139
121
<command>&COMMANDNAME;</command> is a client program that
140
122
communicates with <citerefentry><refentrytitle
141
123
>mandos</refentrytitle><manvolnum>8</manvolnum></citerefentry>
142
to get a password. In slightly more detail, this client program
143
brings up network interfaces, uses the interfaces’ IPv6
144
link-local addresses to get network connectivity, uses Zeroconf
145
to find servers on the local network, and communicates with
146
servers using TLS with an OpenPGP key to ensure authenticity and
147
confidentiality. This client program keeps running, trying all
148
servers on the network, until it receives a satisfactory reply
149
or a TERM signal. After all servers have been tried, all
150
servers are periodically retried. If no servers are found it
151
will wait indefinitely for new servers to appear.
154
The network interfaces are selected like this: If any interfaces
155
are specified using the <option>--interface</option> option,
156
those interface are used. Otherwise,
157
<command>&COMMANDNAME;</command> will use all interfaces that
158
are not loopback interfaces, are not point-to-point interfaces,
159
are capable of broadcasting and do not have the NOARP flag (see
160
<citerefentry><refentrytitle>netdevice</refentrytitle>
161
<manvolnum>7</manvolnum></citerefentry>). (If the
162
<option>--connect</option> option is used, point-to-point
163
interfaces and non-broadcast interfaces are accepted.) If any
164
used interfaces are not up and running, they are first taken up
165
(and later taken down again on program exit).
168
Before network interfaces are selected, all <quote>network
169
hooks</quote> are run; see <xref linkend="network-hooks"/>.
124
to get a password. It uses IPv6 link-local addresses to get
125
network connectivity, Zeroconf to find servers, and TLS with an
126
OpenPGP key to ensure authenticity and confidentiality. It
127
keeps running, trying all servers on the network, until it
128
receives a satisfactory reply or a TERM signal is received.
172
131
This program is not meant to be run directly; it is really meant
229
<term><option>--interface=<replaceable
230
>NAME</replaceable><arg rep='repeat'>,<replaceable
231
>NAME</replaceable></arg></option></term>
188
<term><option>--interface=
189
<replaceable>NAME</replaceable></option></term>
233
<replaceable>NAME</replaceable><arg rep='repeat'>,<replaceable
234
>NAME</replaceable></arg></option></term>
191
<replaceable>NAME</replaceable></option></term>
237
Comma separated list of network interfaces that will be
238
brought up and scanned for Mandos servers to connect to.
239
The default is the empty string, which will automatically
240
use all appropriate interfaces.
243
If the <option>--connect</option> option is used, and
244
exactly one interface name is specified (except
245
<quote><literal>none</literal></quote>), this specifies
246
the interface to use to connect to the address given.
249
Note that since this program will normally run in the
250
initial RAM disk environment, the interface must be an
251
interface which exists at that stage. Thus, the interface
252
can normally not be a pseudo-interface such as
253
<quote>br0</quote> or <quote>tun0</quote>; such interfaces
254
will not exist until much later in the boot process, and
255
can not be used by this program, unless created by a
256
<quote>network hook</quote> — see <xref
257
linkend="network-hooks"/>.
260
<replaceable>NAME</replaceable> can be the string
261
<quote><literal>none</literal></quote>; this will make
262
<command>&COMMANDNAME;</command> not bring up
263
<emphasis>any</emphasis> interfaces specified
264
<emphasis>after</emphasis> this string. This is not
265
recommended, and only meant for advanced users.
194
Network interface that will be brought up and scanned for
195
Mandos servers to connect to. The default it
196
<quote><literal>eth0</literal></quote>.
199
If the <option>--connect</option> option is used, this
200
specifies the interface to use to connect to the address
319
<term><option>--delay=<replaceable
320
>SECONDS</replaceable></option></term>
323
After bringing a network interface up, the program waits
324
for the interface to arrive in a <quote>running</quote>
325
state before proceeding. During this time, the kernel log
326
level will be lowered to reduce clutter on the system
327
console, alleviating any other plugins which might be
328
using the system console. This option sets the upper
329
limit of seconds to wait. The default is 2.5 seconds.
335
<term><option>--retry=<replaceable
336
>SECONDS</replaceable></option></term>
339
All Mandos servers are tried repeatedly until a password
340
is received. This value specifies, in seconds, how long
341
between each successive try <emphasis>for the same
342
server</emphasis>. The default is 10 seconds.
