/mandos/trunk : revision 237.4.28

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to plugins.d/mandos-client.xml

Committer: Teddy Hogeborn
Date: 2012-01-15 21:07:44 UTC
mto: (237.4.29 release)
mto: This revision was merged to the branch mainline in revision 559.
Revision ID: teddy@recompile.se-20120115210744-xc33sww1zxrk92s9

Tags: version-1.5.3-1

* Makefile (version): Changed to "1.5.3".
* NEWS (Version 1.5.3): New entry.
* debian/changelog (1.5.3-1): - '' -

Show diffs side-by-side

added added

removed removed

plugins.d/mandos-client.xml

<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

<!ENTITY COMMANDNAME "mandos-client">

<!ENTITY TIMESTAMP "2012-06-13">

<!ENTITY TIMESTAMP "2012-01-01">

<!ENTITY % common SYSTEM "../common.ent">

%common;

><replaceable>PORT</replaceable></option></arg>

</group>

<sbr/>

<group>

<arg choice="plain"><option>--interface

<replaceable>NAME</replaceable><arg rep='repeat'

>,<replaceable>NAME</replaceable></arg></option></arg>

<arg choice="plain"><option>-i <replaceable>NAME</replaceable

><arg rep='repeat'>,<replaceable>NAME</replaceable></arg

></option></arg>

<arg choice="plain"><option>-i

</group>

<sbr/>

<group>

139

137

communicates with <citerefentry><refentrytitle

140

138

>mandos</refentrytitle><manvolnum>8</manvolnum></citerefentry>

141

139

to get a password. In slightly more detail, this client program

142

brings up network interfaces, uses the interfaces’ IPv6

143

link-local addresses to get network connectivity, uses Zeroconf

144

to find servers on the local network, and communicates with

145

servers using TLS with an OpenPGP key to ensure authenticity and

140

brings up a network interface, uses the interface’s IPv6

141

link-local address to get network connectivity, uses Zeroconf to

142

find servers on the local network, and communicates with servers

143

using TLS with an OpenPGP key to ensure authenticity and

146

144

confidentiality. This client program keeps running, trying all

147

145

servers on the network, until it receives a satisfactory reply

148

146

or a TERM signal. After all servers have been tried, all

150

148

will wait indefinitely for new servers to appear.

151

149

</para>

152

150

<para>

153

The network interfaces are selected like this: If any interfaces

154

are specified using the <option>--interface</option> option,

155

those interface are used. Otherwise,

156

<command>&COMMANDNAME;</command> will use all interfaces that

157

are not loopback interfaces, are not point-to-point interfaces,

158

are capable of broadcasting and do not have the NOARP flag (see

151

The network interface is selected like this: If an interface is

152

specified using the <option>--interface</option> option, that

153

interface is used. Otherwise, <command>&COMMANDNAME;</command>

154

will choose any interface that is up and running and is not a

155

loopback interface, is not a point-to-point interface, is

156

capable of broadcasting and does not have the NOARP flag (see

159

157

<citerefentry><refentrytitle>netdevice</refentrytitle>

160

158

<manvolnum>7</manvolnum></citerefentry>). (If the

161

159

<option>--connect</option> option is used, point-to-point

162

interfaces and non-broadcast interfaces are accepted.) If any

163

used interfaces are not up and running, they are first taken up

164

(and later taken down again on program exit).

160

interfaces and non-broadcast interfaces are accepted.) If no

161

acceptable interfaces are found, re-run the check but without

162

the <quote>up and running</quote> requirement, and manually take

163

the selected interface up (and later take it down on program

164

exit).

165

</para>

166

<para>

167

Before network interfaces are selected, all <quote>network

167

Before a network interface is selected, all <quote>network

168

hooks</quote> are run; see <xref linkend="network-hooks"/>.

169

</para>

170

<para>

231

232

233

<para>

234

Comma separated list of network interfaces that will be

235

brought up and scanned for Mandos servers to connect to.

236

The default is the empty string, which will automatically

237

use all appropriate interfaces.

234

Network interface that will be brought up and scanned for

235

Mandos servers to connect to. The default is the empty

236

string, which will automatically choose an appropriate

237

interface.

238

</para>

239

<para>

240

If the <option>--connect</option> option is used, this

245

Note that since this program will normally run in the

246

initial RAM disk environment, the interface must be an

247

interface which exists at that stage. Thus, the interface

248

can normally not be a pseudo-interface such as

249

<quote>br0</quote> or <quote>tun0</quote>; such interfaces

250

will not exist until much later in the boot process, and

251

can not be used by this program, unless created by a

252

<quote>network hook</quote> — see <xref

253

linkend="network-hooks"/>.

248

can not be a pseudo-interface such as <quote>br0</quote>

249

or <quote>tun0</quote>; such interfaces will not exist

250

until much later in the boot process, and can not be used

251

by this program, unless created by a <quote>network

252

hook</quote> — see <xref linkend="network-hooks"/>.

254

253

</para>

255

254

<para>

256

255

<replaceable>NAME</replaceable> can be the string

315

314

>SECONDS</replaceable></option></term>

316

315

317

316

<para>

318

After bringing a network interface up, the program waits

317

After bringing the network interface up, the program waits

319

318

for the interface to arrive in a <quote>running</quote>

320

319

state before proceeding. During this time, the kernel log

321

320

level will be lowered to reduce clutter on the system

548

547

<term><envar>DEVICE</envar></term>

549

548

550

549

<para>

551

The network interfaces, as specified to

550

The network interface, as specified to

552

551

<command>&COMMANDNAME;</command> by the

553

<option>--interface</option> option, combined to one

554

string and separated by commas. If this is set, and

555

does not contain the interface a hook will bring up,

556

there is no reason for a hook to continue.

552

<option>--interface</option> option. If this is not the

553

interface a hook will bring up, there is no reason for a

554

hook to continue.

557

555

</para>

558

556

</listitem>

559

557

</varlistentry>

663

661

664

662

<para>

665

663

Normal invocation needs no options, if the network interface

666

can be automatically determined:

664

is <quote>eth0</quote>:

667

665

</para>

668

666

<para>

669

667

<userinput>&COMMANDNAME;</userinput>

Older »