/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos.xml

  • Committer: Teddy Hogeborn
  • Date: 2008-09-05 16:24:33 UTC
  • Revision ID: teddy@fukt.bsnet.se-20080905162433-58fgx91ae9foxlh1
* Makefile (PIDDIR, USER, GROUP): Removed.
  (install-server): Do not create $(PIDDIR).
  (uninstall-server): Do not remove $(PIDDIR).

* init.d-mandos (PIDFILE): Changed to "/var/run/$NAME.pid".

* mandos (IPv6_TCPServer.enabled): New attribute.
  (IPv6_TCPServer.server_activate): Only call method of superclass if
                                    "self.enabled".
  (IPv6_TCPServer.enable): Set "self.enabled" to True.
  (main): Create client Set() early.  Create IPv6_TCPServer object
          early.  Switch to user and group "mandos", "nobody" or
          65534, if possible.  Enable IPv6_TCPServer *after* switching
          user.

* mandos-keygen (KEYDIR): Changed to "/etc/keys/mandos".

* mandos.xml (FILES): Changed PID file.
  (SECURITY): The server does need to be privileged, but switches to a
              non-privileged user.

* plugin-runner.xml (EXAMPLE): Changed long example to something more
                               realistic.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos.xml
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY VERSION "1.0">
5
5
<!ENTITY COMMANDNAME "mandos">
6
 
<!ENTITY TIMESTAMP "2008-08-29">
 
6
<!ENTITY TIMESTAMP "2008-09-05">
7
7
]>
8
8
 
9
9
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
34
34
      <holder>Teddy Hogeborn</holder>
35
35
      <holder>Björn Påhlsson</holder>
36
36
    </copyright>
37
 
    <legalnotice>
38
 
      <para>
39
 
        This manual page is free software: you can redistribute it
40
 
        and/or modify it under the terms of the GNU General Public
41
 
        License as published by the Free Software Foundation,
42
 
        either version 3 of the License, or (at your option) any
43
 
        later version.
44
 
      </para>
45
 
 
46
 
      <para>
47
 
        This manual page is distributed in the hope that it will
48
 
        be useful, but WITHOUT ANY WARRANTY; without even the
49
 
        implied warranty of MERCHANTABILITY or FITNESS FOR A
50
 
        PARTICULAR PURPOSE.  See the GNU General Public License
51
 
        for more details.
52
 
      </para>
53
 
 
54
 
      <para>
55
 
        You should have received a copy of the GNU General Public
56
 
        License along with this program; If not, see
57
 
        <ulink url="http://www.gnu.org/licenses/"/>.
58
 
      </para>
59
 
    </legalnotice>
 
37
    <xi:include href="legalnotice.xml"/>
60
38
  </refentryinfo>
61
39
 
62
40
  <refmeta>
67
45
  <refnamediv>
68
46
    <refname><command>&COMMANDNAME;</command></refname>
69
47
    <refpurpose>
70
 
      Sends encrypted passwords to authenticated Mandos clients
 
48
      Gives encrypted passwords to authenticated Mandos clients
71
49
    </refpurpose>
72
50
  </refnamediv>
73
51
 
74
52
  <refsynopsisdiv>
75
53
    <cmdsynopsis>
76
54
      <command>&COMMANDNAME;</command>
77
 
