/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to intro.xml

  • Committer: Teddy Hogeborn
  • Date: 2024-11-15 11:02:39 UTC
  • Revision ID: teddy@recompile.se-20241115110239-1t2yh76c1ap7wlmm
mandos-keygen: Avoid comment lines from ssh-keyscan

In ssh-keyscan from OpenSSH 9.8, comment lines containing the hostname
and SSH protocol banner are emitted by to standard output.  Avoid this
by passing the "-q" (quiet) option to ssh-keyscan.

mandos-keygen: When scanning localhost for keys, try to run
"ssh-keyscan" both with and without the "-q" option.  If the "-q"
option worked, use the option also in the generated checker command.

Reported-By: bb <bb@tsufeki.eu>
Thanks: bb <bb@tsufeki.eu> for analysis

Show diffs side-by-side

added added

removed removed

Lines of Context:
intro.xml
1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
 
<!ENTITY TIMESTAMP "2019-04-10">
 
4
<!ENTITY TIMESTAMP "2020-09-16">
5
5
<!ENTITY % common SYSTEM "common.ent">
6
6
%common;
7
7
]>
39
39
      <year>2017</year>
40
40
      <year>2018</year>
41
41
      <year>2019</year>
 
42
      <year>2020</year>
42
43
      <holder>Teddy Hogeborn</holder>
43
44
      <holder>Björn Påhlsson</holder>
44
45
    </copyright>
384
385
      plugin requirements.
385
386
    </para>
386
387
  </refsect1>
387
 
  
 
388
 
 
389
  <refsect1 id="systemd">
 
390
    <title>SYSTEMD</title>
 
391
    <para>
 
392
      More advanced startup systems like <citerefentry><refentrytitle
 
393
      >systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 
394
      already have their own plugin-like mechanisms for allowing
 
395
      multiple agents to independently retrieve a password and deliver
 
396
      it to the subsystem requesting a password to unlock the root
 
397
      file system.  On these systems, it would make no sense to run
 
398
      <citerefentry><refentrytitle>plugin-runner</refentrytitle
 
399
      ><manvolnum>8mandos</manvolnum></citerefentry>, the plugins of
 
400
      which would largely duplicate the work of (and conflict with)
 
401
      the existing systems prompting for passwords.
 
402
    </para>
 
403
    <para>
 
404
      As for <citerefentry><refentrytitle>systemd</refentrytitle
 
405
      ><manvolnum>1</manvolnum></citerefentry> in particular, it has
 
406
      its own <ulink
 
407
      url="https://systemd.io/PASSWORD_AGENTS/">Password
 
408
      Agents</ulink> system.  Mandos uses this via its
 
409
      <citerefentry><refentrytitle>password-agent</refentrytitle
 
410
      ><manvolnum>8mandos</manvolnum></citerefentry> program, which is
 
411
      run instead of <citerefentry><refentrytitle
 
412
      >plugin-runner</refentrytitle><manvolnum>8mandos</manvolnum
 
413
      ></citerefentry> when <citerefentry><refentrytitle
 
414
      >systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 
415
      is used during system startup.
 
416
    </para>
 
417
  </refsect1>
388
418
  <refsect1 id="bugs">
389
419
    <title>BUGS</title>
390
420
    <xi:include href="bugs.xml"/>
405
435
      <manvolnum>8</manvolnum></citerefentry>,
406
436
      <citerefentry><refentrytitle>plugin-runner</refentrytitle>
407
437
      <manvolnum>8mandos</manvolnum></citerefentry>,
 
438
      <citerefentry><refentrytitle>password-agent</refentrytitle>
 
439
      <manvolnum>8mandos</manvolnum></citerefentry>,
408
440
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
409
441
      <manvolnum>8mandos</manvolnum></citerefentry>,
410
442
      <citerefentry><refentrytitle>password-prompt</refentrytitle>