/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to plugins.d/mandos-client.xml

* Makefile (run-server): Use "--no-dbus" unconditionally.

* initramfs-tools-script: Correct tests for writable "/conf/conf.d".

* mandos: Add process ID number to logging messages.
  (IPv6_TCPServer.server_bind): Use plain "raise".
  (main): Do not try to handle SIGSEGV; it does not work.  Use plain
         "raise".  Log KeyboardInterrupt and server exit.

Show diffs side-by-side

added added

removed removed

Lines of Context:
plugins.d/mandos-client.xml
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY COMMANDNAME "mandos-client">
5
 
<!ENTITY TIMESTAMP "2011-10-03">
 
5
<!ENTITY TIMESTAMP "2009-01-24">
6
6
<!ENTITY % common SYSTEM "../common.ent">
7
7
%common;
8
8
]>
19
19
        <firstname>Björn</firstname>
20
20
        <surname>Påhlsson</surname>
21
21
        <address>
22
 
          <email>belorn@recompile.se</email>
 
22
          <email>belorn@fukt.bsnet.se</email>
23
23
        </address>
24
24
      </author>
25
25
      <author>
26
26
        <firstname>Teddy</firstname>
27
27
        <surname>Hogeborn</surname>
28
28
        <address>
29
 
          <email>teddy@recompile.se</email>
 
29
          <email>teddy@fukt.bsnet.se</email>
30
30
        </address>
31
31
      </author>
32
32
    </authorgroup>
33
33
    <copyright>
34
34
      <year>2008</year>
35
35
      <year>2009</year>
36
 
      <year>2011</year>
37
36
      <holder>Teddy Hogeborn</holder>
38
37
      <holder>Björn Påhlsson</holder>
39
38
    </copyright>
98
97
      </arg>
99
98
      <sbr/>
100
99
      <arg>
101
 
        <option>--retry <replaceable>SECONDS</replaceable></option>
102
 
      </arg>
103
 
      <sbr/>
104
 
      <arg>
105
 
        <option>--network-hook-dir<replaceable>DIR</replaceable></option>
106
 
      </arg>
107
 
      <sbr/>
108
 
      <arg>
109
100
        <option>--debug</option>
110
101
      </arg>
111
102
    </cmdsynopsis>
142
133
      using TLS with an OpenPGP key to ensure authenticity and
143
134
      confidentiality.  This client program keeps running, trying all
144
135
      servers on the network, until it receives a satisfactory reply
145
 
      or a TERM signal.  After all servers have been tried, all
146
 
      servers are periodically retried.  If no servers are found it
147
 
      will wait indefinitely for new servers to appear.
 
136
      or a TERM signal is received.  If no servers are found, or after
 
137
      all servers have been tried, it waits indefinitely for new
 
138
      servers to appear.
148
139
    </para>
149
140
    <para>
150
141
      This program is not meant to be run directly; it is really meant
204
195
      </varlistentry>
205
196
      
206
197
      <varlistentry>
207
 
        <term><option>--interface=<replaceable
208
 
        >NAME</replaceable></option></term>
 
198
        <term><option>--interface=
 
199
        <replaceable>NAME</replaceable></option></term>
209
200
        <term><option>-i
210
201
        <replaceable>NAME</replaceable></option></term>
211
202
        <listitem>
212
203
          <para>
213
204
            Network interface that will be brought up and scanned for
214
 
            Mandos servers to connect to.  The default is the empty
215
 
            string, which will automatically choose an appropriate
216
 
            interface.
 
