/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to intro.xml

  • Committer: teddy at recompile
  • Date: 2020-02-05 21:39:28 UTC
  • Revision ID: teddy@recompile.se-20200205213928-vpvt0fwfg47ikv6f
Allow users to alter ask-password-mandos.service

If a user uses dracut with systemd and wishes to modify the options
passed to password-agent(8mandos) or mandos-client(8mandos), they
should be able to do so by simply creating a file
/etc/systemd/system/ask-password-mandos.service.d/override.conf,
containing, for instance:

[Service]
Environment=MANDOS_CLIENT_OPTIONS=--debug

Adding PASSWORD_AGENT_OPTIONS should also be possible (but should not
normally be needed).

* dracut-module/ask-password-mandos.service ([Service]/ExecStart): Add
  $PASSWORD_AGENT_OPTIONS before "--" and "$MANDOS_CLIENT_OPTIONS" to
  end of line.
* dracut-module/module-setup.sh (install): Install all files named
  /etc/systemd/system/ask-password-mandos.service.d/*.conf if any
  exists.  Also add --dh-params before $MANDOS_CLIENT_OPTIONS instead
  of at end of line.

Show diffs side-by-side

added added

removed removed

Lines of Context:
1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
 
<!ENTITY TIMESTAMP "2019-04-10">
 
4
<!ENTITY TIMESTAMP "2019-08-04">
5
5
<!ENTITY % common SYSTEM "common.ent">
6
6
%common;
7
7
]>
384
384
      plugin requirements.
385
385
    </para>
386
386
  </refsect1>
387
 
  
 
387
 
 
388
  <refsect1 id="systemd">
 
389
    <title>SYSTEMD</title>
 
390
    <para>
 
391
      More advanced startup systems like <citerefentry><refentrytitle
 
392
      >systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 
393
      already have their own plugin-like mechanisms for allowing
 
394
      multiple agents to independently retrieve a password and deliver
 
395
      it to the subsystem requesting a password to unlock the root
 
396
      file system.  On these systems, it would make no sense to run
 
397
      <citerefentry><refentrytitle>plugin-runner</refentrytitle
 
398
      ><manvolnum>8mandos</manvolnum></citerefentry>, the plugins of
 
399
      which would largely duplicate the work of (and conflict with)
 
400
      the existing systems prompting for passwords.
 
401
    </para>
 
402
    <para>
 
403
      As for <citerefentry><refentrytitle>systemd</refentrytitle
 
404
      ><manvolnum>1</manvolnum></citerefentry> in particular, it has
 
405
      its own <ulink
 
406
      url="https://www.freedesktop.org/wiki/Software/systemd/PasswordAgents/"
 
407
      >Password Agents</ulink> system.  Mandos uses this via its
 
408
      <citerefentry><refentrytitle>password-agent</refentrytitle
 
409
      ><manvolnum>8mandos</manvolnum></citerefentry> program, which
 
410
      is run instead of <citerefentry><refentrytitle
 
411
      >plugin-runner</refentrytitle><manvolnum>8mandos</manvolnum
 
412
      ></citerefentry> when <citerefentry><refentrytitle
 
413
      >systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 
414
      is used during system startup.
 
415
    </para>
 
416
  </refsect1>
388
417
  <refsect1 id="bugs">
389
418
    <title>BUGS</title>
390
419
    <xi:include href="bugs.xml"/>
405
434
      <manvolnum>8</manvolnum></citerefentry>,
406
435
      <citerefentry><refentrytitle>plugin-runner</refentrytitle>
407
436
      <manvolnum>8mandos</manvolnum></citerefentry>,
 
437
      <citerefentry><refentrytitle>password-agent</refentrytitle>
 
438
      <manvolnum>8mandos</manvolnum></citerefentry>,
408
439
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
409
440
      <manvolnum>8mandos</manvolnum></citerefentry>,
410
441
      <citerefentry><refentrytitle>password-prompt</refentrytitle>