1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
<!ENTITY VERSION "1.0">
4
5
<!ENTITY COMMANDNAME "mandos">
5
<!ENTITY TIMESTAMP "2019-02-10">
6
<!ENTITY % common SYSTEM "common.ent">
10
8
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
12
<title>Mandos Manual</title>
10
<title>&COMMANDNAME;</title>
13
11
<!-- NWalsh’s docbook scripts use this to generate the footer: -->
14
<productname>Mandos</productname>
15
<productnumber>&version;</productnumber>
16
<date>&TIMESTAMP;</date>
12
<productname>&COMMANDNAME;</productname>
13
<productnumber>&VERSION;</productnumber>
19
16
<firstname>Björn</firstname>
20
17
<surname>Påhlsson</surname>
22
<email>belorn@recompile.se</email>
19
<email>belorn@fukt.bsnet.se</email>
26
23
<firstname>Teddy</firstname>
27
24
<surname>Hogeborn</surname>
29
<email>teddy@recompile.se</email>
26
<email>teddy@fukt.bsnet.se</email>
46
32
<holder>Teddy Hogeborn</holder>
47
33
<holder>Björn Påhlsson</holder>
49
<xi:include href="legalnotice.xml"/>
37
This manual page is free software: you can redistribute it
38
and/or modify it under the terms of the GNU General Public
39
License as published by the Free Software Foundation,
40
either version 3 of the License, or (at your option) any
45
This manual page is distributed in the hope that it will
46
be useful, but WITHOUT ANY WARRANTY; without even the
47
implied warranty of MERCHANTABILITY or FITNESS FOR A
48
PARTICULAR PURPOSE. See the GNU General Public License
53
You should have received a copy of the GNU General Public
54
License along with this program; If not, see
55
<ulink url="http://www.gnu.org/licenses/"/>.
53
61
<refentrytitle>&COMMANDNAME;</refentrytitle>
54
62
<manvolnum>8</manvolnum>
58
66
<refname><command>&COMMANDNAME;</command></refname>
60
Gives encrypted passwords to authenticated Mandos clients
68
Sends encrypted passwords to authenticated Mandos clients
66
74
<command>&COMMANDNAME;</command>
68
<arg choice="plain"><option>--interface
69
<replaceable>NAME</replaceable></option></arg>
70
<arg choice="plain"><option>-i
71
<replaceable>NAME</replaceable></option></arg>
75
<arg choice="plain"><option>--address
76
<replaceable>ADDRESS</replaceable></option></arg>
77
<arg choice="plain"><option>-a
78
<replaceable>ADDRESS</replaceable></option></arg>
82
<arg choice="plain"><option>--port
83
<replaceable>PORT</replaceable></option></arg>
84
<arg choice="plain"><option>-p
85
<replaceable>PORT</replaceable></option></arg>
88
<arg><option>--priority
89
<replaceable>PRIORITY</replaceable></option></arg>
91
<arg><option>--servicename
92
<replaceable>NAME</replaceable></option></arg>
94
<arg><option>--configdir
95
<replaceable>DIRECTORY</replaceable></option></arg>
97
<arg><option>--debug</option></arg>
99
<arg><option>--debuglevel
100
<replaceable>LEVEL</replaceable></option></arg>
102
<arg><option>--no-dbus</option></arg>
104
<arg><option>--no-ipv6</option></arg>
106
<arg><option>--no-restore</option></arg>
108
<arg><option>--statedir
109
<replaceable>DIRECTORY</replaceable></option></arg>
111
<arg><option>--socket
112
<replaceable>FD</replaceable></option></arg>
114
<arg><option>--foreground</option></arg>
116
<arg><option>--no-zeroconf</option></arg>
75
<arg>--interface<arg choice="plain">NAME</arg></arg>
76
<arg>--address<arg choice="plain">ADDRESS</arg></arg>
77
<arg>--port<arg choice="plain">PORT</arg></arg>
78
<arg>--priority<arg choice="plain">PRIORITY</arg></arg>
79
<arg>--servicename<arg choice="plain">NAME</arg></arg>
80
<arg>--configdir<arg choice="plain">DIRECTORY</arg></arg>
84
<command>&COMMANDNAME;</command>
85
<arg>-i<arg choice="plain">NAME</arg></arg>
86
<arg>-a<arg choice="plain">ADDRESS</arg></arg>
87
<arg>-p<arg choice="plain">PORT</arg></arg>
88
<arg>--priority<arg choice="plain">PRIORITY</arg></arg>
89
<arg>--servicename<arg choice="plain">NAME</arg></arg>
