/mandos/trunk : changes

» Changes to clients.conf from revision 1316

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

From Revision 1316 to 25

expand all

Rev	Summary	Authors	Date
1265	Clarify documentation and a comment about GnuTLS versions Clarify documentation and a comment about GnuTLS versions * clients.conf ([foo]/secret): In the comment for the example client's "secret" setting, clarify GnuTLS version conditions. * mandos-clients.conf.xml (OPTIONS/fingerprint, OPTIONS/key_id): Clarify required/optional status under different GnuTLS versions.	Teddy Hogeborn	1 year ago
1244	Add comment about duration syntax to default clients.conf. Add comment about duration syntax to default clients.conf. * clients.conf (timeout, interval, extended_timeout, approval_delay, approval_duration): Add comment about this being RFC 3339 syntax.	Teddy Hogeborn	2 years ago
964	Doc fix: Change some "/etc/mandos" to "/etc/keys/mandos" Doc fix: Change some "/etc/mandos" to "/etc/keys/mandos" * clients.conf: Change "/etc/mandos" to "/etc/keys/mandos" where appropriate * mandos-keygen.xml: - '' -	Teddy Hogeborn	5 years ago
962	Add support for using raw public keys in TLS (RFC 7250) Add support for using raw public keys in TLS (RFC 7250) Since GnuTLS removed support for OpenPGP keys in TLS (RFC 6091), and no other library supports it, we have to change the protocol to use something else. We choose to use "raw public keys" (RFC 7250). Since we still use OpenPGP keys to decrypt the secret password, this means that each client will have two keys: One OpenPGP key and one TLS public/private key, and the key ID of the latter key is used to identify clients instead of the fingerprint of the OpenPGP key. Note that this code is still compatible with GnuTLS before version 3.6.0 (when OpenPGP key support was removed). This commit merely adds support for using raw pulic keys instead with GnuTLS 3.6.6. or later. * DBUS-API (Signals/ClientNotFound): Change name of first parameter from "Fingerprint" to "KeyID". (Mandos Client Interface/Properties/KeyID): New. * INSTALL: Document conflict with GnuTLS 3.6.0 (which removed OpenPGP key support) up until 3.6.6, when support for raw public keys was added. Also document new dependency of client on "gnutls-bin" package (for certtool). * Makefile (run-client): Depend on TLS key files, and also pass them as arguments to client. (keydir/tls-privkey.pem, keydir/tls-pubkey.pem): New. (confdir/clients.conf): Add dependency on TLS public key. (purge-client): Add removal of TLS key files. * clients.conf ([foo]/key_id, [bar]/key_id): New. * debian/control (Source: mandos/Build-Depends): Also allow libgnutls30 (>= 3.6.6) (Package: mandos/Depends): - '' - (Package: mandos/Description): Alter description to match new design. (Package: mandos-client/Description): - '' - (Package: mandos-client/Depends): Move "gnutls-bin \| openssl" to here from "Recommends". * debian/mandos-client.README.Debian: Add --tls-privkey and --tls-pubkey options to test command. * debian/mandos-client.postinst (create_key): Renamed to "create_keys" (all callers changed), and also create TLS key. * debian/mandos-client.postrm (purge): Also remove TLS key files. * intro.xml (DESCRIPTION): Describe new dual-key design. * mandos (GnuTLS): Define different functions depending on whether support for raw public keys is detected. (Client.key_id): New attribute. (ClientDBus.KeyID_dbus_property): New method. (ProxyClient.__init__): Take new "key_id" parameter. (ClientHandler.handle): Use key IDs when using raw public keys and use fingerprints when using OpenPGP keys. (ClientHandler.peer_certificate): Also handle raw public keys. (ClientHandler.key_id): New. (MandosServer.handle_ipc): Pass key ID over the pipe IPC. Also check for key ID matches when looking up clients. (main): Default GnuTLS priority string depends on whether we are using raw public keys or not. When unpickling clients, set key_id if not set in the pickle. (main/MandosDBusService.ClientNotFound): Change name of first parameter from "Fingerprint" to "KeyID". * mandos-clients.conf.xml (OPTIONS): Document new "key_id" option. (OPTIONS/secret): Mention new key ID matchning. (EXPANSION/RUNTIME EXPANSION): Add new "key_id" option. (EXAMPLE): - '' - * mandos-ctl (tablewords, main/keywords): Add new "KeyID" property. * mandos-keygen: Create TLS key files. New "--tls-keytype" (-T) option. Alter help text to be more clear about key types. When in password mode, also output "key_id" option. * mandos-keygen.xml (SYNOPSIS): Add new "--tls-keytype" (-T) option. (DESCRIPTION): Alter to match new dual-key design. (OVERVIEW): - '' - (FILES): Add TLS key files. * mandos-options.xml (priority): Document new default priority string when using raw public keys. * mandos.xml (NETWORK PROTOCOL): Describe new protocol using key ID. (BUGS): Remove issue about checking expire times of OpenPGP keys, since TLS public keys do not have expiration times. (SECURITY/CLIENT): Alter description to match new design. (SEE ALSO/GnuTLS): - '' - (SEE ALSO): Add reference to RFC 7250, and alter description of when RFC 6091 is used. * overview.xml: Alter text to match new design. * plugin-runner.xml (EXAMPLE): Add --tls-pubkey and --tls-privkey options to mandos-client options. * plugins.d/mandos-client.c: Use raw public keys when compiling with supporting GnuTLS versions. Add new "--tls-pubkey" and "--tls-privkey" options (which do nothing if GnuTLS library does not support raw public keys). Alter text throughout to reflect new design. Only generate new DH parameters (based on size of OpenPGP key) when using OpenPGP in TLS. Default GnuTLS priority string depends on whether we are using raw public keys or not. * plugins.d/mandos-client.xml (SYNOPSIS): Add new "--tls-privkey" (-t) and "--tls-pubkey" (-T) options. (DESCRIPTION): Describe new dual-key design. (OPTIONS): Document new "--tls-privkey" (-t) and "--tls-pubkey" (-T) options. (OPTIONS/--dh-bits): No longer necessarily depends on OpenPGP key size. (FILES): Add default locations for TLS public and private key files. (EXAMPLE): Use new --tls-pubkey and --tls-privkey options. (SECURITY): Alter wording slightly to reflect new dual-key design. (SEE ALSO/GnuTLS): Alter description to match new design. (SEE ALSO): Add reference to RFC 7250, and alter description of when RFC 6091 is used.	Teddy Hogeborn	5 years ago
609	* clients.conf: Convert all time intervals to new RFC 3339 s... * clients.conf: Convert all time intervals to new RFC 3339 syntax. * mandos: All client options for time intervals now take an RFC 3339 duration. (rfc3339_duration_to_delta): New function. (string_to_delta): Try rfc3339_duration_to_delta first. * mandos-clients.conf.xml (OPTIONS/timeout): Document new format. (EXAMPLE): Update to new interval format. (SEE ALSO): Reference RFC 3339.	Teddy Hogeborn	12 years ago
524	Working persistant state Working persistant state	Björn Påhlsson	13 years ago
500	* mandos-clients.conf.xml (OPTIONS): Moved up "extended_time... * mandos-clients.conf.xml (OPTIONS): Moved up "extended_timeout" to order options alphabetically. * clients.conf: Language change in comment.	Teddy Hogeborn	13 years ago
499	* clients.conf ([DEFAULT]/timeout): Changed default value to... * clients.conf ([DEFAULT]/timeout): Changed default value to "5m". ([DEFAULT]/interval): Changed default value to "2m". ([DEFAULT]/extenden_timeout): New. ([bar]/interval): Changed to "1m".	Teddy Hogeborn	13 years ago
423	Documentation changes: Documentation changes: * DBUS-API: New file documenting the server D-Bus interface. * clients.conf: Add examples of new approval settings. * debian/mandos.docs: Added "DBUS-API". * mandos-clients.conf.xml (OPTIONS): Added "approved_by_default", "approval_delay", and "approval_duration". * mandos.xml (D-BUS INTERFACE): Refer to the "DBUS-API" file. (BUGS): Remove mention of lack of a remote query interface.	Teddy Hogeborn	14 years ago
