/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos.xml

  • Committer: Teddy Hogeborn
  • Date: 2014-01-20 21:50:11 UTC
  • mto: (237.7.272 trunk)
  • mto: This revision was merged to the branch mainline in revision 307.
  • Revision ID: teddy@recompile.se-20140120215011-ka70v54d3rb2pyug
Bug fix from libdir change: make plugins get setuid bit again.

* debian/mandos-client.lintian-overrides: Libdir changes.
* debian/rules (override_dh_fixperms): - '' -

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos.xml
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY COMMANDNAME "mandos">
5
 
<!ENTITY TIMESTAMP "2010-09-25">
 
5
<!ENTITY TIMESTAMP "2013-10-26">
6
6
<!ENTITY % common SYSTEM "common.ent">
7
7
%common;
8
8
]>
19
19
        <firstname>Björn</firstname>
20
20
        <surname>Påhlsson</surname>
21
21
        <address>
22
 
          <email>belorn@fukt.bsnet.se</email>
 
22
          <email>belorn@recompile.se</email>
23
23
        </address>
24
24
      </author>
25
25
      <author>
26
26
        <firstname>Teddy</firstname>
27
27
        <surname>Hogeborn</surname>
28
28
        <address>
29
 
          <email>teddy@fukt.bsnet.se</email>
 
29
          <email>teddy@recompile.se</email>
30
30
        </address>
31
31
      </author>
32
32
    </authorgroup>
33
33
    <copyright>
34
34
      <year>2008</year>
35
35
      <year>2009</year>
 
36
      <year>2010</year>
 
37
      <year>2011</year>
 
38
      <year>2012</year>
 
39
      <year>2013</year>
36
40
      <holder>Teddy Hogeborn</holder>
37
41
      <holder>Björn Påhlsson</holder>
38
42
    </copyright>
86
90
      <sbr/>
87
91
      <arg><option>--debug</option></arg>
88
92
      <sbr/>
 
93
      <arg><option>--debuglevel
 
94
      <replaceable>LEVEL</replaceable></option></arg>
 
95
      <sbr/>
89
96
      <arg><option>--no-dbus</option></arg>
90
97
      <sbr/>
91
98
      <arg><option>--no-ipv6</option></arg>
 
99
      <sbr/>
 
100
      <arg><option>--no-restore</option></arg>
 
101
      <sbr/>
 
102
      <arg><option>--statedir
 
103
      <replaceable>DIRECTORY</replaceable></option></arg>
 
104
      <sbr/>
 
105
      <arg><option>--socket
 
106
      <replaceable>FD</replaceable></option></arg>
 
107
      <sbr/>
 
108
      <arg><option>--foreground</option></arg>
92
109
    </cmdsynopsis>
93
110
    <cmdsynopsis>
94
111
      <command>&COMMANDNAME;</command>
112
129
    <para>
113
130
      <command>&COMMANDNAME;</command> is a server daemon which
114
131
      handles incoming request for passwords for a pre-defined list of
115
 
      client host computers.  The Mandos server uses Zeroconf to
116
 
      announce itself on the local network, and uses TLS to
117
 
      communicate securely with and to authenticate the clients.  The
118
 
      Mandos server uses IPv6 to allow Mandos clients to use IPv6
119
 
      link-local addresses, since the clients will probably not have
120
 
      any other addresses configured (see <xref linkend="overview"/>).
121
 
      Any authenticated client is then given the stored pre-encrypted
122
 
      password for that specific client.
 
132
      client host computers. For an introduction, see
 
133
      <citerefentry><refentrytitle>intro</refentrytitle>
 
134
      <manvolnum>8mandos</manvolnum></citerefentry>. The Mandos server
 
135
      uses Zeroconf to announce itself on the local network, and uses
 
136
      TLS to communicate securely with and to authenticate the
 
137
      clients.  The Mandos server uses IPv6 to allow Mandos clients to
 
138
      use IPv6 link-local addresses, since the clients will probably
 
139
      not have any other addresses configured (see <xref
 
140
      linkend="overview"/>).  Any authenticated client is then given
 
141
      the stored pre-encrypted password for that specific client.
123
142
    </para>
124
143
  </refsect1>
125
144
  
194
213
      </varlistentry>
195
214
      
196
215
      <varlistentry>
 
216
        <term><option>--debuglevel
 
217
        <replaceable>LEVEL</replaceable></option></term>
 
218
        <listitem>
 
219
          <para>
 
220
            Set the debugging log level.
 
221
            <replaceable>LEVEL</replaceable> is a string, one of
 
222
            <quote><literal>CRITICAL</literal></quote>,
 
223
            <quote><literal>ERROR</literal></quote>,
 
224
            <quote><literal>WARNING</literal></quote>,
 
225
            <quote><literal>INFO</literal></quote>, or
 
226
            <quote><literal>DEBUG</literal></quote>, in order of
 
227
            increasing verbosity.  The default level is
 
228
            <quote><literal>WARNING</literal></quote>.
 
