=== modified file 'Makefile' --- Makefile 2008-09-05 18:19:52 +0000 +++ Makefile 2008-09-04 21:42:02 +0000 @@ -17,8 +17,6 @@ PREFIX=$(DESTDIR)/usr # CONFDIR=/usr/local/lib/mandos CONFDIR=$(DESTDIR)/etc/mandos -# KEYDIR=/usr/local/lib/mandos/keys -KEYDIR=$(DESTDIR)/etc/keys/mandos # MANDIR=/usr/local/man MANDIR=$(DESTDIR)/usr/share/man @@ -123,26 +121,22 @@ # Used by run-server confdir/mandos.conf: mandos.conf install --directory confdir - install --mode=u=rw,go=r $^ $@ + install --mode=0644 $^ $@ confdir/clients.conf: clients.conf keydir/seckey.txt install --directory confdir - install --mode=u=rw,g=r $< $@ + install --mode=0640 $< $@ # Add a client password ./mandos-keygen --dir keydir --password >> $@ install: install-server install-client install-server: doc - install --directory $(CONFDIR) $(MANDIR)/man5 \ + install --directory --parents $(CONFDIR) $(MANDIR)/man5 \ $(MANDIR)/man8 - install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos - install --mode=u=rw,go=r --target-directory=$(CONFDIR) \ - mandos.conf - install --mode=u=rw,g=r --target-directory=$(CONFDIR) \ + install --mode=0755 mandos $(PREFIX)/sbin/mandos + install --mode=0644 --target-directory=$(CONFDIR) mandos.conf + install --mode=0640 --target-directory=$(CONFDIR) \ clients.conf - install --mode=u=rwx,go=rx init.d-mandos /etc/init.d/mandos - install --mode=u=rw,go=r default-mandos /etc/default/mandos - update-rc.d mandos defaults gzip --best --to-stdout mandos.8 \ > $(MANDIR)/man8/mandos.8.gz gzip --best --to-stdout mandos.conf.5 \ @@ -151,35 +145,26 @@ > $(MANDIR)/man5/mandos-clients.conf.5.gz install-client: all doc /usr/share/initramfs-tools/hooks/. - install --directory $(PREFIX)/lib/mandos $(CONFDIR) \ - $(MANDIR)/man8 - install --directory --mode=u=rwx $(KEYDIR) - install --directory --mode=u=rwx \ - $(PREFIX)/lib/mandos/plugins.d - if [ "$(CONFDIR)/plugins.d" \ - != "$(PREFIX)/lib/mandos/plugins.d" ]; then \ - install --directory "$(CONFDIR)/plugins.d"; \ - fi - install --mode=u=rwx,go=rx \ - --target-directory=$(PREFIX)/lib/mandos plugin-runner - install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \ + install --directory --parents $(PREFIX)/lib/mandos \ + $(CONFDIR) $(MANDIR)/man8 + install --directory --mode=0700 $(PREFIX)/lib/mandos/plugins.d + chmod u=rwx,g=,o= $(PREFIX)/lib/mandos/plugins.d + install --mode=0755 --target-directory=$(PREFIX)/lib/mandos \ + plugin-runner + install --mode=0755 --target-directory=$(PREFIX)/sbin \ mandos-keygen - install --mode=u=rwx,go=rx \ + install --mode=0755 \ --target-directory=$(PREFIX)/lib/mandos/plugins.d \ plugins.d/password-prompt - install --mode=u=rwxs,go=rx \ + install --mode=4755 \ --target-directory=$(PREFIX)/lib/mandos/plugins.d \ plugins.d/password-request - install --mode=u=rwx,go=rx \ - --target-directory=$(PREFIX)/lib/mandos/plugins.d \ - plugins.d/usplash install initramfs-tools-hook \ /usr/share/initramfs-tools/hooks/mandos install initramfs-tools-hook-conf \ /usr/share/initramfs-tools/conf-hooks.d/mandos install initramfs-tools-script \ /usr/share/initramfs-tools/scripts/local-top/mandos - install --mode=u=rw,go=r plugin-runner.conf $(CONFDIR) gzip --best --to-stdout mandos-keygen.8 \ > $(MANDIR)/man8/mandos-keygen.8.gz gzip --best --to-stdout plugin-runner.8mandos \ @@ -188,18 +173,16 @@ > $(MANDIR)/man8/password-prompt.8mandos.gz gzip --best --to-stdout plugins.d/password-request.8mandos \ > $(MANDIR)/man8/password-request.8mandos.gz - -$(PREFIX)/sbin/mandos-keygen --dir "$(KEYDIR)" + -$(PREFIX)/sbin/mandos-keygen update-initramfs -k all -u - echo "Now run mandos-keygen --password --dir $(KEYDIR)" uninstall: uninstall-server uninstall-client -uninstall-server: +uninstall-server: $(PREFIX)/sbin/mandos -rm --force $(PREFIX)/sbin/mandos \ $(MANDIR)/man8/mandos.8.gz \ $(MANDIR)/man5/mandos.conf.5.gz \ $(MANDIR)/man5/mandos-clients.conf.5.gz - update-rc.d -f mandos remove -rmdir $(CONFDIR) uninstall-client: @@ -224,12 +207,9 @@ purge: purge-server purge-client purge-server: uninstall-server - -rm --force $(CONFDIR)/mandos.conf $(CONFDIR)/clients.conf \ - /etc/default/mandos /etc/init.d/mandos + -rm --force $(CONFDIR)/mandos.conf $(CONFDIR)/clients.conf -rmdir $(CONFDIR) purge-client: uninstall-client - -shred --remove $(KEYDIR)/seckey.txt - -rm --force $(CONFDIR)/plugin-runner.conf \ - $(KEYDIR)/pubkey.txt $(KEYDIR)/seckey.txt - -rmdir $(KEYDIR) $(CONFDIR)/plugins.d $(CONFDIR) + -rm --force $(CONFDIR)/seckey.txt $(CONFDIR)/pubkey.txt + -rmdir $(CONFDIR) $(CONFDIR)/plugins.d === modified file 'README' --- README 2008-09-05 07:11:24 +0000 +++ README 2008-09-04 12:38:35 +0000 @@ -77,10 +77,10 @@ not likely. If someone does that, the whole system *will* lock itself up completely, since Mandos servers are no longer running. - For sophisticated attackers who *could* do the clever thing, *and* - had physical access to the server for enough time, it would be - simpler to get a key for an encrypted file system by using hardware - memory scanners and reading it right off the memory bus. + For sophisticated attackers who *could* do such a thing, *and* had + physical access to the server for enough time, it would be simpler + to get a key for an encrypted file system by using hardware memory + scanners and reading it right off the memory bus. ** Replay attacks? Nope, the network stuff is all done over TLS, which provides === modified file 'TODO' --- TODO 2008-09-05 07:11:24 +0000 +++ TODO 2008-09-04 07:30:58 +0000 @@ -50,6 +50,8 @@ This seems to use some kind of "trigger" system [[file:/usr/share/doc/dpkg/triggers.txt.gz]] dpkg-trigger(1), deb-triggers(5) +*** Keydir move: /etc/mandos -> /etc/keys/mandos + Must create in preinst if not pre-depending on cryptsetup *** mandos-keygen **** "--passfile" option Using the "secfile" option instead of "secret" @@ -58,9 +60,6 @@ ** Server-side *** [#A] Create mandos user and group for server *** [#A] Create /var/run/mandos directory with perm and ownership -*** [#A] install rc.d script and do update-rc.d - between config files and man pages - * [#A] Package ** /usr/share/initramfs-tools/hooks/mandos === removed file 'default-mandos' --- default-mandos 2008-09-05 08:38:30 +0000 +++ default-mandos 1970-01-01 00:00:00 +0000 @@ -1,4 +0,0 @@ -# Directory where configuration files are located. Default is -# "/etc/mandos". -# -#CONFIGDIR=/etc/mandos === removed file 'init.d-mandos' --- init.d-mandos 2008-09-05 16:24:33 +0000 +++ init.d-mandos 1970-01-01 00:00:00 +0000 @@ -1,159 +0,0 @@ -#! /bin/sh -### BEGIN INIT INFO -# Provides: mandos -# Required-Start: $remote_fs -# Required-Stop: $remote_fs -# Default-Start: 2 3 4 5 -# Default-Stop: 0 1 6 -# Short-Description: Mandos server -# Description: Gives encrypted