90
<arg>--configdir<arg choice="plain">DIRECTORY</arg></arg>
119
94
<command>&COMMANDNAME;</command>
120
95
<group choice="req">
121
<arg choice="plain"><option>--help</option></arg>
122
<arg choice="plain"><option>-h</option></arg>
96
<arg choice="plain">-h</arg>
97
<arg choice="plain">--help</arg>
126
101
<command>&COMMANDNAME;</command>
127
<arg choice="plain"><option>--version</option></arg>
102
<arg choice="plain">--version</arg>
130
105
<command>&COMMANDNAME;</command>
131
<arg choice="plain"><option>--check</option></arg>
106
<arg choice="plain">--check</arg>
133
108
</refsynopsisdiv>
135
110
<refsect1 id="description">
136
111
<title>DESCRIPTION</title>
138
113
<command>&COMMANDNAME;</command> is a server daemon which
139
114
handles incoming request for passwords for a pre-defined list of
140
client host computers. For an introduction, see
141
<citerefentry><refentrytitle>intro</refentrytitle>
142
<manvolnum>8mandos</manvolnum></citerefentry>. The Mandos server
143
uses Zeroconf to announce itself on the local network, and uses
144
TLS to communicate securely with and to authenticate the
145
clients. The Mandos server uses IPv6 to allow Mandos clients to
146
use IPv6 link-local addresses, since the clients will probably
147
not have any other addresses configured (see <xref
148
linkend="overview"/>). Any authenticated client is then given
149
the stored pre-encrypted password for that specific client.
115
client host computers. The Mandos server uses Zeroconf to
116
announce itself on the local network, and uses TLS to
117
communicate securely with and to authenticate the clients. The
118
Mandos server uses IPv6 to allow Mandos clients to use IPv6
119
link-local addresses, since the clients will probably not have
120
any other addresses configured (see <xref linkend="overview"/>).
121
Any authenticated client is then given the stored pre-encrypted
122
password for that specific client.
153
127
<refsect1 id="purpose">
154
128
<title>PURPOSE</title>
156
131
The purpose of this is to enable <emphasis>remote and unattended
157
132
rebooting</emphasis> of client host computer with an
158
133
<emphasis>encrypted root file system</emphasis>. See <xref
159
134
linkend="overview"/> for details.
163
139
<refsect1 id="options">
164
140
<title>OPTIONS</title>
167
<term><option>--help</option></term>
168
<term><option>-h</option></term>
144
<term><literal>-h</literal>, <literal>--help</literal></term>
171
147
Show a help message and exit
177
<term><option>--interface</option>
178
<replaceable>NAME</replaceable></term>
179
<term><option>-i</option>
180
<replaceable>NAME</replaceable></term>
153
<term><literal>-i</literal>, <literal>--interface <replaceable
154
>NAME</replaceable></literal></term>
182
156
<xi:include href="mandos-options.xml" xpointer="interface"/>
187
<term><option>--address
188
<replaceable>ADDRESS</replaceable></option></term>
190
<replaceable>ADDRESS</replaceable></option></term>
161
<term><literal>-a</literal>, <literal>--address <replaceable>
162
ADDRESS</replaceable></literal></term>
192
164
<xi:include href="mandos-options.xml" xpointer="address"/>
198
<replaceable>PORT</replaceable></option></term>
200
<replaceable>PORT</replaceable></option></term>
169
<term><literal>-p</literal>, <literal>--port <replaceable>
170
PORT</replaceable></literal></term>
202
172
<xi:include href="mandos-options.xml" xpointer="port"/>
207
<term><option>--check</option></term>
177
<term><literal>--check</literal></term>
210
180
Run the server’s self-tests. This includes any unit
217
<term><option>--debug</option></term>
187
<term><literal>--debug</literal></term>
219
189
<xi:include href="mandos-options.xml" xpointer="debug"/>
224
<term><option>--debuglevel
225
<replaceable>LEVEL</replaceable></option></term>
228
Set the debugging log level.
