
<para>
String parameters may contain substitution patterns. This allows gssproxy to deal with patterns for
the storage location of keytabs or credential caches easier.
</para>
<para>
The supported patterns are:
</para>
<variablelist>
<varlistentry>
<term>%U</term>
<listitem><para>substitutes to the user's numeric uid (e.g. 123)</para></listitem>
</varlistentry>
<varlistentry>
<term>%u</term>
<listitem><para>substitutes to the user's username (e.g. john).</para></listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1 id='options'>
<title>OPTIONS</title>
<para>
gssproxy supports the following options:
<variablelist>
<varlistentry>
<term>allow_any_uid (boolean)</term>
<listitem>
<para>Allow any process of any user to use this service.</para>
<para>Note that absent a custom socket or selinux_context option
this option may cause a service definition to mask access to
following services. To avoid issues change the order of services
in your configuation file so that services with allow_any_uid
enabled are listed last, or define a custom socket for other
services.</para>
<para>Default: false</para>
</listitem>
</varlistentry>
<varlistentry>
<term>cred_usage (string)</term>
<listitem>
<para>Allow to restrict the kind of operations permitted for this service.</para>
<para>The allowed options are: initiate, accept, both</para>
<para>Default: cred_usage = both </para>
</listitem>
</varlistentry>
<varlistentry>
<term>cred_store (string)</term>
<listitem>
<para>This parameter allows to control in which way gssproxy should use the cred_store interface provided by GSSAPI. The parameter can be defined multiple times per service.</para>
<para>The syntax of the cred_store parameter is as
follows:
<![CDATA[cred_store = <cred_store_option>:<cred_store_value>]]></para>
<para>Currently this interface supports the following
options:</para>
<variablelist>
<varlistentry>
<term>keytab</term>
<listitem><para>Defines the keytab the service should use. Example: cred_store = keytab:/path/to/keytab</para></listitem>
</varlistentry>
<varlistentry>
<term>client_keytab</term>
<listitem><para>Defines a client keytab the service should use. Example: cred_store = client_keytab:/path/to/client_keytab.</para></listitem>
</varlistentry>
<varlistentry>
<term>ccache</term>
<listitem><para>Defines a credential cache the service should use. Example: cred_store = ccache:/path/to/ccache.</para></listitem>
</varlistentry>
</variablelist>
<para>Notably the client_keytab and the ccache setting
typically are used with variable substitution
placeholders (see above). For example:</para>
<programlisting>
<userinput moreinfo="none">cred_store = keytab:/etc/krb5.keytab</userinput>
<userinput moreinfo="none">cred_store = ccache:FILE:/var/lib/gssproxy/krb5cc_%U</userinput>
<userinput moreinfo="none">cred_store = client_keytab:/var/lib/gssproxy/%U.keytab</userinput>
</programlisting>
<para>Default: cred_store = </para>
</listitem>
</varlistentry>
<varlistentry>
<term>debug (boolean)</term>
<listitem>
<para>Enable debugging to syslog.</para>
<para>Default: debug = false</para>
</listitem>
</varlistentry>
<varlistentry>
<term>euid (integer)</term>
<listitem>
<para>The numeric effective uid of a running process, required to identify a service.</para>
<para>The "euid" parameter is imperative, any section
without it will be discarded.</para>
<para>Default: euid =</para>
</listitem>
</varlistentry>
<varlistentry>
<term>impersonate (boolean)</term>
<listitem>
<para>Use impersonation (s4u2self + s4u2proxy) to obtain credentials</para>
<para>Default: impersonate = false</para>
</listitem>
</varlistentry>
<varlistentry>
<term>kernel_nfsd (boolean)</term>
<listitem>
<para>Boolean flag that allows the Linux kernel to check if gssproxy is running (via <filename>/proc/net/rpc/use-gss-proxy</filename>).</para>
<para>Default: kernel_nfsd = false</para>
</listitem>
</varlistentry>
<varlistentry>
<term>krb5_principal (string)</term>
<listitem>
<para>The krb5 principal to be used by this service.</para>
<para>Default: krb5_principal = </para>
</listitem>
</varlistentry>
<varlistentry>
<term>mechs (string)</term>
<listitem>
<para>Currently only <parameter>krb5</parameter> is supported.</para>
<para>The "mechs" parameter is imperative, any section
without it will be discarded.</para>
<para>Default: mechs = </para>
</listitem>
</varlistentry>
<varlistentry>
<term>selinux_context (string)</term>
<listitem>
<para>This parameter instructs the proxy to allow map a
request to the service only if the context of the
connecting client matches the one defined here.
</para>
<para>When this parameter is not set any client will be
allowed regardless of their selinux context.
</para>
<para>Example: selinux_context = system_u:system_r:gssd_t
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>socket (string)</term>
<listitem>
<para>This parameter allows to create a per-service socket file over which gssproxy client and server components communicate.
</para>
<para>When this parameter is not set, gssproxy will
use a compiled-in default.</para>
</listitem>
</varlistentry>
<varlistentry>
<term>trusted (boolean)</term>
<listitem><para>Defines whether this service is considered trusted. Use with caution, this enables impersonation.</para>
<para>Default: trusted = false</para>
</listitem>
</varlistentry>
<varlistentry>
<term>worker threads (integer)</term>
<listitem>
<para>Defines the amount of worker threads gssproxy will create at startup.</para>
<para>Default: worker threads = </para>
</listitem>
</varlistentry>
</variablelist>
</para>
</refsect1>
<refsect1>
<title>SEE ALSO</title>
<para>
<citerefentry>
<refentrytitle>gssproxy</refentrytitle><manvolnum>8</manvolnum>
</citerefentry> and
<citerefentry>
<refentrytitle>gssproxy-mech</refentrytitle><manvolnum>8</manvolnum>
</citerefentry>.
</para>
</refsect1>
</refentry>
</reference>
|
