/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos.xml

  • Committer: Teddy Hogeborn
  • Date: 2008-09-06 15:34:21 UTC
  • Revision ID: teddy@fukt.bsnet.se-20080906153421-605ydhwyo404krh9
* initramfs-tools-hook: Use long options where available.  Use only
                        one "test" invocation instead of several.

* mandos-keygen: Use only one "test" invocation instead of several.
                 Use long options where available.  Strip newline from
                 entered password.

* plugin-runner.c (print_out_password): Do not strip trailing newline.
  (fallback): Strip trailing newline from getpass().

* plugin-runner.xml (PLUGINS): Plugins should not print trailing
                               newlines.

* plugins.d/password-prompt.c (main): Strip trailing newline.

* plugins.d/password-request.c (main): Bug fix: Read "pubkey.txt", not
                                       "pupkey.txt".

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos.xml
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY VERSION "1.0">
5
5
<!ENTITY COMMANDNAME "mandos">
6
 
<!ENTITY TIMESTAMP "2008-08-29">
 
6
<!ENTITY TIMESTAMP "2008-09-05">
7
7
]>
8
8
 
9
9
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
34
34
      <holder>Teddy Hogeborn</holder>
35
35
      <holder>Björn Påhlsson</holder>
36
36
    </copyright>
37
 
    <legalnotice>
38
 
      <para>
39
 
        This manual page is free software: you can redistribute it
40
 
        and/or modify it under the terms of the GNU General Public
41
 
        License as published by the Free Software Foundation,
42
 
        either version 3 of the License, or (at your option) any
43
 
        later version.
44
 
      </para>
45
 
 
46
 
      <para>
47
 
        This manual page is distributed in the hope that it will
48
 
        be useful, but WITHOUT ANY WARRANTY; without even the
49
 
        implied warranty of MERCHANTABILITY or FITNESS FOR A
50
 
        PARTICULAR PURPOSE.  See the GNU General Public License
51
 
        for more details.
52
 
      </para>
53
 
 
54
 
      <para>
55
 
        You should have received a copy of the GNU General Public
56
 
        License along with this program; If not, see
57
 
        <ulink url="http://www.gnu.org/licenses/"/>.
58
 
      </para>
59
 
    </legalnotice>
 
37
    <xi:include href="legalnotice.xml"/>
60
38
  </refentryinfo>
61
39
 
62
40
  <refmeta>
67
45
  <refnamediv>
68
46
    <refname><command>&COMMANDNAME;</command></refname>
69
47
    <refpurpose>
70
 
      Sends encrypted passwords to authenticated Mandos clients
 
48
      Gives encrypted passwords to authenticated Mandos clients
71
49
    </refpurpose>
72
50
  </refnamediv>
73
51
 
74
52
  <refsynopsisdiv>
75
53
    <cmdsynopsis>
76
54
      <command>&COMMANDNAME;</command>
77
 
