/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos.xml

  • Committer: Teddy Hogeborn
  • Date: 2010-09-25 21:24:49 UTC
  • Revision ID: teddy@fukt.bsnet.se-20100925212449-h9hpy9n406tkkakb
* mandos.xml (APPROVAL): New section.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos.xml
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY COMMANDNAME "mandos">
5
 
<!ENTITY TIMESTAMP "2013-10-20">
 
5
<!ENTITY TIMESTAMP "2010-09-25">
6
6
<!ENTITY % common SYSTEM "common.ent">
7
7
%common;
8
8
]>
19
19
        <firstname>Björn</firstname>
20
20
        <surname>Påhlsson</surname>
21
21
        <address>
22
 
          <email>belorn@recompile.se</email>
 
22
          <email>belorn@fukt.bsnet.se</email>
23
23
        </address>
24
24
      </author>
25
25
      <author>
26
26
        <firstname>Teddy</firstname>
27
27
        <surname>Hogeborn</surname>
28
28
        <address>
29
 
          <email>teddy@recompile.se</email>
 
29
          <email>teddy@fukt.bsnet.se</email>
30
30
        </address>
31
31
      </author>
32
32
    </authorgroup>
33
33
    <copyright>
34
34
      <year>2008</year>
35
35
      <year>2009</year>
36
 
      <year>2010</year>
37
 
      <year>2011</year>
38
 
      <year>2012</year>
39
 
      <year>2013</year>
40
36
      <holder>Teddy Hogeborn</holder>
41
37
      <holder>Björn Påhlsson</holder>
42
38
    </copyright>
90
86
      <sbr/>
91
87
      <arg><option>--debug</option></arg>
92
88
      <sbr/>
93
 
      <arg><option>--debuglevel
94
 
      <replaceable>LEVEL</replaceable></option></arg>
95
 
      <sbr/>
96
89
      <arg><option>--no-dbus</option></arg>
97
90
      <sbr/>
98
91
      <arg><option>--no-ipv6</option></arg>
99
 
      <sbr/>
100
 
      <arg><option>--no-restore</option></arg>
101
 
      <sbr/>
102
 
      <arg><option>--statedir
103
 
      <replaceable>DIRECTORY</replaceable></option></arg>
104
 
      <sbr/>
105
 
      <arg><option>--socket
106
 
      <replaceable>FD</replaceable></option></arg>
107
 
      <sbr/>
108
 
      <arg><option>--foreground</option></arg>
109
92
    </cmdsynopsis>
110
93
    <cmdsynopsis>
111
94
      <command>&COMMANDNAME;</command>
129
112
    <para>
130
113
      <command>&COMMANDNAME;</command> is a server daemon which
131
114
      handles incoming request for passwords for a pre-defined list of
132
 
      client host computers. For an introduction, see
133
 
      <citerefentry><refentrytitle>intro</refentrytitle>
134
 
      <manvolnum>8mandos</manvolnum></citerefentry>. The Mandos server
135
 
      uses Zeroconf to announce itself on the local network, and uses
136
 
      TLS to communicate securely with and to authenticate the
137
 
      clients.  The Mandos server uses IPv6 to allow Mandos clients to
138
 
      use IPv6 link-local addresses, since the clients will probably
139
 
      not have any other addresses configured (see <xref
140
 
      linkend="overview"/>).  Any authenticated client is then given
141
 
      the stored pre-encrypted password for that specific client.
 
115
      client host computers.  The Mandos server uses Zeroconf to
 
116
      announce itself on the local network, and uses TLS to
 
117
      communicate securely with and to authenticate the clients.  The
 
118
      Mandos server uses IPv6 to allow Mandos clients to use IPv6
 
119
      link-local addresses, since the clients will probably not have
 
120
      any other addresses configured (see <xref linkend="overview"/>).
 
