1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
<!ENTITY VERSION "1.0">
4
5
<!ENTITY COMMANDNAME "mandos">
5
<!ENTITY TIMESTAMP "2018-02-08">
6
<!ENTITY % common SYSTEM "common.ent">
10
8
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
12
<title>Mandos Manual</title>
10
<title>&COMMANDNAME;</title>
13
11
<!-- NWalsh’s docbook scripts use this to generate the footer: -->
14
<productname>Mandos</productname>
15
<productnumber>&version;</productnumber>
16
<date>&TIMESTAMP;</date>
12
<productname>&COMMANDNAME;</productname>
13
<productnumber>&VERSION;</productnumber>
19
16
<firstname>Björn</firstname>
20
17
<surname>Påhlsson</surname>
22
<email>belorn@recompile.se</email>
19
<email>belorn@fukt.bsnet.se</email>
26
23
<firstname>Teddy</firstname>
27
24
<surname>Hogeborn</surname>
29
<email>teddy@recompile.se</email>
26
<email>teddy@fukt.bsnet.se</email>
45
32
<holder>Teddy Hogeborn</holder>
46
33
<holder>Björn Påhlsson</holder>
48
<xi:include href="legalnotice.xml"/>
37
This manual page is free software: you can redistribute it
38
and/or modify it under the terms of the GNU General Public
39
License as published by the Free Software Foundation,
40
either version 3 of the License, or (at your option) any
45
This manual page is distributed in the hope that it will
46
be useful, but WITHOUT ANY WARRANTY; without even the
47
implied warranty of MERCHANTABILITY or FITNESS FOR A
48
PARTICULAR PURPOSE. See the GNU General Public License
53
You should have received a copy of the GNU General Public
54
License along with this program; If not, see
55
<ulink url="http://www.gnu.org/licenses/"/>.
52
61
<refentrytitle>&COMMANDNAME;</refentrytitle>
53
62
<manvolnum>8</manvolnum>
57
66
<refname><command>&COMMANDNAME;</command></refname>
59
Gives encrypted passwords to authenticated Mandos clients
68
Sends encrypted passwords to authenticated Mandos clients
65
74
<command>&COMMANDNAME;</command>
67
<arg choice="plain"><option>--interface
68
<replaceable>NAME</replaceable></option></arg>
69
<arg choice="plain"><option>-i
70
<replaceable>NAME</replaceable></option></arg>
74
<arg choice="plain"><option>--address
75
<replaceable>ADDRESS</replaceable></option></arg>
76
<arg choice="plain"><option>-a
77
<replaceable>ADDRESS</replaceable></option></arg>
81
<arg choice="plain"><option>--port
82
<replaceable>PORT</replaceable></option></arg>
83
<arg choice="plain"><option>-p
84
<replaceable>PORT</replaceable></option></arg>
87
<arg><option>--priority
88
<replaceable>PRIORITY</replaceable></option></arg>
90
<arg><option>--servicename
91
<replaceable>NAME</replaceable></option></arg>
93
<arg><option>--configdir
94
<replaceable>DIRECTORY</replaceable></option></arg>
96
<arg><option>--debug</option></arg>
98
<arg><option>--debuglevel
99
<replaceable>LEVEL</replaceable></option></arg>
101
<arg><option>--no-dbus</option></arg>
103
<arg><option>--no-ipv6</option></arg>
105
<arg><option>--no-restore</option></arg>
107
<arg><option>--statedir
108
<replaceable>DIRECTORY</replaceable></option></arg>
110
<arg><option>--socket
111
<replaceable>FD</replaceable></option></arg>
113
<arg><option>--foreground</option></arg>
115
<arg><option>--no-zeroconf</option></arg>
75
<arg>--interface<arg choice="plain">NAME</arg></arg>
76
<arg>--address<arg choice="plain">ADDRESS</arg></arg>
77
<arg>--port<arg choice="plain">PORT</arg></arg>
78
<arg>--priority<arg choice="plain">PRIORITY</arg></arg>
79
<arg>--servicename<arg choice="plain">NAME</arg></arg>
80
<arg>--configdir<arg choice="plain">DIRECTORY</arg></arg>
84
<command>&COMMANDNAME;</command>
85
<arg>-i<arg choice="plain">NAME</arg></arg>
86
<arg>-a<arg choice="plain">ADDRESS</arg></arg>
87
<arg>-p<arg choice="plain">PORT</arg></arg>
88
<arg>--priority<arg choice="plain">PRIORITY</arg></arg>
89
<arg>--servicename<arg choice="plain">NAME</arg></arg>
90
<arg>--configdir<arg choice="plain">DIRECTORY</arg></arg>
118
94
<command>&COMMANDNAME;</command>
119
95
<group choice="req">
120
<arg choice="plain"><option>--help</option></arg>
121
