/mandos/trunk : revision 130

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos.xml

Committer: Teddy Hogeborn
Date: 2008-08-31 14:02:37 UTC
Revision ID: teddy@fukt.bsnet.se-20080831140237-oz9knd88esz8cj4y

* plugin-runner.xml: Removed <?xml-stylesheet>.
* plugins.d/password-request.xml: - '' -

Show diffs side-by-side

added added

removed removed

mandos.xml

<?xml version='1.0' encoding='UTF-8'?>

<?xml-stylesheet type="text/xsl"

href="http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl"?>

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

<!ENTITY VERSION "1.0">

<!ENTITY COMMANDNAME "mandos">

<!ENTITY TIMESTAMP "2008-08-31">

<title>&COMMANDNAME;</title>

<productname>&COMMANDNAME;</productname>

<title>Mandos Manual</title>

<productname>Mandos</productname>

<productnumber>&VERSION;</productnumber>

<date>&TIMESTAMP;</date>

<firstname>Björn</firstname>

<refname><command>&COMMANDNAME;</command></refname>

Sends encrypted passwords to authenticated Mandos clients

Gives encrypted passwords to authenticated Mandos clients

</refpurpose>

</refnamediv>

<command>&COMMANDNAME;</command>

<arg choice='opt'>--interface<arg choice='plain'>IF</arg></arg>

<arg choice='opt'>--address<arg choice='plain'>ADDRESS</arg></arg>

<arg choice='opt'>--priority<arg choice='plain'>PRIORITY</arg></arg>

<arg choice='opt'>--servicename<arg choice='plain'>NAME</arg></arg>

<arg choice='opt'>--configdir<arg choice='plain'>DIRECTORY</arg></arg>

<arg choice='opt'>--debug</arg>

</cmdsynopsis>

<command>&COMMANDNAME;</command>

<arg choice='opt'>-a<arg choice='plain'>ADDRESS</arg></arg>

<arg choice='opt'>--priority<arg choice='plain'>PRIORITY</arg></arg>

<arg choice='opt'>--servicename<arg choice='plain'>NAME</arg></arg>

<arg choice='opt'>--configdir<arg choice='plain'>DIRECTORY</arg></arg>

<arg choice='opt'>--debug</arg>

</cmdsynopsis>

<command>&COMMANDNAME;</command>

</cmdsynopsis>

100

<command>&COMMANDNAME;</command>

101

<arg choice='plain'>--version</arg>

102

</cmdsynopsis>

103

104

<command>&COMMANDNAME;</command>

105

<arg choice='plain'>--check</arg>

106

</cmdsynopsis>

<group>

<arg choice="plain"><option>--interface

<arg choice="plain"><option>-i

</group>

<sbr/>

<group>

<arg choice="plain"><option>--address

<replaceable>ADDRESS</replaceable></option></arg>

<arg choice="plain"><option>-a

<replaceable>ADDRESS</replaceable></option></arg>

</group>

<sbr/>

<group>

<arg choice="plain"><option>--port

<arg choice="plain"><option>-p

</group>

<sbr/>

<arg><option>--priority

<replaceable>PRIORITY</replaceable></option></arg>

100

<sbr/>

101

<arg><option>--servicename

102

103

<sbr/>

104

<arg><option>--configdir

105

<replaceable>DIRECTORY</replaceable></option></arg>

106

<sbr/>

107

<arg><option>--debug</option></arg>

108

</cmdsynopsis>

109

110

<command>&COMMANDNAME;</command>

111

112

113

114

</group>

115

</cmdsynopsis>

116

117

<command>&COMMANDNAME;</command>

118

<arg choice="plain"><option>--version</option></arg>

119

</cmdsynopsis>

120

121

<command>&COMMANDNAME;</command>

122

<arg choice="plain"><option>--check</option></arg>

123

</cmdsynopsis>

107

124

</refsynopsisdiv>

108

125

109

126

112

129

<command>&COMMANDNAME;</command> is a server daemon which

113

130

handles incoming request for passwords for a pre-defined list of

114

131

client host computers. The Mandos server uses Zeroconf to

115

announce itself on the local network, and uses GnuTLS to

116

communicate securely with and to authenticate the clients.

117

Mandos uses IPv6 link-local addresses, since the clients are

118

assumed to not have any other addresses configured yet. Any

119

authenticated client is then given the pre-encrypted password

120

for that specific client.

