/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to plugins.d/password-request.xml

  • Committer: Teddy Hogeborn
  • Date: 2008-09-03 05:08:24 UTC
  • Revision ID: teddy@fukt.bsnet.se-20080903050824-x38ghzu01vkfrpb4
* plugins.d/password-request.xml (OVERVIEW): Improved wording.
  (EXIT STATUS): Fixed typos.

Show diffs side-by-side

added added

removed removed

Lines of Context:
plugins.d/password-request.xml
1
 
<?xml version='1.0' encoding='UTF-8'?>
2
 
<?xml-stylesheet type="text/xsl"
3
 
        href="http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl"?>
 
1
<?xml version="1.0" encoding="UTF-8"?>
4
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
5
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
6
4
<!ENTITY VERSION "1.0">
7
5
<!ENTITY COMMANDNAME "password-request">
 
6
<!ENTITY TIMESTAMP "2008-09-03">
8
7
]>
9
8
 
10
 
<refentry>
 
9
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
11
10
  <refentryinfo>
12
 
    <title>&COMMANDNAME;</title>
13
 
    <!-- NWalsh's docbook scripts use this to generate the footer: -->
14
 
    <productname>&COMMANDNAME;</productname>
 
11
    <title>Mandos Manual</title>
 
12
    <!-- Nwalsh’s docbook scripts use this to generate the footer: -->
 
13
    <productname>Mandos</productname>
15
14
    <productnumber>&VERSION;</productnumber>
 
15
    <date>&TIMESTAMP;</date>
16
16
    <authorgroup>
17
17
      <author>
18
18
        <firstname>Björn</firstname>
31
31
    </authorgroup>
32
32
    <copyright>
33
33
      <year>2008</year>
34
 
      <holder>Teddy Hogeborn &amp; Björn Påhlsson</holder>
 
34
      <holder>Teddy Hogeborn</holder>
 
35
      <holder>Björn Påhlsson</holder>
35
36
    </copyright>
36
 
    <legalnotice>
37
 
      <para>
38
 
        This manual page is free software: you can redistribute it
39
 
        and/or modify it under the terms of the GNU General Public
40
 
        License as published by the Free Software Foundation,
41
 
        either version 3 of the License, or (at your option) any
42
 
        later version.
43
 
      </para>
44
 
 
45
 
      <para>
46
 
        This manual page is distributed in the hope that it will
47
 
        be useful, but WITHOUT ANY WARRANTY; without even the
48
 
        implied warranty of MERCHANTABILITY or FITNESS FOR A
49
 
        PARTICULAR PURPOSE.  See the GNU General Public License
50
 
        for more details.
51
 
      </para>
52
 
 
53
 
      <para>
54
 
        You should have received a copy of the GNU General Public
55
 
        License along with this program; If not, see
56
 
        <ulink url="http://www.gnu.org/licenses/"/>.
57
 
      </para>
58
 
    </legalnotice>
 
37
    <xi:include href="../legalnotice.xml"/>
59
38
  </refentryinfo>
60
39
 
61
40
  <refmeta>
73
52
  <refsynopsisdiv>
74
53
    <cmdsynopsis>
75
54
      <command>&COMMANDNAME;</command>
76
 
