]> Mandos &VERSION; &TIMESTAMP; Björn Påhlsson

belorn@fukt.bsnet.se

Teddy Hogeborn

teddy@fukt.bsnet.se

2008 Teddy Hogeborn Björn Påhlsson &COMMANDNAME; 8mandos &COMMANDNAME; Client for mandos &COMMANDNAME; --connect IPADDR:PORT -c IPADDR:PORT --keydir DIRECTORY -d DIRECTORY --interface NAME -i NAME --pubkey FILE -p FILE --seckey FILE -s FILE --priority STRING --dh-bits BITS --debug &COMMANDNAME; --help -? &COMMANDNAME; --usage &COMMANDNAME; --version -V &COMMANDNAME; is a client program that communicates with mandos8 to get a password. It uses IPv6 link-local addresses to get network connectivity, Zeroconf to find the server, and TLS with an OpenPGP key to ensure authenticity and confidentiality. It keeps running, trying all servers on the network, until it receives a satisfactory reply. This program is not meant to be run directly; it is really meant to run as a plugin of the Mandos plugin-runner 8mandos, which runs in the initial RAM disk environment because it is specified as a keyscript in the crypttab5 file. The purpose of this is to enable remote and unattended rebooting of client host computer with an encrypted root file system. See for details. This program is commonly not invoked from the command line; it is normally started by the Mandos plugin runner, see plugin-runner8mandos . Any command line options this program accepts are therefore normally provided by the plugin runner, and not directly. --connect=ADDRESS:PORT -c ADDRESS:PORT Do not use Zeroconf to locate servers. Connect directly to only one specified Mandos server. Note that an IPv6 address has colon characters in it, so the last colon character is assumed to separate the address from the port number. This option is normally only useful for testing and debugging. --keydir=DIRECTORY -d DIRECTORY Directory to read the OpenPGP key files pubkey.txt and seckey.txt from. The default is /conf/conf.d/mandos (in the initial RAM disk environment). --interface= NAME -i NAME Network interface that will be brought up and scanned for Mandos servers to connect to. The default it eth0. --pubkey=FILE -p FILE OpenPGP public key file base name. This will be combined with the directory from the --keydir option to form an absolute file name. The default name is pubkey.txt. --seckey=FILE -s FILE OpenPGP secret key file base name. This will be combined with the directory from the --keydir option to form an absolute file name. The default name is seckey.txt. --priority=STRING --dh-bits=BITS Sets the number of bits to use for the prime number in the TLS Diffie-Hellman key exchange. Default is 1024. --debug Enable debug mode. This will enable a lot of output to standard error about what the program is doing. The program will still perform all other functions normally. It will also enable debug mode in the Avahi and GnuTLS libraries, making them print large amounts of debugging output. --help -? Gives a help message about options and their meanings. --usage Gives a short usage message. --version -V Prints the program version. This program is the client part. It is a plugin started by plugin-runner 8mandos which will run in an initial RAM disk environment. This program could, theoretically, be used as a keyscript in /etc/crypttab, but it would then be impossible to enter the encrypted root disk password at the console, since this program does not read from the console at all. This is why a separate plugin does that, which will be run in parallell to this one. This program will exit with a successful (zero) exit status if a server could be found and the password received from it could be successfully decrypted and output on standard output. The program will exit with a non-zero exit status only if a critical error occurs. Otherwise, it will forever connect to new Mandosservers servers as they appear, trying to get a decryptable password. This program does not use any environment variables, not even the ones provided by cryptsetup8 . mandos 8, password-prompt 8mandos, plugin-runner 8mandos Zeroconf Avahi GnuTLS GPGME RFC 4880: OpenPGP Message Format RFC 5081: Using OpenPGP Keys for Transport Layer Security RFC 4291: IP Version 6 Addressing Architecture, section 2.5.6, Link-Local IPv6 Unicast Addresses