/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos-keygen.xml

First version of a somewhat complete D-Bus server interface.  Also
change user/group name to "_mandos".

* debian/mandos.postinst: Rename old "mandos" user and group to
                          "_mandos"; create "_mandos" user and group
                          if none exist.
* debian/mandos-client.postinst: - '' -

* initramfs-tools-hook: Try "_mandos" before "mandos" as user and
                        group name.

* mandos (_datetime_to_dbus_struct): New; was previously local.
  (Client.started): Renamed to "last_started".  All users changed.
  (Client.started): New; boolean.
  (Client.dbus_object_path): New.
  (Client.check_command): Renamed to "checker_command".  All users
                          changed.
  (Client.__init__): Set and use "self.dbus_object_path".  Set
                     "self.started".
  (Client.start): Update "self.started".  Emit "self.PropertyChanged"
                  signals for both "started" and "last_started".
  (Client.stop): Update "self.started".  Emit "self.PropertyChanged"
                 signal for "started".
  (Client.checker_callback): Take additional "command" argument.  All
                             callers changed. Emit
                             "self.PropertyChanged" signal.
  (Client.bump_timeout): Emit "self.PropertyChanged" signal for
                         "last_checked_ok".
  (Client.start_checker): Emit "self.PropertyChanged" signal for
                          "checker_running".
  (Client.stop_checker): Emit "self.PropertyChanged" signal for
                         "checker_running".
  (Client.still_valid): Bug fix: use "getattr(self, started, False)"
                        instead of "self.started" in case this client
                        object is so new that the "started" attribute
                        has not been created yet.
  (Client.IntervalChanged, Client.CheckerIsRunning, Client.GetChecker,
  Client.GetCreated, Client.GetFingerprint, Client.GetHost,
  Client.GetInterval, Client.GetName, Client.GetStarted,
  Client.GetTimeout, Client.StateChanged, Client.TimeoutChanged):
  Removed; all callers changed.
  (Client.CheckerCompleted): Add "condition" and "command" arguments.
                             All callers changed.
  (Client.GetAllProperties, Client.PropertyChanged): New.
  (Client.StillValid): Renamed to "IsStillValid".
  (Client.StartChecker): Changed to its own function to avoid the
                         return value from "Client.start_checker()".
  (Client.Stop): Changed to its own function to avoid the return value
                 from "Client.stop()".
  (main): Try "_mandos" before "mandos" as user and group name.
          Removed inner function "remove_from_clients".  New inner
          class "MandosServer".

Show diffs side-by-side

added added

removed removed

Lines of Context:
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY COMMANDNAME "mandos-keygen">
5
 
<!ENTITY TIMESTAMP "2019-02-10">
 
5
<!ENTITY TIMESTAMP "2008-10-03">
6
6
<!ENTITY % common SYSTEM "common.ent">
7
7
%common;
8
8
]>
19
19
        <firstname>Björn</firstname>
20
20
        <surname>Påhlsson</surname>
21
21
        <address>
22
 
          <email>belorn@recompile.se</email>
 
22
          <email>belorn@fukt.bsnet.se</email>
23
23
        </address>
24
24
      </author>
25
25
      <author>
26
26
        <firstname>Teddy</firstname>
27
27
        <surname>Hogeborn</surname>
28
28
        <address>
29
 
          <email>teddy@recompile.se</email>
 
29
          <email>teddy@fukt.bsnet.se</email>
30
30
        </address>
31
31
      </author>
32
32
    </authorgroup>
33
33
    <copyright>
34
34
      <year>2008</year>
35
 
      <year>2009</year>
36
 
      <year>2010</year>
37
 
      <year>2011</year>
38
 
      <year>2012</year>
39
 
      <year>2013</year>
40
 
      <year>2014</year>
41
 
      <year>2015</year>
42
 
      <year>2016</year>
43
 
      <year>2017</year>
44
 
      <year>2018</year>
45
35
      <holder>Teddy Hogeborn</holder>
46
36
      <holder>Björn Påhlsson</holder>
47
37
    </copyright>
126
116
        <replaceable>TIME</replaceable></option></arg>
127
117
      </group>
128
118
      <sbr/>
129
 
