/mandos/trunk : revision 369

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos.xml

Committer: Teddy Hogeborn
Date: 2009-09-16 23:28:39 UTC
Revision ID: teddy@fukt.bsnet.se-20090916232839-3o7i8qmcdcz5j1ya

* init.d-mandos (Required-Start, Required-Stop): Bug fix: Added
                 "$syslog", thanks to Petter Reinholdtsen
                 <pere@hungry.com> (Debian bug #546928).

* initramfs-tools-script: Removed erroneous comment.

* plugins.d/askpass-fifo.c: Removed TEMP_FAILURE_RETRY since it is
                            not needed.

* plugins.d/mandos-client.c (main): Bug fix: Initialize
                                    "old_sigterm_action".

* plugins.d/splashy.c (main): Bug fix: really check return value from
                              "sigaddset".  Fix some warnings on
                              64-bit systems.

* plugins.d/usplash.c (termination_handler, main): Save received
                                                   signal and
                                                   re-raise it on
                                                   exit.
  (usplash_write): Do not close FIFO, instead, take an additional file
                   descriptor pointer to it and open only when needed
                   (all callers changed).  Abort immediately on EINTR.
                   Bug fix:  Add NUL byte on single-word commands.
                   Ignore "interrupted_by_signal".
  (makeprompt, find_usplash): New; broken out from "main()".
  (find_usplash): Bug fix: close /proc/<pid>/cmdline FD on error.
  (main): Reorganized to jump to a new "failure" label on any error.
          Bug fix: check return values from sigaddset.
          New variable "usplash_accessed" to flag if usplash(8) needs
          to be killed and restarted.  Removed the "an_error_occured"
          variable.

Show diffs side-by-side

added added

removed removed

mandos.xml

<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

<!ENTITY COMMANDNAME "mandos">

<!ENTITY TIMESTAMP "2010-09-25">

<!ENTITY TIMESTAMP "2009-09-10">

<!ENTITY % common SYSTEM "common.ent">

%common;

332

checker program, and interval between checks can be configured

333

both globally and per client; see <citerefentry>

334

<refentrytitle>mandos-clients.conf</refentrytitle>

335

<manvolnum>5</manvolnum></citerefentry>. A client successfully

336

receiving its password will also be treated as a successful

337

checker run.

338

</para>

339

</refsect1>

340

341

342

<title>APPROVAL</title>

343

<para>

344

The server can be configured to require manual approval for a

345

client before it is sent its secret. The delay to wait for such

346

approval and the default action (approve or deny) can be

347

configured both globally and per client; see <citerefentry>

348

<refentrytitle>mandos-clients.conf</refentrytitle>

349

<manvolnum>5</manvolnum></citerefentry>. By default all clients

350

will be approved immediately without delay.

351

</para>

352

<para>

353

This can be used to deny a client its secret if not manually

354

approved within a specified time. It can also be used to make

355

the server delay before giving a client its secret, allowing

356

optional manual denying of this specific client.

357

</para>

358

335

<manvolnum>5</manvolnum></citerefentry>.

336

</para>

359

337

</refsect1>

360

338

361

339

373

351

<para>

374

352

The server will by default provide a D-Bus system bus interface.

375

353

This interface will only be accessible by the root user or a

376

Mandos-specific user, if such a user exists. For documentation

377

of the D-Bus API, see the file <filename>DBUS-API</filename>.

354

Mandos-specific user, if such a user exists.

355

378

356

</para>

379

357

</refsect1>

380

358

438

416

<term><filename>/var/run/mandos.pid</filename></term>

439

417

440

418

<para>

441

The file containing the process id of the

442

<command>&COMMANDNAME;</command> process started last.

419

The file containing the process id of

420

<command>&COMMANDNAME;</command>.

443

421

</para>

444

422

</listitem>

445

423

</varlistentry>

473

451

backtrace. This could be considered a feature.

474

452

</para>

475

453

<para>

476

Currently, if a client is disabled due to having timed out, the

477

server does not record this fact onto permanent storage. This

478

has some security implications, see <xref linkend="clients"/>.

454

Currently, if a client is declared <quote>invalid</quote> due to

455

having timed out, the server does not record this fact onto

456

permanent storage. This has some security implications, see

457

<xref linkend="clients"/>.

458

</para>

459

<para>

460

There is currently no way of querying the server of the current

461

status of clients, other than analyzing its <systemitem

462

class="service">syslog</systemitem> output.

479

463

</para>

480

464

<para>

481

465

There is no fine-grained control over logging and debug output.

563

547

</para>

564

548

<para>

565

549

If a client is compromised, its downtime should be duly noted

566

by the server which would therefore disable the client. But

567

if the server was ever restarted, it would re-read its client

568

list from its configuration file and again regard all clients

569

therein as enabled, and hence eligible to receive their

570

passwords. Therefore, be careful when restarting servers if

571

it is suspected that a client has, in fact, been compromised

572

by parties who may now be running a fake Mandos client with

573

the keys from the non-encrypted initial <acronym>RAM</acronym>

574

image of the client host. What should be done in that case

575

(if restarting the server program really is necessary) is to

576

stop the server program, edit the configuration file to omit

577

any suspect clients, and restart the server program.

550

by the server which would therefore declare the client

551

invalid. But if the server was ever restarted, it would

552

re-read its client list from its configuration file and again

553

regard all clients therein as valid, and hence eligible to

554

receive their passwords. Therefore, be careful when

555

restarting servers if it is suspected that a client has, in

556

fact, been compromised by parties who may now be running a

557

fake Mandos client with the keys from the non-encrypted

558

initial <acronym>RAM</acronym> image of the client host. What

559

should be done in that case (if restarting the server program

560

really is necessary) is to stop the server program, edit the

561

configuration file to omit any suspect clients, and restart

562

the server program.

578

563

</para>

579

564

<para>

580

565

For more details on client-side security, see

Older »