/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-ctl.xml

  • Committer: Teddy Hogeborn
  • Date: 2019-08-02 22:16:53 UTC
  • Revision ID: teddy@recompile.se-20190802221653-ic1iko9hbefzwsk7
Fix bug in server Debian package: Fails to start on first install

There has been a very long-standing bug where installation of the
server (the "mandos" Debian package) would fail to start the server
properly right after installation.  It would work on manual (re)start
after installation, or after reboot, and even after package purge and
reinstall, it would then work the first time.  The problem, it turns
out, is when the new "_mandos" user (and corresponding group) is
created, the D-Bus server is not reloaded, and is therefore not aware
of that user, and does not recognize the user and group name in the
/etc/dbus-1/system.d/mandos.conf file.  The Mandos server, when it
tries to start and access the D-Bus, is then not permitted to connect
to its D-Bus bus name, and disables D-Bus use as a fallback measure;
i.e. the server works, but it is not controllable via D-Bus commands
(via mandos-ctl or mandos-monitor).  The next time the D-Bus daemon is
reloaded for any reason, the new user & group would become visible to
the D-Bus daemon and after that, any restart of the Mandos server
would succeed and it would bind to its D-Bus name properly, and
thereby be visible and controllable by mandos-ctl & mandos-monitor.
This was mostly invisible when using sysvinit, but systemd makes the
problem visible since the systemd service file for the Mandos server
is configured to not consider the Mandos server "started" until the
D-Bus name has been bound; this makes the starting of the service wait
for 90 seconds and then fail with a timeout error.

Fixing this should also make the Debian CI autopkgtest tests work.

* debian/mandos.postinst (configure): After creating (or renaming)
                                      user & group, reload D-Bus
                                      daemon (if present).

Show diffs side-by-side

added added

removed removed

Lines of Context:
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY COMMANDNAME "mandos-ctl">
5
 
<!ENTITY TIMESTAMP "2011-08-08">
 
5
<!ENTITY TIMESTAMP "2019-07-29">
6
6
<!ENTITY % common SYSTEM "common.ent">
7
7
%common;
8
8
]>
19
19
        <firstname>Björn</firstname>
20
20
        <surname>Påhlsson</surname>
21
21
        <address>
22
 
          <email>belorn@fukt.bsnet.se</email>
 
22
          <email>belorn@recompile.se</email>
23
23
        </address>
24
24
      </author>
25
25
      <author>
26
26
        <firstname>Teddy</firstname>
27
27
        <surname>Hogeborn</surname>
28
28
        <address>
29
 
          <email>teddy@fukt.bsnet.se</email>
 
29
          <email>teddy@recompile.se</email>
30
30
        </address>
31
31
      </author>
32
32
    </authorgroup>
33
33
    <copyright>
34
34
      <year>2010</year>
35
35
      <year>2011</year>
 
36
      <year>2012</year>
 
37
      <year>2013</year>
 
38
      <year>2014</year>
 
39
      <year>2015</year>
 
40
      <year>2016</year>
 
41
      <year>2017</year>
 
42
      <year>2018</year>
 
43
      <year>2019</year>
36
44
      <holder>Teddy Hogeborn</holder>
37
45
      <holder>Björn Påhlsson</holder>
38
46
    </copyright>
47
55
  <refnamediv>
48
56
    <refname><command>&COMMANDNAME;</command></refname>
49
57
    <refpurpose>
50
 
      Control the operation of the Mandos server
 
58
      Control or query the operation of the Mandos server
51
59
    </refpurpose>
52
60
  </refnamediv>
53
61
  
55
63
    <cmdsynopsis>
56
64
      <command>&COMMANDNAME;</command>
57
65
      <group>
58
 
