Configuration¶

log_file_max_size¶

--log_file_max_size=bytes¶

"log_file_max_size": 104857600 // Which is the result of: 100 * 1024 * 1024

This defines the maximum size of Gate One's web server log file in bytes before it is automatically rotated.

log_file_num_backups¶

--log_file_num_backups=integer¶

"log_file_max_size": 10

The maximum number of backups to keep of Gate One's web server logs.

log_file_prefix¶

--log_file_prefix=string (file path)¶

"log_file_prefix": "/opt/gateone/logs/webserver.log"

This is the path where Gate One's web server logs will be kept.

IOError: [Errno 13] Permission denied: '/opt/gateone/logs/webserver.log'

log_to_stderr¶

--log_to_stderr=boolean¶

"log_to_stderr": False

This option tells Gate One to send web server logs to stderr (instead of to the log file).

logging¶

--logging=string (info|warning|error|none)¶

"logging": "info"

Specifies the log level of the web server logs. The default is "info". Can be one of, "info", "warning", "error", or "none".

address¶

--address=string (IPv4 or IPv6 address)¶

"address": "" // Empty string means listen on all addresses

Specifies the IP address or hostname that Gate One will listen for incoming connections. Multiple addresses may provided using a semicolon as the separator. For example:

"address": "localhost;::1;10.1.1.100" // Listen on localhost, the IPv6 loopback address, and 10.1.1.100

api_keys¶

--api_keys=string (key1:secret1,key2:secret2,...)¶

"api_keys": {
    "ZWVkOWJjZ23yNjNlNDQ1YWE3MThiYmI0M72sujFhODFiZ": "NTg5NTllOTIyMD1lNGU1MzkzZDM4NjVkZWNGNDdlN2RmO"
}

Specifies a list of API keys (key:value pairs) that can be used when performing using Gate One's authentication API.

api_timestamp_window¶

--api_timestamp_window=string (special: [0-9]+[smhd])¶

"api_timestamp_window": "30s"

This setting controls how long API authentication objects will last before they expire if --auth is set to 'api' (default is 30 seconds). It accepts the following <num><character> types:

Character	Meaning	Example
s	Seconds	'60s' ➡ 60 Seconds
m	Minutes	'5m'  ➡ 5 Minutes
h	Hours	'24h' ➡ 24 Hours
d	Days	'7d'   ➡ 7 Days

auth¶

--auth=string (none|pam|google|kerberos|api)¶

"auth": "none"

Specifies how you want Gate One to authenticate clients. One of, "none", "pam", "google", "kerberos", or "api".

ca_certs¶

--ca_certs=string (file path)¶

"ca_certs": "/opt/gateone/ca_certs.pem" // Default is None

Path to a file containing any number of concatenated CA certificates in PEM format. They will be used to authenticate clients if the --ssl_auth option is set to 'optional' or 'required'.

cache_dir¶

--cache_dir=string (directory path)¶

"cache_dir": "/tmp/gateone_cache"

Path to a directory where Gate One will cache temporary information (for performance/memory reasons). Mostly for things like templates, JavaScript, and CSS files that have been rendered and/or minified.

certificate¶

--certificate=string (file path)¶

"certificate": "/etc/gateone/ssl/certificate.pem"

The path to the SSL certificate Gate One will use in its web server.

combine_css¶

--combine_css=string (file path)¶

This option tells Gate One to render and combine all its CSS files into a single file (i.e. so you can deliver it via some other web server/web cache/CDN). The file will be saved at the provided path.

combine_css_container¶

--combine_css_container=string (e.g. 'gateone')¶

When combining CSS into a single file, this option specifies the name of the '#gateone' container element (if something else). It is used when rendering CSS templates.

combine_js¶

--combine_js=string (file path)¶

This option tells Gate One to combine all its JavaScript files into a single file (i.e. so you can deliver it via some other web server/web cache/CDN). The file will be saved at the provided path.

command¶

--command=string (program path)¶

config¶

--config=string (file path)¶

cookie_secret¶

--cookie_secret=string ([A-Za-z0-9])¶

"cookie_secret": "A45CharacterStringGeneratedAtRandom012345678" // NOTE: Yours will be different ;)

This is a 45-character string that Gate One will use to encrypt the cookie stored at the client. By default Gate One will generate one at random when it runs for the first time. Only change this if you know what you're doing.

