/mandos/release : revision 170

3

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

4

<!ENTITY VERSION "1.0">

5

<!ENTITY COMMANDNAME "mandos">

6

<!ENTITY TIMESTAMP "2008-09-05">

6

7

]>

7

8

9

9

10

10

<title>&COMMANDNAME;</title>

11

<title>Mandos Manual</title>

11

12

12

<productname>&COMMANDNAME;</productname>

13

<productname>Mandos</productname>

13

14

<productnumber>&VERSION;</productnumber>

15

<date>&TIMESTAMP;</date>

14

16

15

17

16

18

<firstname>Björn</firstname>

32

34

<holder>Teddy Hogeborn</holder>

33

35

<holder>Björn Påhlsson</holder>

34

36

</copyright>

35

36

<para>

37

This manual page is free software: you can redistribute it

38

and/or modify it under the terms of the GNU General Public

39

License as published by the Free Software Foundation,

40

either version 3 of the License, or (at your option) any

41

later version.

42

</para>

43

44

<para>

45

This manual page is distributed in the hope that it will

46

be useful, but WITHOUT ANY WARRANTY; without even the

47

implied warranty of MERCHANTABILITY or FITNESS FOR A

48

PARTICULAR PURPOSE. See the GNU General Public License

49

for more details.

50

</para>

51

52

<para>

53

You should have received a copy of the GNU General Public

54

License along with this program; If not, see

55

<ulink url="http://www.gnu.org/licenses/"/>.