        <arg choice="plain"><option>--enable</option></arg>
59
 
        <arg choice="plain"><option>-e</option></arg>
60
 
        <sbr/>
61
 
        <arg choice="plain"><option>--disable</option></arg>
62
 
        <arg choice="plain"><option>-d</option></arg>
63
 
      </group>
64
 
      <sbr/>
65
 
      <group>
66
 
        <arg choice="plain"><option>--bump-timeout</option></arg>
67
 
        <arg choice="plain"><option>-b</option></arg>
68
 
      </group>
69
 
      <sbr/>
70
 
      <group>
71
 
        <arg choice="plain"><option>--start-checker</option></arg>
72
 
      </group>
73
 
      <sbr/>
74
 
      <group>
75
 
        <arg choice="plain"><option>--stop-checker</option></arg>
76
 
      </group>
77
 
      <sbr/>
78
 
      <group>
79
 
        <arg choice="plain"><option>--remove</option></arg>
80
 
        <arg choice="plain"><option>-r</option></arg>
81
 
      </group>
82
 
      <sbr/>
83
 
      <group>
84
 
        <arg choice="plain"><option>--checker
85
 
        <replaceable>COMMAND</replaceable></option></arg>
86
 
        <arg choice="plain"><option>-c
87
 
        <replaceable>COMMAND</replaceable></option></arg>
88
 
      </group>
89
 
      <sbr/>
90
 
      <group>
91
 
        <arg choice="plain"><option>--timeout
92
 
        <replaceable>TIME</replaceable></option></arg>
93
 
        <arg choice="plain"><option>-t
94
 
        <replaceable>TIME</replaceable></option></arg>
95
 
      </group>
96
 
      <sbr/>
97
 
      <group>
98
 
        <arg choice="plain"><option>--interval
99
 
        <replaceable>TIME</replaceable></option></arg>
100
 
        <arg choice="plain"><option>-i
101
 
        <replaceable>TIME</replaceable></option></arg>
102
 
      </group>
103
 
      <sbr/>
104
 
      <group>
105
 
        <arg choice="plain"><option>--approve-by-default</option
106
 
        ></arg>
107
 
        <sbr/>
108
 
        <arg choice="plain"><option>--deny-by-default</option></arg>
109
 
      </group>
110
 
      <sbr/>
111
 
      <group>
112
 
        <arg choice="plain"><option>--approval-delay
113
 
        <replaceable>TIME</replaceable></option></arg>
114
 
      </group>
115
 
      <sbr/>
116
 
      <group>
117
 
        <arg choice="plain"><option>--approval-duration
118
 
        <replaceable>TIME</replaceable></option></arg>
119
 
      </group>
120
 
      <sbr/>
121
 
      <group>
122
 
        <arg choice="plain"><option>--interval
123
 
        <replaceable>TIME</replaceable></option></arg>
124
 
        <arg choice="plain"><option>-i
125
 
        <replaceable>TIME</replaceable></option></arg>
126
 
      </group>
127
 
      <sbr/>
128
 
      <group>
129
 
        <arg choice="plain"><option>--host
130
 
        <replaceable>STRING</replaceable></option></arg>
131
 
        <arg choice="plain"><option>-H
132
 
        <replaceable>STRING</replaceable></option></arg>
133
 
      </group>
134
 
      <sbr/>
135
 
      <group>
136
 
        <arg choice="plain"><option>--secret
137
 
        <replaceable>FILENAME</replaceable></option></arg>
138
 
        <arg choice="plain"><option>-s
139
 
        <replaceable>FILENAME</replaceable></option></arg>
140
 
      </group>
141
 
      <sbr/>
142
 
      <group>
143
 
        <arg choice="plain"><option>--approve</option></arg>
144
 
        <arg choice="plain"><option>-A</option></arg>
145
 
        <sbr/>
 
66
          <arg choice="plain"><option>--verbose</option></arg>
 
67
          <arg choice="plain"><option>-v</option></arg>
 
68
          <sbr/>
 
69
          <arg choice="plain"><option>--dump-json</option></arg>
 
70
