1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
<!ENTITY COMMANDNAME "mandos-client">
5
<!ENTITY TIMESTAMP "2016-07-10">
6
<!ENTITY % common SYSTEM "../common.ent">
4
<!ENTITY VERSION "1.0">
5
<!ENTITY COMMANDNAME "password-request">
6
<!ENTITY TIMESTAMP "2008-09-03">
10
9
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
12
11
<title>Mandos Manual</title>
13
<!-- NWalsh’s docbook scripts use this to generate the footer: -->
12
<!-- Nwalsh’s docbook scripts use this to generate the footer: -->
14
13
<productname>Mandos</productname>
15
<productnumber>&version;</productnumber>
14
<productnumber>&VERSION;</productnumber>
16
15
<date>&TIMESTAMP;</date>
19
18
<firstname>Björn</firstname>
20
19
<surname>Påhlsson</surname>
22
<email>belorn@recompile.se</email>
21
<email>belorn@fukt.bsnet.se</email>
26
25
<firstname>Teddy</firstname>
27
26
<surname>Hogeborn</surname>
29
<email>teddy@recompile.se</email>
28
<email>teddy@fukt.bsnet.se</email>
43
34
<holder>Teddy Hogeborn</holder>
44
35
<holder>Björn Påhlsson</holder>
46
37
<xi:include href="../legalnotice.xml"/>
50
41
<refentrytitle>&COMMANDNAME;</refentrytitle>
51
42
<manvolnum>8mandos</manvolnum>
143
115
</refsynopsisdiv>
145
117
<refsect1 id="description">
146
118
<title>DESCRIPTION</title>
148
120
<command>&COMMANDNAME;</command> is a client program that
149
121
communicates with <citerefentry><refentrytitle
150
122
>mandos</refentrytitle><manvolnum>8</manvolnum></citerefentry>
151
to get a password. In slightly more detail, this client program
152
brings up network interfaces, uses the interfaces’ IPv6
153
link-local addresses to get network connectivity, uses Zeroconf
154
to find servers on the local network, and communicates with
155
servers using TLS with an OpenPGP key to ensure authenticity and
156
confidentiality. This client program keeps running, trying all
157
servers on the network, until it receives a satisfactory reply
158
or a TERM signal. After all servers have been tried, all
159
servers are periodically retried. If no servers are found it
160
will wait indefinitely for new servers to appear.
163
The network interfaces are selected like this: If any interfaces
164
are specified using the <option>--interface</option> option,
165
those interface are used. Otherwise,
166
<command>&COMMANDNAME;</command> will use all interfaces that
167
are not loopback interfaces, are not point-to-point interfaces,
168
are capable of broadcasting and do not have the NOARP flag (see
169
<citerefentry><refentrytitle>netdevice</refentrytitle>
170
<manvolnum>7</manvolnum></citerefentry>). (If the
171
<option>--connect</option> option is used, point-to-point
172
interfaces and non-broadcast interfaces are accepted.) If any
173
used interfaces are not up and running, they are first taken up
174
(and later taken down again on program exit).
177
Before network interfaces are selected, all <quote>network
178
hooks</quote> are run; see <xref linkend="network-hooks"/>.
123
to get a password. It uses IPv6 link-local addresses to get
124
network connectivity, Zeroconf to find servers, and TLS with an
125
OpenPGP key to ensure authenticity and confidentiality. It
126
keeps running, trying all servers on the network, until it
127
receives a satisfactory reply or a TERM signal is recieved.
181
130
This program is not meant to be run directly; it is really meant
228
177
assumed to separate the address from the port number.
231
Normally, Zeroconf would be used to locate Mandos servers,
232
in which case this option would only be used when testing
180
This option is normally only useful for testing and
239
<term><option>--interface=<replaceable
240
>NAME</replaceable><arg rep='repeat'>,<replaceable
241
>NAME</replaceable></arg></option></term>
187
<term><option>--interface=
188
<replaceable>NAME</replaceable></option></term>
243
<replaceable>NAME</replaceable><arg rep='repeat'>,<replaceable
244
>NAME</replaceable></arg></option></term>
190
<replaceable>NAME</replaceable></option></term>
247
Comma separated list of network interfaces that will be
248
brought up and scanned for Mandos servers to connect to.
249
The default is the empty string, which will automatically
250
use all appropriate interfaces.
253
If the <option>--connect</option> option is used, and
254
exactly one interface name is specified (except
255
<quote><literal>none</literal></quote>), this specifies
256
the interface to use to connect to the address given.