      <arg choice='opt' rep='repeat'>OPTION</arg>
 
55
      <group>
 
56
        <arg choice="plain"><option>--connect
 
57
        <replaceable>IPADDR</replaceable><literal>:</literal
 
58
        ><replaceable>PORT</replaceable></option></arg>
 
59
        <arg choice="plain"><option>-c
 
60
        <replaceable>IPADDR</replaceable><literal>:</literal
 
61
        ><replaceable>PORT</replaceable></option></arg>
 
62
      </group>
 
63
      <sbr/>
 
64
      <group>
 
65
        <arg choice="plain"><option>--keydir
 
66
        <replaceable>DIRECTORY</replaceable></option></arg>
 
67
        <arg choice="plain"><option>-d
 
68
        <replaceable>DIRECTORY</replaceable></option></arg>
 
69
      </group>
 
70
      <sbr/>
 
71
      <group>
 
72
        <arg choice="plain"><option>--interface
 
73
        <replaceable>NAME</replaceable></option></arg>
 
74
        <arg choice="plain"><option>-i
 
75
        <replaceable>NAME</replaceable></option></arg>
 
76
      </group>
 
77
      <sbr/>
 
78
      <group>
 
79
        <arg choice="plain"><option>--pubkey
 
80
        <replaceable>FILE</replaceable></option></arg>
 
81
        <arg choice="plain"><option>-p
 
82
        <replaceable>FILE</replaceable></option></arg>
 
83
      </group>
 
84
      <sbr/>
 
85
      <group>
 
86
        <arg choice="plain"><option>--seckey
 
87
        <replaceable>FILE</replaceable></option></arg>
 
88
        <arg choice="plain"><option>-s
 
89
        <replaceable>FILE</replaceable></option></arg>
 
90
      </group>
 
91
      <sbr/>
 
92
      <arg>
 
93
        <option>--priority <replaceable>STRING</replaceable></option>
 
94
      </arg>
 
95
      <sbr/>
 
96
      <arg>
 
97
        <option>--dh-bits <replaceable>BITS</replaceable></option>
 
98
      </arg>
 
99
      <sbr/>
 
100
      <arg>
 
101
        <option>--debug</option>
 
102
      </arg>
 
103
    </cmdsynopsis>
 
104
    <cmdsynopsis>
 
105
      <command>&COMMANDNAME;</command>
 
106
      <group choice="req">
 
107
        <arg choice="plain"><option>--help</option></arg>
 
108
        <arg choice="plain"><option>-?</option></arg>
 
109
      </group>
 
110
    </cmdsynopsis>
 
111
    <cmdsynopsis>
 
112
      <command>&COMMANDNAME;</command>
 
113
      <arg choice="plain"><option>--usage</option></arg>
 
114
    </cmdsynopsis>
 
115
    <cmdsynopsis>
 
116
      <command>&COMMANDNAME;</command>
 
117
      <group choice="req">
 
118
        <arg choice="plain"><option>--version</option></arg>
 
119
        <arg choice="plain"><option>-V</option></arg>
 
120
      </group>
77
121
    </cmdsynopsis>
78
122
  </refsynopsisdiv>
79
123
 
80
124
  <refsect1 id="description">
81
125
    <title>DESCRIPTION</title>
82
126
    <para>
83
 
      <command>&COMMANDNAME;</command> is a mandos plugin that works
84
 
      like a client program that through avahi detects mandos servers,
85
 
      sets up a gnutls connect and request a encrypted password. Any
86
 
      passwords given is automaticly decrypted and passed to
87
 
      cryptsetup.
88
 
    </para>
89
 
 
 
127
      <command>&COMMANDNAME;</command> is a client program that
 
128
      communicates with <citerefentry><refentrytitle
 
129
      >mandos</refentrytitle><manvolnum>8</manvolnum></citerefentry>
 
130
      to get a password.  It uses IPv6 link-local addresses to get
 
131
      network connectivity, Zeroconf to find the server, and TLS with
 
132
      an OpenPGP key to ensure authenticity and confidentiality.  It
 
133
      keeps running, trying all servers on the network, until it
 
134
      receives a satisfactory reply.
 
135
    </para>
 
136
    <para>
 
137
      This program is not meant to be run directly; it is really meant
 
138
      to run as a plugin of the <application>Mandos</application>
 
139
      <citerefentry><refentrytitle>plugin-runner</refentrytitle>
 
140
      <manvolnum>8mandos</manvolnum></citerefentry>, which runs in the
 
141
      initial <acronym>RAM</acronym> disk environment because it is
 
142
      specified as a <quote>keyscript</quote> in the <citerefentry>
 
143
      <refentrytitle>crypttab</refentrytitle><manvolnum>5</manvolnum>
 
144
      </citerefentry> file.
 
