1
2MUNGED(8)                 MUNGE Uid 'N' Gid Emporium                 MUNGED(8)
3
4
5

NAME

7       munged - MUNGE daemon
8
9

SYNOPSIS

11       munged [OPTION]...
12
13

DESCRIPTION

15       The munged daemon is responsible for authenticating local MUNGE clients
16       and servicing their credential encode & decode  requests.   All  munged
17       daemons  within  a security realm share a secret key.  This key is used
18       to protect the contents of a credential.
19
20       When a credential is created, munged embeds metadata within it  includ‐
21       ing  the  effective UID and GID of the requesting client (as determined
22       by munged) and the current time (as determined by the local clock).  It
23       then  compresses  the  data,  computes  a  message authentication code,
24       encrypts the data, and base64-encodes the result before  returning  the
25       credential to the client.
26
27       When a credential is validated, munged first checks the message authen‐
28       tication code to  ensure  the  credential  has  not  been  subsequently
29       altered.   Next,  it checks the embedded UID/GID restrictions to deter‐
30       mine whether the requesting client is allowed to decode it.   Then,  it
31       checks  the embedded encode time against the current time; if this dif‐
32       ference exceeds the embedded time-to-live, the credential has  expired.
33       Finally,  it checks whether this credential has been previously decoded
34       on this host; if so, the credential has been replayed.  If  all  checks
35       pass, the credential metadata and payload are returned to the client.
36
37

OPTIONS

39       -h, --help
40              Display a summary of the command-line options.
41
42       -L, --license
43              Display license information.
44
45       -V, --version
46              Display version information.
47
48       -f, --force
49              Force  the  daemon  to  run  if at all possible.  This overrides
50              warnings for an existing local domain socket, a lack of  entropy
51              for the PRNG, and insecure file/directory permissions.
52
53       -F, --foreground
54              Run the daemon in the foreground.
55
56       -S, --socket path
57              Specify the local domain socket for communicating with clients.
58
59       --auth-server-dir directory
60              Specify  an  alternate directory in which the daemon will create
61              the pipe used to authenticate clients.  The recommended  permis‐
62              sions for this directory are 0711.  This option is only valid on
63              platforms where client authentication is performed via  a  file-
64              descriptor passing mechanism.
65
66       --auth-client-dir directory
67              Specify  an alternate directory in which clients will create the
68              file used to authenticate themselves to the daemon.  The  recom‐
69              mended  permissions for this directory are 1733.  This option is
70              only valid on platforms where client authentication is performed
71              via a file-descriptor passing mechanism.
72
73       --group-check-mtime boolean
74              Specify  whether  the  modification time of /etc/group should be
75              checked before updating the supplementary group membership  map‐
76              ping.   If this value is non-zero, the check will be enabled and
77              the mapping will not be updated unless the file has  been  modi‐
78              fied since the last update.
79
80       --group-update-time integer
81              Specify  the number of seconds between updates to the supplemen‐
82              tary  group  membership  mapping;  this  mapping  is  used  when
83              restricting  credentials  by  GID.  A value of 0 causes it to be
84              computed initially but never  updated  (unless  triggered  by  a
85              SIGHUP).  A value of -1 causes it to be disabled.
86
87       --key-file file
88              Specify an alternate secret key file.
89
90       --num-threads integer
91              Specify the number of threads to spawn for processing credential
92              requests.
93
94

SIGNALS

96       SIGHUP Immediately update the supplementary  group  membership  mapping
97              instead  of  waiting for the next scheduled update; this mapping
98              is used when restricting credentials by GID.
99
100       SIGTERM
101              Terminate the daemon.
102
103
104

NOTES

106       All clocks within a security realm must be kept in sync within the cre‐
107       dential time-to-live setting.
108
109       While  munged  prevents a given credential from being decoded on a par‐
110       ticular host more than once, nothing prevents a credential  from  being
111       decoded on multiple hosts within the security realm before it expires.
112
113

AUTHOR

115       Chris Dunlap <cdunlap@llnl.gov>
116
117

119       Copyright (C) 2007-2010 Lawrence Livermore National Security, LLC.
120       Copyright (C) 2002-2007 The Regents of the University of California.
121
122       MUNGE  is free software: you can redistribute it and/or modify it under
123       the terms of the GNU General Public License as published  by  the  Free
124       Software  Foundation,  either  version  3  of  the License, or (at your
125       option) any later version.  Additionally for the  MUNGE  library  (lib‐
126       munge), you can redistribute it and/or modify it under the terms of the
127       GNU Lesser General Public License as published  by  the  Free  Software
128       Foundation,  either  version  3 of the License, or (at your option) any
129       later version.
130
131

SEE ALSO

133       munge(1),    remunge(1),    unmunge(1),     munge(3),     munge_ctx(3),
134       munge_enum(3), munge(7).
135
136       http://home.gna.org/munge/
137
138
139
140munge-0.5.9                       2010-03-23                         MUNGED(8)
Impressum