文件操作 - sfcb.cfg

文件: /etc/sfcb/sfcb.cfg

编辑文件内容

# $Id: sfcb.cfg.pre.in 5ea1945 on Thu May 1 19:59:43 2014 -0400 by Dave Heller $
##
## Sample Configuration for Small Footprint CIM Broker
## 
## Format is:
## option: value
##
## Value may be boolean, numeric, or a string
## Some options take multiple values; each value should be delimited by a space
## Options without explicitly set values will use the default
## Use '#' at the start of a line to comment
##

##------------------------------------- HTTP ----------------------------------
## List of IPv4 addresses to bind to. The default behavior is to bind to any
## available IP address. To bind to specific IPs enter a comma delimited list
## of IPv4 addresses here. Note that a loopback address must be explicitly
## listed if that is desired. Do not include "0.0.0.0" (i.e. INADDR_ANY) as it
## will conflict with other addresses. All addresses are bound to http and/or
## https according to the values of enableHttp and enableHttps.
## The value listed here is ignored if the -4 option is set on the command line.
## Default is an empty list, which implies bind to any available IP.
#ip4AddrList:

## List of IPv6 addresses to bind to. The default behavior is to bind to any
## available IP address. To bind to specific IPs enter a comma delimited list
## of IPv6 addresses here. These addresses are bound in addition to any IPv4
## addresses listed above. Note that a loopback address must be explicitly
## listed if that is desired. Do not include "::" (i.e. IN6ADDR_ANY) as it
## will conflict with other addresses. All addresses are bound to http and/or
## https according to the values of enableHttp and enableHttps.
## The value listed here is ignored if the -6 option is set on the command line.
## Default is an empty list, which implies bind to any available IP.
#ip6AddrList:

## Enable HTTP. 
## Default is true. If HTTPS is configured, default is false.
enableHttp:     false

## Network Interface Card (NIC) to use.
## Default - not set.
## If unset, SFCB will listen on all available network interfaces
## The value is ignored when httpLocalOnly is set to true
#networkInterface: eth0

## The HTTP port that SFCB should listen on. 
## Default is 5988
httpPort:       5988

## These settings control what user http is forked under. If
## httpUserSFCB is "true" (the default), http will run under 
## the same user as the SFCB main process. If it is "false" the username 
## specified for httpUser will be used. This setting is used for
## both http and https servers
## httpUser MUST be specified if httpUserSFCB is false.
#httpUserSFCB:true
#httpUser:

## Max number of HTTP processes.  
## Setting to 0 disables starting of HTTP adapter and allows connections via
## LocalConnect only.  Setting to 1 enables no-fork mode which prevents forking
## of request handler processes.
## Default is 8
httpProcs:      8

## Do not allow HTTP request from anywhere except localhost. Overrides all
## other IP address configuration.
## Default is false
#httpLocalOnly: false

## Enable HTTP chunking. This will reduce memory usage of HTTP process.
## Default is true
useChunking:    true

## Size of chunks in bytes. This has an affect even if useChunking is not 
## enabled. Also, sfcb may internally adjust this value if needed.
## Default is 50000
#chunkSize: 50000

## Maximum number of objects to return per chunk. Note the actual number of
## objects returned may be limited by chunkSize.  If 0, the maximum number of   
## objects is unlimited.
## Default is 0
#maxChunkObjCount: 0

## Maximum ContentLength of an HTTP request allowed.
## Default is 100000000
#httpMaxContentLength: 100000000

## Customization library - user can modify the logic of one or more routine(s)
## But, do not remove any functions or change the function signature.
sfcbCustomLib:   sfcCustomLib

## Enable basic authentication for HTTP and HTTPS connections
## Default is false
doBasicAuth:    false

## Name of of the authenticaion library. Leave off the ".so"
## Default is: sfcBasicAuthentication
basicAuthLib:   sfcBasicPAMAuthentication

## Name of the entry point into the authentication library
## The return code of this function will determine if auth passes or fails
## Default is: _sfcBasicAuthenticate
basicAuthEntry: _sfcBasicAuthenticate

## Maximum time in seconds an sfcb HTTP process will wait for select.
## Default is 5
#selectTimeout: 5

## Maximum number of tries to bind a TCP socket before giving up.
## Default is 8
#maxBindAttempts: 8

## Maximum time in seconds an sfcb HTTP process will wait between two requests
## on one connection before terminating. 0 will disable HTTP keep-alive.
## Default is 15
#keepaliveTimeout: 15