145
    </para>
 
146
  </refsect1>
 
147
  
 
148
  <refsect1 id="purpose">
 
149
    <title>PURPOSE</title>
 
150
    <para>
 
151
      The purpose of this is to enable <emphasis>remote and unattended
 
152
      rebooting</emphasis> of client host computer with an
 
153
      <emphasis>encrypted root file system</emphasis>.  See <xref
 
154
      linkend="overview"/> for details.
 
155
    </para>
 
156
  </refsect1>
 
157
  
 
158
  <refsect1 id="options">
 
159
    <title>OPTIONS</title>
 
160
    <para>
 
161
      This program is commonly not invoked from the command line; it
 
162
      is normally started by the <application>Mandos</application>
 
163
      plugin runner, see <citerefentry><refentrytitle
 
164
      >plugin-runner</refentrytitle><manvolnum>8mandos</manvolnum>
 
165
      </citerefentry>.  Any command line options this program accepts
 
166
      are therefore normally provided by the plugin runner, and not
 
167
      directly.
 
168
    </para>
 
169
    
90
170
    <variablelist>
91
171
      <varlistentry>
92
 
        <term><literal>-c</literal>, <literal>--connect=<replaceable>
93
 
        IP</replaceable></literal></term>
94
 
        <listitem>
95
 
          <para>
96
 
            Connect directly to a sepcified mandos server
97
 
          </para>
98
 
        </listitem>
99
 
      </varlistentry>
100
 
 
101
 
      <varlistentry>
102
 
        <term><literal>-d</literal>, <literal>--keydir=<replaceable>
103
 
        KEYDIR</replaceable></literal></term>
104
 
        <listitem>
105
 
          <para>
106
 
            Directory where the openpgp keyring is
107
 
          </para>
108
 
        </listitem>
109
 
      </varlistentry>      
110
 
 
111
 
      <varlistentry>
112
 
        <term><literal>-i</literal>, <literal>--interface=
113
 
        <replaceable>INTERFACE</replaceable></literal></term>
114
 
        <listitem>
115
 
          <para>
116
 
            Interface that Avahi will conntect through
117
 
          </para>
118
 
        </listitem>
119
 
      </varlistentry>      
120
 
 
121
 
      <varlistentry>
122
 
        <term><literal>-p</literal>, <literal>--pubkey=<replaceable>
123
 
        PUBKEY</replaceable></literal></term>
124
 
        <listitem>
125
 
          <para>
126
 
            Public openpgp key for gnutls authentication
127
 
          </para>
128
 
        </listitem>
129
 
      </varlistentry>      
130
 
 
131
 
      <varlistentry>
132
 
        <term><literal>-s</literal>, <literal>--seckey=<replaceable>
133
 
        SECKEY</replaceable></literal></term>
134
 
        <listitem>
135
 
          <para>
136
 
            Secret openpgp key for gnutls authentication
137
 
          </para>
138
 
        </listitem>
139
 
      </varlistentry>            
140
 
      
141
 
      <varlistentry>
142
 
        <term><literal>--priority=<replaceable>PRIORITY</replaceable>
143
 
        </literal></term>
144
 
        <listitem>
145
 
          <para>
146
 
            GNUTLS priority
147
 
          </para>
148
 
        </listitem>
149
 
      </varlistentry>            
150
 
 
151
 
      <varlistentry>
152
 
        <term><literal>--dh-bits=<replaceable>BITS</replaceable>
153
 
        </literal></term>
154
 
        <listitem>
155
 
          <para>
156
 
            dh-bits to use in gnutls communication
157
 
          </para>
158
 
        </listitem>
159
 
      </varlistentry>      
160
 
      
161
 
      <varlistentry>
162
 
        <term><literal>--debug</literal></term>
163
 
        <listitem>
164
 
          <para>
165
 
            Debug mode
166
 
          </para>
167
 
        </listitem>
