1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
<!ENTITY VERSION "1.0">
4
5
<!ENTITY COMMANDNAME "mandos">
5
<!ENTITY TIMESTAMP "2013-10-20">
6
<!ENTITY % common SYSTEM "common.ent">
10
8
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
12
<title>Mandos Manual</title>
10
<title>&COMMANDNAME;</title>
13
11
<!-- NWalsh’s docbook scripts use this to generate the footer: -->
14
<productname>Mandos</productname>
15
<productnumber>&version;</productnumber>
16
<date>&TIMESTAMP;</date>
12
<productname>&COMMANDNAME;</productname>
13
<productnumber>&VERSION;</productnumber>
19
16
<firstname>Björn</firstname>
20
17
<surname>Påhlsson</surname>
22
<email>belorn@recompile.se</email>
19
<email>belorn@fukt.bsnet.se</email>
26
23
<firstname>Teddy</firstname>
27
24
<surname>Hogeborn</surname>
29
<email>teddy@recompile.se</email>
26
<email>teddy@fukt.bsnet.se</email>
40
32
<holder>Teddy Hogeborn</holder>
41
33
<holder>Björn Påhlsson</holder>
43
<xi:include href="legalnotice.xml"/>
37
This manual page is free software: you can redistribute it
38
and/or modify it under the terms of the GNU General Public
39
License as published by the Free Software Foundation,
40
either version 3 of the License, or (at your option) any
45
This manual page is distributed in the hope that it will
46
be useful, but WITHOUT ANY WARRANTY; without even the
47
implied warranty of MERCHANTABILITY or FITNESS FOR A
48
PARTICULAR PURPOSE. See the GNU General Public License
53
You should have received a copy of the GNU General Public
54
License along with this program; If not, see
55
<ulink url="http://www.gnu.org/licenses/"/>.
47
61
<refentrytitle>&COMMANDNAME;</refentrytitle>
48
62
<manvolnum>8</manvolnum>
52
66
<refname><command>&COMMANDNAME;</command></refname>
54
Gives encrypted passwords to authenticated Mandos clients
68
Sends encrypted passwords to authenticated Mandos clients
60
74
<command>&COMMANDNAME;</command>
62
<arg choice="plain"><option>--interface
63
<replaceable>NAME</replaceable></option></arg>
64
<arg choice="plain"><option>-i
65
<replaceable>NAME</replaceable></option></arg>
69
<arg choice="plain"><option>--address
70
<replaceable>ADDRESS</replaceable></option></arg>
71
<arg choice="plain"><option>-a
72
<replaceable>ADDRESS</replaceable></option></arg>
76
<arg choice="plain"><option>--port
77
<replaceable>PORT</replaceable></option></arg>
78
<arg choice="plain"><option>-p
79
<replaceable>PORT</replaceable></option></arg>
82
<arg><option>--priority
83
<replaceable>PRIORITY</replaceable></option></arg>
85
<arg><option>--servicename
86
<replaceable>NAME</replaceable></option></arg>
88
<arg><option>--configdir
89
<replaceable>DIRECTORY</replaceable></option></arg>
91
<arg><option>--debug</option></arg>
93
<arg><option>--debuglevel
94
<replaceable>LEVEL</replaceable></option></arg>
96
<arg><option>--no-dbus</option></arg>
98
<arg><option>--no-ipv6</option></arg>
100
<arg><option>--no-restore</option></arg>
102
<arg><option>--statedir
103
<replaceable>DIRECTORY</replaceable></option></arg>
105
<arg><option>--socket
106
<replaceable>FD</replaceable></option></arg>
108
<arg><option>--foreground</option></arg>
75
<arg>--interface<arg choice="plain">IF</arg></arg>
76
<arg>--address<arg choice="plain">ADDRESS</arg></arg>
77
<arg>--port<arg choice="plain">PORT</arg></arg>
78
<arg>--priority<arg choice="plain">PRIORITY</arg></arg>
79
<arg>--servicename<arg choice="plain">NAME</arg></arg>
80
<arg>--configdir<arg choice="plain">DIRECTORY</arg></arg>
84
<command>&COMMANDNAME;</command>
85
<arg>-i<arg choice="plain">IF</arg></arg>
86
<arg>-a<arg choice="plain">ADDRESS</arg></arg>
87
<arg>-p<arg choice="plain">PORT</arg></arg>
88
<arg>--priority<arg choice="plain">PRIORITY</arg></arg>
89
<arg>--servicename<arg choice="plain">NAME</arg></arg>
90
