/mandos/release : revision 173

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to plugins.d/password-prompt.xml

Committer: Teddy Hogeborn
Date: 2008-09-06 16:33:54 UTC
Revision ID: teddy@fukt.bsnet.se-20080906163354-x2l238fvbs2xashj

* .bzrignore: Rename "password-request" to "mandos-client".

files added:
.bzrignore

COPYING

README

default-mandos

etc-plugins.d-README

init.d-mandos

initramfs-tools-hook

initramfs-tools-hook-conf

initramfs-tools-script

legalnotice.xml

mandos-keygen

mandos-keygen.xml

mandos-options.xml

overview.xml

plugin-runner.conf

plugins.d/usplash

files removed:
network-protocol.txt

files renamed:
mandos-client.c => plugin-runner.c

mandos-client.xml => plugin-runner.xml

plugins.d/password-request.c => plugins.d/mandos-client.c

plugins.d/password-request.xml => plugins.d/mandos-client.xml

files modified:
Makefile

TODO

clients.conf

mandos

mandos-clients.conf.xml

mandos.conf

mandos.conf.xml

mandos.xml

plugins.d/password-prompt.c

plugins.d/password-prompt.xml

Show diffs side-by-side

added added

removed removed

plugins.d/password-prompt.xml

<?xml version='1.0' encoding='UTF-8'?>

<?xml-stylesheet type="text/xsl"

href="http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl"?>

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

<!ENTITY VERSION "1.0">

<!ENTITY COMMANDNAME "password-prompt">

<!ENTITY TIMESTAMP "2008-09-06">

<title>&COMMANDNAME;</title>

<productname>&COMMANDNAME;</productname>

<title>Mandos Manual</title>

<productname>Mandos</productname>

<productnumber>&VERSION;</productnumber>

<date>&TIMESTAMP;</date>

<firstname>Björn</firstname>

</authorgroup>

<holder>Teddy Hogeborn & Björn Påhlsson</holder>

<holder>Teddy Hogeborn</holder>

<holder>Björn Påhlsson</holder>

</copyright>

<para>

This manual page is free software: you can redistribute it

and/or modify it under the terms of the GNU General Public

License as published by the Free Software Foundation,

either version 3 of the License, or (at your option) any

later version.

</para>

<para>

This manual page is distributed in the hope that it will

be useful, but WITHOUT ANY WARRANTY; without even the

implied warranty of MERCHANTABILITY or FITNESS FOR A

PARTICULAR PURPOSE. See the GNU General Public License

for more details.

</para>

<para>

You should have received a copy of the GNU General Public

License along with this program; If not, see

<ulink url="http://www.gnu.org/licenses/"/>.