229
<replaceable>LEVEL</replaceable> is a string, one of
230
<quote><literal>CRITICAL</literal></quote>,
231
<quote><literal>ERROR</literal></quote>,
232
<quote><literal>WARNING</literal></quote>,
233
<quote><literal>INFO</literal></quote>, or
234
<quote><literal>DEBUG</literal></quote>, in order of
235
increasing verbosity. The default level is
236
<quote><literal>WARNING</literal></quote>.
242
<term><option>--priority <replaceable>
243
PRIORITY</replaceable></option></term>
194
<term><literal>--priority <replaceable>
195
PRIORITY</replaceable></literal></term>
245
197
<xi:include href="mandos-options.xml" xpointer="priority"/>
250
<term><option>--servicename
251
<replaceable>NAME</replaceable></option></term>
202
<term><literal>--servicename <replaceable>NAME</replaceable>
253
205
<xi:include href="mandos-options.xml"
254
206
xpointer="servicename"/>
259
<term><option>--configdir
260
<replaceable>DIRECTORY</replaceable></option></term>
211
<term><literal>--configdir <replaceable>DIR</replaceable>
263
215
Directory to search for configuration files. Default is
274
<term><option>--version</option></term>
226
<term><literal>--version</literal></term>
277
229
Prints the program version and exit.
283
<term><option>--no-dbus</option></term>
285
<xi:include href="mandos-options.xml" xpointer="dbus"/>
287
See also <xref linkend="dbus_interface"/>.
293
<term><option>--no-ipv6</option></term>
295
<xi:include href="mandos-options.xml" xpointer="ipv6"/>
300
<term><option>--no-restore</option></term>
302
<xi:include href="mandos-options.xml" xpointer="restore"/>
304
See also <xref linkend="persistent_state"/>.
310
<term><option>--statedir
311
<replaceable>DIRECTORY</replaceable></option></term>
313
<xi:include href="mandos-options.xml" xpointer="statedir"/>
318
<term><option>--socket
319
<replaceable>FD</replaceable></option></term>
321
<xi:include href="mandos-options.xml" xpointer="socket"/>
326
<term><option>--foreground</option></term>
328
<xi:include href="mandos-options.xml"
329
xpointer="foreground"/>
334
<term><option>--no-zeroconf</option></term>
336
<xi:include href="mandos-options.xml" xpointer="zeroconf"/>
343
236
<refsect1 id="overview">
344
237
<title>OVERVIEW</title>
345
238
<xi:include href="overview.xml"/>
347
240
This program is the server part. It is a normal server program
348
241
and will run in a normal system environment, not in an initial
349
<acronym>RAM</acronym> disk environment.
242
RAM disk environment.
353
246
<refsect1 id="protocol">
354
247
<title>NETWORK PROTOCOL</title>
408
301
</tbody></tgroup></table>
411
304
<refsect1 id="checking">
412
305
<title>CHECKING</title>
414
307
The server will, by default, continually check that the clients
415
308
are still up. If a client has not been confirmed as being up
416
309
for some time, the client is assumed to be compromised and is no
417
longer eligible to receive the encrypted password. (Manual
418
intervention is required to re-enable a client.) The timeout,
419
extended timeout, checker program, and interval between checks
420
can be configured both globally and per client; see
421
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
310
longer eligible to receive the encrypted password. The timeout,
311
checker program, and interval between checks can be configured
312
both globally and per client; see <citerefentry>
313
<refentrytitle>mandos-clients.conf</refentrytitle>
422
314
<manvolnum>5</manvolnum></citerefentry>.