132

announce itself on the local network, and uses TLS to

133

communicate securely with and to authenticate the clients. The

134

Mandos server uses IPv6 to allow Mandos clients to use IPv6

135

link-local addresses, since the clients will probably not have

136

any other addresses configured (see <xref linkend="overview"/>).

137

Any authenticated client is then given the stored pre-encrypted

138

password for that specific client.

121

139

</para>

122

140

123

</refsect1>

141

</refsect1>

124

142

125

143

126

144

<title>PURPOSE</title>

127

145

128

146

<para>

129

147

The purpose of this is to enable <emphasis>remote and unattended

130

rebooting</emphasis> of any client host computer with an

131

<emphasis>encrypted root file system</emphasis>. The client

132

host computer should start a Mandos client in the initial RAM

133

disk environment, the Mandos client program communicates with

134

this server program to get an encrypted password, which is then

135

decrypted and used to unlock the encrypted root file system.

136

The client host computer can then continue its boot sequence

137

normally.

148

rebooting</emphasis> of client host computer with an

149

<emphasis>encrypted root file system</emphasis>. See <xref

150

linkend="overview"/> for details.

138

151

</para>

139

140

</refsect1>

152

153

</refsect1>

141

154

142

155

143

156

<title>OPTIONS</title>

144

157

145

158

146

159

147

160

161

148

162

149

163

<para>

150

164

Show a help message and exit

151

165

</para>

152

166

</listitem>

153

167

</varlistentry>

154

155

156

<term><literal>-i</literal>, <literal>--interface <replaceable>

157

IF</replaceable></literal></term>

158

159

<para>

160

Only announce the server and listen to requests on network

161

interface <replaceable>IF</replaceable>. Default is to

162

use all available interfaces.

163

</para>

164

</listitem>

165

</varlistentry>

166

167

168

<term><literal>-a</literal>, <literal>--address <replaceable>

169

ADDRESS</replaceable></literal></term>

170

171

<para>

172

If this option is used, the server will only listen to a

173

specific address. This must currently be an IPv6 address;

174

an IPv4 address can be specified using the

175

"<literal>::FFFF:192.0.2.3</literal>" syntax. Also, if a

176

link-local address is specified, an interface should be

177

set, since a link-local address is only valid on a single

178

interface. By default, the server will listen to all

179

available addresses.

180

</para>

181

</listitem>

182

</varlistentry>

183

184

185

186

PORT</replaceable></literal></term>

187

188

<para>

189

If this option is used, the server to bind to that

190

port. By default, the server will listen to an arbitrary

191

port given by the operating system.

192

</para>

193

</listitem>

194

</varlistentry>

195

196

197

<term><literal>--check</literal></term>

198

199

<para>

200

Run the server's self-tests. This includes any unit

168

169

170

<term><option>--interface</option>

171

172

173

174

175

<xi:include href="mandos-options.xml" xpointer="interface"/>

176

</listitem>

177

</varlistentry>

178

179

180

<term><option>--address

181

<replaceable>ADDRESS</replaceable></option></term>

182

<term><option>-a

183

<replaceable>ADDRESS</replaceable></option></term>

184

185

<xi:include href="mandos-options.xml" xpointer="address"/>

186

</listitem>

187

</varlistentry>

188

189

190

<term><option>--port

191

192

<term><option>-p

193

194

195

<xi:include href="mandos-options.xml" xpointer="port"/>

196

</listitem>

197

</varlistentry>

198

199

200

<term><option>--check</option></term>

201

202

<para>

203

Run the server’s self-tests. This includes any unit

201

204

tests, etc.

202

205

</para>

203

206

</listitem>

204

</varlistentry>

205

206

207

<term><literal>--debug</literal></term>

208

209

<para>

210

If the server is run in debug mode, it will run in the

211

foreground and print a lot of debugging information. The

212

default is <emphasis>not</emphasis> to run in debug mode.

213

</para>

214

</listitem>

215

</varlistentry>

216

217

218

<term><literal>--priority <replaceable>

219

PRIORITY</replaceable></literal></term>

220

221

<para>

222

GnuTLS priority string for the TLS handshake with the

223

clients. See

224

<citerefentry><refentrytitle>gnutls_priority_init

225

</refentrytitle><manvolnum>3</manvolnum></citerefentry>

226

for the syntax. The default is

227

"<literal>SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP</literal>".

