/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos.conf.xml

  • Committer: Teddy Hogeborn
  • Date: 2024-09-09 01:36:41 UTC
  • Revision ID: teddy@recompile.se-20240909013641-6zu6kx2f7meu134k
Make all required directories when installing

When installing into a normal system, one can assume that target
directories, such as /usr/bin, already exists.  But when installing
into a subdirectory for the purpose of creating a package, one cannot
assume that all directories already exist.  Therefore, when
installing, we must not check if any directories exist, and must
instead always create any directories we want to install into.

* Makefile (confdir/mandos.conf, confdir/clients.conf, install-html):
  Use the "-D" option to "install" instead of creating the directory
  separately.
  (install-server): Move creation of $(CONFDIR) down to before it is
  needed.  Don't check if the $(TMPFILES) or $(SYSUSERS) directories
  exist; instead create them by using the "-D" option to "install".
  Create the $(PREFIX)/sbin directory.  Always use
  "--target-directory" if possible; i.e. if the file name is the same.
  Create the $(DBUSPOLICYDIR) and $(DESTDIR)/etc/init.d directories by
  using the "-D" option to "install".  Don't check if the $(SYSTEMD)
  directory exists; instead create it by using the "-D" option to
  "install".  Create the $(DESTDIR)/etc/default and $(MANDIR)/man8
  directories by using the "-D" option to "install".  Create the
  $(MANDIR)/man5 directories explicitly.
  (install-client-nokey): Remove unnecessary creation of the
  $(CONFDIR) directory.  Don't check if the $(SYSUSERS) directory
  exists; instead create it by using the "-D" option to "install".
  Move the "--directory" argument to be the first argument, for
  clarity.  Create the $(PREFIX)/sbin directory.  Use the "-D"
  argument to "install" when installing
  $(INITRAMFSTOOLS)/hooks/mandos,
  $(INITRAMFSTOOLS)/conf.d/mandos-conf,
  $(INITRAMFSTOOLS)/conf-hooks.d/zz-mandos,
  $(INITRAMFSTOOLS)/scripts/init-premount/mandos,
  $(INITRAMFSTOOLS)/scripts/local-premount/mandos,
  $(DRACUTMODULE)/ask-password-mandos.path, and
  $(DRACUTMODULE)/dracut-module/ask-password-mandos.service.  Create
  the $(MANDIR)/man8 directory.

Reported-By: Erich Eckner <erich@eckner.net>
Thanks: Erich Eckner <erich@eckner.net> for analysis

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos.conf.xml
1
 
<?xml version='1.0' encoding='UTF-8'?>
2
 
<?xml-stylesheet type="text/xsl"
3
 
        href="http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl"?>
 
1
<?xml version="1.0" encoding="UTF-8"?>
4
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
5
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
6
 
<!ENTITY VERSION "1.0">
7
4
<!ENTITY CONFNAME "mandos.conf">
8
5
<!ENTITY CONFPATH "<filename>/etc/mandos/mandos.conf</filename>">
 
6
<!ENTITY TIMESTAMP "2023-04-30">
 
7
<!ENTITY % common SYSTEM "common.ent">
 
8
%common;
9
9
]>
10
10
 
11
 
<refentry>
 
11
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
12
12
  <refentryinfo>
13
 
    <title>&CONFNAME;</title>
14
 
    <!-- NWalsh's docbook scripts use this to generate the footer: -->
15
 
    <productname>&CONFNAME;</productname>
16
 
    <productnumber>&VERSION;</productnumber>
 
13
    <title>Mandos Manual</title>
 
14
    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
 
15
    <productname>Mandos</productname>
 
16
    <productnumber>&version;</productnumber>
 
17
    <date>&TIMESTAMP;</date>
17
18
    <authorgroup>
18
19
      <author>
19
20
        <firstname>Björn</firstname>
20
21
        <surname>Påhlsson</surname>
21
22
        <address>
22
 
          <email>belorn@fukt.bsnet.se</email>
 
23
          <email>belorn@recompile.se</email>
23
24
        </address>
24
25
      </author>
25
26
      <author>
26
27
        <firstname>Teddy</firstname>
27
28
        <surname>Hogeborn</surname>
28
29
        <address>
29
 
