/mandos/trunk

This NEWS file records noteworthy changes, very tersely.

See the manual for detailed information.

Version 1.7.20 (2018-08-19)

* Client

** Fix: Adapt to the Debian cryptsetup package 2.0.3 or later.

   Important: in that version or later, the plugins "askpass-fifo",

   "password-prompt", and "plymouth" will no longer be run, since they

   would conflict with what cryptsetup is doing.  Other plugins, such

   as mandos-client and any user-supplied plugins, will still run.

** Better error message if failing to decrypt secret data

** Check for (and report) any key import failure from GPGME

** Better error message if self-signature verification fails

** Set system clock if not set; required by GnuPG for key import

** When debugging plugin-runner, it will now show starting plugins

Version 1.7.19 (2018-02-22)

* Client

** Do not print "unlink(...): No such file or directory".

** Bug fixes: Fix file descriptor leaks.

** Bug fix: Don't use leak sanitizer with leaking libraries.

Version 1.7.18 (2018-02-12)

* Client

** Bug fix: Revert faulty fix for a nonexistent bug in the

   plugin-runner

Version 1.7.17 (2018-02-10)

* Client

** Bug fix: Fix a memory leak in the plugin-runner

** Bug fix: Fix memory leaks in the plymouth plugin

Version 1.7.16 (2017-08-20)

* Client

** Bug fix: ignore "resumedev" entries in initramfs' cryptroot file

** Bug fix in plymouth plugin: fix memory leak, avoid warning output

Version 1.7.15 (2017-02-23)

* Server

** Bug fix: Respect the mandos.conf "zeroconf" and "restore" options

* Client

** Bug fix in mandos-keygen: Handle backslashes in passphrases

Version 1.7.14 (2017-01-25)

* Server

** Use "Requisite" instead of "RequisiteOverridable" in systemd

   service file.

Version 1.7.13 (2016-10-08)

* Client

** Minor bug fix: Don't ask for passphrase or fail when generating

   keys using GnuPG 2.1 in a chrooted environment.

Version 1.7.12 (2016-10-05)

* Client

** Bug fix: Don't crash after exit() when using DH parameters file

Version 1.7.11 (2016-10-01)

* Client

** Security fix: Don't compile with AddressSanitizer

* Server

** Bug fix: Find GnuTLS library when gnutls28-dev is not installed

** Bug fix: Include "Expires" and "Last Checker Status" in mandos-ctl

   verbose output

** New option for mandos-ctl: --dump-json

Version 1.7.10 (2016-06-23)

* Client

** Security fix: restrict permissions of /etc/mandos/plugin-helpers

* Server

** Bug fix: Make the --interface flag work with Python 2.7 when "cc"

   is not installed

Version 1.7.9 (2016-06-22)

* Client

** Do not include intro(8mandos) man page

Version 1.7.8 (2016-06-21)

* Client

** Include intro(8mandos) man page

** mandos-keygen: Use ECDSA SSH keys by default

** Bug fix: Work with GnuPG 2 when booting (Debian bug #819982)

   by copying /usr/bin/gpg-agent into initramfs

* Server

** Bug fix: Work with GnuPG 2 (don't use --no-use-agent option)

** Bug fix: Make the --interface option work when using Python 2.7

   by trying harder to find SO_BINDTODEVICE

Version 1.7.7 (2016-03-19)

* Client

** Fix bug in Plymouth client, broken since 1.7.2

Version 1.7.6 (2016-03-13)

* Server

** Fix bug where stopping server would time out

** Make server runnable with Python 3

Version 1.7.5 (2016-03-08)

* Server

** Fix security restrictions in systemd service file.

** Work around bug where stopping server would time out

Version 1.7.4 (2016-03-05)

* Client

** Bug fix: Tolerate errors from configure_networking (Debian Bug

   #816513)

** Compilation: Only use sanitizing options which work with the

   compiler used when building.  This should fix compilation with GCC

   4.9 on mips, mipsel, and s390x.

* Server

** Add extra security restrictions in systemd service file.

Version 1.7.3 (2016-02-29)

* Client

** Bug fix: Remove new type of keyring directory user by GnuPG 2.1.

** Bug fix: Remove "nonnull" attribute from a function argument, which

   would otherwise generate a spurious runtime warning.

Version 1.7.2 (2016-02-28)

* Server

** Stop using python-gnutls library; it was not updated to GnuTLS 3.3.

** Bug fix: Only send D-Bus signal ClientRemoved if using D-Bus.

** Use GnuPG 2 if available.

* Client

** Compile with various sanitizing flags.

Version 1.7.1 (2015-10-24)

* Client

** Bug fix: Can now really find Mandos server even if the server has

   an IPv6 address on a network other than the one which the Mandos

   server is on.

