/mandos/release : revision 176

3

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

4

<!ENTITY VERSION "1.0">

5

<!ENTITY COMMANDNAME "mandos">

6

<!ENTITY TIMESTAMP "2008-09-06">

6

7

]>

7

8

9

9

10

10

<title>&COMMANDNAME;</title>

11

<title>Mandos Manual</title>

11

12

12

<productname>&COMMANDNAME;</productname>

13

<productname>Mandos</productname>

13

14

<productnumber>&VERSION;</productnumber>

15

<date>&TIMESTAMP;</date>

14

16

15

17

16

18

<firstname>Björn</firstname>

32

34

<holder>Teddy Hogeborn</holder>

33

35

<holder>Björn Påhlsson</holder>

34

36

</copyright>

35

36

<para>

37

This manual page is free software: you can redistribute it

38

and/or modify it under the terms of the GNU General Public

39

License as published by the Free Software Foundation,

40

either version 3 of the License, or (at your option) any

41

later version.

42

</para>

43

44

<para>

45

This manual page is distributed in the hope that it will

46

be useful, but WITHOUT ANY WARRANTY; without even the

47

implied warranty of MERCHANTABILITY or FITNESS FOR A

48

PARTICULAR PURPOSE. See the GNU General Public License

49

for more details.

50

</para>

51

52

<para>

53

You should have received a copy of the GNU General Public

54

License along with this program; If not, see

55

<ulink url="http://www.gnu.org/licenses/"/>.

56

</para>

57

</legalnotice>

37

<xi:include href="legalnotice.xml"/>

58

38

</refentryinfo>

59

39

60

40

65

45

66

46

<refname><command>&COMMANDNAME;</command></refname>

67

47

68

Sends encrypted passwords to authenticated Mandos clients

48

Gives encrypted passwords to authenticated Mandos clients

69

49

</refpurpose>

70

50

</refnamediv>

71

51

72

52

73

53

74

54

<command>&COMMANDNAME;</command>

75

<arg>--interface<arg choice="plain">IF</arg></arg>

76

<arg>--address<arg choice="plain">ADDRESS</arg></arg>

77

78

<arg>--priority<arg choice="plain">PRIORITY</arg></arg>

79

<arg>--servicename<arg choice="plain">NAME</arg></arg>

80

<arg>--configdir<arg choice="plain">DIRECTORY</arg></arg>

81

<arg>--debug</arg>

82

</cmdsynopsis>

83

84

<command>&COMMANDNAME;</command>

85

86

<arg>-a<arg choice="plain">ADDRESS</arg></arg>

87

88

<arg>--priority<arg choice="plain">PRIORITY</arg></arg>

89

<arg>--servicename<arg choice="plain">NAME</arg></arg>

90

<arg>--configdir<arg choice="plain">DIRECTORY</arg></arg>

91

<arg>--debug</arg>

55

<group>

56

<arg choice="plain"><option>--interface

57

58

<arg choice="plain"><option>-i

59

60

</group>

61

<sbr/>

62

<group>

63

<arg choice="plain"><option>--address

64

<replaceable>ADDRESS</replaceable></option></arg>

65

<arg choice="plain"><option>-a

66

<replaceable>ADDRESS</replaceable></option></arg>

67

</group>

68

<sbr/>

69

<group>

70

<arg choice="plain"><option>--port

71

72

<arg choice="plain"><option>-p

73

74

</group>

75

<sbr/>

76

<arg><option>--priority

77

<replaceable>PRIORITY</replaceable></option></arg>

78

<sbr/>

79

<arg><option>--servicename

80

81

<sbr/>

82

<arg><option>--configdir

83

<replaceable>DIRECTORY</replaceable></option></arg>

84

<sbr/>

85

<arg><option>--debug</option></arg>

92

86

</cmdsynopsis>

93

87

94

88

<command>&COMMANDNAME;</command>

95

89

96

97

90

91

98

92

</group>

99

93

</cmdsynopsis>

100

94

101

95

<command>&COMMANDNAME;</command>

102

<arg choice="plain">--version</arg>

96

<arg choice="plain"><option>--version</option></arg>

103

97

</cmdsynopsis>

104

98

105

99

<command>&COMMANDNAME;</command>

106

<arg choice="plain">--check</arg>

100

<arg choice="plain"><option>--check</option></arg>

107

101

</cmdsynopsis>

108

102

</refsynopsisdiv>

109

103

121

115

Any authenticated client is then given the stored pre-encrypted

122

116

password for that specific client.

123

117

</para>

124

125

118

</refsect1>

126

119

127

120

128

121

<title>PURPOSE</title>

129

130

122

<para>

131

123

The purpose of this is to enable <emphasis>remote and unattended

132

124

rebooting</emphasis> of client host computer with an

133

125

<emphasis>encrypted root file system</emphasis>. See <xref

134

126

linkend="overview"/> for details.

