(root)/mandos/release
» Revision
136
(compared to revision 24.1.90)
: plugins.d/password-request.xml
To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to plugins.d/password-request.xml
- browse files at revision 136
- compare with another revision
- download diff
- download tarball
- view history from revision 136
- Committer: Teddy Hogeborn
- Date: 2008-09-01 16:53:17 UTC
- Revision ID: teddy@fukt.bsnet.se-20080901165317-77dccp81zyqimt2j
* plugin-runner.c (add_environment): Override existing environment
variables when asked to do so.
All callers changed.
(main): Removed old argp.args_doc string. Parse argument file
before normal command line arguments. Use ARGP_IN_ORDER
flag in both calls to argp_parse. Do not strdup() strings
to be sent to add_environment().
* plugin-runner.xml (OPTIONS): Document "--global-env" and "--envs-for".
(FILES): Note that the config file is parsed before the command line
options.
variables when asked to do so.
All callers changed.
(main): Removed old argp.args_doc string. Parse argument file
before normal command line arguments. Use ARGP_IN_ORDER
flag in both calls to argp_parse. Do not strdup() strings
to be sent to add_environment().
* plugin-runner.xml (OPTIONS): Document "--global-env" and "--envs-for".
(FILES): Note that the config file is parsed before the command line
options.
added
removed
plugins.d/password-request.xml
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY VERSION "1.0">
5
5
<!ENTITY COMMANDNAME "password-request">
6
<!ENTITY TIMESTAMP "2008-09-04">
6
<!ENTITY TIMESTAMP "2008-08-31">
7
7
]>
8
8
9
9
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
54
54
<command>&COMMANDNAME;</command>
55
55
<group>
56
56
<arg choice="plain"><option>--connect
57
<replaceable>ADDRESS</replaceable><literal>:</literal
57
<replaceable>IPADDR</replaceable><literal>:</literal
58
58
><replaceable>PORT</replaceable></option></arg>
59
59
<arg choice="plain"><option>-c
60
<replaceable>ADDRESS</replaceable><literal>:</literal
60
<replaceable>IPADDR</replaceable><literal>:</literal
61
61
><replaceable>PORT</replaceable></option></arg>
62
62
</group>
63
63
<sbr/>
64
64
<group>
65
<arg choice="plain"><option>--keydir
66
<replaceable>DIRECTORY</replaceable></option></arg>
67
<arg choice="plain"><option>-d
68
<replaceable>DIRECTORY</replaceable></option></arg>
69
</group>
70
<sbr/>
71
<group>
65
72
<arg choice="plain"><option>--interface
66
73
<replaceable>NAME</replaceable></option></arg>
67
74
<arg choice="plain"><option>-i
117
124
<refsect1 id="description">
118
125
<title>DESCRIPTION</title>
119
126
<para>
120
<command>&COMMANDNAME;</command> is a client program that
121
communicates with <citerefentry><refentrytitle
122
>mandos</refentrytitle><manvolnum>8</manvolnum></citerefentry>
123
to get a password. It uses IPv6 link-local addresses to get
124
network connectivity, Zeroconf to find servers, and TLS with an
125
OpenPGP key to ensure authenticity and confidentiality. It
126
keeps running, trying all servers on the network, until it
127
receives a satisfactory reply or a TERM signal is received.
128
</para>
129
<para>
130
This program is not meant to be run directly; it is really meant
131
to run as a plugin of the <application>Mandos</application>
132
<citerefentry><refentrytitle>plugin-runner</refentrytitle>
133
<manvolnum>8mandos</manvolnum></citerefentry>, which runs in the
134
initial <acronym>RAM</acronym> disk environment because it is
135
specified as a <quote>keyscript</quote> in the <citerefentry>
136
<refentrytitle>crypttab</refentrytitle><manvolnum>5</manvolnum>
137
</citerefentry> file.
138
</para>
139
</refsect1>
140
141
<refsect1 id="purpose">
142
<title>PURPOSE</title>
143
<para>
144
The purpose of this is to enable <emphasis>remote and unattended
145
rebooting</emphasis> of client host computer with an
146
<emphasis>encrypted root file system</emphasis>. See <xref
147
linkend="overview"/> for details.
127
<command>&COMMANDNAME;</command> is a mandos plugin that works
128
like a client program that through avahi detects mandos servers,
129
sets up a gnutls connect and request a encrypted password. Any
130
passwords given is automaticly decrypted and passed to
131
cryptsetup.