259
Note that since this program will normally run in the
260
initial RAM disk environment, the interface must be an
261
interface which exists at that stage. Thus, the interface
262
can normally not be a pseudo-interface such as
263
<quote>br0</quote> or <quote>tun0</quote>; such interfaces
264
will not exist until much later in the boot process, and
265
can not be used by this program, unless created by a
266
<quote>network hook</quote> — see <xref
267
linkend="network-hooks"/>.
270
<replaceable>NAME</replaceable> can be the string
271
<quote><literal>none</literal></quote>; this will make
272
<command>&COMMANDNAME;</command> only bring up interfaces
273
specified <emphasis>before</emphasis> this string. This
274
is not recommended, and only meant for advanced users.
193
Network interface that will be brought up and scanned for
194
Mandos servers to connect to. The default it
195
<quote><literal>eth0</literal></quote>.
198
If the <option>--connect</option> option is used, this
199
specifies the interface to use to connect to the address
312
238
xpointer="priority"/>
317
243
<term><option>--dh-bits=<replaceable
318
244
>BITS</replaceable></option></term>
321
247
Sets the number of bits to use for the prime number in the
322
TLS Diffie-Hellman key exchange. The default value is
323
selected automatically based on the OpenPGP key. Note
324
that if the <option>--dh-params</option> option is used,
325
the values from that file will be used instead.
331
<term><option>--dh-params=<replaceable
332
>FILE</replaceable></option></term>
335
Specifies a PEM-encoded PKCS#3 file to read the parameters
336
needed by the TLS Diffie-Hellman key exchange from. If
337
this option is not given, or if the file for some reason
338
could not be used, the parameters will be generated on
339
startup, which will take some time and processing power.
340
Those using servers running under time, power or processor
341
constraints may want to generate such a file in advance
348
<term><option>--delay=<replaceable
349
>SECONDS</replaceable></option></term>
352
After bringing a network interface up, the program waits
353
for the interface to arrive in a <quote>running</quote>
354
state before proceeding. During this time, the kernel log
355
level will be lowered to reduce clutter on the system
356
console, alleviating any other plugins which might be
357
using the system console. This option sets the upper
358
limit of seconds to wait. The default is 2.5 seconds.
364
<term><option>--retry=<replaceable
365
>SECONDS</replaceable></option></term>
368
All Mandos servers are tried repeatedly until a password
369
is received. This value specifies, in seconds, how long
370
between each successive try <emphasis>for the same
371
server</emphasis>. The default is 10 seconds.
377
<term><option>--network-hook-dir=<replaceable
378
>DIR</replaceable></option></term>
381
Network hook directory. The default directory is
382
<quote><filename class="directory"
383
>/lib/mandos/network-hooks.d</filename></quote>.
248
TLS Diffie-Hellman key exchange. Default is 1024.
464
325
server could be found and the password received from it could be
465
326
successfully decrypted and output on standard output. The
466
327
program will exit with a non-zero exit status only if a critical
467
error occurs. Otherwise, it will forever connect to any
468
discovered <application>Mandos</application> servers, trying to
469
get a decryptable password and print it.
328
error occurs. Otherwise, it will forever connect to new
329
<application>Mandos</application> servers as they appear, trying
330
to get a decryptable password.
473
334
<refsect1 id="environment">
474
335
<title>ENVIRONMENT</title>
477
<term><envar>MANDOSPLUGINHELPERDIR</envar></term>
480
This environment variable will be assumed to contain the
481
directory containing any helper executables. The use and
482
nature of these helper executables, if any, is
483
purposefully not documented.
489
This program does not use any other environment variables, not
490
even the ones provided by <citerefentry><refentrytitle
337
This program does not use any environment variables, not even
338
the ones provided by <citerefentry><refentrytitle
491
339
>cryptsetup</refentrytitle><manvolnum>8</manvolnum>
496
<refsect1 id="network-hooks">
497
<title>NETWORK HOOKS</title>
499
If a network interface like a bridge or tunnel is required to
500
find a Mandos server, this requires the interface to be up and
501
running before <command>&COMMANDNAME;</command> starts looking
502
for Mandos servers. This can be accomplished by creating a
503
<quote>network hook</quote> program, and placing it in a special
507
Before the network is used (and again before program exit), any
508
runnable programs found in the network hook directory are run
509
with the argument <quote><literal>start</literal></quote> or
510
<quote><literal>stop</literal></quote>. This should bring up or
511
down, respectively, any network interface which
512
<command>&COMMANDNAME;</command> should use.
