NAME

       system.rootdaemonrc, .rootdaemonrc - access control directives for ROOT daemons

LOCATIONS

       ROOTDAEMORC, $HOME/.rootdaemonrc
       /etc/root/system.rootdaemonrc, $ROOTSYS/etc/system.rootdaemonrc

DESCRIPTION

       This  manual  page  documents  the  format  of  directives  specifying access control directives for ROOT
       daemons. These directives are read from a text file  whose  full  path  is  taken  from  the  environment
       variable  ROOTDAEMONRC.  If such a variable in undefined, the daemon looks for a file named .rootdaemonrc
       in the $HOME directory of the user starting the daemon; if this file does not  exists  either,  the  file
       system.rootdaemonrc,  located under /etc/root or $ROOTSYS/etc, is used.  If none of these file exists (or
       is readable), the daemon makes use of a default built-in directive derived from the configuration options
       of the installation.

FORMAT

       *      lines starting with '#' are comment lines.

       *      hosts  can  specified either with their name (e.g. pcepsft43), their FQDN (e.g. pcepsft43.cern.ch)
              or their IP address (e.g. 137.138.99.73).

       *      host names can be followed by :rootd, :proofd or :sockd to define directives applying only to  the
              given service; 'sockd' applies to servers run from interactive sessions (TServerSocket class)

       *      directives applying to all host can be specified either by 'default' or '*'

       *      the  '*'  character can be used in any field of the name to indicate a set of machines or domains,
              e.g. pcepsft*.cern.ch applies to all 'pcepsft' machines in the domain 'cern.ch'. (to indicate  all
              'lxplus'  machines  you should use 'lxplus*.cern.ch' because internally the generic lxplus machine
              has a real name of the form lxplusnnn.cern.ch; you can also use 'lxplus' if you don't  care  about
              domain name checking).

       *      a whole domain can be indicated by its name, e.g. 'cern.ch', 'cnaf.infn.it' or '.ch'

       *      truncated  IP  address can also be used to indicate a set of machines; they are interpreted as the
              very first or very last part of the address; for example, to select 137.138.99.73, any of these is
              valid:  '137.138.99',  '137.138',  '137`,  '99.73';  or  with  wild cards: '137.13*' or '*.99.73`;
              however, '138.99' is invalid because ambiguous.

       *      the information following the name or IP address indicates, in  order  of  preference,  the  short
              names  or  the  internal  codes  of  authentication  methods accepted for requests coming from the
              specified host(s); the ones implemented so far are:

                 Method                           nickname    code

                 UsrPwd                            usrpwd       0
                 SRP                               srp          1
                 Kerberos                          krb5         2
                 Globus                            globus       3
                 SSH                               ssh          4
                 UidGid                            uidgid       5   (insecure)

              (The insecure method is intended to speed up access within a cluster protected by other means from
              outside attacks; should not be used for inter-cluster or inter-domain authentication). Methods non
              specified explicitly are not accepted. For the insecure method it is possible to give access  only
              to  a  specific list of users by specifying the usernames after the method separated by colons (:)
              example:

                 uidgid:user1:user2:user3

              will allow uidgid access only to users user1, user2 and user3. This is useful to give easy  access
              to data servers. It is also possible to deny access to a user by using a '-' in front of the name:

                 uidgid:-user4

       *      Lines  ending  with  '´  are followed by additional information for the host on the next line; the
              name of the host should not be repeated.

EXAMPLES

       Valid examples:

       default none
              All requests are denied unless specified by dedicated directives.

       default 0 ssh
              Authentication mechanisms allowed by default are 'usrpwd' (code 0) and 'ssh'

       137.138. 0 4
              Authentication mechanisms allowed from host in the domain 137.138. (cern.ch) are 'usrpwd' (code 0)
              and 'ssh'

       pceple19.cern.ch 4 1 3 2 5 0
              All mechanisms are accepted for requests coming from host pceple19.cern.ch .

       lxplus*.cern.ch 4 1 globus 0:qwerty:uytre
              Requests  from the lxplus cluster can authenticate using 'ssh', 'srp' and 'globus'; users 'qwerty'
              and 'uytre' can also use 'usrpwd' .

       pcep*.cern.ch:rootd 0:-qwerty 4
              Requests from the pcep*.cern.ch nodes can authenticate using 'usrpwd' and 'ssh' when accessing the
              'rootd' daemon ; user 'qwerty' can only use 'ssh'.

SEE ALSO

       rootd(1), proofd(1)

       For more information on the ROOT system, please refer to http://root.cern.ch/ .

ORIGINAL AUTHORS

       The ROOT team (see web page above):
              Rene Brun and Fons Rademakers

COPYRIGHT

       This library is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser
       General Public License as published by the Free Software Foundation; either version 2.1 of  the  License,
       or (at your option) any later version.

       This  library  is  distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even
       the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser  General
       Public License for more details.

       You should have received a copy of the GNU Lesser General Public License along with this library; if not,
       write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA

AUTHOR

       This manual page was written by G. Ganis <g.ganis@cern.ch> .