/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release
179 by Teddy Hogeborn
* INSTALL: New file.
1
-*- org -*-
2
3
* Prerequisites
4
  
180 by Teddy Hogeborn
* INSTALL: More text. Better text.
5
** Operating System
6
   
7
   Debian 5.0 "lenny" or Ubuntu 8.04 "Hardy Heron".
8
   
181 by Teddy Hogeborn
* INSTALL: Even better text.
9
   This is mostly for the support scripts which make sure that the
10
   client is installed and started in the initial RAM disk environment
11
   and that the initrd.img file is automatically made unreadable.  The
12
   server and client programs themselves *could* be run in other
13
   distributions, but they *are* specific to GNU/Linux systems, and
14
   are not intended to be portable to other Unixes.
180 by Teddy Hogeborn
* INSTALL: More text. Better text.
15
  
16
** Libraries
17
   
18
   The following libraries and packages are needed.  (It is possible
19
   that it might work with older versions of some of these, but these
20
   versions are confirmed to work.  Newer versions are almost
21
   certainly OK.)
22
   
23
*** Documentation
24
    These are required to build the manual pages for both the server
25
    and client:
26
    
27
    + DocBook 4.5         http://www.docbook.org/
181 by Teddy Hogeborn
* INSTALL: Even better text.
28
      Note: DocBook 5.0 is not compatible.
180 by Teddy Hogeborn
* INSTALL: More text. Better text.
29
    + DocBook XSL stylesheets 1.71.0
179 by Teddy Hogeborn
* INSTALL: New file.
30
                   http://wiki.docbook.org/topic/DocBookXslStylesheets
180 by Teddy Hogeborn
* INSTALL: More text. Better text.
31
    
32
    Package names:
33
    docbook docbook-xsl
181 by Teddy Hogeborn
* INSTALL: Even better text.
34
    
35
    To build just the documentation, run the command "make doc".  Then
36
    the manual page "mandos.8", for example, can be read by running
37
    "man -l mandos.8".
180 by Teddy Hogeborn
* INSTALL: More text. Better text.
38
   
39
*** Mandos Server
40
    + GnuTLS 2.4          http://www.gnu.org/software/gnutls/
41
    + Avahi 0.6.16        http://www.avahi.org/
42
    + Python 2.4          http://www.python.org/
43
    + Python-GnuTLS 1.1.5 http://pypi.python.org/pypi/python-gnutls/
44
    + dbus-python 0.82.4  http://dbus.freedesktop.org/doc/dbus-python/
45
    + python-ctypes 1.0.0 http://pypi.python.org/pypi/ctypes
46
    
47
    Strongly recommended:
48
    + fping 2.4b2-to-ipv6 http://www.fping.com/
49
    
50
    Package names:
181 by Teddy Hogeborn
* INSTALL: Even better text.
51
    python-gnutls avahi-daemon python python-avahi python-dbus
180 by Teddy Hogeborn
* INSTALL: More text. Better text.
52
    python-ctypes
53
   
54
*** Mandos Client
55
    + initramfs-tools 0.85i
179 by Teddy Hogeborn
* INSTALL: New file.
56
                  http://packages.qa.debian.org/i/initramfs-tools.html
180 by Teddy Hogeborn
* INSTALL: More text. Better text.
57
    + GnuTLS 2.4          http://www.gnu.org/software/gnutls/
58
    + Avahi 0.6.16        http://www.avahi.org/
59
    + GnuPG 1.4.9         http://www.gnupg.org/
60
    + GPGME 1.1.6         http://www.gnupg.org/related_software/gpgme/
61
    
62
    Package names:
63
    initramfs-tools libgnutls-dev libavahi-core-dev gnupg
64
    libgpgme11-dev
179 by Teddy Hogeborn
* INSTALL: New file.
65
66
* Installing the Mandos server
67
  
180 by Teddy Hogeborn
* INSTALL: More text. Better text.
68
  1. Do "make doc".
179 by Teddy Hogeborn
* INSTALL: New file.
69
  
180 by Teddy Hogeborn
* INSTALL: More text. Better text.
70
  2. On the computer to run as a Mandos server, run the following
181 by Teddy Hogeborn
* INSTALL: Even better text.
71
     command:
72
     For Debian: su -c 'make install-server'
73
     For Ubuntu: sudo make install-server
74
     
75
     (This creates a configuration without any clients configured; you
180 by Teddy Hogeborn
* INSTALL: More text. Better text.
76
     need an actually configured client to do that; see below.)
179 by Teddy Hogeborn
* INSTALL: New file.
77
78
* Installing the Mandos client.
79
  
180 by Teddy Hogeborn
* INSTALL: More text. Better text.
80
  1. Do "make all doc".
81
  
82
  2. On the computer to run as a Mandos client, run the following
181 by Teddy Hogeborn
* INSTALL: Even better text.
83
     command:
84
     For Debian: su -c 'make install-client'
85
     For Ubuntu: sudo make install-client
86
     
87
     This will also create an OpenPGP key, which will take some time
88
     and entropy, so be patient.
180 by Teddy Hogeborn
* INSTALL: More text. Better text.
89
  
181 by Teddy Hogeborn
* INSTALL: Even better text.
90
  3. Run the following command:
91
     For Debian: su -c 'mandos-keygen --password'
92
     For Ubuntu: sudo mandos-keygen --password
93
     
94
     When prompted, enter the password/passphrase for the encrypted
95
     root file system on this client computer.  The command will
96
     output a section of text, starting with a [section header].  Copy
97
     and append this to the file "/etc/mandos/clients.conf" *on the
98
     server computer*.
180 by Teddy Hogeborn
* INSTALL: More text. Better text.
99
  
228 by Teddy Hogeborn
* INSTALL: Add instructions on how to set the correct network
100
  4. Configure the client to use the correct network interface.  The
101
     default is "eth0", and if this needs to be adjusted, it will be
102
     necessary to edit /etc/mandos/plugin-runner.conf to uncomment and
103
     change the line there.  If that file is changed, the initrd.img
104
     file must be updated, possibly using the following command:
105
     
106
	# update-initramfs -k all -u
107
  
108
  5. On the server computer, start the server by running the command
181 by Teddy Hogeborn
* INSTALL: Even better text.
109
     For Debian: su -c 'invoke-rc.d mandos start'
110
     For Ubuntu: sudo invoke-rc.d mandos start
111
     
228 by Teddy Hogeborn
* INSTALL: Add instructions on how to set the correct network
112
     At this point, it is possible to verify that the correct password
113
     will be received by the client by running the command:
114
     
115
	# /usr/lib/mandos/plugins.d/mandos-client \
116
		--pubkey=/etc/keys/mandos/pubkey.txt \
117
		--seckey=/etc/keys/mandos/seckey.txt; echo
118
     
119
     This command should retrieve the password from the server,
120
     decrypt it, and output it to standard output.
121
     
181 by Teddy Hogeborn
* INSTALL: Even better text.
122
     After this, the client computer should be able to reboot without
123
     needing a password entered on the console, as long as it does not
124
     take more than an hour to reboot.
179 by Teddy Hogeborn
* INSTALL: New file.
125
126
* Further customizations
127
  
128
  You may want to tighten or loosen the timeouts in the server
129
  configuration files; see mandos.conf(5) and mandos-clients.conf(5).
235 by Teddy Hogeborn
* INSTALL: Fixed typo.
130
  If IPsec is not used, it is suggested that a more cryptographically
179 by Teddy Hogeborn
* INSTALL: New file.
131
  secure checker program is used and configured, since without IPsec
132
  ping packets can be faked.