228

<emphasis>Warning</emphasis>: changing this may make the

229

TLS handshake fail, making communication with clients

230

impossible.

231

</para>

232

</listitem>

233

</varlistentry>

234

235

236

<term><literal>--servicename <replaceable>NAME</replaceable>

237

</literal></term>

238

239

<para>

240

Zeroconf service name. The default is

241

"<literal>Mandos</literal>". You only need to change this

242

if you for some reason want to run more than one server on

243

the same <emphasis>host</emphasis>. If there are name

244

collisions on the same <emphasis>network</emphasis>, the

245

new server will automatically rename itself to "Mandos

246

#2", etc.

247

</para>

248

</listitem>

249

</varlistentry>

250

251

252

<term><literal>--configdir <replaceable>DIR</replaceable>

253

</literal></term>

207

</varlistentry>

208

209

210

<term><option>--debug</option></term>

211

212

<xi:include href="mandos-options.xml" xpointer="debug"/>

213

</listitem>

214

</varlistentry>

215

216

217

<term><option>--priority <replaceable>

218

PRIORITY</replaceable></option></term>

219

220

<xi:include href="mandos-options.xml" xpointer="priority"/>

221

</listitem>

222

</varlistentry>

223

224

225

<term><option>--servicename

226

227

228

<xi:include href="mandos-options.xml"

229

xpointer="servicename"/>

230

</listitem>

231

</varlistentry>

232

233

234

<term><option>--configdir

235

<replaceable>DIRECTORY</replaceable></option></term>

254

236

255

237

<para>

256

238

Directory to search for configuration files. Default is

257

"<literal>/etc/mandos</literal>". See <citerefentry>

258

<refentrytitle>mandos.conf</refentrytitle>

239

<quote><literal>/etc/mandos</literal></quote>. See

240

<citerefentry><refentrytitle>mandos.conf</refentrytitle>

259

241

260

242

<refentrytitle>mandos-clients.conf</refentrytitle>

261

243

<manvolnum>5</manvolnum></citerefentry>.

264

246

</varlistentry>

265

247

266

248

267

<term><literal>--version</literal></term>

249

<term><option>--version</option></term>

268

250

269

251

<para>

270

252

Prints the program version and exit.

271

253

</para>

272

254

</listitem>

273

</varlistentry>

255

</varlistentry>

274

256

</variablelist>

275

257

</refsect1>

276

258

259

260

<title>OVERVIEW</title>

261

<xi:include href="overview.xml"/>

262

<para>

263

This program is the server part. It is a normal server program

264

and will run in a normal system environment, not in an initial

265

RAM disk environment.

266

</para>

267

</refsect1>

268

277

269

278

270

<title>NETWORK PROTOCOL</title>

279

271

<para>

280

272

The Mandos server announces itself as a Zeroconf service of type

281

"<literal>_mandos._tcp</literal>". The Mandos client connects

282

to the announced address and port, and sends a line of text

283

where the first whitespace-separated field is the protocol

284

version, which currently is "<literal>1</literal>". The client

285

and server then start a TLS protocol handshake with a slight

286

quirk: the Mandos server program acts as a TLS "client" while

287

the connecting Mandos client acts as a TLS "server". The Mandos

288

client must supply an OpenPGP certificate, and the fingerprint

289

of this certificate is used by the Mandos server to look up (in

290

a list read from a file at start time) which binary blob to give

291

the client. No other authentication or authorization is done by

292

the server.

273

<quote><literal>_mandos._tcp</literal></quote>. The Mandos

274

client connects to the announced address and port, and sends a

275

line of text where the first whitespace-separated field is the

276

protocol version, which currently is

277

<quote><literal>1</literal></quote>. The client and server then

278

start a TLS protocol handshake with a slight quirk: the Mandos

279

server program acts as a TLS <quote>client</quote> while the

280

connecting Mandos client acts as a TLS <quote>server</quote>.

281

The Mandos client must supply an OpenPGP certificate, and the

282

fingerprint of this certificate is used by the Mandos server to

283

look up (in a list read from <filename>clients.conf</filename>

284

at start time) which binary blob to give the client. No other

285

authentication or authorization is done by the server.