148
132
</para>
149
133
</refsect1>
150
134
151
135
<refsect1 id="options">
152
136
<title>OPTIONS</title>
153
137
<para>
154
This program is commonly not invoked from the command line; it
155
is normally started by the <application>Mandos</application>
156
plugin runner, see <citerefentry><refentrytitle
157
>plugin-runner</refentrytitle><manvolnum>8mandos</manvolnum>
158
</citerefentry>. Any command line options this program accepts
159
are therefore normally provided by the plugin runner, and not
160
directly.
138
Commonly not invoked as command lines but from configuration
139
file of plugin runner.
161
140
</para>
162
141
163
142
<variablelist>
164
143
<varlistentry>
165
144
<term><option>--connect=<replaceable
166
>ADDRESS</replaceable><literal>:</literal><replaceable
145
>IPADDR</replaceable><literal>:</literal><replaceable
167
146
>PORT</replaceable></option></term>
168
147
<term><option>-c
169
<replaceable>ADDRESS</replaceable><literal>:</literal
148
<replaceable>IPADDR</replaceable><literal>:</literal
170
149
><replaceable>PORT</replaceable></option></term>
171
150
<listitem>
172
151
<para>
173
Do not use Zeroconf to locate servers. Connect directly
174
to only one specified <application>Mandos</application>
175
server. Note that an IPv6 address has colon characters in
176
it, so the <emphasis>last</emphasis> colon character is
177
assumed to separate the address from the port number.
152
Connect directly to a specified mandos server
178
153
</para>
154
</listitem>
155
</varlistentry>
156
157
<varlistentry>
158
<term><option>--keydir=<replaceable
159
>DIRECTORY</replaceable></option></term>
160
<term><option>-d
161
<replaceable>DIRECTORY</replaceable></option></term>
162
<listitem>
179
163
<para>
180
This option is normally only useful for testing and
181
debugging.
164
Directory where the openpgp keyring is
182
165
</para>
183
166
</listitem>
184
167
</varlistentry>
185
168
186
169
<varlistentry>
187
170
<term><option>--interface=
188
171
<replaceable>NAME</replaceable></option></term>
190
173
<replaceable>NAME</replaceable></option></term>
191
174
<listitem>
192
175
<para>
193
Network interface that will be brought up and scanned for
194
Mandos servers to connect to. The default it
195
<quote><literal>eth0</literal></quote>.
196
</para>
197
<para>
198
If the <option>--connect</option> option is used, this
199
specifies the interface to use to connect to the address
200
given.
176
Interface that Avahi will connect through
201
177
</para>
202
178
</listitem>
203
179
</varlistentry>
204
180
205
181
<varlistentry>
206
182
<term><option>--pubkey=<replaceable
207
183
>FILE</replaceable></option></term>
209
185
<replaceable>FILE</replaceable></option></term>
210
186
<listitem>
211
187
<para>
212
OpenPGP public key file name. The default name is
213
<quote><filename>/conf/conf.d/mandos/pubkey.txt</filename
214
></quote>.
188
Public openpgp key for gnutls authentication
215
189
</para>
216
190
</listitem>
217
191
</varlistentry>
223
197
<replaceable>FILE</replaceable></option></term>
224
198
<listitem>
225
199
<para>
226
OpenPGP secret key file name. The default name is
227
<quote><filename>/conf/conf.d/mandos/seckey.txt</filename
228
></quote>.
200
Secret OpenPGP key for GnuTLS authentication
229
201
</para>
230
202
</listitem>
231
203
</varlistentry>
234
206
<term><option>--priority=<replaceable
235
207
>STRING</replaceable></option></term>
236
208
<listitem>
237
<xi:include href="../mandos-options.xml"
238
xpointer="priority"/>
209
<para>
210
GnuTLS priority
211
</para>
239
212
</listitem>
240
213
</varlistentry>
241
214
244
217
>BITS</replaceable></option></term>
245
218
<listitem>
246
219
<para>
247
Sets the number of bits to use for the prime number in the
248
TLS Diffie-Hellman key exchange. Default is 1024.
220
DH bits to use in gnutls communication
249
221
</para>
250
222
</listitem>
251
223
</varlistentry>
254
226
<term><option>--debug</option></term>
255
227
<listitem>
256
228
<para>
257
Enable debug mode. This will enable a lot of output to
258
standard error about what the program is doing. The
259
program will still perform all other functions normally.