          <arg choice="plain"><option>-j</option></arg>
 
71
      </group>
 
72
      <arg><option>--debug</option></arg>
 
73
      <group>
 
74
        <arg rep='repeat' choice='plain'>
 
75
          <replaceable>CLIENT</replaceable>
 
76
        </arg>
 
77
      </group>
 
78
    </cmdsynopsis>
 
79
    <cmdsynopsis>
 
80
      <command>&COMMANDNAME;</command>
 
81
      <group choice="req">
 
82
        <group>
 
83
          <arg choice="plain"><option>--enable</option></arg>
 
84
          <arg choice="plain"><option>-e</option></arg>
 
85
          <sbr/>
 
86
          <arg choice="plain"><option>--disable</option></arg>
 
87
          <arg choice="plain"><option>-d</option></arg>
 
88
        </group>
 
89
        <sbr/>
 
90
        <group>
 
91
          <arg choice="plain"><option>--bump-timeout</option></arg>
 
92
          <arg choice="plain"><option>-b</option></arg>
 
93
        </group>
 
94
        <sbr/>
 
95
        <group>
 
96
          <arg choice="plain"><option>--start-checker</option></arg>
 
97
          <arg choice="plain"><option>--stop-checker</option></arg>
 
98
        </group>
 
99
        <sbr/>
 
100
        <group>
 
101
          <arg choice="plain"><option>--checker
 
102
          <replaceable>COMMAND</replaceable></option></arg>
 
103
          <arg choice="plain"><option>-c
 
104
          <replaceable>COMMAND</replaceable></option></arg>
 
105
        </group>
 
106
        <sbr/>
 
107
        <group>
 
108
          <arg choice="plain"><option>--timeout
 
109
          <replaceable>TIME</replaceable></option></arg>
 
110
          <arg choice="plain"><option>-t
 
111
          <replaceable>TIME</replaceable></option></arg>
 
112
        </group>
 
113
        <sbr/>
 
114
        <group>
 
115
          <arg choice="plain"><option>--extended-timeout
 
116
          <replaceable>TIME</replaceable></option></arg>
 
117
        </group>
 
118
        <sbr/>
 
119
        <group>
 
120
          <arg choice="plain"><option>--interval
 
121
          <replaceable>TIME</replaceable></option></arg>
 
122
          <arg choice="plain"><option>-i
 
123
          <replaceable>TIME</replaceable></option></arg>
 
124
        </group>
 
125
        <sbr/>
 
126
        <group>
 
127
          <arg choice="plain"><option>--approve-by-default</option
 
128
          ></arg>
 
129
          <sbr/>
 
130
          <arg choice="plain"><option>--deny-by-default</option></arg>
 
131
        </group>
 
132
        <sbr/>
 
133
        <group>
 
134
          <arg choice="plain"><option>--approval-delay
 
135
          <replaceable>TIME</replaceable></option></arg>
 
136
        </group>
 
137
        <sbr/>
 
138
        <group>
 
139
          <arg choice="plain"><option>--approval-duration
 
140
          <replaceable>TIME</replaceable></option></arg>
 
141
        </group>
 
142
        <sbr/>
 
143
        <group>
 
144
          <arg choice="plain"><option>--host
 
145
          <replaceable>STRING</replaceable></option></arg>
 
146
          <arg choice="plain"><option>-H
 
147
          <replaceable>STRING</replaceable></option></arg>
 
148
        </group>
 
149
        <sbr/>
 
150
        <group>
 
151
          <arg choice="plain"><option>--secret
 
152
          <replaceable>FILENAME</replaceable></option></arg>
 
153
          <arg choice="plain"><option>-s
 
154
          <replaceable>FILENAME</replaceable></option></arg>
 
155
        </group>
 
156
        <sbr/>
 
157
        <group>
 
158
          <arg choice="plain"><option>--approve</option></arg>
 
159
          <arg choice="plain"><option>-A</option></arg>
 
160
          <sbr/>
 
