NAME

       system.rootdaemonrc, .rootdaemonrc - access control directives for ROOT daemons

LOCATIONS

       ROOTDAEMORC, $HOME/.rootdaemonrc
       /etc/root/system.rootdaemonrc, $ROOTSYS/etc/system.rootdaemonrc

DESCRIPTION

       This  manual  page documents the format of directives specifying access control directives
       for ROOT daemons. These directives are read from a text file whose full path is taken from
       the  environment variable ROOTDAEMONRC.  If such a variable in undefined, the daemon looks
       for a file named .rootdaemonrc in the $HOME directory of the user starting the daemon;  if
       this file does not exists either, the file system.rootdaemonrc, located under /etc/root or
       $ROOTSYS/etc, is used.  If none of these file exists (or is readable),  the  daemon  makes
       use  of  a  default  built-in  directive  derived  from  the  configuration options of the
       installation.

FORMAT

       *      lines starting with '#' are comment lines.

       *      hosts can specified either with their  name  (e.g.  pcepsft43),  their  FQDN  (e.g.
              pcepsft43.cern.ch) or their IP address (e.g. 137.138.99.73).

       *      host  names  can  be  followed  by  :rootd,  :proofd or :sockd to define directives
              applying only to the given service; 'sockd' applies to servers run from interactive
              sessions (TServerSocket class)

       *      directives applying to all host can be specified either by 'default' or '*'

       *      the  '*'  character  can  be  used  in  any  field of the name to indicate a set of
              machines or domains, e.g. pcepsft*.cern.ch applies to all 'pcepsft' machines in the
              domain   'cern.ch'.   (to   indicate   all   'lxplus'   machines   you  should  use
              'lxplus*.cern.ch' because internally the generic lxplus machine has a real name  of
              the  form  lxplusnnn.cern.ch;  you  can  also  use 'lxplus' if you don't care about
              domain name checking).

       *      a whole domain can be indicated by its  name,  e.g.  'cern.ch',  'cnaf.infn.it'  or
              '.ch'

       *      truncated  IP  address  can  also  be  used to indicate a set of machines; they are
              interpreted as the very first or very last part of the  address;  for  example,  to
              select  137.138.99.73,  any  of  these  is  valid:  '137.138.99', '137.138', '137`,
              '99.73'; or with wild cards: '137.13*' or '*.99.73`; however, '138.99'  is  invalid
              because ambiguous.

       *      the information following the name or IP address indicates, in order of preference,
              the short names or the  internal  codes  of  authentication  methods  accepted  for
              requests coming from the specified host(s); the ones implemented so far are:

                 Method                           nickname    code

                 UsrPwd                            usrpwd       0
                 SRP                               srp          1
                 Kerberos                          krb5         2
                 Globus                            globus       3
                 SSH                               ssh          4
                 UidGid                            uidgid       5   (insecure)

              (The  insecure  method is intended to speed up access within a cluster protected by
              other means from outside attacks; should not be used for  inter-cluster  or  inter-
              domain  authentication). Methods non specified explicitly are not accepted. For the
              insecure method it is possible to give access only to a specific list of  users  by
              specifying the usernames after the method separated by colons (:) example:

                 uidgid:user1:user2:user3

              will  allow  uidgid  access only to users user1, user2 and user3. This is useful to
              give easy access to data servers. It is also possible to deny access to a  user  by
              using a '-' in front of the name:

                 uidgid:-user4

       *      Lines  ending  with  '´  are followed by additional information for the host on the
              next line; the name of the host should not be repeated.

EXAMPLES

       Valid examples:

       default none
              All requests are denied unless specified by dedicated directives.

       default 0 ssh
              Authentication mechanisms allowed by default are 'usrpwd' (code 0) and 'ssh'

       137.138. 0 4
              Authentication mechanisms allowed from host in the domain  137.138.  (cern.ch)  are
              'usrpwd' (code 0) and 'ssh'

       pceple19.cern.ch 4 1 3 2 5 0
              All mechanisms are accepted for requests coming from host pceple19.cern.ch .

       lxplus*.cern.ch 4 1 globus 0:qwerty:uytre
              Requests  from the lxplus cluster can authenticate using 'ssh', 'srp' and 'globus';
              users 'qwerty' and 'uytre' can also use 'usrpwd' .

       pcep*.cern.ch:rootd 0:-qwerty 4
              Requests from the pcep*.cern.ch nodes can authenticate  using  'usrpwd'  and  'ssh'
              when accessing the 'rootd' daemon ; user 'qwerty' can only use 'ssh'.

SEE ALSO

       rootd(1), proofd(1)

       For more information on the ROOT system, please refer to http://root.cern.ch/ .

ORIGINAL AUTHORS

       The ROOT team (see web page above):
              Rene Brun and Fons Rademakers

COPYRIGHT

       This library is free software; you can redistribute it and/or modify it under the terms of
       the GNU Lesser General Public License as published by the Free Software Foundation; either
       version 2.1 of the License, or (at your option) any later version.

       This  library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
       without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR  PURPOSE.
       See the GNU Lesser General Public License for more details.

       You  should  have received a copy of the GNU Lesser General Public License along with this
       library; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
       Boston, MA  02110-1301  USA

AUTHOR

       This manual page was written by G. Ganis <g.ganis@cern.ch> .