293

286

</para>

294

287

<table>

288

<title>Mandos Protocol (Version 1)</title><tgroup cols="3"><thead>

295

289

<row>

296

290

<entry>Mandos Client</entry>

297

291

<entry>Direction</entry>

303

297

304

298

</row>

305

299

<row>

306

300

307

301

308

302

</row>

309

303

<row>

310

<entry>TLS handshake</entry>

304

<entry>TLS handshake <emphasis>as TLS <quote>server</quote>

305

</emphasis></entry>

311

306

312

<entry>TLS handshake</entry>

307

<entry>TLS handshake <emphasis>as TLS <quote>client</quote>

308

</emphasis></entry>

313

309

</row>

314

310

<row>

315

311

<entry>OpenPGP public key (part of TLS handshake)</entry>

318

314

<row>

319

315

320

316

321

<entry>Binary blob</entry>

317

<entry>Binary blob (client will assume OpenPGP data)</entry>

322

318

</row>

323

319

<row>

324

320

325

321

326

322

<entry>Close</entry>

327

323

</row>

328

</tbody></tgroup></informaltable>

324

</tbody></tgroup></table>

325

</refsect1>

326

327

328

<title>CHECKING</title>

329

<para>

330

The server will, by default, continually check that the clients

331

are still up. If a client has not been confirmed as being up

332

for some time, the client is assumed to be compromised and is no

333

longer eligible to receive the encrypted password. The timeout,

334

checker program, and interval between checks can be configured

335

both globally and per client; see <citerefentry>

336

<refentrytitle>mandos-clients.conf</refentrytitle>

337

<manvolnum>5</manvolnum></citerefentry>.

338

</para>

329

339

</refsect1>

330

340

331

341

332

342

<title>LOGGING</title>

333

343

<para>

334

The server will log a lot of information with various severity

335

levels to

336

<citerefentry><refentrytitle>syslog</refentrytitle>

337

<manvolnum>8</manvolnum></citerefentry>. With the

344

The server will send log message with various severity levels to

345

<filename>/dev/log</filename>. With the

338

346

<option>--debug</option> option, it will log even more messages,

339

347

and also show them on the console.

340

348

</para>

348

356

</para>

349

357

</refsect1>

350

358

359

360

<title>ENVIRONMENT</title>

361

362

363

364

365

<para>

366

To start the configured checker (see <xref

367

linkend="checking"/>), the server uses

368

<filename>/bin/sh</filename>, which in turn uses

369

<varname>PATH</varname> to search for matching commands if

370

an absolute path is not given. See <citerefentry>

371

372

</citerefentry>.

373

</para>

374

</listitem>

375

</varlistentry>

376

</variablelist>

377

</refsect1>

378

351

379

352

380

<title>FILES</title>

353

381

<para>

354

355

356

<filename>/etc/mandos/mandos.conf</filename> See <citerefentry>

357

<refentrytitle>mandos.conf</refentrytitle>

358

<manvolnum>5</manvolnum></citerefentry>.

359

</para></listitem>

360

361

<filename>/etc/mandos/clients.conf</filename> See <citerefentry>

382

Use the <option>--configdir</option> option to change where

383

<command>&COMMANDNAME;</command> looks for its configurations

384

files. The default file names are listed here.

385

</para>

386

387

388

<term><filename>/etc/mandos/mandos.conf</filename></term>

389

390

<para>

391

Server-global settings. See

392

<citerefentry><refentrytitle>mandos.conf</refentrytitle>

393

<manvolnum>5</manvolnum></citerefentry> for details.

394

</para>

395

</listitem>

396

</varlistentry>

397

398

<term><filename>/etc/mandos/clients.conf</filename></term>

399

400

<para>

401

List of clients and client-specific settings. See

402

<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>

403

<manvolnum>5</manvolnum></citerefentry> for details.

404

</para>

405

</listitem>

406

</varlistentry>

407

408

<term><filename>/var/run/mandos/mandos.pid</filename></term>

409

410

<para>

411

The file containing the process id of

412

<command>&COMMANDNAME;</command>.

413

</para>

414

</listitem>

415

</varlistentry>

416

417

418

419

<para>

420

The Unix domain socket to where local syslog messages are

421

sent.

422

</para>

423

</listitem>

424

</varlistentry>

425

426

427

428

<para>

429

This is used to start the configured checker command for

430

each client. See <citerefentry>

362

431

<refentrytitle>mandos-clients.conf</refentrytitle>

363

<manvolnum>5</manvolnum></citerefentry>.

