1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
<!ENTITY VERSION "1.0">
5
4
<!ENTITY COMMANDNAME "mandos">
6
<!ENTITY TIMESTAMP "2008-08-29">
5
<!ENTITY TIMESTAMP "2008-10-03">
6
<!ENTITY % common SYSTEM "common.ent">
9
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
11
12
<title>Mandos Manual</title>
12
13
<!-- NWalsh’s docbook scripts use this to generate the footer: -->
13
14
<productname>Mandos</productname>
14
<productnumber>&VERSION;</productnumber>
15
<productnumber>&version;</productnumber>
15
16
<date>&TIMESTAMP;</date>
34
35
<holder>Teddy Hogeborn</holder>
35
36
<holder>Björn Påhlsson</holder>
39
This manual page is free software: you can redistribute it
40
and/or modify it under the terms of the GNU General Public
41
License as published by the Free Software Foundation,
42
either version 3 of the License, or (at your option) any
47
This manual page is distributed in the hope that it will
48
be useful, but WITHOUT ANY WARRANTY; without even the
49
implied warranty of MERCHANTABILITY or FITNESS FOR A
50
PARTICULAR PURPOSE. See the GNU General Public License
55
You should have received a copy of the GNU General Public
56
License along with this program; If not, see
57
<ulink url="http://www.gnu.org/licenses/"/>.
38
<xi:include href="legalnotice.xml"/>
63
42
<refentrytitle>&COMMANDNAME;</refentrytitle>
64
43
<manvolnum>8</manvolnum>
68
47
<refname><command>&COMMANDNAME;</command></refname>
70
Sends encrypted passwords to authenticated Mandos clients
49
Gives encrypted passwords to authenticated Mandos clients
76
55
<command>&COMMANDNAME;</command>
77
<arg>--interface<arg choice="plain">NAME</arg></arg>
78
<arg>--address<arg choice="plain">ADDRESS</arg></arg>
79
<arg>--port<arg choice="plain">PORT</arg></arg>
80
<arg>--priority<arg choice="plain">PRIORITY</arg></arg>
81
<arg>--servicename<arg choice="plain">NAME</arg></arg>
82
<arg>--configdir<arg choice="plain">DIRECTORY</arg></arg>
86
<command>&COMMANDNAME;</command>
87
<arg>-i<arg choice="plain">NAME</arg></arg>
88
<arg>-a<arg choice="plain">ADDRESS</arg></arg>
89
<arg>-p<arg choice="plain">PORT</arg></arg>
90
<arg>--priority<arg choice="plain">PRIORITY</arg></arg>
91
<arg>--servicename<arg choice="plain">NAME</arg></arg>
92
<arg>--configdir<arg choice="plain">DIRECTORY</arg></arg>
57
<arg choice="plain"><option>--interface
58
<replaceable>NAME</replaceable></option></arg>
59
<arg choice="plain"><option>-i
60
<replaceable>NAME</replaceable></option></arg>
64
<arg choice="plain"><option>--address
65
<replaceable>ADDRESS</replaceable></option></arg>
66
<arg choice="plain"><option>-a
67
<replaceable>ADDRESS</replaceable></option></arg>
71
<arg choice="plain"><option>--port
72
<replaceable>PORT</replaceable></option></arg>
73
<arg choice="plain"><option>-p
74
<replaceable>PORT</replaceable></option></arg>
77
<arg><option>--priority
78
<replaceable>PRIORITY</replaceable></option></arg>
80
<arg><option>--servicename
81
<replaceable>NAME</replaceable></option></arg>
83
<arg><option>--configdir
84
<replaceable>DIRECTORY</replaceable></option></arg>
86
<arg><option>--debug</option></arg>
96
89
<command>&COMMANDNAME;</command>
97
90
<group choice="req">
98
<arg choice="plain">-h</arg>
99
<arg choice="plain">--help</arg>
91
<arg choice="plain"><option>--help</option></arg>
92
<arg choice="plain"><option>-h</option></arg>
103
96
<command>&COMMANDNAME;</command>
104
<arg choice="plain">--version</arg>
97
<arg choice="plain"><option>--version</option></arg>
107
100
<command>&COMMANDNAME;</command>
108
<arg choice="plain">--check</arg>
101
<arg choice="plain"><option>--check</option></arg>
110
103
</refsynopsisdiv>
112
105
<refsect1 id="description">
113
106
<title>DESCRIPTION</title>
123
116
Any authenticated client is then given the stored pre-encrypted
124
117
password for that specific client.
129
121
<refsect1 id="purpose">
130
122
<title>PURPOSE</title>
133
124
The purpose of this is to enable <emphasis>remote and unattended
134
125
rebooting</emphasis> of client host computer with an
135
126
<emphasis>encrypted root file system</emphasis>. See <xref
136
127
linkend="overview"/> for details.