          <email>teddy@fukt.bsnet.se</email>
 
30
          <email>teddy@recompile.se</email>
30
31
        </address>
31
32
      </author>
32
33
    </authorgroup>
33
34
    <copyright>
34
35
      <year>2008</year>
35
 
      <holder>Teddy Hogeborn &amp; Björn Påhlsson</holder>
 
36
      <year>2009</year>
 
37
      <year>2010</year>
 
38
      <year>2011</year>
 
39
      <year>2012</year>
 
40
      <year>2013</year>
 
41
      <year>2014</year>
 
42
      <year>2015</year>
 
43
      <year>2016</year>
 
44
      <year>2017</year>
 
45
      <year>2018</year>
 
46
      <year>2019</year>
 
47
      <holder>Teddy Hogeborn</holder>
 
48
      <holder>Björn Påhlsson</holder>
36
49
    </copyright>
37
 
    <legalnotice>
38
 
      <para>
39
 
        This manual page is free software: you can redistribute it
40
 
        and/or modify it under the terms of the GNU General Public
41
 
        License as published by the Free Software Foundation,
42
 
        either version 3 of the License, or (at your option) any
43
 
        later version.
44
 
      </para>
45
 
 
46
 
      <para>
47
 
        This manual page is distributed in the hope that it will
48
 
        be useful, but WITHOUT ANY WARRANTY; without even the
49
 
        implied warranty of MERCHANTABILITY or FITNESS FOR A
50
 
        PARTICULAR PURPOSE.  See the GNU General Public License
51
 
        for more details.
52
 
      </para>
53
 
 
54
 
      <para>
55
 
        You should have received a copy of the GNU General Public
56
 
        License along with this program; If not, see
57
 
        <ulink url="http://www.gnu.org/licenses/"/>.
58
 
      </para>
59
 
    </legalnotice>
 
50
    <xi:include href="legalnotice.xml"/>
60
51
  </refentryinfo>
61
 
 
 
52
  
62
53
  <refmeta>
63
54
    <refentrytitle>&CONFNAME;</refentrytitle>
64
55
    <manvolnum>5</manvolnum>
67
58
  <refnamediv>
68
59
    <refname><filename>&CONFNAME;</filename></refname>
69
60
    <refpurpose>
70
 
      Configuration file for Mandos
 
61
      Configuration file for the Mandos server
71
62
    </refpurpose>
72
63
  </refnamediv>
73
 
 
 
64
  
74
65
  <refsynopsisdiv>
75
 
    <synopsis>
76
 
      &CONFPATH;
77
 
    </synopsis>
 
66
    <synopsis>&CONFPATH;</synopsis>
78
67
  </refsynopsisdiv>
79
 
 
 
68
  
80
69
  <refsect1 id="description">
81
70
    <title>DESCRIPTION</title>
82
71
    <para>
83
 
      The file &CONFPATH; is a simple configuration file for mandos
84
 
      and is looked on at startup of the service. The configuration
85
 
      file must start with <literal>[server]</literal>. The format for
86
 
      the rest is a simple VAR = VALUE pair. Values may not be empty.
87
 
    </para>
88
 
 
89
 
    <para>
90
 
      The paramters are:
91
 
    </para>
92
 
 
 
72
      The file &CONFPATH; is a configuration file for
 
73
      <citerefentry><refentrytitle>mandos</refentrytitle>
 
74
      <manvolnum>8</manvolnum></citerefentry>, and is read by it at
 
75
      startup.  The configuration file starts with <quote><literal
 
76
      >[DEFAULT]</literal></quote> on a line by itself, followed by
 
77
      any number of <quote><varname><replaceable>option</replaceable
 
78
      ></varname>=<replaceable>value</replaceable></quote> entries,
 
79
      with continuations in the style of RFC 822.  <quote><varname
 
80
      ><replaceable>option</replaceable></varname>: <replaceable
 
81
      >value</replaceable></quote> is also accepted.  Note that
 
82
      leading whitespace is removed from values.  Lines beginning with
 
83
      <quote>#</quote> or <quote>;</quote> are ignored and may be used
 
84
      to provide comments.
 
