1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
<!ENTITY VERSION "1.0">
5
4
<!ENTITY COMMANDNAME "mandos">
6
<!ENTITY TIMESTAMP "2008-08-29">
5
<!ENTITY TIMESTAMP "2019-02-10">
6
<!ENTITY % common SYSTEM "common.ent">
9
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
11
12
<title>Mandos Manual</title>
12
13
<!-- NWalsh’s docbook scripts use this to generate the footer: -->
13
14
<productname>Mandos</productname>
14
<productnumber>&VERSION;</productnumber>
15
<productnumber>&version;</productnumber>
15
16
<date>&TIMESTAMP;</date>
18
19
<firstname>Björn</firstname>
19
20
<surname>Påhlsson</surname>
21
<email>belorn@fukt.bsnet.se</email>
22
<email>belorn@recompile.se</email>
25
26
<firstname>Teddy</firstname>
26
27
<surname>Hogeborn</surname>
28
<email>teddy@fukt.bsnet.se</email>
29
<email>teddy@recompile.se</email>
34
46
<holder>Teddy Hogeborn</holder>
35
47
<holder>Björn Påhlsson</holder>
39
This manual page is free software: you can redistribute it
40
and/or modify it under the terms of the GNU General Public
41
License as published by the Free Software Foundation,
42
either version 3 of the License, or (at your option) any
47
This manual page is distributed in the hope that it will
48
be useful, but WITHOUT ANY WARRANTY; without even the
49
implied warranty of MERCHANTABILITY or FITNESS FOR A
50
PARTICULAR PURPOSE. See the GNU General Public License
55
You should have received a copy of the GNU General Public
56
License along with this program; If not, see
57
<ulink url="http://www.gnu.org/licenses/"/>.
49
<xi:include href="legalnotice.xml"/>
63
53
<refentrytitle>&COMMANDNAME;</refentrytitle>
64
54
<manvolnum>8</manvolnum>
68
58
<refname><command>&COMMANDNAME;</command></refname>
70
Sends encrypted passwords to authenticated Mandos clients
60
Gives encrypted passwords to authenticated Mandos clients
76
66
<command>&COMMANDNAME;</command>
77
<arg>--interface<arg choice="plain">NAME</arg></arg>
78
<arg>--address<arg choice="plain">ADDRESS</arg></arg>
79
<arg>--port<arg choice="plain">PORT</arg></arg>
80
<arg>--priority<arg choice="plain">PRIORITY</arg></arg>
81
<arg>--servicename<arg choice="plain">NAME</arg></arg>
82
<arg>--configdir<arg choice="plain">DIRECTORY</arg></arg>
86
<command>&COMMANDNAME;</command>
87
<arg>-i<arg choice="plain">NAME</arg></arg>
88
<arg>-a<arg choice="plain">ADDRESS</arg></arg>
89
<arg>-p<arg choice="plain">PORT</arg></arg>
90
<arg>--priority<arg choice="plain">PRIORITY</arg></arg>
91
<arg>--servicename<arg choice="plain">NAME</arg></arg>
92
<arg>--configdir<arg choice="plain">DIRECTORY</arg></arg>
68
<arg choice="plain"><option>--interface
69
<replaceable>NAME</replaceable></option></arg>
70
<arg choice="plain"><option>-i
71
<replaceable>NAME</replaceable></option></arg>
75
<arg choice="plain"><option>--address
76
<replaceable>ADDRESS</replaceable></option></arg>
77
<arg choice="plain"><option>-a
78
<replaceable>ADDRESS</replaceable></option></arg>
82
<arg choice="plain"><option>--port
83
<replaceable>PORT</replaceable></option></arg>
84
<arg choice="plain"><option>-p
85
<replaceable>PORT</replaceable></option></arg>
88
<arg><option>--priority
89
<replaceable>PRIORITY</replaceable></option></arg>
91
<arg><option>--servicename
92
<replaceable>NAME</replaceable></option></arg>
94
<arg><option>--configdir
95
<replaceable>DIRECTORY</replaceable></option></arg>
97
<arg><option>--debug</option></arg>
99
<arg><option>--debuglevel
100
<replaceable>LEVEL</replaceable></option></arg>
102
<arg><option>--no-dbus</option></arg>
104
<arg><option>--no-ipv6</option></arg>
106
<arg><option>--no-restore</option></arg>
108
<arg><option>--statedir
109
<replaceable>DIRECTORY</replaceable></option></arg>
111
<arg><option>--socket
112
<replaceable>FD</replaceable></option></arg>
114
<arg><option>--foreground</option></arg>
116
<arg><option>--no-zeroconf</option></arg>