</para>

</legalnotice>

<xi:include href="../legalnotice.xml"/>

</refentryinfo>

<refentrytitle>&COMMANDNAME;</refentrytitle>

<manvolnum>8mandos</manvolnum>

<refname><command>&COMMANDNAME;</command></refname>

Passprompt for luks during boot sequence

</refpurpose>

<refpurpose>Prompt for a password and output it.</refpurpose>

</refnamediv>

<command>&COMMANDNAME;</command>

<arg choice='opt'>--prefix<arg choice='plain'>PREFIX</arg></arg>

<arg choice='opt'>--debug</arg>

</cmdsynopsis>

<command>&COMMANDNAME;</command>

</cmdsynopsis>

<command>&COMMANDNAME;</command>

<arg choice='plain'>--usage</arg>

</cmdsynopsis>

<command>&COMMANDNAME;</command>

<arg choice='plain'>--version</arg>

</cmdsynopsis>

<arg choice="plain"><option>--prefix <replaceable

>PREFIX</replaceable></option></arg>

<arg choice="plain"><option>-p </option><replaceable

>PREFIX</replaceable></arg>

</group>

<sbr/>

<arg choice="opt"><option>--debug</option></arg>

</cmdsynopsis>

<command>&COMMANDNAME;</command>

</group>

</cmdsynopsis>

<command>&COMMANDNAME;</command>

<arg choice="plain"><option>--usage</option></arg>

</cmdsynopsis>

<command>&COMMANDNAME;</command>

<arg choice="plain"><option>--version</option></arg>

</group>

</cmdsynopsis>

</refsynopsisdiv>

<title>DESCRIPTION</title>

<para>

<command>&COMMANDNAME;</command> is a terminal program that ask for

passwords during boot sequence. It is a plugin to

<firstterm>mandos</firstterm>, and is used as a fallback and

alternative to retriving passwords from a mandos server. During

100

boot sequence the user is prompted for the disk password, and

101

when a password is given it then gets forwarded to

102

<acronym>LUKS</acronym>.

103

</para>

104

105

106

107

<term><literal>-p</literal>, <literal>--prefix=<replaceable>PREFIX

108

</replaceable></literal></term>

109

110

<para>

111

Prefix used before the passprompt

112

</para>

113

</listitem>

114

</varlistentry>

115

116

117

<term><literal>--debug</literal></term>

118

119

<para>

120

Debug mode

121

</para>

122

</listitem>

123

</varlistentry>

124

125

126

127

128

<para>

129

Gives a help message

130

</para>

131

</listitem>

132

</varlistentry>

133

134

135

<term><literal>--usage</literal></term>

136

137

<para>

138

Gives a short usage message

139

</para>

140

</listitem>

141

</varlistentry>

142

143

144

<term><literal>-V</literal>, <literal>--version</literal></term>

145

146

<para>

147

Prints the program version

148

</para>

149

</listitem>

150

</varlistentry>

151

</variablelist>

All <command>&COMMANDNAME;</command> does is prompt for a

password and output any given password to standard output. This

is not very useful on its own. This program is really meant to

run as a plugin in the <application>Mandos</application>

client-side system, where it is used as a fallback and

alternative to retrieving passwords from a <application

>Mandos</application> server.

</para>

<para>

This program is little more than a <citerefentry><refentrytitle

>getpass</refentrytitle><manvolnum>3</manvolnum></citerefentry>

wrapper, although actual use of that function is not guaranteed

or implied.

</para>

</refsect1>

100

101

102

<title>OPTIONS</title>

103

<para>

104

This program is commonly not invoked from the command line; it

105

is normally started by the <application>Mandos</application>

106

plugin runner, see <citerefentry><refentrytitle

107

>plugin-runner</refentrytitle><manvolnum>8mandos</manvolnum>

108

</citerefentry>. Any command line options this program accepts

109

are therefore normally provided by the plugin runner, and not

110

directly.

111

</para>

112

113

114

115

<term><option>--prefix=<replaceable

116

>PREFIX</replaceable></option></term>

117

<term><option>-p

118

<replaceable>PREFIX</replaceable></option></term>

119

120

<para>

121

Prefix string shown before the password prompt.

122

</para>

123

</listitem>

124

</varlistentry>

125

126

127

<term><option>--debug</option></term>

128

129

<para>

130

Enable debug mode. This will enable a lot of output to

131

standard error about what the program is doing. The

132

program will still perform all other functions normally.

133

</para>

134

</listitem>

135

</varlistentry>

136

137

138

139

140

141

<para>

142

Gives a help message about options and their meanings.

143

</para>

144

</listitem>

145

</varlistentry>

146

147

148

<term><option>--usage</option></term>

149

150

<para>

151

Gives a short usage message.

152

</para>

153

</listitem>

154

</varlistentry>

155

156

157

<term><option>--version</option></term>

158

159

160

<para>

161

Prints the program version.

162

</para>

163

</listitem>

164

</varlistentry>

165

</variablelist>

166

</refsect1>

167

168

169

<title>EXIT STATUS</title>

170

<para>

171

If exit status is 0, the output from the program is the password

172

as it was read. Otherwise, if exit status is other than 0, the

173

program has encountered an error, and any output so far could be

174

corrupt and/or truncated, and should therefore be ignored.