debug¶

--debug=boolean¶

"debug": false

Turns on Tornado's debug mode: If a change is made to any Python code while gateone.py is running it will automatically restart itself. Cached templates will also be regenerated.

disable_ssl¶

--disable_ssl=boolean¶

"disable_ssl": false

Disables SSL support in Gate One. Generally not a good idea unless you know what you're doing. There's really only two reasons why you'd want to do this:

• Gate One will be running behind a proxy server that handles the SSL encryption.
• Gate One will only be connected to via localhost (kiosks, console devices, etc).

embedded¶

--embedded=boolean¶

"embedded": false

This option is available to applications, plugins, and CSS themes/templates (if desired). It is unused by Gate One proper but can be used at your discretion when embedding Gate One.

enable_unix_socket¶

--enable_unix_socket=boolean¶

"enable_unix_socket": false

Tells Gate One to listen on a Unix socket. The path to said socket is defined in --unix_socket_path.

gid¶

--gid=string¶

"gid": "0" // You could also put "root", "somegroup", etc

If run as root, Gate One will drop privileges to this group/gid after starting up. Default: 0 (aka root)

https_redirect¶

--https_redirect¶

"https_redirect": false

If https_redirect is enabled, Gate One will listen on port 80 and redirect incoming connections to Gate One's configured port using HTTPS.

js_init¶

--js_init=string (JavaScript Object)¶

"js_init": ""

This option can be used to pass parameters to the GateOne.init() function whenever Gate One is opened in a browser. For example:

"js_init": "{'theme': 'white', 'fontSize': '120%'}"

For a list of all the possible options see GateOne.prefs in the Developer Documentation under gateone.js.

keyfile¶

--keyfile=string (file path)¶

"keyfile": "/etc/gateone/ssl/keyfile.pem"

The path to the SSL key file Gate One will use in its web server.

locale¶

--locale=string (locale string)¶

"locale": "en_US"

This option tells Gate One which local translation (native language) to use when rendering strings. The first time you run Gate One it will attempt to automatically detect your locale using the $LANG environment variable. If this variable is not set it will fall back to using en_US.

new_api_key¶

--new_api_key¶

This command line option will generate a new, random API key and secret for use with applications that will be embedding Gate One. Instructions on how to use API-based authentication can be found in the Embedding Gate One Into Other Applications.

origins¶

--origins=string (semicolon-separated origins)¶

"origins": ["localhost", "127.0.0.1", "enterprise", "enterprise\\..*.com", "10.1.1.100"]

By default Gate One will only allow connections from web pages that match the configured origins. If a user is denied access based on a failed origin check a message will be logged like so:

[I 120831 15:32:12 gateone:1043] WebSocket closed (ANONYMOUS).
[E 120831 15:32:17 gateone:943] Access denied for origin: https://somehost.company.com

pam_realm¶

--pam_realm=string (hostname)¶

"pam_realm": "somehost"

If --auth is set to "pam" Gate One will present this string in the BASIC auth dialog (essentially, the login dialog will say, "REALM: <pam_realm>"). Also, the user's directory will be created in --user_dir as user@. Make sure to use path-safe characters!

pam_service¶

--pam_service=string¶

"pam_service": "login"

If --auth is set to "pam", tells Gate One which PAM service to use when authenticating clients. Defaults to 'login' which is typically configured via /etc/pam.d/login.

pid_file¶

--pid_file=string¶

"pid_file": "/var/run/gateone.pid"

The path to Gate One's PID file.

IOError: [Errno 13] Permission denied: '/var/run/gateone.pid'

port¶

--port=integer (1-65535)¶

"port": 443

The port Gate One should listen for connections.

session_dir¶

--session_dir=string (file path)¶

"session_dir": "/tmp/gateone"

The path where Gate One should keep temporary user session information. Defaults to /tmp/gateone (will be auto-created if not present).

session_timeout¶

--session_timeout=string (special: [0-9]+[smhd])¶

"session_timeout": "5d"

This setting controls how long Gate One will wait before force-killing a user's disconnected session (i.e. where the user hasn't used Gate One in, say, "5d"). It accepts the following <num><character> types:

Character	Meaning	Example
s	Seconds	'60s' ➡ 60 Seconds
m	Minutes	'5m'  ➡ 5 Minutes
h	Hours	'24h' ➡ 24 Hours
d	Days	'7d'   ➡ 7 Days

ssl_auth¶

--ssl_auth=string (None|optional|required)¶

"ssl_auth": "none"

