/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos.xml

Merge from trunk.  Bug fix for initramfs-tools-hook.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos.xml
1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
 
<!ENTITY VERSION "1.0">
5
4
<!ENTITY COMMANDNAME "mandos">
6
 
<!ENTITY TIMESTAMP "2008-09-02">
 
5
<!ENTITY TIMESTAMP "2009-02-24">
 
6
<!ENTITY % common SYSTEM "common.ent">
 
7
%common;
7
8
]>
8
9
 
9
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
10
 
  <refentryinfo>
 
11
   <refentryinfo>
11
12
    <title>Mandos Manual</title>
12
13
    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
13
14
    <productname>Mandos</productname>
14
 
    <productnumber>&VERSION;</productnumber>
 
15
    <productnumber>&version;</productnumber>
15
16
    <date>&TIMESTAMP;</date>
16
17
    <authorgroup>
17
18
      <author>
31
32
    </authorgroup>
32
33
    <copyright>
33
34
      <year>2008</year>
 
35
      <year>2009</year>
34
36
      <holder>Teddy Hogeborn</holder>
35
37
      <holder>Björn Påhlsson</holder>
36
38
    </copyright>
37
39
    <xi:include href="legalnotice.xml"/>
38
40
  </refentryinfo>
39
 
 
 
41
  
40
42
  <refmeta>
41
43
    <refentrytitle>&COMMANDNAME;</refentrytitle>
42
44
    <manvolnum>8</manvolnum>
48
50
      Gives encrypted passwords to authenticated Mandos clients
49
51
    </refpurpose>
50
52
  </refnamediv>
51
 
 
 
53
  
52
54
  <refsynopsisdiv>
53
55
    <cmdsynopsis>
54
56
      <command>&COMMANDNAME;</command>
83
85
      <replaceable>DIRECTORY</replaceable></option></arg>
84
86
      <sbr/>
85
87
      <arg><option>--debug</option></arg>
 
88
      <sbr/>
 
89
      <arg><option>--no-ipv6</option></arg>
86
90
    </cmdsynopsis>
87
91
    <cmdsynopsis>
88
92
      <command>&COMMANDNAME;</command>
100
104
      <arg choice="plain"><option>--check</option></arg>
101
105
    </cmdsynopsis>
102
106
  </refsynopsisdiv>
103
 
 
 
107
  
104
108
  <refsect1 id="description">
105
109
    <title>DESCRIPTION</title>
106
110
    <para>
186
190
          <xi:include href="mandos-options.xml" xpointer="debug"/>
187
191
        </listitem>
188
192
      </varlistentry>
189
 
 
 
193
      
190
194
      <varlistentry>
191
195
        <term><option>--priority <replaceable>
192
196
        PRIORITY</replaceable></option></term>
194
198
          <xi:include href="mandos-options.xml" xpointer="priority"/>
195
199
        </listitem>
196
200
      </varlistentry>
197
 
 
 
201
      
198
202
      <varlistentry>
199
203
        <term><option>--servicename
200
204
        <replaceable>NAME</replaceable></option></term>
203
207
                      xpointer="servicename"/>
204
208
        </listitem>
205
209
      </varlistentry>
206
 
 
 
210
      
207
211
      <varlistentry>
208
212
        <term><option>--configdir
209
213
        <replaceable>DIRECTORY</replaceable></option></term>
218
222
          </para>
219
223
        </listitem>
220
224
      </varlistentry>
221
 
 
 
225
      
222
226
      <varlistentry>
223
227
        <term><option>--version</option></term>
224
228
        <listitem>
227
231
          </para>
228
232
        </listitem>
229
233
      </varlistentry>
 
234
      
 
235
      <varlistentry>
 
236
        <term><option>--no-ipv6</option></term>
 
237
        <listitem>
 
238
          <xi:include href="mandos-options.xml" xpointer="ipv6"/>
 
239
        </listitem>
 
240
      </varlistentry>
230
241
    </variablelist>
231
242
  </refsect1>
232
 
 
 
243
  
233
244
  <refsect1 id="overview">
234
245
    <title>OVERVIEW</title>
235
246
    <xi:include href="overview.xml"/>
239
250
      <acronym>RAM</acronym> disk environment.
240
251
    </para>
241
252
  </refsect1>
242
 
 
 
253
  
243
254
  <refsect1 id="protocol">
244
255
    <title>NETWORK PROTOCOL</title>
245
256
    <para>
297
308
      </row>
298
309
    </tbody></tgroup></table>
299
310
  </refsect1>
300
 
 
 
