/mandos/trunk : revision 141

3

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

4

<!ENTITY VERSION "1.0">

5

<!ENTITY COMMANDNAME "mandos">

6

<!ENTITY TIMESTAMP "2008-09-01">

6

7

]>

7

8

9

9

10

10

<title>&COMMANDNAME;</title>

11

<title>Mandos Manual</title>

11

12

12

<productname>&COMMANDNAME;</productname>

13

<productname>Mandos</productname>

13

14

<productnumber>&VERSION;</productnumber>

15

<date>&TIMESTAMP;</date>

14

16

15

17

16

18

<firstname>Björn</firstname>

32

34

<holder>Teddy Hogeborn</holder>

33

35

<holder>Björn Påhlsson</holder>

34

36

</copyright>

35

36

<para>

37

This manual page is free software: you can redistribute it

38

and/or modify it under the terms of the GNU General Public

39

License as published by the Free Software Foundation,

40

either version 3 of the License, or (at your option) any

41

later version.

42

</para>

43

44

<para>

45

This manual page is distributed in the hope that it will

46

be useful, but WITHOUT ANY WARRANTY; without even the

47

implied warranty of MERCHANTABILITY or FITNESS FOR A

48

PARTICULAR PURPOSE. See the GNU General Public License

49

for more details.

50

</para>

51

52

<para>

53

You should have received a copy of the GNU General Public

54

License along with this program; If not, see

55

<ulink url="http://www.gnu.org/licenses/"/>.

56

</para>

57

</legalnotice>

37

<xi:include href="legalnotice.xml"/>

58

38

</refentryinfo>

59

39

60

40

65

45

66

46

<refname><command>&COMMANDNAME;</command></refname>

67

47

68

Sends encrypted passwords to authenticated Mandos clients

48

Gives encrypted passwords to authenticated Mandos clients

69

49

</refpurpose>

70

50

</refnamediv>

71

51

72

52

73

53

74

54

<command>&COMMANDNAME;</command>

75

<arg>--interface<arg choice="plain">IF</arg></arg>

76

<arg>--address<arg choice="plain">ADDRESS</arg></arg>

77

78

<arg>--priority<arg choice="plain">PRIORITY</arg></arg>

79

<arg>--servicename<arg choice="plain">NAME</arg></arg>

80

<arg>--configdir<arg choice="plain">DIRECTORY</arg></arg>

81

<arg>--debug</arg>

82

</cmdsynopsis>

83

84

<command>&COMMANDNAME;</command>

85

86

<arg>-a<arg choice="plain">ADDRESS</arg></arg>

87

88

<arg>--priority<arg choice="plain">PRIORITY</arg></arg>

89

<arg>--servicename<arg choice="plain">NAME</arg></arg>

90

<arg>--configdir<arg choice="plain">DIRECTORY</arg></arg>

91

<arg>--debug</arg>

55

<group>

56

<arg choice="plain"><option>--interface

57

58

<arg choice="plain"><option>-i

59

60

</group>

61

<sbr/>

62

<group>

63

<arg choice="plain"><option>--address

64

<replaceable>ADDRESS</replaceable></option></arg>

65

<arg choice="plain"><option>-a

66

<replaceable>ADDRESS</replaceable></option></arg>

67

</group>

68

<sbr/>

69

<group>

70

<arg choice="plain"><option>--port

71

72

<arg choice="plain"><option>-p

73

74

</group>

75

<sbr/>

76

<arg><option>--priority

77

<replaceable>PRIORITY</replaceable></option></arg>

78

<sbr/>

79

<arg><option>--servicename

80

81

<sbr/>

82

<arg><option>--configdir

83

<replaceable>DIRECTORY</replaceable></option></arg>

84

<sbr/>

85

<arg><option>--debug</option></arg>

92

86

</cmdsynopsis>

93

87

94

88

<command>&COMMANDNAME;</command>

95

89

96

97

90

91

98

92

</group>

99

93

</cmdsynopsis>

100

94

101

95

<command>&COMMANDNAME;</command>

102

<arg choice="plain">--version</arg>

96

<arg choice="plain"><option>--version</option></arg>

103

97

</cmdsynopsis>

104

98

105

99

<command>&COMMANDNAME;</command>

106

<arg choice="plain">--check</arg>

100

<arg choice="plain"><option>--check</option></arg>

107

101

</cmdsynopsis>

108

102

</refsynopsisdiv>

109

103

133

127

<emphasis>encrypted root file system</emphasis>. See <xref

134

128

linkend="overview"/> for details.