229
          </para>
 
230
        </listitem>
 
231
      </varlistentry>
 
232
      
 
233
      <varlistentry>
197
234
        <term><option>--priority <replaceable>
198
235
        PRIORITY</replaceable></option></term>
199
236
        <listitem>
200
 
          <xi:include href="mandos-options.xml" xpointer="priority"/>
 
237
          <xi:include href="mandos-options.xml"
 
238
                      xpointer="priority_compat"/>
201
239
        </listitem>
202
240
      </varlistentry>
203
241
      
250
288
          <xi:include href="mandos-options.xml" xpointer="ipv6"/>
251
289
        </listitem>
252
290
      </varlistentry>
 
291
      
 
292
      <varlistentry>
 
293
        <term><option>--no-restore</option></term>
 
294
        <listitem>
 
295
          <xi:include href="mandos-options.xml" xpointer="restore"/>
 
296
          <para>
 
297
            See also <xref linkend="persistent_state"/>.
 
298
          </para>
 
299
        </listitem>
 
300
      </varlistentry>
 
301
      
 
302
      <varlistentry>
 
303
        <term><option>--statedir
 
304
        <replaceable>DIRECTORY</replaceable></option></term>
 
305
        <listitem>
 
306
          <xi:include href="mandos-options.xml" xpointer="statedir"/>
 
307
        </listitem>
 
308
      </varlistentry>
 
309
      
 
310
      <varlistentry>
 
311
        <term><option>--socket
 
312
        <replaceable>FD</replaceable></option></term>
 
313
        <listitem>
 
314
          <xi:include href="mandos-options.xml" xpointer="socket"/>
 
315
        </listitem>
 
316
      </varlistentry>
 
317
      
 
318
      <varlistentry>
 
319
        <term><option>--foreground</option></term>
 
320
        <listitem>
 
321
          <xi:include href="mandos-options.xml"
 
322
                      xpointer="foreground"/>
 
323
        </listitem>
 
324
      </varlistentry>
 
325
      
253
326
    </variablelist>
254
327
  </refsect1>
255
328
  
329
402
      for some time, the client is assumed to be compromised and is no
330
403
      longer eligible to receive the encrypted password.  (Manual
331
404
      intervention is required to re-enable a client.)  The timeout,
332
 
      checker program, and interval between checks can be configured
333
 
      both globally and per client; see <citerefentry>
334
 
      <refentrytitle>mandos-clients.conf</refentrytitle>
335
 
      <manvolnum>5</manvolnum></citerefentry>.  A client successfully
336
 
      receiving its password will also be treated as a successful
337
 
      checker run.
 
405
      extended timeout, checker program, and interval between checks
 
406
      can be configured both globally and per client; see
 
407
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
 
408
      <manvolnum>5</manvolnum></citerefentry>.
338
409
    </para>
339
410
  </refsect1>
340
411
  
362
433
    <title>LOGGING</title>
363
434
    <para>
364
435
      The server will send log message with various severity levels to
365
 
      <filename>/dev/log</filename>.  With the
 
436
      <filename class="devicefile">/dev/log</filename>.  With the
366
437
      <option>--debug</option> option, it will log even more messages,
367
438
      and also show them on the console.
368
439
    </para>
369
440
  </refsect1>
370
441
  
 
442
  <refsect1 id="persistent_state">
 
443
    <title>PERSISTENT STATE</title>
 
444
    <para>
 
445
      Client settings, initially read from
 
446
      <filename>clients.conf</filename>, are persistent across
 
447
      restarts, and run-time changes will override settings in
 
448
      <filename>clients.conf</filename>.  However, if a setting is
 
449
      <emphasis>changed</emphasis> (or a client added, or removed) in
 
450
      <filename>clients.conf</filename>, this will take precedence.
 
451
    </para>
 
452
  </refsect1>
 
453
  
371
454
  <refsect1 id="dbus_interface">
372
455
    <title>D-BUS INTERFACE</title>
373
456
    <para>
435
518
        </listitem>
436
519
      </varlistentry>
437
520
      <varlistentry>
438
 
        <term><filename>/var/run/mandos.pid</filename></term>
 
521
        <term><filename>/run/mandos.pid</filename></term>
439
522
        <listitem>
440
523
          <para>
441
524
            The file containing the process id of the
442
525
            <command>&COMMANDNAME;</command> process started last.
 