348
<term><option>--network-hook-dir=<replaceable
349
>DIR</replaceable></option></term>
352
Network hook directory. The default directory is
353
<quote><filename class="directory"
354
>/lib/mandos/network-hooks.d</filename></quote>.
360
255
<term><option>--debug</option></term>
454
<refsect1 id="network-hooks">
455
<title>NETWORK HOOKS</title>
457
If a network interface like a bridge or tunnel is required to
458
find a Mandos server, this requires the interface to be up and
459
running before <command>&COMMANDNAME;</command> starts looking
460
for Mandos servers. This can be accomplished by creating a
461
<quote>network hook</quote> program, and placing it in a special
465
Before the network is used (and again before program exit), any
466
runnable programs found in the network hook directory are run
467
with the argument <quote><literal>start</literal></quote> or
468
<quote><literal>stop</literal></quote>. This should bring up or
469
down, respectively, any network interface which
470
<command>&COMMANDNAME;</command> should use.
472
<refsect2 id="hook-requirements">
473
<title>REQUIREMENTS</title>
475
A network hook must be an executable file, and its name must
476
consist entirely of upper and lower case letters, digits,
477
underscores, periods, and hyphens.
480
A network hook will receive one argument, which can be one of
485
<term><literal>start</literal></term>
488
This should make the network hook create (if necessary)
489
and bring up a network interface.
494
<term><literal>stop</literal></term>
497
This should make the network hook take down a network
498
interface, and delete it if it did not exist previously.
503
<term><literal>files</literal></term>
506
This should make the network hook print, <emphasis>one
507
file per line</emphasis>, all the files needed for it to
508
run. (These files will be copied into the initial RAM
509
filesystem.) Typical use is for a network hook which is
510
a shell script to print its needed binaries.
513
It is not necessary to print any non-executable files
514
already in the network hook directory, these will be
515
copied implicitly if they otherwise satisfy the name
521
<term><literal>modules</literal></term>
524
This should make the network hook print, <emphasis>on
525
separate lines</emphasis>, all the kernel modules needed
526
for it to run. (These modules will be copied into the
527
initial RAM filesystem.) For instance, a tunnel
529
<quote><literal>tun</literal></quote> module.
535
The network hook will be provided with a number of environment
540
<term><envar>MANDOSNETHOOKDIR</envar></term>
543
The network hook directory, specified to
544
<command>&COMMANDNAME;</command> by the
545
<option>--network-hook-dir</option> option. Note: this
546
should <emphasis>always</emphasis> be used by the
547
network hook to refer to itself or any files in the hook
548
directory it may require.
553
<term><envar>DEVICE</envar></term>
556
The network interfaces, as specified to
557
<command>&COMMANDNAME;</command> by the
558
<option>--interface</option> option, combined to one
559
string and separated by commas. If this is set, and
560
does not contain the interface a hook will bring up,
561
there is no reason for a hook to continue.
566
<term><envar>MODE</envar></term>
569
This will be the same as the first argument;
570
i.e. <quote><literal>start</literal></quote>,
571
<quote><literal>stop</literal></quote>,
572
<quote><literal>files</literal></quote>, or
573
<quote><literal>modules</literal></quote>.
578
<term><envar>VERBOSITY</envar></term>
581
This will be the <quote><literal>1</literal></quote> if
582
the <option>--debug</option> option is passed to
583
<command>&COMMANDNAME;</command>, otherwise
584
<quote><literal>0</literal></quote>.
589
<term><envar>DELAY</envar></term>
592
This will be the same as the <option>--delay</option>
593
option passed to <command>&COMMANDNAME;</command>. Is
594
only set if <envar>MODE</envar> is
595
<quote><literal>start</literal></quote> or
596
<quote><literal>stop</literal></quote>.
601
<term><envar>CONNECT</envar></term>
604
This will be the same as the <option>--connect</option>
605
option passed to <command>&COMMANDNAME;</command>. Is
606
only set if <option>--connect</option> is passed and
607
<envar>MODE</envar> is
608
<quote><literal>start</literal></quote> or
609
<quote><literal>stop</literal></quote>.
615
A hook may not read from standard input, and should be
616
restrictive in printing to standard output or standard error
617
unless <varname>VERBOSITY</varname> is
618
<quote><literal>1</literal></quote>.
623
347
<refsect1 id="files">
624
348
<title>FILES</title>