/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to plugins.d/mandos-client.xml

  • Committer: Teddy Hogeborn
  • Date: 2019-02-09 23:36:11 UTC
  • mto: (237.7.594 trunk)
  • mto: This revision was merged to the branch mainline in revision 370.
  • Revision ID: teddy@recompile.se-20190209233611-qurtq0kpsoct9uwf
Doc fix: Minor clarification

* mandos-clients.conf.xml (OPTIONS/checker): Be more clear that it's
  specifically an SSH key fingerprint that is being compared, and no
  other kind of fingerprint.

Show diffs side-by-side

added added

removed removed

Lines of Context:
plugins.d/mandos-client.xml
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY COMMANDNAME "mandos-client">
5
 
<!ENTITY TIMESTAMP "2023-10-21">
 
5
<!ENTITY TIMESTAMP "2019-02-09">
6
6
<!ENTITY % common SYSTEM "../common.ent">
7
7
%common;
8
8
]>
42
42
      <year>2016</year>
43
43
      <year>2017</year>
44
44
      <year>2018</year>
45
 
      <year>2019</year>
46
45
      <holder>Teddy Hogeborn</holder>
47
46
      <holder>Björn Påhlsson</holder>
48
47
    </copyright>
196
195
    </para>
197
196
    <para>
198
197
      This program is not meant to be run directly; it is really meant
199
 
      to be run by other programs in the initial
200
 
      <acronym>RAM</acronym> disk environment; see <xref
201
 
      linkend="overview"/>.
 
198
      to run as a plugin of the <application>Mandos</application>
 
199
      <citerefentry><refentrytitle>plugin-runner</refentrytitle>
 
200
      <manvolnum>8mandos</manvolnum></citerefentry>, which runs in the
 
201
      initial <acronym>RAM</acronym> disk environment because it is
 
202
      specified as a <quote>keyscript</quote> in the <citerefentry>
 
203
      <refentrytitle>crypttab</refentrytitle><manvolnum>5</manvolnum>
 
204
      </citerefentry> file.
202
205
    </para>
203
206
  </refsect1>
204
207
  
216
219
    <title>OPTIONS</title>
217
220
    <para>
218
221
      This program is commonly not invoked from the command line; it
219
 
      is normally started by another program as described in <xref
220
 
      linkend="description"/>.  Any command line options this program
221
 
      accepts are therefore normally provided by the invoking program,
222
 
      and not directly.
 
222
      is normally started by the <application>Mandos</application>
 
223
      plugin runner, see <citerefentry><refentrytitle
 
224
      >plugin-runner</refentrytitle><manvolnum>8mandos</manvolnum>
 
225
      </citerefentry>.  Any command line options this program accepts
 
226
      are therefore normally provided by the plugin runner, and not
 
227
      directly.
223
228
    </para>
224
229
    
225
230
    <variablelist>
476
481
    <title>OVERVIEW</title>
477
482
    <xi:include href="../overview.xml"/>
478
483
    <para>
479
 
      This program is the client part.  It is run automatically in an
480
 
      initial <acronym>RAM</acronym> disk environment.
481
 
    </para>
482
 
    <para>
483
 
      In an initial <acronym>RAM</acronym> disk environment using
484
 
      <citerefentry><refentrytitle>systemd</refentrytitle>
485
 
      <manvolnum>1</manvolnum></citerefentry>, this program is started
486
 
      by the <application>Mandos</application> <citerefentry>
487
 
      <refentrytitle>password-agent</refentrytitle>
488
 
      <manvolnum>8mandos</manvolnum></citerefentry>, which in turn is
489
 
      started automatically by the <citerefentry>
490
 
      <refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum>
491
 
      </citerefentry> <quote>Password Agent</quote> system.
492
 
    </para>
493
 
    <para>
494
 
      In the case of a non-<citerefentry>
495
 
      <refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum>
496
 
      </citerefentry> environment, this program is started as a plugin
497
 
      of the <application>Mandos</application> <citerefentry>
498
 
      <refentrytitle>plugin-runner</refentrytitle>
499
 
      <manvolnum>8mandos</manvolnum></citerefentry>, which runs in the
500
 
      initial <acronym>RAM</acronym> disk environment because it is
501
 
      specified as a <quote>keyscript</quote> in the <citerefentry>
502
 
      <refentrytitle>crypttab</refentrytitle><manvolnum>5</manvolnum>
503
 
      </citerefentry> file.
 