85
    </para>
 
86
    
 
87
  </refsect1>
 
88
  <refsect1>
 
89
    <title>OPTIONS</title>
 
90
    
93
91
    <variablelist>
94
92
      <varlistentry>
95
 
        <term><literal>interface</literal></term>
96
 
        <listitem>
97
 
          <para>
98
 
            This option allows you to override the default network
99
 
            interfaces. By default mandos will not bind to any
100
 
            specific interface but instead use default avahi-server
101
 
            behaviour.
102
 
          </para>
103
 
        </listitem>
104
 
      </varlistentry>
105
 
 
106
 
      <varlistentry>
107
 
        <term><literal>address</literal></term>
108
 
        <listitem>
109
 
          <para>
110
 
            This option allows you to override the default network
111
 
            address. By default mandos will not bind to any
112
 
            specific address but instead use default avahi-server
113
 
            behaviour.
114
 
          </para>
115
 
        </listitem>
116
 
      </varlistentry>      
117
 
 
118
 
      <varlistentry>
119
 
        <term><literal>port</literal></term>
120
 
        <listitem>
121
 
          <para>
122
 
            This option allows you to override the default port to
123
 
            listen on. By default mandos will not specify any specific
124
 
            port and instead use a random port given by the OS from
125
 
            the use of INADDR_ANY.
126
 
          </para>
127
 
        </listitem>
128
 
      </varlistentry>
129
 
 
130
 
      <varlistentry>
131
 
        <term><literal>debug</literal></term>
132
 
        <listitem>
133
 
          <para>
134
 
            This option allows you to modify debug mode with a true/false
135
 
            boolean value. By default is debug set to <literal>false</literal>.
136
 
          </para>
137
 
        </listitem>
138
 
      </varlistentry>      
139
 
 
140
 
      <varlistentry>
141
 
        <term><literal>priority</literal></term>
142
 
        <listitem>
143
 
          <para>
144
 
            This option allows you to override the default gnutls
145
 
            priority that will be used in gnutls session. See
146
 
            <citerefentry><refentrytitle>gnutls_priority_init
147
 
            </refentrytitle><manvolnum>3</manvolnum></citerefentry>for
148
 
            more information on gnutls priority strings.
149
 
          </para>         
150
 
        </listitem>
151
 
      </varlistentry>
152
 
 
153
 
      <varlistentry>
154
 
        <term><literal>servicename</literal></term>
155
 
        <listitem>
156
 
          <para>
157
 
            This option allows you to override the default Zeroconf
158
 
            service name use to announce mandos as a avahi service. By
159
 
            default mandos will use "Mandos".
160
 
          </para>
 
93
        <term><option>interface<literal> = </literal><replaceable
 
94
        >NAME</replaceable></option></term>
 
95
        <listitem>
 
96
          <xi:include href="mandos-options.xml" xpointer="interface"/>
 
97
        </listitem>
 
98
      </varlistentry>
 
99
      
 
100
      <varlistentry>
 
101
        <term><option>address<literal> = </literal><replaceable
 
102
          >ADDRESS</replaceable></option></term>
 
103
        <listitem>
 
104
          <xi:include href="mandos-options.xml" xpointer="address"/>
 
105
        </listitem>
 
106
      </varlistentry>
 
107
      
 
108
      <varlistentry>
 
109
        <term><option>port<literal> = </literal><replaceable
 
110
        >NUMBER</replaceable></option></term>
 
111
        <listitem>
 
112
          <xi:include href="mandos-options.xml" xpointer="port"/>
 
113
        </listitem>
 
114
      </varlistentry>
 
115
      
 
116
      <varlistentry>
 
117
        <term><option>debug<literal> = </literal>{ <literal
 
118
          >1</literal> | <literal>yes</literal> | <literal
 
119
          >true</literal> | <literal>on</literal> | <literal
 
120
          >0</literal> | <literal>no</literal> | <literal
 
121
          >false</literal> | <literal>off</literal> }</option></term>
 