      <arg>--interface<arg choice="plain">NAME</arg></arg>
78
 
      <arg>--address<arg choice="plain">ADDRESS</arg></arg>
79
 
      <arg>--port<arg choice="plain">PORT</arg></arg>
80
 
      <arg>--priority<arg choice="plain">PRIORITY</arg></arg>
81
 
      <arg>--servicename<arg choice="plain">NAME</arg></arg>
82
 
      <arg>--configdir<arg choice="plain">DIRECTORY</arg></arg>
83
 
      <arg>--debug</arg>
84
 
    </cmdsynopsis>
85
 
    <cmdsynopsis>
86
 
      <command>&COMMANDNAME;</command>
87
 
      <arg>-i<arg choice="plain">NAME</arg></arg>
88
 
      <arg>-a<arg choice="plain">ADDRESS</arg></arg>
89
 
      <arg>-p<arg choice="plain">PORT</arg></arg>
90
 
      <arg>--priority<arg choice="plain">PRIORITY</arg></arg>
91
 
      <arg>--servicename<arg choice="plain">NAME</arg></arg>
92
 
      <arg>--configdir<arg choice="plain">DIRECTORY</arg></arg>
93
 
      <arg>--debug</arg>
 
55
      <group>
 
56
        <arg choice="plain"><option>--interface
 
57
        <replaceable>NAME</replaceable></option></arg>
 
58
        <arg choice="plain"><option>-i
 
59
        <replaceable>NAME</replaceable></option></arg>
 
60
      </group>
 
61
      <sbr/>
 
62
      <group>
 
63
        <arg choice="plain"><option>--address
 
64
        <replaceable>ADDRESS</replaceable></option></arg>
 
65
        <arg choice="plain"><option>-a
 
66
        <replaceable>ADDRESS</replaceable></option></arg>
 
67
      </group>
 
68
      <sbr/>
 
69
      <group>
 
70
        <arg choice="plain"><option>--port
 
71
        <replaceable>PORT</replaceable></option></arg>
 
72
        <arg choice="plain"><option>-p
 
73
        <replaceable>PORT</replaceable></option></arg>
 
74
      </group>
 
75
      <sbr/>
 
76
      <arg><option>--priority
 
77
      <replaceable>PRIORITY</replaceable></option></arg>
 
78
      <sbr/>
 
79
      <arg><option>--servicename
 
80
      <replaceable>NAME</replaceable></option></arg>
 
81
      <sbr/>
 
82
      <arg><option>--configdir
 
83
      <replaceable>DIRECTORY</replaceable></option></arg>
 
84
      <sbr/>
 
85
      <arg><option>--debug</option></arg>
94
86
    </cmdsynopsis>
95
87
    <cmdsynopsis>
96
88
      <command>&COMMANDNAME;</command>
97
89
      <group choice="req">
98
 
        <arg choice="plain">-h</arg>
99
 
        <arg choice="plain">--help</arg>
 
90
        <arg choice="plain"><option>--help</option></arg>
 
91
        <arg choice="plain"><option>-h</option></arg>
100
92
      </group>
101
93
    </cmdsynopsis>
102
94
    <cmdsynopsis>
103
95
      <command>&COMMANDNAME;</command>
104
 
      <arg choice="plain">--version</arg>
 
96
      <arg choice="plain"><option>--version</option></arg>
105
97
    </cmdsynopsis>
106
98
    <cmdsynopsis>
107
99
      <command>&COMMANDNAME;</command>
108
 
      <arg choice="plain">--check</arg>
 
100
      <arg choice="plain"><option>--check</option></arg>
109
101
    </cmdsynopsis>
110
102
  </refsynopsisdiv>
111
103
 
123
115
      Any authenticated client is then given the stored pre-encrypted
124
116
      password for that specific client.
125
117
    </para>
126
 
 
127
118
  </refsect1>
128
119
  
129
120
  <refsect1 id="purpose">
130
121
    <title>PURPOSE</title>
131
 
 
132
122
    <para>
133
123
      The purpose of this is to enable <emphasis>remote and unattended
134
124
      rebooting</emphasis> of client host computer with an
135
125
      <emphasis>encrypted root file system</emphasis>.  See <xref
136
126
      linkend="overview"/> for details.
137
127
    </para>
138
 
 
139
128
  </refsect1>
140
129
  
141
130
  <refsect1 id="options">
142
131
    <title>OPTIONS</title>
143
 
 
144
132
    <variablelist>
145
133
      <varlistentry>
146
 
        <term><literal>-h</literal>, <literal>--help</literal></term>
 
134
        <term><option>--help</option></term>
 
135
        <term><option>-h</option></term>
147
136
        <listitem>
148
137
          <para>
149
138
            Show a help message and exit
150
139
          </para>
151
140
        </listitem>
152
141
      </varlistentry>
153
 
 
 
142
      
154
143
      <varlistentry>
155
 
        <term><literal>-i</literal>, <literal>--interface <replaceable
156
 
        >NAME</replaceable></literal></term>
 
144
        <term><option>--interface</option>
 
145
        <replaceable>NAME</replaceable></term>
 
146
        <term><option>-i</option>
 
147
        <replaceable>NAME</replaceable></term>
157
148
        <listitem>
158
149
          <xi:include href="mandos-options.xml" xpointer="interface"/>
159
150
        </listitem>
160
151
      </varlistentry>
161
 
 
 
152
      
162
153
      <varlistentry>
163
 
        <term><literal>-a</literal>, <literal>--address <replaceable>
164
 
        ADDRESS</replaceable></literal></term>
 
154
        <term><option>--address
 
155
        <replaceable>ADDRESS</replaceable></option></term>
 
156
        <term><option>-a
 
157
        <replaceable>ADDRESS</replaceable></option></term>
165
158
        <listitem>
166
159
          <xi:include href="mandos-options.xml" xpointer="address"/>
167
160
        </listitem>
168
161
      </varlistentry>
169
 
 
 
162
      
170
163
      <varlistentry>
171
 
        <term><literal>-p</literal>, <literal>--port <replaceable>
172
 
        PORT</replaceable></literal></term>
 
164
        <term><option>--port
 
165
        <replaceable>PORT</replaceable></option></term>
 
166
        <term><option>-p
 
167
        <replaceable>PORT</replaceable></option></term>
173
168
        <listitem>
174
169
          <xi:include href="mandos-options.xml" xpointer="port"/>
175
170
        </listitem>
176
171
      </varlistentry>
177
 
