Fix handling of invalid groups and ACL's.

[pwmd.git] / doc / config.example

# Example PWMD configuration file. Edit and save to ~/.pwmd/config or
# specify with the -f command line option. See the pwmd(1) manual page or the
# pwmd.info documentation for complete details of the options.
#
# The global section is for non-file related settings and defaults for data
# files without a file section of their own.
[global]

# Location of the pinentry binary.
#pinentry_path=/usr/bin/pinentry

# The number of seconds to wait for a pinentry before giving up.
#pinentry_timeout=30

# Location of the listening socket.
#socket_path=~/.pwmd/socket

# Socket permissions. This will override any umask setting.
#socket_perms=0600

# Usernames or groups obtained via SO_PEERCRED which are allowed to
# connect to the socket. Groups should be prefixed with a '@'. When not
# specified only the invoking user is allowed. You can also specify an SHA256
# TLS fingerprint by prefixing it with a '#'.
#allowed = username,another_user,@group,!not_this_user,#TLS-FINGERPRINT

# Same syntax as the 'allowed' parameter with one entry per line.
#allowed_file=~/path/to/file

# Username to use as the default in an element ACL. The default is the
# user that starts pwmd.
#invoking_user=nobody,@group,!notme,#TLSFINGERPRINT

# Same syntax as the 'invoking_user' parameter with one entry per line.
#invoking_file=~/path/to/file

# Allow killing another client of the same UID or TLS fingerprint when not an
# invoking_user.
#strict_kill=false

# When false, disable keeping backups for data files.
#backup=true

# Log file location.
#log_path=~/.pwmd/log

# Set to true to enable logging to log_path.
#enable_logging=false

# Disable to close the logging file descriptor (log_path) after writing each
# line.
#log_keepopen=true

# Set to true to enable logging to syslog.
#syslog=false

# The logging level: 0=connections and errors, 1=client commands.
#log_level=0

# Enable gpg-agent support.
#use_agent=false

# The location of the gpg-agent socket.
#gpg_agent_socket=~/.gnupg/S.gpg-agent

# Kill the smartcard daemon after each OPEN or SAVE.
#kill_scd=false

# Require the passphrase needed for a data file before each SAVE.
#require_save_key=true

# Set to false to call mlockall(2) after a client connects. Uses more memory
# but is also more secure. Most will probably find it overkill since the
# contents of all memory is cleared before being freed.
#disable_mlockall=true

# Disable the XPATH, LIST and DUMP commands. When "true" and a client sends
# these commands the error GPG_ERR_NOT_IMPLEMENTED will be returned.
#disable_list_and_dump=false

# When sending data to the client an XFER status message will be sent after
# N bytes. N is rounded to ASSUAN_LINELENGTH (1002) bytes.
#xfer_progress=8196

# A comma separated list of filenames to add to the file cache upon startup.
# You will be prompted for the passphrasefor each file if required. The files
# are looked for in ~/.pwmd/data. This also affects rcfile reloading via
# SIGHUP.
#cache_push=somefile,anotherfile

# The number of seconds to keep a file in the cache. If -1, the file will be
# kept forever. If 0 then every OPEN will require a passphrase.
#cache_timeout=600

# The maximum recursion depth when resolving elements that contain a "target"
# attribute. When this value is exceeded an error will be returned.
#recursion_depth=100

# The priority or nice value of the server process. The default is inherited
# from the parent process.
#priority=10

# The cipher to use for newly created files.
#cipher=aes256

# The default key parameters to use when generating a new keypair
# (RSA 2048 bit).
#keyparam=(genkey (rsa (nbits 4:2048)))

# The number of passphrase hashing iterations.  The default is the calibrated
# value of the machine for gpg-agent data files and 5000000 when not.
#s2k_count=0

# In tenths of a second, the amount of time to wait for a file lock before
# returning an error to the client.
#lock_timeout=50

# Whether to enable TCP/TLS server support. If enabled, both TCP and the local
# unix domain socket will listen for connections.
#enable_tcp=false

# If TCP is enabled, the port to listen on.
#tcp_port=6466

# The network interface to listen on.
#tcp_interface=eth1

# The number of seconds to wait for a network read and write to complete
# for TLS connections.
#tls_timeout=300

# Require the client to provide the key to open a file even if the file is
# cached.
#tcp_require_key=false

# The time in tenths of a second to wait for a new TCP connection.  Setting to
# 0 will disable waiting.
#tcp_wait=3

# Accept TCP connections from the specified protocol. One of: ipv4, ipv6 or
# any. The default is "any".
#tcp_bind=any

# The GnuTLS cipher suite and protocol to use.
#tls_cipher_suite=SECURE256

# TLS key exchange security level: low, medium or high.
#tls_dh_level=medium

# The interval in seconds to send the KEEPALIVE status message when
# not in a command.
#keepalive_interval=60

# Send client state information to all connected clients. 0=disable, 1=all,
# 2=invoking user clients only.
#send_state=2

# END GLOBAL SETTINGS

# File specific settings are allowed by placing the filename in braces. Each
# file can have it's own configuration settings from those listed below.
#[somefile]
#allowed=@group,!not_this_user,!#DENIEDFINGERPRINT
#cache_timeout=300
#passphrase=password
#passphrase_file=/path/to/file.key
#backup=true
#xfer_progress=1024
#recursion_depth=200