passwords to Mandos clients -### END INIT INFO - -# Author: Teddy Hogeborn -# Author: Björn Påhlsson -# -# Please remove the "Author" lines above and replace them -# with your own name if you copy and modify this script. - -# Do NOT "set -e" - -# PATH should only include /usr/* if it runs after the mountnfs.sh script -PATH=/sbin:/usr/sbin:/bin:/usr/bin -DESC="Mandos root file system password server" -NAME=mandos -DAEMON=/usr/sbin/$NAME -DAEMON_ARGS="" -PIDFILE=/var/run/$NAME.pid -SCRIPTNAME=/etc/init.d/$NAME - -# Exit if the package is not installed -[ -x "$DAEMON" ] || exit 0 - -# Read configuration variable file if it is present -[ -r /etc/default/$NAME ] && . /etc/default/$NAME - -if [ -n "$CONFIGDIR" ]; then - DAEMON_ARGS="$DAEMON_ARGS --configdir $CONFIGDIR" -fi - -# Load the VERBOSE setting and other rcS variables -. /lib/init/vars.sh - -# Define LSB log_* functions. -# Depend on lsb-base (>= 3.0-6) to ensure that this file is present. -. /lib/lsb/init-functions - -# -# Function that starts the daemon/service -# -do_start() -{ - # Return - # 0 if daemon has been started - # 1 if daemon was already running - # 2 if daemon could not be started - start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \ - || return 1 - start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON -- \ - $DAEMON_ARGS \ - || return 2 - # Add code here, if necessary, that waits for the process to be ready - # to handle requests from services started subsequently which depend - # on this one. As a last resort, sleep for some time. -} - -# -# Function that stops the daemon/service -# -do_stop() -{ - # Return - # 0 if daemon has been stopped - # 1 if daemon was already stopped - # 2 if daemon could not be stopped - # other if a failure occurred - start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --name $NAME - RETVAL="$?" - [ "$RETVAL" = 2 ] && return 2 - # Wait for children to finish too if this is a daemon that forks - # and if the daemon is only ever run from this initscript. - # If the above conditions are not satisfied then add some other code - # that waits for the process to drop all resources that could be - # needed by services started subsequently. A last resort is to - # sleep for some time. - start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON - [ "$?" = 2 ] && return 2 - # Many daemons don't delete their pidfiles when they exit. - rm -f $PIDFILE - return "$RETVAL" -} - -# -# Function that sends a SIGHUP to the daemon/service -# -do_reload() { - # - # If the daemon can reload its configuration without - # restarting (for example, when it is sent a SIGHUP), - # then implement that here. - # - start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE --name $NAME - return 0 -} - -case "$1" in - start) - [ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME" - do_start - case "$?" in - 0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;; - 2) [ "$VERBOSE" != no ] && log_end_msg 1 ;; - esac - ;; - stop) - [ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME" - do_stop - case "$?" in - 0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;; - 2) [ "$VERBOSE" != no ] && log_end_msg 1 ;; - esac - ;; - #reload|force-reload) - # - # If do_reload() is not implemented then leave this commented out - # and leave 'force-reload' as an alias for 'restart'. - # - #log_daemon_msg "Reloading $DESC" "$NAME" - #do_reload - #log_end_msg $? - #;; - restart|force-reload) - # - # If the "reload" option is implemented then remove the - # 'force-reload' alias - # - log_daemon_msg "Restarting $DESC" "$NAME" - do_stop - case "$?" in - 0|1) - do_start - case "$?" in - 0) log_end_msg 0 ;; - 1) log_end_msg 1 ;; # Old process is still running - *) log_end_msg 1 ;; # Failed to start - esac - ;; - *) - # Failed to stop - log_end_msg 1 - ;; - esac - ;; - *) - #echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload}" >&2 - echo "Usage: $SCRIPTNAME {start|stop|restart|force-reload}" >&2 - exit 3 - ;; -esac - -: === modified file 'initramfs-tools-hook' --- initramfs-tools-hook 2008-09-05 07:11:24 +0000 +++ initramfs-tools-hook 2008-09-04 12:38:35 +0000 @@ -29,28 +29,15 @@ . /usr/share/initramfs-tools/hook-functions -for d in /usr /usr/local; do - if [ -d "$d"/lib/mandos ]; then - prefix="$d" - break - fi -done -if [ -z "$prefix" ]; then +if [ -d /usr/lib/mandos ]; then + prefix=/usr +elif [ -d /usr/local/lib/mandos ]; then + prefix=/usr/local +else # Mandos not found exit 1 fi -for d in /etc/keys/mandos /usr/local/lib/mandos/keys; do - if [ -d "$d" ]; then - keydir="$d" - break - fi -done -if [ -z "$keydir" ]; then - # Mandos key directory not found - exit 1 -fi - # The Mandos network client uses the network auto_add_modules net # The Mandos network client uses IPv6 @@ -66,7 +53,7 @@ mkdir --parents "${DESTDIR}${PLUGINDIR}" # Copy the Mandos plugin runner -copy_exec "$prefix"/lib/mandos/plugin-runner "${MANDOSDIR}" +copy_exec "$prefix"/lib/mandos/plugin-runner "${DESTDIR}${MANDOSDIR}" # Copy the plugins @@ -79,7 +66,6 @@ fi case "$base" in *~|.*|\#*\#|*.dpkg-old|*.dpkg-new|*.dpkg-divert) : ;; - "*") :;; *) copy_exec "$file" "${PLUGINDIR}";; esac done @@ -89,7 +75,6 @@ base="`basename \"$file\"`" case "$base" in *~|.*|\#*\#|*.dpkg-old|*.dpkg-new|*.dpkg-divert) : ;; - "*") :;; *) copy_exec "$file" "${PLUGINDIR}";; esac done @@ -100,8 +85,8 @@ copy_exec /usr/bin/gpg fi -# Config files and key files -for file in /etc/mandos/* "$keydir"/*; do +# Key files and config files +for file in /etc/mandos/*; do if [ -d "$file" ]; then continue fi @@ -130,11 +115,9 @@ # Reset some other things to sane permissions which we have # inadvertently affected with our umask setting. for dir in / /bin /etc /keyscripts /sbin /scripts /usr /usr/bin; do - if [ -d "${DESTDIR}$dir" ]; then - chmod a+rX "${DESTDIR}$dir" - fi + chmod a+rX "${DESTDIR}$dir" done for dir in /lib /usr/lib; do find "${DESTDIR}$dir" \! -perm /u+rw,g+r -prune -o -print0 \ - | xargs --null --no-run-if-empty chmod a+rX + | xargs --null chmod a+rX done === modified file 'mandos' --- mandos 2008-09-05 18:19:52 +0000 +++ mandos 2008-08-27 01:18:25 +0000 @@ -55,7 +55,6 @@ import stat import logging import logging.handlers -import pwd import dbus import gobject @@ -518,7 +517,6 @@ Attributes: settings: Server settings clients: Set() of Client objects - enabled: Boolean; whether this server is activated yet """ address_family = socket.AF_INET6 def __init__(self, *args, **kwargs): @@ -528,7 +526,6 @@ if "clients" in kwargs: self.clients = kwargs["clients"] del kwargs["clients"] - self.enabled = False return super(type(self), self).