175

</para>

176

</refsect1>

177

178

179

<title>ENVIRONMENT</title>

180

181

182

<term><envar>cryptsource</envar></term>

183

<term><envar>crypttarget</envar></term>

184

185

<para>

186

If set, these environment variables will be assumed to

187

contain the source device name and the target device

188

mapper name, respectively, and will be shown as part of

189

the prompt.

190

</para>

191

<para>

192

These variables will normally be inherited from

193

<citerefentry><refentrytitle>plugin-runner</refentrytitle>

194

<manvolnum>8mandos</manvolnum></citerefentry>, which will

195

normally have inherited them from

196

<filename>/scripts/local-top/cryptroot</filename> in the

197

initial <acronym>RAM</acronym> disk environment, which will

198

have set them from parsing kernel arguments and

199

<filename>/conf/conf.d/cryptroot</filename> (also in the

200

initial RAM disk environment), which in turn will have been

201

created when the initial RAM disk image was created by

202

<filename

203

>/usr/share/initramfs-tools/hooks/cryptroot</filename>, by

204

extracting the information of the root file system from

205

<filename >/etc/crypttab</filename>.

206

</para>

207

<para>

208

This behavior is meant to exactly mirror the behavior of

209

<command>askpass</command>, the default password prompter.

210

</para>

211

</listitem>

212

</varlistentry>

213

</variablelist>

214

</refsect1>

215

216

217

218

<para>

219

None are known at this time.

220

</para>

221

</refsect1>

222

223

224

<title>EXAMPLE</title>

225

<para>

226

Note that normally, command line options will not be given

227

directly, but via options for the Mandos <citerefentry

228

><refentrytitle>plugin-runner</refentrytitle>

229

<manvolnum>8mandos</manvolnum></citerefentry>.

230

</para>

231

232

<para>

233

Normal invocation needs no options:

234

</para>

235

<para>

236

<userinput>&COMMANDNAME;</userinput>

237

</para>

238

</informalexample>

239

240

<para>

241

Show a prefix before the prompt; in this case, a host name.

242

It might be useful to be reminded of which host needs a

243

password, in case of <acronym>KVM</acronym> switches, etc.

244

</para>

245

<para>

246

247

248

<userinput>&COMMANDNAME; --prefix=host.example.org:</userinput>

249

250

</para>

251

</informalexample>

252

253

<para>

254

Run in debug mode.

255

</para>

256

<para>

257

258

<userinput>&COMMANDNAME; --debug</userinput>

259

</para>

260

</informalexample>

261

</refsect1>

262

263

264

<title>SECURITY</title>

265

<para>

266

On its own, this program is very simple, and does not exactly

267

present any security risks. The one thing that could be

268

considered worthy of note is this: This program is meant to be

269

run by <citerefentry><refentrytitle

270

>plugin-runner</refentrytitle><manvolnum>8mandos</manvolnum>

271

</citerefentry>, and will, when run standalone, outside, in a

272

normal environment, immediately output on its standard output

273

any presumably secret password it just received. Therefore,

274

when running this program standalone (which should never

275

normally be done), take care not to type in any real secret

276

password by force of habit, since it would then immediately be

277

shown as output.

278

</para>

279

<para>

280

To further alleviate any risk of being locked out of a system,

281

the <citerefentry><refentrytitle>plugin-runner</refentrytitle>

282

<manvolnum>8mandos</manvolnum></citerefentry> has a fallback

283

mode which does the same thing as this program, only with less

284

features.

285

</para>

286

</refsect1>

287

288

289

290

<para>

291

<citerefentry><refentrytitle>crypttab</refentrytitle>

292

293

<citerefentry><refentrytitle>mandos-client</refentrytitle>

294

<manvolnum>8mandos</manvolnum></citerefentry>

295

<citerefentry><refentrytitle>plugin-runner</refentrytitle>

296

<manvolnum>8mandos</manvolnum></citerefentry>,

297

</para>

152

298

</refsect1>

153

299

</refentry>

300

301

302

303

304

Older »