1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
<!ENTITY VERSION "1.0">
5
4
<!ENTITY COMMANDNAME "mandos">
6
<!ENTITY OVERVIEW SYSTEM "overview.xml">
5
<!ENTITY TIMESTAMP "2012-01-15">
6
<!ENTITY % common SYSTEM "common.ent">
11
<title>&COMMANDNAME;</title>
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
12
<title>Mandos Manual</title>
12
13
<!-- NWalsh’s docbook scripts use this to generate the footer: -->
13
<productname>&COMMANDNAME;</productname>
14
<productnumber>&VERSION;</productnumber>
14
<productname>Mandos</productname>
15
<productnumber>&version;</productnumber>
16
<date>&TIMESTAMP;</date>
17
19
<firstname>Björn</firstname>
18
20
<surname>Påhlsson</surname>
20
<email>belorn@fukt.bsnet.se</email>
22
<email>belorn@recompile.se</email>
24
26
<firstname>Teddy</firstname>
25
27
<surname>Hogeborn</surname>
27
<email>teddy@fukt.bsnet.se</email>
29
<email>teddy@recompile.se</email>
33
39
<holder>Teddy Hogeborn</holder>
34
40
<holder>Björn Påhlsson</holder>
38
This manual page is free software: you can redistribute it
39
and/or modify it under the terms of the GNU General Public
40
License as published by the Free Software Foundation,
41
either version 3 of the License, or (at your option) any
46
This manual page is distributed in the hope that it will
47
be useful, but WITHOUT ANY WARRANTY; without even the
48
implied warranty of MERCHANTABILITY or FITNESS FOR A
49
PARTICULAR PURPOSE. See the GNU General Public License
54
You should have received a copy of the GNU General Public
55
License along with this program; If not, see
56
<ulink url="http://www.gnu.org/licenses/"/>.
42
<xi:include href="legalnotice.xml"/>
62
46
<refentrytitle>&COMMANDNAME;</refentrytitle>
63
47
<manvolnum>8</manvolnum>
67
51
<refname><command>&COMMANDNAME;</command></refname>
69
Sends encrypted passwords to authenticated Mandos clients
53
Gives encrypted passwords to authenticated Mandos clients
75
59
<command>&COMMANDNAME;</command>
76
<arg>--interface<arg choice="plain">IF</arg></arg>
77
<arg>--address<arg choice="plain">ADDRESS</arg></arg>
78
<arg>--port<arg choice="plain">PORT</arg></arg>
79
<arg>--priority<arg choice="plain">PRIORITY</arg></arg>
80
<arg>--servicename<arg choice="plain">NAME</arg></arg>
81
<arg>--configdir<arg choice="plain">DIRECTORY</arg></arg>
85
<command>&COMMANDNAME;</command>
86
<arg>-i<arg choice="plain">IF</arg></arg>
87
<arg>-a<arg choice="plain">ADDRESS</arg></arg>
88
<arg>-p<arg choice="plain">PORT</arg></arg>
89
<arg>--priority<arg choice="plain">PRIORITY</arg></arg>
90
<arg>--servicename<arg choice="plain">NAME</arg></arg>
91
<arg>--configdir<arg choice="plain">DIRECTORY</arg></arg>
61
<arg choice="plain"><option>--interface
62
<replaceable>NAME</replaceable></option></arg>
63
<arg choice="plain"><option>-i
64
<replaceable>NAME</replaceable></option></arg>
68
<arg choice="plain"><option>--address
69
<replaceable>ADDRESS</replaceable></option></arg>
70
<arg choice="plain"><option>-a
71
<replaceable>ADDRESS</replaceable></option></arg>
75
<arg choice="plain"><option>--port
76
<replaceable>PORT</replaceable></option></arg>
77
<arg choice="plain"><option>-p
78
<replaceable>PORT</replaceable></option></arg>
81
<arg><option>--priority
82
<replaceable>PRIORITY</replaceable></option></arg>
84
<arg><option>--servicename
85
<replaceable>NAME</replaceable></option></arg>
87
<arg><option>--configdir
88
<replaceable>DIRECTORY</replaceable></option></arg>
90
<arg><option>--debug</option></arg>
92
<arg><option>--debuglevel
93
<replaceable>LEVEL</replaceable></option></arg>
95
<arg><option>--no-dbus</option></arg>
97
<arg><option>--no-ipv6</option></arg>
99
<arg><option>--no-restore</option></arg>
101
<arg><option>--statedir
102
<replaceable>DIRECTORY</replaceable></option></arg>
95
105
<command>&COMMANDNAME;</command>
96
106
<group choice="req">
97
<arg choice="plain">-h</arg>
98
<arg choice="plain">--help</arg>
107
<arg choice="plain"><option>--help</option></arg>
108
<arg choice="plain"><option>-h</option></arg>
102
112
<command>&COMMANDNAME;</command>
103
<arg choice="plain">--version</arg>
113
<arg choice="plain"><option>--version</option></arg>
106
116
<command>&COMMANDNAME;</command>