311
  
301
312
  <refsect1 id="checking">
302
313
    <title>CHECKING</title>
303
314
    <para>
311
322
      <manvolnum>5</manvolnum></citerefentry>.
312
323
    </para>
313
324
  </refsect1>
314
 
 
 
325
  
315
326
  <refsect1 id="logging">
316
327
    <title>LOGGING</title>
317
328
    <para>
321
332
      and also show them on the console.
322
333
    </para>
323
334
  </refsect1>
324
 
 
 
335
  
325
336
  <refsect1 id="exit_status">
326
337
    <title>EXIT STATUS</title>
327
338
    <para>
329
340
      critical error is encountered.
330
341
    </para>
331
342
  </refsect1>
332
 
 
 
343
  
333
344
  <refsect1 id="environment">
334
345
    <title>ENVIRONMENT</title>
335
346
    <variablelist>
349
360
      </varlistentry>
350
361
    </variablelist>
351
362
  </refsect1>
352
 
 
353
 
  <refsect1 id="file">
 
363
  
 
364
  <refsect1 id="files">
354
365
    <title>FILES</title>
355
366
    <para>
356
367
      Use the <option>--configdir</option> option to change where
379
390
        </listitem>
380
391
      </varlistentry>
381
392
      <varlistentry>
382
 
        <term><filename>/var/run/mandos/mandos.pid</filename></term>
 
393
        <term><filename>/var/run/mandos.pid</filename></term>
383
394
        <listitem>
384
395
          <para>
385
396
            The file containing the process id of
420
431
      Currently, if a client is declared <quote>invalid</quote> due to
421
432
      having timed out, the server does not record this fact onto
422
433
      permanent storage.  This has some security implications, see
423
 
      <xref linkend="CLIENTS"/>.
 
434
      <xref linkend="clients"/>.
424
435
    </para>
425
436
    <para>
426
437
      There is currently no way of querying the server of the current
434
445
      Debug mode is conflated with running in the foreground.
435
446
    </para>
436
447
    <para>
437
 
      The console log messages does not show a timestamp.
 
448
      The console log messages do not show a time stamp.
 
449
    </para>
 
450
    <para>
 
451
      This server does not check the expire time of clients’ OpenPGP
 
452
      keys.
438
453
    </para>
439
454
  </refsect1>
440
455
  
475
490
      </para>
476
491
    </informalexample>
477
492
  </refsect1>
478
 
 
 
493
  
479
494
  <refsect1 id="security">
480
495
    <title>SECURITY</title>
481
 
    <refsect2 id="SERVER">
 
496
    <refsect2 id="server">
482
497
      <title>SERVER</title>
483
498
      <para>
484
499
        Running this <command>&COMMANDNAME;</command> server program
485
500
        should not in itself present any security risk to the host
486
 
        computer running it.  The program does not need any special
487
 
        privileges to run, and is designed to run as a non-root user.
 
501
        computer running it.  The program switches to a non-root user
 
502
        soon after startup.
488
503
      </para>
489
504
    </refsect2>
490
 
    <refsect2 id="CLIENTS">
 
505
    <refsect2 id="clients">
491
506
      <title>CLIENTS</title>
492
507
      <para>
493
508
        The server only gives out its stored data to clients which
500
515
        <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
501
516
        <manvolnum>5</manvolnum></citerefentry>)
502
517
        <emphasis>must</emphasis> be made non-readable by anyone
503
 
        except the user running the server.
 
518
        except the user starting the server (usually root).
504
519
      </para>
505
520
      <para>
506
521
        As detailed in <xref linkend="checking"/>, the status of all
525
540
      </para>
526
541
      <para>
527
542
        For more details on client-side security, see
528
 
        <citerefentry><refentrytitle>password-request</refentrytitle>
 
543
        <citerefentry><refentrytitle>mandos-client</refentrytitle>
529
544
        <manvolnum>8mandos</manvolnum></citerefentry>.
530
545
      </para>
531
546
    </refsect2>
532
547
  </refsect1>
533
 
 
 
548
  
534
549
  <refsect1 id="see_also">
535
550
    <title>SEE ALSO</title>
536
551
    <para>
539
554
        <manvolnum>5</manvolnum></citerefentry>, <citerefentry>
540
555
        <refentrytitle>mandos.conf</refentrytitle>
541
556
        <manvolnum>5</manvolnum></citerefentry>, <citerefentry>
542
 
        <refentrytitle>password-request</refentrytitle>
 
557
        <refentrytitle>mandos-client</refentrytitle>
543
558
        <manvolnum>8mandos</manvolnum></citerefentry>, <citerefentry>
544
559
        <refentrytitle>sh</refentrytitle><manvolnum>1</manvolnum>
545
560
      </citerefentry>