Provided by: bcfg2_1.3.5-4ubuntu1_all bug

NAME

       bcfg2.conf - Configuration parameters for Bcfg2

DESCRIPTION

       bcfg2.conf includes configuration parameters for the Bcfg2 server and client.

FILE FORMAT

       The file is INI-style and consists of sections and options. A section begins with the name
       of the sections in square brackets and continues until the next section begins.

       Options are specified in the form "name=value".

       The file is line-based each newline-terminated line represents either a comment, a section
       name or an option.

       Any line beginning with a hash (#) is ignored, as are lines containing only whitespace.

SERVER OPTIONS

       These  options  are only necessary on the Bcfg2 server. They are specified in the [server]
       section of the configuration file.

       repository
              Specifies the path to the Bcfg2 repository  containing  all  of  the  configuration
              specifications.  The  repository  should  be  created  using  the  bcfg2-admin init
              command.

       filemonitor
              The file monitor used to watch for changes in the repository. The  default  is  the
              best available monitor. The following values are valid:

                 inotify
                 gamin
                 fam
                 pseudo

       fam_blocking
              Whether  the  server  should  block  at  startup until the file monitor backend has
              processed all events. This can cause a slower startup, but ensure  that  all  files
              are recognized before the first client is handled.

       ignore_files
              A comma-separated list of globs that should be ignored by the file monitor. Default
              values are:

                 *~
                 *#
                 #*
                 *.swp
                 *.swpx
                 *.swx
                 SCCS
                 .svn
                 4913
                 .gitignore

       listen_all
              This setting tells the server to listen on all available interfaces.   The  default
              is  to  only  listen  on  those  interfaces  specified  by the bcfg2 setting in the
              components section of bcfg2.conf.

       plugins
              A comma-delimited list of enabled server plugins. Currently available plugins are:

                 Account
                 Base
                 Bundler
                 Bzr
                 Cfg
                 Cvs
                 Darcs
                 DBStats
                 Decisions
                 Deps
                 Editor
                 FileProbes
                 Fossil
                 Git
                 GroupPatterns
                 Guppy
                 Hg
                 Hostbase
                 Ldap
                 Metadata
                 NagiosGen
                 Ohai
                 Packages
                 Pkgmgr
                 POSIXCompat
                 Probes
                 Properties
                 PuppetENC
                 Reporting
                 Rules
                 SEModules
                 ServiceCompat
                 Snapshots
                 SSHbase
                 SSLCA
                 Statistics
                 Svn
                 TCheetah
                 TemplateHelper
                 TGenshi
                 Trigger

              Descriptions of each plugin can be found in their respective sections below.

       prefix Specifies a prefix if the Bcfg2 installation isn't placed in the  default  location
              (e.g. /usr/local).

       backend
              Specifies which server core backend to use. Current available options are:

                 cherrypy
                 builtin
                 best

              The  default is best, which is currently an alias for builtin.  More details on the
              backends can be found in the official documentation.

       user   The username or UID to run the daemon as. Default is 0.

       group  The group name or GID to run the daemon as. Default is 0.

       vcs_root
              Specifies the path to the root of the  VCS  working  copy  that  holds  your  Bcfg2
              specification,  if  it  is  different from repository.  E.g., if the VCS repository
              does not hold the bcfg2 data at the top level, you may need to set this option.

       umask  The umask to set for the server.  Default is 0077.

SERVER PLUGINS

       This section has a listing of all the plugins currently provided with Bcfg2.

   Account Plugin
       The account plugin manages authentication data, including the following.

       · /etc/passwd

       · /etc/group

       · /etc/security/limits.conf

       · /etc/sudoers

       · /root/.ssh/authorized_keys

   Base Plugin
       The Base plugin is a structure plugin that provides the ability to add lists of  unrelated
       entries  into  client configuration entry inventories. Base works much like Bundler in its
       file format. This structure plugin is good for the pile of independent configs needed  for
       most actual systems.

   Bundler Plugin
       The  Bundler  plugin  is used to describe groups of inter-dependent configuration entries,
       such as the combination of packages, configuration files,  and  service  activations  that
       comprise  typical Unix daemons. Bundles are used to add groups of configuration entries to
       the inventory of client configurations, as opposed to describing  particular  versions  of
       those entries.

   Bzr Plugin
       The  Bzr  plugin  allows  you to track changes to your Bcfg2 repository using a GNU Bazaar
       version control backend. Currently, it enables you to get revision information out of your
       repository for reporting purposes.

   Cfg Plugin
       The  Cfg plugin provides a repository to describe configuration file contents for clients.
       In its simplest form, the Cfg repository is just a  directory  tree  modeled  off  of  the
       directory tree on your client machines.

