Net::NetReg::Variables - provides global settings for NetReg registration system
use Net::NetReg::Variables;
This module acts as a deployment descriptor for NetReg. All customized settings
and variables are stored here.
Some settings require IP addresses or fully-qualified domain names. Many settings
are either 0 (off) or 1 (on). Sample values are provided.
- AUTH_METHOD
-
Determines which authentication method should be used by users during the registraion
process. Possible methods include FTP, POP, IMAP, LDAP or RADIUS.
- POPSERVER
-
The IP address of the POP server to be used for authentication. Only needs to be
specified if POP is the selected AUTH_METHOD. The the Mail::POP3Client manpage module is
used for actual authentication of user credentials.
- FTPSERVER
-
The IP address of the FTP server to be used for authentication. Only needs to be
specified if FTP is the selected AUTH_METHOD. The the Net::FTP manpage module is used for
actual authentication of user credentials.
- IMAPSERVER
-
The IP address of the IMAP server to be used for authentication. Only needs to be
specified if IMAP is the selected AUTH_METHOD. The the Net::IMAP::Simple manpage module is
used for actual authentication of user credentials.
- LDAP_SERVERS
-
A list of all LDAP servers to be used for authentication. Only needs to be
specificed if LDAP is the selected AUTH_METHOD. The the Net::LDAP manpage module is used
for actual authentication of user credentials. Follow dotted-quad IP addresses
or FQDNs with :<port> to override the default port. A random server will be
tried first. If no response is received with LDAP_TIMEOUT seconds, a random
server from the remaining servers in the list will be chosen until no more
servers remain to be tried. This results is some failover capabilities as
well as crude load-balancing.
- LDAP_USE_SSL
-
A flag, which if turned on will cause an LDAPS URI to be constructed for
the connection. This will cause a different default port to be used.
- LDAP_PORT
-
The default port for LDAP servers. The normal TCP port for LDAP connections
is TCP port 389, while for LDAPS connections it is TCP port 636.
- LDAP_TIMEOUT
-
How many seconds to wait to failover to next server following a connection
failure.
- LDAP_BASE
-
The searchbase where the DNs of registering users can be found in the
LDAP DIT. This can be used to restrict which users can register. If
you are using ADS (Microsoft's Active Directory Server), this is not
referenced.
- LDAP_AUTH_ATTR
-
This specifies which attribute in the user's entry matches their
username. Typically this will be
uid
, or perhaps cn
.
- LDAP_BIND_ANON
-
Whether to bind anonymously for searches. If you have a protected
branch of your DIT for students who exercised their FERPA rights, for
example, you might then need turn this off and specify credentials for
searching that would include access to that branch.
- LDAP_BIND_CREDENTIALS
-
Credentials for non-anonymous binding, if needed. This should only be
needed if you do not allow public access to your LDAP directory.
Rarely needed.
- LDAP_USES_PASSTHRU_AUTH
-
Set if your LDAP server uses pass-thru authentication, *and*
you need to re-map
part(s)
of the DIT. For example, the DIT
may not match the authentication server's DIT; this allows
re-writing of the dn to match.
- LDAP_DIT_MAP
-
Pairs of elements: lefthand side is what you expect to see returned
in the search, and the righthand side is what it should be re-mapped
to to match the authenticating server.
- LDAP_USE_ADS
-
Set if you wish to use Microsoft's Active Directory Server as your
authentication source
- LDAP_ADS_DOMAIN
-
ADS can authenticate using user@domain form. This is what is used,
rather than the normal two-step process for LDAP: search for the entry
matching the LDAP_AUTH_ATTR and the supplied username, then bind
against the directory using the DN of that entry and the supplied
password. Instead, with ADS, the domain is appended to the username
and we bind directly using the supplied password
- RADIUS_SVRS
-
List of all RADIUS servers as a comma-separated list of quoted strings
If special ports are needed, use a.b.c.d:port to override the
default port. As with LDAP servers, selection is randomized, with
failover after RADIUS_TIMEOUT seconds, again providing a failover
mechanism and crude load-balancing.
