.\" No comment!
.\"
.TH RSSH.CONF 5 "7 Jul 2003" "man pages" "Derek D. Martin"
.SH NAME 
@sysconfdir@/rssh.conf \- configuration file for rssh
.SH OVERVIEW
.B rssh.conf
is the configuration file for \fBrssh\fP.  It allows the system administrator
to control the behavior of the shell.  Configuration keywords are either used
by themselves on a line, or followed by an equal sign ('=') and a
configuration value.  Comments start with a hash ('#') and can occur anywhere
on the line.  Configuration options are case insensitive. Spaces at the
beginning or end of line, or between the equal sign and the configuration
keywords or values are ignored.  If the value of a configuration option
contains spaces, it (or at least the space) must be enclosed in either single
or double quotes.
.P
A default configuration file is provided with the source distribution of
\fBrssh\fP.  If no configuration file is used, rssh will assume a default
umask of 022, and allow only \fIscp\fP.  If a config file is present, the
default is to lock out users if neither scp nor sftp have been explicitly
allowed.
.P
New in v2.1 is the ability to configure options on a per-user basis, using the
user keyword.  More details are below.

.SH CONFIGURATION KEYWORDS 
.B allowscp
.RS
Tells the shell that scp is allowed.
.RE
.P
.B allowsftp
.RS
Tells the shell that sftp is allowed.
.RE
.P
.B allowcvs
.RS
Tells the shell that cvs is allowed.
.RE
.P
.B allowrdist
.RS
Tells the shell that rdist is allowed.
.RE
.P
.B allowrsync
.RS
Tells the shell that rsync is allowed.
.RE
.P
.B allowsvnserve
.RS
Tells the shell that svnserve is allowed.
.RE
.P
.B umask
.RS
Sets the umask value for file creations in the scp/sftp session.  This is
normally set at login time by the user's shell.  In order not to use the
system default, \fBrssh\fP must set the umask.
.RE
.P
.B logfacility
.RS
Allows the system administrator to control what syslog facility
.B rssh
logs to.  The facilities are the same as those used by \fIsyslogd.conf\fP(5),
or the C macros for the facilities can be used instead.  For example:
.P
logfacility=user
.br
logfacility=LOG_USER
.P
are equivalent, and tell
.B rssh
to use the user facility for logging to syslog.
.RE
.P
.B chrootpath
.RS
Causes \fBrssh\fP (actually a helper program) to call the 
.I chroot() 
system call, changing the root of the file system to whatever directory is
specified.  Note that the value on the right hand side of the equal sign is
the name of a directory, not a command.  For example:
.P
chrootpath=/usr/chroot
.P
will change the root of the virtual file system to /usr/chroot, preventing the
user from being able to access anything below /usr/chroot in the file system,
and making /usr/chroot appear to be the root directory.  Care must be taken to
set up a proper chroot jail; see the file CHROOT in the rssh source
distribution for hints about how to do this.  See also the \fIchroot\fP(2) man
page.
.P
If the user's home directory (as specified in \fI/etc/passwd\fP) is underneath
the path specified by this keyword, then the user will be chdir'd into their
home directory.  If it is not, then they will be chdir'd to the root of the
chroot jail.
.P
In other words, if the jail is \fI/chroot\fP, and your user's home directory
is \fI/chroot/home/user\fP, then once \fBrssh_chroot_helper\fP changes the
root of the system, it will cd into \fI/home/user\fP inside the jail.
However, if your user's home directory is given as \fI/home/user\fP in
\fI/etc/passwd\fP, then even if that directory exists in the jail, the chroot
helper will not try to cd there.  The user's normal home directory must live
inside the jail for this to work.
.RE
.P
.B user
.RS
The user keyword allows for the configuration of options on a per-user basis.
.I THIS KEYWORD OVERRIDES ALL OTHER KEYWORDS FOR THE SPECIFIED USER.
That is, if you use a user keyword for user foo, then foo will use only the
settings in that user line, and not any of the settings set with the keywords
above.  The user keyword's argument consists of a group of fields separated by
a colon (':'), as shown below.  The fields are, in order:
.P
.B username
.RS
The username of the user for whom the entry provides options
.RE
.B umask
.RS
The umask for this user, in octal, just as it would be specified to the shell
.RE
.B access bits
.RS
Six binary digits, which indicate whether the user is allowed to use rsync,
rdist, cvs, sftp, scp and svnserve, in that order.  One means the command is
allowed, zero means it is not.
.RE
.B path
.RS
The \fIdirectory\fP to which this user should be chrooted (this is not a
command, it is a directory name).  See \fBchroot_path\fP above for complete
details.
.RE
.P
For example, you might have something like this:
.P
user = luser:022:000010:
.P
This does the following: for the user with the username "luser", set the umask
to 022, disallow sftp, and allow scp.  Because there is no chroot path
specified, the user will 
.I not 
be chrooted, 
.I regardless of default options set with the keywords above.
If you wanted this user to be chrooted, you would need to specify the chroot
path explicitly, even if it should be the same as that set using the
chrootpath keyword.  Remember that if there are spaces in the path, you need
to quote it, something like this:
.P
user = "luser:022:000010:/usr/local/chroot dir"
.P
See the default rssh.conf file for more examples.
.RE

.SH SEE ALSO
\fIrssh\fP(1), \fIsshd\fP(8), \fIssh\fP(1), \fIscp\fP(1), \fIsftp\fP(1),
\fIsvnserve\fP(8), \fIsyslogd.conf\fP(5), \fIchroot\fP(2).


