/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos.xml

* initramfs-tools-hook-conf: Security bug fix: Add code to handle
                             being called by "mkinitramfs-kpkg"
                             instead of "update-initramfs".

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos.xml
1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
 
<!ENTITY VERSION "1.0">
5
4
<!ENTITY COMMANDNAME "mandos">
6
 
<!ENTITY TIMESTAMP "2008-09-03">
 
5
<!ENTITY TIMESTAMP "2009-02-24">
 
6
<!ENTITY % common SYSTEM "common.ent">
 
7
%common;
7
8
]>
8
9
 
9
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
10
 
  <refentryinfo>
 
11
   <refentryinfo>
11
12
    <title>Mandos Manual</title>
12
13
    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
13
14
    <productname>Mandos</productname>
14
 
    <productnumber>&VERSION;</productnumber>
 
15
    <productnumber>&version;</productnumber>
15
16
    <date>&TIMESTAMP;</date>
16
17
    <authorgroup>
17
18
      <author>
31
32
    </authorgroup>
32
33
    <copyright>
33
34
      <year>2008</year>
 
35
      <year>2009</year>
34
36
      <holder>Teddy Hogeborn</holder>
35
37
      <holder>Björn Påhlsson</holder>
36
38
    </copyright>
37
39
    <xi:include href="legalnotice.xml"/>
38
40
  </refentryinfo>
39
 
 
 
41
  
40
42
  <refmeta>
41
43
    <refentrytitle>&COMMANDNAME;</refentrytitle>
42
44
    <manvolnum>8</manvolnum>
48
50
      Gives encrypted passwords to authenticated Mandos clients
49
51
    </refpurpose>
50
52
  </refnamediv>
51
 
 
 
53
  
52
54
  <refsynopsisdiv>
53
55
    <cmdsynopsis>
54
56
      <command>&COMMANDNAME;</command>
83
85
      <replaceable>DIRECTORY</replaceable></option></arg>
84
86
      <sbr/>
85
87
      <arg><option>--debug</option></arg>
 
88
      <sbr/>
 
89
      <arg><option>--no-ipv6</option></arg>
86
90
    </cmdsynopsis>
87
91
    <cmdsynopsis>
88
92
      <command>&COMMANDNAME;</command>
100
104
      <arg choice="plain"><option>--check</option></arg>
101
105
    </cmdsynopsis>
102
106
  </refsynopsisdiv>
103
 
 
 
107
  
104
108
  <refsect1 id="description">
105
109
    <title>DESCRIPTION</title>
106
110
    <para>
186
190
          <xi:include href="mandos-options.xml" xpointer="debug"/>
187
191
        </listitem>
188
192
      </varlistentry>
189
 
 
 
193
      
190
194
      <varlistentry>
191
195
        <term><option>--priority <replaceable>
192
196
        PRIORITY</replaceable></option></term>
194
198
          <xi:include href="mandos-options.xml" xpointer="priority"/>
195
199
        </listitem>
196
200
      </varlistentry>
197
 
 
 
201
      
198
202
      <varlistentry>
199
203
        <term><option>--servicename
200
204
        <replaceable>NAME</replaceable></option></term>
203
207
                      xpointer="servicename"/>
204
208
        </listitem>
205
209
      </varlistentry>
206
 
 
 
210
      
207
211
      <varlistentry>
208
212
        <term><option>--configdir
209
213
        <replaceable>DIRECTORY</replaceable></option></term>
218
222
          </para>
219
223
        </listitem>
220
224
      </varlistentry>
221
 
 
 
225
      
222
226
      <varlistentry>
223
227
        <term><option>--version</option></term>
224
228
        <listitem>
227
231
          </para>
228
232
        </listitem>
229
233
      </varlistentry>
 
234
      
 
235
      <varlistentry>
 
236
        <term><option>--no-ipv6</option></term>
 
237
        <listitem>
 
238
          <xi:include href="mandos-options.xml" xpointer="ipv6"/>
 
239
        </listitem>
 
240
      </varlistentry>
230
241
    </variablelist>
231
242
  </refsect1>
232
 
 
 
243
  
233
244
  <refsect1 id="overview">
234
245
    <title>OVERVIEW</title>
235
246
    <xi:include href="overview.xml"/>
239
250
      <acronym>RAM</acronym> disk environment.
240
251
    </para>
241
252
  </refsect1>
242
 
 
 
253
  
243
254
  <refsect1 id="protocol">
244
255
    <title>NETWORK PROTOCOL</title>
245
256
    <para>
297
308
      </row>
298
309
    </tbody></tgroup></table>
299
310
  </refsect1>
300
 
 
 
