/mandos/release : revision 237.7.69

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos.xml

Committer: teddy at bsnet
Date: 2011-11-10 11:08:50 UTC
mto: (237.11.22 teddy) (299.1.1 release) (300.1.1 release) (301.1.1 release)
mto: This revision was merged to the branch mainline in revision 290.
Revision ID: teddy@fukt.bsnet.se-20111110110850-ztybq08hduf85vx6

* debian/control (mandos/Depends): Added "python-crypto".
* mandos: Break long lines.
  (ClientDBus.add_to_dbus): New.
  (ClientDBus.__init__): Call add_to_dbus().
  (main): - '' -

Show diffs side-by-side

added added

removed removed

mandos.xml

<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

<!ENTITY COMMANDNAME "mandos">

<!ENTITY TIMESTAMP "2011-11-26">

<!ENTITY TIMESTAMP "2011-10-22">

<!ENTITY % common SYSTEM "common.ent">

%common;

<sbr/>

<arg><option>--no-restore</option></arg>

<sbr/>

100

<arg><option>--statedir

101

<replaceable>DIRECTORY</replaceable></option></arg>

102

</cmdsynopsis>

103

100

104

101

<command>&COMMANDNAME;</command>

287

284

<xi:include href="mandos-options.xml" xpointer="restore"/>

288

285

</listitem>

289

286

</varlistentry>

290

291

292

<term><option>--statedir

293

<replaceable>DIRECTORY</replaceable></option></term>

294

295

<xi:include href="mandos-options.xml" xpointer="statedir"/>

296

</listitem>

297

</varlistentry>

298

287

</variablelist>

299

288

</refsect1>

300

289

407

396

<title>LOGGING</title>

408

397

<para>

409

398

The server will send log message with various severity levels to

410

<filename class="devicefile">/dev/log</filename>. With the

399

<filename>/dev/log</filename>. With the

411

400

<option>--debug</option> option, it will log even more messages,

412

401

and also show them on the console.

413

402

</para>

489

478

</listitem>

490

479

</varlistentry>

491

480

492

493

</varlistentry>

494

495

<term><filename

496

class="directory">/var/lib/mandos</filename></term>

497

498

<para>

499

Directory where persistent state will be saved. Change

500

this with the <option>--statedir</option> option. See

501

also the <option>--no-restore</option> option.

502

</para>

503

</listitem>

504

</varlistentry>

505

506

481

507

482

508

483

<para>

532

507

backtrace. This could be considered a feature.

533

508

</para>

534

509

<para>

510

Currently, if a client is disabled due to having timed out, the

511

server does not record this fact onto permanent storage. This

512

has some security implications, see <xref linkend="clients"/>.

513

</para>

514

<para>

535

515

There is no fine-grained control over logging and debug output.

536

516

</para>

537

517

<para>

556

536

557

537

<para>

558

538

Run the server in debug mode, read configuration files from

559

the <filename class="directory">~/mandos</filename> directory,

560

and use the Zeroconf service name <quote>Test</quote> to not

561

collide with any other official Mandos server on this host:

539

the <filename>~/mandos</filename> directory, and use the

540

Zeroconf service name <quote>Test</quote> to not collide with

541

any other official Mandos server on this host:

562

542

</para>

563

543

<para>

564

544

613

593

compromised if they are gone for too long.

614

594

</para>

615

595

<para>

596

If a client is compromised, its downtime should be duly noted

597

by the server which would therefore disable the client. But

598

if the server was ever restarted, it would re-read its client

599

list from its configuration file and again regard all clients

600

therein as enabled, and hence eligible to receive their

601

passwords. Therefore, be careful when restarting servers if

602

it is suspected that a client has, in fact, been compromised

603

by parties who may now be running a fake Mandos client with

604

the keys from the non-encrypted initial <acronym>RAM</acronym>

605

image of the client host. What should be done in that case

606

(if restarting the server program really is necessary) is to

607

stop the server program, edit the configuration file to omit

608

any suspect clients, and restart the server program.

609

</para>

610

<para>

616

611

For more details on client-side security, see

617

612

<citerefentry><refentrytitle>mandos-client</refentrytitle>

618

613

<manvolnum>8mandos</manvolnum></citerefentry>.

Older »