      <group>
130
 
        <arg choice="plain"><option>--tls-keytype
131
 
        <replaceable>KEYTYPE</replaceable></option></arg>
132
 
        <arg choice="plain"><option>-T
133
 
        <replaceable>KEYTYPE</replaceable></option></arg>
134
 
      </group>
135
 
      <sbr/>
136
 
      <group>
137
 
        <arg choice="plain"><option>--force</option></arg>
138
 
        <arg choice="plain"><option>-f</option></arg>
139
 
      </group>
 
119
      <arg><option>--force</option></arg>
140
120
    </cmdsynopsis>
141
121
    <cmdsynopsis>
142
122
      <command>&COMMANDNAME;</command>
162
142
        <arg choice="plain"><option>-n
163
143
        <replaceable>NAME</replaceable></option></arg>
164
144
      </group>
165
 
      <group>
166
 
        <arg choice="plain"><option>--no-ssh</option></arg>
167
 
        <arg choice="plain"><option>-S</option></arg>
168
 
      </group>
169
145
    </cmdsynopsis>
170
146
    <cmdsynopsis>
171
147
      <command>&COMMANDNAME;</command>
187
163
    <title>DESCRIPTION</title>
188
164
    <para>
189
165
      <command>&COMMANDNAME;</command> is a program to generate the
190
 
      TLS and OpenPGP keys used by
 
166
      OpenPGP key used by
191
167
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
192
 
      <manvolnum>8mandos</manvolnum></citerefentry>.  The keys are
 
168
      <manvolnum>8mandos</manvolnum></citerefentry>.  The key is
193
169
      normally written to /etc/mandos for later installation into the
194
170
      initrd image, but this, and most other things, can be changed
195
171
      with command line options.
236
212
        <listitem>
237
213
          <para>
238
214
            Target directory for key files.  Default is
239
 
            <filename class="directory">/etc/mandos</filename>.
 
215
            <filename>/etc/mandos</filename>.
240
216
          </para>
241
217
        </listitem>
242
218
      </varlistentry>
248
224
        <replaceable>TYPE</replaceable></option></term>
249
225
        <listitem>
250
226
          <para>
251
 
            OpenPGP key type.  Default is <quote>RSA</quote>.
 
227
            Key type.  Default is <quote>DSA</quote>.
252
228
          </para>
253
229
        </listitem>
254
230
      </varlistentry>
260
236
        <replaceable>BITS</replaceable></option></term>
261
237
        <listitem>
262
238
          <para>
263
 
            OpenPGP key length in bits.  Default is 4096.
 
239
            Key length in bits.  Default is 2048.
264
240
          </para>
265
241
        </listitem>
266
242
      </varlistentry>
272
248
        <replaceable>KEYTYPE</replaceable></option></term>
273
249
        <listitem>
274
250
          <para>
275
 
            OpenPGP subkey type.  Default is <quote>RSA</quote>
 
251
            Subkey type.  Default is <quote>ELG-E</quote> (Elgamal
 
252
            encryption-only).
276
253
          </para>
277
254
        </listitem>
278
255
      </varlistentry>
284
261
        <replaceable>BITS</replaceable></option></term>
285
262
        <listitem>
286
263
          <para>
287
 
            OpenPGP subkey length in bits.  Default is 4096.
 
264
            Subkey length in bits.  Default is 2048.
288
265
          </para>
289
266
        </listitem>
290
267
      </varlistentry>
308
285
        <replaceable>TEXT</replaceable></option></term>
309
286
        <listitem>
310
287
          <para>
311
 
            Comment field for key.  Default is empty.
 
288
            Comment field for key.  The default value is
 
289
            <quote><literal>Mandos client key</literal></quote>.
312
290
          </para>
313
291
        </listitem>
314
292
      </varlistentry>
328
306
      </varlistentry>
329
307
      
330
308
      <varlistentry>
331
 
        <term><option>--tls-keytype
332
 
        <replaceable>KEYTYPE</replaceable></option></term>
333
 
        <term><option>-T
334
 
        <replaceable>KEYTYPE</replaceable></option></term>
335
 
        <listitem>
336
 
          <para>
337
 
            TLS key type.  Default is <quote>ed25519</quote>
338
 
          </para>
339
 
        </listitem>
340
 
      </varlistentry>
341
 
      
342
 
      <varlistentry>
343
309
        <term><option>--force</option></term>
344
310
        <term><option>-f</option></term>
345
311
        <listitem>
378
344
          </para>
379
345
        </listitem>
380
346
      </varlistentry>
381
 