526
            <emphasis >Note:</emphasis> If the <filename
 
527
            class="directory">/run</filename> directory does not
 
528
            exist, <filename>/var/run/mandos.pid</filename> will be
 
529
            used instead.
 
530
          </para>
 
531
        </listitem>
 
532
      </varlistentry>
 
533
      <varlistentry>
 
534
        <term><filename class="devicefile">/dev/log</filename></term>
 
535
      </varlistentry>
 
536
      <varlistentry>
 
537
        <term><filename
 
538
        class="directory">/var/lib/mandos</filename></term>
 
539
        <listitem>
 
540
          <para>
 
541
            Directory where persistent state will be saved.  Change
 
542
            this with the <option>--statedir</option> option.  See
 
543
            also the <option>--no-restore</option> option.
443
544
          </para>
444
545
        </listitem>
445
546
      </varlistentry>
473
574
      backtrace.  This could be considered a feature.
474
575
    </para>
475
576
    <para>
476
 
      Currently, if a client is disabled due to having timed out, the
477
 
      server does not record this fact onto permanent storage.  This
478
 
      has some security implications, see <xref linkend="clients"/>.
479
 
    </para>
480
 
    <para>
481
577
      There is no fine-grained control over logging and debug output.
482
578
    </para>
483
579
    <para>
484
 
      Debug mode is conflated with running in the foreground.
485
 
    </para>
486
 
    <para>
487
 
      The console log messages do not show a time stamp.
488
 
    </para>
489
 
    <para>
490
580
      This server does not check the expire time of clients’ OpenPGP
491
581
      keys.
492
582
    </para>
505
595
    <informalexample>
506
596
      <para>
507
597
        Run the server in debug mode, read configuration files from
508
 
        the <filename>~/mandos</filename> directory, and use the
509
 
        Zeroconf service name <quote>Test</quote> to not collide with
510
 
        any other official Mandos server on this host:
 
598
        the <filename class="directory">~/mandos</filename> directory,
 
599
        and use the Zeroconf service name <quote>Test</quote> to not
 
600
        collide with any other official Mandos server on this host:
511
601
      </para>
512
602
      <para>
513
603
 
562
652
        compromised if they are gone for too long.
563
653
      </para>
564
654
      <para>
565
 
        If a client is compromised, its downtime should be duly noted
566
 
        by the server which would therefore disable the client.  But
567
 
        if the server was ever restarted, it would re-read its client
568
 
        list from its configuration file and again regard all clients
569
 
        therein as enabled, and hence eligible to receive their
570
 
        passwords.  Therefore, be careful when restarting servers if
571
 
        it is suspected that a client has, in fact, been compromised
572
 
        by parties who may now be running a fake Mandos client with
573
 
        the keys from the non-encrypted initial <acronym>RAM</acronym>
574
 
        image of the client host.  What should be done in that case
575
 
        (if restarting the server program really is necessary) is to
576
 
        stop the server program, edit the configuration file to omit
577
 
        any suspect clients, and restart the server program.
578
 
      </para>
579
 
      <para>
580
655
        For more details on client-side security, see
581
656
        <citerefentry><refentrytitle>mandos-client</refentrytitle>
582
657
        <manvolnum>8mandos</manvolnum></citerefentry>.
587
662
  <refsect1 id="see_also">
588
663
    <title>SEE ALSO</title>
589
664
    <para>
590
 
      <citerefentry>
591
 
        <refentrytitle>mandos-clients.conf</refentrytitle>
592
 
        <manvolnum>5</manvolnum></citerefentry>, <citerefentry>
593
 
        <refentrytitle>mandos.conf</refentrytitle>
594
 
        <manvolnum>5</manvolnum></citerefentry>, <citerefentry>
595
 
        <refentrytitle>mandos-client</refentrytitle>
596
 
        <manvolnum>8mandos</manvolnum></citerefentry>, <citerefentry>
597
 
        <refentrytitle>sh</refentrytitle><manvolnum>1</manvolnum>
598
 
      </citerefentry>
 
665
      <citerefentry><refentrytitle>intro</refentrytitle>
 
666
      <manvolnum>8mandos</manvolnum></citerefentry>,
 
667
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
 
668
      <manvolnum>5</manvolnum></citerefentry>,
 
669
      <citerefentry><refentrytitle>mandos.conf</refentrytitle>
 
670
      <manvolnum>5</manvolnum></citerefentry>,
 
671
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
 
672
      <manvolnum>8mandos</manvolnum></citerefentry>,
 
673
      <citerefentry><refentrytitle>sh</refentrytitle>
 
674
      <manvolnum>1</manvolnum></citerefentry>
599
675
    </para>
600
676
    <variablelist>
601
677
      <varlistentry>