/mandos/release : revision 88

3

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

4

<!ENTITY VERSION "1.0">

5

<!ENTITY COMMANDNAME "mandos">

6

<!ENTITY TIMESTAMP "2008-08-29">

6

<!ENTITY OVERVIEW SYSTEM "overview.xml">

7

]>

8

9

9

10

11

<title>Mandos Manual</title>

11

<title>&COMMANDNAME;</title>

12

13

<productname>Mandos</productname>

13

<productname>&COMMANDNAME;</productname>

14

<productnumber>&VERSION;</productnumber>

15

<date>&TIMESTAMP;</date>

16

15

17

16

18

17

<firstname>Björn</firstname>

74

73

75

74

76

75

<command>&COMMANDNAME;</command>

77

<arg>--interface<arg choice="plain">NAME</arg></arg>

76

<arg>--interface<arg choice="plain">IF</arg></arg>

78

77

<arg>--address<arg choice="plain">ADDRESS</arg></arg>

79

78

80

79

<arg>--priority<arg choice="plain">PRIORITY</arg></arg>

84

83

</cmdsynopsis>

85

84

86

85

<command>&COMMANDNAME;</command>

87

86

88

87

<arg>-a<arg choice="plain">ADDRESS</arg></arg>

89

88

90

89

<arg>--priority<arg choice="plain">PRIORITY</arg></arg>

152

151

</varlistentry>

153

152

154

153

155

<term><literal>-i</literal>, <literal>--interface <replaceable

156

>NAME</replaceable></literal></term>

154

<term><literal>-i</literal>, <literal>--interface <replaceable>

155

IF</replaceable></literal></term>

157

156

158

<xi:include href="mandos-options.xml" xpointer="interface"/>

157

<para>

158

Only announce the server and listen to requests on network

159

interface <replaceable>IF</replaceable>. Default is to

160

use all available interfaces. <emphasis>Note:</emphasis>

161

a failure to bind to the specified interface is not

162

considered critical, and the server does not exit.

163

</para>

159

164

</listitem>

160

165

</varlistentry>

161

166

163

168

<term><literal>-a</literal>, <literal>--address <replaceable>

164

169

ADDRESS</replaceable></literal></term>

165

170

166

<xi:include href="mandos-options.xml" xpointer="address"/>

171

<para>

172

If this option is used, the server will only listen to a

173

specific address. This must currently be an IPv6 address;

174

an IPv4 address can be specified using the

175

<quote><literal>::FFFF:192.0.2.3</literal></quote> syntax.

176

Also, if a link-local address is specified, an interface

177

should be set, since a link-local address is only valid on

178

a single interface. By default, the server will listen to

179

all available addresses.

180

</para>

167

181

</listitem>

168

182

</varlistentry>

169

183

171

185

172

186

PORT</replaceable></literal></term>

173

187

174

<xi:include href="mandos-options.xml" xpointer="port"/>

188

<para>

189

If this option is used, the server to bind to that

190

port. By default, the server will listen to an arbitrary

191

port given by the operating system.

192

</para>

175

193

</listitem>

176

194

</varlistentry>

177

195

188

206

189

207

<term><literal>--debug</literal></term>

190

208

191

<xi:include href="mandos-options.xml" xpointer="debug"/>

209

<para>

210

If the server is run in debug mode, it will run in the

211

foreground and print a lot of debugging information. The

212

default is <emphasis>not</emphasis> to run in debug mode.

213

</para>

192

214

</listitem>

193

215

</varlistentry>

194

216

196

218

<term><literal>--priority <replaceable>

197

219

PRIORITY</replaceable></literal></term>

198

220

199

<xi:include href="mandos-options.xml" xpointer="priority"/>

221

<para>

222

GnuTLS priority string for the TLS handshake with the

223

clients. The default is

224

<quote><literal>SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP</literal></quote>.

225

See <citerefentry><refentrytitle>gnutls_priority_init

226

</refentrytitle><manvolnum>3</manvolnum></citerefentry>

227

for the syntax. <emphasis>Warning</emphasis>: changing

228

this may make the TLS handshake fail, making communication

229

with clients impossible.

230

</para>

200

231

</listitem>

201

232

</varlistentry>

202

233

204

235

<term><literal>--servicename <replaceable>NAME</replaceable>

205

236

</literal></term>

206

237

207

<xi:include href="mandos-options.xml"

208

xpointer="servicename"/>

238

<para>

239

Zeroconf service name. The default is

240

<quote><literal>Mandos</literal></quote>. This only needs

241

to be changed this if it, for some reason, is necessary to

242

run more than one server on the same

243

<emphasis>host</emphasis>, which would not normally be

244

useful. If there are name collisions on the same

245

<emphasis>network</emphasis>, the newer server will

246

automatically rename itself to <quote><literal>Mandos

247

#2</literal></quote>, and so on; therefore, this option is

248

not needed in that case.

249

</para>

209

250

</listitem>

210

251

</varlistentry>

211

252

237

278

238

279

239

280

<title>OVERVIEW</title>

240

<xi:include href="overview.xml"/>

281

&OVERVIEW;

241

282

<para>

242

283

This program is the server part. It is a normal server program

243

284

and will run in a normal system environment, not in an initial

276

317

277

318

</row>

278

319

<row>

279

320

280

321

281

322

</row>

282

323

<row>

312

353

longer eligible to receive the encrypted password. The timeout,

313

354

checker program, and interval between checks can be configured

314

355

both globally and per client; see <citerefentry>

356

<refentrytitle>mandos.conf</refentrytitle>

357

315

358

<refentrytitle>mandos-clients.conf</refentrytitle>

316

359

<manvolnum>5</manvolnum></citerefentry>.