260
</para>
261
<para>
262
It will also enable debug mode in the Avahi and GnuTLS
263
libraries, making them print large amounts of debugging
264
output.
229
Debug mode
265
230
</para>
266
231
</listitem>
267
232
</varlistentry>
271
236
<term><option>-?</option></term>
272
237
<listitem>
273
238
<para>
274
Gives a help message about options and their meanings.
239
Gives a help message
275
240
</para>
276
241
</listitem>
277
242
</varlistentry>
280
245
<term><option>--usage</option></term>
281
246
<listitem>
282
247
<para>
283
Gives a short usage message.
248
Gives a short usage message
284
249
</para>
285
250
</listitem>
286
251
</varlistentry>
290
255
<term><option>-V</option></term>
291
256
<listitem>
292
257
<para>
293
Prints the program version.
258
Prints the program version
294
259
</para>
295
260
</listitem>
296
261
</varlistentry>
297
262
</variablelist>
298
263
</refsect1>
299
264
300
<refsect1 id="overview">
301
<title>OVERVIEW</title>
302
<xi:include href="../overview.xml"/>
303
<para>
304
This program is the client part. It is a plugin started by
305
<citerefentry><refentrytitle>plugin-runner</refentrytitle>
306
<manvolnum>8mandos</manvolnum></citerefentry> which will run in
307
an initial <acronym>RAM</acronym> disk environment.
308
</para>
309
<para>
310
This program could, theoretically, be used as a keyscript in
311
<filename>/etc/crypttab</filename>, but it would then be
312
impossible to enter a password for the encrypted root disk at
313
the console, since this program does not read from the console
314
at all. This is why a separate plugin (<citerefentry>
315
<refentrytitle>password-prompt</refentrytitle>
316
<manvolnum>8mandos</manvolnum></citerefentry>) does that, which
317
will be run in parallel to this one by the plugin runner.
318
</para>
319
</refsect1>
320
321
265
<refsect1 id="exit_status">
322
266
<title>EXIT STATUS</title>
323
267
<para>
324
This program will exit with a successful (zero) exit status if a
325
server could be found and the password received from it could be
326
successfully decrypted and output on standard output. The
327
program will exit with a non-zero exit status only if a critical
328
error occurs. Otherwise, it will forever connect to new
329
<application>Mandos</application> servers as they appear, trying
330
to get a decryptable password.
331
268
</para>
332
269
</refsect1>
333
270
334
271
<refsect1 id="environment">
335
272
<title>ENVIRONMENT</title>
336
273
<para>
337
This program does not use any environment variables, not even
338
the ones provided by <citerefentry><refentrytitle
339
>cryptsetup</refentrytitle><manvolnum>8</manvolnum>
340
</citerefentry>.
341
274
</para>
342
275
</refsect1>
343
276
344
277
<refsect1 id="file">
345
278
<title>FILES</title>
346
<variablelist>
347
<varlistentry>
348
<term><filename>/conf/conf.d/mandos/pubkey.txt</filename
349
></term>
350
<term><filename>/conf/conf.d/mandos/seckey.txt</filename
351
></term>
352
<listitem>
353
<para>
354
OpenPGP public and private key files, in <quote>ASCII
355
Armor</quote> format. These are the default file names,
356
they can be changed with the <option>--pubkey</option> and
357
<option>--seckey</option> options.
358
</para>
359
</listitem>
360
</varlistentry>
361
</variablelist>
279
<para>
280
</para>
362
281
</refsect1>
363
282
364
<!-- <refsect1 id="bugs"> -->
365
<!-- <title>BUGS</title> -->
366
<!-- <para> -->
367
<!-- </para> -->
368
<!-- </refsect1> -->
283
<refsect1 id="bugs">
284
<title>BUGS</title>
285
<para>
286
</para>
287
</refsect1>
369
288
370
289
<refsect1 id="example">
371
290
<title>EXAMPLE</title>
372
291
<para>
373
Note that normally, command line options will not be given
374
directly, but via options for the Mandos <citerefentry
375
><refentrytitle>plugin-runner</refentrytitle>
376
<manvolnum>8mandos</manvolnum></citerefentry>.
