165
131
communicates with <citerefentry><refentrytitle
166
132
>mandos</refentrytitle><manvolnum>8</manvolnum></citerefentry>
167
133
to get a password. In slightly more detail, this client program
168
brings up network interfaces, uses the interfaces’ IPv6
169
link-local addresses to get network connectivity, uses Zeroconf
170
to find servers on the local network, and communicates with
171
servers using TLS with a raw public key to ensure authenticity
172
and confidentiality. This client program keeps running, trying
173
all servers on the network, until it receives a satisfactory
174
reply or a TERM signal. After all servers have been tried, all
134
brings up a network interface, uses the interface’s IPv6
135
link-local address to get network connectivity, uses Zeroconf to
136
find servers on the local network, and communicates with servers
137
using TLS with an OpenPGP key to ensure authenticity and
138
confidentiality. This client program keeps running, trying all
139
servers on the network, until it receives a satisfactory reply
140
or a TERM signal. After all servers have been tried, all
175
141
servers are periodically retried. If no servers are found it
176
142
will wait indefinitely for new servers to appear.
179
The network interfaces are selected like this: If any interfaces
180
are specified using the <option>--interface</option> option,
181
those interface are used. Otherwise,
182
<command>&COMMANDNAME;</command> will use all interfaces that
183
are not loopback interfaces, are not point-to-point interfaces,
184
are capable of broadcasting and do not have the NOARP flag (see
185
<citerefentry><refentrytitle>netdevice</refentrytitle>
186
<manvolnum>7</manvolnum></citerefentry>). (If the
187
<option>--connect</option> option is used, point-to-point
188
interfaces and non-broadcast interfaces are accepted.) If any
189
used interfaces are not up and running, they are first taken up
190
(and later taken down again on program exit).
193
Before network interfaces are selected, all <quote>network
194
hooks</quote> are run; see <xref linkend="network-hooks"/>.
197
145
This program is not meant to be run directly; it is really meant
198
146
to run as a plugin of the <application>Mandos</application>
199
147
<citerefentry><refentrytitle>plugin-runner</refentrytitle>
244
192
assumed to separate the address from the port number.
247
Normally, Zeroconf would be used to locate Mandos servers,
248
in which case this option would only be used when testing
195
This option is normally only useful for testing and
255
202
<term><option>--interface=<replaceable
256
>NAME</replaceable><arg rep='repeat'>,<replaceable
257
>NAME</replaceable></arg></option></term>
203
>NAME</replaceable></option></term>
259
<replaceable>NAME</replaceable><arg rep='repeat'>,<replaceable
260
>NAME</replaceable></arg></option></term>
205
<replaceable>NAME</replaceable></option></term>
263
Comma separated list of network interfaces that will be
264
brought up and scanned for Mandos servers to connect to.
265
The default is the empty string, which will automatically
266
use all appropriate interfaces.
208
Network interface that will be brought up and scanned for
209
Mandos servers to connect to. The default is the empty
210
string, which will automatically choose an appropriate
269
If the <option>--connect</option> option is used, and
270
exactly one interface name is specified (except
271
<quote><literal>none</literal></quote>), this specifies
272
the interface to use to connect to the address given.
214
If the <option>--connect</option> option is used, this
215
specifies the interface to use to connect to the address
275
219
Note that since this program will normally run in the
276
220
initial RAM disk environment, the interface must be an
277
221
interface which exists at that stage. Thus, the interface
278
can normally not be a pseudo-interface such as
279
<quote>br0</quote> or <quote>tun0</quote>; such interfaces
280
will not exist until much later in the boot process, and
281
can not be used by this program, unless created by a
282
<quote>network hook</quote> — see <xref
283
linkend="network-hooks"/>.
222
can not be a pseudo-interface such as <quote>br0</quote>
223
or <quote>tun0</quote>; such interfaces will not exist
224
until much later in the boot process, and can not be used
286
228
<replaceable>NAME</replaceable> can be the string
287
<quote><literal>none</literal></quote>; this will make
288
<command>&COMMANDNAME;</command> only bring up interfaces
289
specified <emphasis>before</emphasis> this string. This
290
is not recommended, and only meant for advanced users.
229
<quote><literal>none</literal></quote>; this will not use
230
any specific interface, and will not bring up an interface
231
on startup. This is not recommended, and only meant for
365
279
Sets the number of bits to use for the prime number in the
366
TLS Diffie-Hellman key exchange. The default value is
367
selected automatically based on the GnuTLS security
368
profile set in its priority string. Note that if the
369
<option>--dh-params</option> option is used, the values
370
from that file will be used instead.
376
<term><option>--dh-params=<replaceable
377
>FILE</replaceable></option></term>
380
Specifies a PEM-encoded PKCS#3 file to read the parameters
381
needed by the TLS Diffie-Hellman key exchange from. If
382
this option is not given, or if the file for some reason
383
could not be used, the parameters will be generated on
384
startup, which will take some time and processing power.
385
Those using servers running under time, power or processor
386
constraints may want to generate such a file in advance
280
TLS Diffie-Hellman key exchange. Default is 1024.
518
397
<refsect1 id="environment">
519
398
<title>ENVIRONMENT</title>
522
<term><envar>MANDOSPLUGINHELPERDIR</envar></term>
525
This environment variable will be assumed to contain the
526
directory containing any helper executables. The use and
527
nature of these helper executables, if any, is
528
purposefully not documented.