107
<arg choice="plain">--check</arg>
117
<arg choice="plain"><option>--check</option></arg>
109
119
</refsynopsisdiv>
111
121
<refsect1 id="description">
112
122
<title>DESCRIPTION</title>
114
124
<command>&COMMANDNAME;</command> is a server daemon which
115
125
handles incoming request for passwords for a pre-defined list of
116
client host computers. The Mandos server uses Zeroconf to
117
announce itself on the local network, and uses TLS to
118
communicate securely with and to authenticate the clients. The
119
Mandos server uses IPv6 to allow Mandos clients to use IPv6
120
link-local addresses, since the clients will probably not have
121
any other addresses configured (see <xref linkend="overview"/>).
122
Any authenticated client is then given the stored pre-encrypted
123
password for that specific client.
126
client host computers. For an introduction, see
127
<citerefentry><refentrytitle>intro</refentrytitle>
128
<manvolnum>8mandos</manvolnum></citerefentry>. The Mandos server
129
uses Zeroconf to announce itself on the local network, and uses
130
TLS to communicate securely with and to authenticate the
131
clients. The Mandos server uses IPv6 to allow Mandos clients to
132
use IPv6 link-local addresses, since the clients will probably
133
not have any other addresses configured (see <xref
134
linkend="overview"/>). Any authenticated client is then given
135
the stored pre-encrypted password for that specific client.
128
139
<refsect1 id="purpose">
129
140
<title>PURPOSE</title>
132
142
The purpose of this is to enable <emphasis>remote and unattended
133
143
rebooting</emphasis> of client host computer with an
134
144
<emphasis>encrypted root file system</emphasis>. See <xref
135
145
linkend="overview"/> for details.
140
149
<refsect1 id="options">
141
150
<title>OPTIONS</title>
145
<term><literal>-h</literal>, <literal>--help</literal></term>
153
<term><option>--help</option></term>
154
<term><option>-h</option></term>
148
157
Show a help message and exit
154
<term><literal>-i</literal>, <literal>--interface <replaceable>
155
IF</replaceable></literal></term>
158
Only announce the server and listen to requests on network
159
interface <replaceable>IF</replaceable>. Default is to
160
use all available interfaces. <emphasis>Note:</emphasis>
161
a failure to bind to the specified interface is not
162
considered critical, and the server does not exit.
168
<term><literal>-a</literal>, <literal>--address <replaceable>
169
ADDRESS</replaceable></literal></term>
172
If this option is used, the server will only listen to a
173
specific address. This must currently be an IPv6 address;
174
an IPv4 address can be specified using the
175
<quote><literal>::FFFF:192.0.2.3</literal></quote> syntax.
176
Also, if a link-local address is specified, an interface
177
should be set, since a link-local address is only valid on
178
a single interface. By default, the server will listen to
179
all available addresses.
185
<term><literal>-p</literal>, <literal>--port <replaceable>
186
PORT</replaceable></literal></term>
189
If this option is used, the server to bind to that
190
port. By default, the server will listen to an arbitrary
191
port given by the operating system.
197
<term><literal>--check</literal></term>
163
<term><option>--interface</option>
164
<replaceable>NAME</replaceable></term>
165
<term><option>-i</option>
166
<replaceable>NAME</replaceable></term>
168
<xi:include href="mandos-options.xml" xpointer="interface"/>
173
<term><option>--address
174
<replaceable>ADDRESS</replaceable></option></term>
176
<replaceable>ADDRESS</replaceable></option></term>
178
<xi:include href="mandos-options.xml" xpointer="address"/>
184
<replaceable>PORT</replaceable></option></term>
186
<replaceable>PORT</replaceable></option></term>
188
<xi:include href="mandos-options.xml" xpointer="port"/>
193
<term><option>--check</option></term>
200
196
Run the server’s self-tests. This includes any unit
207
<term><literal>--debug</literal></term>
210
If the server is run in debug mode, it will run in the
211
foreground and print a lot of debugging information. The
212
default is <emphasis>not</emphasis> to run in debug mode.