484
      This program is the client part.  It is a plugin started by
 
485
      <citerefentry><refentrytitle>plugin-runner</refentrytitle>
 
486
      <manvolnum>8mandos</manvolnum></citerefentry> which will run in
 
487
      an initial <acronym>RAM</acronym> disk environment.
504
488
    </para>
505
489
    <para>
506
490
      This program could, theoretically, be used as a keyscript in
507
491
      <filename>/etc/crypttab</filename>, but it would then be
508
492
      impossible to enter a password for the encrypted root disk at
509
493
      the console, since this program does not read from the console
510
 
      at all.
 
494
      at all.  This is why a separate plugin runner (<citerefentry>
 
495
      <refentrytitle>plugin-runner</refentrytitle>
 
496
      <manvolnum>8mandos</manvolnum></citerefentry>) is used to run
 
497
      both this program and others in in parallel,
 
498
      <emphasis>one</emphasis> of which (<citerefentry>
 
499
      <refentrytitle>password-prompt</refentrytitle>
 
500
      <manvolnum>8mandos</manvolnum></citerefentry>) will prompt for
 
501
      passwords on the system console.
511
502
    </para>
512
503
  </refsect1>
513
504
  
533
524
          <para>
534
525
            This environment variable will be assumed to contain the
535
526
            directory containing any helper executables.  The use and
536
 
            nature of these helper executables, if any, is purposely
537
 
            not documented.
 
527
            nature of these helper executables, if any, is
 
528
            purposefully not documented.
538
529
        </para>
539
530
        </listitem>
540
531
      </varlistentry>
770
761
    <title>EXAMPLE</title>
771
762
    <para>
772
763
      Note that normally, command line options will not be given
773
 
      directly, but passed on via the program responsible for starting
774
 
      this program; see <xref linkend="overview"/>.
 
764
      directly, but via options for the Mandos <citerefentry
 
765
      ><refentrytitle>plugin-runner</refentrytitle>
 
766
      <manvolnum>8mandos</manvolnum></citerefentry>.
775
767
    </para>
776
768
    <informalexample>
777
769
      <para>
823
815
  <refsect1 id="security">
824
816
    <title>SECURITY</title>
825
817
    <para>
826
 
      This program assumes that it is set-uid to root, and will switch
827
 
      back to the original (and presumably non-privileged) user and
828
 
      group after bringing up the network interface.
 
818
      This program is set-uid to root, but will switch back to the
 
819
      original (and presumably non-privileged) user and group after
 
820
      bringing up the network interface.
829
821
    </para>
830
822
    <para>
831
823
      To use this program for its intended purpose (see <xref
879
871
      <manvolnum>5</manvolnum></citerefentry>,
880
872
      <citerefentry><refentrytitle>mandos</refentrytitle>
881
873
      <manvolnum>8</manvolnum></citerefentry>,
882
 
      <citerefentry><refentrytitle>password-agent</refentrytitle>
 
874
      <citerefentry><refentrytitle>password-prompt</refentrytitle>
883
875
      <manvolnum>8mandos</manvolnum></citerefentry>,
884
876
      <citerefentry><refentrytitle>plugin-runner</refentrytitle>
885
877
      <manvolnum>8mandos</manvolnum></citerefentry>
898
890
      </varlistentry>
899
891
      <varlistentry>
900
892
        <term>
901
 
          <ulink url="https://www.avahi.org/">Avahi</ulink>
 
893
          <ulink url="http://www.avahi.org/">Avahi</ulink>
902
894
        </term>
903
895
      <listitem>
904
896
        <para>