/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-clients.conf.xml

  • Committer: Teddy Hogeborn
  • Date: 2024-11-17 17:28:47 UTC
  • Revision ID: teddy@recompile.se-20241117172847-3bon1o16owybrmoo
mandos: Make configured network socket non-inheritable

If we are passed a pre-created created network socket as a file
descriptor, we should make it non-inheritable to checkers and other
subprocesses.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-clients.conf.xml
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY CONFNAME "mandos-clients.conf">
5
5
<!ENTITY CONFPATH "<filename>/etc/mandos/clients.conf</filename>">
6
 
<!ENTITY TIMESTAMP "2015-07-20">
 
6
<!ENTITY TIMESTAMP "2019-02-10">
7
7
<!ENTITY % common SYSTEM "common.ent">
8
8
%common;
9
9
]>
40
40
      <year>2013</year>
41
41
      <year>2014</year>
42
42
      <year>2015</year>
 
43
      <year>2016</year>
 
44
      <year>2017</year>
 
45
      <year>2018</year>
 
46
      <year>2019</year>
43
47
      <holder>Teddy Hogeborn</holder>
44
48
      <holder>Björn Påhlsson</holder>
45
49
    </copyright>
183
187
            >--</option> %%(host)s</literal></quote>.  Note that
184
188
            <command>mandos-keygen</command>, when generating output
185
189
            to be inserted into this file, normally looks for an SSH
186
 
            server on the Mandos client, and, if it find one, outputs
 
190
            server on the Mandos client, and, if it finds one, outputs
187
191
            a <option>checker</option> option to check for the
188
 
            client’s key fingerprint – this is more secure against
 
192
            client’s SSH key fingerprint – this is more secure against
189
193
            spoofing.
190
194
          </para>
191
195
          <para>
224
228
        ><replaceable>HEXSTRING</replaceable></option></term>
225
229
        <listitem>
226
230
          <para>
227
 
            This option is <emphasis>required</emphasis>.
228
 
          </para>
229
 
          <para>
230
 
            This option sets the OpenPGP fingerprint that identifies
231
 
            the public key that clients authenticate themselves with
232
 
            through TLS.  The string needs to be in hexidecimal form,
233
 
            but spaces or upper/lower case are not significant.
 
231
            This option is <emphasis>required</emphasis> if the
 
232
            <option>key_id</option> is not set, and
 
233
            <emphasis>optional</emphasis> otherwise.
 
234
          </para>
 
235
          <para>
 
236
            This option sets the OpenPGP fingerprint that (before
 
237
            GnuTLS 3.6.0) identified the public key that clients
 
238
            authenticate themselves with through TLS.  The string
 
239
            needs to be in hexadecimal form, but spaces or upper/lower
 
240
            case are not significant.
 
241
          </para>
 
242
        </listitem>
 
243
      </varlistentry>
 
244
      
 
245
      <varlistentry>
 
246
        <term><option>key_id<literal> = </literal
 
247
        ><replaceable>HEXSTRING</replaceable></option></term>
 
248
        <listitem>
 
249
          <para>
 
250
            This option is <emphasis>required</emphasis> if the
 
251
            <option>fingerprint</option> is not set, and
 
252
            <emphasis>optional</emphasis> otherwise.
 
253
          </para>
 
254
          <para>
 
255
            This option sets the certificate key ID that (with GnuTLS
 
256
            3.6.6 or later) identifies the public key that clients
 
257
            authenticate themselves with through TLS.  The string
 
258
            needs to be in hexadecimal form, but spaces or upper/lower
 
259
            case are not significant.
234
260
          </para>
235
261
        </listitem>
236
262
      </varlistentry>
311
337
          <para>
312
338
            If present, this option must be set to a string of
313
339
            base64-encoded binary data.  It will be decoded and sent
314
 
            to the client matching the above
315
 
            <option>fingerprint</option>.  This should, of course, be
316
 
            OpenPGP encrypted data, decryptable only by the client.
 
340
            to the client matching the above <option>key_id</option>
 
341
            or <option>fingerprint</option>.  This should, of course,
 
342
            be OpenPGP encrypted data, decryptable only by the client.
317
343
            The program <citerefentry><refentrytitle><command
318
344
            >mandos-keygen</command></refentrytitle><manvolnum
319
345
            >8</manvolnum></citerefentry> can, using its
414
440
        <quote><literal>created</literal></quote>,
415
441
        <quote><literal>enabled</literal></quote>,
416
442
        <quote><literal>expires</literal></quote>,
 
443
        <quote><literal>key_id</literal></quote>,
417
444
        <quote><literal>fingerprint</literal></quote>,
418
445
        <quote><literal>host</literal></quote>,
419
446
        <quote><literal>interval</literal></quote>,
462
489
      <literal>%(<replaceable>foo</replaceable>)s</literal> is
463
490
      obscure.
464
491
    </para>
 
492
    <xi:include href="bugs.xml"/>
465
493
  </refsect1>
466
494
  
467
495
  <refsect1 id="example">
475
503
 
476
504
# Client "foo"
477
505
[foo]
 
506
key_id = 788cd77115cd0bb7b2d5e0ae8496f6b48149d5e712c652076b1fd2d957ef7c1f
478
507
fingerprint =  7788 2722 5BA7 DE53 9C5A  7CFA 59CF F7CD BD9A 5920
479
508
secret =
480
509
        hQIOA6QdEjBs2L/HEAf/TCyrDe5Xnm9esa+Pb/vWF9CUqfn4srzVgSu234
497
526
 
498
527
# Client "bar"
499
528
[bar]
 
529
key_id = F90C7A81D72D1EA69A51031A91FF8885F36C8B46D155C8C58709A4C99AE9E361
500
530
fingerprint = 3e393aeaefb84c7e89e2f547b3a107558fca3a27
501
531
secfile = /etc/mandos/bar-secret
502
532
timeout = PT15M