/mandos/release : revision 115

3

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

4

<!ENTITY VERSION "1.0">

5

<!ENTITY COMMANDNAME "mandos">

6

<!ENTITY TIMESTAMP "2008-09-05">

6

<!ENTITY TIMESTAMP "2008-08-29">

7

]>

8

9

34

<holder>Teddy Hogeborn</holder>

35

<holder>Björn Påhlsson</holder>

36

</copyright>

37

<xi:include href="legalnotice.xml"/>

37

38

<para>

39

This manual page is free software: you can redistribute it

40

and/or modify it under the terms of the GNU General Public

41

License as published by the Free Software Foundation,

42

either version 3 of the License, or (at your option) any

43

later version.

44

</para>

45

46

<para>

47

This manual page is distributed in the hope that it will

48

be useful, but WITHOUT ANY WARRANTY; without even the

49

implied warranty of MERCHANTABILITY or FITNESS FOR A

50

PARTICULAR PURPOSE. See the GNU General Public License

51

for more details.

52

</para>

53

54

<para>

55

You should have received a copy of the GNU General Public

56

License along with this program; If not, see

57

<ulink url="http://www.gnu.org/licenses/"/>.

58

</para>

59

</legalnotice>

38

60

</refentryinfo>

39

61

40

62

45

67

46

68

<refname><command>&COMMANDNAME;</command></refname>

47

69

48

Gives encrypted passwords to authenticated Mandos clients

70

Sends encrypted passwords to authenticated Mandos clients

49

71

</refpurpose>

50

72

</refnamediv>

51

73

52

74

53

75

54

76

<command>&COMMANDNAME;</command>

55

<group>

56

<arg choice="plain"><option>--interface

57

58

<arg choice="plain"><option>-i

59

60

</group>

61

<sbr/>

62

<group>

63

<arg choice="plain"><option>--address

64

<replaceable>ADDRESS</replaceable></option></arg>

65

<arg choice="plain"><option>-a

66

<replaceable>ADDRESS</replaceable></option></arg>

67

</group>

68

<sbr/>

69

<group>

70

<arg choice="plain"><option>--port

71

72

<arg choice="plain"><option>-p

73

74

</group>

75

<sbr/>

76

<arg><option>--priority

77

<replaceable>PRIORITY</replaceable></option></arg>

78

<sbr/>

79

<arg><option>--servicename

80

81

<sbr/>

82

<arg><option>--configdir

83

<replaceable>DIRECTORY</replaceable></option></arg>

84

<sbr/>

85

<arg><option>--debug</option></arg>

77

<arg>--interface<arg choice="plain">NAME</arg></arg>

78

<arg>--address<arg choice="plain">ADDRESS</arg></arg>

79

80

<arg>--priority<arg choice="plain">PRIORITY</arg></arg>

81

<arg>--servicename<arg choice="plain">NAME</arg></arg>

82

<arg>--configdir<arg choice="plain">DIRECTORY</arg></arg>

83

<arg>--debug</arg>

84

</cmdsynopsis>

85

86

<command>&COMMANDNAME;</command>

87

88

<arg>-a<arg choice="plain">ADDRESS</arg></arg>

89

90

<arg>--priority<arg choice="plain">PRIORITY</arg></arg>

91

<arg>--servicename<arg choice="plain">NAME</arg></arg>

92

<arg>--configdir<arg choice="plain">DIRECTORY</arg></arg>

93

<arg>--debug</arg>

86

94

</cmdsynopsis>

87

95

88

96

<command>&COMMANDNAME;</command>

89

97

90

91

98

99

92

100

</group>

93

101

</cmdsynopsis>

94

102

95

103

<command>&COMMANDNAME;</command>

96

<arg choice="plain"><option>--version</option></arg>

104

<arg choice="plain">--version</arg>

97

105

</cmdsynopsis>

98

106

99

107

<command>&COMMANDNAME;</command>

100

<arg choice="plain"><option>--check</option></arg>

108

<arg choice="plain">--check</arg>

101

109

</cmdsynopsis>

102

110

</refsynopsisdiv>

103

111

115

123

Any authenticated client is then given the stored pre-encrypted

116

124

password for that specific client.

117

125

</para>

126

118

127

</refsect1>

119

128

120

129

121

130

<title>PURPOSE</title>

131

122

132

<para>

123

133

The purpose of this is to enable <emphasis>remote and unattended

124

134

rebooting</emphasis> of client host computer with an

125

135

<emphasis>encrypted root file system</emphasis>. See <xref

126

136

linkend="overview"/> for details.

