/mandos/trunk : revision 130

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to plugins.d/password-request.xml

Committer: Teddy Hogeborn
Date: 2008-08-31 14:02:37 UTC
Revision ID: teddy@fukt.bsnet.se-20080831140237-oz9knd88esz8cj4y

* plugin-runner.xml: Removed <?xml-stylesheet>.
* plugins.d/password-request.xml: - '' -

files removed:
legalnotice.xml

files modified:
Makefile

TODO

mandos-clients.conf.xml

mandos-keygen.xml

mandos-options.xml

mandos.conf.xml

mandos.xml

overview.xml

plugin-runner.c

plugin-runner.xml

plugins.d/password-prompt.xml

plugins.d/password-request.c

plugins.d/password-request.xml

Show diffs side-by-side

added added

removed removed

plugins.d/password-request.xml

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

<!ENTITY VERSION "1.0">

<!ENTITY COMMANDNAME "password-request">

<!ENTITY TIMESTAMP "2008-09-03">

<!ENTITY TIMESTAMP "2008-08-31">

<title>Mandos Manual</title>

<holder>Teddy Hogeborn</holder>

<holder>Björn Påhlsson</holder>

</copyright>

<xi:include href="../legalnotice.xml"/>

<para>

This manual page is free software: you can redistribute it

and/or modify it under the terms of the GNU General Public

License as published by the Free Software Foundation,

either version 3 of the License, or (at your option) any

later version.

</para>

<para>

This manual page is distributed in the hope that it will

be useful, but WITHOUT ANY WARRANTY; without even the

implied warranty of MERCHANTABILITY or FITNESS FOR A

PARTICULAR PURPOSE. See the GNU General Public License

for more details.

</para>

<para>

You should have received a copy of the GNU General Public

License along with this program; If not, see

<ulink url="http://www.gnu.org/licenses/"/>.

</para>

</legalnotice>

</refentryinfo>

124

146

125

147

<title>DESCRIPTION</title>

126

148

<para>

127

<command>&COMMANDNAME;</command> is a client program that

128

communicates with <citerefentry><refentrytitle

129

>mandos</refentrytitle><manvolnum>8</manvolnum></citerefentry>

130

to get a password. It uses IPv6 link-local addresses to get

131

network connectivity, Zeroconf to find the server, and TLS with

132

an OpenPGP key to ensure authenticity and confidentiality. It

133

keeps running, trying all servers on the network, until it

134

receives a satisfactory reply.

135

</para>

136

<para>

137

This program is not meant to be run directly; it is really meant

138

to run as a plugin of the <application>Mandos</application>

139

<citerefentry><refentrytitle>plugin-runner</refentrytitle>

140

<manvolnum>8mandos</manvolnum></citerefentry>, which runs in the

141

initial <acronym>RAM</acronym> disk environment because it is

142

specified as a <quote>keyscript</quote> in the <citerefentry>

143

<refentrytitle>crypttab</refentrytitle><manvolnum>5</manvolnum>

144

</citerefentry> file.

145

</para>

146

</refsect1>

147

148

149

<title>PURPOSE</title>

150

<para>

151

The purpose of this is to enable <emphasis>remote and unattended

152

rebooting</emphasis> of client host computer with an

153

<emphasis>encrypted root file system</emphasis>. See <xref

154

linkend="overview"/> for details.

149

<command>&COMMANDNAME;</command> is a mandos plugin that works

150

like a client program that through avahi detects mandos servers,

151

sets up a gnutls connect and request a encrypted password. Any

152

passwords given is automaticly decrypted and passed to

153

cryptsetup.

155

154

</para>

156

155

</refsect1>

157

156

158

157

159

158

<title>OPTIONS</title>

160

159

<para>

161

This program is commonly not invoked from the command line; it

162

is normally started by the <application>Mandos</application>

163

plugin runner, see <citerefentry><refentrytitle

164

>plugin-runner</refentrytitle><manvolnum>8mandos</manvolnum>

165

</citerefentry>. Any command line options this program accepts

166

are therefore normally provided by the plugin runner, and not

167

directly.

160

Commonly not invoked as command lines but from configuration

161

file of plugin runner.

168

162

</para>

169

163

170

164

171

165

172

166

<term><option>--connect=<replaceable

173

>ADDRESS</replaceable><literal>:</literal><replaceable

167

>IPADDR</replaceable><literal>:</literal><replaceable

174

168

>PORT</replaceable></option></term>

175

169

<term><option>-c

176

<replaceable>ADDRESS</replaceable><literal>:</literal

170

<replaceable>IPADDR</replaceable><literal>:</literal

177

171

><replaceable>PORT</replaceable></option></term>

178

172

179

173

<para>

180

Do not use Zeroconf to locate servers. Connect directly

181

to only one specified <application>Mandos</application>

182

server. Note that an IPv6 address has colon characters in

183

it, so the <emphasis>last</emphasis> colon character is

184

assumed to separate the address from the port number.

185

</para>

186

<para>

187

This option is normally only useful for testing and

188

debugging.