<arg choice="plain"><option>-h</option></arg>
96
<arg choice="plain">-h</arg>
97
<arg choice="plain">--help</arg>
125
101
<command>&COMMANDNAME;</command>
126
<arg choice="plain"><option>--version</option></arg>
102
<arg choice="plain">--version</arg>
129
105
<command>&COMMANDNAME;</command>
130
<arg choice="plain"><option>--check</option></arg>
106
<arg choice="plain">--check</arg>
132
108
</refsynopsisdiv>
134
110
<refsect1 id="description">
135
111
<title>DESCRIPTION</title>
137
113
<command>&COMMANDNAME;</command> is a server daemon which
138
114
handles incoming request for passwords for a pre-defined list of
139
client host computers. For an introduction, see
140
<citerefentry><refentrytitle>intro</refentrytitle>
141
<manvolnum>8mandos</manvolnum></citerefentry>. The Mandos server
142
uses Zeroconf to announce itself on the local network, and uses
143
TLS to communicate securely with and to authenticate the
144
clients. The Mandos server uses IPv6 to allow Mandos clients to
145
use IPv6 link-local addresses, since the clients will probably
146
not have any other addresses configured (see <xref
147
linkend="overview"/>). Any authenticated client is then given
148
the stored pre-encrypted password for that specific client.
115
client host computers. The Mandos server uses Zeroconf to
116
announce itself on the local network, and uses TLS to
117
communicate securely with and to authenticate the clients. The
118
Mandos server uses IPv6 to allow Mandos clients to use IPv6
119
link-local addresses, since the clients will probably not have
120
any other addresses configured (see <xref linkend="overview"/>).
121
Any authenticated client is then given the stored pre-encrypted
122
password for that specific client.
152
127
<refsect1 id="purpose">
153
128
<title>PURPOSE</title>
155
131
The purpose of this is to enable <emphasis>remote and unattended
156
132
rebooting</emphasis> of client host computer with an
157
133
<emphasis>encrypted root file system</emphasis>. See <xref
158
134
linkend="overview"/> for details.
162
139
<refsect1 id="options">
163
140
<title>OPTIONS</title>
166
<term><option>--help</option></term>
167
<term><option>-h</option></term>
144
<term><literal>-h</literal>, <literal>--help</literal></term>
170
147
Show a help message and exit
176
<term><option>--interface</option>
177
<replaceable>NAME</replaceable></term>
178
<term><option>-i</option>
179
<replaceable>NAME</replaceable></term>
153
<term><literal>-i</literal>, <literal>--interface <replaceable
154
>NAME</replaceable></literal></term>
181
156
<xi:include href="mandos-options.xml" xpointer="interface"/>
186
<term><option>--address
187
<replaceable>ADDRESS</replaceable></option></term>
189
<replaceable>ADDRESS</replaceable></option></term>
161
<term><literal>-a</literal>, <literal>--address <replaceable>
162
ADDRESS</replaceable></literal></term>
191
164
<xi:include href="mandos-options.xml" xpointer="address"/>
197
<replaceable>PORT</replaceable></option></term>
199
<replaceable>PORT</replaceable></option></term>
169
<term><literal>-p</literal>, <literal>--port <replaceable>
170
PORT</replaceable></literal></term>
201
172
<xi:include href="mandos-options.xml" xpointer="port"/>
206
<term><option>--check</option></term>
177
<term><literal>--check</literal></term>
209
180
Run the server’s self-tests. This includes any unit
216
<term><option>--debug</option></term>
187
<term><literal>--debug</literal></term>
218
189
<xi:include href="mandos-options.xml" xpointer="debug"/>
223
<term><option>--debuglevel
224
<replaceable>LEVEL</replaceable></option></term>
227
Set the debugging log level.
228
<replaceable>LEVEL</replaceable> is a string, one of
229
<quote><literal>CRITICAL</literal></quote>,
230
<quote><literal>ERROR</literal></quote>,
231
<quote><literal>WARNING</literal></quote>,
232
<quote><literal>INFO</literal></quote>, or
233
<quote><literal>DEBUG</literal></quote>, in order of
234
increasing verbosity. The default level is
235
<quote><literal>WARNING</literal></quote>.
