NAME

       eurephia-variables - eurephia configuration variables

DESCRIPTION

       Overview  over  all  eurephia  configuration variables.  These variables are stored in the
       database and can be modified by the eurephiadm config command.

PASSWORD HASH

       These variables are related to the password hash configuration.  All of them must be  set,
       but  they  can  be  changed  over  time without affecting the functionality of the already
       stored passwords.

       These parameters are the first to be set when  eurephia_init  is  run.   The  minimum  and
       maximum  hash  rounds  are bechmarked for you with this tool to find more suitable numbers
       for the hardware eurephia will be running on.

       passwordhash_salt_length
              Sets number of bytes to use for the password hash salt.

       passwordhash_rounds_min
              Sets the minimum number of hashing rounds to perform when calculating new  password
              hashes.

       passwordhash_rounds_max
              Sets  the maximum number of hashing rounds to perform when calculating new password
              hashes

ATTEMPTS SETTINGS

       eurephia can blacklist user names, certificates and IP addresses based on number of failed
       attempts.   The  following  parameters  defines  the  limits  of how many attempts you are
       willing to allow before blacklisting them.

       allow_cert_attempts
              Defines the number of attempts of failed login attempts you allow before  you  will
              blacklist  the OpenVPN clients cerrtificate.  This number should normally be higher
              than allow_username_attempts. Default is 5.

       allow_username_attempts
              Defines the number of failed ttempts for a user name can be tried before  you  will
              blacklist the user name from further attempts.  Default is 3.

       allow_ipaddr_attempts
              Defines  the number of failed attempts for an IP address to be used before you will
              blacklist the IP address from further attempts.   This  one  should  be  the  least
              strictest limit.  You also need to consider if your clients will log in via a proxy
              or NATed network and how many of your clients will do so.  If you  experience  many
              users  failing to log on and more of them are behind the same proxy or NAT gateway,
              this may blacklist the IP address quicker than intended.  But if among many failing
              attempts  a valid authentication happens, the attempts counter will be reset again,
              so this limit do not need to be too forgiving.  Default is 10.

FIREWALL INTEGRATION

       If you are running the OpenVPN server with eurephia on a Linux server, it is  possible  to
       let  eurephia interact with the firewall as well.  These settings will enable the firewall
       integration and tell eurephia how to interact with the  firewall.   These  parameters  are
       very  iptables oriented.  The iptables firewall module must be enabled at compile time and
       be installed to work.

       firewall_interface
              This is the variable which enables firewall integration. This variable  must  point
              at  the  firewall  driver,  which  is a shared object file which eurephia will load
              dynamically.  These drivers are prefixed efw and will be found in the same  lib  or
              lib64  directory  as  the  eurephia-auth and edb-sqlite modules.  The variable must
              contain the full path to the driver module.

       firewall_command
              This defines the binary the  firewall  module  will  execute  to  help  update  the
              firewall.  For iptables this defaults to /sbin/iptables.

       firewall_destination
              Defines  which  predefined  firewall  rule  to use when updating the firewall.  The
              default value is vpn_users.

       firewall_blacklist_destination
              This activates firewall based IP address blacklisting in addition to  the  internal
              blacklist  in  eurephia.   This  variable  defines  which firewall rule to use when
              wanting to blacklist an IP address.

       firewall_blacklist_send_to
              This is an optional parameter.  Normally when eurephia blacklists an IP address  it
              will  default  to  drop  the  network  packets  from  that client. You can use this
              variable to send it to a different firewall target.  This is useful if you to,  for
              example, log the incident to the system log before dropping the packets.

EUREPHIA UTILITIES

       These settings are used by the eurephia administration utility, eurephiadm.

       eurephiadmin_autologout
              This  defines  how  long a eurephia administration utility may have an open session
              before it is considered inactive.  When exceeding  this  limit,  the  administrator
              user  will  be  out  automatically.   The  unit for this setting is minutes and the
              default value is 10.

       eurephiadm_xslt_path
              The eurephiadm utility uses XSLT templates for generating the output to the screen.
              This  variable  gives  you  the  possibility to have your own set of templates in a
              different directory instead of using the system wide XSLT  templates  installed  by
              default.  This variable is not set by default.

OPENVPN RELATED VARIABLES

       openvpn_devtype
              The  eurephia-auth  plug-in  will try to auto-detect the device type, which must be
              either tun or tap.  If this auto-detection fails, this configuration variable needs
              to be set to tun or tap.  This value must correspond to the OpenVPN configuration.

SEE ALSO

       eurephiadm-config(7), eurephia_init(7),
       Administrators Tutorial and Manual

AUTHOR

       Copyright (C) 2008-2012  David Sommerseth <dazo@users.sourceforge.net>