FTicks docs changes

[libradsec.git] / radsecproxy.conf.5.xml

diff --git a/radsecproxy.conf.5.xml b/radsecproxy.conf.5.xml
index 6ab49a8..0b7ee05 100644 (file)
--- a/radsecproxy.conf.5.xml
+++ b/radsecproxy.conf.5.xml
@@ -2,14 +2,14 @@
 "http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd">
 <refentry>
   <refentryinfo>
-    <date>2011-04-04</date>
+    <date>2011-10-08</date>
   </refentryinfo>
   <refmeta>
     <refentrytitle>
       <application>radsecproxy.conf</application>
     </refentrytitle>
     <manvolnum>5</manvolnum>
-    <refmiscinfo>radsecproxy 1.5-dev</refmiscinfo>
+    <refmiscinfo>radsecproxy 1.5</refmiscinfo>
   </refmeta>
   <refnamediv>
     <refname>
@@ -176,12 +176,17 @@ blocktype name {
            The FTicksReporting option is used to enable F-Ticks
            logging and can be set to <literal>None</literal>,
            <literal>Basic</literal> or <literal>Full</literal>.  Its
-           default value is <literal>None</literal>.
-
+           default value is <literal>None</literal>.  If
+           FTicksReporting is set to anything other than
+           <literal>None</literal>, note that the default value for
+           FTicksMAC is <literal>VendorKeyHashed</literal> which
+           needs FTicksKey to be set.
+         </para>
+         <para>
            See <literal>radsecproxy.conf-example</literal> for
            details.  Note that radsecproxy has to be configured with
-           support for F-Ticks (<literal>--enable-fticks</literal>)
-           for this option to have any effect.
+           F-Ticks support (<literal>--enable-fticks</literal>) for
+           this option to have any effect.
          </para>
        </listitem>
       </varlistentry>
@@ -191,19 +196,31 @@ blocktype name {
         <listitem>
          <para>
            The FTicksMAC option can be used to control if and how
-           Calling-Station-Id is being logged.  It can be set to one
-           of <literal>Static</literal>, <literal>Original</literal>,
+           Calling-Station-Id (the users Ethernet MAC address) is
+           being logged.  It can be set to one of
+           <literal>Static</literal>, <literal>Original</literal>,
            <literal>VendorHashed</literal>,
            <literal>VendorKeyHashed</literal>,
            <literal>FullyHashed</literal> or
            <literal>FullyKeyHashed</literal>.
-
-           Its default value is <static>Static</static>.
-
+         </para>
+         <para>
+           The default value for FTicksMAC is
+           <literal>VendorKeyHashed</literal>.  This means that
+           FTicksKey has to be set.
+         <para>
+           Before chosing any of <literal>Original</literal>,
+           <literal>FullyHashed</literal> or
+           <literal>VendorHashed</literal>, consider the implications
+           for user privacy when MAC addresses are collected.  How
+           will the logs be stored, transferred and accessed?
+         </para>
+         </para>
+         <para>
            See <literal>radsecproxy.conf-example</literal> for
            details.  Note that radsecproxy has to be configured with
-           support for F-Ticks (<literal>--enable-fticks</literal>)
-           for this option to have any effect.
+           F-Ticks support (<literal>--enable-fticks</literal>) for
+           this option to have any effect.
          </para>
        </listitem>
       </varlistentry>
@@ -216,15 +233,34 @@ blocktype name {
            when producing HMAC's as an effect of specifying
            VendorKeyHashed or FullyKeyHashed for the FTicksMAC
            option.
-
-           Note that radsecproxy has to be configured with support
-           for F-Ticks (<literal>--enable-fticks</literal>) for this
+         </para>
+         <para>
+           Note that radsecproxy has to be configured with F-Ticks
+           support (<literal>--enable-fticks</literal>) for this
            option to have any effect.
          </para>
        </listitem>
       </varlistentry>
 
       <varlistentry>
+        <term><literal>FTicksSyslogFacility</literal></term>
+        <listitem>
+         <para>
+           The FTicksSyslogFacility option is used to specify 
+           a dedicated syslog facility for F-Ticks messages.
+           This allows easy filtering of F-Ticks messages.
+           By default, if FTicksSyslogFacility is not given,
+           F-Ticks messages are written to the LogDestination. 
+         </para>
+         <para>
+           For F-Ticks messages always LOG_DEBUG level is used.
+           Note that FTicksSyslogFacility value specifying a file 
+           (via file:/// prefix) is ignored.
+         </para>
+       </listitem>
+      </varlistentry>
+
+      <varlistentry>
         <term><literal>ListenUDP</literal></term>
         <listitem>
          <para>
@@ -453,7 +489,9 @@ blocktype name {
       <literal>tls</literal> or <literal>dtls</literal>. The value of
       <literal>secret</literal> is the shared RADIUS key used with
       this client. If the secret contains whitespace, the value must
-      be quoted. This option is optional for TLS/DTLS.
+      be quoted. This option is optional for TLS/DTLS and if omitted
+      will default to "mysecret".  Note that the default value of
+      <literal>secret</literal> will change in an upcoming release.
     </para>
     <para>
       For a TLS/DTLS client you may also specify the