 
 
172
      
178
173
      <varlistentry>
179
 
        <term><literal>--check</literal></term>
 
174
        <term><option>--check</option></term>
180
175
        <listitem>
181
176
          <para>
182
177
            Run the server’s self-tests.  This includes any unit
184
179
          </para>
185
180
        </listitem>
186
181
      </varlistentry>
187
 
 
 
182
      
188
183
      <varlistentry>
189
 
        <term><literal>--debug</literal></term>
 
184
        <term><option>--debug</option></term>
190
185
        <listitem>
191
186
          <xi:include href="mandos-options.xml" xpointer="debug"/>
192
187
        </listitem>
193
188
      </varlistentry>
194
189
 
195
190
      <varlistentry>
196
 
        <term><literal>--priority <replaceable>
197
 
        PRIORITY</replaceable></literal></term>
 
191
        <term><option>--priority <replaceable>
 
192
        PRIORITY</replaceable></option></term>
198
193
        <listitem>
199
194
          <xi:include href="mandos-options.xml" xpointer="priority"/>
200
195
        </listitem>
201
196
      </varlistentry>
202
197
 
203
198
      <varlistentry>
204
 
        <term><literal>--servicename <replaceable>NAME</replaceable>
205
 
        </literal></term>
 
199
        <term><option>--servicename
 
200
        <replaceable>NAME</replaceable></option></term>
206
201
        <listitem>
207
202
          <xi:include href="mandos-options.xml"
208
203
                      xpointer="servicename"/>
210
205
      </varlistentry>
211
206
 
212
207
      <varlistentry>
213
 
        <term><literal>--configdir <replaceable>DIR</replaceable>
214
 
        </literal></term>
 
208
        <term><option>--configdir
 
209
        <replaceable>DIRECTORY</replaceable></option></term>
215
210
        <listitem>
216
211
          <para>
217
212
            Directory to search for configuration files.  Default is
225
220
      </varlistentry>
226
221
 
227
222
      <varlistentry>
228
 
        <term><literal>--version</literal></term>
 
223
        <term><option>--version</option></term>
229
224
        <listitem>
230
225
          <para>
231
226
            Prints the program version and exit.
241
236
    <para>
242
237
      This program is the server part.  It is a normal server program
243
238
      and will run in a normal system environment, not in an initial
244
 
      RAM disk environment.
 
239
      <acronym>RAM</acronym> disk environment.
245
240
    </para>
246
241
  </refsect1>
247
242
 
339
334
    <title>ENVIRONMENT</title>
340
335
    <variablelist>
341
336
      <varlistentry>
342
 
        <term><varname>PATH</varname></term>
 
337
        <term><envar>PATH</envar></term>
343
338
        <listitem>
344
339
          <para>
345
340
            To start the configured checker (see <xref
384
379
        </listitem>
385
380
      </varlistentry>
386
381
      <varlistentry>
387
 
        <term><filename>/var/run/mandos/mandos.pid</filename></term>
 
382
        <term><filename>/var/run/mandos.pid</filename></term>
388
383
        <listitem>
389
384
          <para>
390
385
            The file containing the process id of
439
434
      Debug mode is conflated with running in the foreground.
440
435
    </para>
441
436
    <para>
442
 
      The console log messages does not show a timestamp.
 
437
      The console log messages does not show a time stamp.
 
438
    </para>
 
439
    <para>
 
440
      This server does not check the expire time of clients’ OpenPGP
 
441
      keys.
443
442
    </para>
444
443
  </refsect1>
445
444
  
488
487
      <para>
489
488
        Running this <command>&COMMANDNAME;</command> server program
490
489
        should not in itself present any security risk to the host
491
 
        computer running it.  The program does not need any special
492
 
        privileges to run, and is designed to run as a non-root user.
 
490
        computer running it.  The program switches to a non-root user
 
491
        soon after startup.
493
492
      </para>
494
493
    </refsect2>
495
494
    <refsect2 id="CLIENTS">
522
521
        restarting servers if it is suspected that a client has, in
523
522
        fact, been compromised by parties who may now be running a
524
523
        fake Mandos client with the keys from the non-encrypted
525
 
        initial RAM image of the client host.  What should be done in
526
 
        that case (if restarting the server program really is
527
 
        necessary) is to stop the server program, edit the
 
524
        initial <acronym>RAM</acronym> image of the client host.  What
 
525
        should be done in that case (if restarting the server program
 
526
        really is necessary) is to stop the server program, edit the
528
527
        configuration file to omit any suspect clients, and restart
529
528
        the server program.
530
529
      </para>