426
<refsect1 id="approval">
427
<title>APPROVAL</title>
429
The server can be configured to require manual approval for a
430
client before it is sent its secret. The delay to wait for such
431
approval and the default action (approve or deny) can be
432
configured both globally and per client; see <citerefentry>
433
<refentrytitle>mandos-clients.conf</refentrytitle>
434
<manvolnum>5</manvolnum></citerefentry>. By default all clients
435
will be approved immediately without delay.
438
This can be used to deny a client its secret if not manually
439
approved within a specified time. It can also be used to make
440
the server delay before giving a client its secret, allowing
441
optional manual denying of this specific client.
446
318
<refsect1 id="logging">
447
319
<title>LOGGING</title>
449
321
The server will send log message with various severity levels to
450
<filename class="devicefile">/dev/log</filename>. With the
322
<filename>/dev/log</filename>. With the
451
323
<option>--debug</option> option, it will log even more messages,
452
324
and also show them on the console.
456
<refsect1 id="persistent_state">
457
<title>PERSISTENT STATE</title>
459
Client settings, initially read from
460
<filename>clients.conf</filename>, are persistent across
461
restarts, and run-time changes will override settings in
462
<filename>clients.conf</filename>. However, if a setting is
463
<emphasis>changed</emphasis> (or a client added, or removed) in
464
<filename>clients.conf</filename>, this will take precedence.
468
<refsect1 id="dbus_interface">
469
<title>D-BUS INTERFACE</title>
471
The server will by default provide a D-Bus system bus interface.
472
This interface will only be accessible by the root user or a
473
Mandos-specific user, if such a user exists. For documentation
474
of the D-Bus API, see the file <filename>DBUS-API</filename>.
478
328
<refsect1 id="exit_status">
479
329
<title>EXIT STATUS</title>
624
475
<!-- do not wrap this line -->
625
<userinput>&COMMANDNAME; --interface eth7 --address fe80::aede:48ff:fe71:f6f2</userinput>
476
<userinput>mandos --interface eth7 --address fe80::aede:48ff:fe71:f6f2</userinput>
628
479
</informalexample>
631
482
<refsect1 id="security">
632
483
<title>SECURITY</title>
633
<refsect2 id="server">
484
<refsect2 id="SERVER">
634
485
<title>SERVER</title>
636
487
Running this <command>&COMMANDNAME;</command> server program
637
488
should not in itself present any security risk to the host
638
computer running it. The program switches to a non-root user
489
computer running it. The program does not need any special
490
privileges to run, and is designed to run as a non-root user.
642
<refsect2 id="clients">
493
<refsect2 id="CLIENTS">
643
494
<title>CLIENTS</title>
645
496
The server only gives out its stored data to clients which
646
does have the correct key ID of the stored key ID. This is
647
guaranteed by the fact that the client sends its public key in
648
the TLS handshake; this ensures it to be genuine. The server
649
computes the key ID of the key itself and looks up the key ID
650
in its list of clients. The <filename>clients.conf</filename>
497
does have the OpenPGP key of the stored fingerprint. This is
498
guaranteed by the fact that the client sends its OpenPGP
499
public key in the TLS handshake; this ensures it to be
500
genuine. The server computes the fingerprint of the key
501
itself and looks up the fingerprint in its list of
502
clients. The <filename>clients.conf</filename> file (see
652
503
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
653
504
<manvolnum>5</manvolnum></citerefentry>)
654
505
<emphasis>must</emphasis> be made non-readable by anyone
655
except the user starting the server (usually root).
506
except the user running the server.
658
509
As detailed in <xref linkend="checking"/>, the status of all
660
511
compromised if they are gone for too long.
