To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.xml
- browse files at revision 238
- compare with another revision
- download diff
- download tarball
- view history from revision 238
- Committer: Teddy Hogeborn
- Date: 2008-12-10 01:26:02 UTC
- mfrom: (237.1.2 mandos)
- Revision ID: teddy@fukt.bsnet.se-20081210012602-vhz3h75xkj24t340
First version of a somewhat complete D-Bus server interface. Also
change user/group name to "_mandos".
* debian/mandos.postinst: Rename old "mandos" user and group to
"_mandos"; create "_mandos" user and group
if none exist.
* debian/mandos-client.postinst: - '' -
* initramfs-tools-hook: Try "_mandos" before "mandos" as user and
group name.
* mandos (_datetime_to_dbus_struct): New; was previously local.
(Client.started): Renamed to "last_started". All users changed.
(Client.started): New; boolean.
(Client.dbus_object_path): New.
(Client.check_command): Renamed to "checker_command". All users
changed.
(Client.__init__): Set and use "self.dbus_object_path". Set
"self.started".
(Client.start): Update "self.started". Emit "self.PropertyChanged"
signals for both "started" and "last_started".
(Client.stop): Update "self.started". Emit "self.PropertyChanged"
signal for "started".
(Client.checker_callback): Take additional "command" argument. All
callers changed. Emit
"self.PropertyChanged" signal.
(Client.bump_timeout): Emit "self.PropertyChanged" signal for
"last_checked_ok".
(Client.start_checker): Emit "self.PropertyChanged" signal for
"checker_running".
(Client.stop_checker): Emit "self.PropertyChanged" signal for
"checker_running".
(Client.still_valid): Bug fix: use "getattr(self, started, False)"
instead of "self.started" in case this client
object is so new that the "started" attribute
has not been created yet.
(Client.IntervalChanged, Client.CheckerIsRunning, Client.GetChecker,
Client.GetCreated, Client.GetFingerprint, Client.GetHost,
Client.GetInterval, Client.GetName, Client.GetStarted,
Client.GetTimeout, Client.StateChanged, Client.TimeoutChanged):
Removed; all callers changed.
(Client.CheckerCompleted): Add "condition" and "command" arguments.
All callers changed.
(Client.GetAllProperties, Client.PropertyChanged): New.
(Client.StillValid): Renamed to "IsStillValid".
(Client.StartChecker): Changed to its own function to avoid the
return value from "Client.start_checker()".
(Client.Stop): Changed to its own function to avoid the return value
from "Client.stop()".
(main): Try "_mandos" before "mandos" as user and group name.
Removed inner function "remove_from_clients". New inner
class "MandosServer".
change user/group name to "_mandos".
* debian/mandos.postinst: Rename old "mandos" user and group to
"_mandos"; create "_mandos" user and group
if none exist.
* debian/mandos-client.postinst: - '' -
* initramfs-tools-hook: Try "_mandos" before "mandos" as user and
group name.
* mandos (_datetime_to_dbus_struct): New; was previously local.
(Client.started): Renamed to "last_started". All users changed.
(Client.started): New; boolean.
(Client.dbus_object_path): New.
(Client.check_command): Renamed to "checker_command". All users
changed.
(Client.__init__): Set and use "self.dbus_object_path". Set
"self.started".
(Client.start): Update "self.started". Emit "self.PropertyChanged"
signals for both "started" and "last_started".
(Client.stop): Update "self.started". Emit "self.PropertyChanged"
signal for "started".
(Client.checker_callback): Take additional "command" argument. All
callers changed. Emit
"self.PropertyChanged" signal.
(Client.bump_timeout): Emit "self.PropertyChanged" signal for
"last_checked_ok".
(Client.start_checker): Emit "self.PropertyChanged" signal for
"checker_running".
(Client.stop_checker): Emit "self.PropertyChanged" signal for
"checker_running".
(Client.still_valid): Bug fix: use "getattr(self, started, False)"
instead of "self.started" in case this client
object is so new that the "started" attribute
has not been created yet.
(Client.IntervalChanged, Client.CheckerIsRunning, Client.GetChecker,
Client.GetCreated, Client.GetFingerprint, Client.GetHost,
Client.GetInterval, Client.GetName, Client.GetStarted,
Client.GetTimeout, Client.StateChanged, Client.TimeoutChanged):
Removed; all callers changed.
