![[tokkee]](http://tokkee.org/images/avatar.png){kind=avatar}
diff --git a/doc/rrdcached.txt b/doc/rrdcached.txt
index a550a5613af4ce7025839b4f7df1e03f41e2b9cd..2caaacd31b64c7448d05d2ae4a298e8e192bb5d6 100644 (file)
--- a/doc/rrdcached.txt
+++ b/doc/rrdcached.txt
rrdcached - Data caching daemon for rrdtool
S\bSY\bYN\bNO\bOP\bPS\bSI\bIS\bS
- r\brr\brd\bdc\bca\bac\bch\bhe\bed\bd [-\b-P\bP _\bp_\be_\br_\bm_\bi_\bs_\bs_\bi_\bo_\bn_\bs] [-\b-l\bl _\ba_\bd_\bd_\br_\be_\bs_\bs] [-\b-w\bw _\bt_\bi_\bm_\be_\bo_\bu_\bt] [-\b-z\bz _\bd_\be_\bl_\ba_\by]
- [-\b-f\bf _\bt_\bi_\bm_\be_\bo_\bu_\bt] [-\b-p\bp _\bp_\bi_\bd_\b__\bf_\bi_\bl_\be] [-\b-t\bt _\bw_\br_\bi_\bt_\be_\b__\bt_\bh_\br_\be_\ba_\bd_\bs] [-\b-j\bj _\bj_\bo_\bu_\br_\bn_\ba_\bl_\b__\bd_\bi_\br] [-F]
- [-g] [-\b-b\bb _\bb_\ba_\bs_\be_\b__\bd_\bi_\br [-\b-B\bB]]
+ r\brr\brd\bdc\bca\bac\bch\bhe\bed\bd [-\b-P\bP _\bp_\be_\br_\bm_\bi_\bs_\bs_\bi_\bo_\bn_\bs] [-\b-l\bl _\ba_\bd_\bd_\br_\be_\bs_\bs] [-\b-s\bs _\bg_\br_\bo_\bu_\bp] [-\b-w\bw _\bt_\bi_\bm_\be_\bo_\bu_\bt]
+ [-\b-z\bz _\bd_\be_\bl_\ba_\by] [-\b-f\bf _\bt_\bi_\bm_\be_\bo_\bu_\bt] [-\b-p\bp _\bp_\bi_\bd_\b__\bf_\bi_\bl_\be] [-\b-t\bt _\bw_\br_\bi_\bt_\be_\b__\bt_\bh_\br_\be_\ba_\bd_\bs]
+ [-\b-j\bj _\bj_\bo_\bu_\br_\bn_\ba_\bl_\b__\bd_\bi_\br] [-F] [-g] [-\b-b\bb _\bb_\ba_\bs_\be_\b__\bd_\bi_\br [-\b-B\bB]]
D\bDE\bES\bSC\bCR\bRI\bIP\bPT\bTI\bIO\bON\bN
r\brr\brd\bdc\bca\bac\bch\bhe\bed\bd is a daemon that receives updates to existing RRD files,
on that socket. If _\ba_\bd_\bd_\br_\be_\bs_\bs begins with "unix:", everything
following that prefix is interpreted as the path to a UNIX domain
socket. Otherwise the address or node name are resolved using
- getaddrinfo.
+ "getaddrinfo()".
For network sockets, a port may be specified by using the form
"[\b[_\ba_\bd_\bd_\br_\be_\bs_\bs]\b]:\b:_\bp_\bo_\br_\bt_\b". If the address is an IPv4 address or a fully
qualified domain name (i. e. the address contains at least one dot
(".")), the square brackets can be omitted, resulting in the
- (simpler) "_\ba_\bd_\bd_\br_\be_\bs_\bs:\b:_\bp_\bo_\br_\bt_\b" pattern. The default port is 4\b42\b22\b21\b17\b7/\b/u\bud\bdp\bp. If
+ (simpler) "_\ba_\bd_\bd_\br_\be_\bs_\bs:\b:_\bp_\bo_\br_\bt_\b" pattern. The default port is 4\b42\b22\b21\b17\b7/\b/t\btc\bcp\bp. If
you specify a network socket, it is mandatory to read the "SECURITY
CONSIDERATIONS" section.
If the -\b-l\bl option is not specified the default address,
"unix:/tmp/rrdcached.sock", will be used.