135

129

</para>

136

130

137

131

</refsect1>

138

132

139

133

140

134

<title>OPTIONS</title>

141

135

142

136

143

137

144

138

139

145

140

146

141

<para>

147

142

Show a help message and exit

148

143

</para>

149

144

</listitem>

150

145

</varlistentry>

151

146

152

147

153

<term><literal>-i</literal>, <literal>--interface <replaceable>

154

IF</replaceable></literal></term>

148

<term><option>--interface</option>

149

150

151

155

152

156

153

<xi:include href="mandos-options.xml" xpointer="interface"/>

157

154

</listitem>

158

155

</varlistentry>

159

156

160

157

161

<term><literal>-a</literal>, <literal>--address <replaceable>

162

ADDRESS</replaceable></literal></term>

158

<term><option>--address

159

<replaceable>ADDRESS</replaceable></option></term>

160

<term><option>-a

161

<replaceable>ADDRESS</replaceable></option></term>

163

162

164

163

<xi:include href="mandos-options.xml" xpointer="address"/>

165

164

</listitem>

166

165

</varlistentry>

167

166

168

167

169

170

PORT</replaceable></literal></term>

168

<term><option>--port

169

170

<term><option>-p

171

171

172

172

173

<xi:include href="mandos-options.xml" xpointer="port"/>

173

174

</listitem>

174

175

</varlistentry>

175

176

177

177

<term><literal>--check</literal></term>

178

<term><option>--check</option></term>

178

179

179

180

<para>

180

181

Run the server’s self-tests. This includes any unit

182

183

</para>

183

184

</listitem>

184

185

</varlistentry>

185

186

187

187

<term><literal>--debug</literal></term>

188

<term><option>--debug</option></term>

188

189

189

190

<xi:include href="mandos-options.xml" xpointer="debug"/>

190

191

</listitem>

191

192

</varlistentry>

192

193

194

194

<term><literal>--priority <replaceable>

195

PRIORITY</replaceable></literal></term>

195

<term><option>--priority <replaceable>

196

PRIORITY</replaceable></option></term>

196

197

197

198

<xi:include href="mandos-options.xml" xpointer="priority"/>

198

199

</listitem>

199

200

</varlistentry>

200

201

202

202

<term><literal>--servicename <replaceable>NAME</replaceable>

203

</literal></term>

203

<term><option>--servicename

204

204

205

205

206

<xi:include href="mandos-options.xml"

206

207

xpointer="servicename"/>

208

209

</varlistentry>

209

210

211

211

<term><literal>--configdir <replaceable>DIR</replaceable>

212

</literal></term>

212

<term><option>--configdir

213

<replaceable>DIRECTORY</replaceable></option></term>

213

214

214

215

<para>

215

216

Directory to search for configuration files. Default is

223

224

</varlistentry>

224

225

226

226

<term><literal>--version</literal></term>

227

<term><option>--version</option></term>

227

228

228

229

<para>

229

230

Prints the program version and exit.

239

240

<para>

240

241

This program is the server part. It is a normal server program

241

242

and will run in a normal system environment, not in an initial

242

RAM disk environment.

243

<acronym>RAM</acronym> disk environment.

243

244

</para>

244

245

</refsect1>

245

246

274

275

275

276

</row>

276

277

<row>

277

278

278

279

279

280

</row>

280

281

<row>

310

311

longer eligible to receive the encrypted password. The timeout,

311

312

checker program, and interval between checks can be configured

312

313

both globally and per client; see <citerefentry>

313

<refentrytitle>mandos.conf</refentrytitle>

314

315

314

<refentrytitle>mandos-clients.conf</refentrytitle>

316

315

<manvolnum>5</manvolnum></citerefentry>.

317

316

</para>

320

319

321

320

<title>LOGGING</title>

322

321

<para>

323

The server will send log messaged with various severity levels

324

to <filename>/dev/log</filename>. With the

322

The server will send log message with various severity levels to

323

<filename>/dev/log</filename>. With the

325

324

<option>--debug</option> option, it will log even more messages,

326

325

and also show them on the console.

327

326

</para>

339

338

<title>ENVIRONMENT</title>

340

339

341

340

342

341

343

342

344

343

<para>

345

344

To start the configured checker (see <xref

348

347

<varname>PATH</varname> to search for matching commands if

349

348

an absolute path is not given. See <citerefentry>

350

349

351

</citerefentry>

350

</citerefentry>.

