/mandos/release : revision 237.7.256

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos

Committer: Teddy Hogeborn
Date: 2014-06-22 02:19:30 UTC
mto: (237.7.272 trunk)
mto: This revision was merged to the branch mainline in revision 317.
Revision ID: teddy@recompile.se-20140622021930-icl7h4cm97blhjml

mandos-keygen: Generate "checker" option to use SSH fingerprints.

To turn this off, use a new "--no-ssh" option to mandos-keygen.

* INSTALL (Mandos Server, Mandos Client): Document new suggested
                                          installation of SSH.
* Makefile (confdir/clients.conf): Use new "--no-ssh" option to
                                   "mandos-keygen".
* debian/control (mandos/Depends): Changed to "fping | ssh-client".
  (mandos-client/Recommends): New; set to "ssh".
* intro.xml (FREQUENTLY ASKED QUESTIONS): Rename and rewrite section
                                          called "Faking ping
                                          replies?" to address new
                                          default behavior.
* mandos-clients.conf.xml (OPTIONS/checker): Briefly discuss new
                                             behavior of
                                             mandos-keygen.
* mandos-keygen: Bug fix: Suppress failure output of "shred" to remove
                 "sec*", since no such files may exist.
(password mode): Scan for SSH key fingerprints and output as new
                  "checker" and "ssh_fingerprint" options, unless new
                  "--no-ssh" option is given.
* mandos-keygen.xml (SYNOPSIS/--force): Bug fix: Document short form.
  (OPTIONS/--no-ssh): New.
  (SEE ALSO): Add reference "ssh-keyscan(1)".
* plugins.d/mandos-client.xml (SECURITY): Briefly mention the
                                          possibility of using SSH key
                                          fingerprints for checking.

Show diffs side-by-side

added added

removed removed

mandos

except ImportError:

SO_BINDTODEVICE = None

version = "1.6.2"

version = "1.6.5"

stored_state_file = "clients.pickle"

logger = logging.getLogger()

syslogger = (logging.handlers.SysLogHandler

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

address = str("/dev/log")))

syslogger = None

try:

100

if_nametoindex = (ctypes.cdll.LoadLibrary

116

114

def initlogger(debug, level=logging.WARNING):

117

115

"""init logger and add loglevel"""

118

116

117

global syslogger

118

syslogger = (logging.handlers.SysLogHandler

119

(facility =

120

logging.handlers.SysLogHandler.LOG_DAEMON,

121

address = str("/dev/log")))

119

122

syslogger.setFormatter(logging.Formatter

120

123

('Mandos [%(process)d]: %(levelname)s:'

121

124

' %(message)s'))

1350

1353

*args, **kwargs)

1351

1354

1352

1355

def start_checker(self, *args, **kwargs):

1353

old_checker = self.checker

1354

if self.checker is not None:

1355

old_checker_pid = self.checker.pid

1356

else:

1357

old_checker_pid = None

1356

old_checker_pid = getattr(self.checker, "pid", None)

1358

1357

r = Client.start_checker(self, *args, **kwargs)

1359

1358

# Only if new checker process was started

1360

1359

if (self.checker is not None

2338

2337

help="Directory to save/restore state in")

2339

2338

parser.add_argument("--foreground", action="store_true",

2340

2339

help="Run in foreground", default=None)

2340

parser.add_argument("--no-zeroconf", action="store_false",

2341

dest="zeroconf", help="Do not use Zeroconf",

2342

default=None)

2341

2343

2342

2344

options = parser.parse_args()

2343

2345

2344

2346

if options.check:

2345

2347

import doctest

2346

doctest.testmod()

2347

sys.exit()

2348

fail_count, test_count = doctest.testmod()

2349

sys.exit(os.EX_OK if fail_count == 0 else 1)

2348

2350

2349

2351

# Default values for config file for server-global settings

2350

2352

server_defaults = { "interface": "",

2361

2363

"socket": "",

2362

2364

"statedir": "/var/lib/mandos",

2363

2365

"foreground": "False",

2366

"zeroconf": "True",

2364

2367

}

2365

2368

2366

2369

# Parse config file for server-global settings

2393

2396

for option in ("interface", "address", "port", "debug",

2394

2397

"priority", "servicename", "configdir",

2395

2398

"use_dbus", "use_ipv6", "debuglevel", "restore",

2396

"statedir", "socket", "foreground"):