135

127

</para>

136

137

128

</refsect1>

138

129

139

130

140

131

<title>OPTIONS</title>

141

142

132

143

133

144

134

135

145

136

146

137

<para>

147

138

Show a help message and exit

148

139

</para>

149

140

</listitem>

150

141

</varlistentry>

151

142

152

143

153

<term><literal>-i</literal>, <literal>--interface <replaceable>

154

IF</replaceable></literal></term>

144

<term><option>--interface</option>

145

146

147

155

148

156

149

<xi:include href="mandos-options.xml" xpointer="interface"/>

157

150

</listitem>

158

151

</varlistentry>

159

152

160

153

161

<term><literal>-a</literal>, <literal>--address <replaceable>

162

ADDRESS</replaceable></literal></term>

154

<term><option>--address

155

<replaceable>ADDRESS</replaceable></option></term>

156

<term><option>-a

157

<replaceable>ADDRESS</replaceable></option></term>

163

158

164

159

<xi:include href="mandos-options.xml" xpointer="address"/>

165

160

</listitem>

166

161

</varlistentry>

167

162

168

163

169

170

PORT</replaceable></literal></term>

164

<term><option>--port

165

166

<term><option>-p

167

171

168

172

169

<xi:include href="mandos-options.xml" xpointer="port"/>

173

170

</listitem>

174

171

</varlistentry>

175

172

176

173

177

<term><literal>--check</literal></term>

174

<term><option>--check</option></term>

178

175

179

176

<para>

180

177

Run the server’s self-tests. This includes any unit

182

179

</para>

183

180

</listitem>

184

181

</varlistentry>

185

182

186

183

187

<term><literal>--debug</literal></term>

184

<term><option>--debug</option></term>

188

185

189

186

<xi:include href="mandos-options.xml" xpointer="debug"/>

190

187

</listitem>

191

188

</varlistentry>

192

189

193

190

194

<term><literal>--priority <replaceable>

195

PRIORITY</replaceable></literal></term>

191

<term><option>--priority <replaceable>

192

PRIORITY</replaceable></option></term>

196

193

197

194

<xi:include href="mandos-options.xml" xpointer="priority"/>

198

195

</listitem>

199

196

</varlistentry>

200

197

201

198

202

<term><literal>--servicename <replaceable>NAME</replaceable>

203

</literal></term>

199

<term><option>--servicename

200

204

201

205

202

<xi:include href="mandos-options.xml"

206

203

xpointer="servicename"/>

208

205

</varlistentry>

209

206

210

207

211

<term><literal>--configdir <replaceable>DIR</replaceable>

212

</literal></term>

208

<term><option>--configdir

209

<replaceable>DIRECTORY</replaceable></option></term>

213

210

214

211

<para>

215

212

Directory to search for configuration files. Default is

223

220

</varlistentry>

224

221

225

222

226

<term><literal>--version</literal></term>

223

<term><option>--version</option></term>

227

224

228

225

<para>

229

226

Prints the program version and exit.

239

236

<para>

240

237

This program is the server part. It is a normal server program

241

238

and will run in a normal system environment, not in an initial

242

RAM disk environment.

239

<acronym>RAM</acronym> disk environment.

243

240

</para>

244

241

</refsect1>

245

242

337

334

<title>ENVIRONMENT</title>

338

335

339

336

340

337

341

338

342

339

<para>

343

340

To start the configured checker (see <xref

382

379

</listitem>

383

380

</varlistentry>

384

381

385

<term><filename>/var/run/mandos/mandos.pid</filename></term>

382

<term><filename>/var/run/mandos.pid</filename></term>

386

383

387

384

<para>

388

385

The file containing the process id of

437

434

Debug mode is conflated with running in the foreground.

438

435

</para>

439

436

<para>

440

The console log messages does not show a timestamp.

437

The console log messages does not show a time stamp.

438

</para>

439

<para>

440

This server does not check the expire time of clients’ OpenPGP

441

keys.

441

442

</para>

442

443

</refsect1>

443

444

448

449

Normal invocation needs no options:

449

450

</para>

450

451

<para>

451

<userinput>mandos</userinput>

452

<userinput>&COMMANDNAME;</userinput>

452

453

</para>

453

454

</informalexample>

454

455

461

462

<para>

462

463

464

464

<userinput>mandos --debug --configdir ~/mandos --servicename Test</userinput>

465

<userinput>&COMMANDNAME; --debug --configdir ~/mandos --servicename Test</userinput>

465

466

467

</para>

467

468

</informalexample>

473

474

<para>

474

475

476

476

<userinput>mandos --interface eth7 --address fe80::aede:48ff:fe71:f6f2</userinput>

477

<userinput>&COMMANDNAME; --interface eth7 --address fe80::aede:48ff:fe71:f6f2</userinput>

477

478

479

</para>

479

480

</informalexample>

486

487

<para>

487

488

Running this <command>&COMMANDNAME;</command> server program

488

489

should not in itself present any security risk to the host

489

computer running it. The program does not need any special

490

privileges to run, and is designed to run as a non-root user.