Version 1.7.0 (2015-08-10)

* Server

** Bug fix: Handle local Zeroconf service name collisions better.

** Bug fix: Finally fix "ERROR: Child process vanished" bug.

** Bug fix: Fix systemd service file to start server correctly.

** Bug fix: Be compatible with old 2048-bit DSA keys.

** The D-Bus API now provides the standard D-Bus ObjectManager

   interface, and deprecates older functionality.  See the DBUS-API

   file for the currently recommended API.  Note: the original API

   still works, but is deprecated.

* Client

** Can now find Mandos server even if the server has an IPv6 address

   on a network without IPv6 Router Advertisment (like if the Mandos

   client itself is the router, or there is an IPv6 router advertising

   a network other than the one which the Mandos server is on.)

** Use a better value than 1024 for the default number of DH bits.

   This better value is either provided by a DH parameters file (see

   below) or an appropriate number of DH bits is determined based on

   the PGP key.

** Bug fix: mandos-keygen now generates correct output for the

   "Checker" variable even if the SSH server on the Mandos client has

   multiple SSH key types.

** Can now use pre-generated Diffie-Hellman parameters from a file.

Version 1.6.9 (2014-10-05)

* Server

** Changed to emit standard D-Bus signal when D-Bus properties change.

   (The old signal is still emitted too, but marked as deprecated.)

Version 1.6.8 (2014-08-06)

* Client

** Bug fix: mandos-keygen now generates working SSH checker commands.

* Server

** Bug fix: "mandos-monitor" now really redraws screen on Ctrl-L.

** Now requires Python 2.7.

Version 1.6.7 (2014-07-17)

* Client

** Bug fix: Now compatible with GPGME 1.5.0.

** Bug fix: Fixed minor memory leaks.

* Server

** "mandos-monitor" now has verbose logging, toggleable with "v".

Version 1.6.6 (2014-07-13)

* Client

** If client host has an SSH server, "mandos-keygen --password" now

   outputs "checker" option which uses "ssh-keyscan"; this is more

   secure than the default "fping" checker.

** Bug fix: allow "." in network hook names, to match documentation.

** Better error messages.

* Server

** New --no-zeroconf option.

** Bug fix: Fix --servicename option, broken since 1.6.4.

** Bug fix: Fix --socket option work for --socket=0.

Version 1.6.5 (2014-05-11)

* Client

** Work around bug in GnuPG <http://bugs.g10code.com/gnupg/issue1622>

** Give better error messages when run without sufficient privileges

** Only warn if workaround for Debian bug #633582 was necessary and

   failed, not if it failed and was unnecessary.

Version 1.6.4 (2014-02-16)

* Server

** Very minor fix to self-test code.

Version 1.6.3 (2014-01-21)

* Server

** Add systemd support.

** For PID file, fall back to /var/run if /run does not exist.

* Client

** Moved files from /usr/lib/mandos to whatever the architecture

   specifies, like /usr/lib/x86_64-linux-gnu/mandos or

   /usr/lib64/mandos.

Version 1.6.2 (2013-10-24)

* Server

** PID file moved from /var/run to /run.

** Bug fix: Handle long secrets when saving client state.

** Bug fix: Use more magic in the GnuTLS priority string to handle

   both old DSA/ELG 2048-bit keys and new RSA/RSA 4096-bit keys.

* Client

** mandos-keygen: Bug fix: now generate RSA keys which GnuTLS can use.

   		  Bug fix: Output passphrase prompts even when

   		  redirecting standard output.

Version 1.6.1 (2013-10-13)

* Server

** All client options for time intervals now also take an RFC 3339

   duration.  The same for all options to mandos-ctl.

** Bug fix: Handle fast checkers (like ":") correctly.

** Bug fix: Don't print output from checkers when running in

   foreground.

** Bug fix: Do not fail when client is removed from clients.conf but

   saved settings remain.

** Bug fix: mandos-monitor now displays standout (reverse video) again

   using new version of Urwid.

** Bug fix: Make boolean options work from the config file again.

** Bug fix: Make --no-ipv6 work again.

** New default priority string to be slightly more compatible with

   older versions of GnuTLS.

* Client

** Bug fix: Fix bashism in mandos-keygen.

** Default key and subkey types are now RSA and RSA, respectively.

   Also, new default key size is 4096 bits.

Version 1.6.0 (2012-06-18)

* Server

** Takes new --foreground option

** Init script supports new "status" action.

* Client

** Now uses all interfaces by default; the --interface option can

   still be used to restrict it, and the argument to --interface (as

   well as the $DEVICE environment variable for the network hooks) is

   now a comma-separated list of interfaces to use.