      <arg>--interface<arg choice="plain">NAME</arg></arg>
78
 
      <arg>--address<arg choice="plain">ADDRESS</arg></arg>
79
 
      <arg>--port<arg choice="plain">PORT</arg></arg>
80
 
      <arg>--priority<arg choice="plain">PRIORITY</arg></arg>
81
 
      <arg>--servicename<arg choice="plain">NAME</arg></arg>
82
 
      <arg>--configdir<arg choice="plain">DIRECTORY</arg></arg>
83
 
      <arg>--debug</arg>
84
 
    </cmdsynopsis>
85
 
    <cmdsynopsis>
86
 
      <command>&COMMANDNAME;</command>
87
 
      <arg>-i<arg choice="plain">NAME</arg></arg>
88
 
      <arg>-a<arg choice="plain">ADDRESS</arg></arg>
89
 
      <arg>-p<arg choice="plain">PORT</arg></arg>
90
 
      <arg>--priority<arg choice="plain">PRIORITY</arg></arg>
91
 
      <arg>--servicename<arg choice="plain">NAME</arg></arg>
92
 
      <arg>--configdir<arg choice="plain">DIRECTORY</arg></arg>
93
 
      <arg>--debug</arg>
 
55
      <group>
 
56
        <arg choice="plain"><option>--interface
 
57
        <replaceable>NAME</replaceable></option></arg>
 
58
        <arg choice="plain"><option>-i
 
59
        <replaceable>NAME</replaceable></option></arg>
 
60
      </group>
 
61
      <sbr/>
 
62
      <group>
 
63
        <arg choice="plain"><option>--address
 
64
        <replaceable>ADDRESS</replaceable></option></arg>
 
65
        <arg choice="plain"><option>-a
 
66
        <replaceable>ADDRESS</replaceable></option></arg>
 
67
      </group>
 
68
      <sbr/>
 
69
      <group>
 
70
        <arg choice="plain"><option>--port
 
71
        <replaceable>PORT</replaceable></option></arg>
 
72
        <arg choice="plain"><option>-p
 
73
        <replaceable>PORT</replaceable></option></arg>
 
74
      </group>
 
75
      <sbr/>
 
76
      <arg><option>--priority
 
77
      <replaceable>PRIORITY</replaceable></option></arg>
 
78
      <sbr/>
 
79
      <arg><option>--servicename
 
80
      <replaceable>NAME</replaceable></option></arg>
 
81
      <sbr/>
 
82
      <arg><option>--configdir
 
83
      <replaceable>DIRECTORY</replaceable></option></arg>
 
84
      <sbr/>
 
85
      <arg><option>--debug</option></arg>
94
86
    </cmdsynopsis>
95
87
    <cmdsynopsis>
96
88
      <command>&COMMANDNAME;</command>
97
89
      <group choice="req">
98
 
        <arg choice="plain">-h</arg>
99
 
        <arg choice="plain">--help</arg>
 
90
        <arg choice="plain"><option>--help</option></arg>
 
91
        <arg choice="plain"><option>-h</option></arg>
100
92
      </group>
101
93
    </cmdsynopsis>
102
94
    <cmdsynopsis>
103
95
      <command>&COMMANDNAME;</command>
104
 
      <arg choice="plain">--version</arg>
 
96
      <arg choice="plain"><option>--version</option></arg>
105
97
    </cmdsynopsis>
106
98
    <cmdsynopsis>
107
99
      <command>&COMMANDNAME;</command>
108
 
      <arg choice="plain">--check</arg>
 
100
      <arg choice="plain"><option>--check</option></arg>
109
101
    </cmdsynopsis>
110
102
  </refsynopsisdiv>
111
103
 
123
115
      Any authenticated client is then given the stored pre-encrypted
124
116
      password for that specific client.
125
117
    </para>
126
 
 
127
118
  </refsect1>
128
119
  
129
120
  <refsect1 id="purpose">
130
121
    <title>PURPOSE</title>
131
 
 
132
122
    <para>
133
123
      The purpose of this is to enable <emphasis>remote and unattended
134
124
      rebooting</emphasis> of client host computer with an
135
125
      <emphasis>encrypted root file system</emphasis>.  See <xref
136
126
      linkend="overview"/> for details.
137
127
    </para>
138
 
 
139
128
  </refsect1>
140
129
  
141
130
  <refsect1 id="options">
142
131
    <title>OPTIONS</title>
143
 
 
144
132
    <variablelist>
145
133
      <varlistentry>
 
134
        <term><option>--help</option></term>
146
135
        <term><option>-h</option></term>
147
 
        <term><option>--help</option></term>
148
136
        <listitem>
149
137
          <para>
150
138
            Show a help message and exit
151
139
          </para>
152
140
        </listitem>
153
141
      </varlistentry>
154
 
 
 
142
      
155
143
      <varlistentry>
 
144
        <term><option>--interface</option>
 
145
        <replaceable>NAME</replaceable></term>
156
146
        <term><option>-i</option>
157
147
        <replaceable>NAME</replaceable></term>
158
 
        <term><option>--interface</option>
159
 
        <replaceable>NAME</replaceable></term>
160
148
        <listitem>
161
149
          <xi:include href="mandos-options.xml" xpointer="interface"/>
162
150
        </listitem>
163
151
      </varlistentry>
164
 
 
 
152
      
165
153
      <varlistentry>
166
 
        <term><literal>-a</literal>, <literal>--address <replaceable>
167
 
        ADDRESS</replaceable></literal></term>
 
154
        <term><option>--address
 
155
        <replaceable>ADDRESS</replaceable></option></term>
 
156
        <term><option>-a
 
157
        <replaceable>ADDRESS</replaceable></option></term>
168
158
        <listitem>
169
159
          <xi:include href="mandos-options.xml" xpointer="address"/>
170
160
        </listitem>
171
161
      </varlistentry>
172
 
 
 
162
      
173
163
      <varlistentry>
174
 
        <term><literal>-p</literal>, <literal>--port <replaceable>
175
 
        PORT</replaceable></literal></term>
 
164
        <term><option>--port
 
165
        <replaceable>PORT</replaceable></option></term>
 
166
        <term><option>-p
 
167
        <replaceable>PORT</replaceable></option></term>
176
168
        <listitem>
177
169
          <xi:include href="mandos-options.xml" xpointer="port"/>
178
170
        </listitem>
179
171
      </varlistentry>
180
 
