/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos-ctl.xml

  • Committer: Teddy Hogeborn
  • Date: 2015-03-10 18:03:38 UTC
  • mto: (237.7.304 trunk)
  • mto: This revision was merged to the branch mainline in revision 325.
  • Revision ID: teddy@recompile.se-20150310180338-pcxw6r2qmw9k6br9
Add ":!RSA" to GnuTLS priority string, to disallow non-DHE kx.

If Mandos was somehow made to use a non-ephemeral Diffie-Hellman key
exchange algorithm in the TLS handshake, any saved network traffic
could then be decrypted later if the Mandos client key was obtained.
By default, Mandos uses ephemeral DH key exchanges which does not have
this problem, but a non-ephemeral key exchange algorithm was still
enabled by default.  The simplest solution is to simply turn that off,
which ensures that Mandos will always use ephemeral DH key exchanges.

There is a "PFS" priority string specifier, but we can't use it because:

1. Security-wise, it is a mix between "NORMAL" and "SECURE128" - it
   enables a lot more algorithms than "SECURE256".

2. It is only available since GnuTLS 3.2.4.

Thanks to Andreas Fischer <af@bantuX.org> for reporting this issue.

Show diffs side-by-side

added added

removed removed

Lines of Context:
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY COMMANDNAME "mandos-ctl">
5
 
<!ENTITY TIMESTAMP "2018-02-08">
 
5
<!ENTITY TIMESTAMP "2012-06-22">
6
6
<!ENTITY % common SYSTEM "common.ent">
7
7
%common;
8
8
]>
34
34
      <year>2010</year>
35
35
      <year>2011</year>
36
36
      <year>2012</year>
37
 
      <year>2013</year>
38
 
      <year>2014</year>
39
 
      <year>2015</year>
40
 
      <year>2016</year>
41
 
      <year>2017</year>
42
 
      <year>2018</year>
43
37
      <holder>Teddy Hogeborn</holder>
44
38
      <holder>Björn Påhlsson</holder>
45
39
    </copyright>
54
48
  <refnamediv>
55
49
    <refname><command>&COMMANDNAME;</command></refname>
56
50
    <refpurpose>
57
 
      Control or query the operation of the Mandos server
 
51
      Control the operation of the Mandos server
58
52
    </refpurpose>
59
53
  </refnamediv>
60
54
  
61
55
  <refsynopsisdiv>
62
56
    <cmdsynopsis>
63
57
      <command>&COMMANDNAME;</command>
64
 