## Maximum number of consecutive request on one connection. 0 will disable HTTP
## keep-alive. 
## Default is 10
#keepaliveMaxRequest: 10

## Maximum time in seconds a HTTP process (i.e request handler) will wait for
## a provider response before giving up. A timeout implies the provider is hung
## or has crashed. The timeout prevents the handler from waiting indefinitely.
## A value too short may allow insufficient time for long-running processes to
## complete; a value too long may allow handlers to be tied up longer than
## necessary. A value of 0 implies no timeout (wait indefinitely). Note this
## property has no effect on the time a handler will wait on a HTTP client;
## that is governed by selectTimeout or keepaliveTimeout, depending on whether
## or not the handler is in a request.
## Default is 40
#httpReqHandlerTimeout: 40

## The location of the HTTP named socket. This should be someplace writable
## by the user that sfcb runs under.
## Default is /tmp/sfcbHttpSocket
#httpSocketPath: /tmp/sfcbHttpSocket

## The location of the named socket used for LocalConnect requests. This 
## should be someplace writable by the user that sfcbd runs under.
## Default is /tmp/sfcbLocalSocket
#localSocketPath: /tmp/sfcbLocalSocket

## The group name to use to set permission for the named socket. This is
## useful for daemon clients where worker threads are running with permission
## different than the permission for the named socket. For example, sfcb may
## be running as root while a web server using sfcb may be running as daemon.
## Default is NULL which means no change to the default permission.
#socketPathGroupPerm: daemon

## Trim leading and trailing whitespace from XML property values. 
## Whitespace is space, tab, crlf. Any ascii value <= 32.
## Default is true
#trimWhitespace:      true

## Sets the encoding style to be used for returning an EmbeddedObject over
## CIM-XML. Choices are "CDATA" or "xmlescape"
## Default is xmlescape
# embeddedObjEncoding: xmlescape

##---------------------------- Provider-Related -------------------------------

## Max number of provider processes.  
## Default is 32.
provProcs:      32

## Max message length, in bytes. This is a limit on the size of messages
## written across sockets, for instance, between providers and SFCB.
## Default is 100000000
maxMsgLen:      100000000

## Location of the registration directory, where providerRegister can be found
## Default is /var/lib/sfcb/registration
registrationDir: /var/lib/sfcb/registration

## Locations to look for provider libraries. Delimit paths with a space.
## Default is /usr/lib/sfcb /usr/lib64/sfcb /usr/lib /usr/lib64 /usr/lib/cmpi /usr/lib64/cmpi
providerDirs: /usr/lib/sfcb /usr/lib64/sfcb /usr/lib /usr/lib64 /usr/lib/cmpi /usr/lib64/cmpi

## Enable the root/interop namespace (affects indications)
## Default: true
enableInterOp:  true

## How often a provider is checked for idleness, in seconds.
## Default is 30
#providerSampleInterval: 30

## How long before an idle provider is unloaded. This is the /shortest/ amount
## of time before unload; there is some dependency on providerSampleInterval
## Default is 60
#providerTimeoutInterval: 60

## Group together all providers residing in the same shared library to be in 
## the same process, unless explicitly grouped differently in providerRegister
## Default is true
#providerAutoGroup: true

## For an invokeMethod request, validate method parameter types against what
## is specified in the mof, and return an error on a mismatch. Many providers 
## will do this on their own. Note that if one param type is not set, SFCB will
## do validation and set the correct type, even if this option is disabled.
## Default is false.
#validateMethodParamTypes:  false

## These settings control what user providers are forked under. If
## providerDefaultUserSFCB is "true" (the default), providers will run under 
## the same user as the SFCB main process. If it is "false" the username 
## specified for providerDefaultUser will be used. 
## providerDefaultUser MUST be specified if providerDefaultUserSFCB is false.
##
## In either case, a user name specified in the providerRegister will override
## these settings.
#providerDefaultUserSFCB:true
#providerDefaultUser:

##--------------------------------- HTTPS -------------------------------------
## These options only apply if configured with --enable-ssl