   Cvs Plugin (experimental)
       The  Cvs  plugin  allows  you to track changes to your Bcfg2 repository using a Concurrent
       version control backend. Currently, it enables you to get revision information out of your
       repository for reporting purposes.

   Darcs Plugin (experimental)
       The  Darcs  plugin  allows  you  to  track  changes to your Bcfg2 repository using a Darcs
       version control backend. Currently, it enables you to get revision information out of your
       repository for reporting purposes.

   DBStats Plugin
       Direct to database statistics plugin.

   Decisions Plugin
       The  Decisions  plugin  has  support  for  a  centralized  set  of  per-entry installation
       decisions. This approach is needed when particular changes are deemed  "high  risk";  this
       gives  the  ability  to  centrally specify these changes, but only install them on clients
       when administrator supervision is available.

   Defaults Plugin
       The Defaults plugin can be used to populate default attributes for  entries.  Defaults  is
       not  a Generator plugin, so it does not actually bind an entry; Defaults are applied after
       an entry has been bound, and only populate attributes that are not yet set.

   Deps Plugin
       The Deps plugin allows you to make a series of assertions like "Package X requires Package
       Y (and optionally also Package Z etc.)"

   Editor Plugin
       The  Editor plugin attempts to allow you to partially manage configuration for a file. Its
       use is not recommended and not well documented.

   FileProbes Plugin
       The FileProbes plugin allows you to probe a client for a file, which is then added to  the
       Cfg  specification.  If the file changes on the client, FileProbes can either update it in
       the specification or allow Cfg to replace it.

   Fossil Plugin
       The Fossil plugin allows you to track changes to your Bcfg2 repository using a Fossil  SCM
       version control backend. Currently, it enables you to get revision information out of your
       repository for reporting purposes.

   Git Plugin
       The Git plugin allows you to track changes to your Bcfg2 repository using  a  Git  version
       control  backend.  Currently,  it  enables  you  to  get  revision information out of your
       repository for reporting purposes.

   GroupPatterns Plugin
       The GroupPatterns plugin is a connector that can assign clients group membership based  on
       patterns in client hostnames.

   Guppy Plugin
       The  Guppy  plugin  is  used  to  trace memory leaks within the bcfg2-server process using
       Guppy.

   Hg Plugin (experimental)
       The Hg plugin allows you to track changes to  your  Bcfg2  repository  using  a  Mercurial
       version control backend. Currently, it enables you to get revision information out of your
       repository for reporting purposes.

   Hostbase Plugin
       The Hostbase plugin is an IP management system built on top of Bcfg2.

   Ldap Plugin
       The Ldap plugin makes it possible to fetch data from an LDAP  directory,  process  it  and
       attach it to your metadata.

   Metadata Plugin
       The Metadata plugin is the primary method of specifying Bcfg2 server metadata.

   NagiosGen Plugin
       The NagiosGen plugin dynamically generates Nagios configuration files based on Bcfg2 data.

   Ohai Plugin (experimental)
       The  Ohai plugin is used to detect information about the client operating system. The data
       is reported back to the server using JSON.

   Packages Plugin
       The Packages plugin is an  alternative  to  Pkgmgr  for  specifying  package  entries  for
       clients.  Where  Pkgmgr explicitly specifies package entry information, Packages delegates
       control of package version information to the underlying package manager,  installing  the
       latest version available from through those channels.

   Pkgmgr Plugin
       The  Pkgmgr  plugin  resolves  the  Abstract  Configuration  Entity "Package" to a package
       specification that the client can use to detect, verify and install the specified package.

   POSIXCompat Plugin
       The POSIXCompat plugin provides a compatibility layer for 1.3 POSIX Entries so  that  they
       are compatible with older clients.

   Probes Plugin
       The Probes plugin gives you the ability to gather information from a client machine before
       you generate its configuration. This information can be used with the  various  templating
       systems to generate configuration based on the results.

   Properties Plugin
       The  Properties  plugin  is a connector plugin that adds information from properties files
       into client metadata instances.

   PuppetENC Plugin
       The PuppetENC plugin is a connector plugin that adds  support  for  Puppet  External  Node
       Classifiers.

   Reporting Plugin
       The Reporting plugin enables the collection of data for use with Bcfg2's dynamic reporting
       system.

   Rules Plugin
       The Rules  plugin  provides  literal  configuration  entries  that  resolve  the  abstract
       configuration  entries normally found in the Bundler and Base plugins. The literal entries
       in Rules are suitable for consumption by the appropriate client drivers.

   SEModules Plugin
       The SEModules plugin provides a way to distribute SELinux modules via Bcfg2.

   ServiceCompat Plugin
       The ServiceCompat plugin converts service entries for older clients.