+ -\b-s\bs _\bg_\br_\bo_\bu_\bp_\b__\bn_\ba_\bm_\be|_\bg_\bi_\bd
+ Set the group permissions of a UNIX domain socket. The option
+ accepts either a numeric group id or group name. That group will
+ then have both read and write permissions (the socket will have
+ file permissions 0750) for the socket and, therefore, is able to
+ send commands to the daemon. This may be useful in cases where you
+ cannot easily run all RRD processes with the same user privileges
+ (e.g. graph generating CGI scripts that typically run in the
+ permission context of the web server).
+
+ This option affects the _\bf_\bo_\bl_\bl_\bo_\bw_\bi_\bn_\bg UNIX socket addresses (the
+ following -\b-l\bl options) or the default socket (if no -\b-l\bl options have
+ been specified), i.e., you may specify different settings for
+ different sockets.
+
+ The default is not to change ownership or permissions of the socket
+ and, thus, use the system default.
+
+ -\b-m\bm _\bm_\bo_\bd_\be
+ Set the file permissions of a UNIX domain socket. The option
+ accepts an octal number representing the bit pattern for the mode
+ (see _\bc_\bh_\bm_\bo_\bd(1) for details).
+
+ Please note that not all systems honor this setting. On Linux,
+ read/write permissions are required to connect to a UNIX socket.
+ However, many BSD-derived systems ignore permissions for UNIX
+ sockets. See _\bu_\bn_\bi_\bx(7) for details.
+
+ This option affects the _\bf_\bo_\bl_\bl_\bo_\bw_\bi_\bn_\bg UNIX socket addresses (the
+ following -\b-l\bl options) or the default socket (if no -\b-l\bl options have
+ been specified), i.e., you may specify different settings for
+ different sockets.
+
+ The default is not to change ownership or permissions of the socket
+ and, thus, use the system default.
+
-\b-P\bP _\bc_\bo_\bm_\bm_\ba_\bn_\bd[,_\bc_\bo_\bm_\bm_\ba_\bn_\bd[,...]]
Specifies the commands accepted via a network socket. This allows
administrators of _\bR_\bR_\bD_\bC_\ba_\bc_\bh_\be_\bD to control the actions accepted from
rrdcached -P FLUSH,PENDING $MORE_ARGUMENTS
- The -\b-P\bP option effects the _\bf_\bo_\bl_\bl_\bo_\bw_\bi_\bn_\bg socket addresses (the following
- -\b-l\bl options). In the following example, only the IPv4 network socket
+ The -\b-P\bP option affects the _\bf_\bo_\bl_\bl_\bo_\bw_\bi_\bn_\bg socket addresses (the following
+ -\b-l\bl options) or the default socket (if no -\b-l\bl options have been
+ specified). In the following example, only the IPv4 network socket
(address 10.0.0.1) will be restricted to the "FLUSH" and "PENDING"
commands:
S\bSE\bEC\bCU\bUR\bRI\bIT\bTY\bY C\bCO\bON\bNS\bSI\bID\bDE\bER\bRA\bAT\bTI\bIO\bON\bNS\bS
A\bAu\but\bth\bhe\ben\bnt\bti\bic\bca\bat\bti\bio\bon\bn
- There is no authentication.
+ If your rrdtool installation was built without libwrap there is no form
+ of authentication for clients connecting to the rrdcache daemon!
- The client/server protocol does not yet have any authentication
- mechanism. It is likely that authentication and encryption will be
- added in a future version, but for the time being it is the
- administrator's responsibility to secure the traffic from/to the
- daemon!
+ If your rrdtool installation was built with libwrap then you can use
+ hosts_access to restrict client access to the rrdcache daemon
+ (rrdcached). For more information on how to use hosts_access to
+ restrict access to the rrdcache daemon you should read the
+ _\bh_\bo_\bs_\bt_\bs_\b__\ba_\bc_\bc_\be_\bs_\bs(5) man pages.
- It is highly recommended to install a packet filter or similar
+ It is still highly recommended to install a packet filter or similar
mechanism to prevent unauthorized connections. Unless you have a
dedicated VLAN or VPN for this, using network sockets is probably a bad
idea!
-1.4.2 2009-11-15 RRDCACHED(1)
+1.4.8 2013-05-23 RRDCACHED(1)