      <group choice="req">
65
 
        <group>
66
 
          <arg choice="plain"><option>--enable</option></arg>
67
 
          <arg choice="plain"><option>-e</option></arg>
68
 
          <sbr/>
69
 
          <arg choice="plain"><option>--disable</option></arg>
70
 
          <arg choice="plain"><option>-d</option></arg>
71
 
        </group>
72
 
        <sbr/>
73
 
        <group>
74
 
          <arg choice="plain"><option>--bump-timeout</option></arg>
75
 
          <arg choice="plain"><option>-b</option></arg>
76
 
        </group>
77
 
        <sbr/>
78
 
        <group>
79
 
          <arg choice="plain"><option>--start-checker</option></arg>
80
 
        </group>
81
 
        <sbr/>
82
 
        <group>
83
 
          <arg choice="plain"><option>--stop-checker</option></arg>
84
 
        </group>
85
 
        <sbr/>
86
 
        <group>
87
 
          <arg choice="plain"><option>--remove</option></arg>
88
 
          <arg choice="plain"><option>-r</option></arg>
89
 
        </group>
90
 
        <sbr/>
91
 
        <group>
92
 
          <arg choice="plain"><option>--checker
93
 
          <replaceable>COMMAND</replaceable></option></arg>
94
 
          <arg choice="plain"><option>-c
95
 
          <replaceable>COMMAND</replaceable></option></arg>
96
 
        </group>
97
 
        <sbr/>
98
 
        <group>
99
 
          <arg choice="plain"><option>--timeout
100
 
          <replaceable>TIME</replaceable></option></arg>
101
 
          <arg choice="plain"><option>-t
102
 
          <replaceable>TIME</replaceable></option></arg>
103
 
        </group>
104
 
        <sbr/>
105
 
        <group>
106
 
          <arg choice="plain"><option>--extended-timeout
107
 
          <replaceable>TIME</replaceable></option></arg>
108
 
        </group>
109
 
        <sbr/>
110
 
        <group>
111
 
          <arg choice="plain"><option>--interval
112
 
          <replaceable>TIME</replaceable></option></arg>
113
 
          <arg choice="plain"><option>-i
114
 
          <replaceable>TIME</replaceable></option></arg>
115
 
        </group>
116
 
        <sbr/>
117
 
        <group>
118
 
          <arg choice="plain"><option>--approve-by-default</option
119
 
          ></arg>
120
 
          <sbr/>
121
 
          <arg choice="plain"><option>--deny-by-default</option></arg>
122
 
        </group>
123
 
        <sbr/>
124
 
        <group>
125
 
          <arg choice="plain"><option>--approval-delay
126
 
          <replaceable>TIME</replaceable></option></arg>
127
 
        </group>
128
 
        <sbr/>
129
 
        <group>
130
 
          <arg choice="plain"><option>--approval-duration
131
 
          <replaceable>TIME</replaceable></option></arg>
132
 
        </group>
133
 
        <sbr/>
134
 
        <group>
135
 
          <arg choice="plain"><option>--interval
136
 
          <replaceable>TIME</replaceable></option></arg>
137
 
          <arg choice="plain"><option>-i
138
 
          <replaceable>TIME</replaceable></option></arg>
139
 
        </group>
140
 
        <sbr/>
141
 
        <group>
142
 
          <arg choice="plain"><option>--host
143
 
          <replaceable>STRING</replaceable></option></arg>
144
 
          <arg choice="plain"><option>-H
145
 
          <replaceable>STRING</replaceable></option></arg>
146
 
        </group>
147
 
        <sbr/>
148
 
        <group>
149
 
          <arg choice="plain"><option>--secret
150
 
          <replaceable>FILENAME</replaceable></option></arg>
151
 
          <arg choice="plain"><option>-s
152
 
          <replaceable>FILENAME</replaceable></option></arg>
153
 
        </group>
154
 
        <sbr/>
155
 
        <group>
156
 
          <arg choice="plain"><option>--approve</option></arg>
157
 
          <arg choice="plain"><option>-A</option></arg>
158
 
          <sbr/>
159
 
          <arg choice="plain"><option>--deny</option></arg>
160
 
          <arg choice="plain"><option>-D</option></arg>
161
 
        </group>
 
58
      <group>
 
59
        <arg choice="plain"><option>--enable</option></arg>
 
60
        <arg choice="plain"><option>-e</option></arg>
 
61
        <sbr/>
 
62
        <arg choice="plain"><option>--disable</option></arg>
 
63
        <arg choice="plain"><option>-d</option></arg>
 
64
      </group>
 
65
      <sbr/>
 
66
      <group>
 
67
        <arg choice="plain"><option>--bump-timeout</option></arg>
 
68
        <arg choice="plain"><option>-b</option></arg>
 
69
      </group>
 
70
      <sbr/>
 
71
      <group>
 
72
        <arg choice="plain"><option>--start-checker</option></arg>
 
73
      </group>
 
74
      <sbr/>
 
75
      <group>
 
76
        <arg choice="plain"><option>--stop-checker</option></arg>
 
77
      </group>
 
78
      <sbr/>
 
79
      <group>
 
80
        <arg choice="plain"><option>--remove</option></arg>
 
81
        <arg choice="plain"><option>-r</option></arg>
 
82
      </group>
 
83
      <sbr/>
 
84
      <group>
 
85
        <arg choice="plain"><option>--checker
 
86