 
 
172
      
181
173
      <varlistentry>
182
 
        <term><literal>--check</literal></term>
 
174
        <term><option>--check</option></term>
183
175
        <listitem>
184
176
          <para>
185
177
            Run the server’s self-tests.  This includes any unit
187
179
          </para>
188
180
        </listitem>
189
181
      </varlistentry>
190
 
 
 
182
      
191
183
      <varlistentry>
192
 
        <term><literal>--debug</literal></term>
 
184
        <term><option>--debug</option></term>
193
185
        <listitem>
194
186
          <xi:include href="mandos-options.xml" xpointer="debug"/>
195
187
        </listitem>
196
188
      </varlistentry>
197
189
 
198
190
      <varlistentry>
199
 
        <term><literal>--priority <replaceable>
200
 
        PRIORITY</replaceable></literal></term>
 
191
        <term><option>--priority <replaceable>
 
192
        PRIORITY</replaceable></option></term>
201
193
        <listitem>
202
194
          <xi:include href="mandos-options.xml" xpointer="priority"/>
203
195
        </listitem>
204
196
      </varlistentry>
205
197
 
206
198
      <varlistentry>
207
 
        <term><literal>--servicename <replaceable>NAME</replaceable>
208
 
        </literal></term>
 
199
        <term><option>--servicename
 
200
        <replaceable>NAME</replaceable></option></term>
209
201
        <listitem>
210
202
          <xi:include href="mandos-options.xml"
211
203
                      xpointer="servicename"/>
213
205
      </varlistentry>
214
206
 
215
207
      <varlistentry>
216
 
        <term><literal>--configdir <replaceable>DIR</replaceable>
217
 
        </literal></term>
 
208
        <term><option>--configdir
 
209
        <replaceable>DIRECTORY</replaceable></option></term>
218
210
        <listitem>
219
211
          <para>
220
212
            Directory to search for configuration files.  Default is
228
220
      </varlistentry>
229
221
 
230
222
      <varlistentry>
231
 
        <term><literal>--version</literal></term>
 
223
        <term><option>--version</option></term>
232
224
        <listitem>
233
225
          <para>
234
226
            Prints the program version and exit.
244
236
    <para>
245
237
      This program is the server part.  It is a normal server program
246
238
      and will run in a normal system environment, not in an initial
247
 
      RAM disk environment.
 
239
      <acronym>RAM</acronym> disk environment.
248
240
    </para>
249
241
  </refsect1>
250
242
 
342
334
    <title>ENVIRONMENT</title>
343
335
    <variablelist>
344
336
      <varlistentry>
345
 
        <term><varname>PATH</varname></term>
 
337
        <term><envar>PATH</envar></term>
346
338
        <listitem>
347
339
          <para>
348
340
            To start the configured checker (see <xref
387
379
        </listitem>
388
380
      </varlistentry>
389
381
      <varlistentry>
390
 
        <term><filename>/var/run/mandos/mandos.pid</filename></term>
 
382
        <term><filename>/var/run/mandos.pid</filename></term>
391
383
        <listitem>
392
384
          <para>
393
385
            The file containing the process id of
442
434
      Debug mode is conflated with running in the foreground.
443
435
    </para>
444
436
    <para>
445
 
      The console log messages does not show a timestamp.
 
437
      The console log messages does not show a time stamp.
 
438
    </para>
 
439
    <para>
 
440
      This server does not check the expire time of clients’ OpenPGP
 
441
      keys.
446
442
    </para>
447
443
  </refsect1>
448
444
  
491
487
      <para>
492
488
        Running this <command>&COMMANDNAME;</command> server program
493
489
        should not in itself present any security risk to the host
494
 
        computer running it.  The program does not need any special
495
 
        privileges to run, and is designed to run as a non-root user.
 
490
        computer running it.  The program switches to a non-root user
 
491
        soon after startup.
496
492
      </para>
497
493
    </refsect2>
498
494
    <refsect2 id="CLIENTS">
525
521
        restarting servers if it is suspected that a client has, in
526
522
        fact, been compromised by parties who may now be running a
527
523
        fake Mandos client with the keys from the non-encrypted
528
 
        initial RAM image of the client host.  What should be done in
529
 
        that case (if restarting the server program really is
530
 
        necessary) is to stop the server program, edit the
 
524
        initial <acronym>RAM</acronym> image of the client host.  What
 
525
        should be done in that case (if restarting the server program
 
526
        really is necessary) is to stop the server program, edit the
531
527
        configuration file to omit any suspect clients, and restart
532
528
        the server program.
533
529
      </para>