56

</para>

57

</legalnotice>

37

<xi:include href="legalnotice.xml"/>

58

38

</refentryinfo>

59

39

60

40

65

45

66

46

<refname><command>&COMMANDNAME;</command></refname>

67

47

68

Sends encrypted passwords to authenticated Mandos clients

48

Gives encrypted passwords to authenticated Mandos clients

69

49

</refpurpose>

70

50

</refnamediv>

71

51

72

52

73

53

74

54

<command>&COMMANDNAME;</command>

75

<arg>--interface<arg choice="plain">IF</arg></arg>

76

<arg>--address<arg choice="plain">ADDRESS</arg></arg>

77

78

<arg>--priority<arg choice="plain">PRIORITY</arg></arg>

79

<arg>--servicename<arg choice="plain">NAME</arg></arg>

80

<arg>--configdir<arg choice="plain">DIRECTORY</arg></arg>

81

<arg>--debug</arg>

82

</cmdsynopsis>

83

84

<command>&COMMANDNAME;</command>

85

86

<arg>-a<arg choice="plain">ADDRESS</arg></arg>

87

88

<arg>--priority<arg choice="plain">PRIORITY</arg></arg>

89

<arg>--servicename<arg choice="plain">NAME</arg></arg>

90

<arg>--configdir<arg choice="plain">DIRECTORY</arg></arg>

91

<arg>--debug</arg>

55

<group>

56

<arg choice="plain"><option>--interface

57

58

<arg choice="plain"><option>-i

59

60

</group>

61

<sbr/>

62

<group>

63

<arg choice="plain"><option>--address

64

<replaceable>ADDRESS</replaceable></option></arg>

65

<arg choice="plain"><option>-a

66

<replaceable>ADDRESS</replaceable></option></arg>

67

</group>

68

<sbr/>

69

<group>

70

<arg choice="plain"><option>--port

71

72

<arg choice="plain"><option>-p

73

74

</group>

75

<sbr/>

76

<arg><option>--priority

77

<replaceable>PRIORITY</replaceable></option></arg>

78

<sbr/>

79

<arg><option>--servicename

80

81

<sbr/>

82

<arg><option>--configdir

83

<replaceable>DIRECTORY</replaceable></option></arg>

84

<sbr/>

85

<arg><option>--debug</option></arg>

92

86

</cmdsynopsis>

93

87

94

88

<command>&COMMANDNAME;</command>

95

89

96

97

90

91

98

92

</group>

99

93

</cmdsynopsis>

100

94

101

95

<command>&COMMANDNAME;</command>

102

<arg choice="plain">--version</arg>

96

<arg choice="plain"><option>--version</option></arg>

103

97

</cmdsynopsis>

104

98

105

99

<command>&COMMANDNAME;</command>

106

<arg choice="plain">--check</arg>

100

<arg choice="plain"><option>--check</option></arg>

107

101

</cmdsynopsis>

108

102

</refsynopsisdiv>

109

103

121

115

Any authenticated client is then given the stored pre-encrypted

122

116

password for that specific client.

123

117

</para>

124

125

118

</refsect1>

126

119

127

120

128

121

<title>PURPOSE</title>

129

130

122

<para>

131

123

The purpose of this is to enable <emphasis>remote and unattended

132

124

rebooting</emphasis> of client host computer with an

133

125

<emphasis>encrypted root file system</emphasis>. See <xref

134

126

linkend="overview"/> for details.

135

127

</para>

136

137

128

</refsect1>

138

129

139

130

140

131

<title>OPTIONS</title>

141

142

132

143

133

144

134

135

145

136

146

137

<para>

147

138

Show a help message and exit

148

139

</para>

149

140

</listitem>

150

141

</varlistentry>

151

142

152

143

153

<term><literal>-i</literal>, <literal>--interface <replaceable>

154

IF</replaceable></literal></term>

144

<term><option>--interface</option>

145

146

147

155

148

156

149

<xi:include href="mandos-options.xml" xpointer="interface"/>

157

150

</listitem>

158

151

</varlistentry>

159

152

160

153

161

<term><literal>-a</literal>, <literal>--address <replaceable>

162

ADDRESS</replaceable></literal></term>

154

<term><option>--address

155

<replaceable>ADDRESS</replaceable></option></term>

156

<term><option>-a

157

<replaceable>ADDRESS</replaceable></option></term>

163

158

164

159

<xi:include href="mandos-options.xml" xpointer="address"/>

165

160

</listitem>

166

161

</varlistentry>

167

162

168

163

169

170

PORT</replaceable></literal></term>

164

<term><option>--port

165

166

<term><option>-p

167

171

168

172

169

<xi:include href="mandos-options.xml" xpointer="port"/>

173

170

</listitem>

174

171

</varlistentry>

175

172

176

173

177

<term><literal>--check</literal></term>

174

<term><option>--check</option></term>

178

175

179

176

<para>

180

177

Run the server’s self-tests. This includes any unit

182

179

</para>

183

180

</listitem>

184

181

</varlistentry>

185

182

186

183

187

<term><literal>--debug</literal></term>

184

<term><option>--debug</option></term>

188

185

189

186

<xi:include href="mandos-options.xml" xpointer="debug"/>

190

187

</listitem>

191

188

</varlistentry>

192

189

193

190

194

<term><literal>--priority <replaceable>

195

PRIORITY</replaceable></literal></term>

191

<term><option>--priority <replaceable>

192

PRIORITY</replaceable></option></term>

196

193

197

194

<xi:include href="mandos-options.xml" xpointer="priority"/>

198

195

</listitem>

199

196

</varlistentry>

200

197

201

198

202

<term><literal>--servicename <replaceable>NAME</replaceable>

203

</literal></term>

199

<term><option>--servicename

200

204

201

205

202

<xi:include href="mandos-options.xml"

206

203

xpointer="servicename"/>

208

205

</varlistentry>

209

206

210

207

211

<term><literal>--configdir <replaceable>DIR</replaceable>

212

</literal></term>

208

<term><option>--configdir

209

<replaceable>DIRECTORY</replaceable></option></term>

213

210

214

211

<para>

215

212

Directory to search for configuration files. Default is

223

220

</varlistentry>

224

221

225

222

226

<term><literal>--version</literal></term>

223

<term><option>--version</option></term>

227

224

228

225

<para>

229

226

Prints the program version and exit.

