/mandos/trunk : revision 165

3

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

4

<!ENTITY VERSION "1.0">

5

<!ENTITY COMMANDNAME "mandos">

6

<!ENTITY TIMESTAMP "2008-08-29">

6

<!ENTITY TIMESTAMP "2008-09-05">

7

]>

8

9

34

<holder>Teddy Hogeborn</holder>

35

<holder>Björn Påhlsson</holder>

36

</copyright>

37

38

<para>

39

This manual page is free software: you can redistribute it

40

and/or modify it under the terms of the GNU General Public

41

License as published by the Free Software Foundation,

42

either version 3 of the License, or (at your option) any

43

later version.

44

</para>

45

46

<para>

47

This manual page is distributed in the hope that it will

48

be useful, but WITHOUT ANY WARRANTY; without even the

49

implied warranty of MERCHANTABILITY or FITNESS FOR A

50

PARTICULAR PURPOSE. See the GNU General Public License

51

for more details.

52

</para>

53

54

<para>

55

You should have received a copy of the GNU General Public

56

License along with this program; If not, see

57

<ulink url="http://www.gnu.org/licenses/"/>.

58

</para>

59

</legalnotice>

37

<xi:include href="legalnotice.xml"/>

60

38

</refentryinfo>

61

39

62

40

67

45

68

46

<refname><command>&COMMANDNAME;</command></refname>

69

47

70

Sends encrypted passwords to authenticated Mandos clients

48

Gives encrypted passwords to authenticated Mandos clients

71

49

</refpurpose>

72

50

</refnamediv>

73

51

74

52

75

53

76

54

<command>&COMMANDNAME;</command>

77

<arg>--interface<arg choice="plain">NAME</arg></arg>

78

<arg>--address<arg choice="plain">ADDRESS</arg></arg>

79

80

<arg>--priority<arg choice="plain">PRIORITY</arg></arg>

81

<arg>--servicename<arg choice="plain">NAME</arg></arg>

82

<arg>--configdir<arg choice="plain">DIRECTORY</arg></arg>

83

<arg>--debug</arg>

84

</cmdsynopsis>

85

86

<command>&COMMANDNAME;</command>

87

88

<arg>-a<arg choice="plain">ADDRESS</arg></arg>

89

90

<arg>--priority<arg choice="plain">PRIORITY</arg></arg>

91

<arg>--servicename<arg choice="plain">NAME</arg></arg>

92

<arg>--configdir<arg choice="plain">DIRECTORY</arg></arg>

93

<arg>--debug</arg>

55

<group>

56

<arg choice="plain"><option>--interface

57

58

<arg choice="plain"><option>-i

59

60

</group>

61

<sbr/>

62

<group>

63

<arg choice="plain"><option>--address

64

<replaceable>ADDRESS</replaceable></option></arg>

65

<arg choice="plain"><option>-a

66

<replaceable>ADDRESS</replaceable></option></arg>

67

</group>

68

<sbr/>

69

<group>

70

<arg choice="plain"><option>--port

71

72

<arg choice="plain"><option>-p

73

74

</group>

75

<sbr/>

76

<arg><option>--priority

77

<replaceable>PRIORITY</replaceable></option></arg>

78

<sbr/>

79

<arg><option>--servicename

80

81

<sbr/>

82

<arg><option>--configdir

83

<replaceable>DIRECTORY</replaceable></option></arg>

84

<sbr/>

85

<arg><option>--debug</option></arg>

94

86

</cmdsynopsis>

95

87

96

88

<command>&COMMANDNAME;</command>

97

89

98

99

90

91

100

92

</group>

101

93

</cmdsynopsis>

102

94

103

95

<command>&COMMANDNAME;</command>

104

<arg choice="plain">--version</arg>

96

<arg choice="plain"><option>--version</option></arg>

105

97

</cmdsynopsis>

106

98

107

99

<command>&COMMANDNAME;</command>

108

<arg choice="plain">--check</arg>

100

<arg choice="plain"><option>--check</option></arg>

109

101

</cmdsynopsis>

110

102

</refsynopsisdiv>

111

103

123

115

Any authenticated client is then given the stored pre-encrypted

124

116

password for that specific client.

125

117

</para>

126

127

118

</refsect1>

128

119

129

120

130

121

<title>PURPOSE</title>

131

132

122

<para>

133

123

The purpose of this is to enable <emphasis>remote and unattended

134

124

rebooting</emphasis> of client host computer with an

135

125

<emphasis>encrypted root file system</emphasis>. See <xref

136

126

linkend="overview"/> for details.