317

360

</para>

320

363

321

364

<title>LOGGING</title>

322

365

<para>

323

The server will send log message with various severity levels to

324

<filename>/dev/log</filename>. With the

366

The server will send log messaged with various severity levels

367

to <filename>/dev/log</filename>. With the

325

368

<option>--debug</option> option, it will log even more messages,

326

369

and also show them on the console.

327

370

</para>

348

391

<varname>PATH</varname> to search for matching commands if

349

392

an absolute path is not given. See <citerefentry>

350

393

351

</citerefentry>.

394

</citerefentry>

352

395

</para>

353

396

</listitem>

354

397

</varlistentry>

450

493

Normal invocation needs no options:

451

494

</para>

452

495

<para>

453

<userinput>&COMMANDNAME;</userinput>

496

<userinput>mandos</userinput>

454

497

</para>

455

498

</informalexample>

456

499

463

506

<para>

464

507

465

508

466

<userinput>&COMMANDNAME; --debug --configdir ~/mandos --servicename Test</userinput>

509

<userinput>mandos --debug --configdir ~/mandos --servicename Test</userinput>

467

510

468

511

</para>

469

512

</informalexample>

475

518

<para>

476

519

477

520

478

<userinput>&COMMANDNAME; --interface eth7 --address fe80::aede:48ff:fe71:f6f2</userinput>

521

<userinput>mandos --interface eth7 --address fe80::aede:48ff:fe71:f6f2</userinput>

479

522

480

523

</para>

481

524

</informalexample>

538

581

539

582

540

583

541

<para>

542

543

<refentrytitle>mandos-clients.conf</refentrytitle>

544

545

<refentrytitle>mandos.conf</refentrytitle>

546

547

<refentrytitle>password-request</refentrytitle>

548

<manvolnum>8mandos</manvolnum></citerefentry>, <citerefentry>

549

550

</citerefentry>

551

</para>

552

584

553

585

554

586

<term>

587

588

<refentrytitle>password-request</refentrytitle>

589

<manvolnum>8mandos</manvolnum>

590

</citerefentry>

591

</term>

592

593

<para>

594

This is the actual program which talks to this server.

595

Note that it is normally not invoked directly, and is only

596

run in the initial RAM disk environment, and not on a

597

fully started system.

598

</para>

599

</listitem>

600

</varlistentry>

601

602

<term>

555

603

<ulink url="http://www.zeroconf.org/">Zeroconf</ulink>

556

604

</term>

557

605

574

622

</varlistentry>

575

623

576

624

<term>

577

<ulink url="http://www.gnu.org/software/gnutls/"

578

>GnuTLS</ulink>

625

<ulink

626

url="http://www.gnu.org/software/gnutls/">GnuTLS</ulink>

579

627

</term>

580

628

581

629

<para>

587

635

</varlistentry>

588

636

589

637

<term>

590

RFC 4291: <citetitle>IP Version 6 Addressing

591

Architecture</citetitle>

638

<citation>RFC 4291: <citetitle>IP Version 6 Addressing

639

Architecture</citetitle>, section 2.5.6, Link-Local IPv6

640

Unicast Addresses</citation>

592

641

</term>

593

642

594

595

596

<term>Section 2.2: <citetitle>Text Representation of

597

Addresses</citetitle></term>

598

599

</varlistentry>

600

601

<term>Section 2.5.5.2: <citetitle>IPv4-Mapped IPv6

602

Address</citetitle></term>

603

604

</varlistentry>

605

606

<term>Section 2.5.6, <citetitle>Link-Local IPv6 Unicast

607

Addresses</citetitle></term>

608

609

<para>

610

The clients use IPv6 link-local addresses, which are

611

immediately usable since a link-local addresses is

612

automatically assigned to a network interfaces when it

613

is brought up.

614

</para>

615

</listitem>

616

</varlistentry>

617

</variablelist>

643

<para>

644

The clients use IPv6 link-local addresses, which are

645

immediately usable since a link-local addresses is

646

automatically assigned to a network interfaces when it is

647

brought up.

648

</para>

618

649

</listitem>

619

650

</varlistentry>

620

651

621

652

<term>

622

RFC 4346: <citetitle>The Transport Layer Security (TLS)

623

Protocol Version 1.1</citetitle>

653

<citation>RFC 4346: <citetitle>The Transport Layer Security

654

(TLS) Protocol Version 1.1</citetitle></citation>

624

655

</term>

625

656

626

657

<para>

630

661

</varlistentry>

631

662

632

663

<term>

633

RFC 4880: <citetitle>OpenPGP Message Format</citetitle>

664

<citation>RFC 4880: <citetitle>OpenPGP Message

665

Format</citetitle></citation>

634

666

</term>

635

667

636

668

<para>

640

672

</varlistentry>

641

673

642

674

<term>

643

RFC 5081: <citetitle>Using OpenPGP Keys for Transport Layer

644

Security</citetitle>

675

<citation>RFC 5081: <citetitle>Using OpenPGP Keys for

676

Transport Layer Security</citetitle></citation>

645

677

</term>

646

678

647

679

<para>

653

685

</variablelist>

654

686

</refsect1>

655

687

</refentry>

656

657

658

659

660