1
<?xml version="1.0" encoding="UTF-8"?>
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
<!ENTITY COMMANDNAME "mandos-ctl">
5
<!ENTITY TIMESTAMP "2019-03-06">
6
<!ENTITY % common SYSTEM "common.ent">
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
12
<title>Mandos Manual</title>
13
<!-- NWalsh’s docbook scripts use this to generate the footer: -->
14
<productname>Mandos</productname>
15
<productnumber>&version;</productnumber>
16
<date>&TIMESTAMP;</date>
19
<firstname>Björn</firstname>
20
<surname>Påhlsson</surname>
22
<email>belorn@recompile.se</email>
26
<firstname>Teddy</firstname>
27
<surname>Hogeborn</surname>
29
<email>teddy@recompile.se</email>
44
<holder>Teddy Hogeborn</holder>
45
<holder>Björn Påhlsson</holder>
47
<xi:include href="legalnotice.xml"/>
51
<refentrytitle>&COMMANDNAME;</refentrytitle>
52
<manvolnum>8</manvolnum>
56
<refname><command>&COMMANDNAME;</command></refname>
58
Control or query the operation of the Mandos server
64
<command>&COMMANDNAME;</command>
67
<arg choice="plain"><option>--enable</option></arg>
68
<arg choice="plain"><option>-e</option></arg>
70
<arg choice="plain"><option>--disable</option></arg>
71
<arg choice="plain"><option>-d</option></arg>
75
<arg choice="plain"><option>--bump-timeout</option></arg>
76
<arg choice="plain"><option>-b</option></arg>
80
<arg choice="plain"><option>--start-checker</option></arg>
84
<arg choice="plain"><option>--stop-checker</option></arg>
88
<arg choice="plain"><option>--remove</option></arg>
89
<arg choice="plain"><option>-r</option></arg>
93
<arg choice="plain"><option>--checker
94
<replaceable>COMMAND</replaceable></option></arg>
95
<arg choice="plain"><option>-c
96
<replaceable>COMMAND</replaceable></option></arg>
100
<arg choice="plain"><option>--timeout
101
<replaceable>TIME</replaceable></option></arg>
102
<arg choice="plain"><option>-t
103
<replaceable>TIME</replaceable></option></arg>
107
<arg choice="plain"><option>--extended-timeout
108
<replaceable>TIME</replaceable></option></arg>
112
<arg choice="plain"><option>--interval
113
<replaceable>TIME</replaceable></option></arg>
114
<arg choice="plain"><option>-i
115
<replaceable>TIME</replaceable></option></arg>
119
<arg choice="plain"><option>--approve-by-default</option
122
<arg choice="plain"><option>--deny-by-default</option></arg>
126
<arg choice="plain"><option>--approval-delay
127
<replaceable>TIME</replaceable></option></arg>
131
<arg choice="plain"><option>--approval-duration
132
<replaceable>TIME</replaceable></option></arg>
136
<arg choice="plain"><option>--host
137
<replaceable>STRING</replaceable></option></arg>
138
<arg choice="plain"><option>-H
139
<replaceable>STRING</replaceable></option></arg>
143
<arg choice="plain"><option>--secret
144
<replaceable>FILENAME</replaceable></option></arg>
145
<arg choice="plain"><option>-s
146
<replaceable>FILENAME</replaceable></option></arg>
150
<arg choice="plain"><option>--approve</option></arg>
151
<arg choice="plain"><option>-A</option></arg>
153
<arg choice="plain"><option>--deny</option></arg>
154
<arg choice="plain"><option>-D</option></arg>
159
<arg choice="plain"><option>--all</option></arg>
160
<arg choice="plain"><option>-a</option></arg>
161
<arg rep='repeat' choice='plain'>
162
<replaceable>CLIENT</replaceable>
167
<command>&COMMANDNAME;</command>
169
<arg choice="plain"><option>--verbose</option></arg>
170
<arg choice="plain"><option>-v</option></arg>
172
<arg choice="plain"><option>--dump-json</option></arg>
173
<arg choice="plain"><option>-j</option></arg>
176
<arg rep='repeat' choice='plain'>
177
<replaceable>CLIENT</replaceable>
182
<command>&COMMANDNAME;</command>
184
<arg choice="plain"><option>--is-enabled</option></arg>
185
<arg choice="plain"><option>-V</option></arg>
187
<arg choice='plain'><replaceable>CLIENT</replaceable></arg>
190
<command>&COMMANDNAME;</command>
192
<arg choice="plain"><option>--help</option></arg>
193
<arg choice="plain"><option>-h</option></arg>
197
<command>&COMMANDNAME;</command>
199
<arg choice="plain"><option>--version</option></arg>
200
<arg choice="plain"><option>-v</option></arg>
204
<command>&COMMANDNAME;</command>
205
<arg choice="plain"><option>--check</option></arg>
209
<refsect1 id="description">
210
<title>DESCRIPTION</title>
212
<command>&COMMANDNAME;</command> is a program to control or
213
query the operation of the Mandos server
214
<citerefentry><refentrytitle>mandos</refentrytitle><manvolnum
215
>8</manvolnum></citerefentry>.