137

127

</para>

138

139

128

</refsect1>

140

129

141

130

142

131

<title>OPTIONS</title>

143

144

132

145

133

146

134

135

147

136

148

137

<para>

149

138

Show a help message and exit

150

139

</para>

151

140

</listitem>

152

141

</varlistentry>

153

142

154

143

155

<term><literal>-i</literal>, <literal>--interface <replaceable

156

>NAME</replaceable></literal></term>

144

<term><option>--interface</option>

145

146

147

157

148

158

149

<xi:include href="mandos-options.xml" xpointer="interface"/>

159

150

</listitem>

160

151

</varlistentry>

161

152

162

153

163

<term><literal>-a</literal>, <literal>--address <replaceable>

164

ADDRESS</replaceable></literal></term>

154

<term><option>--address

155

<replaceable>ADDRESS</replaceable></option></term>

156

<term><option>-a

157

<replaceable>ADDRESS</replaceable></option></term>

165

158

166

159

<xi:include href="mandos-options.xml" xpointer="address"/>

167

160

</listitem>

168

161

</varlistentry>

169

162

170

163

171

172

PORT</replaceable></literal></term>

164

<term><option>--port

165

166

<term><option>-p

167

173

168

174

169

<xi:include href="mandos-options.xml" xpointer="port"/>

175

170

</listitem>

176

171

</varlistentry>

177

172

178

173

179

<term><literal>--check</literal></term>

174

<term><option>--check</option></term>

180

175

181

176

<para>

182

177

Run the server’s self-tests. This includes any unit

184

179

</para>

185

180

</listitem>

186

181

</varlistentry>

187

182

188

183

189

<term><literal>--debug</literal></term>

184

<term><option>--debug</option></term>

190

185

191

186

<xi:include href="mandos-options.xml" xpointer="debug"/>

192

187

</listitem>

193

188

</varlistentry>

194

189

195

190

196

<term><literal>--priority <replaceable>

197

PRIORITY</replaceable></literal></term>

191

<term><option>--priority <replaceable>

192

PRIORITY</replaceable></option></term>

198

193

199

194

<xi:include href="mandos-options.xml" xpointer="priority"/>

200

195

</listitem>

201

196

</varlistentry>

202

197

203

198

204

<term><literal>--servicename <replaceable>NAME</replaceable>

205

</literal></term>

199

<term><option>--servicename

200

206

201

207

202

<xi:include href="mandos-options.xml"

208

203

xpointer="servicename"/>

210

205

</varlistentry>

211

206

212

207

213

<term><literal>--configdir <replaceable>DIR</replaceable>

214

</literal></term>

208

<term><option>--configdir

209

<replaceable>DIRECTORY</replaceable></option></term>

215

210

216

211

<para>

217

212

Directory to search for configuration files. Default is

225

220

</varlistentry>

226

221

227

222

228

<term><literal>--version</literal></term>

223

<term><option>--version</option></term>

229

224

230

225

<para>

231

226

Prints the program version and exit.

241

236

<para>

242

237

This program is the server part. It is a normal server program

243

238

and will run in a normal system environment, not in an initial

244

RAM disk environment.

239

<acronym>RAM</acronym> disk environment.

245

240

</para>

246

241

</refsect1>

247

242

339

334

<title>ENVIRONMENT</title>

340

335

341

336

342

337

343

338

344

339

<para>

345

340

To start the configured checker (see <xref

384

379

</listitem>

385

380

</varlistentry>

386

381

387

<term><filename>/var/run/mandos/mandos.pid</filename></term>

382

<term><filename>/var/run/mandos.pid</filename></term>

388

383

389

384

<para>

390

385

The file containing the process id of

439

434

Debug mode is conflated with running in the foreground.

440

435

</para>

441

436

<para>

442

The console log messages does not show a timestamp.

437

The console log messages does not show a time stamp.

438

</para>

439

<para>

440

This server does not check the expire time of clients’ OpenPGP

441

keys.

443

442

</para>

444

443

</refsect1>

445

444

488

487

<para>

489

488

Running this <command>&COMMANDNAME;</command> server program

490

489

should not in itself present any security risk to the host

491

computer running it. The program does not need any special

492

privileges to run, and is designed to run as a non-root user.

490

computer running it. The program switches to a non-root user

491

soon after startup.

493

492

</para>

494

493

</refsect2>

495

494

522

521

restarting servers if it is suspected that a client has, in

523

522

fact, been compromised by parties who may now be running a

524

523

fake Mandos client with the keys from the non-encrypted

525

initial RAM image of the client host. What should be done in

526

that case (if restarting the server program really is

527

necessary) is to stop the server program, edit the

524

initial <acronym>RAM</acronym> image of the client host. What

525

should be done in that case (if restarting the server program

526

really is necessary) is to stop the server program, edit the

528

527

configuration file to omit any suspect clients, and restart

529

528

the server program.

530

529

</para>

540

539

541

540

<para>

542

541

542

<refentrytitle>mandos-clients.conf</refentrytitle>

543

543

544

<refentrytitle>mandos.conf</refentrytitle>

544

545

545

<refentrytitle>mandos-clients.conf</refentrytitle>

546

547

546

<refentrytitle>password-request</refentrytitle>

548

547

<manvolnum>8mandos</manvolnum></citerefentry>, <citerefentry>

549

548