__init__(*args, **kwargs) def server_bind(self): """This overrides the normal server_bind() function @@ -565,11 +562,6 @@ # (self.settings # ["interface"])) return super(type(self), self).server_bind() - def server_activate(self): - if self.enabled: - return super(type(self), self).server_activate() - def enable(self): - self.enabled = True def string_to_delta(interval): @@ -766,42 +758,6 @@ client_config.read(os.path.join(server_settings["configdir"], "clients.conf")) - clients = Set() - tcp_server = IPv6_TCPServer((server_settings["address"], - server_settings["port"]), - tcp_handler, - settings=server_settings, - clients=clients) - pidfilename = "/var/run/mandos.pid" - pidfile = None - try: - pidfile = open(pidfilename, "w") - except IOError, error: - logger.error("Could not open file %r", pidfilename) - - uid = 65534 - gid = 65534 - try: - uid = pwd.getpwnam("mandos").pw_uid - except KeyError: - try: - uid = pwd.getpwnam("nobody").pw_uid - except KeyError: - pass - try: - gid = pwd.getpwnam("mandos").pw_gid - except KeyError: - try: - gid = pwd.getpwnam("nogroup").pw_gid - except KeyError: - pass - try: - os.setuid(uid) - os.setgid(gid) - except OSError, error: - if error[0] != errno.EPERM: - raise error - global service service = AvahiService(name = server_settings["servicename"], type = "_mandos._tcp", ); @@ -821,6 +777,7 @@ avahi.DBUS_INTERFACE_SERVER) # End of Avahi example code + clients = Set() def remove_from_clients(client): clients.remove(client) if not clients: @@ -848,16 +805,16 @@ # Close all input and output, do double fork, etc. daemon() - if pidfile is not None: - pid = os.getpid() - try: - pidfile.write(str(pid) + "\n") - pidfile.close() - except IOError, err: - logger.error(u"Could not write %s file with PID %d", - pidfilename, os.getpid()) - del pidfile - del pidfilename + pidfilename = "/var/run/mandos/mandos.pid" + pid = os.getpid() + try: + pidfile = open(pidfilename, "w") + pidfile.write(str(pid) + "\n") + pidfile.close() + del pidfile + except IOError, err: + logger.error(u"Could not write %s file with PID %d", + pidfilename, os.getpid()) def cleanup(): "Cleanup function; run on exit" @@ -883,9 +840,11 @@ for client in clients: client.start() - tcp_server.enable() - tcp_server.server_activate() - + tcp_server = IPv6_TCPServer((server_settings["address"], + server_settings["port"]), + tcp_handler, + settings=server_settings, + clients=clients) # Find out what port we got service.port = tcp_server.socket.getsockname()[1] logger.info(u"Now listening on address %r, port %d, flowinfo %d," === modified file 'mandos-keygen' --- mandos-keygen 2008-09-05 16:24:33 +0000 +++ mandos-keygen 2008-09-04 21:42:02 +0000 @@ -22,7 +22,7 @@ VERSION="1.0" -KEYDIR="/etc/keys/mandos" +KEYDIR="/etc/mandos" KEYTYPE=DSA KEYLENGTH=2048 SUBKEYTYPE=ELG-E === modified file 'mandos.xml' --- mandos.xml 2008-09-05 16:24:33 +0000 +++ mandos.xml 2008-09-04 13:36:59 +0000 @@ -3,7 +3,7 @@ "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [ - + ]> @@ -379,7 +379,7 @@ - /var/run/mandos.pid + /var/run/mandos/mandos.pid The file containing the process id of @@ -487,8 +487,8 @@ Running this &COMMANDNAME; server program should not in itself present any security risk to the host - computer running it. The program switches to a non-root user - soon after startup. + computer running it. The program does not need any special + privileges to run, and is designed to run as a non-root user. === modified file 'plugin-runner.c' --- plugin-runner.c 