161
          <arg choice="plain"><option>--deny</option></arg>
 
162
          <arg choice="plain"><option>-D</option></arg>
 
163
        </group>
 
164
      </group>
 
165
      <sbr/>
 
166
      <arg><option>--debug</option></arg>
 
167
      <group choice="req">
 
168
        <arg choice="plain"><option>--all</option></arg>
 
169
        <arg choice="plain"><option>-a</option></arg>
 
170
        <arg rep='repeat' choice='plain'>
 
171
          <replaceable>CLIENT</replaceable>
 
172
        </arg>
 
173
      </group>
 
174
    </cmdsynopsis>
 
175
    <cmdsynopsis>
 
176
      <command>&COMMANDNAME;</command>
 
177
      <group>
146
178
        <arg choice="plain"><option>--deny</option></arg>
147
179
        <arg choice="plain"><option>-D</option></arg>
148
180
      </group>
 
181
      <group choice="req">
 
182
          <arg choice="plain"><option>--remove</option></arg>
 
183
          <arg choice="plain"><option>-r</option></arg>
 
184
      </group>
149
185
      <sbr/>
 
186
      <arg><option>--debug</option></arg>
150
187
      <group choice="req">
151
188
        <arg choice="plain"><option>--all</option></arg>
152
189
        <arg choice="plain"><option>-a</option></arg>
157
194
    </cmdsynopsis>
158
195
    <cmdsynopsis>
159
196
      <command>&COMMANDNAME;</command>
160
 
      <group>
161
 
        <arg choice="plain"><option>--verbose</option></arg>
162
 
        <arg choice="plain"><option>-v</option></arg>
163
 
      </group>
164
 
      <group>
165
 
        <arg rep='repeat' choice='plain'>
166
 
          <replaceable>CLIENT</replaceable>
167
 
        </arg>
168
 
      </group>
169
 
    </cmdsynopsis>
170
 
    <cmdsynopsis>
171
 
      <command>&COMMANDNAME;</command>
172
197
      <group choice="req">
173
198
        <arg choice="plain"><option>--is-enabled</option></arg>
174
199
        <arg choice="plain"><option>-V</option></arg>
175
200
      </group>
 
201
      <arg><option>--debug</option></arg>
176
202
      <arg choice='plain'><replaceable>CLIENT</replaceable></arg>
177
203
    </cmdsynopsis>
178
204
    <cmdsynopsis>
189
215
        <arg choice="plain"><option>-v</option></arg>
190
216
      </group>
191
217
    </cmdsynopsis>
 
218
    <cmdsynopsis>
 
219
      <command>&COMMANDNAME;</command>
 
220
      <arg choice="plain"><option>--check</option></arg>
 
221
    </cmdsynopsis>
192
222
  </refsynopsisdiv>
193
223
  
194
224
  <refsect1 id="description">
195
225
    <title>DESCRIPTION</title>
196
226
    <para>
197
 
      <command>&COMMANDNAME;</command> is a program to control the
198
 
      operation of the Mandos server <citerefentry><refentrytitle
199
 
      >mandos</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
 
227
      <command>&COMMANDNAME;</command> is a program to control or
 
228
      query the operation of the Mandos server
 
229
      <citerefentry><refentrytitle>mandos</refentrytitle><manvolnum
 
230
      >8</manvolnum></citerefentry>.
200
231
    </para>
201
232
    <para>
202
233
      This program can be used to change client settings, approve or
318
349
          </para>
319
350
        </listitem>
320
351
      </varlistentry>
 
352
 
 
353
      <varlistentry>
 
354
        <term><option>--extended-timeout
 
355
        <replaceable>TIME</replaceable></option></term>
 
356
        <listitem>
 
357
          <para>
 
358
            Set the <varname>extended_timeout</varname> option of the
 
359
            specified client(s); see <citerefentry><refentrytitle
 
360
            >mandos-clients.conf</refentrytitle><manvolnum
 
361
            >5</manvolnum></citerefentry>.
 