490

computer running it. The program switches to a non-root user

491

soon after startup.

491

492

</para>

492

493

</refsect2>

493

494

520

521

restarting servers if it is suspected that a client has, in

521

522

fact, been compromised by parties who may now be running a

522

523

fake Mandos client with the keys from the non-encrypted

523

initial RAM image of the client host. What should be done in

524

that case (if restarting the server program really is

525

necessary) is to stop the server program, edit the

524

initial <acronym>RAM</acronym> image of the client host. What

525

should be done in that case (if restarting the server program

526

really is necessary) is to stop the server program, edit the

526

527

configuration file to omit any suspect clients, and restart

527

528

the server program.

528

529

</para>

529

530

<para>

530

531

For more details on client-side security, see

531

<citerefentry><refentrytitle>password-request</refentrytitle>

532

<citerefentry><refentrytitle>mandos-client</refentrytitle>

532

533

<manvolnum>8mandos</manvolnum></citerefentry>.

533

534

</para>

534

535

</refsect2>

538

539

539

540

<para>

540

541

542

<refentrytitle>mandos-clients.conf</refentrytitle>

543

541

544

<refentrytitle>mandos.conf</refentrytitle>

542

545

543

<refentrytitle>mandos-clients.conf</refentrytitle>

544

545

<refentrytitle>password-request</refentrytitle>

546

<refentrytitle>mandos-client</refentrytitle>

546

547

<manvolnum>8mandos</manvolnum></citerefentry>, <citerefentry>

547

548

548

549

</citerefentry>

572

573

</varlistentry>

573

574

574

575

<term>

575

<ulink

576

url="http://www.gnu.org/software/gnutls/">GnuTLS</ulink>

576

<ulink url="http://www.gnu.org/software/gnutls/"

577

>GnuTLS</ulink>

577

578

</term>

578

579

579

580

<para>

585

586

</varlistentry>

586

587

587

588

<term>

588

<citation>RFC 4291: <citetitle>IP Version 6 Addressing

589

Architecture</citetitle>, section 2.5.6, Link-Local IPv6

590

Unicast Addresses</citation>

589

RFC 4291: <citetitle>IP Version 6 Addressing

590

Architecture</citetitle>

591

</term>

592

593

<para>

594

The clients use IPv6 link-local addresses, which are

595

immediately usable since a link-local addresses is

596

automatically assigned to a network interfaces when it is

597

brought up.

598

</para>

593

594

595

<term>Section 2.2: <citetitle>Text Representation of

596

Addresses</citetitle></term>

597

598

</varlistentry>

599

600

<term>Section 2.5.5.2: <citetitle>IPv4-Mapped IPv6

601

Address</citetitle></term>

602

603

</varlistentry>

604

605

<term>Section 2.5.6, <citetitle>Link-Local IPv6 Unicast

606

Addresses</citetitle></term>

607

608

<para>

609

The clients use IPv6 link-local addresses, which are

610

immediately usable since a link-local addresses is

611

automatically assigned to a network interfaces when it

612

is brought up.

613

</para>

614

</listitem>

615

</varlistentry>

616

</variablelist>

599

617

</listitem>

600

618

</varlistentry>

601

619

602

620

<term>

603

<citation>RFC 4346: <citetitle>The Transport Layer Security

604

(TLS) Protocol Version 1.1</citetitle></citation>

621

RFC 4346: <citetitle>The Transport Layer Security (TLS)

622

Protocol Version 1.1</citetitle>

605

623

</term>

606

624

607

625

<para>

611

629

</varlistentry>

612

630

613

631

<term>

614

<citation>RFC 4880: <citetitle>OpenPGP Message

615

Format</citetitle></citation>

632

RFC 4880: <citetitle>OpenPGP Message Format</citetitle>

616

633

</term>

617

634

618

635

<para>

622

639

</varlistentry>

623

640

624

641

<term>

625

<citation>RFC 5081: <citetitle>Using OpenPGP Keys for

626

Transport Layer Security</citetitle></citation>

642

RFC 5081: <citetitle>Using OpenPGP Keys for Transport Layer

643

Security</citetitle>

627

644

</term>

628

645

629

646

<para>

635

652

</variablelist>

636

653

</refsect1>

637

654

</refentry>

655

656

657

658

659