514
<refsect2 id="hook-requirements">
515
<title>REQUIREMENTS</title>
517
A network hook must be an executable file, and its name must
518
consist entirely of upper and lower case letters, digits,
519
underscores, periods, and hyphens.
522
A network hook will receive one argument, which can be one of
527
<term><literal>start</literal></term>
530
This should make the network hook create (if necessary)
531
and bring up a network interface.
536
<term><literal>stop</literal></term>
539
This should make the network hook take down a network
540
interface, and delete it if it did not exist previously.
545
<term><literal>files</literal></term>
548
This should make the network hook print, <emphasis>one
549
file per line</emphasis>, all the files needed for it to
550
run. (These files will be copied into the initial RAM
551
filesystem.) Typical use is for a network hook which is
552
a shell script to print its needed binaries.
555
It is not necessary to print any non-executable files
556
already in the network hook directory, these will be
557
copied implicitly if they otherwise satisfy the name
563
<term><literal>modules</literal></term>
566
This should make the network hook print, <emphasis>on
567
separate lines</emphasis>, all the kernel modules needed
568
for it to run. (These modules will be copied into the
569
initial RAM filesystem.) For instance, a tunnel
571
<quote><literal>tun</literal></quote> module.
577
The network hook will be provided with a number of environment
582
<term><envar>MANDOSNETHOOKDIR</envar></term>
585
The network hook directory, specified to
586
<command>&COMMANDNAME;</command> by the
587
<option>--network-hook-dir</option> option. Note: this
588
should <emphasis>always</emphasis> be used by the
589
network hook to refer to itself or any files in the hook
590
directory it may require.
595
<term><envar>DEVICE</envar></term>
598
The network interfaces, as specified to
599
<command>&COMMANDNAME;</command> by the
600
<option>--interface</option> option, combined to one
601
string and separated by commas. If this is set, and
602
does not contain the interface a hook will bring up,
603
there is no reason for a hook to continue.
608
<term><envar>MODE</envar></term>
611
This will be the same as the first argument;
612
i.e. <quote><literal>start</literal></quote>,
613
<quote><literal>stop</literal></quote>,
614
<quote><literal>files</literal></quote>, or
615
<quote><literal>modules</literal></quote>.
620
<term><envar>VERBOSITY</envar></term>
623
This will be the <quote><literal>1</literal></quote> if
624
the <option>--debug</option> option is passed to
625
<command>&COMMANDNAME;</command>, otherwise
626
<quote><literal>0</literal></quote>.
631
<term><envar>DELAY</envar></term>
634
This will be the same as the <option>--delay</option>
635
option passed to <command>&COMMANDNAME;</command>. Is
636
only set if <envar>MODE</envar> is
637
<quote><literal>start</literal></quote> or
638
<quote><literal>stop</literal></quote>.
643
<term><envar>CONNECT</envar></term>
646
This will be the same as the <option>--connect</option>
647
option passed to <command>&COMMANDNAME;</command>. Is
648
only set if <option>--connect</option> is passed and
649
<envar>MODE</envar> is
650
<quote><literal>start</literal></quote> or
651
<quote><literal>stop</literal></quote>.
657
A hook may not read from standard input, and should be
658
restrictive in printing to standard output or standard error
659
unless <varname>VERBOSITY</varname> is
660
<quote><literal>1</literal></quote>.
665
<refsect1 id="files">
666
345
<title>FILES</title>
778
446
The only remaining weak point is that someone with physical
779
447
access to the client hard drive might turn off the client
780
448
computer, read the OpenPGP keys directly from the hard drive,
781
and communicate with the server. To safeguard against this, the
782
server is supposed to notice the client disappearing and stop
783
giving out the encrypted data. Therefore, it is important to
784
set the timeout and checker interval values tightly on the
785
server. See <citerefentry><refentrytitle
449
and communicate with the server. The defense against this is
450
that the server is supposed to notice the client disappearing
451
and will stop giving out the encrypted data. Therefore, it is
452
important to set the timeout and checker interval values tightly
453
on the server. See <citerefentry><refentrytitle
786
454
>mandos</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
789
457
It will also help if the checker program on the server is
790
458
configured to request something from the client which can not be
791
spoofed by someone else on the network, like SSH server key
792
fingerprints, and unlike unencrypted <acronym>ICMP</acronym>
793
echo (<quote>ping</quote>) replies.
459
spoofed by someone else on the network, unlike unencrypted
460
<acronym>ICMP</acronym> echo (<quote>ping</quote>) replies.
796
463
<emphasis>Note</emphasis>: This makes it completely insecure to