205
            Mandos servers to connect to.  The default it
 
206
            <quote><literal>eth0</literal></quote>.
217
207
          </para>
218
208
          <para>
219
209
            If the <option>--connect</option> option is used, this
229
219
            until much later in the boot process, and can not be used
230
220
            by this program.
231
221
          </para>
232
 
          <para>
233
 
            <replaceable>NAME</replaceable> can be the string
234
 
            <quote><literal>none</literal></quote>; this will not use
235
 
            any specific interface, and will not bring up an interface
236
 
            on startup.  This is not recommended, and only meant for
237
 
            advanced users.
238
 
          </para>
239
222
        </listitem>
240
223
      </varlistentry>
241
224
      
302
285
          </para>
303
286
        </listitem>
304
287
      </varlistentry>
305
 
 
306
 
      <varlistentry>
307
 
        <term><option>--retry=<replaceable
308
 
        >SECONDS</replaceable></option></term>
309
 
        <listitem>
310
 
          <para>
311
 
            All Mandos servers are tried repeatedly until a password
312
 
            is received.  This value specifies, in seconds, how long
313
 
            between each successive try <emphasis>for the same
314
 
            server</emphasis>.  The default is 10 seconds.
315
 
          </para>
316
 
        </listitem>
317
 
      </varlistentry>
318
 
 
319
 
      <varlistentry>
320
 
        <term><option>--network-hook-dir=<replaceable
321
 
        >DIR</replaceable></option></term>
322
 
        <listitem>
323
 
          <para>
324
 
            Network hook directory.  The default directory is
325
 
            <quote><filename class="directory"
326
 
            >/lib/mandos/network-hooks.d</filename></quote>.
327
 
          </para>
328
 
        </listitem>
329
 
      </varlistentry>
330
288
      
331
289
      <varlistentry>
332
290
        <term><option>--debug</option></term>
405
363
      server could be found and the password received from it could be
406
364
      successfully decrypted and output on standard output.  The
407
365
      program will exit with a non-zero exit status only if a critical
408
 
      error occurs.  Otherwise, it will forever connect to any
409
 
      discovered <application>Mandos</application> servers, trying to
410
 
      get a decryptable password and print it.
 
366
      error occurs.  Otherwise, it will forever connect to new
 
367
      <application>Mandos</application> servers as they appear, trying
 
368
      to get a decryptable password and print it.
411
369
    </para>
412
370
  </refsect1>
413
371
  
488
446
    <informalexample>
489
447
      <para>
490
448
        Run in debug mode, with a custom key, and do not use Zeroconf
491
 
        to locate a server; connect directly to the IPv6 link-local
492
 
        address <quote><systemitem class="ipaddress"
493
 
        >fe80::aede:48ff:fe71:f6f2</systemitem></quote>, port 4711,
494
 
        using interface eth2:
 
449
        to locate a server; connect directly to the IPv6 address
 
450
        <quote><systemitem class="ipaddress"
 
451
        >2001:db8:f983:bd0b:30de:ae4a:71f2:f672</systemitem></quote>,
 
452
        port 4711, using interface eth2:
495
453
      </para>
496
454
      <para>
497
455
 
498
456
<!-- do not wrap this line -->
499
 
<userinput>&COMMANDNAME; --debug --pubkey keydir/pubkey.txt --seckey keydir/seckey.txt --connect fe80::aede:48ff:fe71:f6f2:4711 --interface eth2</userinput>
 
457
<userinput>&COMMANDNAME; --debug --pubkey keydir/pubkey.txt --seckey keydir/seckey.txt --connect 2001:db8:f983:bd0b:30de:ae4a:71f2:f672:4711 --interface eth2</userinput>
500
458
 
501
459
      </para>
502
460
    </informalexample>
552
510
  <refsect1 id="see_also">
553
511
    <title>SEE ALSO</title>
554
512
    <para>
555
 
      <citerefentry><refentrytitle>intro</refentrytitle>
556
 
      <manvolnum>8mandos</manvolnum></citerefentry>,
557
513
      <citerefentry><refentrytitle>cryptsetup</refentrytitle>
558
514
      <manvolnum>8</manvolnum></citerefentry>,
559
515
      <citerefentry><refentrytitle>crypttab</refentrytitle>