174

Connect directly to a specified mandos server

189

175

</para>

190

176

</listitem>

191

177

</varlistentry>

192

178

193

179

194

180

<term><option>--keydir=<replaceable

195

181

>DIRECTORY</replaceable></option></term>

197

183

<replaceable>DIRECTORY</replaceable></option></term>

198

184

199

185

<para>

200

Directory to read the OpenPGP key files

201

<filename>pubkey.txt</filename> and

202

<filename>seckey.txt</filename> from. The default is

203

<filename>/conf/conf.d/mandos</filename> (in the initial

204

<acronym>RAM</acronym> disk environment).

186

Directory where the openpgp keyring is

205

187

</para>

206

188

</listitem>

207

189

</varlistentry>

213

195

214

196

215

197

<para>

216

Network interface that will be brought up and scanned for

217

Mandos servers to connect to. The default it

218

<quote><literal>eth0</literal></quote>.

198

Interface that Avahi will connect through

219

199

</para>

220

200

</listitem>

221

201

</varlistentry>

222

202

223

203

224

204

<term><option>--pubkey=<replaceable

225

205

>FILE</replaceable></option></term>

227

207

228

208

229

209

<para>

230

OpenPGP public key file base name. This will be combined

231

with the directory from the <option>--keydir</option>

232

option to form an absolute file name. The default name is

233

<quote><literal>pubkey.txt</literal></quote>.

210

Public openpgp key for gnutls authentication

234

211

</para>

235

212

</listitem>

236

213

</varlistentry>

242

219

243

220

244

221

<para>

245

OpenPGP secret key file base name. This will be combined

246

with the directory from the <option>--keydir</option>

247

option to form an absolute file name. The default name is

248

<quote><literal>seckey.txt</literal></quote>.

222

Secret OpenPGP key for GnuTLS authentication

249

223

</para>

250

224

</listitem>

251

225

</varlistentry>

254

228

<term><option>--priority=<replaceable

255

229

>STRING</replaceable></option></term>

256

230

257

<xi:include href="../mandos-options.xml"

258

xpointer="priority"/>

231

<para>

232

GnuTLS priority

233

</para>

259

234

</listitem>

260

235

</varlistentry>

261

236

264

239

>BITS</replaceable></option></term>

265

240

266

241

<para>

267

Sets the number of bits to use for the prime number in the

268

TLS Diffie-Hellman key exchange. Default is 1024.

242

DH bits to use in gnutls communication

269

243

</para>

270

244

</listitem>

271

245

</varlistentry>

274

248

<term><option>--debug</option></term>

275

249

276

250

<para>

277

Enable debug mode. This will enable a lot of output to

278

standard error about what the program is doing. The

279

program will still perform all other functions normally.

280

</para>

281

<para>

282

It will also enable debug mode in the Avahi and GnuTLS

283

libraries, making them print large amounts of debugging

284

output.

251

Debug mode

285

252

</para>

286

253

</listitem>

287

254

</varlistentry>

291

258

292

259

293

260

<para>

294

Gives a help message about options and their meanings.

261

Gives a help message

295

262

</para>

296

263

</listitem>

297

264

</varlistentry>

300

267

<term><option>--usage</option></term>

301

268

302

269

<para>

303

Gives a short usage message.

270

Gives a short usage message

304

271

</para>

305

272

</listitem>

306

273

</varlistentry>

310

277

311

278

312

279

<para>

313

Prints the program version.

280

Prints the program version

314

281

</para>

315

282

</listitem>

316

283

</varlistentry>

317

284

</variablelist>

318

285

</refsect1>

319

286

320

321

<title>OVERVIEW</title>

322

<xi:include href="../overview.xml"/>

323

<para>

324

This program is the client part. It is a plugin started by

325

<citerefentry><refentrytitle>plugin-runner</refentrytitle>

326

<manvolnum>8mandos</manvolnum></citerefentry> which will run in

327

an initial <acronym>RAM</acronym> disk environment.

328

</para>

329

<para>

330

This program could, theoretically, be used as a keyscript in

331

<filename>/etc/crypttab</filename>, but it would then be

332

impossible to enter the encrypted root disk password at the

333

console, since this program does not read from the console at

334

all. This is why a separate plugin does that, which will be run

335

in parallell to this one.

336

</para>

337

</refsect1>

338

339

287

340

288

<title>EXIT STATUS</title>

341

289

<para>

342

This program will exit with a successful (zero) exit status if a

343

server could be found and the password received from it could be

344

successfully decrypted and output on standard output. The

345

program will exit with a non-zero exit status only if a critical

346

error occurs. Otherwise, it will forever connect to new

347

<application>Mandosservers</application> servers as they appear,

348

trying to get a decryptable password.

349

290

</para>

350

291

</refsect1>

351

292

352

293

353

294

<title>ENVIRONMENT</title>

354

295

<para>

355

This program does not use any environment variables, not even

356

the ones provided by <citerefentry><refentrytitle

357

>cryptsetup</refentrytitle><manvolnum>8</manvolnum>

358

</citerefentry>.

359

296

</para>

360

297

</refsect1>

361

298

362

299

363

300

<title>FILES</title>

364

301

<para>

409

346

410

347

411

348

<ulink

412

url="http://www.gnupg.org/related_software/gpgme/"

413

>GPGME</ulink>

349

url="http://www.gnupg.org/related_software/gpgme/">

350

GPGME</ulink>

414

351

</para></listitem>

415

352

416

353

Older »