- RADIUS_SECRET
-
The shared secret for the RADIUS server.
- RADIUS_TIMEOUT
-
How long to wait to failover to next server after a connection failure
- USE_NESSUS
-
A flag to turn on Nessus scanning capabilities
- NESSUS_USER
-
The username to be used when binding to the Nessus scanner
- NESSUS_PASS
-
The password to be used when binding to the Nessus scanner
- NESSUS_HOST
-
The IP address or FQDN of the Nessus host
- NESSUS_PORT
-
The port the Nessus scanner is listening on for connections;
by default this is TCP port 1214.
- NESSUS_SSL
-
A flag indicating whether or not a secure connection to the Nessus
host should be used.
- NESSUS_PLUGIN
-
A semicolon-separated list of plugins to use for host attacks.
- MAXREG
-
Maximum number of registrations per user. Zero is unlimited.
- MRSUB
-
The subnet from which manual registration are allowed in the admin
CGI script. The admin CGI script should be protected through some
mechanism anyway, but this provides an extra layer of defense. The
subnet is specified in CIDR notation. A single host would be indicated
by using a /32 mask.
- UIDLEN
-
Maximum length of usernames for the manual registration form. Malicious
long strings could have unexpected side-effects if allowed into your
DHCP configuration.
- AUTH_LC_USERNAME
-
Turn on if you want all usernames to be sent as lowercase. Since the
display of some information is sorted by usernames in the admin CGI
script, ensuring uniformity, when possible, assures correctly displayed
information.
- GFX
-
The path from the web server root to the graphics directory for NetReg
image files.
- HELPDESK
-
The path to a limited-functionality script for helpdesk personnel. Not
yet implemented.
- LEASESPATH
-
The file system path to the directory holding the DHCP leases file.
- LEASESFILE
-
The name of the DHCP leases file. The user running the web server
must have read access to this file.
- DHCPDCONFPATH
-
The file system path to the directory holding the DHCP configuration
file used to store host registrations.
- DHCPDCONFFILE
-
The name of the file used to store host registrations. This should
point to the file that will be included into the actual dhcpd.conf
file, NOT the dhcpd.conf file itself. The default value is
dhcpd.netreg. A second file, DHCPDCONFFILE.new is used for
writing host registrations. The web server user requires write
access to this file. Note, if you change the default name of
this file, you will also need to edit the refresh-dhcpdconf
shell script delivered with NetReg to reflect this.
- ERROR_LOG
-
The complete file system path for the file to which errors during
host registrations are written.
- SUBNETFILE
-
The complete file system path for the file holding network
configuration information about how and where NetReg is to
be used. See the NetReg::Subnet manpage for more information.
- DDNS_USE_HOST_DECL
-
The value of $DDNS_USE_HOST_DECL is only of importance if you
employ DDNS. Turn off (0) to use the host-supplied hostname to update
A and PTR records. Turn on (1) to use the derived hostname in the
DHCPDCONFFILE host declaration as the hostname in DDNS updates, e.g.
username-N.
- IP
-
Used to store the CGI environment variable REMOTE_ADDR. This is
the IP address of the host using the registration CGI script.
- LDAP_URL
-
The URL of your online directory application. Usernames displayed
in the admin CGI script will have a link to open a new window and
lookup the user's directory information. Set to the empty string
if you do not have an online directory application. Remember to
URL-encode special characters. Leave \<USERNAME\> where the
username should be substituted into the URL.
- LOGO_ORG
-
The filename of your organization's logo image. This file must be
located in the $GFX directory.
- LOGO_IT
-
The filename of your IT department's logo image. This file must be
located in the $GFX directory.
- HELP_TEXT
-
Text that will be printed in the sidebar. This should be information
that might assist users who have difficulty registering their
computer.
- TECH_TEXT
-
Text that will be printed in the sidebar of the technician's
interface.
- COPYRIGHT
-
Text that is printed as a copyright notice at the bottom of each
page. The recommended format is ``Copyright © DATE ORGANIZATION''
where DATE is the year Netreg was installed, and ORGANIZATION is
the official name of your organization.