Update

[bacula/docs] / docs / manual / tls.tex

diff --git a/docs/manual/tls.tex b/docs/manual/tls.tex
index 8234c7a34d296bd70a787f6159399ec7f9eac5fc..beaa74560f3efb7edcb225cb66a5fea1e28455df 100644 (file)
--- a/docs/manual/tls.tex
+++ b/docs/manual/tls.tex
@@ -13,7 +13,10 @@ Bacula TLS (Transport Layer Security) is built-in network
 encryption code to provide secure network transport similar to
 that offered by {\bf stunnel} or {\bf ssh}.  The data written to  
 Volumes by the Storage daemon is not encrypted by this code.
-The Bacula encryption code was written by Landon Fuller.
+For data encryption, please see the \ilink{Data Encryption
+Chapter}{DataEncryption} of this manual.
+
+The Bacula encryption implementations were written by Landon Fuller.
 
 Supported features of this code include: 
 \begin{itemize} 
@@ -44,10 +47,16 @@ These new directives are defined as follows:
 
 \begin{description}
 \item [TLS Enable = \lt{}yes|no\gt{}]
-Enable TLS support.
+Enable TLS support.  If TLS is not enabled, none of the other TLS directives
+have any effect. In other words, even if you set {\bf TLS Require = yes} 
+you need to have TLS enabled or TLS will not be used.
 
 \item [TLS Require = \lt{}yes|no\gt{}]
-Require TLS connections.
+Require TLS connections.  This directive is ignored unless {\bf TLS Enable}
+is set to {\bf yes}.  If TLS is not required, and TLS is enabled, then
+Bacula will connect with other daemons either with or without TLS depending
+on what the other daemon requests.  If TLS is enabled and TLS is required,
+then Bacula will refuse any connection that does not use TLS.
 
 \item [TLS Certificate = \lt{}Directory\gt{}]
 Path to a PEM encoded TLS certificate.  It can be used as either a client
@@ -131,7 +140,7 @@ each of them by entering a return, or if you wish you may enter your own data.
 Note, however, that self-signed certificates will only work for the
 outgoing end of connections.  For example, in the case of the Director
 making a connection to a File Daemon, the File Daemon may be configured to
-allow self-signed certifictes, but the certificate being sed by the
+allow self-signed certifictes, but the certificate used by the
 Director must be signed by a certificate that is explicitly trusted on the
 File Daemon end.
 
@@ -186,7 +195,7 @@ Note, this link may change.
 
 Landon has supplied us with the TLS portions of his configuration
 files, which should help you setting up your own.
-    
+
 {\bf bacula-dir.conf}
 \footnotesize
 \begin{verbatim}