(Client.CheckerCompleted): Add "condition" and "command" arguments.
All callers changed.
(Client.GetAllProperties, Client.PropertyChanged): New.
(Client.StillValid): Renamed to "IsStillValid".
(Client.StartChecker): Changed to its own function to avoid the
return value from "Client.start_checker()".
(Client.Stop): Changed to its own function to avoid the return value
from "Client.stop()".
(main): Try "_mandos" before "mandos" as user and group name.
Removed inner function "remove_from_clients". New inner
class "MandosServer".
- files added:
- .bzr-builddeb
- debian
- debian/po
- files removed:
- plugins.d/usplash
- files renamed:
- plugins.d/password-request.c => plugins.d/mandos-client.c
- plugins.d/password-request.xml => plugins.d/mandos-client.xml
- files modified:
- .bzrignore
added
removed
plugins.d/mandos-client.xml
1
<?xml version='1.0' encoding='UTF-8'?>
2
<?xml-stylesheet type="text/xsl"
3
href="http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl"?>
1
<?xml version="1.0" encoding="UTF-8"?>
4
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
5
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
6
<!ENTITY VERSION "1.0">
7
<!ENTITY COMMANDNAME "password-request">
8
<!ENTITY TIMESTAMP "2008-08-31">
4
<!ENTITY COMMANDNAME "mandos-client">
5
<!ENTITY TIMESTAMP "2008-10-03">
6
<!ENTITY % common SYSTEM "../common.ent">
7
%common;
9
8
]>
10
9
11
<refentry>
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
12
11
<refentryinfo>
13
12
<title>Mandos Manual</title>
14
<!-- NWalsh's docbook scripts use this to generate the footer: -->
13
<!-- NWalsh’s docbook scripts use this to generate the footer: -->
15
14
<productname>Mandos</productname>
16
<productnumber>&VERSION;</productnumber>
15
<productnumber>&version;</productnumber>
17
16
<date>&TIMESTAMP;</date>
18
17
<authorgroup>
19
18
<author>
36
35
<holder>Teddy Hogeborn</holder>
37
36
<holder>Björn Påhlsson</holder>
38
37
</copyright>
39
<legalnotice>
40
<para>
41
This manual page is free software: you can redistribute it
42
and/or modify it under the terms of the GNU General Public
43
License as published by the Free Software Foundation,
44
either version 3 of the License, or (at your option) any
45
later version.
46
</para>
47
48
<para>
49
This manual page is distributed in the hope that it will
50
be useful, but WITHOUT ANY WARRANTY; without even the
51
implied warranty of MERCHANTABILITY or FITNESS FOR A
52
PARTICULAR PURPOSE. See the GNU General Public License
53
for more details.
54
</para>
55
56
<para>
57
You should have received a copy of the GNU General Public
58
License along with this program; If not, see
59
<ulink url="http://www.gnu.org/licenses/"/>.
60
</para>
61
</legalnotice>
38
<xi:include href="../legalnotice.xml"/>
62
39
</refentryinfo>
63
40
64
41
<refmeta>
65
42
<refentrytitle>&COMMANDNAME;</refentrytitle>
66
43
<manvolnum>8mandos</manvolnum>
69
46
<refnamediv>
70
47
<refname><command>&COMMANDNAME;</command></refname>
71
48
<refpurpose>
72
Client for mandos
49
Client for <application>Mandos</application>
73
50
</refpurpose>
74
51
</refnamediv>
75
52
76
53
<refsynopsisdiv>
77
54
<cmdsynopsis>
78
55
<command>&COMMANDNAME;</command>
79
56
<group>
80
57
<arg choice="plain"><option>--connect
81
<replaceable>IPADDR</replaceable><literal>:</literal
58
<replaceable>ADDRESS</replaceable><literal>:</literal
82
59
><replaceable>PORT</replaceable></option></arg>
83
60
<arg choice="plain"><option>-c
84
<replaceable>IPADDR</replaceable><literal>:</literal
61
<replaceable>ADDRESS</replaceable><literal>:</literal
85
62
><replaceable>PORT</replaceable></option></arg>
86
63
</group>
87
64
<sbr/>
88
65
<group>
89
<arg choice="plain"><option>--keydir
90
<replaceable>DIRECTORY</replaceable></option></arg>
91
<arg choice="plain"><option>-d
92
<replaceable>DIRECTORY</replaceable></option></arg>
93
</group>
94
<sbr/>
95
<group>
96
66
<arg choice="plain"><option>--interface
97
67
<replaceable>NAME</replaceable></option></arg>
98
68
<arg choice="plain"><option>-i
128
98
<cmdsynopsis>
129
99