2008-09-04 19:59:05 +0000 +++ plugin-runner.c 2008-09-02 06:13:47 +0000 @@ -96,7 +96,7 @@ static plugin *plugin_list = NULL; -/* Gets an existing plugin based on name, +/* Gets a existing plugin based on name, or if none is found, creates a new one */ static plugin *getplugin(char *name){ /* Check for exiting plugin with that name */ @@ -118,7 +118,7 @@ return NULL; } } - + *new_plugin = (plugin) { .name = copy_name, .argc = 1, .disabled = false, @@ -187,10 +187,10 @@ size_t namelen = (size_t)(strchrnul(def, '=') - def); /* Search for this environment variable */ for(char **e = p->environ; *e != NULL; e++){ - if(strncmp(*e, def, namelen + 1) == 0){ + if(strncmp(*e, def, namelen+1) == 0){ /* It already exists */ if(replace){ - char *new = realloc(*e, strlen(def) + 1); + char *new = realloc(*e, strlen(def)); if(new == NULL){ return false; } @@ -238,7 +238,7 @@ /* No child processes */ break; } - + /* A child exited, find it in process_list */ while(proc != NULL and proc->pid != pid){ proc = proc->next; @@ -410,21 +410,23 @@ case 'o': /* --options-for */ if (arg != NULL){ char *p_name = strsep(&arg, ":"); - if(p_name[0] == '\0' or arg == NULL){ + if(p_name[0] == '\0'){ break; } char *opt = strsep(&arg, ":"); - if(opt[0] == '\0' or opt == NULL){ + if(opt[0] == '\0'){ break; } - char *p; - while((p = strsep(&opt, ",")) != NULL){ - if(p[0] == '\0'){ - continue; - } - if(not add_argument(getplugin(p_name), p)){ - perror("add_argument"); - return ARGP_ERR_UNKNOWN; + if(opt != NULL){ + char *p; + while((p = strsep(&opt, ",")) != NULL){ + if(p[0] == '\0'){ + continue; + } + if(not add_argument(getplugin(p_name), p)){ + perror("add_argument"); + return ARGP_ERR_UNKNOWN; + } } } } === removed file 'plugin-runner.conf' --- plugin-runner.conf 2008-09-05 07:11:24 +0000 +++ plugin-runner.conf 1970-01-01 00:00:00 +0000 @@ -1,9 +0,0 @@ -## This is the configuration file for plugin-runner. It should be -## installed as "/etc/mandos/plugin-runner.conf", which will be copied -## to "/conf/conf.d/mandos/plugin-runner.conf" in the initrd.img file. -## -## The default network interface for password-request(8mandos) is -## "eth0". Uncomment this line and change it if necessary. -## - -#--options-for=password-request:--interface=eth0 === modified file 'plugin-runner.xml' --- plugin-runner.xml 2008-09-05 18:19:52 +0000 +++ plugin-runner.xml 2008-09-04 14:04:09 +0000 @@ -3,7 +3,7 @@ "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [ - + ]> @@ -564,15 +564,15 @@ - Run plugins from a different directory, read a different - configuration file, and add two options to the - password-request + Run plugins from a different directory and add two + options to the password-request 8mandos plugin: -&COMMANDNAME; --config-file=/etc/mandos/plugin-runner.conf --plugin-dir /usr/lib/mandos/plugins.d --options-for=password-request:--pubkey=/etc/keys/mandos/pubkey.txt,--seckey=/etc/keys/mandos/seckey.txt +&COMMANDNAME; --plugin-dir=plugins.d --options-for=password-request:--pubkey=keydir/pubkey.txt,--seckey=keydir/seckey.txt @@ -586,7 +586,7 @@ non-privileged. This user and group is then what all plugins will be started as. Therefore, the only way to run a plugin as a privileged user is to have the set-user-ID or set-group-ID bit - set on the plugin executable file (see + set on the plugin executable files (see execve2 ).