2399

"statedir", "socket", "foreground", "zeroconf"):

2397

2400

value = getattr(options, option)

2398

2401

if value is not None:

2399

2402

server_settings[option] = value

2404

2407

server_settings[option] = unicode(server_settings[option])

2405

2408

# Force all boolean options to be boolean

2406

2409

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2407

"foreground"):

2410

"foreground", "zeroconf"):

2408

2411

server_settings[option] = bool(server_settings[option])

2409

2412

# Debug implies foreground

2410

2413

if server_settings["debug"]:

2413

2416

2414

2417

##################################################################

2415

2418

2419

if (not server_settings["zeroconf"] and

2420

not (server_settings["port"]

2421

or server_settings["socket"] != "")):

2422

parser.error("Needs port or socket to work without"

2423

" Zeroconf")

2424

2416

2425

# For convenience

2417

2426

debug = server_settings["debug"]

2418

2427

debuglevel = server_settings["debuglevel"]

2421

2430

stored_state_path = os.path.join(server_settings["statedir"],

2422

2431

stored_state_file)

2423

2432

foreground = server_settings["foreground"]

2433

zeroconf = server_settings["zeroconf"]

2424

2434

2425

2435

if debug:

2426

2436

initlogger(debug, logging.DEBUG)

2447

2457

global mandos_dbus_service

2448

2458

mandos_dbus_service = None

2449

2459

2460

socketfd = None

2461

if server_settings["socket"] != "":

2462

socketfd = server_settings["socket"]

2450

2463

tcp_server = MandosServer((server_settings["address"],

2451

2464

server_settings["port"]),

2452

2465

ClientHandler,

2456

2469

gnutls_priority=

2457

2470

server_settings["priority"],

2458

2471

use_dbus=use_dbus,

2459

socketfd=(server_settings["socket"]

2460

or None))

2472

socketfd=socketfd)

2461

2473

if not foreground:

2462

2474

pidfilename = "/run/mandos.pid"

2463

2475

if not os.path.isdir("/run/."):

2533

2545

use_dbus = False

2534

2546

server_settings["use_dbus"] = False

2535

2547

tcp_server.use_dbus = False

2536

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2537

service = AvahiServiceToSyslog(name =

2538

server_settings["servicename"],

2539

servicetype = "_mandos._tcp",

2540

protocol = protocol, bus = bus)

2541

if server_settings["interface"]:

2542

service.interface = (if_nametoindex

2543

(str(server_settings["interface"])))

2548

if zeroconf:

2549

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2550

service = AvahiServiceToSyslog(name =

2551

server_settings["servicename"],

2552

servicetype = "_mandos._tcp",

2553

protocol = protocol, bus = bus)

2554

if server_settings["interface"]:

2555

service.interface = (if_nametoindex

2556

(str(server_settings["interface"])))

2544

2557

2545

2558

global multiprocessing_manager

2546

2559

multiprocessing_manager = multiprocessing.Manager()

2740

2753

2741

2754

def cleanup():

2742

2755

"Cleanup function; run on exit"

2743

service.cleanup()

2756

if zeroconf:

2757

service.cleanup()

2744

2758

2745

2759

multiprocessing.active_children()

2746

2760

wnull.close()

2825

2839

tcp_server.server_activate()

2826

2840

2827

2841

# Find out what port we got

2828

service.port = tcp_server.socket.getsockname()[1]

2842

if zeroconf:

2843

service.port = tcp_server.socket.getsockname()[1]

2829

2844

if use_ipv6:

2830

2845

logger.info("Now listening on address %r, port %d,"

2831

2846

" flowinfo %d, scope_id %d",

2837

2852

#service.interface = tcp_server.socket.getsockname()[3]

2838

2853

2839

2854

try:

2840

# From the Avahi example code

2841

try:

2842

service.activate()

2843

except dbus.exceptions.DBusException as error:

2844

logger.critical("D-Bus Exception", exc_info=error)

2845

cleanup()

2846

sys.exit(1)

2847

# End of Avahi example code

2855

if zeroconf:

2856

# From the Avahi example code

2857

try:

2858

service.activate()

2859

except dbus.exceptions.DBusException as error:

2860

logger.critical("D-Bus Exception", exc_info=error)

2861

cleanup()

2862

sys.exit(1)

2863

# End of Avahi example code

2848

2864

2849

2865

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2850

2866

lambda *args, **kwargs:

Older »