514
If a client is compromised, its downtime should be duly noted
515
by the server which would therefore declare the client
516
invalid. But if the server was ever restarted, it would
517
re-read its client list from its configuration file and again
518
regard all clients therein as valid, and hence eligible to
519
receive their passwords. Therefore, be careful when
520
restarting servers if it is suspected that a client has, in
521
fact, been compromised by parties who may now be running a
522
fake Mandos client with the keys from the non-encrypted
523
initial RAM image of the client host. What should be done in
524
that case (if restarting the server program really is
525
necessary) is to stop the server program, edit the
526
configuration file to omit any suspect clients, and restart
663
530
For more details on client-side security, see
664
<citerefentry><refentrytitle>mandos-client</refentrytitle>
531
<citerefentry><refentrytitle>password-request</refentrytitle>
665
532
<manvolnum>8mandos</manvolnum></citerefentry>.
670
537
<refsect1 id="see_also">
671
538
<title>SEE ALSO</title>
673
<citerefentry><refentrytitle>intro</refentrytitle>
674
<manvolnum>8mandos</manvolnum></citerefentry>,
675
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
676
<manvolnum>5</manvolnum></citerefentry>,
677
<citerefentry><refentrytitle>mandos.conf</refentrytitle>
678
<manvolnum>5</manvolnum></citerefentry>,
679
<citerefentry><refentrytitle>mandos-client</refentrytitle>
680
<manvolnum>8mandos</manvolnum></citerefentry>,
681
<citerefentry><refentrytitle>sh</refentrytitle>
682
<manvolnum>1</manvolnum></citerefentry>
541
<refentrytitle>mandos.conf</refentrytitle>
542
<manvolnum>5</manvolnum></citerefentry>, <citerefentry>
543
<refentrytitle>mandos-clients.conf</refentrytitle>
544
<manvolnum>5</manvolnum></citerefentry>, <citerefentry>
545
<refentrytitle>password-request</refentrytitle>
546
<manvolnum>8mandos</manvolnum></citerefentry>, <citerefentry>
547
<refentrytitle>sh</refentrytitle><manvolnum>1</manvolnum>
709
<ulink url="https://gnutls.org/">GnuTLS</ulink>
576
url="http://www.gnu.org/software/gnutls/">GnuTLS</ulink>
713
580
GnuTLS is the library this server uses to implement TLS for
714
581
communicating securely with the client, and at the same time
715
confidently get the client’s public key.
582
confidently get the client’s public OpenPGP key.
721
RFC 4291: <citetitle>IP Version 6 Addressing
722
Architecture</citetitle>
588
<citation>RFC 4291: <citetitle>IP Version 6 Addressing
589
Architecture</citetitle>, section 2.5.6, Link-Local IPv6
590
Unicast Addresses</citation>
727
<term>Section 2.2: <citetitle>Text Representation of
728
Addresses</citetitle></term>
729
<listitem><para/></listitem>
732
<term>Section 2.5.5.2: <citetitle>IPv4-Mapped IPv6
733
Address</citetitle></term>
734
<listitem><para/></listitem>
737
<term>Section 2.5.6, <citetitle>Link-Local IPv6 Unicast
738
Addresses</citetitle></term>
741
The clients use IPv6 link-local addresses, which are
742
immediately usable since a link-local addresses is
743
automatically assigned to a network interfaces when it
594
The clients use IPv6 link-local addresses, which are
595
immediately usable since a link-local addresses is
596
automatically assigned to a network interfaces when it is
753
RFC 5246: <citetitle>The Transport Layer Security (TLS)
754
Protocol Version 1.2</citetitle>
603
<citation>RFC 4346: <citetitle>The Transport Layer Security
604
(TLS) Protocol Version 1.1</citetitle></citation>
758
TLS 1.2 is the protocol implemented by GnuTLS.
608
TLS 1.1 is the protocol implemented by GnuTLS.
764
RFC 4880: <citetitle>OpenPGP Message Format</citetitle>
614
<citation>RFC 4880: <citetitle>OpenPGP Message
615
Format</citetitle></citation>