<command>&COMMANDNAME;</command>
130
100
<group choice="req">
131
<arg choice='plain'><option>--help</option></arg>
132
<arg choice='plain'><option>-?</option></arg>
101
<arg choice="plain"><option>--help</option></arg>
102
<arg choice="plain"><option>-?</option></arg>
133
103
</group>
134
104
</cmdsynopsis>
135
105
<cmdsynopsis>
136
106
<command>&COMMANDNAME;</command>
137
<arg choice='plain'><option>--usage</option></arg>
107
<arg choice="plain"><option>--usage</option></arg>
138
108
</cmdsynopsis>
139
109
<cmdsynopsis>
140
110
<command>&COMMANDNAME;</command>
141
111
<group choice="req">
142
<arg choice='plain'><option>--version</option></arg>
143
<arg choice='plain'><option>-V</option></arg>
112
<arg choice="plain"><option>--version</option></arg>
113
<arg choice="plain"><option>-V</option></arg>
144
114
</group>
145
115
</cmdsynopsis>
146
116
</refsynopsisdiv>
147
117
148
118
<refsect1 id="description">
149
119
<title>DESCRIPTION</title>
150
120
<para>
151
<command>&COMMANDNAME;</command> is a mandos plugin that works
152
like a client program that through avahi detects mandos servers,
153
sets up a gnutls connect and request a encrypted password. Any
154
passwords given is automaticly decrypted and passed to
155
cryptsetup.
121
<command>&COMMANDNAME;</command> is a client program that
122
communicates with <citerefentry><refentrytitle
123
>mandos</refentrytitle><manvolnum>8</manvolnum></citerefentry>
124
to get a password. It uses IPv6 link-local addresses to get
125
network connectivity, Zeroconf to find servers, and TLS with an
126
OpenPGP key to ensure authenticity and confidentiality. It
127
keeps running, trying all servers on the network, until it
128
receives a satisfactory reply or a TERM signal is received.
129
</para>
130
<para>
131
This program is not meant to be run directly; it is really meant
132
to run as a plugin of the <application>Mandos</application>
133
<citerefentry><refentrytitle>plugin-runner</refentrytitle>
134
<manvolnum>8mandos</manvolnum></citerefentry>, which runs in the
135
initial <acronym>RAM</acronym> disk environment because it is
136
specified as a <quote>keyscript</quote> in the <citerefentry>
137
<refentrytitle>crypttab</refentrytitle><manvolnum>5</manvolnum>
138
</citerefentry> file.
139
</para>
140
</refsect1>
141
142
<refsect1 id="purpose">
143
<title>PURPOSE</title>
144
<para>
145
The purpose of this is to enable <emphasis>remote and unattended
146
rebooting</emphasis> of client host computer with an
147
<emphasis>encrypted root file system</emphasis>. See <xref
148
linkend="overview"/> for details.
156
149
</para>
157
150
</refsect1>
158
151
159
152
<refsect1 id="options">
160
153
<title>OPTIONS</title>
161
154
<para>
162
Commonly not invoked as command lines but from configuration
163
file of plugin runner.
155
This program is commonly not invoked from the command line; it
156
is normally started by the <application>Mandos</application>
157
plugin runner, see <citerefentry><refentrytitle
158
>plugin-runner</refentrytitle><manvolnum>8mandos</manvolnum>
159
</citerefentry>. Any command line options this program accepts
160
are therefore normally provided by the plugin runner, and not
161
directly.
164
162
</para>
165
163
166
164
<variablelist>
167
165
<varlistentry>
168
166
<term><option>--connect=<replaceable
169
>IPADDR</replaceable><literal>:</literal><replaceable
167
>ADDRESS</replaceable><literal>:</literal><replaceable
170
168
>PORT</replaceable></option></term>
171
169
<term><option>-c
172
<replaceable>IPADDR</replaceable><literal>:</literal
170
<replaceable>ADDRESS</replaceable><literal>:</literal
173
171
><replaceable>PORT</replaceable></option></term>
174
172
<listitem>
175
173
<para>
176
Connect directly to a specified mandos server
174
Do not use Zeroconf to locate servers. Connect directly
175
to only one specified <application>Mandos</application>
176
server. Note that an IPv6 address has colon characters in
177
it, so the <emphasis>last</emphasis> colon character is
178
assumed to separate the address from the port number.
