/mandos/release : revision 116

3

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

4

<!ENTITY VERSION "1.0">

5

<!ENTITY COMMANDNAME "mandos">

6

<!ENTITY OVERVIEW SYSTEM "overview.xml">

6

<!ENTITY TIMESTAMP "2008-08-30">

7

]>

8

9

9

10

11

<title>&COMMANDNAME;</title>

11

<title>Mandos Manual</title>

12

13

<productname>&COMMANDNAME;</productname>

13

<productname>Mandos</productname>

14

<productnumber>&VERSION;</productnumber>

15

<date>&TIMESTAMP;</date>

15

16

16

17

17

18

<firstname>Björn</firstname>

66

67

67

68

<refname><command>&COMMANDNAME;</command></refname>

68

69

69

Sends encrypted passwords to authenticated Mandos clients

70

Gives encrypted passwords to authenticated Mandos clients

70

71

</refpurpose>

71

72

</refnamediv>

72

73

74

74

75

75

76

<command>&COMMANDNAME;</command>

76

<arg>--interface<arg choice="plain">IF</arg></arg>

77

<arg>--interface<arg choice="plain">NAME</arg></arg>

77

78

<arg>--address<arg choice="plain">ADDRESS</arg></arg>

78

79

79

80

<arg>--priority<arg choice="plain">PRIORITY</arg></arg>

83

84

</cmdsynopsis>

84

85

85

86

<command>&COMMANDNAME;</command>

86

87

87

88

<arg>-a<arg choice="plain">ADDRESS</arg></arg>

88

89

89

90

<arg>--priority<arg choice="plain">PRIORITY</arg></arg>

142

143

144

144

145

145

146

147

146

148

147

149

<para>

148

150

Show a help message and exit

151

153

</varlistentry>

152

154

153

155

154

<term><literal>-i</literal>, <literal>--interface <replaceable>

155

IF</replaceable></literal></term>

156

157

158

<term><option>--interface</option>

159

156

160

157

<para>

158

Only announce the server and listen to requests on network

159

interface <replaceable>IF</replaceable>. Default is to

160

use all available interfaces. <emphasis>Note:</emphasis>

161

a failure to bind to the specified interface is not

162

considered critical, and the server does not exit.

163

</para>

161

<xi:include href="mandos-options.xml" xpointer="interface"/>

164

162

</listitem>

165

163

</varlistentry>

166

164

168

166

<term><literal>-a</literal>, <literal>--address <replaceable>

169

167

ADDRESS</replaceable></literal></term>

170

168

171

<para>

172

If this option is used, the server will only listen to a

173

specific address. This must currently be an IPv6 address;

174

an IPv4 address can be specified using the

175

<quote><literal>::FFFF:192.0.2.3</literal></quote> syntax.

176

Also, if a link-local address is specified, an interface

177

should be set, since a link-local address is only valid on

178

a single interface. By default, the server will listen to

179

all available addresses.

180

</para>

169

<xi:include href="mandos-options.xml" xpointer="address"/>

181

170

</listitem>

182

171

</varlistentry>

183

172

185

174

186

175

PORT</replaceable></literal></term>

187

176

188

<para>

189

If this option is used, the server to bind to that

190

port. By default, the server will listen to an arbitrary

191

port given by the operating system.

192

</para>

177

<xi:include href="mandos-options.xml" xpointer="port"/>

193

178

</listitem>

194

179

</varlistentry>

195

180

206

191

207

192

<term><literal>--debug</literal></term>

208

193

209

<para>

210

If the server is run in debug mode, it will run in the

211

foreground and print a lot of debugging information. The

212

default is <emphasis>not</emphasis> to run in debug mode.

213

</para>

194

<xi:include href="mandos-options.xml" xpointer="debug"/>

214

195

</listitem>

215

196

</varlistentry>

216

197

218

199

<term><literal>--priority <replaceable>

219

200

PRIORITY</replaceable></literal></term>

220

201

221

<para>

222

GnuTLS priority string for the TLS handshake with the

223

clients. The default is

224

<quote><literal>SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP</literal></quote>.

225

See <citerefentry><refentrytitle>gnutls_priority_init

226

</refentrytitle><manvolnum>3</manvolnum></citerefentry>

227

for the syntax. <emphasis>Warning</emphasis>: changing

228

this may make the TLS handshake fail, making communication

229

with clients impossible.

230

</para>

202

<xi:include href="mandos-options.xml" xpointer="priority"/>

231

203

</listitem>

232

204

</varlistentry>

233

205

235

207

<term><literal>--servicename <replaceable>NAME</replaceable>

236

208

</literal></term>

237

209

238

<para>

239

Zeroconf service name. The default is

240

<quote><literal>Mandos</literal></quote>. This only needs

241

to be changed this if it, for some reason, is necessary to

242

run more than one server on the same

243

<emphasis>host</emphasis>, which would not normally be

244

useful. If there are name collisions on the same

245

<emphasis>network</emphasis>, the newer server will

246

automatically rename itself to <quote><literal>Mandos

247

#2</literal></quote>, and so on; therefore, this option is

248

not needed in that case.

249

</para>

210

<xi:include href="mandos-options.xml"

211

xpointer="servicename"/>

250

212

</listitem>

251

213

</varlistentry>

252

214

278

240

279

241

280

242

<title>OVERVIEW</title>

281

&OVERVIEW;

243

<xi:include href="overview.xml"/>

282

244

<para>

283

245

This program is the server part. It is a normal server program

284

246

and will run in a normal system environment, not in an initial

317

279

318

280

</row>

319

281

<row>

320

282

321

283

322

284

</row>

323

285

<row>

353

315

longer eligible to receive the encrypted password. The timeout,

354

316

checker program, and interval between checks can be configured

355

317

both globally and per client; see <citerefentry>

356

<refentrytitle>mandos.conf</refentrytitle>

357

358

318

<refentrytitle>mandos-clients.conf</refentrytitle>

359

319

<manvolnum>5</manvolnum></citerefentry>.