   Snapshots Plugin
       The Snapshots plugin stores various aspects of a client’s state when the client checks  in
       to the server.

   SSHbase Plugin
       The  SSHbase  generator  plugin  manages ssh host keys (both v1 and v2) for hosts. It also
       manages the ssh_known_hosts file. It can integrate host keys from other management domains
       and similarly export its keys.

   SSLCA Plugin
       The  SSLCA  plugin  is  designed to handle creation of SSL privatekeys and certificates on
       request.

   Statistics
       The Statistics plugin is deprecated (see Reporting).

   Svn Plugin
       The Svn plugin allows you to track changes to your Bcfg2  repository  using  a  Subversion
       backend.  Currently, it enables you to get revision information out of your repository for
       reporting purposes.

   TCheetah Plugin
       The TCheetah plugin allows you to use the cheetah templating system to  create  files.  It
       also  allows  you  to  include the results of probes executed on the client in the created
       files.

   TGenshi Plugin
       The TGenshi plugin allows you to use the Genshi templating system to create files. It also
       allows you to include the results of probes executed on the client in the created files.

   Trigger Plugin
       The  Trigger  plugin  provides  a  method  for  calling  external scripts when clients are
       configured.

CACHING OPTIONS

       These options are specified in the [caching] section.

          client_metadata
                 The following four caching modes are available for client metadata:

                 · off: No caching of client metadata objects is performed. This is the default.

                 · initial: Only initial metadata objects are cached.  Initial  metadata  objects
                   are  created  only  from  the  data  in the Metadata plugin, before additional
                   groups from other plugins are merged in.

                 · cautious: Final metadata objects  are  cached,  but  each  client’s  cache  is
                   cleared  at  the  start  of  each  client run, immediately after probe data is
                   received. Cache is also cleared as in aggressive mode. on  is  a  synonym  for
                   cautious.

                 · aggressive:  Final metadata objects are cached. Each plugin is responsible for
                   clearing cache when appropriate.

CLIENT OPTIONS

       These options only affect client functionality. They can  be  specified  in  the  [client]
       section.

          decision
                 Specify  the server decision list mode (whitelist or blacklist).  (This settiing
                 will be ignored if the client is called with the -f option).

          drivers
                 Specify tool driver set to use. This option can be used  to  explicitly  specify
                 the client tool drivers you want to use when the client is run.

          paranoid
                 Run the client in paranoid mode.

          profile
                 Assert the given profile for the host.

COMMUNICATION OPTIONS

       Specified  in  the  [communication]  section.  These  options  define  settings  used  for
       client-server communication.

          ca     The path to a file containing the CA certificate. This file is required  on  the
                 server,  and  optional  on  clients.  However,  if  the cacert is not present on
                 clients, the server cannot be verified.

          certificate
                 The path to a file containing a PEM formatted certificate which  signs  the  key
                 with  the  ca  certificate. This setting is required on the server in all cases,
                 and required on clients if using client certificates.

          key    Specifies the path to a file containing the SSL Key. This  is  required  on  the
                 server in all cases, and required on clients if using client certificates.

          password
                 Required  on  both  the  server  and  clients.  On the server, sets the password
                 clients need to use to communicate. On a client, sets the  password  to  use  to
                 connect to the server.

          protocol
                 Communication protocol to use. Defaults to xmlrpc/ssl.

          retries
                 A client-only option. Number of times to retry network communication. Default is
                 3 retries.

          retry_delay
                 A client-only option. Number of seconds to  wait  in  between  retrying  network
                 communication. Default is 1 second.

          serverCommonNames
                 A  client-only  option.  A  colon-separated list of Common Names the client will
                 accept in the SSL certificate presented by the server.

          timeout
                 A client-only option. The network communication timeout.

          user   A client-only option. The UUID of the client.

COMPONENT OPTIONS

       Specified in the [components] section.

          bcfg2  URL of the server. On the server this specifies which  interface  and  port  the
                 server  listens  on. On the client, this specifies where the client will attempt
                 to contact the server.

                 e.g. bcfg2 = https://10.3.1.6:6789

          encoding
                 Text encoding of configuration files. Defaults to UTF-8.

          lockfile
                 The path to the client lock file, which is used to ensure that  only  one  Bcfg2
                 client runs at a time on a single client.

LOGGING OPTIONS

       Specified   in   the   [logging]   section.  These  options  control  the  server  logging
       functionality.

          debug  Whether or not to enable debug-level log output. Default is false.

          path   Server log file path.

          syslog Whether or not to send logging data to syslog. Default is true.

          verbose
                 Whether or not to enable verbose log output. Default is false.