241
<term><option>--priority <replaceable>
242
PRIORITY</replaceable></option></term>
194
<term><literal>--priority <replaceable>
195
PRIORITY</replaceable></literal></term>
244
197
<xi:include href="mandos-options.xml" xpointer="priority"/>
249
<term><option>--servicename
250
<replaceable>NAME</replaceable></option></term>
202
<term><literal>--servicename <replaceable>NAME</replaceable>
252
205
<xi:include href="mandos-options.xml"
253
206
xpointer="servicename"/>
258
<term><option>--configdir
259
<replaceable>DIRECTORY</replaceable></option></term>
211
<term><literal>--configdir <replaceable>DIR</replaceable>
262
215
Directory to search for configuration files. Default is
273
<term><option>--version</option></term>
226
<term><literal>--version</literal></term>
276
229
Prints the program version and exit.
282
<term><option>--no-dbus</option></term>
284
<xi:include href="mandos-options.xml" xpointer="dbus"/>
286
See also <xref linkend="dbus_interface"/>.
292
<term><option>--no-ipv6</option></term>
294
<xi:include href="mandos-options.xml" xpointer="ipv6"/>
299
<term><option>--no-restore</option></term>
301
<xi:include href="mandos-options.xml" xpointer="restore"/>
303
See also <xref linkend="persistent_state"/>.
309
<term><option>--statedir
310
<replaceable>DIRECTORY</replaceable></option></term>
312
<xi:include href="mandos-options.xml" xpointer="statedir"/>
317
<term><option>--socket
318
<replaceable>FD</replaceable></option></term>
320
<xi:include href="mandos-options.xml" xpointer="socket"/>
325
<term><option>--foreground</option></term>
327
<xi:include href="mandos-options.xml"
328
xpointer="foreground"/>
333
<term><option>--no-zeroconf</option></term>
335
<xi:include href="mandos-options.xml" xpointer="zeroconf"/>
342
236
<refsect1 id="overview">
343
237
<title>OVERVIEW</title>
344
238
<xi:include href="overview.xml"/>
346
240
This program is the server part. It is a normal server program
347
241
and will run in a normal system environment, not in an initial
348
<acronym>RAM</acronym> disk environment.
242
RAM disk environment.
352
246
<refsect1 id="protocol">
353
247
<title>NETWORK PROTOCOL</title>
407
301
</tbody></tgroup></table>
410
304
<refsect1 id="checking">
411
305
<title>CHECKING</title>
413
307
The server will, by default, continually check that the clients
414
308
are still up. If a client has not been confirmed as being up
415
309
for some time, the client is assumed to be compromised and is no
416
longer eligible to receive the encrypted password. (Manual
417
intervention is required to re-enable a client.) The timeout,
418
extended timeout, checker program, and interval between checks
419
can be configured both globally and per client; see
420
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
310
longer eligible to receive the encrypted password. The timeout,
311
checker program, and interval between checks can be configured
312
both globally and per client; see <citerefentry>
313
<refentrytitle>mandos-clients.conf</refentrytitle>
421
314
<manvolnum>5</manvolnum></citerefentry>.
425
<refsect1 id="approval">
426
<title>APPROVAL</title>
428
The server can be configured to require manual approval for a
429
client before it is sent its secret. The delay to wait for such
430
approval and the default action (approve or deny) can be
431
configured both globally and per client; see <citerefentry>
432
<refentrytitle>mandos-clients.conf</refentrytitle>
433
<manvolnum>5</manvolnum></citerefentry>. By default all clients
434
will be approved immediately without delay.
437
This can be used to deny a client its secret if not manually
438
approved within a specified time. It can also be used to make
439
the server delay before giving a client its secret, allowing
440
optional manual denying of this specific client.
445
318
<refsect1 id="logging">
446
319
<title>LOGGING</title>
448
321
The server will send log message with various severity levels to
449
<filename class="devicefile">/dev/log</filename>. With the
322
<filename>/dev/log</filename>. With the
450
323
<option>--debug</option> option, it will log even more messages,
451
324
and also show them on the console.