411	More consistent terminology: Clients are no longer "invalid"... More consistent terminology: Clients are no longer "invalid" - they are "disabled". All code and documentation changed to reflect this. D=Bus API change: The "properties" argument was removed from the "ClientAdded" signal on interface "se.bsnet.fukt.Mandos". All code in both "mandos" and "mandos-monitor" changed to reflect this. * mandos: Replaced "with closing(F)" with simply "with F" in all places where F is a file object. (Client.still_valid): Removed. All callers changed to look at "Client.enabled" instead. (dbus_service_property): Check for unsupported signatures with the "byte_arrays" option. (DBusObjectWithProperties.Set): - '' - (ClientHandler.handle): Use the reverse pipe to receive the "Client.enabled" attribute instead of the now-removed "Client.still_valid()" method. (ForkingMixInWithPipe): Renamed to "ForkingMixInWithPipes" (all users changed). Now also create a reverse pipe for sending data to the child process. (ForkingMixInWithPipes.add_pipe): Now takes two pipe fd's as arguments. All callers changed. (IPv6_TCPServer.handle_ipc): Take an additional "reply_fd" argument (all callers changed). Close the reply pipe when the child data pipe is closed. New "GETATTR" IPC method; will pickle client attribute and send it over the reply pipe FD. (MandosDBusService.ClientAdded): Removed "properties" argument. All emitters changed. * mandos-clients.conf.xml (DESCRIPTION, OPTIONS): Use "enabled/disabled" terminology. * mandos-ctl: Option "--is-valid" renamed to "--is-enabled". * mandos-monitor: Enable user locale. Try to log exceptions. (MandosClientPropertyCache.__init__): Removed "properties" argument. All callers changed. (UserInterface.add_new_client): Remove "properties" argument. All callers changed. Supply "logger" argument to MandosClientWidget(). (UserInterface.add_client): New "logger" argument. All callers changed. * mandos.xml (BUGS, SECURITY/CLIENTS): Use "enabled/disabled" terminology.	Teddy Hogeborn	15 years ago
257	Change the default value of the "checker" option command to ... Change the default value of the "checker" option command to make the checker command be run-time dependent on the "host" client attribute instead of reading it only once on startup: * clients.conf (checker): Changed default commented-out value to "fping -q -- %%(host)s". * mandos (main): Changed default value for the "checker" config option to "fping -q -- %%(host)s". * mandos-clients.conf.xml (OPTIONS): Document changed default value. (EXAMPLE): Changed value of "checker". * plugins.d/password-prompt.c: Whitespace changes only.	Teddy Hogeborn	15 years ago
202	* clients.conf ([bar]/secfile): Do not imply armored format. * clients.conf ([bar]/secfile): Do not imply armored format. * debian/control: Build-Depend on pkg-config. * debian/mandos.prerm (remove): Bug fix; check for "/etc/init.d/mandos", not "/etc/init.d/ssh".	Teddy Hogeborn	16 years ago
109	* .bzrignore: New. * .bzrignore: New. * clients.conf ([foo]): Remove Radix-64 checksum. * mandos (AvahiService.rename, server_state_changed, entry_group_state_changed): Make Avahi log messages more clear that they are about Zeroconf. (fingerprint): Use plain "0" instead of "ctypes.c_uint(0)".	Teddy Hogeborn	16 years ago
94	* clients.conf ([DEFAULT]/checker): Update to new default va... * clients.conf ([DEFAULT]/checker): Update to new default value. * mandos (Client.start_checker): Bug fix: OSError, not subprocess.OSError. (main): Use "fping -q -- %(host)s" instead of "fping -q -- %%(host)s" as default value for "checker". Always redirect stdin to be from /dev/null, even if in debug mode. * mandos-clients.conf.xml (DESCRIPTION): Improved wording and refer to the EXPANSION section. (OPTIONS): Added synopsis and improved wording for "checker", "fingerprint", and "secret". Refer to the RUNTIME EXPANSION section for the "checker" option. (EXAMPLE): Update to new default value for "checker". * mandos-keygen (trap): Split lines and add "set +e".	Teddy Hogeborn	16 years ago
93	* mandos (string_to_delta): Accept a whitespace-separated se... * mandos (string_to_delta): Accept a whitespace-separated sequence of intervals and return the sum. This allows "5m 30s" to be valid. (main): Provide an empty default value for the "host" option for "clients.conf", making it no longer a required option. * mandos-clients.conf.xml: Removed <?xml-stylesheet>. (DESCRIPTION): Improved text. (DEFAULTS): Renamed to "OPTIONS". Improved text for "timeout" and "interval". (CLIENTS): Removed; content moved to "OPTIONS". (EXPANSION): New section; document %(foo)s and %%(foo)s expansion. (FILES): Moved to before "EXAMPLES". (BUGS): New section. (EXAMPLES): Renamed to "EXAMPLE", as per man-pages(7). Renamed example section "example_client" to "foo". Changed example "host" setting to a more reasonable example host name. Added additional example client "bar". * mandos-conf.xml: Removed OVERVIEW entity.	Teddy Hogeborn	16 years ago