122
        <listitem>
 
123
          <xi:include href="mandos-options.xml" xpointer="debug"/>
 
124
        </listitem>
 
125
      </varlistentry>
 
126
      
 
127
      <varlistentry>
 
128
        <term><option>priority<literal> = </literal><replaceable
 
129
        >STRING</replaceable></option></term>
 
130
        <listitem>
 
131
          <xi:include href="mandos-options.xml" xpointer="priority"/>
 
132
        </listitem>
 
133
      </varlistentry>
 
134
      
 
135
      <varlistentry>
 
136
        <term><option>servicename<literal> = </literal
 
137
        ><replaceable>NAME</replaceable></option></term>
 
138
        <listitem>
 
139
          <xi:include href="mandos-options.xml"
 
140
                      xpointer="servicename"/>
 
141
        </listitem>
 
142
      </varlistentry>
 
143
      
 
144
      <varlistentry>
 
145
        <term><option>use_dbus<literal> = </literal>{ <literal
 
146
          >1</literal> | <literal>yes</literal> | <literal
 
147
          >true</literal> | <literal>on</literal> | <literal
 
148
          >0</literal> | <literal>no</literal> | <literal
 
149
          >false</literal> | <literal>off</literal> }</option></term>
 
150
        <listitem>
 
151
          <xi:include href="mandos-options.xml" xpointer="dbus"/>
 
152
        </listitem>
 
153
      </varlistentry>
 
154
      
 
155
      <varlistentry>
 
156
        <term><option>use_ipv6<literal> = </literal>{ <literal
 
157
          >1</literal> | <literal>yes</literal> | <literal
 
158
          >true</literal> | <literal>on</literal> | <literal
 
159
          >0</literal> | <literal>no</literal> | <literal
 
160
          >false</literal> | <literal>off</literal> }</option></term>
 
161
        <listitem>
 
162
          <xi:include href="mandos-options.xml" xpointer="ipv6"/>
 
163
        </listitem>
 
164
      </varlistentry>
 
165
      
 
166
      <varlistentry>
 
167
        <term><option>restore<literal> = </literal>{ <literal
 
168
          >1</literal> | <literal>yes</literal> | <literal
 
169
          >true</literal> | <literal>on</literal> | <literal
 
170
          >0</literal> | <literal>no</literal> | <literal
 
171
          >false</literal> | <literal>off</literal> }</option></term>
 
172
        <listitem>
 
173
          <xi:include href="mandos-options.xml" xpointer="restore"/>
 
174
        </listitem>
 
175
      </varlistentry>
 
176
      
 
177
      <varlistentry>
 
178
        <term><option>statedir<literal> = </literal><replaceable
 
179
        >DIRECTORY</replaceable></option></term>
 
180
        <listitem>
 
181
          <xi:include href="mandos-options.xml" xpointer="statedir"/>
 
182
        </listitem>
 
183
      </varlistentry>
 
184
      
 
185
      <varlistentry>
 
186
        <term><option>socket<literal> = </literal><replaceable
 
187
        >NUMBER</replaceable></option></term>
 
188
        <listitem>
 
189
          <xi:include href="mandos-options.xml" xpointer="socket"/>
161
190
        </listitem>
162
191
      </varlistentry>
163
192
      
164
193
    </variablelist>
165
194
  </refsect1>
166
 
 
167
 
  <refsect1 id="examples">
168
 
    <title>EXAMPLES</title>
169
 
    <informalexample>
170
 
      <programlisting>
171
 
        [server]
172
 
        # A configuration example
173
 
        interface = eth0 
174
 
        address = 2001:DB8:
175
 
        port = 1025 
176
 
        debug = true 
177
 
        priority = SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP
178
 
        servicename = Mandos
179
 
      </programlisting>
180
 
    </informalexample>
181
 
  </refsect1>  
182
195
  
183
196
  <refsect1 id="files">
184
197
    <title>FILES</title>
186
199
      The file described here is &CONFPATH;
187
200
    </para>
188
201
  </refsect1>
 
202
  
 
203
  <refsect1 id="bugs">
 
204
    <title>BUGS</title>
 
205
    <para>
 
206
      The <literal>[DEFAULT]</literal> is necessary because the Python
 
207
      built-in module <systemitem class="library">ConfigParser</systemitem>
 
208
      requires it.
 