If set to 'required' or 'optional' this setting will instruct Gate One to authenticate client-side SSL certificates. This can be an excellent added layer of security on top of Gate One's other authentication options. Obviously, only the 'required' setting adds this protection. If set to 'optional' it merely adds information to the logs.

sso_realm¶

--sso_realm=string (Kerberos realm or Active Directory domain)¶

"sso_realm": "EXAMPLE.COM"

If --auth is set to "kerberos", tells Gate One which Kerberos realm or Active Directory domain to use when authenticating users. Otherwise this setting will be ignored.

sso_service¶

--sso_service=string (kerberos service name)¶

"sso_service": "HTTP"

If --auth is set to "kerberos", tells Gate One which Kerberos service to use when authenticating clients. This is the 'service/' part of a principal or servicePrincipalName (e.g. HTTP/somehost.example.com).

syslog_facility¶

--syslog_facility=string (auth|cron|daemon|kern|local0|local1|local2|local3|local4|local5|local6|local7|lpr|mail|news|syslog|user|uucp)¶

"syslog_facility": "daemon"

if --syslog_session_logging is set to True, specifies the syslog facility that user session logs will use in outgoing syslog messages.

uid¶

--uid=string¶

"uid": "0" // You could also put "root", "someuser", etc

If run as root, Gate One will drop privileges to this user/uid after starting up. Default: 0 (aka root)

unix_socket_path¶

--unix_socket_path=string (file path)¶

"unix_socket_path": "/tmp/gateone.sock"

Path to the Unix socket (if --enable_unix_socket is "true").

url_prefix¶

--url_prefix=string (e.g. "/ssh/")¶

"url_prefix": "/"

This specifies the URL path Gate One will live when it is accessed from a browser. By default Gate One will use "/" as its base URL; this means that you can connect to it using a URL like so: https://mygateone.company.com/

That "/" at the end of the above URL is what the url_prefix is specifying. If you wanted your Gate One server to live at https://mygateone.company.com/gateone/ you could set url_prefix="/gateone/".

user_dir¶

--user_dir=string (file path)¶

"user_dir": "/var/lib/gateone/users"

Specifies the location where persistent user files will be kept. Things like session logs, ssh files (known_hosts, keys, etc), and similar are stored here.

user_logs_max_age¶

--user_logs_max_age=string (special: [0-9]+[smhd])¶

"user_dir": "30d"

This setting controls how long Gate One will wait before old user session logs are cleaned up. It accepts the following <num><character> types:

Character	Meaning	Example
s	Seconds	'60s' ➡ 60 Seconds
m	Minutes	'5m'  ➡ 5 Minutes
h	Hours	'24h' ➡ 24 Hours
d	Days	'7d'   ➡ 7 Days

version¶

--version¶

Displays the current Gate One version as well as the version information of any installed applications. Example:

root@host:~ $ gateone --version
Gate One:
     Version: 1.2.0 (20140226213756)
Installed Applications:
     Terminal Version: 1.2
     X11 Version: 1.0

dtach¶

--dtach=boolean¶

"dtach": true

This feature is special: It enables Gate One to be restarted (think: upgraded) without losing user's connected sessions. This option is enabled by default.

If dtach support is enabled but the dtach command cannot be found Gate One will output a warning message in the log.

kill¶

--kill¶

If running with dtach support, this will kill all user's running terminal applications. Giving everyone a fresh start, as it were.

session_logging¶

--session_logging¶

session_logging = True

This tells Gate One to enable server-side logging of user terminal sessions. These logs can be viewed or played back (like a video) using the Log Viewer application.

syslog_session_logging¶

--syslog_session_logging¶

"syslog_session_logging": false

This option tells Gate One to send logs of user sessions to the host's syslog daemon. Special characters and escape sequences will be sent as-is so it is up to the syslog daemon as to how to handle them. In most cases you'll wind up with log lines that look like this:

Oct  1 19:18:22 gohost gateone: ANONYMOUS 1: Connecting to: ssh://user@somehost:22
Oct  1 19:18:22 gohost gateone: ANONYMOUS 1: #033]0;user@somehost#007
Oct  1 19:18:22 gohost gateone: ANONYMOUS 1: #033]_;ssh|user@somehost:22#007