311
  
301
312
  <refsect1 id="checking">
302
313
    <title>CHECKING</title>
303
314
    <para>
311
322
      <manvolnum>5</manvolnum></citerefentry>.
312
323
    </para>
313
324
  </refsect1>
314
 
 
 
325
  
315
326
  <refsect1 id="logging">
316
327
    <title>LOGGING</title>
317
328
    <para>
321
332
      and also show them on the console.
322
333
    </para>
323
334
  </refsect1>
324
 
 
 
335
  
325
336
  <refsect1 id="exit_status">
326
337
    <title>EXIT STATUS</title>
327
338
    <para>
329
340
      critical error is encountered.
330
341
    </para>
331
342
  </refsect1>
332
 
 
 
343
  
333
344
  <refsect1 id="environment">
334
345
    <title>ENVIRONMENT</title>
335
346
    <variablelist>
349
360
      </varlistentry>
350
361
    </variablelist>
351
362
  </refsect1>
352
 
 
353
 
  <refsect1 id="file">
 
363
  
 
364
  <refsect1 id="files">
354
365
    <title>FILES</title>
355
366
    <para>
356
367
      Use the <option>--configdir</option> option to change where
379
390
        </listitem>
380
391
      </varlistentry>
381
392
      <varlistentry>
382
 
        <term><filename>/var/run/mandos/mandos.pid</filename></term>
 
393
        <term><filename>/var/run/mandos.pid</filename></term>
383
394
        <listitem>
384
395
          <para>
385
396
            The file containing the process id of
420
431
      Currently, if a client is declared <quote>invalid</quote> due to
421
432
      having timed out, the server does not record this fact onto
422
433
      permanent storage.  This has some security implications, see
423
 
      <xref linkend="CLIENTS"/>.
 
434
      <xref linkend="clients"/>.
424
435
    </para>
425
436
    <para>
426
437
      There is currently no way of querying the server of the current
434
445
      Debug mode is conflated with running in the foreground.
435
446
    </para>
436
447
    <para>
437
 
      The console log messages does not show a timestamp.
 
448
      The console log messages do not show a time stamp.
438
449
    </para>
439
450
    <para>
440
451
      This server does not check the expire time of clients’ OpenPGP
479
490
      </para>
480
491
    </informalexample>
481
492
  </refsect1>
482
 
 
 
493
  
483
494
  <refsect1 id="security">
484
495
    <title>SECURITY</title>
485
 
    <refsect2 id="SERVER">
 
496
    <refsect2 id="server">
486
497
      <title>SERVER</title>
487
498
      <para>
488
499
        Running this <command>&COMMANDNAME;</command> server program
489
500
        should not in itself present any security risk to the host
490
 
        computer running it.  The program does not need any special
491
 
        privileges to run, and is designed to run as a non-root user.
 
501
        computer running it.  The program switches to a non-root user
 
502
        soon after startup.
492
503
      </para>
493
504
    </refsect2>
494
 
    <refsect2 id="CLIENTS">
 
505
    <refsect2 id="clients">
495
506
      <title>CLIENTS</title>
496
507
      <para>
497
508
        The server only gives out its stored data to clients which
504
515
        <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
505
516
        <manvolnum>5</manvolnum></citerefentry>)
506
517
        <emphasis>must</emphasis> be made non-readable by anyone
507
 
        except the user running the server.
 
518
        except the user starting the server (usually root).
508
519
      </para>
509
520
      <para>
510
521
        As detailed in <xref linkend="checking"/>, the status of all
529
540
      </para>
530
541
      <para>
531
542
        For more details on client-side security, see
532
 
        <citerefentry><refentrytitle>password-request</refentrytitle>
 
543
        <citerefentry><refentrytitle>mandos-client</refentrytitle>
533
544
        <manvolnum>8mandos</manvolnum></citerefentry>.
534
545
      </para>
535
546
    </refsect2>
536
547
  </refsect1>
537
 
 
 
548
  
538
549
  <refsect1 id="see_also">
539
550
    <title>SEE ALSO</title>
540
551
    <para>
543
554
        <manvolnum>5</manvolnum></citerefentry>, <citerefentry>
544
555
        <refentrytitle>mandos.conf</refentrytitle>
545
556
        <manvolnum>5</manvolnum></citerefentry>, <citerefentry>
546
 
        <refentrytitle>password-request</refentrytitle>
 
557
        <refentrytitle>mandos-client</refentrytitle>
547
558
        <manvolnum>8mandos</manvolnum></citerefentry>, <citerefentry>
548
559
        <refentrytitle>sh</refentrytitle><manvolnum>1</manvolnum>
549
560
      </citerefentry>