<arg>--configdir<arg choice="plain">DIRECTORY</arg></arg>
111
94
<command>&COMMANDNAME;</command>
112
95
<group choice="req">
113
<arg choice="plain"><option>--help</option></arg>
114
<arg choice="plain"><option>-h</option></arg>
96
<arg choice="plain">-h</arg>
97
<arg choice="plain">--help</arg>
118
101
<command>&COMMANDNAME;</command>
119
<arg choice="plain"><option>--version</option></arg>
102
<arg choice="plain">--version</arg>
122
105
<command>&COMMANDNAME;</command>
123
<arg choice="plain"><option>--check</option></arg>
106
<arg choice="plain">--check</arg>
125
108
</refsynopsisdiv>
127
110
<refsect1 id="description">
128
111
<title>DESCRIPTION</title>
130
113
<command>&COMMANDNAME;</command> is a server daemon which
131
114
handles incoming request for passwords for a pre-defined list of
132
client host computers. For an introduction, see
133
<citerefentry><refentrytitle>intro</refentrytitle>
134
<manvolnum>8mandos</manvolnum></citerefentry>. The Mandos server
135
uses Zeroconf to announce itself on the local network, and uses
136
TLS to communicate securely with and to authenticate the
137
clients. The Mandos server uses IPv6 to allow Mandos clients to
138
use IPv6 link-local addresses, since the clients will probably
139
not have any other addresses configured (see <xref
140
linkend="overview"/>). Any authenticated client is then given
141
the stored pre-encrypted password for that specific client.
115
client host computers. The Mandos server uses Zeroconf to
116
announce itself on the local network, and uses TLS to
117
communicate securely with and to authenticate the clients. The
118
Mandos server uses IPv6 to allow Mandos clients to use IPv6
119
link-local addresses, since the clients will probably not have
120
any other addresses configured (see <xref linkend="overview"/>).
121
Any authenticated client is then given the stored pre-encrypted
122
password for that specific client.
145
127
<refsect1 id="purpose">
146
128
<title>PURPOSE</title>
148
131
The purpose of this is to enable <emphasis>remote and unattended
149
132
rebooting</emphasis> of client host computer with an
150
133
<emphasis>encrypted root file system</emphasis>. See <xref
151
134
linkend="overview"/> for details.
155
139
<refsect1 id="options">
156
140
<title>OPTIONS</title>
159
<term><option>--help</option></term>
160
<term><option>-h</option></term>
144
<term><literal>-h</literal>, <literal>--help</literal></term>
163
147
Show a help message and exit
169
<term><option>--interface</option>
170
<replaceable>NAME</replaceable></term>
171
<term><option>-i</option>
172
<replaceable>NAME</replaceable></term>
153
<term><literal>-i</literal>, <literal>--interface <replaceable>
154
IF</replaceable></literal></term>
174
156
<xi:include href="mandos-options.xml" xpointer="interface"/>
179
<term><option>--address
180
<replaceable>ADDRESS</replaceable></option></term>
182
<replaceable>ADDRESS</replaceable></option></term>
161
<term><literal>-a</literal>, <literal>--address <replaceable>
162
ADDRESS</replaceable></literal></term>
184
164
<xi:include href="mandos-options.xml" xpointer="address"/>
190
<replaceable>PORT</replaceable></option></term>
192
<replaceable>PORT</replaceable></option></term>
169
<term><literal>-p</literal>, <literal>--port <replaceable>
170
PORT</replaceable></literal></term>
194
172
<xi:include href="mandos-options.xml" xpointer="port"/>
199
<term><option>--check</option></term>
177
<term><literal>--check</literal></term>
202
180
Run the server’s self-tests. This includes any unit
209
<term><option>--debug</option></term>
187
<term><literal>--debug</literal></term>
211
189
<xi:include href="mandos-options.xml" xpointer="debug"/>
216
<term><option>--debuglevel
217
<replaceable>LEVEL</replaceable></option></term>
220
Set the debugging log level.