177
179
</para>
178
</listitem>
179
</varlistentry>
180
181
<varlistentry>
182
<term><option>--keydir=<replaceable
183
>DIRECTORY</replaceable></option></term>
184
<term><option>-d
185
<replaceable>DIRECTORY</replaceable></option></term>
186
<listitem>
187
180
<para>
188
Directory where the openpgp keyring is
181
This option is normally only useful for testing and
182
debugging.
189
183
</para>
190
184
</listitem>
191
185
</varlistentry>
192
186
193
187
<varlistentry>
194
188
<term><option>--interface=
195
189
<replaceable>NAME</replaceable></option></term>
197
191
<replaceable>NAME</replaceable></option></term>
198
192
<listitem>
199
193
<para>
200
Interface that Avahi will connect through
194
Network interface that will be brought up and scanned for
195
Mandos servers to connect to. The default it
196
<quote><literal>eth0</literal></quote>.
197
</para>
198
<para>
199
If the <option>--connect</option> option is used, this
200
specifies the interface to use to connect to the address
201
given.
201
202
</para>
202
203
</listitem>
203
204
</varlistentry>
204
205
205
206
<varlistentry>
206
207
<term><option>--pubkey=<replaceable
207
208
>FILE</replaceable></option></term>
209
210
<replaceable>FILE</replaceable></option></term>
210
211
<listitem>
211
212
<para>
212
Public openpgp key for gnutls authentication
213
OpenPGP public key file name. The default name is
214
<quote><filename>/conf/conf.d/mandos/pubkey.txt</filename
215
></quote>.
213
216
</para>
214
217
</listitem>
215
218
</varlistentry>
216
219
217
220
<varlistentry>
218
221
<term><option>--seckey=<replaceable
219
222
>FILE</replaceable></option></term>
221
224
<replaceable>FILE</replaceable></option></term>
222
225
<listitem>
223
226
<para>
224
Secret OpenPGP key for GnuTLS authentication
227
OpenPGP secret key file name. The default name is
228
<quote><filename>/conf/conf.d/mandos/seckey.txt</filename
229
></quote>.
225
230
</para>
226
231
</listitem>
227
232
</varlistentry>
230
235
<term><option>--priority=<replaceable
231
236
>STRING</replaceable></option></term>
232
237
<listitem>
233
<para>
234
GnuTLS priority
235
</para>
238
<xi:include href="../mandos-options.xml"
239
xpointer="priority"/>
236
240
</listitem>
237
241
</varlistentry>
238
242
239
243
<varlistentry>
240
244
<term><option>--dh-bits=<replaceable
241
245
>BITS</replaceable></option></term>
242
246
<listitem>
243
247
<para>
244
DH bits to use in gnutls communication
248
Sets the number of bits to use for the prime number in the
249
TLS Diffie-Hellman key exchange. Default is 1024.
245
250
</para>
246
251
</listitem>
247
252
</varlistentry>
250
255
<term><option>--debug</option></term>
251
256
<listitem>
252
257
<para>
253
Debug mode
258
Enable debug mode. This will enable a lot of output to
259
standard error about what the program is doing. The
260
program will still perform all other functions normally.
261
</para>
262
<para>
263
It will also enable debug mode in the Avahi and GnuTLS
264
libraries, making them print large amounts of debugging
265
output.
254
266
</para>
255
267
</listitem>
256
268
</varlistentry>
260
272
<term><option>-?</option></term>
261
273
<listitem>
262
274
<para>
263
Gives a help message
275
Gives a help message about options and their meanings.
264
276
</para>
265
277
</listitem>
266
278
</varlistentry>
269
281
<term><option>--usage</option></term>
270
282
<listitem>
271
283
<para>
272
Gives a short usage message
284
Gives a short usage message.