239

236

<para>

240

237

This program is the server part. It is a normal server program

241

238

and will run in a normal system environment, not in an initial

242

RAM disk environment.

239

<acronym>RAM</acronym> disk environment.

243

240

</para>

244

241

</refsect1>

245

242

274

271

275

272

</row>

276

273

<row>

277

274

278

275

279

276

</row>

280

277

<row>

310

307

longer eligible to receive the encrypted password. The timeout,

311

308

checker program, and interval between checks can be configured

312

309

both globally and per client; see <citerefentry>

313

<refentrytitle>mandos.conf</refentrytitle>

314

315

310

<refentrytitle>mandos-clients.conf</refentrytitle>

316

311

<manvolnum>5</manvolnum></citerefentry>.

317

312

</para>

320

315

321

316

<title>LOGGING</title>

322

317

<para>

323

The server will send log messaged with various severity levels

324

to <filename>/dev/log</filename>. With the

318

The server will send log message with various severity levels to

319

<filename>/dev/log</filename>. With the

325

320

<option>--debug</option> option, it will log even more messages,

326

321

and also show them on the console.

327

322

</para>

339

334

<title>ENVIRONMENT</title>

340

335

341

336

342

337

343

338

344

339

<para>

345

340

To start the configured checker (see <xref

348

343

<varname>PATH</varname> to search for matching commands if

349

344

an absolute path is not given. See <citerefentry>

350

345

351

</citerefentry>

346

</citerefentry>.

352

347

</para>

353

348

</listitem>

354

349

</varlistentry>

384

379

</listitem>

385

380

</varlistentry>

386

381

387

<term><filename>/var/run/mandos/mandos.pid</filename></term>

382

<term><filename>/var/run/mandos.pid</filename></term>

388

383

389

384

<para>

390

385

The file containing the process id of

439

434

Debug mode is conflated with running in the foreground.

440

435

</para>

441

436

<para>

442

The console log messages does not show a timestamp.

437

The console log messages does not show a time stamp.

438

</para>

439

<para>

440

This server does not check the expire time of clients’ OpenPGP

441

keys.

443

442

</para>

444

443

</refsect1>

445

444

450

449

Normal invocation needs no options:

451

450

</para>

452

451

<para>

453

<userinput>mandos</userinput>

452

<userinput>&COMMANDNAME;</userinput>

454

453

</para>

455

454

</informalexample>

456

455

463

462

<para>

464

463

465

464

466

<userinput>mandos --debug --configdir ~/mandos --servicename Test</userinput>

465

<userinput>&COMMANDNAME; --debug --configdir ~/mandos --servicename Test</userinput>

467

466

468

467

</para>

469

468

</informalexample>

475

474

<para>

476

475

477

476

478

<userinput>mandos --interface eth7 --address fe80::aede:48ff:fe71:f6f2</userinput>

477

<userinput>&COMMANDNAME; --interface eth7 --address fe80::aede:48ff:fe71:f6f2</userinput>

479

478

480

479

</para>

481

480

</informalexample>

488

487

<para>

489

488

Running this <command>&COMMANDNAME;</command> server program

490

489

should not in itself present any security risk to the host

491

computer running it. The program does not need any special

492

privileges to run, and is designed to run as a non-root user.

490

computer running it. The program switches to a non-root user

491

soon after startup.

493

492

</para>

494

493

</refsect2>

495

494

522

521

restarting servers if it is suspected that a client has, in

523

522

fact, been compromised by parties who may now be running a

524

523

fake Mandos client with the keys from the non-encrypted

525

initial RAM image of the client host. What should be done in

526

that case (if restarting the server program really is

527

necessary) is to stop the server program, edit the

524

initial <acronym>RAM</acronym> image of the client host. What

525

should be done in that case (if restarting the server program

526

really is necessary) is to stop the server program, edit the

528

527

configuration file to omit any suspect clients, and restart

529

528

the server program.