221
<replaceable>LEVEL</replaceable> is a string, one of
222
<quote><literal>CRITICAL</literal></quote>,
223
<quote><literal>ERROR</literal></quote>,
224
<quote><literal>WARNING</literal></quote>,
225
<quote><literal>INFO</literal></quote>, or
226
<quote><literal>DEBUG</literal></quote>, in order of
227
increasing verbosity. The default level is
228
<quote><literal>WARNING</literal></quote>.
234
<term><option>--priority <replaceable>
235
PRIORITY</replaceable></option></term>
194
<term><literal>--priority <replaceable>
195
PRIORITY</replaceable></literal></term>
237
197
<xi:include href="mandos-options.xml" xpointer="priority"/>
242
<term><option>--servicename
243
<replaceable>NAME</replaceable></option></term>
202
<term><literal>--servicename <replaceable>NAME</replaceable>
245
205
<xi:include href="mandos-options.xml"
246
206
xpointer="servicename"/>
251
<term><option>--configdir
252
<replaceable>DIRECTORY</replaceable></option></term>
211
<term><literal>--configdir <replaceable>DIR</replaceable>
255
215
Directory to search for configuration files. Default is
266
<term><option>--version</option></term>
226
<term><literal>--version</literal></term>
269
229
Prints the program version and exit.
275
<term><option>--no-dbus</option></term>
277
<xi:include href="mandos-options.xml" xpointer="dbus"/>
279
See also <xref linkend="dbus_interface"/>.
285
<term><option>--no-ipv6</option></term>
287
<xi:include href="mandos-options.xml" xpointer="ipv6"/>
292
<term><option>--no-restore</option></term>
294
<xi:include href="mandos-options.xml" xpointer="restore"/>
296
See also <xref linkend="persistent_state"/>.
302
<term><option>--statedir
303
<replaceable>DIRECTORY</replaceable></option></term>
305
<xi:include href="mandos-options.xml" xpointer="statedir"/>
310
<term><option>--socket
311
<replaceable>FD</replaceable></option></term>
313
<xi:include href="mandos-options.xml" xpointer="socket"/>
318
<term><option>--foreground</option></term>
320
<xi:include href="mandos-options.xml"
321
xpointer="foreground"/>
328
236
<refsect1 id="overview">
329
237
<title>OVERVIEW</title>
330
238
<xi:include href="overview.xml"/>
332
240
This program is the server part. It is a normal server program
333
241
and will run in a normal system environment, not in an initial
334
<acronym>RAM</acronym> disk environment.
242
RAM disk environment.
338
246
<refsect1 id="protocol">
339
247
<title>NETWORK PROTOCOL</title>
393
301
</tbody></tgroup></table>
396
304
<refsect1 id="checking">
397
305
<title>CHECKING</title>
399
307
The server will, by default, continually check that the clients
400
308
are still up. If a client has not been confirmed as being up
401
309
for some time, the client is assumed to be compromised and is no
402
longer eligible to receive the encrypted password. (Manual
403
intervention is required to re-enable a client.) The timeout,
404
extended timeout, checker program, and interval between checks
405
can be configured both globally and per client; see
406
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
310
longer eligible to receive the encrypted password. The timeout,
311
checker program, and interval between checks can be configured
312
both globally and per client; see <citerefentry>
313
<refentrytitle>mandos-clients.conf</refentrytitle>
407
314
<manvolnum>5</manvolnum></citerefentry>.
411
<refsect1 id="approval">
412
<title>APPROVAL</title>
414
The server can be configured to require manual approval for a
415
client before it is sent its secret. The delay to wait for such
416
approval and the default action (approve or deny) can be
417
configured both globally and per client; see <citerefentry>
418
<refentrytitle>mandos-clients.conf</refentrytitle>
419
<manvolnum>5</manvolnum></citerefentry>. By default all clients
420
will be approved immediately without delay.
423
This can be used to deny a client its secret if not manually
424
approved within a specified time. It can also be used to make
425
the server delay before giving a client its secret, allowing
426
optional manual denying of this specific client.
431
318
<refsect1 id="logging">
432
319
<title>LOGGING</title>
434
321
The server will send log message with various severity levels to
435
<filename class="devicefile">/dev/log</filename>. With the
322
<filename>/dev/log</filename>. With the
436
323
<option>--debug</option> option, it will log even more messages,
437
324
and also show them on the console.