273
285
</para>
274
286
</listitem>
275
287
</varlistentry>
276
288
277
289
<varlistentry>
278
290
<term><option>--version</option></term>
279
291
<term><option>-V</option></term>
280
292
<listitem>
281
293
<para>
282
Prints the program version
294
Prints the program version.
283
295
</para>
284
296
</listitem>
285
297
</varlistentry>
286
298
</variablelist>
287
299
</refsect1>
288
300
301
<refsect1 id="overview">
302
<title>OVERVIEW</title>
303
<xi:include href="../overview.xml"/>
304
<para>
305
This program is the client part. It is a plugin started by
306
<citerefentry><refentrytitle>plugin-runner</refentrytitle>
307
<manvolnum>8mandos</manvolnum></citerefentry> which will run in
308
an initial <acronym>RAM</acronym> disk environment.
309
</para>
310
<para>
311
This program could, theoretically, be used as a keyscript in
312
<filename>/etc/crypttab</filename>, but it would then be
313
impossible to enter a password for the encrypted root disk at
314
the console, since this program does not read from the console
315
at all. This is why a separate plugin runner (<citerefentry>
316
<refentrytitle>plugin-runner</refentrytitle>
317
<manvolnum>8mandos</manvolnum></citerefentry>) is used to run
318
both this program and others in in parallel,
319
<emphasis>one</emphasis> of which will prompt for passwords on
320
the system console.
321
</para>
322
</refsect1>
323
289
324
<refsect1 id="exit_status">
290
325
<title>EXIT STATUS</title>
291
326
<para>
327
This program will exit with a successful (zero) exit status if a
328
server could be found and the password received from it could be
329
successfully decrypted and output on standard output. The
330
program will exit with a non-zero exit status only if a critical
331
error occurs. Otherwise, it will forever connect to new
332
<application>Mandos</application> servers as they appear, trying
333
to get a decryptable password and print it.
292
334
</para>
293
335
</refsect1>
294
336
295
337
<refsect1 id="environment">
296
338
<title>ENVIRONMENT</title>
297
339
<para>
340
This program does not use any environment variables, not even
341
the ones provided by <citerefentry><refentrytitle
342
>cryptsetup</refentrytitle><manvolnum>8</manvolnum>
343
</citerefentry>.
298
344
</para>
299
345
</refsect1>
300
301
<refsect1 id="file">
346
347
<refsect1 id="files">
302
348
<title>FILES</title>
303
<para>
304
</para>
305
</refsect1>
306
307
<refsect1 id="bugs">
308
<title>BUGS</title>
309
<para>
310
</para>
311
</refsect1>
312
349
<variablelist>
350
<varlistentry>
351
<term><filename>/conf/conf.d/mandos/pubkey.txt</filename
352
></term>
353
<term><filename>/conf/conf.d/mandos/seckey.txt</filename
354
></term>
355
<listitem>
356
<para>
357
OpenPGP public and private key files, in <quote>ASCII
358
Armor</quote> format. These are the default file names,
359
they can be changed with the <option>--pubkey</option> and
360
<option>--seckey</option> options.
361
</para>
362
</listitem>
363
</varlistentry>
364
</variablelist>
365
</refsect1>
366
367
<!-- <refsect1 id="bugs"> -->
368
<!-- <title>BUGS</title> -->
369
<!-- <para> -->
370
<!-- </para> -->
371
<!-- </refsect1> -->
372
313
373
<refsect1 id="example">
314
374
<title>EXAMPLE</title>
315
375
<para>
376
Note that normally, command line options will not be given
377
directly, but via options for the Mandos <citerefentry
378
><refentrytitle>plugin-runner</refentrytitle>
379
<manvolnum>8mandos</manvolnum></citerefentry>.