364

</para></listitem>

365

366

<filename>/var/run/mandos/mandos.pid</filename>

367

</para></listitem>

368

</itemizedlist>

369

</para>

370

</refsect1>

371

432

<manvolnum>5</manvolnum></citerefentry> for details.

433

</para>

434

</listitem>

435

</varlistentry>

436

</variablelist>

437

</refsect1>

438

372

439

373

440

374

441

<para>

375

</para>

376

</refsect1>

377

378

379

<title>EXAMPLES</title>

380

<para>

381

</para>

442

This server might, on especially fatal errors, emit a Python

443

backtrace. This could be considered a feature.

444

</para>

445

<para>

446

Currently, if a client is declared <quote>invalid</quote> due to

447

having timed out, the server does not record this fact onto

448

permanent storage. This has some security implications, see

449

<xref linkend="CLIENTS"/>.

450

</para>

451

<para>

452

There is currently no way of querying the server of the current

453

status of clients, other than analyzing its <systemitem

454

class="service">syslog</systemitem> output.

455

</para>

456

<para>

457

There is no fine-grained control over logging and debug output.

458

</para>

459

<para>

460

Debug mode is conflated with running in the foreground.

461

</para>

462

<para>

463

The console log messages does not show a timestamp.

464

</para>

465

</refsect1>

466

467

468

<title>EXAMPLE</title>

469

470

<para>

471

Normal invocation needs no options:

472

</para>

473

<para>

474

<userinput>&COMMANDNAME;</userinput>

475

</para>

476

</informalexample>

477

478

<para>

479

Run the server in debug mode, read configuration files from

480

the <filename>~/mandos</filename> directory, and use the

481

Zeroconf service name <quote>Test</quote> to not collide with

482

any other official Mandos server on this host:

483

</para>

484

<para>

485

486

487

<userinput>&COMMANDNAME; --debug --configdir ~/mandos --servicename Test</userinput>

488

489

</para>

490

</informalexample>

491

492

<para>

493

Run the server normally, but only listen to one interface and

494

only on the link-local address on that interface:

495

</para>

496

<para>

497

498

499

<userinput>&COMMANDNAME; --interface eth7 --address fe80::aede:48ff:fe71:f6f2</userinput>

500

501

</para>

502

</informalexample>

382

503

</refsect1>

383

504

384

505

385

506

<title>SECURITY</title>

386

<para>

387

</para>

507

508

<title>SERVER</title>

509

<para>

510

Running this <command>&COMMANDNAME;</command> server program

511

should not in itself present any security risk to the host

512

computer running it. The program does not need any special

513

privileges to run, and is designed to run as a non-root user.

514

</para>

515

</refsect2>

516

517

<title>CLIENTS</title>

518

<para>

519

The server only gives out its stored data to clients which

520

does have the OpenPGP key of the stored fingerprint. This is

521

guaranteed by the fact that the client sends its OpenPGP

522

public key in the TLS handshake; this ensures it to be

523

genuine. The server computes the fingerprint of the key

524

itself and looks up the fingerprint in its list of

525

clients. The <filename>clients.conf</filename> file (see

526

<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>

527

<manvolnum>5</manvolnum></citerefentry>)

528

<emphasis>must</emphasis> be made non-readable by anyone

529

except the user running the server.

530

</para>

531

<para>

532

As detailed in <xref linkend="checking"/>, the status of all

533

client computers will continually be checked and be assumed

534

compromised if they are gone for too long.

535

</para>

536

<para>

537

If a client is compromised, its downtime should be duly noted

538

by the server which would therefore declare the client

539

invalid. But if the server was ever restarted, it would

540

re-read its client list from its configuration file and again

541

regard all clients therein as valid, and hence eligible to

542

receive their passwords. Therefore, be careful when

543

restarting servers if it is suspected that a client has, in

544

fact, been compromised by parties who may now be running a

545

fake Mandos client with the keys from the non-encrypted

546

initial RAM image of the client host. What should be done in

547

that case (if restarting the server program really is

548

necessary) is to stop the server program, edit the

549

configuration file to omit any suspect clients, and restart

550

the server program.

551

</para>

552

<para>

553

For more details on client-side security, see

554

<citerefentry><refentrytitle>password-request</refentrytitle>

555

<manvolnum>8mandos</manvolnum></citerefentry>.