377
292
</para>
378
<informalexample>
379
<para>
380
Normal invocation needs no options, if the network interface
381
is <quote>eth0</quote>:
382
</para>
383
<para>
384
<userinput>&COMMANDNAME;</userinput>
385
</para>
386
</informalexample>
387
<informalexample>
388
<para>
389
Search for Mandos servers on another interface:
390
</para>
391
<para>
392
<!-- do not wrap this line -->
393
<userinput>&COMMANDNAME; --interface eth1</userinput>
394
</para>
395
</informalexample>
396
<informalexample>
397
<para>
398
Run in debug mode, and use a custom key:
399
</para>
400
<para>
401
402
<!-- do not wrap this line -->
403
<userinput>&COMMANDNAME; --debug --pubkey keydir/pubkey.txt --seckey keydir/seckey.txt</userinput>
404
405
</para>
406
</informalexample>
407
<informalexample>
408
<para>
409
Run in debug mode, with a custom key, and do not use Zeroconf
410
to locate a server; connect directly to the IPv6 address
411
<quote><systemitem class="ipaddress"
412
>2001:db8:f983:bd0b:30de:ae4a:71f2:f672</systemitem></quote>,
413
port 4711, using interface eth2:
414
</para>
415
<para>
416
417
<!-- do not wrap this line -->
418
<userinput>&COMMANDNAME; --debug --pubkey keydir/pubkey.txt --seckey keydir/seckey.txt --connect 2001:db8:f983:bd0b:30de:ae4a:71f2:f672:4711 --interface eth2</userinput>
419
420
</para>
421
</informalexample>
422
293
</refsect1>
423
294
424
295
<refsect1 id="security">
425
296
<title>SECURITY</title>
426
297
<para>
427
This program is set-uid to root, but will switch back to the
428
original (and presumably non-privileged) user and group after
429
bringing up the network interface.
430
</para>
431
<para>
432
To use this program for its intended purpose (see <xref
433
linkend="purpose"/>), the password for the root file system will
434
have to be given out to be stored in a server computer, after
435
having been encrypted using an OpenPGP key. This encrypted data
436
which will be stored in a server can only be decrypted by the
437
OpenPGP key, and the data will only be given out to those
438
clients who can prove they actually have that key. This key,
439
however, is stored unencrypted on the client side in its initial
440
<acronym>RAM</acronym> disk image file system. This is normally
441
readable by all, but this is normally fixed during installation
442
of this program; file permissions are set so that no-one is able
443
to read that file.
444
</para>
445
<para>
446
The only remaining weak point is that someone with physical
447
access to the client hard drive might turn off the client
448
computer, read the OpenPGP keys directly from the hard drive,
449
and communicate with the server. The defense against this is
450
that the server is supposed to notice the client disappearing
451
and will stop giving out the encrypted data. Therefore, it is
452
important to set the timeout and checker interval values tightly
453
on the server. See <citerefentry><refentrytitle
454
>mandos</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
455
</para>
456
<para>
457
It will also help if the checker program on the server is
458
configured to request something from the client which can not be
459
spoofed by someone else on the network, unlike unencrypted
460
<acronym>ICMP</acronym> echo (<quote>ping</quote>) replies.
461
</para>
462
<para>
463
<emphasis>Note</emphasis>: This makes it completely insecure to
464
have <application >Mandos</application> clients which dual-boot
465
to another operating system which is <emphasis>not</emphasis>
466
trusted to keep the initial <acronym>RAM</acronym> disk image
467
confidential.
468
298
</para>
469
299
</refsect1>
470
300
471
301
<refsect1 id="see_also">
472
302
<title>SEE ALSO</title>
473
303
<para>
474
<citerefentry><refentrytitle>cryptsetup</refentrytitle>
475
<manvolnum>8</manvolnum></citerefentry>,
476
<citerefentry><refentrytitle>crypttab</refentrytitle>
477
<manvolnum>5</manvolnum></citerefentry>,
478
304
<citerefentry><refentrytitle>mandos</refentrytitle>
479
305
<manvolnum>8</manvolnum></citerefentry>,
480
306
<citerefentry><refentrytitle>password-prompt</refentrytitle>
482
308
<citerefentry><refentrytitle>plugin-runner</refentrytitle>
483
309
<manvolnum>8mandos</manvolnum></citerefentry>
484
310
</para>
485
<variablelist>
486
<varlistentry>
487
<term>
488
<ulink url="http://www.zeroconf.org/">Zeroconf</ulink>
489
</term>
490
<listitem>
491
<para>
492
Zeroconf is the network protocol standard used for finding
493
Mandos servers on the local network.