Version 1.5.5 (2012-06-01)

* Server

** Server takes new --socket option

Version 1.5.4 (2012-05-20)

* Server

** Bug fix: Regression fix: Make non-zero approval timeout values work.

** Bug fix: Regression fix: Allow changing the Timeout D-Bus property.

** Fall back to not bind to an interface if an invalid interface name

   is given.

** Removed support for undocumented feature of using plain "%%s" in

   "checker" client option.

** Old D-Bus interface are now marked as deprecated.

** mandos-monitor: Bug fix: show approval timers correctly.

** mandos-ctl: Show "Extended Timeout" correctly, not as milliseconds.

Version 1.5.3 (2012-01-15)

* Server

** Add D-Bus property se.recompile.Client.LastCheckerStatus and use it

   in mandos-monitor.

* Client

** Fix bugs in the example "bridge" network hook.

Version 1.5.2 (2012-01-08)

* Server

** Removed D-Bus signal se.recompile.Mandos.NewRequest() added in

   1.5.0.  It was buggy and was of questionable utility.

Version 1.5.1 (2012-01-01)

* Server

** Include intro(8mandos) manual page, missing since migration from

   README file in version 1.4.0.

Version 1.5.0 (2012-01-01)

* Client

** Network hooks.  The Mandos client can now run custom scripts to take

   up a network interface before the client is run.  Three example

   scripts are provided: "wireless", "openvpn", and "bridge".

   To facilitate this, the client now prefers network interfaces which

   are up (if any) over all other interfaces.

* Server

** Persistent state.  Client state is now saved between server

   restarts.

** clients.conf file can now contain "enabled" setting for clients.

** Bug fix: Fix rare crash bug.

** Bug fix: Send corrent D-Bus type in PropertyChanged for

   "ApprovalDelay", "ApprovalDuration", "Timeout", and

   "ExtendedTimeout".

** mandos-ctl: Bare numbers as arguments are taken to be milliseconds.

** Bug fix: mandos-ctl --secret option now works.

** New D-Bus signal: se.recompile.Mandos.NewRequest(s).

Version 1.4.1 (2011-10-15)

* Server

** Make D-Bus properties settable again, and handle checkers

   for disabled clients correctly.

* Miscellaneous fixes to "pedantic" Lintian warnings

Version 1.4.0 (2011-10-09)

* README file migrated to manual page intro(8mandos).

* Client:

** Fixed warning about "rmdir: Directory not empty".

* Server:

** Default values changed: timeout 5 minutes, interval 2 minutes.

** Clients gets an expiration extension when receiving a password,

   controlled by new "extended_timeout" setting.

** New domain name: "fukt.bsnet.se" changes to "recompile.se".  This

   also affects the D-Bus bus and interface names (old names still

   work).  Users should start using the new names immediately.

** New D-Bus Client object properties "Expires" and "ExtendedTimeout";

   see DBUS-API for details.

Version 1.3.1 (2011-07-27)

* Client:

** Client now retries all Mandos servers periodically.

** Work around Debian bug #633582 - fixes "Permission denied" problem.

Version 1.3.0 (2011-03-08)

* Server:

** Updated for Python 2.6.

* Client:

** Bug fix: Make the password-prompt plugin not conflict with

   Plymouth.

** Bug fix: Bug fix: update initramfs also when purging package.

Version 1.2.3 (2010-10-11)

* Server:

** Bug fix: Expose D-Bus API also in non-debug mode.

Version 1.2.2 (2010-10-07)

* Client:

** splashy: Minor fix to compile with non-Linux kernels.

Version 1.2.1 (2010-10-02)

* Server:

** mandos-monitor(8): Documentation bug fix: Key for removing client

   is "R", not "r".

Version 1.2 (2010-09-28)

* Client:

** New "plymouth" plugin to ask for a password using the Plymouth

   graphical boot system.

** The Mandos client now automatically chooses a network interface if

   the DEVICE setting in /etc/initramfs-tools/initramfs.conf is set to

   the empty string.  This is also the new default instead of "eth0".

** The Mandos client --connect option now loops indefinitely until a

   password is received from the specified server.

** Bug fix: Quote directory correctly in mandos-keygen with --password

** Bug fix: don't use "echo -e" in mandos-keygen; unsupported by dash.

* Server:

** Terminology change: clients are now "ENABLED" or "DISABLED", not

   "valid" or "invalid".

** New D-Bus API; see the file "DBUS-API".

** New control utilities using the new D-Bus API:

   + mandos-ctl		       A command-line based utility

   + mandos-monitor	       A text-based GUI interface

** New feature: manual interactive approval or denying of clients on a

   case-by-case basis.

** New --debuglevel option to control logging

** Will not write PID file if --debug is passed

** Bug fix: Avoid race conditions with short "interval" values or

   fast checkers.