## Enable HTTPS. 
## Default is false. If HTTPS is configured, default is true.
enableHttps:    true

## The HTTP port that SFCB should listen on for secure connections. 
## Default is 5989
httpsPort:      5989

## Filename containing the private key for the server's certificate. The file 
## must be in PEM format and may not be passphrase-protected. The file is
## relevant for both client connect and indications sent via https.
## For client connect: the file must be present if enableHttps is true.
## For indications: the file is required only if the indication receiver
## will attempt to verify the sender (sfcb) certificate.
## Default is /etc/sfcb/file.pem
sslKeyFilePath: /etc/sfcb/file.pem

## Filename containing the server's certificate. Must be in PEM format.
## The file is relevant for both client connect and indications sent via https.
## For client connect: the file must be present if enableHttps is true.
## For indications: the file is required only if the indication receiver
## will attempt to verify the sender (sfcb) certificate.
## Default is /etc/sfcb/server.pem
sslCertificateFilePath: /etc/sfcb/server.pem

## Filename containing list of certificates server accepts.
## The file is relevant client connect only.
## Default is /etc/sfcb/clist.pem
sslCertList: /etc/sfcb/clist.pem

## How SFCB handles client certificate based authentication. 
## ignore - do not request a certificate from the client
## accept - request a certificate from the client; do not fail if not presented
## require - refuse the client connection if the client doesn't present a 
##           certificate 
## Default is ignore
sslClientCertificate: ignore

## How SFCB handles verification of the endpoint certificate when sending
## an indication via https.
## ignore - do not attempt to validate the endpoint certificate
## verify - validate the certificate against known CA certs in the trust store;
##          do not send the indication if verification fails.
## verifyhostname - additionally validate the certificate CN (common name)
##          against the indication handler Destination address; 
##          do not send the indication if verification fails.
## Default is ignore (always send the indication)
sslIndicationReceiverCert: ignore

## Location of the trust store. Contains one or more CA certificates.
## The file is relevant for both client connect and indications sent via https.
## For client connect: if sslClientCertificate is set to "require", 
## certificate presented must present valid according to the trust store.
## For indications: if sslIndicationReceiverCert is set to "verify" or
## "verifyhostname", the endpoint's certificate is checked against this file.
## Default: /etc/sfcb/client.pem
sslClientTrustStore: /etc/sfcb/client.pem

## Name of the local library to call for client-certificate based user 
## authentication. 
## Applicable only if sslClientCertificate is not set to "accept" or "require".
## Default is sfcCertificateAuthentication
certificateAuthLib:   sfcCertificateAuthentication

## List of SSL ciphers to enable.
## Default is "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH" which disables
##      weak ciphers.
sslCiphers: ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH

## Optionally configure a DH parameters file for ephemeral key generation.
## See man SSL_CTX_set_tmp_dh_callback(3) for details. The value should be
## the full path to the file. Note that ephemeral key generation will still
## proceed, where applicable, without this file; it is only required when the
## user desires a key length greater than the (openssl) default. If this
## value is not set, no DH parameters file is configured. If the value is set
## but the file is unreadable or contains bad data, and https is configured,
## SFCB will abort. The data is expected to be in PEM format.
## Default is: not set
#sslDhParamsFilePath: /etc/sfcb/dh_param_file.pem

## Configure a curve name for ECDH ephemeral key generation. See man
## SSL_CTX_set_tmp_ecdh(3) for details. The value should be a curve name
## listed by the "openssl ecparam -list_curves" command in the SFCB runtime
## environment. If this value is not set, the indicated default is in effect.
## If the value is set but the curve name is not recognized by the underlying
## openssl implementation, SFCB will abort.
## Default is secp384r1
#sslEcDhCurveName: secp384r1

## When set to true, sets the SSL_OP_CIPHER_SERVER_PREFERENCE flag for the ssl
## context, to enforce server's preference instead of the client preference for
## selection of cipher suite. See man SSL_CTX_set_options(3) for details.
## Default is false
#enableSslCipherServerPref: false

##---------------------------------- UDS --------------------------------------
## These options only apply if configured with --enable-uds

## Enable connections via Unix domain sockets. 
## Default is false
#enableUds:      false

## Enable authentication for Unix domain sockets connections
## Default is true
#doUdsAuth:      true

##-------------------------------------- SLP -----------------------------------
## These options only apply if configured with --enable-slp