494
</para>
495
</listitem>
496
</varlistentry>
497
<varlistentry>
498
<term>
499
<ulink url="http://www.avahi.org/">Avahi</ulink>
500
</term>
501
<listitem>
502
<para>
503
Avahi is the library this program calls to find Zeroconf
504
services.
505
</para>
506
</listitem>
507
</varlistentry>
508
<varlistentry>
509
<term>
510
<ulink url="http://www.gnu.org/software/gnutls/"
511
>GnuTLS</ulink>
512
</term>
513
<listitem>
514
<para>
515
GnuTLS is the library this client uses to implement TLS for
516
communicating securely with the server, and at the same time
517
send the public OpenPGP key to the server.
518
</para>
519
</listitem>
520
</varlistentry>
521
<varlistentry>
522
<term>
523
<ulink url="http://www.gnupg.org/related_software/gpgme/"
524
>GPGME</ulink>
525
</term>
526
<listitem>
527
<para>
528
GPGME is the library used to decrypt the OpenPGP data sent
529
by the server.
530
</para>
531
</listitem>
532
</varlistentry>
533
<varlistentry>
534
<term>
535
RFC 4291: <citetitle>IP Version 6 Addressing
536
Architecture</citetitle>
537
</term>
538
<listitem>
539
<variablelist>
540
<varlistentry>
541
<term>Section 2.2: <citetitle>Text Representation of
542
Addresses</citetitle></term>
543
<listitem><para/></listitem>
544
</varlistentry>
545
<varlistentry>
546
<term>Section 2.5.5.2: <citetitle>IPv4-Mapped IPv6
547
Address</citetitle></term>
548
<listitem><para/></listitem>
549
</varlistentry>
550
<varlistentry>
551
<term>Section 2.5.6, <citetitle>Link-Local IPv6 Unicast
552
Addresses</citetitle></term>
553
<listitem>
554
<para>
555
This client uses IPv6 link-local addresses, which are
556
immediately usable since a link-local addresses is
557
automatically assigned to a network interfaces when it
558
is brought up.
559
</para>
560
</listitem>
561
</varlistentry>
562
</variablelist>
563
</listitem>
564
</varlistentry>
565
<varlistentry>
566
<term>
567
RFC 4346: <citetitle>The Transport Layer Security (TLS)
568
Protocol Version 1.1</citetitle>
569
</term>
570
<listitem>
571
<para>
572
TLS 1.1 is the protocol implemented by GnuTLS.
573
</para>
574
</listitem>
575
</varlistentry>
576
<varlistentry>
577
<term>
578
RFC 4880: <citetitle>OpenPGP Message Format</citetitle>
579
</term>
580
<listitem>
581
<para>
582
The data received from the server is binary encrypted
583
OpenPGP data.
584
</para>
585
</listitem>
586
</varlistentry>
587
<varlistentry>
588
<term>
589
RFC 5081: <citetitle>Using OpenPGP Keys for Transport Layer
590
Security</citetitle>
591
</term>
592
<listitem>
593
<para>
594
This is implemented by GnuTLS and used by this program so
595
that OpenPGP keys can be used.
596
</para>
597
</listitem>
598
</varlistentry>
599
</variablelist>
311
<itemizedlist>
312
<listitem><para>
313
<ulink url="http://www.zeroconf.org/">Zeroconf</ulink>
314
</para></listitem>
315
316
<listitem><para>
317
<ulink url="http://www.avahi.org/">Avahi</ulink>
318
</para></listitem>
319
320
<listitem><para>
321
<ulink
322
url="http://www.gnu.org/software/gnutls/">GnuTLS</ulink>
323
</para></listitem>
324
325
<listitem><para>
326
<ulink
327
url="http://www.gnupg.org/related_software/gpgme/">
328
GPGME</ulink>
329
</para></listitem>
330
331
<listitem><para>
332
<citation>RFC 4880: <citetitle>OpenPGP Message
333
Format</citetitle></citation>
334
</para></listitem>
335
336
<listitem><para>
337
<citation>RFC 5081: <citetitle>Using OpenPGP Keys for
338
Transport Layer Security</citetitle></citation>
339
</para></listitem>
340
341
<listitem><para>
342
<citation>RFC 4291: <citetitle>IP Version 6 Addressing
343
Architecture</citetitle>, section 2.5.6, Link-Local IPv6
344
Unicast Addresses</citation>
345
</para></listitem>
346
</itemizedlist>
600
347
</refsect1>
601
348
602
349
</refentry>
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0