352

351

</para>

353

352

</listitem>

354

353

</varlistentry>

450

449

Normal invocation needs no options:

451

450

</para>

452

451

<para>

453

<userinput>mandos</userinput>

452

<userinput>&COMMANDNAME;</userinput>

454

453

</para>

455

454

</informalexample>

456

455

463

462

<para>

464

463

465

464

466

<userinput>mandos --debug --configdir ~/mandos --servicename Test</userinput>

465

<userinput>&COMMANDNAME; --debug --configdir ~/mandos --servicename Test</userinput>

467

466

468

467

</para>

469

468

</informalexample>

475

474

<para>

476

475

477

476

478

<userinput>mandos --interface eth7 --address fe80::aede:48ff:fe71:f6f2</userinput>

477

<userinput>&COMMANDNAME; --interface eth7 --address fe80::aede:48ff:fe71:f6f2</userinput>

479

478

480

479

</para>

481

480

</informalexample>

522

521

restarting servers if it is suspected that a client has, in

523

522

fact, been compromised by parties who may now be running a

524

523

fake Mandos client with the keys from the non-encrypted

525

initial RAM image of the client host. What should be done in

526

that case (if restarting the server program really is

527

necessary) is to stop the server program, edit the

524

initial <acronym>RAM</acronym> image of the client host. What

525

should be done in that case (if restarting the server program

526

really is necessary) is to stop the server program, edit the

528

527

configuration file to omit any suspect clients, and restart

529

528

the server program.

530

529

</para>

538

537

539

538

540

539

540

<para>

541

542

<refentrytitle>mandos-clients.conf</refentrytitle>

543

544

<refentrytitle>mandos.conf</refentrytitle>

545

546

<refentrytitle>password-request</refentrytitle>

547

<manvolnum>8mandos</manvolnum></citerefentry>, <citerefentry>

548

549

</citerefentry>

550

</para>

541

551

542

552

543

553

<term>

544

545

<refentrytitle>password-request</refentrytitle>

546

<manvolnum>8mandos</manvolnum>

547

</citerefentry>

548

</term>

549

550

<para>

551

This is the actual program which talks to this server.

552

Note that it is normally not invoked directly, and is only

553

run in the initial RAM disk environment, and not on a

554

fully started system.

555

</para>

556

</listitem>

557

</varlistentry>

558

559

<term>

560

554

<ulink url="http://www.zeroconf.org/">Zeroconf</ulink>

561

555

</term>

562

556

579

573

</varlistentry>

580

574

581

575

<term>

582

<ulink

583

url="http://www.gnu.org/software/gnutls/">GnuTLS</ulink>

576

<ulink url="http://www.gnu.org/software/gnutls/"

577

>GnuTLS</ulink>

584

578

</term>

585

579

586

580

<para>

592

586

</varlistentry>

593

587

594

588

<term>

595

<citation>RFC 4291: <citetitle>IP Version 6 Addressing

596

Architecture</citetitle>, section 2.5.6, Link-Local IPv6

597

Unicast Addresses</citation>

589

RFC 4291: <citetitle>IP Version 6 Addressing

590

Architecture</citetitle>

598

591

</term>

599

592

600

<para>

601

The clients use IPv6 link-local addresses, which are

602

immediately usable since a link-local addresses is

603

automatically assigned to a network interfaces when it is

604

brought up.

605

</para>

593

594

595

<term>Section 2.2: <citetitle>Text Representation of

596

Addresses</citetitle></term>

597

598

</varlistentry>

599

600

<term>Section 2.5.5.2: <citetitle>IPv4-Mapped IPv6

601

Address</citetitle></term>

602

603

</varlistentry>

604

605

<term>Section 2.5.6, <citetitle>Link-Local IPv6 Unicast

606

Addresses</citetitle></term>

607

608

<para>

609

The clients use IPv6 link-local addresses, which are

610

immediately usable since a link-local addresses is

611

automatically assigned to a network interfaces when it

612

is brought up.

613

</para>

614

</listitem>

615

</varlistentry>

616

</variablelist>

606

617

</listitem>

607

618

</varlistentry>

608

619

609

620

<term>

610

<citation>RFC 4346: <citetitle>The Transport Layer Security

611

(TLS) Protocol Version 1.1</citetitle></citation>

621

RFC 4346: <citetitle>The Transport Layer Security (TLS)

622

Protocol Version 1.1</citetitle>

612

623

</term>

613

624

614

625

<para>

618

629

</varlistentry>

619

630

620

631

<term>

621

<citation>RFC 4880: <citetitle>OpenPGP Message

622

Format</citetitle></citation>

632

RFC 4880: <citetitle>OpenPGP Message Format</citetitle>

623

633

</term>

624

634

625

635

<para>

629

639

</varlistentry>

630

640

631

641

<term>

632

<citation>RFC 5081: <citetitle>Using OpenPGP Keys for

633

Transport Layer Security</citetitle></citation>

642

RFC 5081: <citetitle>Using OpenPGP Keys for Transport Layer

643

Security</citetitle>

634

644

</term>

635

645

636

646

<para>

642

652

</variablelist>

643

653

</refsect1>

644

654

</refentry>

655

656

657

658

659