## Enable registration of service:wbem with slp
#enableSlp: true

## Time interval in seconds in which the slp process refreshes information.
## Default is 600
#slpRefreshInterval: 600

##------------------------------------ Trace ----------------------------------

## Location of the trace file.
## Can be overriden by setting environment variable SFCB_TRACE_FILE
## The special value "syslog" will send trace to the syslog
## Default is stderr
#traceFile: stderr

## Trace mask as an ORed bitmask. 
## Can be overriden by the command line option -t.  Use "-t ?" for details.
## Default is 0
#traceMask: 0

## Trace level. 
## Can be overriden by setting environment variable SFCB_TRACE_LEVEL. 
## Default is 0. If trace mask is set (by any method) the default is 1.
#traceLevel: 0

##---------------------------- Indications ----------------------------

## Indication provider calls to CBDeliverIndication() cause a thread to spawn
## which will handle the delivery. This allows CBDeliverIndication() to return
## without waiting for the delivery to complete. However, spawning an unlimited
## number of threads will cause increased resource usage. This limit will 
## prevent unlimited thread creation. If the limit is reached, calls to 
## CBDeliverIndication will block.
## Default is 30
#indicationDeliveryThreadLimit: 30

## When the indicationDeliveryThreadLimit is reached, delivery requests will 
## block, waiting to create a thread. This timeout allows for the indication
## to be dropped if a new thread cannot be created within a given time.
## Note that this dropped indication will not be retried, even if reliable
## indications support is enabled. 
## Default is 0 (no timeout)
#indicationDeliveryThreadTimeout: 0

## Timeout passed to curl for thread delivery. After this time has elapsed
## the indication delivery is considered a failure.
## Default is 10 seconds
#indicationCurlTimeout: 10

## If true, instruct curl to use HTTP/1.1 Expect:100-continue behavior when
## delivering indications. This means that curl will send the header and wait
## up to 1s for a 100-continue reply (or other response code) before sending
## the indication payload. This can in limited circumstances save network
## bandwidth, etc. by allowing the destination handler to refuse delivery and
## potentially redirect the indication to a different handler, before curl
## delivers the payload.  Otherwise the payload is delivered as normal, once
## the handler sends the 100-continue or the 1s timeout expires. Note that if
## the destination is not coded to handle HTTP/1.1 Expect:100-continue, this
## will cause an unnecessary 1s delay in delivering each indication. For that
## reason it recommnded to leave this off unless you understand your handlers'
## behavior in this regard. May be useful with indicationCurlHonorRedirect.
## Default is false
#indicationCurlUseExpect100: false

## If true, instruct curl to honor a HTTP 3xx redirect if it receives such a
## response from the indication handler, and attempt delivery to the URI listed
## in the HTTP Location header of the response. This allows handler to redirect
## indications to a different handler, e.g. based on source IP or resource part
## of the URI. Because this introduces a potential security vulnerability it is
## recommended to use only secure (https) indications and to set the
## sslIndicationReceiverCert property to 'verify' when this is enabled.
## Default is false
#indicationCurlHonorRedirect: false

##----------------------------Reliable Indications ----------------------------
## Interval between indication retry attempts
## Default is 20 seconds
#DeliveryRetryInterval: 20

## Number of retry attempts before giving up
## Default is 3 attempts (not including initial attempt)
## A value of 0 disables reliable indications
## including indication sequence numbers and subscription 
## removal.
#DeliveryRetryAttempts: 3

## The length of time an destination can fail before the subscription
## removal action below is taken
## Default is 2592000 seconds (30 days)
#SubscriptionRemovalTimeInterval: 2592000

## The action taken when the time interval expires
## Default is 2, remove the subscription
## Other values: 3, disable the subscription
##               4, ignore (do nothing)
#SubscriptionRemovalAction: 2

## The maximum number of listener destinations that are allowable.
## This threshold will prevent creation of new listener destinations,
## but will not delete them if more are found.
## Default is 100.
#MaxListenerDestinations: 100

## The maximum number of ACTIVE subscriptions allowed.
## This threshold will prevent new activations,
## but will not deactivate them if more are found.
## Default is 100.
#MaxActiveSubscriptions: 100

文件操作 - sfcb.cfg

文件: /etc/sfcb/sfcb.cfg

编辑文件内容

修改文件时间

删除文件