/mandos/release : revision 237.2.174

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos.xml

Committer: Teddy Hogeborn
Date: 2009-12-25 23:13:47 UTC
mto: (24.1.146 mandos) (237.12.2 mandos-persistent) (299.1.1 release) (300.1.1 release) (301.1.1 release)
mto: This revision was merged to the branch mainline in revision 270.
Revision ID: teddy@fukt.bsnet.se-20091225231347-gg9u9ru0wj0f24hh

More consistent terminology: Clients are no longer "invalid" - they
are "disabled".  All code and documentation changed to reflect this.

D=Bus API change: The "properties" argument was removed from the
"ClientAdded" signal on interface "se.bsnet.fukt.Mandos".  All code in
both "mandos" and "mandos-monitor" changed to reflect this.

* mandos: Replaced "with closing(F)" with simply "with F" in all
          places where F is a file object.
  (Client.still_valid): Removed.  All callers changed to look at
                        "Client.enabled" instead.
  (dbus_service_property): Check for unsupported signatures with the
                           "byte_arrays" option.
  (DBusObjectWithProperties.Set): - '' -
  (ClientHandler.handle): Use the reverse pipe to receive the
                          "Client.enabled" attribute instead of the
                          now-removed "Client.still_valid()" method.
  (ForkingMixInWithPipe): Renamed to "ForkingMixInWithPipes" (all
                          users changed).  Now also create a reverse
                          pipe for sending data to the child process.
  (ForkingMixInWithPipes.add_pipe): Now takes two pipe fd's as
                                    arguments.  All callers changed.
  (IPv6_TCPServer.handle_ipc): Take an additional "reply_fd" argument
                               (all callers changed).  Close the reply
                               pipe when the child data pipe is
                               closed.  New "GETATTR" IPC method; will
                               pickle client attribute and send it
                               over the reply pipe FD.
  (MandosDBusService.ClientAdded): Removed "properties" argument.  All
                                   emitters changed.
* mandos-clients.conf.xml (DESCRIPTION, OPTIONS): Use
                                                  "enabled/disabled"
                                                  terminology.
* mandos-ctl: Option "--is-valid" renamed to "--is-enabled".
* mandos-monitor: Enable user locale.  Try to log exceptions.
  (MandosClientPropertyCache.__init__): Removed "properties" argument.
                                        All callers changed.
  (UserInterface.add_new_client): Remove "properties" argument.  All
                                  callers changed.  Supply "logger"
                                  argument to MandosClientWidget().
  (UserInterface.add_client): New "logger" argument.  All callers
                              changed.
* mandos.xml (BUGS, SECURITY/CLIENTS): Use "enabled/disabled"
                                       terminology.

Show diffs side-by-side

added added

removed removed

mandos.xml

<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

<!ENTITY COMMANDNAME "mandos">

<!ENTITY TIMESTAMP "2009-02-24">

<!ENTITY TIMESTAMP "2009-12-09">

<!ENTITY % common SYSTEM "common.ent">

%common;

<sbr/>

<arg><option>--debug</option></arg>

<sbr/>

<sbr/>

</cmdsynopsis>

233

235

</varlistentry>

234

236

235

237

238

239

240

<xi:include href="mandos-options.xml" xpointer="dbus"/>

241

<para>

242

See also <xref linkend="dbus_interface"/>.

243

</para>

244

</listitem>

245

</varlistentry>

246

247

236

248

237

249

238

250

<xi:include href="mandos-options.xml" xpointer="ipv6"/>

315

327

The server will, by default, continually check that the clients

316

328

are still up. If a client has not been confirmed as being up

317

329

for some time, the client is assumed to be compromised and is no

318

longer eligible to receive the encrypted password. The timeout,

330

longer eligible to receive the encrypted password. (Manual

331

intervention is required to re-enable a client.) The timeout,

319

332

checker program, and interval between checks can be configured

320

333

both globally and per client; see <citerefentry>

321

334

<refentrytitle>mandos-clients.conf</refentrytitle>

322

<manvolnum>5</manvolnum></citerefentry>.

335

<manvolnum>5</manvolnum></citerefentry>. A client successfully

336

receiving its password will also be treated as a successful

337

checker run.

323

338

</para>

324

339

</refsect1>

325

340

333

348

</para>

334

349

</refsect1>

335

350

351

352

<title>D-BUS INTERFACE</title>

353

<para>

354

The server will by default provide a D-Bus system bus interface.

355

This interface will only be accessible by the root user or a

356

Mandos-specific user, if such a user exists.

357

358

</para>

359

</refsect1>

360

336

361

337

362

<title>EXIT STATUS</title>

338

363

<para>

428

453

backtrace. This could be considered a feature.

429

454

</para>

430

455

<para>

431

Currently, if a client is declared <quote>invalid</quote> due to

432

having timed out, the server does not record this fact onto

433

permanent storage. This has some security implications, see

434

<xref linkend="clients"/>.

456

Currently, if a client is disabled due to having timed out, the

457

server does not record this fact onto permanent storage. This

458

has some security implications, see <xref linkend="clients"/>.

435

459

</para>

436

460

<para>

437

461

There is currently no way of querying the server of the current

524

548

</para>

525

549

<para>

526

550

If a client is compromised, its downtime should be duly noted

527

by the server which would therefore declare the client

528

invalid. But if the server was ever restarted, it would

529

re-read its client list from its configuration file and again

530

regard all clients therein as valid, and hence eligible to

531

receive their passwords. Therefore, be careful when

532

restarting servers if it is suspected that a client has, in

533

fact, been compromised by parties who may now be running a

534

fake Mandos client with the keys from the non-encrypted

535

initial <acronym>RAM</acronym> image of the client host. What

536

should be done in that case (if restarting the server program

537

really is necessary) is to stop the server program, edit the

538

configuration file to omit any suspect clients, and restart

539

the server program.

551

by the server which would therefore disable the client. But

552

if the server was ever restarted, it would re-read its client

553

list from its configuration file and again regard all clients

554

therein as enabled, and hence eligible to receive their

555

passwords. Therefore, be careful when restarting servers if

556

it is suspected that a client has, in fact, been compromised

557

by parties who may now be running a fake Mandos client with

558

the keys from the non-encrypted initial <acronym>RAM</acronym>

559

image of the client host. What should be done in that case

560

(if restarting the server program really is necessary) is to

561

stop the server program, edit the configuration file to omit

562

any suspect clients, and restart the server program.

540

563

</para>

541

564

<para>

542

565

For more details on client-side security, see

Older »