        <replaceable>COMMAND</replaceable></option></arg>
 
87
        <arg choice="plain"><option>-c
 
88
        <replaceable>COMMAND</replaceable></option></arg>
 
89
      </group>
 
90
      <sbr/>
 
91
      <group>
 
92
        <arg choice="plain"><option>--timeout
 
93
        <replaceable>TIME</replaceable></option></arg>
 
94
        <arg choice="plain"><option>-t
 
95
        <replaceable>TIME</replaceable></option></arg>
 
96
      </group>
 
97
      <sbr/>
 
98
      <group>
 
99
        <arg choice="plain"><option>--extended-timeout
 
100
        <replaceable>TIME</replaceable></option></arg>
 
101
      </group>
 
102
      <sbr/>
 
103
      <group>
 
104
        <arg choice="plain"><option>--interval
 
105
        <replaceable>TIME</replaceable></option></arg>
 
106
        <arg choice="plain"><option>-i
 
107
        <replaceable>TIME</replaceable></option></arg>
 
108
      </group>
 
109
      <sbr/>
 
110
      <group>
 
111
        <arg choice="plain"><option>--approve-by-default</option
 
112
        ></arg>
 
113
        <sbr/>
 
114
        <arg choice="plain"><option>--deny-by-default</option></arg>
 
115
      </group>
 
116
      <sbr/>
 
117
      <group>
 
118
        <arg choice="plain"><option>--approval-delay
 
119
        <replaceable>TIME</replaceable></option></arg>
 
120
      </group>
 
121
      <sbr/>
 
122
      <group>
 
123
        <arg choice="plain"><option>--approval-duration
 
124
        <replaceable>TIME</replaceable></option></arg>
 
125
      </group>
 
126
      <sbr/>
 
127
      <group>
 
128
        <arg choice="plain"><option>--interval
 
129
        <replaceable>TIME</replaceable></option></arg>
 
130
        <arg choice="plain"><option>-i
 
131
        <replaceable>TIME</replaceable></option></arg>
 
132
      </group>
 
133
      <sbr/>
 
134
      <group>
 
135
        <arg choice="plain"><option>--host
 
136
        <replaceable>STRING</replaceable></option></arg>
 
137
        <arg choice="plain"><option>-H
 
138
        <replaceable>STRING</replaceable></option></arg>
 
139
      </group>
 
140
      <sbr/>
 
141
      <group>
 
142
        <arg choice="plain"><option>--secret
 
143
        <replaceable>FILENAME</replaceable></option></arg>
 
144
        <arg choice="plain"><option>-s
 
145
        <replaceable>FILENAME</replaceable></option></arg>
 
146
      </group>
 
147
      <sbr/>
 
148
      <group>
 
149
        <arg choice="plain"><option>--approve</option></arg>
 
150
        <arg choice="plain"><option>-A</option></arg>
 
151
        <sbr/>
 
152
        <arg choice="plain"><option>--deny</option></arg>
 
153
        <arg choice="plain"><option>-D</option></arg>
162
154
      </group>
163
155
      <sbr/>
164
156
      <group choice="req">
172
164
    <cmdsynopsis>
173
165
      <command>&COMMANDNAME;</command>
174
166
      <group>
175
 
          <arg choice="plain"><option>--verbose</option></arg>
176
 
          <arg choice="plain"><option>-v</option></arg>
177
 
          <sbr/>
178
 
          <arg choice="plain"><option>--dump-json</option></arg>
179
 
          <arg choice="plain"><option>-j</option></arg>
 
167
        <arg choice="plain"><option>--verbose</option></arg>
 
168
        <arg choice="plain"><option>-v</option></arg>
180
169
      </group>
181
170
      <group>
182
171
        <arg rep='repeat' choice='plain'>
215
204
  <refsect1 id="description">
216
205
    <title>DESCRIPTION</title>
217
206
    <para>
218
 
      <command>&COMMANDNAME;</command> is a program to control or
219
 
      query the operation of the Mandos server
220
 
      <citerefentry><refentrytitle>mandos</refentrytitle><manvolnum
221
 
      >8</manvolnum></citerefentry>.
 
207
      <command>&COMMANDNAME;</command> is a program to control the
 
208
      operation of the Mandos server <citerefentry><refentrytitle
 
209
      >mandos</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
222
210
    </para>
223
211
    <para>
224
212
      This program can be used to change client settings, approve or
482
470
      </varlistentry>
483
471
      
484
472
      <varlistentry>
485
 
        <term><option>--dump-json</option></term>
486
 
        <term><option>-j</option></term>
487
 
        <listitem>
488
 
          <para>
489
 
            Dump client settings as JSON to standard output.
490
 
          </para>
491
 
        </listitem>
492
 
      </varlistentry>
493
 
      
494
 
      <varlistentry>
495
473
        <term><option>--is-enabled</option></term>
496
474
        <term><option>-V</option></term>
497
475
        <listitem>
532
510
    </para>
533
511
  </refsect1>
534
512
  
535
 
  <refsect1 id="bugs">
536
 
    <title>BUGS</title>
537
 
    <xi:include href="bugs.xml"/>
538
 
  </refsect1>
 
513
<!--   <refsect1 id="bugs"> -->
 
514
<!--     <title>BUGS</title> -->
 
515
<!--     <para> -->
 
516
<!--     </para> -->
 
517
<!--   </refsect1> -->
539
518
  
540
519
  <refsect1 id="example">
541
520
    <title>EXAMPLE</title>