63	Merge. Merge.	Teddy Hogeborn	16 years ago
51	* clients.conf: Better comments. * clients.conf: Better comments. (foo): Commented out and changed into a better example client. (braxen_client): Removed. (bar): New commented-out example client. * mandos: Changed all log messages to be unicode strings. (Client.fqdn): Renamed to "host". All users and documentation changed. (main): Exit immediately if no clients are defined. * mandos.conf: Better comments.	Teddy Hogeborn	16 years ago
50	* Makefile: Do DocBook manual conversion in a better way. * Makefile: Do DocBook manual conversion in a better way. * mandos (main): Write a PID file.	Teddy Hogeborn	16 years ago
28	* server.conf: New file. * server.conf: New file. * mandos-clients.conf: Renamed to clients.conf. * Makefile (FORTIFY): New. (CFLAGS): Include $(FORTIFY). * plugins.d/mandosclient.c (main): New "if_index" variable. Bug fix: check if interface exists. New "--connect" option. * server.py (serviceInterface): Removed; replaced by "AvahiService.interface". All users changed. (AvahiError, AvahiServiceError, AvahiGroupError): New exception classes. (AvahiService): New class. (serviceName): Removed; replaced by "AvahiService.name". All users changed. (serviceType): Removed; replaced by "AvahiService.type". All users changed. (servicePort): Removed; replaced by "AvahiService.port". All users changed. (serviceTXT): Removed; replaced by "AvahiService.TXT". All users changed. (domain): Removed; replaced by "AvahiService.domain". All users changed. (host): Removed; replaced by "AvahiService.host". All users changed. (rename_count): Removed; replaced by "AvahiService.rename_count" and "AvahiService.max_renames". All users changed. (Client.__init__): If no secret or secfile, raise TypeError instead of RuntimeError. (Client.last_seen): Renamed to "Client.last_checked_ok". All users changed. (Client.stop, Client.stop_checker): Use "getattr" with default value instead of "hasattr". (Client.still_valid): Removed "now" argument. (Client.handle): Separate the "no client found" and "client invalid" cases for clearer code. (IPv6_TCPServer.__init__): "options" argument replaced by "settings". All callers changed. (IPv6_TCPServer.options): Replaced by "IPv6_TCPServer.settings". All users changed. (IPv6_TCPServer.server_bind): Use getattr instead of hasattr. (add_service): Removed; replaced by "AvahiService.add". All callers changed. (remove_service): Removed; replaced by "AvahiService.remove". All callers changed. (entry_group_state_changed): On entry group collision, call the new AvahiService.rename method. Raise AvahiGroupError on group error. (if_nametoindex): Use ctypes.utils.find_library to locate the C library. Cache the result. Loop on EINTR. (daemon): Use os.path.devnull to locate "/dev/null". (killme): Removed. All callers changed to do "sys.exit()" instead, except where stated otherwise. (main): Removed "exitstatus". Removed all default values from all non-bool options. New option "--configdir". New variables "server_defaults" and "server_settings", read from "%(configdir)s/server.conf". Let any supplied command line options override server settings. Variable "defaults" renamed to "client_defaults", which is read from "clients.conf" instead of "mandos-clients.conf". New global AvahiService object "service" replaces old global variables. Catch AvahiError and exit with error if caught.	Teddy Hogeborn	16 years ago
25	* mandos-clients.conf ([DEFAULT]): New section. * mandos-clients.conf ([DEFAULT]): New section. * plugins.d/mandosclient.c (start_mandos_communication): Only print if debugging. Print server name. Bug fix: Loop until suc- cess. * server.py (serverName): Set via option, not globally. (Client.__init__): Removed argument "options". Require "timeout" and "interval" arguments. (tcp_handler.handle): Set "priority" from self.server.options. (main): Removed "--timeout" and "--interval" options. New options "--priority" and "--servicename". Add defaults for "timeout" and "interval". Set "serviceName" from options. Do not pass "options" to "Client()".	Teddy Hogeborn	16 years ago

Older »