radmind(8)

NAME
radmind - Remote administration daemon

SYNOPSIS
radmind [ -dRrUV ] [ -a bind-address ] [ -b backlog ] [ -D path ] [ -L syslog-facility ] [ -m max-connections ] [ -p port ] [ -u umask ] [ -w auth-level ] [ -x ca-pem-file ] [ -y cert-pem-file ] [ -z private-key-file ]

DESCRIPTION
Radmind uses the radmind access protocol to communicate with radmind clients.

On startup, radmind changes directory to /usr/obj/ports/radmind-1.5.0/fake-vax/var/radmind, creates command, file, special, tmp, tmp/file, tmp/transcript and transcript ( with permissions 0750 ) if they do not exist, and begins listening on the radmind port ( by default 6662 ) for incoming connections. With the -D option, radmind will use path as its working directory. Radmind forks a child for each connection.

The file config contains a list of known clients that can connect to radmind, one per line. Each line contains the CN, domain name or IP address of the client and the client's command file. The server checks each line of the config file, first checking to see if the connecting client's CN, domain name, and finally IP address match in that order. CNs and domain names are case insensitive. Lines that are blank or begin with '#' are ignored. '*' is a wildcard and will match any string. A number range can be given by "<min- max>" where min is the lower bound and max is the upper bound. '\' can be used to escape any character.

A client is only given access to command files and transcripts listed in their base command file as determined by the config file.

DIRECTORY STRUCTURE

command
    Stores command files.

transcripts
    Stores transcripts.

file
    All files served from the radmind server are stored in the file directory. All files for a given transcript are stored in file/<transcript> where <transcript> is the name of the transcript. A file is stored in file/<transcript> /<path> where <path> is the file's path as listed in the transcript.

special
    All special files are stored in special. The special files for a given host are stored in special/<host> where <host> is the fully qualified domain name or IP address of the client. Individual special files are stored in special/<host> /<path> where <path> is the path of the special file as listed in the client's command file. The IP address of the client will be used for <host> if there is no domain name returned by gethostbyname().

tmp/file
    All files stored on the server using the STOR command are saved in tmp/file. Files for a given transcript are stored in tmp/transcript/<transcript> /<path> where <transcript> is the name of the transcript and <path> is the file's path as given in the STOR command.

tmp/transcript
    All transcripts stored on the server using the STOR command are saved in tmp/transcript.

RADMIND ACCESS PROTOCOL
Radmind currently supports the following Radmind Access Protocol ( RAP ) requests:

QUIT
    terminate session

NOOP
    do nothing

HELP
    display helpful message

STAT
    stat a transcript, command or special file. When statting a command file or transcript, the mode, UID and GID default to 0444, 0, and 0 respectively. If no command file is specified, the server returns information on the base command file as indicated in the config file.

    Status of a special file is determined by a single transcript line listed in a file named special/<special-file-path >.T, where <special-file-path > is the full path to the special file. If that does not exist, a listing for the file in the transcript/special.T transcript in the transcript directory will be used. If neither of those exist, the defaults are returned.

RETR
    retrieve a file, transcript command or special file. If no command file is specified, the server returns the base command file as indicated in the config file.

STOR
    store a file or transcript. If user authentication been turned on, this command is only valid after the client sends a successful LOGI.

STAR
    Start TLS. If the server is run with an authorization level of 2, this command must be given before a client can send a STAT, RETR, or STOR.

LOGI
    Login user. This command is only valid after TLS has been started.

OPTIONS

-a bind-address
    specifies the address on which the server should listen, e.g. 127.0.0.1. By default the server listens on all available interfaces (wildcard address).

-b backlog
    Defines the maximum queue of pending connections to listen(2), by default five.

-D path
    specifies the radmind working directory, by default /usr/obj/ports/radmind-1.5.0/fake-vax/var/radmind

-d  debug mode. Does not disassociate from controlling tty.

-L syslog-facility
    specifies which syslog-facilty to log messages to.

-m max-connections
    specifies the maximum number of simultaneous connections, by default 0. Value must be greater than or equal to 0 with 0 indicating no limit.

-p port
    specifies the port of the radmind server, by default 6662.

-R  registers daemon as a Rendezvous service (Mac OS X only).

-r  use random seed file $RANDFILE if that environment variable is set, $HOME/.rnd otherwise. See RAND_load_file(3o).

-u umask
    specifies the umask the server uses to write files to the disk, defaulting to the user's umask.

-U  Turn on PAM user authentication. Requires auth-level > 0. radmind uses the PAM service name radmind.

-V  displays the version of radmind and exits.

-w auth-level
    TLS authorization level, by default 0. 0 = no TLS, 1 = server verification, 2 = server and client verification.

-x ca-pem-file
    Certificate authority's public certificate, by default /usr/obj/ports/radmind-1.5.0/fake-vax/var/radmind/cert/ca.pem.

-y cert-pem-file
    Server's public certificate, by default /usr/obj/ports/radmind-1.5.0/fake-vax/var/radmind/cert/cert.pem.

-z private-key-file
    Server's private key, by default /usr/obj/ports/radmind-1.5.0/fake-vax/var/radmind/cert/cert.pem.

EXAMPLES
The following example of /usr/obj/ports/radmind-1.5.0/fake-vax/var/radmind/config defines four known clients, each using one of three different command files. Also, any client that ends with ".lab.umich.edu" will get lab.K as its config file and clients in the IP range 212.12.243.1 through 212.12.243.50 will get solaris8.K as their config file.

    #
    # Client               command file
    #
    amber.umich.edu        apple.K
    josh.umich.edu         apple.K
    ben.umich.edu          apple-test.K
    oreo.umich.edu         solaris8.K
    *.lab.umich.edu        lab.K
    212.12.243.<1-50>      solaris8.K

FILES
/usr/obj/ports/radmind-1.5.0/fake-vax/var/radmind/config

SEE ALSO
fsdiff(1), ktcheck(1), lapply(1), lcreate(1), lcksum(1), lfdiff(1), lmerge(1), twhich(1), pam.conf(4), RAND_load_file(3o).

Also see the three Linux-PAM Guides, for System administrators, module developers, and application developers.