=== modified file 'debian/mandos-client.README.Debian' --- debian/mandos-client.README.Debian 2009-04-14 14:56:46 +0000 +++ debian/mandos-client.README.Debian 2009-09-08 06:28:20 +0000 @@ -1,32 +1,42 @@ -* Configure The Server - - A client key has been automatically created in /etc/keys/mandos. - The next step is to run "mandos-keygen --password" to get a config - file section. This should be appended to /etc/mandos/clients.conf - on the Mandos server. - -* Use the Correct Network Interface - - Make sure that the correct network interface is specified in the - DEVICE setting in the "/etc/initramfs-tools/initramfs.conf" file. - If this is changed, it will be necessary to update the initrd image - by doing "update-initramfs -k all -u". This setting can be - overridden at boot time on the Linux kernel command line using the - sixth colon-separated field of the "ip=" option; for exact syntax, - see the file "Documentation/nfsroot.txt" in the Linux source tree. - - Note that since this is used in the initial RAM disk environment, - the network interface must exist at that stage. Thus, the interface - can *not* be a pseudo-interface such as "br0" or "tun0"; instead, a - real interface (such as "eth0") must be used. - -* Test the Server - - After the server has been started and this client's key added, it is - possible to verify that the correct password will be received by +* Choose the Client Network Interface + + You MUST make sure that the correct network interface is specified + in the DEVICE setting in the "/etc/initramfs-tools/initramfs.conf" + file. *If* this is changed, it will be necessary to update the + initrd image by running the command + + update-initramfs -k all -u + + The device can be overridden at boot time on the Linux kernel + command line using the sixth colon-separated field of the "ip=" + option; for exact syntax, read the documentation in the file + "/usr/share/doc/linux-doc-*/Documentation/filesystems/nfsroot.txt", + available in the "linux-doc-*" package. + + Note that since this network interface is used in the initial RAM + disk environment, the network interface *must* exist at that stage. + Thus, the interface can *not* be a pseudo-interface such as "br0" or + "tun0"; instead, a real interface (such as "eth0") must be used. + +* Adding a Client Password to the Server + + The server must be given a password to give back to the client on + boot time. This password must be a one which can be used to unlock + the root file system device. On the *client*, run this command: + + mandos-keygen --password + + It will prompt for a password and output a config file section. + This output should be copied to the Mandos server and added to the + file "/etc/mandos/clients.conf" there. + +* Testing that it Works (Without Rebooting) + + After the server has been started with this client's key added, it + is possible to verify that the correct password will be received by this client by running the command, on the client: - # /usr/lib/mandos/plugins.d/mandos-client \ + /usr/lib/mandos/plugins.d/mandos-client \ --pubkey=/etc/keys/mandos/pubkey.txt \ --seckey=/etc/keys/mandos/seckey.txt; echo @@ -36,16 +46,16 @@ * User-Supplied Plugins - Any plugins found in /etc/mandos/plugins.d will override and add to - the normal Mandos plugins. When adding or changing plugins, do not - forget to update the initital RAM disk image: + Any plugins found in "/etc/mandos/plugins.d" will override and add + to the normal Mandos plugins. When adding or changing plugins, do + not forget to update the initital RAM disk image: - # update-initramfs -k all -u + update-initramfs -k all -u -* Do *NOT* Edit /etc/crypttab +* Do *NOT* Edit "/etc/crypttab" - It is NOT necessary to edit /etc/crypttab to specify - /usr/lib/mandos/plugin-runner as a keyscript for the root file + It is NOT necessary to edit "/etc/crypttab" to specify + "/usr/lib/mandos/plugin-runner" as a keyscript for the root file system; if no keyscript is given for the root file system, the Mandos client will be the new default way for getting a password for the root file system when booting. @@ -74,4 +84,4 @@ work, "--options-for=mandos-client:--connect=
:" needs to be manually added to the file "/etc/mandos/plugin-runner.conf". - -- Teddy Hogeborn , Tue, 14 Apr 2009 16:51:18 +0200 + -- Teddy Hogeborn , Tue, 8 Sep 2009 08:25:58 +0200 === modified file 'debian/mandos.README.Debian' --- debian/mandos.README.Debian 2009-01-04 22:15:01 +0000 +++ debian/mandos.README.Debian 2009-09-08 06:28:20 +0000 @@ -1,7 +1,10 @@ The Mandos server is useless without at least one configured client in /etc/mandos/clients.conf. To create one, install the "mandos-client" -package on a client computer, and run "mandos-keygen --password" there -to get a config file stanza. Append that to /etc/mandos/clients.conf -on the Mandos server. - - -- Teddy Hogeborn , Sun, 4 Jan 2009 22:59:22 +0100 +package on a client computer, and run the command + + # mandos-keygen --password + +there to get a config file stanza. Append the output of that command +to the file "/etc/mandos/clients.conf" on the Mandos server. + + -- Teddy Hogeborn , Tue, 8 Sep 2009 06:57:45 +0200