441
<refsect1 id="persistent_state">
442
<title>PERSISTENT STATE</title>
444
Client settings, initially read from
445
<filename>clients.conf</filename>, are persistent across
446
restarts, and run-time changes will override settings in
447
<filename>clients.conf</filename>. However, if a setting is
448
<emphasis>changed</emphasis> (or a client added, or removed) in
449
<filename>clients.conf</filename>, this will take precedence.
453
<refsect1 id="dbus_interface">
454
<title>D-BUS INTERFACE</title>
456
The server will by default provide a D-Bus system bus interface.
457
This interface will only be accessible by the root user or a
458
Mandos-specific user, if such a user exists. For documentation
459
of the D-Bus API, see the file <filename>DBUS-API</filename>.
463
328
<refsect1 id="exit_status">
464
329
<title>EXIT STATUS</title>
647
511
compromised if they are gone for too long.
514
If a client is compromised, its downtime should be duly noted
515
by the server which would therefore declare the client
516
invalid. But if the server was ever restarted, it would
517
re-read its client list from its configuration file and again
518
regard all clients therein as valid, and hence eligible to
519
receive their passwords. Therefore, be careful when
520
restarting servers if it is suspected that a client has, in
521
fact, been compromised by parties who may now be running a
522
fake Mandos client with the keys from the non-encrypted
523
initial RAM image of the client host. What should be done in
524
that case (if restarting the server program really is
525
necessary) is to stop the server program, edit the
526
configuration file to omit any suspect clients, and restart
650
530
For more details on client-side security, see
651
<citerefentry><refentrytitle>mandos-client</refentrytitle>
531
<citerefentry><refentrytitle>password-request</refentrytitle>
652
532
<manvolnum>8mandos</manvolnum></citerefentry>.
657
537
<refsect1 id="see_also">
658
538
<title>SEE ALSO</title>
660
<citerefentry><refentrytitle>intro</refentrytitle>
661
<manvolnum>8mandos</manvolnum></citerefentry>,
662
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
663
<manvolnum>5</manvolnum></citerefentry>,
664
<citerefentry><refentrytitle>mandos.conf</refentrytitle>
665
<manvolnum>5</manvolnum></citerefentry>,
666
<citerefentry><refentrytitle>mandos-client</refentrytitle>
667
<manvolnum>8mandos</manvolnum></citerefentry>,
668
<citerefentry><refentrytitle>sh</refentrytitle>
669
<manvolnum>1</manvolnum></citerefentry>
543
<refentrytitle>password-request</refentrytitle>
544
<manvolnum>8mandos</manvolnum>
549
This is the actual program which talks to this server.
550
Note that it is normally not invoked directly, and is only
551
run in the initial RAM disk environment, and not on a
552
fully started system.
674
558
<ulink url="http://www.zeroconf.org/">Zeroconf</ulink>
709
RFC 4291: <citetitle>IP Version 6 Addressing
710
Architecture</citetitle>
593
<citation>RFC 4291: <citetitle>IP Version 6 Addressing
594
Architecture</citetitle>, section 2.5.6, Link-Local IPv6
595
Unicast Addresses</citation>
715
<term>Section 2.2: <citetitle>Text Representation of
716
Addresses</citetitle></term>
717
<listitem><para/></listitem>
720
<term>Section 2.5.5.2: <citetitle>IPv4-Mapped IPv6
721
Address</citetitle></term>
722
<listitem><para/></listitem>
725
<term>Section 2.5.6, <citetitle>Link-Local IPv6 Unicast
726
Addresses</citetitle></term>
729
The clients use IPv6 link-local addresses, which are
730
immediately usable since a link-local addresses is
731
automatically assigned to a network interfaces when it
599
The clients use IPv6 link-local addresses, which are
600
immediately usable since a link-local addresses is
601
automatically assigned to a network interfaces when it is
741
RFC 4346: <citetitle>The Transport Layer Security (TLS)
742
Protocol Version 1.1</citetitle>
608
<citation>RFC 4346: <citetitle>The Transport Layer Security
609
(TLS) Protocol Version 1.1</citetitle></citation>