      <varlistentry>
382
 
        <term><option>--no-ssh</option></term>
383
 
        <term><option>-S</option></term>
384
 
        <listitem>
385
 
          <para>
386
 
            When <option>--password</option> or
387
 
            <option>--passfile</option> is given, this option will
388
 
            prevent <command>&COMMANDNAME;</command> from calling
389
 
            <command>ssh-keyscan</command> to get an SSH fingerprint
390
 
            for this host and, if successful, output suitable config
391
 
            options to use this fingerprint as a
392
 
            <option>checker</option> option in the output.  This is
393
 
            otherwise the default behavior.
394
 
          </para>
395
 
        </listitem>
396
 
      </varlistentry>
397
347
    </variablelist>
398
348
  </refsect1>
399
349
  
401
351
    <title>OVERVIEW</title>
402
352
    <xi:include href="overview.xml"/>
403
353
    <para>
404
 
      This program is a small utility to generate new TLS and OpenPGP
405
 
      keys for new Mandos clients, and to generate sections for
406
 
      inclusion in <filename>clients.conf</filename> on the server.
 
354
      This program is a small utility to generate new OpenPGP keys for
 
355
      new Mandos clients, and to generate sections for inclusion in
 
356
      <filename>clients.conf</filename> on the server.
407
357
    </para>
408
358
  </refsect1>
409
359
  
459
409
        </listitem>
460
410
      </varlistentry>
461
411
      <varlistentry>
462
 
        <term><filename>/etc/keys/mandos/tls-privkey.pem</filename></term>
463
 
        <listitem>
464
 
          <para>
465
 
            Private key file which will be created or overwritten.
466
 
          </para>
467
 
        </listitem>
468
 
      </varlistentry>
469
 
      <varlistentry>
470
 
        <term><filename>/etc/keys/mandos/tls-pubkey.pem</filename></term>
471
 
        <listitem>
472
 
          <para>
473
 
            Public key file which will be created or overwritten.
474
 
          </para>
475
 
        </listitem>
476
 
      </varlistentry>
477
 
      <varlistentry>
478
 
        <term><filename class="directory">/tmp</filename></term>
 
412
        <term><filename>/tmp</filename></term>
479
413
        <listitem>
480
414
          <para>
481
415
            Temporary files will be written here if
486
420
    </variablelist>
487
421
  </refsect1>
488
422
  
489
 
  <refsect1 id="bugs">
490
 
    <title>BUGS</title>
491
 
    <xi:include href="bugs.xml"/>
492
 
  </refsect1>
 
423
<!--   <refsect1 id="bugs"> -->
 
424
<!--     <title>BUGS</title> -->
 
425
<!--     <para> -->
 
426
<!--     </para> -->
 
427
<!--   </refsect1> -->
493
428
  
494
429
  <refsect1 id="example">
495
430
    <title>EXAMPLE</title>
515
450
    </informalexample>
516
451
    <informalexample>
517
452
      <para>
518
 
        Prompt for a password, encrypt it with the key in <filename
519
 
        class="directory">/etc/mandos</filename> and output a section
520
 
        suitable for <filename>clients.conf</filename>.
 
453
        Prompt for a password, encrypt it with the key in
 
454
        <filename>/etc/mandos</filename> and output a section suitable
 
455
        for <filename>clients.conf</filename>.
521
456
      </para>
522
457
      <para>
523
458
        <userinput>&COMMANDNAME; --password</userinput>
556
491
  <refsect1 id="see_also">
557
492
    <title>SEE ALSO</title>
558
493
    <para>
559
 
      <citerefentry><refentrytitle>intro</refentrytitle>
560
 
      <manvolnum>8mandos</manvolnum></citerefentry>,
561
494
      <citerefentry><refentrytitle>gpg</refentrytitle>
562
495
      <manvolnum>1</manvolnum></citerefentry>,
563
496
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
565
498
      <citerefentry><refentrytitle>mandos</refentrytitle>
566
499
      <manvolnum>8</manvolnum></citerefentry>,
567
500
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
568
 
      <manvolnum>8mandos</manvolnum></citerefentry>,
569
 
      <citerefentry><refentrytitle>ssh-keyscan</refentrytitle>
570
 
      <manvolnum>1</manvolnum></citerefentry>
 
501
      <manvolnum>8mandos</manvolnum></citerefentry>
571
502
    </para>
572
503
  </refsect1>
573
504