534
This program does not use any other environment variables, not
535
even the ones provided by <citerefentry><refentrytitle
400
This program does not use any environment variables, not even
401
the ones provided by <citerefentry><refentrytitle
536
402
>cryptsetup</refentrytitle><manvolnum>8</manvolnum>
541
<refsect1 id="network-hooks">
542
<title>NETWORK HOOKS</title>
544
If a network interface like a bridge or tunnel is required to
545
find a Mandos server, this requires the interface to be up and
546
running before <command>&COMMANDNAME;</command> starts looking
547
for Mandos servers. This can be accomplished by creating a
548
<quote>network hook</quote> program, and placing it in a special
552
Before the network is used (and again before program exit), any
553
runnable programs found in the network hook directory are run
554
with the argument <quote><literal>start</literal></quote> or
555
<quote><literal>stop</literal></quote>. This should bring up or
556
down, respectively, any network interface which
557
<command>&COMMANDNAME;</command> should use.
559
<refsect2 id="hook-requirements">
560
<title>REQUIREMENTS</title>
562
A network hook must be an executable file, and its name must
563
consist entirely of upper and lower case letters, digits,
564
underscores, periods, and hyphens.
567
A network hook will receive one argument, which can be one of
572
<term><literal>start</literal></term>
575
This should make the network hook create (if necessary)
576
and bring up a network interface.
581
<term><literal>stop</literal></term>
584
This should make the network hook take down a network
585
interface, and delete it if it did not exist previously.
590
<term><literal>files</literal></term>
593
This should make the network hook print, <emphasis>one
594
file per line</emphasis>, all the files needed for it to
595
run. (These files will be copied into the initial RAM
596
filesystem.) Typical use is for a network hook which is
597
a shell script to print its needed binaries.
600
It is not necessary to print any non-executable files
601
already in the network hook directory, these will be
602
copied implicitly if they otherwise satisfy the name
608
<term><literal>modules</literal></term>
611
This should make the network hook print, <emphasis>on
612
separate lines</emphasis>, all the kernel modules needed
613
for it to run. (These modules will be copied into the
614
initial RAM filesystem.) For instance, a tunnel
616
<quote><literal>tun</literal></quote> module.
622
The network hook will be provided with a number of environment
627
<term><envar>MANDOSNETHOOKDIR</envar></term>
630
The network hook directory, specified to
631
<command>&COMMANDNAME;</command> by the
632
<option>--network-hook-dir</option> option. Note: this
633
should <emphasis>always</emphasis> be used by the
634
network hook to refer to itself or any files in the hook
635
directory it may require.
640
<term><envar>DEVICE</envar></term>
643
The network interfaces, as specified to
644
<command>&COMMANDNAME;</command> by the
645
<option>--interface</option> option, combined to one
646
string and separated by commas. If this is set, and
647
does not contain the interface a hook will bring up,
648
there is no reason for a hook to continue.
653
<term><envar>MODE</envar></term>
656
This will be the same as the first argument;
657
i.e. <quote><literal>start</literal></quote>,
658
<quote><literal>stop</literal></quote>,
659
<quote><literal>files</literal></quote>, or
660
<quote><literal>modules</literal></quote>.
665
<term><envar>VERBOSITY</envar></term>
668
This will be the <quote><literal>1</literal></quote> if
669
the <option>--debug</option> option is passed to
670
<command>&COMMANDNAME;</command>, otherwise
671
<quote><literal>0</literal></quote>.
676
<term><envar>DELAY</envar></term>
679
This will be the same as the <option>--delay</option>
680
option passed to <command>&COMMANDNAME;</command>. Is
681
only set if <envar>MODE</envar> is
682
<quote><literal>start</literal></quote> or
683
<quote><literal>stop</literal></quote>.
688
<term><envar>CONNECT</envar></term>
691
This will be the same as the <option>--connect</option>
692
option passed to <command>&COMMANDNAME;</command>. Is
693
only set if <option>--connect</option> is passed and
694
<envar>MODE</envar> is
695
<quote><literal>start</literal></quote> or
696
<quote><literal>stop</literal></quote>.
702
A hook may not read from standard input, and should be
703
restrictive in printing to standard output or standard error
704
unless <varname>VERBOSITY</varname> is
705
<quote><literal>1</literal></quote>.
710
407
<refsect1 id="files">
711
408
<title>FILES</title>
837
510
The only remaining weak point is that someone with physical
838
511
access to the client hard drive might turn off the client
839
computer, read the OpenPGP and TLS keys directly from the hard
840
drive, and communicate with the server. To safeguard against
841
this, the server is supposed to notice the client disappearing
842
and stop giving out the encrypted data. Therefore, it is
843
important to set the timeout and checker interval values tightly
844
on the server. See <citerefentry><refentrytitle
512
computer, read the OpenPGP keys directly from the hard drive,
513
and communicate with the server. To safeguard against this, the
514
server is supposed to notice the client disappearing and stop
515
giving out the encrypted data. Therefore, it is important to
516
set the timeout and checker interval values tightly on the
517
server. See <citerefentry><refentrytitle
845
518
>mandos</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
848
521
It will also help if the checker program on the server is
849
522
configured to request something from the client which can not be
850
spoofed by someone else on the network, like SSH server key
851
fingerprints, and unlike unencrypted <acronym>ICMP</acronym>
852
echo (<quote>ping</quote>) replies.
523
spoofed by someone else on the network, unlike unencrypted
524
<acronym>ICMP</acronym> echo (<quote>ping</quote>) replies.
855
527
<emphasis>Note</emphasis>: This makes it completely insecure to