316
380
</para>
381
<informalexample>
382
<para>
383
Normal invocation needs no options, if the network interface
384
is <quote>eth0</quote>:
385
</para>
386
<para>
387
<userinput>&COMMANDNAME;</userinput>
388
</para>
389
</informalexample>
390
<informalexample>
391
<para>
392
Search for Mandos servers (and connect to them) using another
393
interface:
394
</para>
395
<para>
396
<!-- do not wrap this line -->
397
<userinput>&COMMANDNAME; --interface eth1</userinput>
398
</para>
399
</informalexample>
400
<informalexample>
401
<para>
402
Run in debug mode, and use a custom key:
403
</para>
404
<para>
405
406
<!-- do not wrap this line -->
407
<userinput>&COMMANDNAME; --debug --pubkey keydir/pubkey.txt --seckey keydir/seckey.txt</userinput>
408
409
</para>
410
</informalexample>
411
<informalexample>
412
<para>
413
Run in debug mode, with a custom key, and do not use Zeroconf
414
to locate a server; connect directly to the IPv6 address
415
<quote><systemitem class="ipaddress"
416
>2001:db8:f983:bd0b:30de:ae4a:71f2:f672</systemitem></quote>,
417
port 4711, using interface eth2:
418
</para>
419
<para>
420
421
<!-- do not wrap this line -->
422
<userinput>&COMMANDNAME; --debug --pubkey keydir/pubkey.txt --seckey keydir/seckey.txt --connect 2001:db8:f983:bd0b:30de:ae4a:71f2:f672:4711 --interface eth2</userinput>
423
424
</para>
425
</informalexample>
317
426
</refsect1>
318
427
319
428
<refsect1 id="security">
320
429
<title>SECURITY</title>
321
430
<para>
431
This program is set-uid to root, but will switch back to the
432
original (and presumably non-privileged) user and group after
433
bringing up the network interface.
434
</para>
435
<para>
436
To use this program for its intended purpose (see <xref
437
linkend="purpose"/>), the password for the root file system will
438
have to be given out to be stored in a server computer, after
439
having been encrypted using an OpenPGP key. This encrypted data
440
which will be stored in a server can only be decrypted by the
441
OpenPGP key, and the data will only be given out to those
442
clients who can prove they actually have that key. This key,
443
however, is stored unencrypted on the client side in its initial
444
<acronym>RAM</acronym> disk image file system. This is normally
445
readable by all, but this is normally fixed during installation
446
of this program; file permissions are set so that no-one is able
447
to read that file.
448
</para>
449
<para>
450
The only remaining weak point is that someone with physical
451
access to the client hard drive might turn off the client
452
computer, read the OpenPGP keys directly from the hard drive,
453
and communicate with the server. To safeguard against this, the
454
server is supposed to notice the client disappearing and stop
455
giving out the encrypted data. Therefore, it is important to
456
set the timeout and checker interval values tightly on the
457
server. See <citerefentry><refentrytitle
458
>mandos</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
459
</para>
460
<para>
461
It will also help if the checker program on the server is
462
configured to request something from the client which can not be
463
spoofed by someone else on the network, unlike unencrypted
464
<acronym>ICMP</acronym> echo (<quote>ping</quote>) replies.
465
</para>
466
<para>
467
<emphasis>Note</emphasis>: This makes it completely insecure to
468
have <application >Mandos</application> clients which dual-boot
469
to another operating system which is <emphasis>not</emphasis>
470
trusted to keep the initial <acronym>RAM</acronym> disk image
471
confidential.
322
472
</para>
323
473
</refsect1>
324
474
325
475
<refsect1 id="see_also">
326
476
<title>SEE ALSO</title>
327
477
<para>
478
<citerefentry><refentrytitle>cryptsetup</refentrytitle>
479
<manvolnum>8</manvolnum></citerefentry>,
480
<citerefentry><refentrytitle>crypttab</refentrytitle>
481
<manvolnum>5</manvolnum></citerefentry>,
328
482
<citerefentry><refentrytitle>mandos</refentrytitle>
329
483
<manvolnum>8</manvolnum></citerefentry>,
330
484
<citerefentry><refentrytitle>password-prompt</refentrytitle>
332
486
<citerefentry><refentrytitle>plugin-runner</refentrytitle>
333
487
<manvolnum>8mandos</manvolnum></citerefentry>
334
488
</para>
335
<itemizedlist>
336
<listitem><para>
337
<ulink url="http://www.zeroconf.org/">Zeroconf</ulink>
338
</para></listitem>
339
340
<listitem><para>
341
<ulink url="http://www.avahi.org/">Avahi</ulink>
342
</para></listitem>
343
344
<listitem><para>
345
<ulink
346
url="http://www.gnu.org/software/gnutls/">GnuTLS</ulink>
347
</para></listitem>
348
349
<listitem><para>
350
<ulink
351
url="http://www.gnupg.org/related_software/gpgme/">
352
GPGME</ulink>
353
</para></listitem>
354
355
<listitem><para>
356
<citation>RFC 4880: <citetitle>OpenPGP Message
357
Format</citetitle></citation>
358
</para></listitem>
359
360
<listitem><para>
361
<citation>RFC 5081: <citetitle>Using OpenPGP Keys for
362
Transport Layer Security</citetitle></citation>
363
</para></listitem>
364
365
<listitem><para>
366
<citation>RFC 4291: <citetitle>IP Version 6 Addressing
367
Architecture</citetitle>, section 2.5.6, Link-Local IPv6
368
Unicast Addresses</citation>
369
</para></listitem>
370
</itemizedlist>
489
<variablelist>
490
<varlistentry>
491
<term>
492
<ulink url="http://www.zeroconf.org/">Zeroconf</ulink>
493
</term>
494
<listitem>
495
<para>
496
Zeroconf is the network protocol standard used for finding
497
Mandos servers on the local network.