121
      Any authenticated client is then given the stored pre-encrypted
 
122
      password for that specific client.
142
123
    </para>
143
124
  </refsect1>
144
125
  
213
194
      </varlistentry>
214
195
      
215
196
      <varlistentry>
216
 
        <term><option>--debuglevel
217
 
        <replaceable>LEVEL</replaceable></option></term>
218
 
        <listitem>
219
 
          <para>
220
 
            Set the debugging log level.
221
 
            <replaceable>LEVEL</replaceable> is a string, one of
222
 
            <quote><literal>CRITICAL</literal></quote>,
223
 
            <quote><literal>ERROR</literal></quote>,
224
 
            <quote><literal>WARNING</literal></quote>,
225
 
            <quote><literal>INFO</literal></quote>, or
226
 
            <quote><literal>DEBUG</literal></quote>, in order of
227
 
            increasing verbosity.  The default level is
228
 
            <quote><literal>WARNING</literal></quote>.
229
 
          </para>
230
 
        </listitem>
231
 
      </varlistentry>
232
 
      
233
 
      <varlistentry>
234
197
        <term><option>--priority <replaceable>
235
198
        PRIORITY</replaceable></option></term>
236
199
        <listitem>
287
250
          <xi:include href="mandos-options.xml" xpointer="ipv6"/>
288
251
        </listitem>
289
252
      </varlistentry>
290
 
      
291
 
      <varlistentry>
292
 
        <term><option>--no-restore</option></term>
293
 
        <listitem>
294
 
          <xi:include href="mandos-options.xml" xpointer="restore"/>
295
 
          <para>
296
 
            See also <xref linkend="persistent_state"/>.
297
 
          </para>
298
 
        </listitem>
299
 
      </varlistentry>
300
 
      
301
 
      <varlistentry>
302
 
        <term><option>--statedir
303
 
        <replaceable>DIRECTORY</replaceable></option></term>
304
 
        <listitem>
305
 
          <xi:include href="mandos-options.xml" xpointer="statedir"/>
306
 
        </listitem>
307
 
      </varlistentry>
308
 
      
309
 
      <varlistentry>
310
 
        <term><option>--socket
311
 
        <replaceable>FD</replaceable></option></term>
312
 
        <listitem>
313
 
          <xi:include href="mandos-options.xml" xpointer="socket"/>
314
 
        </listitem>
315
 
      </varlistentry>
316
 
      
317
 
      <varlistentry>
318
 
        <term><option>--foreground</option></term>
319
 
        <listitem>
320
 
          <xi:include href="mandos-options.xml"
321
 
                      xpointer="foreground"/>
322
 
        </listitem>
323
 
      </varlistentry>
324
 
      
325
253
    </variablelist>
326
254
  </refsect1>
327
255
  
401
329
      for some time, the client is assumed to be compromised and is no
402
330
      longer eligible to receive the encrypted password.  (Manual
403
331
      intervention is required to re-enable a client.)  The timeout,
404
 
      extended timeout, checker program, and interval between checks
405
 
      can be configured both globally and per client; see
406
 
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
407
 
      <manvolnum>5</manvolnum></citerefentry>.
 
332
      checker program, and interval between checks can be configured
 
333
      both globally and per client; see <citerefentry>
 
334
      <refentrytitle>mandos-clients.conf</refentrytitle>
 
335
      <manvolnum>5</manvolnum></citerefentry>.  A client successfully
 
336
      receiving its password will also be treated as a successful
 
337
      checker run.
408
338
    </para>
409
339
  </refsect1>
410
340
  
432
362
    <title>LOGGING</title>
433
363
    <para>
434
364
      The server will send log message with various severity levels to
435
 
      <filename class="devicefile">/dev/log</filename>.  With the
 
365
      <filename>/dev/log</filename>.  With the
436
366
      <option>--debug</option> option, it will log even more messages,
437
367
      and also show them on the console.
438
368
    </para>
439
369
  </refsect1>
440
370
  
441
 
  <refsect1 id="persistent_state">
442
 
    <title>PERSISTENT STATE</title>
443
 
    <para>
444
 
      Client settings, initially read from
445
 
      <filename>clients.conf</filename>, are persistent across
446
 
      restarts, and run-time changes will override settings in
447
 
      <filename>clients.conf</filename>.  However, if a setting is
448
 
      <emphasis>changed</emphasis> (or a client added, or removed) in
449
 
      <filename>clients.conf</filename>, this will take precedence.
450
 
    </para>
451
 
  </refsect1>
452
 
  
453
371
  <refsect1 id="dbus_interface">
454
372
    <title>D-BUS INTERFACE</title>
455
373
    <para>
517
435
        </listitem>
518
436
      </varlistentry>
519
437
      <varlistentry>
520
 
        <term><filename>/run/mandos.pid</filename></term>
 
438
        <term><filename>/var/run/mandos.pid</filename></term>
521
439
        <listitem>
522
440
          <para>
523
441
            The file containing the process id of the
526
444
        </listitem>
527
445
      </varlistentry>
528
446
      <varlistentry>
529
 
