/mandos/trunk : revision 24.1.81

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to plugins.d/password-prompt.xml

Committer: Björn Påhlsson
Date: 2008-09-03 18:47:50 UTC
mto: (24.1.154 mandos) (237.4.3 mandos-release)
mto: This revision was merged to the branch mainline in revision 149.
Revision ID: belorn@braxen-20080903184750-s0k0jrrq0lxiamwh

removed keyring pre-requirement for starting password-request.
Keys will now be imported in run-time to a run-time created keyring

Changed seckey and pubkey to be paths to private and public keys of the pgp encrypted password and gnutls authentication credentials.

files added:
.bzrignore

COPYING

initramfs-tools-hook

initramfs-tools-hook-conf

initramfs-tools-script

legalnotice.xml

mandos-clients.conf.xml

mandos-keygen

mandos-keygen.xml

mandos-options.xml

mandos.conf.xml

mandos.xml

overview.xml

plugin-runner.xml

plugins.d/password-prompt.xml

plugins.d/password-request.xml

plugins.d/usplash

files renamed:
server.py => mandos

server.conf => mandos.conf

plugbasedclient.c => plugin-runner.c

plugins.d/passprompt.c => plugins.d/password-prompt.c

plugins.d/mandosclient.c => plugins.d/password-request.c

files modified:
Makefile

TODO

clients.conf

Show diffs side-by-side

added added

removed removed

plugins.d/password-prompt.xml

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

<!ENTITY VERSION "1.0">

<!ENTITY COMMANDNAME "password-prompt">

<!ENTITY TIMESTAMP "2008-09-01">

<title>Mandos Manual</title>

<productname>Mandos</productname>

<productnumber>&VERSION;</productnumber>

<date>&TIMESTAMP;</date>

<firstname>Björn</firstname>

<surname>Påhlsson</surname>

<email>belorn@fukt.bsnet.se</email>

</address>

</author>

<firstname>Teddy</firstname>

<surname>Hogeborn</surname>

<email>teddy@fukt.bsnet.se</email>

</address>

</author>

</authorgroup>

<holder>Teddy Hogeborn</holder>

<holder>Björn Påhlsson</holder>

</copyright>

<xi:include href="../legalnotice.xml"/>

</refentryinfo>

<refentrytitle>&COMMANDNAME;</refentrytitle>

<manvolnum>8mandos</manvolnum>

</refmeta>

<refname><command>&COMMANDNAME;</command></refname>

<refpurpose>Prompt for a password and output it.</refpurpose>

</refnamediv>

<command>&COMMANDNAME;</command>

<arg choice="plain"><option>--prefix <replaceable

>PREFIX</replaceable></option></arg>

<arg choice="plain"><option>-p </option><replaceable

>PREFIX</replaceable></arg>

</group>

<sbr/>

<arg choice="opt"><option>--debug</option></arg>

</cmdsynopsis>

<command>&COMMANDNAME;</command>

</group>

</cmdsynopsis>

<command>&COMMANDNAME;</command>

<arg choice="plain"><option>--usage</option></arg>

</cmdsynopsis>

<command>&COMMANDNAME;</command>

<arg choice="plain"><option>--version</option></arg>

</group>

</cmdsynopsis>

</refsynopsisdiv>

<title>DESCRIPTION</title>

<para>

All <command>&COMMANDNAME;</command> does is prompt for a

password and output any given password to standard output. This

is not very useful on its own. This program is really meant to

run as a plugin in the <application>Mandos</application>

client-side system, where it is used as a fallback and

alternative to retriving passwords from a <application

>Mandos</application> server.

</para>

<para>

This program is little more than a <citerefentry><refentrytitle

>getpass</refentrytitle><manvolnum>3</manvolnum></citerefentry>

wrapper, although actual use of that function is not guaranteed

or implied.

</para>

</refsect1>

100

101

102

<title>OPTIONS</title>

103

<para>

104

This program is commonly not invoked from the command line; it

105

is normally started by the <application>Mandos</application>

106

plugin runner, see <citerefentry><refentrytitle

107

>plugin-runner</refentrytitle><manvolnum>8mandos</manvolnum>

108

</citerefentry>. Any command line options this program accepts

109

are therefore normally provided by the plugin runner, and not

110

directly.

111

</para>

112

113

114

115

<term><option>--prefix=<replaceable

116

>PREFIX</replaceable></option></term>

117

<term><option>-p

118

<replaceable>PREFIX</replaceable></option></term>

119

120

<para>

121

Prefix string shown before the password prompt.

122

</para>

123

</listitem>

124

</varlistentry>

125

126

127

<term><option>--debug</option></term>

128

129

<para>

130

Enable debug mode. This will enable a lot of output to

131

standard error about what the program is doing. The

132

program will still perform all other functions normally.