530

529

</para>

538

537

539

538

540

539

540

<para>

541

542

<refentrytitle>mandos-clients.conf</refentrytitle>

543

544

<refentrytitle>mandos.conf</refentrytitle>

545

546

<refentrytitle>password-request</refentrytitle>

547

<manvolnum>8mandos</manvolnum></citerefentry>, <citerefentry>

548

549

</citerefentry>

550

</para>

541

551

542

552

543

553

<term>

544

545

<refentrytitle>password-request</refentrytitle>

546

<manvolnum>8mandos</manvolnum>

547

</citerefentry>

548

</term>

549

550

<para>

551

This is the actual program which talks to this server.

552

Note that it is normally not invoked directly, and is only

553

run in the initial RAM disk environment, and not on a

554

fully started system.

555

</para>

556

</listitem>

557

</varlistentry>

558

559

<term>

560

554

<ulink url="http://www.zeroconf.org/">Zeroconf</ulink>

561

555

</term>

562

556

579

573

</varlistentry>

580

574

581

575

<term>

582

<ulink

583

url="http://www.gnu.org/software/gnutls/">GnuTLS</ulink>

576

<ulink url="http://www.gnu.org/software/gnutls/"

577

>GnuTLS</ulink>

584

578

</term>

585

579

586

580

<para>

592

586

</varlistentry>

593

587

594

588

<term>

595

<citation>RFC 4291: <citetitle>IP Version 6 Addressing

596

Architecture</citetitle>, section 2.5.6, Link-Local IPv6

597

Unicast Addresses</citation>

589

RFC 4291: <citetitle>IP Version 6 Addressing

590

Architecture</citetitle>

598

591

</term>

599

592

600

<para>

601

The clients use IPv6 link-local addresses, which are

602

immediately usable since a link-local addresses is

603

automatically assigned to a network interfaces when it is

604

brought up.

605

</para>

593

594

595

<term>Section 2.2: <citetitle>Text Representation of

596

Addresses</citetitle></term>

597

598

</varlistentry>

599

600

<term>Section 2.5.5.2: <citetitle>IPv4-Mapped IPv6

601

Address</citetitle></term>

602

603

</varlistentry>

604

605

<term>Section 2.5.6, <citetitle>Link-Local IPv6 Unicast

606

Addresses</citetitle></term>

607

608

<para>

609

The clients use IPv6 link-local addresses, which are

610

immediately usable since a link-local addresses is

611

automatically assigned to a network interfaces when it

612

is brought up.

613

</para>

614

</listitem>

615

</varlistentry>

616

</variablelist>

606

617

</listitem>

607

618

</varlistentry>

608

619

609

620

<term>

610

<citation>RFC 4346: <citetitle>The Transport Layer Security

611

(TLS) Protocol Version 1.1</citetitle></citation>

621

RFC 4346: <citetitle>The Transport Layer Security (TLS)

622

Protocol Version 1.1</citetitle>

612

623

</term>

613

624

614

625

<para>

618

629

</varlistentry>

619

630

620

631

<term>

621

<citation>RFC 4880: <citetitle>OpenPGP Message

622

Format</citetitle></citation>

632

RFC 4880: <citetitle>OpenPGP Message Format</citetitle>

623

633

</term>

624

634

625

635

<para>

629

639

</varlistentry>

630

640

631

641

<term>

632

<citation>RFC 5081: <citetitle>Using OpenPGP Keys for

633

Transport Layer Security</citetitle></citation>

642

RFC 5081: <citetitle>Using OpenPGP Keys for Transport Layer

643

Security</citetitle>

634

644

</term>

635

645

636

646

<para>

642

652

</variablelist>

643

653

</refsect1>

644

654

</refentry>

655

656

657

658

659