Final changes

[bacula/docs] / docs / manual / tls.tex

diff --git a/docs/manual/tls.tex b/docs/manual/tls.tex
index 1ef94dfc398c5bba5e61a7bd6673ad309c0dbe35..237a165f717b52b4e0e40d2a694fcc2b6b1f57c2 100644 (file)
--- a/docs/manual/tls.tex
+++ b/docs/manual/tls.tex
@@ -18,7 +18,7 @@ Validation
 \item Forward Secrecy Support via Diffie-Hellman Ephemeral Keying 
 \end{itemize}
 
-This document will refer to both ``server'' and ``client'' contexts.  These
+This document will refer to both "server" and "client" contexts.  These
 terms refer to the accepting and initiating peer, respectively.
 
 Diffie-Hellman anonymous ciphers are not supported by this code.  The
@@ -141,3 +141,105 @@ Open-source PKI Book project at Source Forge:
 http://ospkibook.sourceforge.net/docs/OSPKI-2.4.7/OSPKI-html/ospki-book.htm}
 {http://ospkibook.sourceforge.net/docs/OSPKI-2.4.7/OSPKI-html/ospki-book.htm}.
 Note, this link may change. 
+
+\subsection*{Example TLS Configuration Files}
+\index[general]{Example!TLS Configuration Files}
+\index[general]{TLS Configuration Files}
+\addcontentsline{toc}{subsection}{Example TLS Configuration Files}
+
+Landon has supplied us with the TLS portions of his configuration
+files, which should help you setting up your own.
+    
+{\bf bacula-dir.conf}
+\footnotesize
+\begin{verbatim}
+   Director {                            # define myself
+     Name = backup1-dir
+     ...
+     TLS Require = yes
+     TLS Verify Peer = yes
+     TLS Allowed CN = "bacula@backup1.example.com"
+     TLS Allowed CN = "administrator@example.com"
+     TLS CA Certificate File = /usr/local/etc/ssl/ca.pem
+     # This is a server certificate, used for incoming
+     # console connections.
+     TLS Certificate = /usr/local/etc/ssl/backup1/cert.pem
+     TLS Key = /usr/local/etc/ssl/backup1/key.pem
+   }
+
+   Storage {
+     Name = File
+     Address = backup1.example.com
+     ...
+     TLS Require = yes
+     TLS CA Certificate File = /usr/local/etc/ssl/ca.pem
+     # This is a client certificate, used by the director to
+     # connect to the storage daemon
+     TLS Certificate = /usr/local/etc/ssl/bacula@backup1/cert.pem
+     TLS Key = /usr/local/etc/ssl/bacula@backup1/key.pem
+   }
+\end{verbatim}
+\normalsize
+
+{\bf bacula-fd.conf}
+\footnotesize
+\begin{verbatim}
+   Director {
+     Name = backup1-dir
+     ...
+     TLS Require = yes
+     TLS Verify Peer = yes
+     # Allow only the Director to connect
+     TLS Allowed CN = "bacula@backup1.example.com"
+     TLS CA Certificate File = /usr/local/etc/ssl/ca.pem\
+     # This is a server certificate. It is used by connecting
+     # directors to verify the authenticity of this file daemon
+     TLS Certificate = /usr/local/etc/ssl/server1/cert.pem
+     TLS Key = /usr/local/etc/ssl/server1/key.pem
+   }
+\end{verbatim}
+\normalsize
+
+{\bf bacula-sd.conf}
+\footnotesize
+\begin{verbatim}
+   Storage {                             # definition of myself
+     Name = backup1-sd
+     ...
+     # These TLS configuration options are used for incoming
+     # file daemon connections. Director TLS settings are handled
+     # below.
+     TLS Require = yes
+     # Peer certificate is not required/requested -- peer validity
+     # is verified by the storage connection cookie provided to the
+     # File Daemon by the director.
+     TLS Verify Peer = no
+     TLS CA Certificate File = /usr/local/etc/ssl/ca.pem
+     # This is a server certificate. It is used by connecting
+     # file daemons to verify the authenticity of this storage daemon
+     TLS Certificate = /usr/local/etc/ssl/backup1/cert.pem
+     TLS Key = /usr/local/etc/ssl/backup1/key.pem
+   }
+
+   #
+   # List Directors who are permitted to contact Storage daemon
+   #
+   Director {
+     Name = backup1-dir
+     ...
+     TLS Require = yes
+     # Require the connecting director to provide a certificate
+     # with the matching CN.
+     TLS Verify Peer = yes
+     TLS Allowed CN = "bacula@backup1.example.com"
+     TLS CA Certificate File = /usr/local/etc/ssl/ca.pem
+     # This is a server certificate. It is used by the connecting
+     # director to verify the authenticity of this storage daemon
+     TLS Certificate = /usr/local/etc/ssl/backup1/cert.pem
+     TLS Key = /usr/local/etc/ssl/backup1/key.pem
+   }
+\end{verbatim}
+\normalsize
+
+
+