/mandos/trunk : revision 369

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos.xml

Committer: Teddy Hogeborn
Date: 2009-09-16 23:28:39 UTC
Revision ID: teddy@fukt.bsnet.se-20090916232839-3o7i8qmcdcz5j1ya

* init.d-mandos (Required-Start, Required-Stop): Bug fix: Added
                 "$syslog", thanks to Petter Reinholdtsen
                 <pere@hungry.com> (Debian bug #546928).

* initramfs-tools-script: Removed erroneous comment.

* plugins.d/askpass-fifo.c: Removed TEMP_FAILURE_RETRY since it is
                            not needed.

* plugins.d/mandos-client.c (main): Bug fix: Initialize
                                    "old_sigterm_action".

* plugins.d/splashy.c (main): Bug fix: really check return value from
                              "sigaddset".  Fix some warnings on
                              64-bit systems.

* plugins.d/usplash.c (termination_handler, main): Save received
                                                   signal and
                                                   re-raise it on
                                                   exit.
  (usplash_write): Do not close FIFO, instead, take an additional file
                   descriptor pointer to it and open only when needed
                   (all callers changed).  Abort immediately on EINTR.
                   Bug fix:  Add NUL byte on single-word commands.
                   Ignore "interrupted_by_signal".
  (makeprompt, find_usplash): New; broken out from "main()".
  (find_usplash): Bug fix: close /proc/<pid>/cmdline FD on error.
  (main): Reorganized to jump to a new "failure" label on any error.
          Bug fix: check return values from sigaddset.
          New variable "usplash_accessed" to flag if usplash(8) needs
          to be killed and restarted.  Removed the "an_error_occured"
          variable.

Show diffs side-by-side

added added

removed removed

mandos.xml

<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

<!ENTITY COMMANDNAME "mandos">

<!ENTITY TIMESTAMP "2010-09-11">

<!ENTITY TIMESTAMP "2009-09-10">

<!ENTITY % common SYSTEM "common.ent">

%common;

332

checker program, and interval between checks can be configured

333

both globally and per client; see <citerefentry>

334

<refentrytitle>mandos-clients.conf</refentrytitle>

335

<manvolnum>5</manvolnum></citerefentry>. A client successfully

336

receiving its password will also be treated as a successful

337

checker run.

335

<manvolnum>5</manvolnum></citerefentry>.

338

336

</para>

339

337

</refsect1>

340

338

353

351

<para>

354

352

The server will by default provide a D-Bus system bus interface.

355

353

This interface will only be accessible by the root user or a

356

Mandos-specific user, if such a user exists. For documentation

357

of the D-Bus API, see the file <filename>DBUS-API</filename>.

354

Mandos-specific user, if such a user exists.

355

358

356

</para>

359

357

</refsect1>

360

358

453

451

backtrace. This could be considered a feature.

454

452

</para>

455

453

<para>

456

Currently, if a client is disabled due to having timed out, the

457

server does not record this fact onto permanent storage. This

458

has some security implications, see <xref linkend="clients"/>.

454

Currently, if a client is declared <quote>invalid</quote> due to

455

having timed out, the server does not record this fact onto

456

permanent storage. This has some security implications, see

457

<xref linkend="clients"/>.

458

</para>

459

<para>

460

There is currently no way of querying the server of the current

461

status of clients, other than analyzing its <systemitem

462

class="service">syslog</systemitem> output.

459

463

</para>

460

464

<para>

461

465

There is no fine-grained control over logging and debug output.

543

547

</para>

544

548

<para>

545

549

If a client is compromised, its downtime should be duly noted

546

by the server which would therefore disable the client. But

547

if the server was ever restarted, it would re-read its client

548

list from its configuration file and again regard all clients

549

therein as enabled, and hence eligible to receive their

550

passwords. Therefore, be careful when restarting servers if

551

it is suspected that a client has, in fact, been compromised

552

by parties who may now be running a fake Mandos client with

553

the keys from the non-encrypted initial <acronym>RAM</acronym>

554

image of the client host. What should be done in that case

555

(if restarting the server program really is necessary) is to

556

stop the server program, edit the configuration file to omit

557

any suspect clients, and restart the server program.

550

by the server which would therefore declare the client

551

invalid. But if the server was ever restarted, it would

552

re-read its client list from its configuration file and again

553

regard all clients therein as valid, and hence eligible to

554

receive their passwords. Therefore, be careful when

555

restarting servers if it is suspected that a client has, in

556

fact, been compromised by parties who may now be running a

557

fake Mandos client with the keys from the non-encrypted

558

initial <acronym>RAM</acronym> image of the client host. What

559

should be done in that case (if restarting the server program

560

really is necessary) is to stop the server program, edit the

561

configuration file to omit any suspect clients, and restart

562

the server program.

558

563

</para>

559

564

<para>

560

565

For more details on client-side security, see

Older »