455
<refsect1 id="persistent_state">
456
<title>PERSISTENT STATE</title>
458
Client settings, initially read from
459
<filename>clients.conf</filename>, are persistent across
460
restarts, and run-time changes will override settings in
461
<filename>clients.conf</filename>. However, if a setting is
462
<emphasis>changed</emphasis> (or a client added, or removed) in
463
<filename>clients.conf</filename>, this will take precedence.
467
<refsect1 id="dbus_interface">
468
<title>D-BUS INTERFACE</title>
470
The server will by default provide a D-Bus system bus interface.
471
This interface will only be accessible by the root user or a
472
Mandos-specific user, if such a user exists. For documentation
473
of the D-Bus API, see the file <filename>DBUS-API</filename>.
477
328
<refsect1 id="exit_status">
478
329
<title>EXIT STATUS</title>
663
511
compromised if they are gone for too long.
514
If a client is compromised, its downtime should be duly noted
515
by the server which would therefore declare the client
516
invalid. But if the server was ever restarted, it would
517
re-read its client list from its configuration file and again
518
regard all clients therein as valid, and hence eligible to
519
receive their passwords. Therefore, be careful when
520
restarting servers if it is suspected that a client has, in
521
fact, been compromised by parties who may now be running a
522
fake Mandos client with the keys from the non-encrypted
523
initial RAM image of the client host. What should be done in
524
that case (if restarting the server program really is
525
necessary) is to stop the server program, edit the
526
configuration file to omit any suspect clients, and restart
666
530
For more details on client-side security, see
667
<citerefentry><refentrytitle>mandos-client</refentrytitle>
531
<citerefentry><refentrytitle>password-request</refentrytitle>
668
532
<manvolnum>8mandos</manvolnum></citerefentry>.
673
537
<refsect1 id="see_also">
674
538
<title>SEE ALSO</title>
676
<citerefentry><refentrytitle>intro</refentrytitle>
677
<manvolnum>8mandos</manvolnum></citerefentry>,
678
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
679
<manvolnum>5</manvolnum></citerefentry>,
680
<citerefentry><refentrytitle>mandos.conf</refentrytitle>
681
<manvolnum>5</manvolnum></citerefentry>,
682
<citerefentry><refentrytitle>mandos-client</refentrytitle>
683
<manvolnum>8mandos</manvolnum></citerefentry>,
684
<citerefentry><refentrytitle>sh</refentrytitle>
685
<manvolnum>1</manvolnum></citerefentry>
541
<refentrytitle>mandos.conf</refentrytitle>
542
<manvolnum>5</manvolnum></citerefentry>, <citerefentry>
543
<refentrytitle>mandos-clients.conf</refentrytitle>
544
<manvolnum>5</manvolnum></citerefentry>, <citerefentry>
545
<refentrytitle>password-request</refentrytitle>
546
<manvolnum>8mandos</manvolnum></citerefentry>, <citerefentry>
547
<refentrytitle>sh</refentrytitle><manvolnum>1</manvolnum>
724
RFC 4291: <citetitle>IP Version 6 Addressing
725
Architecture</citetitle>
588
<citation>RFC 4291: <citetitle>IP Version 6 Addressing
589
Architecture</citetitle>, section 2.5.6, Link-Local IPv6
590
Unicast Addresses</citation>
730
<term>Section 2.2: <citetitle>Text Representation of
731
Addresses</citetitle></term>
732
<listitem><para/></listitem>
735
<term>Section 2.5.5.2: <citetitle>IPv4-Mapped IPv6
736
Address</citetitle></term>
737
<listitem><para/></listitem>
740
<term>Section 2.5.6, <citetitle>Link-Local IPv6 Unicast
741
Addresses</citetitle></term>
744
The clients use IPv6 link-local addresses, which are
745
immediately usable since a link-local addresses is
746
automatically assigned to a network interfaces when it
594
The clients use IPv6 link-local addresses, which are
595
immediately usable since a link-local addresses is
596
automatically assigned to a network interfaces when it is
756
RFC 5246: <citetitle>The Transport Layer Security (TLS)
757
Protocol Version 1.2</citetitle>
603
<citation>RFC 4346: <citetitle>The Transport Layer Security
604
(TLS) Protocol Version 1.1</citetitle></citation>
761
TLS 1.2 is the protocol implemented by GnuTLS.
608
TLS 1.1 is the protocol implemented by GnuTLS.
767
RFC 4880: <citetitle>OpenPGP Message Format</citetitle>
614
<citation>RFC 4880: <citetitle>OpenPGP Message
615
Format</citetitle></citation>