96
119
<command>&COMMANDNAME;</command>
97
120
<group choice="req">
98
<arg choice="plain">-h</arg>
99
<arg choice="plain">--help</arg>
121
<arg choice="plain"><option>--help</option></arg>
122
<arg choice="plain"><option>-h</option></arg>
103
126
<command>&COMMANDNAME;</command>
104
<arg choice="plain">--version</arg>
127
<arg choice="plain"><option>--version</option></arg>
107
130
<command>&COMMANDNAME;</command>
108
<arg choice="plain">--check</arg>
131
<arg choice="plain"><option>--check</option></arg>
110
133
</refsynopsisdiv>
112
135
<refsect1 id="description">
113
136
<title>DESCRIPTION</title>
115
138
<command>&COMMANDNAME;</command> is a server daemon which
116
139
handles incoming request for passwords for a pre-defined list of
117
client host computers. The Mandos server uses Zeroconf to
118
announce itself on the local network, and uses TLS to
119
communicate securely with and to authenticate the clients. The
120
Mandos server uses IPv6 to allow Mandos clients to use IPv6
121
link-local addresses, since the clients will probably not have
122
any other addresses configured (see <xref linkend="overview"/>).
123
Any authenticated client is then given the stored pre-encrypted
124
password for that specific client.
140
client host computers. For an introduction, see
141
<citerefentry><refentrytitle>intro</refentrytitle>
142
<manvolnum>8mandos</manvolnum></citerefentry>. The Mandos server
143
uses Zeroconf to announce itself on the local network, and uses
144
TLS to communicate securely with and to authenticate the
145
clients. The Mandos server uses IPv6 to allow Mandos clients to
146
use IPv6 link-local addresses, since the clients will probably
147
not have any other addresses configured (see <xref
148
linkend="overview"/>). Any authenticated client is then given
149
the stored pre-encrypted password for that specific client.
129
153
<refsect1 id="purpose">
130
154
<title>PURPOSE</title>
133
156
The purpose of this is to enable <emphasis>remote and unattended
134
157
rebooting</emphasis> of client host computer with an
135
158
<emphasis>encrypted root file system</emphasis>. See <xref
136
159
linkend="overview"/> for details.
141
163
<refsect1 id="options">
142
164
<title>OPTIONS</title>
146
<term><literal>-h</literal>, <literal>--help</literal></term>
167
<term><option>--help</option></term>
168
<term><option>-h</option></term>
149
171
Show a help message and exit
155
<term><literal>-i</literal>, <literal>--interface <replaceable
156
>NAME</replaceable></literal></term>
177
<term><option>--interface</option>
178
<replaceable>NAME</replaceable></term>
179
<term><option>-i</option>
180
<replaceable>NAME</replaceable></term>
158
182
<xi:include href="mandos-options.xml" xpointer="interface"/>
163
<term><literal>-a</literal>, <literal>--address <replaceable>
164
ADDRESS</replaceable></literal></term>
187
<term><option>--address
188
<replaceable>ADDRESS</replaceable></option></term>
190
<replaceable>ADDRESS</replaceable></option></term>
166
192
<xi:include href="mandos-options.xml" xpointer="address"/>
171
<term><literal>-p</literal>, <literal>--port <replaceable>
172
PORT</replaceable></literal></term>
198
<replaceable>PORT</replaceable></option></term>
200
<replaceable>PORT</replaceable></option></term>
174
202
<xi:include href="mandos-options.xml" xpointer="port"/>
179
<term><literal>--check</literal></term>
207
<term><option>--check</option></term>
182
210
Run the server’s self-tests. This includes any unit
189
<term><literal>--debug</literal></term>
217
<term><option>--debug</option></term>
191
219
<xi:include href="mandos-options.xml" xpointer="debug"/>
196
<term><literal>--priority <replaceable>
197
PRIORITY</replaceable></literal></term>
224
<term><option>--debuglevel
225
<replaceable>LEVEL</replaceable></option></term>
228
Set the debugging log level.