218
<term><literal>--priority <replaceable>
219
PRIORITY</replaceable></literal></term>
222
GnuTLS priority string for the TLS handshake with the
223
clients. The default is
224
<quote><literal>SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP</literal></quote>.
225
See <citerefentry><refentrytitle>gnutls_priority_init
226
</refentrytitle><manvolnum>3</manvolnum></citerefentry>
227
for the syntax. <emphasis>Warning</emphasis>: changing
228
this may make the TLS handshake fail, making communication
229
with clients impossible.
235
<term><literal>--servicename <replaceable>NAME</replaceable>
239
Zeroconf service name. The default is
240
<quote><literal>Mandos</literal></quote>. You only need
241
to change this if you for some reason want to run more
242
than one server on the same <emphasis>host</emphasis>,
243
which would not normally be useful. If there are name
244
collisions on the same <emphasis>network</emphasis>, the
245
newer server will automatically rename itself to
246
<quote><literal>Mandos #2</literal></quote>, and so on;
247
therefore, this option is not needed in that case.
253
<term><literal>--configdir <replaceable>DIR</replaceable>
203
<term><option>--debug</option></term>
205
<xi:include href="mandos-options.xml" xpointer="debug"/>
210
<term><option>--debuglevel
211
<replaceable>LEVEL</replaceable></option></term>
214
Set the debugging log level.
215
<replaceable>LEVEL</replaceable> is a string, one of
216
<quote><literal>CRITICAL</literal></quote>,
217
<quote><literal>ERROR</literal></quote>,
218
<quote><literal>WARNING</literal></quote>,
219
<quote><literal>INFO</literal></quote>, or
220
<quote><literal>DEBUG</literal></quote>, in order of
221
increasing verbosity. The default level is
222
<quote><literal>WARNING</literal></quote>.
228
<term><option>--priority <replaceable>
229
PRIORITY</replaceable></option></term>
231
<xi:include href="mandos-options.xml" xpointer="priority"/>
236
<term><option>--servicename
237
<replaceable>NAME</replaceable></option></term>
239
<xi:include href="mandos-options.xml"
240
xpointer="servicename"/>
245
<term><option>--configdir
246
<replaceable>DIRECTORY</replaceable></option></term>
257
249
Directory to search for configuration files. Default is
343
370
</tbody></tgroup></table>
346
373
<refsect1 id="checking">
347
374
<title>CHECKING</title>
349
376
The server will, by default, continually check that the clients
350
377
are still up. If a client has not been confirmed as being up
351
378
for some time, the client is assumed to be compromised and is no
352
longer eligible to receive the encrypted password. The timeout,
353
checker program, and interval between checks can be configured
354
both globally and per client; see <citerefentry>
355
<refentrytitle>mandos.conf</refentrytitle>
356
<manvolnum>5</manvolnum></citerefentry> and <citerefentry>
379
longer eligible to receive the encrypted password. (Manual
380
intervention is required to re-enable a client.) The timeout,
381
extended timeout, checker program, and interval between checks
382
can be configured both globally and per client; see
383
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
384
<manvolnum>5</manvolnum></citerefentry>.
388
<refsect1 id="approval">
389
<title>APPROVAL</title>
391
The server can be configured to require manual approval for a
392
client before it is sent its secret. The delay to wait for such
393
approval and the default action (approve or deny) can be
394
configured both globally and per client; see <citerefentry>
357
395
<refentrytitle>mandos-clients.conf</refentrytitle>
358
<manvolnum>5</manvolnum></citerefentry>.
396
<manvolnum>5</manvolnum></citerefentry>. By default all clients
397
will be approved immediately without delay.
400
This can be used to deny a client its secret if not manually
401
approved within a specified time. It can also be used to make
402
the server delay before giving a client its secret, allowing
403
optional manual denying of this specific client.