218
This program can be used to change client settings, approve or
219
deny client requests, and to remove clients from the server.
223
<refsect1 id="purpose">
224
<title>PURPOSE</title>
226
The purpose of this is to enable <emphasis>remote and unattended
227
rebooting</emphasis> of client host computer with an
228
<emphasis>encrypted root file system</emphasis>. See <xref
229
linkend="overview"/> for details.
233
<refsect1 id="options">
234
<title>OPTIONS</title>
238
<term><option>--help</option></term>
239
<term><option>-h</option></term>
242
Show a help message and exit
248
<term><option>--enable</option></term>
249
<term><option>-e</option></term>
252
Enable client(s). An enabled client will be eligble to
259
<term><option>--disable</option></term>
260
<term><option>-d</option></term>
263
Disable client(s). A disabled client will not be eligble
264
to receive its secret, and no checkers will be started for
271
<term><option>--bump-timeout</option></term>
274
Bump the timeout of the specified client(s), just as if a
275
checker had completed successfully for it/them.
281
<term><option>--start-checker</option></term>
284
Start a new checker now for the specified client(s).
290
<term><option>--stop-checker</option></term>
293
Stop any running checker for the specified client(s).
299
<term><option>--remove</option></term>
300
<term><option>-r</option></term>
303
Remove the specified client(s) from the server.
309
<term><option>--checker
310
<replaceable>COMMAND</replaceable></option></term>
312
<replaceable>COMMAND</replaceable></option></term>
315
Set the <varname>checker</varname> option of the specified
316
client(s); see <citerefentry><refentrytitle
317
>mandos-clients.conf</refentrytitle><manvolnum
318
>5</manvolnum></citerefentry>.
324
<term><option>--timeout
325
<replaceable>TIME</replaceable></option></term>
327
<replaceable>TIME</replaceable></option></term>
330
Set the <varname>timeout</varname> option of the specified
331
client(s); see <citerefentry><refentrytitle
332
>mandos-clients.conf</refentrytitle><manvolnum
333
>5</manvolnum></citerefentry>.
339
<term><option>--extended-timeout
340
<replaceable>TIME</replaceable></option></term>
343
Set the <varname>extended_timeout</varname> option of the
344
specified client(s); see <citerefentry><refentrytitle
345
>mandos-clients.conf</refentrytitle><manvolnum
346
>5</manvolnum></citerefentry>.
352
<term><option>--interval
353
<replaceable>TIME</replaceable></option></term>
355
<replaceable>TIME</replaceable></option></term>
358
Set the <varname>interval</varname> option of the
359
specified client(s); see <citerefentry><refentrytitle
360
>mandos-clients.conf</refentrytitle><manvolnum
361
>5</manvolnum></citerefentry>.
367
<term><option>--approve-by-default</option></term>
368
<term><option>--deny-by-default</option></term>
371
Set the <varname>approved_by_default</varname> option of
372
the specified client(s) to <literal>True</literal> or
373
<literal>False</literal>, respectively; see
374
<citerefentry><refentrytitle
375
>mandos-clients.conf</refentrytitle><manvolnum
376
>5</manvolnum></citerefentry>.
382
<term><option>--approval-delay
383
<replaceable>TIME</replaceable></option></term>
386
Set the <varname>approval_delay</varname> option of the
387
specified client(s); see <citerefentry><refentrytitle
388
>mandos-clients.conf</refentrytitle><manvolnum
389
>5</manvolnum></citerefentry>.