362
          </para>
 
363
        </listitem>
 
364
      </varlistentry>
321
365
      
322
366
      <varlistentry>
323
367
        <term><option>--interval
447
491
      </varlistentry>
448
492
      
449
493
      <varlistentry>
 
494
        <term><option>--dump-json</option></term>
 
495
        <term><option>-j</option></term>
 
496
        <listitem>
 
497
          <para>
 
498
            Dump client settings as JSON to standard output.
 
499
          </para>
 
500
        </listitem>
 
501
      </varlistentry>
 
502
      
 
503
      <varlistentry>
450
504
        <term><option>--is-enabled</option></term>
451
505
        <term><option>-V</option></term>
452
506
        <listitem>
457
511
        </listitem>
458
512
      </varlistentry>
459
513
      
 
514
      <varlistentry>
 
515
        <term><option>--debug</option></term>
 
516
        <listitem>
 
517
          <para>
 
518
            Show debug output; currently, this means show D-Bus calls.
 
519
          </para>
 
520
        </listitem>
 
521
      </varlistentry>
 
522
      
 
523
      <varlistentry>
 
524
        <term><option>--check</option></term>
 
525
        <listitem>
 
526
          <para>
 
527
            Run self-tests.  This includes any unit tests, etc.
 
528
          </para>
 
529
        </listitem>
 
530
      </varlistentry>
 
531
      
460
532
    </variablelist>
461
533
  </refsect1>
462
534
  
478
550
    </para>
479
551
  </refsect1>
480
552
  
481
 
<!--   <refsect1 id="bugs"> -->
482
 
<!--     <title>BUGS</title> -->
483
 
<!--     <para> -->
484
 
<!--     </para> -->
485
 
<!--   </refsect1> -->
 
553
  <refsect1 id="bugs">
 
554
    <title>BUGS</title>
 
555
    <xi:include href="bugs.xml"/>
 
556
  </refsect1>
486
557
  
487
558
  <refsect1 id="example">
488
559
    <title>EXAMPLE</title>
 
560
    <!-- Name of test methods in class Test_commands_from_options are
 
561
         written in comments below.  When adding an example, add a
 
562
         test too which tests the documented behavior. -->
489
563
    <informalexample>
 
564
      <!-- Test method: test_manual_page_example_1() -->
490
565
      <para>
491
566
        To list all clients:
492
567
      </para>
496
571
    </informalexample>
497
572
    
498
573
    <informalexample>
 
574
      <!-- Test method: test_manual_page_example_2() -->
499
575
      <para>
500
576
        To list <emphasis>all</emphasis> settings for the clients
501
577
        named <quote>foo1.example.org</quote> and <quote
510
586
    </informalexample>
511
587
    
512
588
    <informalexample>
 
589
      <!-- Test method: test_manual_page_example_3() -->
513
590
      <para>
514
591
        To enable all clients:
515
592
      </para>
519
596
    </informalexample>
520
597
    
521
598
    <informalexample>
 
599
      <!-- Test method: test_manual_page_example_4() -->
522
600
      <para>
523
601
        To change timeout and interval value for the clients
524
602
        named <quote>foo1.example.org</quote> and <quote
527
605
      <para>
528
606
 
529
607
<!-- do not wrap this line -->
530
 
<userinput>&COMMANDNAME; --timeout="5m" --interval="1m" foo1.example.org foo2.example.org</userinput>
 
608
<userinput>&COMMANDNAME; --timeout=PT5M --interval=PT1M foo1.example.org foo2.example.org</userinput>
531
609
 
532
610
      </para>
533
611
    </informalexample>
534
612
    
535
613
    <informalexample>
 
614
      <!-- Test method: test_manual_page_example_5() -->
536
615
      <para>
537
 
        To approve all clients currently waiting for it:
 
616
        To approve all clients currently waiting for approval:
538
617
      </para>
539
618
      <para>
540
619
        <userinput>&COMMANDNAME; --approve --all</userinput>