362
408
<refsect1 id="logging">
363
409
<title>LOGGING</title>
365
The server will send log messaged with various severity levels
366
to <filename>/dev/log</filename>. With the
411
The server will send log message with various severity levels to
412
<filename class="devicefile">/dev/log</filename>. With the
367
413
<option>--debug</option> option, it will log even more messages,
368
414
and also show them on the console.
418
<refsect1 id="persistent_state">
419
<title>PERSISTENT STATE</title>
421
Client settings, initially read from
422
<filename>clients.conf</filename>, are persistent across
423
restarts, and run-time changes will override settings in
424
<filename>clients.conf</filename>. However, if a setting is
425
<emphasis>changed</emphasis> (or a client added, or removed) in
426
<filename>clients.conf</filename>, this will take precedence.
430
<refsect1 id="dbus_interface">
431
<title>D-BUS INTERFACE</title>
433
The server will by default provide a D-Bus system bus interface.
434
This interface will only be accessible by the root user or a
435
Mandos-specific user, if such a user exists. For documentation
436
of the D-Bus API, see the file <filename>DBUS-API</filename>.
372
440
<refsect1 id="exit_status">
373
441
<title>EXIT STATUS</title>
555
627
compromised if they are gone for too long.
558
If a client is compromised, its downtime should be duly noted
559
by the server which would therefore declare the client
560
invalid. But if the server was ever restarted, it would
561
re-read its client list from its configuration file and again
562
regard all clients therein as valid, and hence eligible to
563
receive their passwords. Therefore, be careful when
564
restarting servers if you suspect that a client has, in fact,
565
been compromised by parties who may now be running a fake
566
Mandos client with the keys from the non-encrypted initial RAM
567
image of the client host. What should be done in that case
568
(if restarting the server program really is necessary) is to
569
stop the server program, edit the configuration file to omit
570
any suspect clients, and restart the server program.
573
630
For more details on client-side security, see
574
<citerefentry><refentrytitle>password-request</refentrytitle>
631
<citerefentry><refentrytitle>mandos-client</refentrytitle>
575
632
<manvolnum>8mandos</manvolnum></citerefentry>.
580
637
<refsect1 id="see_also">
581
638
<title>SEE ALSO</title>
640
<citerefentry><refentrytitle>intro</refentrytitle>
641
<manvolnum>8mandos</manvolnum></citerefentry>,
642
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
643
<manvolnum>5</manvolnum></citerefentry>,
644
<citerefentry><refentrytitle>mandos.conf</refentrytitle>
645
<manvolnum>5</manvolnum></citerefentry>,
646
<citerefentry><refentrytitle>mandos-client</refentrytitle>
647
<manvolnum>8mandos</manvolnum></citerefentry>,
648
<citerefentry><refentrytitle>sh</refentrytitle>
649
<manvolnum>1</manvolnum></citerefentry>
586
<refentrytitle>password-request</refentrytitle>
587
<manvolnum>8mandos</manvolnum>
592
This is the actual program which talks to this server.
593
Note that it is normally not invoked directly, and is only
594
run in the initial RAM disk environment, and not on a
595
fully started system.
601
654
<ulink url="http://www.zeroconf.org/">Zeroconf</ulink>
636
<citation>RFC 4291: <citetitle>IP Version 6 Addressing
637
Architecture</citetitle>, section 2.5.6, Link-Local IPv6
638
Unicast Addresses</citation>
689
RFC 4291: <citetitle>IP Version 6 Addressing
690
Architecture</citetitle>
642
The clients use IPv6 link-local addresses, which are
643
immediately usable since a link-local addresses is
644
automatically assigned to a network interfaces when it is
695
<term>Section 2.2: <citetitle>Text Representation of
696
Addresses</citetitle></term>
697
<listitem><para/></listitem>
700
<term>Section 2.5.5.2: <citetitle>IPv4-Mapped IPv6
701
Address</citetitle></term>
702
<listitem><para/></listitem>
705
<term>Section 2.5.6, <citetitle>Link-Local IPv6 Unicast
706
Addresses</citetitle></term>
709
The clients use IPv6 link-local addresses, which are
710
immediately usable since a link-local addresses is
711
automatically assigned to a network interfaces when it
651
<citation>RFC 4346: <citetitle>The Transport Layer Security
652
(TLS) Protocol Version 1.1</citetitle></citation>
721
RFC 4346: <citetitle>The Transport Layer Security (TLS)
722
Protocol Version 1.1</citetitle>