MDATA OPTIONS

       Specified in the [mdata] section. These options affect the default metadata  settings  for
       Paths with type='file'.

          owner  Global owner for Paths (defaults to root)

          group  Global group for Paths (defaults to root)

          mode   Global permissions for Paths (defaults to 644)

          secontext
                 Global SELinux context for Path entries (defaults to __default__, which restores
                 the expected context)

          paranoid
                 Global paranoid settings for Paths (defaults to false)

          sensitive
                 Global sensitive settings for Paths (defaults to false)

          important
                 Global important settings for Paths. Defaults to false.

PACKAGES OPTIONS

       The following options are specified in the [packages] section.

          resolver
                 Enable dependency resolution. Default is 1 (true).

          metadata
                 Enable metadata processing. Default is 1 (true). If metadata is  disabled,  it’s
                 implied that resolver is also disabled.

          yum_config
                 The path at which to generate Yum configs. No default.

          apt_config
                 The path at which to generate APT configs. No default.

          gpg_keypath
                 The  path  on  the  client  where  RPM  GPG  keys will be copied before they are
                 imported on the client. Default is /etc/pki/rpm-gpg.

          version
                 Set the version attribute used when binding Packages. Default is auto.

       The following options are specified in the [packages:yum] section.

          use_yum_libraries
                 By default, Bcfg2 uses an internal implementation of Yum’s dependency resolution
                 and  other  routines so that the Bcfg2 server can be run on a host that does not
                 support Yum itself. If you run the Bcfg2 server on a machine that does have  Yum
                 libraries,  however,  you  can  enable use of those native libraries in Bcfg2 by
                 setting this to 1.

          helper Path to bcfg2-yum-helper. By default, Bcfg2 looks first in  $PATH  and  then  in
                 /usr/sbin/bcfg2-yum-helper for the helper.

       The following options are specified in the [packages:pulp] section.

          username
                 The  username  of a Pulp user that will be used to register new clients and bind
                 them to repositories.

          password
                 The password of a Pulp user that will be used to register new clients  and  bind
                 them to repositories.

       All  other  options in the [packages:yum] section will be passed along verbatim to the Yum
       configuration if you are using the native Yum library support.

PARANOID OPTIONS

       These options allow for finer-grained control of the paranoid mode on  the  Bcfg2  client.
       They are specified in the [paranoid] section of the configuration file.

          path   Custom   path   for  backups  created  in  paranoid  mode.  The  default  is  in
                 /var/cache/bcfg2.

          max_copies
                 Specify a maximum number of copies for  the  server  to  keep  when  running  in
                 paranoid mode. Only the most recent versions of these copies will be kept.

SNAPSHOTS OPTIONS

       Specified  in  the  [snapshots]  section.  These  options  control  the  server  snapshots
       functionality.

          driver sqlite

          database
                 The name of the database to use for statistics data.

                 e.g.: $REPOSITORY_DIR/etc/bcfg2.sqlite

SSLCA OPTIONS

       These options are necessary to configure  the  SSLCA  plugin  and  can  be  found  in  the
       [sslca_default] section of the configuration file.

          config Specifies the location of the openssl configuration file for your CA.

          passphrase
                 Specifies  the  passphrase  for  the  CA’s  private  key  (if  necessary). If no
                 passphrase exists, it is assumed that the private key is stored unencrypted.

          chaincert
                 Specifies the location of your ssl  chaining  certificate.  This  is  used  when
                 pre-existing  certifcate  hostfiles are found, so that they can be validated and
                 only regenerated if they no longer meet the specification.  If  you’re  using  a
                 self signing CA this would be the CA cert that you generated.

DATABASE OPTIONS

       Server-only,  specified  in  the  [database]  section.  These options control the database
       connection of the server.

          engine The database engine used by the statistics module. One of the following:

                     postgresql
                     mysql
                     sqlite3
                     ado_mssql

          name   The name of the database to use for statistics data. If 'database_engine' is set
                 to  'sqlite3'  this  is  a  file  path  to  the  sqlite  file  and  defaults  to
                 $REPOSITORY_DIR/etc/brpt.sqlite.

          user   User for database connections. Not used for sqlite3.

          password
                 Password for database connections. Not used for sqlite3.

          host   Host for database connections. Not used for sqlite3.

          port   Port for database connections. Not used for sqlite3.

          options
                 Various options for the database connection. The value is expected  as  multiple
                 key=value  pairs,  separated  with  commas.   The  concrete value depends on the
                 database engine.

REPORTING OPTIONS

          config Specifies  the   location   of   the   reporting   configuration   (default   is
                 /etc/bcfg2-web.conf.

          time_zone
                 Specifies  a  time zone other than that used on the system. (Note that this will
                 cause the Bcfg2 server to log messages in this time zone as well).

          web_debug
                 Turn on Django debugging.

SEE ALSO

       bcfg2(1), bcfg2-server(8)