168
 
      </varlistentry>
169
 
      
170
 
      <varlistentry>
171
 
        <term><literal>-?</literal>, <literal>--help</literal></term>
172
 
        <listitem>
173
 
          <para>
174
 
            Gives a help message
175
 
          </para>
176
 
        </listitem>
177
 
      </varlistentry>
178
 
      
179
 
      <varlistentry>
180
 
        <term><literal>--usage</literal></term>
181
 
        <listitem>
182
 
          <para>
183
 
            Gives a short usage message
184
 
          </para>
185
 
        </listitem>
186
 
      </varlistentry>
187
 
 
188
 
      <varlistentry>
189
 
        <term><literal>-V</literal>, <literal>--version</literal></term>
190
 
        <listitem>
191
 
          <para>
192
 
            Prints the program version
193
 
          </para>
194
 
        </listitem>
195
 
      </varlistentry>            
 
172
        <term><option>--connect=<replaceable
 
173
        >ADDRESS</replaceable><literal>:</literal><replaceable
 
174
        >PORT</replaceable></option></term>
 
175
        <term><option>-c
 
176
        <replaceable>ADDRESS</replaceable><literal>:</literal
 
177
        ><replaceable>PORT</replaceable></option></term>
 
178
        <listitem>
 
179
          <para>
 
180
            Do not use Zeroconf to locate servers.  Connect directly
 
181
            to only one specified <application>Mandos</application>
 
182
            server.  Note that an IPv6 address has colon characters in
 
183
            it, so the <emphasis>last</emphasis> colon character is
 
184
            assumed to separate the address from the port number.
 
185
          </para>
 
186
          <para>
 
187
            This option is normally only useful for testing and
 
188
            debugging.
 
189
          </para>
 
190
        </listitem>
 
191
      </varlistentry>
 
192
      
 
193
      <varlistentry>
 
194
        <term><option>--keydir=<replaceable
 
195
        >DIRECTORY</replaceable></option></term>
 
196
        <term><option>-d
 
197
        <replaceable>DIRECTORY</replaceable></option></term>
 
198
        <listitem>
 
199
          <para>
 
200
            Directory to read the OpenPGP key files
 
201
            <filename>pubkey.txt</filename> and
 
202
            <filename>seckey.txt</filename> from.  The default is
 
203
            <filename>/conf/conf.d/mandos</filename> (in the initial
 
204
            <acronym>RAM</acronym> disk environment).
 
205
          </para>
 
206
        </listitem>
 
207
      </varlistentry>
 
208
 
 
209
      <varlistentry>
 
210
        <term><option>--interface=
 
211
        <replaceable>NAME</replaceable></option></term>
 
212
        <term><option>-i
 
213
        <replaceable>NAME</replaceable></option></term>
 
214
        <listitem>
 
215
          <para>
 
216
            Network interface that will be brought up and scanned for
 
217
            Mandos servers to connect to.  The default it
 
218
            <quote><literal>eth0</literal></quote>.
 
219
          </para>
 
220
        </listitem>
 
221
      </varlistentry>
 
222
      
 
223
      <varlistentry>
 
224
        <term><option>--pubkey=<replaceable
 
225
        >FILE</replaceable></option></term>
 
226
        <term><option>-p
 
227
        <replaceable>FILE</replaceable></option></term>
 
228
        <listitem>
 
229
          <para>
 
230
            OpenPGP public key file base name.  This will be combined
 
231
            with the directory from the <option>--keydir</option>
 
232
            option to form an absolute file name.  The default name is
 
233
            <quote><literal>pubkey.txt</literal></quote>.
 