209
    </para>
 
210
    <xi:include href="bugs.xml"/>
 
211
  </refsect1>
 
212
  
 
213
  <refsect1 id="example">
 
214
    <title>EXAMPLE</title>
 
215
    <informalexample>
 
216
      <para>
 
217
        No options are actually required:
 
218
      </para>
 
219
      <programlisting>
 
220
[DEFAULT]
 
221
      </programlisting>
 
222
    </informalexample>
 
223
    <informalexample>
 
224
      <para>
 
225
        An example using all the options:
 
226
      </para>
 
227
      <programlisting>
 
228
[DEFAULT]
 
229
# A configuration example
 
230
interface = enp1s0
 
231
address = fe80::aede:48ff:fe71:f6f2
 
232
port = 1025
 
233
debug = True
 
234
priority = SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA:!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA
 
235
servicename = Daena
 
236
use_dbus = False
 
237
use_ipv6 = True
 
238
restore = True
 
239
statedir = /var/lib/mandos
 
240
      </programlisting>
 
241
    </informalexample>
 
242
  </refsect1>
 
243
  
 
244
  <refsect1 id="see_also">
 
245
    <title>SEE ALSO</title>
 
246
    <para>
 
247
      <citerefentry><refentrytitle>intro</refentrytitle>
 
248
      <manvolnum>8mandos</manvolnum></citerefentry>,
 
249
      <citerefentry><refentrytitle>gnutls_priority_init</refentrytitle
 
250
      ><manvolnum>3</manvolnum></citerefentry>,
 
251
      <citerefentry><refentrytitle>mandos</refentrytitle>
 
252
      <manvolnum>8</manvolnum></citerefentry>,
 
253
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
 
254
      <manvolnum>5</manvolnum></citerefentry>
 
255
    </para>
 
256
    
 
257
    <variablelist>
 
258
      <varlistentry>
 
259
        <term>
 
260
          RFC 4291: <citetitle>IP Version 6 Addressing
 
261
          Architecture</citetitle>
 
262
        </term>
 
263
        <listitem>
 
264
          <variablelist>
 
265
            <varlistentry>
 
266
              <term>Section 2.2: <citetitle>Text Representation of
 
267
              Addresses</citetitle></term>
 
268
              <listitem><para/></listitem>
 
269
            </varlistentry>
 
270
            <varlistentry>
 
271
              <term>Section 2.5.5.2: <citetitle>IPv4-Mapped IPv6
 
272
              Address</citetitle></term>
 
273
              <listitem><para/></listitem>
 
274
            </varlistentry>
 
275
            <varlistentry>
 
276
            <term>Section 2.5.6, <citetitle>Link-Local IPv6 Unicast
 
277
            Addresses</citetitle></term>
 
278
            <listitem>
 
279
              <para>
 
280
                The clients use IPv6 link-local addresses, which are
 
281
                immediately usable since a link-local addresses is
 
282
                automatically assigned to a network interface when it
 
283
                is brought up.
 
284
              </para>
 
285
            </listitem>
 
286
            </varlistentry>
 
287
          </variablelist>
 
288
        </listitem>
 
289
      </varlistentry>
 
290
      <varlistentry>
 
291
        <term>
 
292
          <ulink url="http://www.zeroconf.org/">Zeroconf</ulink>
 
293
        </term>
 
294
        <listitem>
 
295
          <para>
 
296
            Zeroconf is the network protocol standard used by clients
 
297
            for finding the Mandos server on the local network.
 
298
          </para>
 
299
        </listitem>
 
300
      </varlistentry>
 
301
    </variablelist>
 
302
  </refsect1>
189
303
</refentry>
 
304
<!-- Local Variables: -->
 
305
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
 
306
<!-- time-stamp-end: "[\"']>" -->
 
307
<!-- time-stamp-format: "%:y-%02m-%02d" -->
 
308
<!-- End: -->