556

</para>

557

</refsect2>

388

558

</refsect1>

389

559

390

560

391

561

392

393

394

<citerefentry><refentrytitle>password-request</refentrytitle>

395

<manvolnum>8mandos</manvolnum></citerefentry>

396

</para></listitem>

397

398

399

<citerefentry><refentrytitle>plugin-runner</refentrytitle>

400

<manvolnum>8mandos</manvolnum></citerefentry>

401

</para></listitem>

402

403

404

<ulink url="http://www.zeroconf.org/">Zeroconf</ulink>

405

</para></listitem>

406

407

408

<ulink url="http://www.avahi.org/">Avahi</ulink>

409

</para></listitem>

410

411

412

<ulink

413

url="http://www.gnu.org/software/gnutls/">GnuTLS</ulink>

414

</para></listitem>

415

416

417

<citation>RFC 4880: <citetitle>OpenPGP Message

418

Format</citetitle></citation>

419

</para></listitem>

420

421

422

<citation>RFC 5081: <citetitle>Using OpenPGP Keys for

423

Transport Layer Security</citetitle></citation>

424

</para></listitem>

425

426

427

<citation>RFC 4291: <citetitle>IP Version 6 Addressing

428

Architecture</citetitle>, section 2.5.6, Link-Local IPv6

429

Unicast Addresses</citation>

430

</para></listitem>

431

</itemizedlist>

562

<para>

563

564

<refentrytitle>mandos-clients.conf</refentrytitle>

565

566

<refentrytitle>mandos.conf</refentrytitle>

567

568

<refentrytitle>password-request</refentrytitle>

569

<manvolnum>8mandos</manvolnum></citerefentry>, <citerefentry>

570

571

</citerefentry>

572

</para>

573

574

575

<term>

576

<ulink url="http://www.zeroconf.org/">Zeroconf</ulink>

577

</term>

578

579

<para>

580

Zeroconf is the network protocol standard used by clients

581

for finding this Mandos server on the local network.

582

</para>

583

</listitem>

584

</varlistentry>

585

586

<term>

587

<ulink url="http://www.avahi.org/">Avahi</ulink>

588

</term>

589

590

<para>

591

Avahi is the library this server calls to implement

592

Zeroconf service announcements.

593

</para>

594

</listitem>

595

</varlistentry>

596

597

<term>

598

<ulink url="http://www.gnu.org/software/gnutls/"

599

>GnuTLS</ulink>

600

</term>

601

602

<para>

603

GnuTLS is the library this server uses to implement TLS for

604

communicating securely with the client, and at the same time

605

confidently get the client’s public OpenPGP key.

606

</para>

607

</listitem>

608

</varlistentry>

609

610

<term>

611

RFC 4291: <citetitle>IP Version 6 Addressing

612

Architecture</citetitle>

613

</term>

614

615

616

617

<term>Section 2.2: <citetitle>Text Representation of

618

Addresses</citetitle></term>

619

620

</varlistentry>

621

622

<term>Section 2.5.5.2: <citetitle>IPv4-Mapped IPv6

623

Address</citetitle></term>

624

625

</varlistentry>

626

627

<term>Section 2.5.6, <citetitle>Link-Local IPv6 Unicast

628

Addresses</citetitle></term>

629

630

<para>

631

The clients use IPv6 link-local addresses, which are

632

immediately usable since a link-local addresses is

633

automatically assigned to a network interfaces when it

634

is brought up.

635

</para>

636

</listitem>

637

</varlistentry>

638

</variablelist>

639

</listitem>

640

</varlistentry>

641

642

<term>

643

RFC 4346: <citetitle>The Transport Layer Security (TLS)

644

Protocol Version 1.1</citetitle>

645

</term>

646

647

<para>

648

TLS 1.1 is the protocol implemented by GnuTLS.

649

</para>

650

</listitem>

651

</varlistentry>

652

653

<term>

654

RFC 4880: <citetitle>OpenPGP Message Format</citetitle>

655

</term>

656

657

<para>

658

The data sent to clients is binary encrypted OpenPGP data.

659

</para>

660

</listitem>

661

</varlistentry>

662

663

<term>

664

RFC 5081: <citetitle>Using OpenPGP Keys for Transport Layer

665

Security</citetitle>

666

</term>

667

668

<para>

669

This is implemented by GnuTLS and used by this server so

670

that OpenPGP keys can be used.

671

</para>

672

</listitem>

673

</varlistentry>

674

</variablelist>

432

675

</refsect1>

433

676

</refentry>

677

678

679

680

681

Older »