229
<replaceable>LEVEL</replaceable> is a string, one of
230
<quote><literal>CRITICAL</literal></quote>,
231
<quote><literal>ERROR</literal></quote>,
232
<quote><literal>WARNING</literal></quote>,
233
<quote><literal>INFO</literal></quote>, or
234
<quote><literal>DEBUG</literal></quote>, in order of
235
increasing verbosity. The default level is
236
<quote><literal>WARNING</literal></quote>.
242
<term><option>--priority <replaceable>
243
PRIORITY</replaceable></option></term>
199
245
<xi:include href="mandos-options.xml" xpointer="priority"/>
204
<term><literal>--servicename <replaceable>NAME</replaceable>
250
<term><option>--servicename
251
<replaceable>NAME</replaceable></option></term>
207
253
<xi:include href="mandos-options.xml"
208
254
xpointer="servicename"/>
213
<term><literal>--configdir <replaceable>DIR</replaceable>
259
<term><option>--configdir
260
<replaceable>DIRECTORY</replaceable></option></term>
217
263
Directory to search for configuration files. Default is
228
<term><literal>--version</literal></term>
274
<term><option>--version</option></term>
231
277
Prints the program version and exit.
283
<term><option>--no-dbus</option></term>
285
<xi:include href="mandos-options.xml" xpointer="dbus"/>
287
See also <xref linkend="dbus_interface"/>.
293
<term><option>--no-ipv6</option></term>
295
<xi:include href="mandos-options.xml" xpointer="ipv6"/>
300
<term><option>--no-restore</option></term>
302
<xi:include href="mandos-options.xml" xpointer="restore"/>
304
See also <xref linkend="persistent_state"/>.
310
<term><option>--statedir
311
<replaceable>DIRECTORY</replaceable></option></term>
313
<xi:include href="mandos-options.xml" xpointer="statedir"/>
318
<term><option>--socket
319
<replaceable>FD</replaceable></option></term>
321
<xi:include href="mandos-options.xml" xpointer="socket"/>
326
<term><option>--foreground</option></term>
328
<xi:include href="mandos-options.xml"
329
xpointer="foreground"/>
334
<term><option>--no-zeroconf</option></term>
336
<xi:include href="mandos-options.xml" xpointer="zeroconf"/>
238
343
<refsect1 id="overview">
239
344
<title>OVERVIEW</title>
240
345
<xi:include href="overview.xml"/>
242
347
This program is the server part. It is a normal server program
243
348
and will run in a normal system environment, not in an initial
244
RAM disk environment.
349
<acronym>RAM</acronym> disk environment.
248
353
<refsect1 id="protocol">
249
354
<title>NETWORK PROTOCOL</title>
303
408
</tbody></tgroup></table>
306
411
<refsect1 id="checking">
307
412
<title>CHECKING</title>
309
414
The server will, by default, continually check that the clients
310
415
are still up. If a client has not been confirmed as being up
311
416
for some time, the client is assumed to be compromised and is no
312
longer eligible to receive the encrypted password. The timeout,
313
checker program, and interval between checks can be configured
314
both globally and per client; see <citerefentry>
417
longer eligible to receive the encrypted password. (Manual
418
intervention is required to re-enable a client.) The timeout,
419
extended timeout, checker program, and interval between checks
420
can be configured both globally and per client; see
421
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
422
<manvolnum>5</manvolnum></citerefentry>.
426
<refsect1 id="approval">
427
<title>APPROVAL</title>
429
The server can be configured to require manual approval for a
430
client before it is sent its secret. The delay to wait for such
431
approval and the default action (approve or deny) can be
432
configured both globally and per client; see <citerefentry>
315
433
<refentrytitle>mandos-clients.conf</refentrytitle>
316
<manvolnum>5</manvolnum></citerefentry>.
434
<manvolnum>5</manvolnum></citerefentry>. By default all clients
435
will be approved immediately without delay.
438
This can be used to deny a client its secret if not manually
439
approved within a specified time. It can also be used to make
440
the server delay before giving a client its secret, allowing
441
optional manual denying of this specific client.
320
446
<refsect1 id="logging">
321
447
<title>LOGGING</title>
323
449
The server will send log message with various severity levels to
324
<filename>/dev/log</filename>. With the
450
<filename class="devicefile">/dev/log</filename>. With the
325
451
<option>--debug</option> option, it will log even more messages,
326
452
and also show them on the console.