234
          </para>
 
235
        </listitem>
 
236
      </varlistentry>
 
237
 
 
238
      <varlistentry>
 
239
        <term><option>--seckey=<replaceable
 
240
        >FILE</replaceable></option></term>
 
241
        <term><option>-s
 
242
        <replaceable>FILE</replaceable></option></term>
 
243
        <listitem>
 
244
          <para>
 
245
            OpenPGP secret key file base name.  This will be combined
 
246
            with the directory from the <option>--keydir</option>
 
247
            option to form an absolute file name.  The default name is
 
248
            <quote><literal>seckey.txt</literal></quote>.
 
249
          </para>
 
250
        </listitem>
 
251
      </varlistentry>
 
252
      
 
253
      <varlistentry>
 
254
        <term><option>--priority=<replaceable
 
255
        >STRING</replaceable></option></term>
 
256
        <listitem>
 
257
          <xi:include href="../mandos-options.xml"
 
258
                      xpointer="priority"/>
 
259
        </listitem>
 
260
      </varlistentry>
 
261
 
 
262
      <varlistentry>
 
263
        <term><option>--dh-bits=<replaceable
 
264
        >BITS</replaceable></option></term>
 
265
        <listitem>
 
266
          <para>
 
267
            Sets the number of bits to use for the prime number in the
 
268
            TLS Diffie-Hellman key exchange.  Default is 1024.
 
269
          </para>
 
270
        </listitem>
 
271
      </varlistentry>
 
272
      
 
273
      <varlistentry>
 
274
        <term><option>--debug</option></term>
 
275
        <listitem>
 
276
          <para>
 
277
            Enable debug mode.  This will enable a lot of output to
 
278
            standard error about what the program is doing.  The
 
279
            program will still perform all other functions normally.
 
280
          </para>
 
281
          <para>
 
282
            It will also enable debug mode in the Avahi and GnuTLS
 
283
            libraries, making them print large amounts of debugging
 
284
            output.
 
285
          </para>
 
286
        </listitem>
 
287
      </varlistentry>
 
288
      
 
289
      <varlistentry>
 
290
        <term><option>--help</option></term>
 
291
        <term><option>-?</option></term>
 
292
        <listitem>
 
293
          <para>
 
294
            Gives a help message about options and their meanings.
 
295
          </para>
 
296
        </listitem>
 
297
      </varlistentry>
 
298
      
 
299
      <varlistentry>
 
300
        <term><option>--usage</option></term>
 
301
        <listitem>
 
302
          <para>
 
303
            Gives a short usage message.
 
304
          </para>
 
305
        </listitem>
 
306
      </varlistentry>
 
307
 
 
308
      <varlistentry>
 
309
        <term><option>--version</option></term>
 
310
        <term><option>-V</option></term>
 
311
        <listitem>
 
312
          <para>
 
313
            Prints the program version.
 
314
          </para>
 
315
        </listitem>
 
316
      </varlistentry>
196
317
    </variablelist>
197
318
  </refsect1>
 
319
 
 
320
  <refsect1 id="overview">
 
321
    <title>OVERVIEW</title>
 
322
    <xi:include href="../overview.xml"/>
 
323
    <para>
 
324
      This program is the client part.  It is a plugin started by
 
325
      <citerefentry><refentrytitle>plugin-runner</refentrytitle>
 
326
      <manvolnum>8mandos</manvolnum></citerefentry> which will run in
 
327
      an initial <acronym>RAM</acronym> disk environment.
 
328
    </para>
 
329
    <para>
 
330
      This program could, theoretically, be used as a keyscript in
 
331
      <filename>/etc/crypttab</filename>, but it would then be
 
332
      impossible to enter a password for the encrypted root disk at
 
333
      the console, since this program does not read from the console
 
334
      at all.  This is why a separate plugin does that, which will be
 
335
      run in parallell to this one by the plugin runner.
 