        <term><filename class="devicefile">/dev/log</filename></term>
530
 
      </varlistentry>
531
 
      <varlistentry>
532
 
        <term><filename
533
 
        class="directory">/var/lib/mandos</filename></term>
534
 
        <listitem>
535
 
          <para>
536
 
            Directory where persistent state will be saved.  Change
537
 
            this with the <option>--statedir</option> option.  See
538
 
            also the <option>--no-restore</option> option.
539
 
          </para>
540
 
        </listitem>
541
 
      </varlistentry>
542
 
      <varlistentry>
543
447
        <term><filename>/dev/log</filename></term>
544
448
        <listitem>
545
449
          <para>
569
473
      backtrace.  This could be considered a feature.
570
474
    </para>
571
475
    <para>
 
476
      Currently, if a client is disabled due to having timed out, the
 
477
      server does not record this fact onto permanent storage.  This
 
478
      has some security implications, see <xref linkend="clients"/>.
 
479
    </para>
 
480
    <para>
572
481
      There is no fine-grained control over logging and debug output.
573
482
    </para>
574
483
    <para>
 
484
      Debug mode is conflated with running in the foreground.
 
485
    </para>
 
486
    <para>
 
487
      The console log messages do not show a time stamp.
 
488
    </para>
 
489
    <para>
575
490
      This server does not check the expire time of clients’ OpenPGP
576
491
      keys.
577
492
    </para>
590
505
    <informalexample>
591
506
      <para>
592
507
        Run the server in debug mode, read configuration files from
593
 
        the <filename class="directory">~/mandos</filename> directory,
594
 
        and use the Zeroconf service name <quote>Test</quote> to not
595
 
        collide with any other official Mandos server on this host:
 
508
        the <filename>~/mandos</filename> directory, and use the
 
509
        Zeroconf service name <quote>Test</quote> to not collide with
 
510
        any other official Mandos server on this host:
596
511
      </para>
597
512
      <para>
598
513
 
647
562
        compromised if they are gone for too long.
648
563
      </para>
649
564
      <para>
 
565
        If a client is compromised, its downtime should be duly noted
 
566
        by the server which would therefore disable the client.  But
 
567
        if the server was ever restarted, it would re-read its client
 
568
        list from its configuration file and again regard all clients
 
569
        therein as enabled, and hence eligible to receive their
 
570
        passwords.  Therefore, be careful when restarting servers if
 
571
        it is suspected that a client has, in fact, been compromised
 
572
        by parties who may now be running a fake Mandos client with
 
573
        the keys from the non-encrypted initial <acronym>RAM</acronym>
 
574
        image of the client host.  What should be done in that case
 
575
        (if restarting the server program really is necessary) is to
 
576
        stop the server program, edit the configuration file to omit
 
577
        any suspect clients, and restart the server program.
 
578
      </para>
 
579
      <para>
650
580
        For more details on client-side security, see
651
581
        <citerefentry><refentrytitle>mandos-client</refentrytitle>
652
582
        <manvolnum>8mandos</manvolnum></citerefentry>.
657
587
  <refsect1 id="see_also">
658
588
    <title>SEE ALSO</title>
659
589
    <para>
660
 
      <citerefentry><refentrytitle>intro</refentrytitle>
661
 
      <manvolnum>8mandos</manvolnum></citerefentry>,
662
 
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
663
 
      <manvolnum>5</manvolnum></citerefentry>,
664
 
      <citerefentry><refentrytitle>mandos.conf</refentrytitle>
665
 
      <manvolnum>5</manvolnum></citerefentry>,
666
 
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
667
 
      <manvolnum>8mandos</manvolnum></citerefentry>,
668
 
      <citerefentry><refentrytitle>sh</refentrytitle>
669
 
      <manvolnum>1</manvolnum></citerefentry>
 
590
      <citerefentry>
 
591
        <refentrytitle>mandos-clients.conf</refentrytitle>
 
592
        <manvolnum>5</manvolnum></citerefentry>, <citerefentry>
 
593
        <refentrytitle>mandos.conf</refentrytitle>
 
594
        <manvolnum>5</manvolnum></citerefentry>, <citerefentry>
 
595
        <refentrytitle>mandos-client</refentrytitle>
 
596
        <manvolnum>8mandos</manvolnum></citerefentry>, <citerefentry>
 
597
        <refentrytitle>sh</refentrytitle><manvolnum>1</manvolnum>
 
598
      </citerefentry>
670
599
    </para>
671
600
    <variablelist>
672
601
      <varlistentry>