395
<term><option>--approval-duration
396
<replaceable>TIME</replaceable></option></term>
399
Set the <varname>approval_duration</varname> option of the
400
specified client(s); see <citerefentry><refentrytitle
401
>mandos-clients.conf</refentrytitle><manvolnum
402
>5</manvolnum></citerefentry>.
409
<replaceable>STRING</replaceable></option></term>
411
<replaceable>STRING</replaceable></option></term>
414
Set the <varname>host</varname> option of the specified
415
client(s); see <citerefentry><refentrytitle
416
>mandos-clients.conf</refentrytitle><manvolnum
417
>5</manvolnum></citerefentry>.
423
<term><option>--secret
424
<replaceable>FILENAME</replaceable></option></term>
426
<replaceable>FILENAME</replaceable></option></term>
429
Set the <varname>secfile</varname> option of the specified
430
client(s); see <citerefentry><refentrytitle
431
>mandos-clients.conf</refentrytitle><manvolnum
432
>5</manvolnum></citerefentry>.
438
<term><option>--approve</option></term>
439
<term><option>-A</option></term>
442
Approve client(s) if currently waiting for approval.
448
<term><option>--deny</option></term>
449
<term><option>-D</option></term>
452
Deny client(s) if currently waiting for approval.
458
<term><option>--all</option></term>
459
<term><option>-a</option></term>
462
Make the client-modifying options modify <emphasis
463
>all</emphasis> clients.
469
<term><option>--verbose</option></term>
470
<term><option>-v</option></term>
473
Show all client settings, not just a subset.
479
<term><option>--dump-json</option></term>
480
<term><option>-j</option></term>
483
Dump client settings as JSON to standard output.
489
<term><option>--is-enabled</option></term>
490
<term><option>-V</option></term>
493
Check if a single client is enabled or not, and exit with
494
a successful exit status only if the client is enabled.
500
<term><option>--check</option></term>
503
Run self-tests. This includes any unit tests, etc.
511
<refsect1 id="overview">
512
<title>OVERVIEW</title>
513
<xi:include href="overview.xml"/>
515
This program is a small utility to generate new OpenPGP keys for
516
new Mandos clients, and to generate sections for inclusion in
517
<filename>clients.conf</filename> on the server.
521
<refsect1 id="exit_status">
522
<title>EXIT STATUS</title>
524
If the <option>--is-enabled</option> option is used, the exit
525
status will be 0 only if the specified client is enabled.
531
<xi:include href="bugs.xml"/>
534
<refsect1 id="example">
535
<title>EXAMPLE</title>
541
<userinput>&COMMANDNAME;</userinput>
547
To list <emphasis>all</emphasis> settings for the clients
548
named <quote>foo1.example.org</quote> and <quote
549
>foo2.example.org</quote>:
553
<!-- do not wrap this line -->
554
<userinput>&COMMANDNAME; --verbose foo1.example.org foo2.example.org</userinput>
561
To enable all clients:
564
<userinput>&COMMANDNAME; --enable --all</userinput>
570
To change timeout and interval value for the clients
571
named <quote>foo1.example.org</quote> and <quote
572
>foo2.example.org</quote>:
576
<!-- do not wrap this line -->
577
<userinput>&COMMANDNAME; --timeout="5m" --interval="1m" foo1.example.org foo2.example.org</userinput>
584
To approve all clients currently waiting for it:
587
<userinput>&COMMANDNAME; --approve --all</userinput>
592
<refsect1 id="security">
593
<title>SECURITY</title>
595
This program must be permitted to access the Mandos server via
596
the D-Bus interface. This normally requires the root user, but
597
could be configured otherwise by reconfiguring the D-Bus server.
601
<refsect1 id="see_also">
602
<title>SEE ALSO</title>
604
<citerefentry><refentrytitle>intro</refentrytitle>
605
<manvolnum>8mandos</manvolnum></citerefentry>,
606
<citerefentry><refentrytitle>mandos</refentrytitle>
607
<manvolnum>8</manvolnum></citerefentry>,
608
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
609
<manvolnum>5</manvolnum></citerefentry>,
610
<citerefentry><refentrytitle>mandos-monitor</refentrytitle>
611
<manvolnum>8</manvolnum></citerefentry>
616
<!-- Local Variables: -->
617
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
618
<!-- time-stamp-end: "[\"']>" -->
619
<!-- time-stamp-format: "%:y-%02m-%02d" -->