336
    </para>
 
337
  </refsect1>
 
338
  
 
339
  <refsect1 id="exit_status">
 
340
    <title>EXIT STATUS</title>
 
341
    <para>
 
342
      This program will exit with a successful (zero) exit status if a
 
343
      server could be found and the password received from it could be
 
344
      successfully decrypted and output on standard output.  The
 
345
      program will exit with a non-zero exit status only if a critical
 
346
      error occurs.  Otherwise, it will forever connect to new
 
347
      <application>Mandos</application> servers as they appear, trying
 
348
      to get a decryptable password.
 
349
    </para>
 
350
  </refsect1>
 
351
  
 
352
  <refsect1 id="environment">
 
353
    <title>ENVIRONMENT</title>
 
354
    <para>
 
355
      This program does not use any environment variables, not even
 
356
      the ones provided by <citerefentry><refentrytitle
 
357
      >cryptsetup</refentrytitle><manvolnum>8</manvolnum>
 
358
    </citerefentry>.
 
359
    </para>
 
360
  </refsect1>
 
361
  
 
362
  <refsect1 id="file">
 
363
    <title>FILES</title>
 
364
    <para>
 
365
    </para>
 
366
  </refsect1>
 
367
  
 
368
  <refsect1 id="bugs">
 
369
    <title>BUGS</title>
 
370
    <para>
 
371
    </para>
 
372
  </refsect1>
 
373
 
 
374
  <refsect1 id="example">
 
375
    <title>EXAMPLE</title>
 
376
    <para>
 
377
    </para>
 
378
  </refsect1>
 
379
 
 
380
  <refsect1 id="security">
 
381
    <title>SECURITY</title>
 
382
    <para>
 
383
    </para>
 
384
  </refsect1>
 
385
 
 
386
  <refsect1 id="see_also">
 
387
    <title>SEE ALSO</title>
 
388
    <para>
 
389
      <citerefentry><refentrytitle>mandos</refentrytitle>
 
390
      <manvolnum>8</manvolnum></citerefentry>,
 
391
      <citerefentry><refentrytitle>password-prompt</refentrytitle>
 
392
      <manvolnum>8mandos</manvolnum></citerefentry>,
 
393
      <citerefentry><refentrytitle>plugin-runner</refentrytitle>
 
394
      <manvolnum>8mandos</manvolnum></citerefentry>
 
395
    </para>
 
396
    <itemizedlist>
 
397
      <listitem><para>
 
398
        <ulink url="http://www.zeroconf.org/">Zeroconf</ulink>
 
399
      </para></listitem>
 
400
      
 
401
      <listitem><para>
 
402
        <ulink url="http://www.avahi.org/">Avahi</ulink>
 
403
      </para></listitem>
 
404
      
 
405
      <listitem><para>
 
406
        <ulink
 
407
            url="http://www.gnu.org/software/gnutls/">GnuTLS</ulink>
 
408
      </para></listitem>
 
409
      
 
410
      <listitem><para>
 
411
        <ulink
 
412
        url="http://www.gnupg.org/related_software/gpgme/"
 
413
        >GPGME</ulink>
 
414
      </para></listitem>
 
415
      
 
416
      <listitem><para>
 
417
        <citation>RFC 4880: <citetitle>OpenPGP Message
 
418
        Format</citetitle></citation>
 
419
      </para></listitem>
 
420
      
 
421
      <listitem><para>
 
422
        <citation>RFC 5081: <citetitle>Using OpenPGP Keys for
 
423
        Transport Layer Security</citetitle></citation>
 
424
      </para></listitem>
 
425
      
 
426
      <listitem><para>
 
427
        <citation>RFC 4291: <citetitle>IP Version 6 Addressing
 
428
        Architecture</citetitle>, section 2.5.6, Link-Local IPv6
 
429
        Unicast Addresses</citation>
 
430
      </para></listitem>
 
431
    </itemizedlist>
 
432
  </refsect1>
 
433
 
198
434
</refentry>
 
435
<!-- Local Variables: -->
 
436
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
 
437
<!-- time-stamp-end: "[\"']>" -->
 
438
<!-- time-stamp-format: "%:y-%02m-%02d" -->
 
439
<!-- End: -->