/mandos/trunk : changes

» Changes from revision 1282

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

From Revision 758 to 739

expand all

Rev	Summary	Authors	Date
758	plugin-runner.xml (EXAMPLE): Use the /usr/lib/<arch> directo... plugin-runner.xml (EXAMPLE): Use the /usr/lib/<arch> directory. Also explain used options in order.	Teddy Hogeborn	10 years ago
757	mandos.service ([Service]/KillMode): Changed to "mixed". mandos.service ([Service]/KillMode): Changed to "mixed".	Teddy Hogeborn	10 years ago
756	Merge change to use multiprocessing module to run checkers. Merge change to use multiprocessing module to run checkers.	Teddy Hogeborn	10 years ago
755	mandos: More Python 3 fixes. mandos: More Python 3 fixes. mandos (MandosServer/handle_ipc): Do not use callable().	Teddy Hogeborn	10 years ago
754	mandos: More Python 3 fixes. mandos: More Python 3 fixes. mandos (alternate_dbus_interfaces/wrapper): If Python 3, then do not use black magic, and use correct function attributes.	Teddy Hogeborn	10 years ago
753	mandos-ctl: Generate better messages in exceptions. mandos-ctl: Generate better messages in exceptions. mandos (rfc3339_duration_to_delta): Remove dead code. Adjust white space. mandos-ctl (rfc3339_duration_to_delta): Do minor formatting and whitespace adjustments, and Generate better message in exception. (string_to_delta): Adjust quote character in doc string.	Teddy Hogeborn	10 years ago
752	mandos: Generate better messages in exceptions. mandos: Generate better messages in exceptions. mandos (ProxyClient.__init__): Include fingerprint in KeyError(). (rfc3339_duration_to_delta): Include duration in ValueError().	Teddy Hogeborn	10 years ago
751	mandos: Use codecs.open() and print() for PID file. mandos: Use codecs.open() and print() for PID file. Use more Pythonic code, closer to the Python 3 style.	Teddy Hogeborn	10 years ago
750	mandos: Disable D-Bus if any DBusException is raised when co... mandos: Disable D-Bus if any DBusException is raised when connecting.	Teddy Hogeborn	10 years ago
749	mandos: Some more minor changes to prepare for Python 3. mandos: Some more minor changes to prepare for Python 3.	Teddy Hogeborn	10 years ago
748	mandos-keygen: Update copyright year. mandos-keygen: Update copyright year.	Teddy Hogeborn	10 years ago
747	mandos-keygen: Bug fix: Only use one SSH key from ssh-keysca... mandos-keygen: Bug fix: Only use one SSH key from ssh-keyscan If ssh-keyscan found keys of more than one type, the generated output would be incorrect. Restrict the output to one type of key.	Teddy Hogeborn	10 years ago
746	mandos: Do minor formatting and whitespace adjustments. mandos: Do minor formatting and whitespace adjustments.	Teddy Hogeborn	10 years ago
745	mandos-ctl: Do minor formatting and whitespace adjustments. mandos-ctl: Do minor formatting and whitespace adjustments.	Teddy Hogeborn	10 years ago
744	Add "!RSA" also to examples/documentation. Add "!RSA" also to examples/documentation. * mandos.conf (priority): Add "!RSA" to default commented-out value. * mandos.conf.xml (EXAMPLE): Add "!RSA" to example priority setting.	Teddy Hogeborn	10 years ago
743	Automatically determine the number of DH bits in the TLS han... Automatically determine the number of DH bits in the TLS handshake. Instead of using a default value of 1024, check the OpenPGP key and determine an appropriate number of DH bits to use, (using GnuTLS functions made for this). Document this new default behavior. * plugins.d/mandos-client.c (safe_string): New function. (init_gnutls_global): If not specified, determine the number of DH bits to use, based on the OpenPGP key. * plugins.d/mandos-client.xml (OPTIONS): Document this new default of the --dh-bits option. Thanks to Andreas Fischer <af@bantuX.org> for reporting this issue.	Teddy Hogeborn	10 years ago
742	Add ":!RSA" to GnuTLS priority string, to disallow non-DHE k... Add ":!RSA" to GnuTLS priority string, to disallow non-DHE kx. If Mandos was somehow made to use a non-ephemeral Diffie-Hellman key exchange algorithm in the TLS handshake, any saved network traffic could then be decrypted later if the Mandos client key was obtained. By default, Mandos uses ephemeral DH key exchanges which does not have this problem, but a non-ephemeral key exchange algorithm was still enabled by default. The simplest solution is to simply turn that off, which ensures that Mandos will always use ephemeral DH key exchanges. There is a "PFS" priority string specifier, but we can't use it because: 1. Security-wise, it is a mix between "NORMAL" and "SECURE128" - it enables a lot more algorithms than "SECURE256". 2. It is only available since GnuTLS 3.2.4. Thanks to Andreas Fischer <af@bantuX.org> for reporting this issue.	Teddy Hogeborn	10 years ago
741	mandos.xml (SEE ALSO): Update links. mandos.xml (SEE ALSO): Update links. Update link to GnuPG home page, change reference from TLS 1.1 to TLS 1.2, and change to latest RFC for using OpenPGP keys with TLS (and use its correct title).	Teddy Hogeborn	10 years ago
740	mandos-keygen: Fix some stylistic quoting issues. mandos-keygen: Fix some stylistic quoting issues.	Teddy Hogeborn	10 years ago
739	mandos (Client.config_parser): Move comment to correct place... mandos (Client.config_parser): Move comment to correct place. A comment was left behind when the code was rewritten; move the comment to the appropriate place.	Teddy Hogeborn	10 years ago