"http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd"

[

  %global_entities;

]>

<refentry id='amanda-security.conf.5'>

<refmeta>

<refentrytitle>amanda-security.conf</refentrytitle>

<manvolnum>5</manvolnum>

&rmi.source;

&rmi.version;

&rmi.manual.5;

</refmeta>

<refnamediv>

<refname>amanda-security.conf</refname>

<refpurpose>Client configuration file for Amanda</refpurpose>

</refnamediv>

<refentryinfo>

&author.jlm;

</refentryinfo>

<refsect1><title>DESCRIPTION</title>

<para>&amsecurityconf; is the security configuration file for Amanda. This manpage lists the

relevant sections and parameters of this file.</para>

<para>The file must be installed at <emphasis remap='B'>/etc/amanda-security.conf</emphasis> and only root must be able to write to it. Good permission are:</para>

<para>It must be readable by the amanda user and owned by root. Good permissions are:</para>

<programlisting>

$ ls -l /etc/amanda-security.conf

-rw-r--r--. 1 root root 1994 Jan 29 13:45 /etc/amanda-security.conf

</programlisting>

<para>An example file should be installed at <emphasis remap='B'>/etc/amanda/amanda-security.conf</emphasis>.</para>

<para>All lines with '#' as the first character ar comment line.</para>

</refsect1>

<refsect1><title>SECURE BINARIES</title>

<para>The list of all executables amanda can execute as root.

The format is as follow:

<programlisting>

   AMANDA_PROGRAM:SYMBOLIC_NAME=REALPATH_TO_BINARY

</programlisting></para>

<para>This file must contains realpath to executable, with all symbolic links resolved.

You can use the 'realpath' command to find them.</para>

<para>Multiple line can be added for the same 'AMANDA_PROGRAM:SYMBOLIC_NAME' if you are using multiple binaries.</para>

<para>The 'AMANDA_PROGRAM:SYMBOLIC_NAME' can be any of the following:</para>

<variablelist remap='TP'>

  <varlistentry>

  <term>runtar:gnutar_path</term>

  <listitem>

<para>The gnutar binary runtar is allowed to run. The default is `amgetconf build.gnutar_path`</para></listitem>

  </varlistentry>

  <varlistentry>

  <term>amgtar:gnutar_path</term>

  <listitem>

<para>The gnutar binary amgtar is allowed to run. The default is `amgetconf build.gnutar_path`</para></listitem>

  </varlistentry>

  <varlistentry>

  <term>amstar:star_path</term>

  <listitem>

<para>The star binary amstar is allowed to run. The default is `amgetconf build.star_path`</para></listitem>

  </varlistentry>

  <varlistentry>

  <term>ambsdtar:bsdtar_path</term>

  <listitem>

<para>The bsdtar binary ambsdtar is allowed to run. The default is `amgetconf build.bsdtar_path`</para></listitem>

  </varlistentry>

</variablelist>

</refsect1>

<refsect1>

<title>OTHERS SECURITY PARAMETERS</title>

<variablelist remap='TP'>

  <varlistentry>

  <term>restore_by_amanda_user=[yes|no]</term>

  <listitem>

<para>Default: no. Set to 'yes' if you want the amanda user to restore file as root, required only if you run amgtar, amstar or ambsdtar as the amanda backup for recovery.</para></listitem>

  </varlistentry>

  <varlistentry>

  <term>tcp_port_range=int,int</term>

  <listitem>

<para>Default: no. Must be set to the range of privileged tcp port amanda

can use, required for bsdtcp and krb5 auth.

The range is inclusive</para>

<para> You can find the range you are configured to use with:</para>

<programlisting>

  amgetconf CONF reserved-udp-port

</programlisting>

</listitem>

  </varlistentry>

  <varlistentry>

  <term>udp_port_range=int,int</term>

  <listitem>

<para>Default: no. Must be set to the range of privileged udp port amanda

can use, required for bsd and bsdudp auth.

The range is inclusive</para>

<para> You can find the range you are configured to use with:</para>

<programlisting>

  amgetconf CONF reserved-udp-port

</programlisting>

</listitem>

  </varlistentry>

</variablelist>

</refsect1>

<seealso>

<manref name="amanda.conf" vol="5"/>,

</seealso>

</refentry>