498
</para>
499
</listitem>
500
</varlistentry>
501
<varlistentry>
502
<term>
503
<ulink url="http://www.avahi.org/">Avahi</ulink>
504
</term>
505
<listitem>
506
<para>
507
Avahi is the library this program calls to find Zeroconf
508
services.
509
</para>
510
</listitem>
511
</varlistentry>
512
<varlistentry>
513
<term>
514
<ulink url="http://www.gnu.org/software/gnutls/"
515
>GnuTLS</ulink>
516
</term>
517
<listitem>
518
<para>
519
GnuTLS is the library this client uses to implement TLS for
520
communicating securely with the server, and at the same time
521
send the public OpenPGP key to the server.
522
</para>
523
</listitem>
524
</varlistentry>
525
<varlistentry>
526
<term>
527
<ulink url="http://www.gnupg.org/related_software/gpgme/"
528
>GPGME</ulink>
529
</term>
530
<listitem>
531
<para>
532
GPGME is the library used to decrypt the OpenPGP data sent
533
by the server.
534
</para>
535
</listitem>
536
</varlistentry>
537
<varlistentry>
538
<term>
539
RFC 4291: <citetitle>IP Version 6 Addressing
540
Architecture</citetitle>
541
</term>
542
<listitem>
543
<variablelist>
544
<varlistentry>
545
<term>Section 2.2: <citetitle>Text Representation of
546
Addresses</citetitle></term>
547
<listitem><para/></listitem>
548
</varlistentry>
549
<varlistentry>
550
<term>Section 2.5.5.2: <citetitle>IPv4-Mapped IPv6
551
Address</citetitle></term>
552
<listitem><para/></listitem>
553
</varlistentry>
554
<varlistentry>
555
<term>Section 2.5.6, <citetitle>Link-Local IPv6 Unicast
556
Addresses</citetitle></term>
557
<listitem>
558
<para>
559
This client uses IPv6 link-local addresses, which are
560
immediately usable since a link-local addresses is
561
automatically assigned to a network interfaces when it
562
is brought up.
563
</para>
564
</listitem>
565
</varlistentry>
566
</variablelist>
567
</listitem>
568
</varlistentry>
569
<varlistentry>
570
<term>
571
RFC 4346: <citetitle>The Transport Layer Security (TLS)
572
Protocol Version 1.1</citetitle>
573
</term>
574
<listitem>
575
<para>
576
TLS 1.1 is the protocol implemented by GnuTLS.
577
</para>
578
</listitem>
579
</varlistentry>
580
<varlistentry>
581
<term>
582
RFC 4880: <citetitle>OpenPGP Message Format</citetitle>
583
</term>
584
<listitem>
585
<para>
586
The data received from the server is binary encrypted
587
OpenPGP data.
588
</para>
589
</listitem>
590
</varlistentry>
591
<varlistentry>
592
<term>
593
RFC 5081: <citetitle>Using OpenPGP Keys for Transport Layer
594
Security</citetitle>
595
</term>
596
<listitem>
597
<para>
598
This is implemented by GnuTLS and used by this program so
599
that OpenPGP keys can be used.
600
</para>
601
</listitem>
602
</varlistentry>
603
</variablelist>
371
604
</refsect1>
372
373
605
</refentry>
606
374
607
<!-- Local Variables: -->
375
608
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
376
609
<!-- time-stamp-end: "[\"']>" -->
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0