133

</para>

134

</listitem>

135

</varlistentry>

136

137

138

139

140

141

<para>

142

Gives a help message about options and their meanings.

143

</para>

144

</listitem>

145

</varlistentry>

146

147

148

<term><option>--usage</option></term>

149

150

<para>

151

Gives a short usage message.

152

</para>

153

</listitem>

154

</varlistentry>

155

156

157

<term><option>--version</option></term>

158

159

160

<para>

161

Prints the program version.

162

</para>

163

</listitem>

164

</varlistentry>

165

</variablelist>

166

</refsect1>

167

168

169

<title>EXIT STATUS</title>

170

<para>

171

If exit status is 0, the output from the program is the password

172

as it was read. Otherwise, if exit status is other than 0, the

173

program has encountered an error, and any output so far could be

174

corrupt and/or truncated, and should therefore be ignored.

175

</para>

176

</refsect1>

177

178

179

<title>ENVIRONMENT</title>

180

181

182

<term><envar>cryptsource</envar></term>

183

<term><envar>crypttarget</envar></term>

184

185

<para>

186

If set, these environment variables will be assumed to

187

contain the source device name and the target device

188

mapper name, respectively, and will be shown as part of

189

the prompt.

190

</para>

191

<para>

192

These variables will normally be inherited from

193

<citerefentry><refentrytitle>plugin-runner</refentrytitle>

194

<manvolnum>8mandos</manvolnum></citerefentry>, which will

195

normally have inherited them from

196

<filename>/scripts/local-top/cryptroot</filename> in the

197

initial <acronym>RAM</acronym> disk environment, which will

198

have set them from parsing kernel arguments and

199

<filename>/conf/conf.d/cryptroot</filename> (also in the

200

initial RAM disk environment), which in turn will have been

201

created when the initial RAM disk image was created by

202

<filename

203

>/usr/share/initramfs-tools/hooks/cryptroot</filename>, by

204

extracting the information of the root file system from

205

<filename >/etc/crypttab</filename>.

206

</para>

207

<para>

208

This behavior is meant to exactly mirror the behavior of

209

<command>askpass</command>, the default password prompter.

210

</para>

211

</listitem>

212

</varlistentry>

213

</variablelist>

214

</refsect1>

215

216

217

218

<para>

219

None are known at this time.

220

</para>

221

</refsect1>

222

223

224

<title>EXAMPLE</title>

225

<para>

226

Note that normally, command line options will not be given

227

directly, but via options for the Mandos <citerefentry

228

><refentrytitle>plugin-runner</refentrytitle>

229

<manvolnum>8mandos</manvolnum></citerefentry>.

230

</para>

231

232

<para>

233

Normal invocation needs no options:

234

</para>

235

<para>

236

<userinput>&COMMANDNAME;</userinput>

237

</para>

238

</informalexample>

239

240

<para>

241

Show a prefix before the prompt; in this case, a host name.

242

It might be useful to be reminded of which host needs a

243

password, in case of KVM switches, etc.

244

</para>

245

<para>

246

247

248

<userinput>&COMMANDNAME; --prefix=host.example.org:</userinput>

249

250

</para>

251

</informalexample>

252

253

<para>

254

Run in debug mode.

255

</para>

256

<para>

257

258

<userinput>&COMMANDNAME; --debug</userinput>

259

</para>

260

</informalexample>

261

</refsect1>

262

263

264

<title>SECURITY</title>

265

<para>

266

On its own, this program is very simple, and does not exactly

267

present any security risks. The one thing that could be

268

considered worthy of note is this: This program is meant to be

269

run by <citerefentry><refentrytitle

270

>plugin-runner</refentrytitle><manvolnum>8mandos</manvolnum>

271

</citerefentry>, and will, when run standalone, outside, in a

272

normal environment, immediately output on its standard output

273

any presumably secret password it just recieved. Therefore,

274

when running this program standalone (which should never

275

normally be done), take care not to type in any real secret

276

password by force of habit, since it would then immediately be

277

shown as output.

278

</para>

279

<para>

280

To further alleviate any risk of being locked out of a system,

281

the <citerefentry><refentrytitle>plugin-runner</refentrytitle>

282

<manvolnum>8mandos</manvolnum></citerefentry> has a fallback

283

mode which does the same thing as this program, only with less

284

features.

285

</para>

286

</refsect1>

287

288

289

290

<para>

291

<citerefentry><refentrytitle>crypttab</refentrytitle>

292

293

<citerefentry><refentrytitle>password-request</refentrytitle>

294

<manvolnum>8mandos</manvolnum></citerefentry>

295

<citerefentry><refentrytitle>plugin-runner</refentrytitle>

296

<manvolnum>8mandos</manvolnum></citerefentry>,

297

</para>

298

</refsect1>

299

</refentry>

300

301

302

303

304

Older »