** Bug fix: Don't try to bind to a network interface when none is

   specified

Version 1.0.14 (2009-10-25)

Enable building without -pie and -fPIE if BROKEN_PIE is set.

Version 1.0.13 (2009-10-22)

* Client

** Security bug fix: If Mandos server is also installed, do not copy

   its config files (with encrypted passwords) into the initrd.img-*

   files.

Version 1.0.12 (2009-09-17)

* Client

** Bug fix: Allow network interface renaming by "udev" by taking down

   the network interface after using it.

** Bug fix: User-supplied plugins are now installed correctly.

** Bug fix: If usplash was used but the password was instead provided

   by the Mandos server, the usplash daemon used to ignore the first

   command passed to it.  This has been fixed.

** Bug fix: Make the "--userid" and "--groupid" options in

   "plugin-runner.conf" work.

* Server

** Bug fix: Fix the LSB header in the init.d script to make dependency

   based booting work.

** A client receiving its password now also counts as if a checker was

   run successfully (i.e. the timeout timer is reset).

Version 1.0.11 (2009-05-23)

* Client

** Bug fix: Use "pkg-config" instead of old "libgnutls-config".

Version 1.0.10 (2009-05-17)

* Client

** Security bug fix: Fix permissions on initrd.img-*.bak files when

   upgrading from older versions.

Version 1.0.9 (2009-05-17)

* Client

** Security bug fix: Fix permissions on initrd.img file when

   installing new linux-image-* packages calling mkinitramfs-kpkg (all

   version lower than 2.6.28-1-* does this).

Version 1.0.8 (2009-02-25)

* Client

** Bug fix: Fix missing quote characters in initramfs-tools-hook.

Version 1.0.7 (2009-02-24)

* Client

** Bug fix: Do not depend on GNU awk.

Version 1.0.6 (2009-02-13)

* Server

** Fix bug where server would stop responding, with a zombie checker

** Support for disabling IPv6 (only for advanced users)

** Fix bug which made server not change group ID

* Client

** Bug fix: Fix permission for /lib64 (on relevant architechtures).

** Add support for IPv4 addresses.

** Add support in mandos-client for not bringing up a network

   interface by specifying an empty string to "--interface".

** Make password prompt on boot not be mangled by kernel log messages

   about network interface.

** Get network interface from initramfs.conf and/or from kernel

   command line.

** If set by "ip=" kernel command line, configure network on boot.

** Support connecting directly using "mandos=connect" kernel command.

   line option, provided network is configured using "ip=".

** Fix bug which made plugin-runner and mandos-client not change group

   ID.

** Fix bug where the "--options-for" option of plugin-runner would

   truncate the value at the first colon character.

** Fix bug where plugin-runner would not go to fallback if all plugins

   failed.

** Fix bug where mandos-client would not clean temporary directory on

   a signal or on certain file systems.

** Bug fix: remove bashism in /bin/sh script "mandos-keygen".

Version 1.0.5 (2009-01-17)

* Client

** Fix small memory leak in plugin-runner.

Version 1.0.4 (2009-01-15)

* Server

** Only find matched user/group pairs when searching for suitable

   nonprivileged user/group to switch to.

* Client

** New kernel parameter "mandos=off" makes client not run at boot.

** Fix linking errors and compilation warnings on AMD64.

** Parse numbers in command line options better.

** The splashy and usplash plugins are more robust while traversing

   /proc, and will not abort if a process suddenly disappears.

Version 1.0.3 (2009-01-06)

* Server

** Now tries to change to user and group "_mandos" before falling back

   to trying the old values "mandos", "nobody:nogroup", and "65534".

** Now does not abort on startup even if no clients are defined in

   clients.conf.

* Client

** Plugins named "*.dpkg-bak" are now ignored.

** Hopefully fixed compilation failure on some architectures where the

   C compiler does not recognize the "-z" option as a linker option.

Version 1.0.2 (2008-10-17)

* mandos-keygen now signs the encrypted key blobs.  This signature is

  not currently verified by mandos-client, but this may change in the

  future.

Version 1.0.1 (2008-10-07)

* Server

** Expand environment variables and ~user in clients.conf's "secfile"

   The "secfile" option in /etc/mandos/clients.conf now expands

   "~user/foo" and "$ENVVAR" strings.

* Client (plugin-runner, plugins, etc.)

** Manual pages for the usplash, splashy, and askpass-fifo plugins.

   All plugins now have man pages.

** More secure compilation and linking flags.

   All programs are now compiled with "-fstack-protector-all -fPIE

   -pie", and linked using "-z relro -pie" for additional security.

* There is now a "NEWS" file (this one), giving a history of

  noteworthy changes.