360

320

</para>

363

323

364

324

<title>LOGGING</title>

365

325

<para>

366

The server will send log messaged with various severity levels

367

to <filename>/dev/log</filename>. With the

326

The server will send log message with various severity levels to

327

<filename>/dev/log</filename>. With the

368

328

<option>--debug</option> option, it will log even more messages,

369

329

and also show them on the console.

370

330

</para>

391

351

<varname>PATH</varname> to search for matching commands if

392

352

an absolute path is not given. See <citerefentry>

393

353

394

</citerefentry>

354

</citerefentry>.

395

355

</para>

396

356

</listitem>

397

357

</varlistentry>

493

453

Normal invocation needs no options:

494

454

</para>

495

455

<para>

496

<userinput>mandos</userinput>

456

<userinput>&COMMANDNAME;</userinput>

497

457

</para>

498

458

</informalexample>

499

459

506

466

<para>

507

467

508

468

509

<userinput>mandos --debug --configdir ~/mandos --servicename Test</userinput>

469

<userinput>&COMMANDNAME; --debug --configdir ~/mandos --servicename Test</userinput>

510

470

511

471

</para>

512

472

</informalexample>

518

478

<para>

519

479

520

480

521

<userinput>mandos --interface eth7 --address fe80::aede:48ff:fe71:f6f2</userinput>

481

<userinput>&COMMANDNAME; --interface eth7 --address fe80::aede:48ff:fe71:f6f2</userinput>

522

482

523

483

</para>

524

484

</informalexample>

581

541

582

542

583

543

544

<para>

545

546

<refentrytitle>mandos-clients.conf</refentrytitle>

547

548

<refentrytitle>mandos.conf</refentrytitle>

549

550

<refentrytitle>password-request</refentrytitle>

551

<manvolnum>8mandos</manvolnum></citerefentry>, <citerefentry>

552

553

</citerefentry>

554

</para>

584

555

585

556

586

557

<term>

587

588

<refentrytitle>password-request</refentrytitle>

589

<manvolnum>8mandos</manvolnum>

590

</citerefentry>

591

</term>

592

593

<para>

594

This is the actual program which talks to this server.

595

Note that it is normally not invoked directly, and is only

596

run in the initial RAM disk environment, and not on a

597

fully started system.

598

</para>

599

</listitem>

600

</varlistentry>

601

602

<term>

603

558

<ulink url="http://www.zeroconf.org/">Zeroconf</ulink>

604

559

</term>

605

560

622

577

</varlistentry>

623

578

624

579

<term>

625

<ulink

626

url="http://www.gnu.org/software/gnutls/">GnuTLS</ulink>

580

<ulink url="http://www.gnu.org/software/gnutls/"

581

>GnuTLS</ulink>

627

582

</term>

628

583

629

584

<para>

635

590

</varlistentry>

636

591

637

592

<term>

638

<citation>RFC 4291: <citetitle>IP Version 6 Addressing

639

Architecture</citetitle>, section 2.5.6, Link-Local IPv6

640

Unicast Addresses</citation>

593

RFC 4291: <citetitle>IP Version 6 Addressing

594

Architecture</citetitle>

641

595

</term>

642

596

643

<para>

644

The clients use IPv6 link-local addresses, which are

645

immediately usable since a link-local addresses is

646

automatically assigned to a network interfaces when it is

647

brought up.

648

</para>

597

598

599

<term>Section 2.2: <citetitle>Text Representation of

600

Addresses</citetitle></term>

601

602

</varlistentry>

603

604

<term>Section 2.5.5.2: <citetitle>IPv4-Mapped IPv6

605

Address</citetitle></term>

606

607

</varlistentry>

608

609

<term>Section 2.5.6, <citetitle>Link-Local IPv6 Unicast

610

Addresses</citetitle></term>

611

612

<para>

613

The clients use IPv6 link-local addresses, which are

614

immediately usable since a link-local addresses is

615

automatically assigned to a network interfaces when it

616

is brought up.

617

</para>

618

</listitem>

619

</varlistentry>

620

</variablelist>

649

621

</listitem>

650

622

</varlistentry>

651

623

652

624

<term>

653

<citation>RFC 4346: <citetitle>The Transport Layer Security

654

(TLS) Protocol Version 1.1</citetitle></citation>

625

RFC 4346: <citetitle>The Transport Layer Security (TLS)

626

Protocol Version 1.1</citetitle>

655

627

</term>

656

628

657

629

<para>

661

633

</varlistentry>

662

634

663

635

<term>

664

<citation>RFC 4880: <citetitle>OpenPGP Message

665

Format</citetitle></citation>

636

RFC 4880: <citetitle>OpenPGP Message Format</citetitle>

666

637

</term>

667

638

668

639

<para>

672

643

</varlistentry>

673

644

674

645

<term>

675

<citation>RFC 5081: <citetitle>Using OpenPGP Keys for

676

Transport Layer Security</citetitle></citation>

646

RFC 5081: <citetitle>Using OpenPGP Keys for Transport Layer

647

Security</citetitle>

677

648

</term>

678

649

679

650

<para>

685

656

</variablelist>

686

657

</refsect1>

687

658

</refentry>

659

660

661

662

663