127

137

</para>

138

128

139

</refsect1>

129

140

130

141

131

142

<title>OPTIONS</title>

143

132

144

133

145

146

134

147

135

136

148

137

149

<para>

138

150

Show a help message and exit

139

151

</para>

140

152

</listitem>

141

153

</varlistentry>

142

154

143

155

156

157

144

158

<term><option>--interface</option>

145

159

146

147

148

160

149

161

<xi:include href="mandos-options.xml" xpointer="interface"/>

150

162

</listitem>

151

163

</varlistentry>

152

164

153

165

154

<term><option>--address

155

<replaceable>ADDRESS</replaceable></option></term>

156

<term><option>-a

157

<replaceable>ADDRESS</replaceable></option></term>

166

<term><literal>-a</literal>, <literal>--address <replaceable>

167

ADDRESS</replaceable></literal></term>

158

168

159

169

<xi:include href="mandos-options.xml" xpointer="address"/>

160

170

</listitem>

161

171

</varlistentry>

162

172

163

173

164

<term><option>--port

165

166

<term><option>-p

167

174

175

PORT</replaceable></literal></term>

168

176

169

177

<xi:include href="mandos-options.xml" xpointer="port"/>

170

178

</listitem>

171

179

</varlistentry>

172

180

173

181

174

<term><option>--check</option></term>

182

<term><literal>--check</literal></term>

175

183

176

184

<para>

177

185

Run the server’s self-tests. This includes any unit

179

187

</para>

180

188

</listitem>

181

189

</varlistentry>

182

190

183

191

184

<term><option>--debug</option></term>

192

<term><literal>--debug</literal></term>

185

193

186

194

<xi:include href="mandos-options.xml" xpointer="debug"/>

187

195

</listitem>

188

196

</varlistentry>

189

197

190

198

191

<term><option>--priority <replaceable>

192

PRIORITY</replaceable></option></term>

199

<term><literal>--priority <replaceable>

200

PRIORITY</replaceable></literal></term>

193

201

194

202

<xi:include href="mandos-options.xml" xpointer="priority"/>

195

203

</listitem>

196

204

</varlistentry>

197

205

198

206

199

<term><option>--servicename

200

207

<term><literal>--servicename <replaceable>NAME</replaceable>

208

</literal></term>

201

209

202

210

<xi:include href="mandos-options.xml"

203

211

xpointer="servicename"/>

205

213

</varlistentry>

206

214

207

215

208

<term><option>--configdir

209

<replaceable>DIRECTORY</replaceable></option></term>

216

<term><literal>--configdir <replaceable>DIR</replaceable>

217

</literal></term>

210

218

211

219

<para>

212

220

Directory to search for configuration files. Default is

220

228

</varlistentry>

221

229

222

230

223

<term><option>--version</option></term>

231

<term><literal>--version</literal></term>

224

232

225

233

<para>

226

234

Prints the program version and exit.

236

244

<para>

237

245

This program is the server part. It is a normal server program

238

246

and will run in a normal system environment, not in an initial

239

<acronym>RAM</acronym> disk environment.

247

RAM disk environment.

240

248

</para>

241

249

</refsect1>

242

250

334

342

<title>ENVIRONMENT</title>

335

343

336

344

337

345

338

346

339

347

<para>

340

348

To start the configured checker (see <xref

379

387

</listitem>

380

388

</varlistentry>

381

389

382

<term><filename>/var/run/mandos.pid</filename></term>

390

<term><filename>/var/run/mandos/mandos.pid</filename></term>

383

391

384

392

<para>

385

393

The file containing the process id of

434

442

Debug mode is conflated with running in the foreground.

435

443

</para>

436

444

<para>

437

The console log messages does not show a time stamp.

438

</para>

439

<para>

440

This server does not check the expire time of clients’ OpenPGP

441

keys.

445

The console log messages does not show a timestamp.

442

446

</para>

443

447

</refsect1>

444

448

487

491

<para>

488

492

Running this <command>&COMMANDNAME;</command> server program

489

493

should not in itself present any security risk to the host

490

computer running it. The program switches to a non-root user

491

soon after startup.

494

computer running it. The program does not need any special

495

privileges to run, and is designed to run as a non-root user.

492

496

</para>

493

497

</refsect2>

494

498

521

525

restarting servers if it is suspected that a client has, in

522

526

fact, been compromised by parties who may now be running a

523

527

fake Mandos client with the keys from the non-encrypted

524

initial <acronym>RAM</acronym> image of the client host. What

525

should be done in that case (if restarting the server program

526

really is necessary) is to stop the server program, edit the

528

initial RAM image of the client host. What should be done in

529

that case (if restarting the server program really is

530

necessary) is to stop the server program, edit the

527

531

configuration file to omit any suspect clients, and restart

528

532

the server program.

529

533

</para>