141
131
<refsect1 id="options">
142
132
<title>OPTIONS</title>
135
<term><option>--help</option></term>
146
136
<term><option>-h</option></term>
147
<term><option>--help</option></term>
150
139
Show a help message and exit
145
<term><option>--interface</option>
146
<replaceable>NAME</replaceable></term>
156
147
<term><option>-i</option>
157
148
<replaceable>NAME</replaceable></term>
158
<term><option>--interface</option>
159
<replaceable>NAME</replaceable></term>
161
150
<xi:include href="mandos-options.xml" xpointer="interface"/>
166
<term><literal>-a</literal>, <literal>--address <replaceable>
167
ADDRESS</replaceable></literal></term>
155
<term><option>--address
156
<replaceable>ADDRESS</replaceable></option></term>
158
<replaceable>ADDRESS</replaceable></option></term>
169
160
<xi:include href="mandos-options.xml" xpointer="address"/>
174
<term><literal>-p</literal>, <literal>--port <replaceable>
175
PORT</replaceable></literal></term>
166
<replaceable>PORT</replaceable></option></term>
168
<replaceable>PORT</replaceable></option></term>
177
170
<xi:include href="mandos-options.xml" xpointer="port"/>
182
<term><literal>--check</literal></term>
175
<term><option>--check</option></term>
185
178
Run the server’s self-tests. This includes any unit
192
<term><literal>--debug</literal></term>
185
<term><option>--debug</option></term>
194
187
<xi:include href="mandos-options.xml" xpointer="debug"/>
199
<term><literal>--priority <replaceable>
200
PRIORITY</replaceable></literal></term>
192
<term><option>--priority <replaceable>
193
PRIORITY</replaceable></option></term>
202
195
<xi:include href="mandos-options.xml" xpointer="priority"/>
207
<term><literal>--servicename <replaceable>NAME</replaceable>
200
<term><option>--servicename
201
<replaceable>NAME</replaceable></option></term>
210
203
<xi:include href="mandos-options.xml"
211
204
xpointer="servicename"/>
216
<term><literal>--configdir <replaceable>DIR</replaceable>
209
<term><option>--configdir
210
<replaceable>DIRECTORY</replaceable></option></term>
220
213
Directory to search for configuration files. Default is
428
421
Currently, if a client is declared <quote>invalid</quote> due to
429
422
having timed out, the server does not record this fact onto
430
423
permanent storage. This has some security implications, see
431
<xref linkend="CLIENTS"/>.
424
<xref linkend="clients"/>.
434
427
There is currently no way of querying the server of the current
484
481
</informalexample>
487
484
<refsect1 id="security">
488
485
<title>SECURITY</title>
489
<refsect2 id="SERVER">
486
<refsect2 id="server">
490
487
<title>SERVER</title>
492
489
Running this <command>&COMMANDNAME;</command> server program
493
490
should not in itself present any security risk to the host
494
computer running it. The program does not need any special
495
privileges to run, and is designed to run as a non-root user.
491
computer running it. The program switches to a non-root user
498
<refsect2 id="CLIENTS">
495
<refsect2 id="clients">
499
496
<title>CLIENTS</title>
501
498
The server only gives out its stored data to clients which
508
505
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
509
506
<manvolnum>5</manvolnum></citerefentry>)
510
507
<emphasis>must</emphasis> be made non-readable by anyone
511
except the user running the server.
508
except the user starting the server (usually root).
514
511
As detailed in <xref linkend="checking"/>, the status of all
525
522
restarting servers if it is suspected that a client has, in
526
523
fact, been compromised by parties who may now be running a
527
524
fake Mandos client with the keys from the non-encrypted
528
initial RAM image of the client host. What should be done in
529
that case (if restarting the server program really is
530
necessary) is to stop the server program, edit the
525
initial <acronym>RAM</acronym> image of the client host. What
526
should be done in that case (if restarting the server program
527
really is necessary) is to stop the server program, edit the
531
528
configuration file to omit any suspect clients, and restart
532
529
the server program.
535
532
For more details on client-side security, see
536
<citerefentry><refentrytitle>password-request</refentrytitle>
533
<citerefentry><refentrytitle>mandos-client</refentrytitle>
537
534
<manvolnum>8mandos</manvolnum></citerefentry>.
542
539
<refsect1 id="see_also">
543
540
<title>SEE ALSO</title>
547
544
<manvolnum>5</manvolnum></citerefentry>, <citerefentry>
548
545
<refentrytitle>mandos.conf</refentrytitle>
549
546
<manvolnum>5</manvolnum></citerefentry>, <citerefentry>
550
<refentrytitle>password-request</refentrytitle>
547
<refentrytitle>mandos-client</refentrytitle>
551
548
<manvolnum>8mandos</manvolnum></citerefentry>, <citerefentry>
552
549
<refentrytitle>sh</refentrytitle><manvolnum>1</manvolnum>