456
<refsect1 id="persistent_state">
457
<title>PERSISTENT STATE</title>
459
Client settings, initially read from
460
<filename>clients.conf</filename>, are persistent across
461
restarts, and run-time changes will override settings in
462
<filename>clients.conf</filename>. However, if a setting is
463
<emphasis>changed</emphasis> (or a client added, or removed) in
464
<filename>clients.conf</filename>, this will take precedence.
468
<refsect1 id="dbus_interface">
469
<title>D-BUS INTERFACE</title>
471
The server will by default provide a D-Bus system bus interface.
472
This interface will only be accessible by the root user or a
473
Mandos-specific user, if such a user exists. For documentation
474
of the D-Bus API, see the file <filename>DBUS-API</filename>.
330
478
<refsect1 id="exit_status">
331
479
<title>EXIT STATUS</title>
481
628
</informalexample>
484
631
<refsect1 id="security">
485
632
<title>SECURITY</title>
486
<refsect2 id="SERVER">
633
<refsect2 id="server">
487
634
<title>SERVER</title>
489
636
Running this <command>&COMMANDNAME;</command> server program
490
637
should not in itself present any security risk to the host
491
computer running it. The program does not need any special
492
privileges to run, and is designed to run as a non-root user.
638
computer running it. The program switches to a non-root user
495
<refsect2 id="CLIENTS">
642
<refsect2 id="clients">
496
643
<title>CLIENTS</title>
498
645
The server only gives out its stored data to clients which
499
does have the OpenPGP key of the stored fingerprint. This is
500
guaranteed by the fact that the client sends its OpenPGP
501
public key in the TLS handshake; this ensures it to be
502
genuine. The server computes the fingerprint of the key
503
itself and looks up the fingerprint in its list of
504
clients. The <filename>clients.conf</filename> file (see
646
does have the correct key ID of the stored key ID. This is
647
guaranteed by the fact that the client sends its public key in
648
the TLS handshake; this ensures it to be genuine. The server
649
computes the key ID of the key itself and looks up the key ID
650
in its list of clients. The <filename>clients.conf</filename>
505
652
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
506
653
<manvolnum>5</manvolnum></citerefentry>)
507
654
<emphasis>must</emphasis> be made non-readable by anyone
508
except the user running the server.
655
except the user starting the server (usually root).
511
658
As detailed in <xref linkend="checking"/>, the status of all
513
660
compromised if they are gone for too long.
516
If a client is compromised, its downtime should be duly noted
517
by the server which would therefore declare the client
518
invalid. But if the server was ever restarted, it would
519
re-read its client list from its configuration file and again
520
regard all clients therein as valid, and hence eligible to
521
receive their passwords. Therefore, be careful when
522
restarting servers if it is suspected that a client has, in
523
fact, been compromised by parties who may now be running a
524
fake Mandos client with the keys from the non-encrypted
525
initial RAM image of the client host. What should be done in
526
that case (if restarting the server program really is
527
necessary) is to stop the server program, edit the
528
configuration file to omit any suspect clients, and restart
532
663
For more details on client-side security, see
533
<citerefentry><refentrytitle>password-request</refentrytitle>
664
<citerefentry><refentrytitle>mandos-client</refentrytitle>
534
665
<manvolnum>8mandos</manvolnum></citerefentry>.
539
670
<refsect1 id="see_also">
540
671
<title>SEE ALSO</title>
543
<refentrytitle>mandos.conf</refentrytitle>
544
<manvolnum>5</manvolnum></citerefentry>, <citerefentry>
545
<refentrytitle>mandos-clients.conf</refentrytitle>
546
<manvolnum>5</manvolnum></citerefentry>, <citerefentry>
547
<refentrytitle>password-request</refentrytitle>
548
<manvolnum>8mandos</manvolnum></citerefentry>, <citerefentry>
549
<refentrytitle>sh</refentrytitle><manvolnum>1</manvolnum>
673
<citerefentry><refentrytitle>intro</refentrytitle>
674
<manvolnum>8mandos</manvolnum></citerefentry>,
675
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
676
<manvolnum>5</manvolnum></citerefentry>,
677
<citerefentry><refentrytitle>mandos.conf</refentrytitle>
678
<manvolnum>5</manvolnum></citerefentry>,
679
<citerefentry><refentrytitle>mandos-client</refentrytitle>
680
<manvolnum>8mandos</manvolnum></citerefentry>,
681
<citerefentry><refentrytitle>sh</refentrytitle>
682
<manvolnum>1</manvolnum></citerefentry>