/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos.xml

  • Committer: Teddy Hogeborn
  • Date: 2010-09-25 23:52:17 UTC
  • Revision ID: teddy@fukt.bsnet.se-20100925235217-4hhqfryz1ste6uw3
* mandos (ClientDBus.__init__): Bug fix: Translate "-" in client names
                                to "_" in D-Bus object paths.
  (MandosServer.handle_ipc): Bug fix: Send only address string to
                             D-Bus signal, not whole tuple.

* mandos-ctl: New options "--approve-by-default", "--deny-by-default",
              "--approval-delay", and "--approval-duration".
* mandos-ctl.xml (SYNOPSIS, OPTIONS): Document new options.

* mandos-monitor (MandosClientWidget.update): Fix spelling.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos.xml
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY COMMANDNAME "mandos">
5
 
<!ENTITY TIMESTAMP "2011-10-22">
 
5
<!ENTITY TIMESTAMP "2010-09-25">
6
6
<!ENTITY % common SYSTEM "common.ent">
7
7
%common;
8
8
]>
19
19
        <firstname>Björn</firstname>
20
20
        <surname>Påhlsson</surname>
21
21
        <address>
22
 
          <email>belorn@recompile.se</email>
 
22
          <email>belorn@fukt.bsnet.se</email>
23
23
        </address>
24
24
      </author>
25
25
      <author>
26
26
        <firstname>Teddy</firstname>
27
27
        <surname>Hogeborn</surname>
28
28
        <address>
29
 
          <email>teddy@recompile.se</email>
 
29
          <email>teddy@fukt.bsnet.se</email>
30
30
        </address>
31
31
      </author>
32
32
    </authorgroup>
33
33
    <copyright>
34
34
      <year>2008</year>
35
35
      <year>2009</year>
36
 
      <year>2010</year>
37
 
      <year>2011</year>
38
36
      <holder>Teddy Hogeborn</holder>
39
37
      <holder>Björn Påhlsson</holder>
40
38
    </copyright>
88
86
      <sbr/>
89
87
      <arg><option>--debug</option></arg>
90
88
      <sbr/>
91
 
      <arg><option>--debuglevel
92
 
      <replaceable>LEVEL</replaceable></option></arg>
93
 
      <sbr/>
94
89
      <arg><option>--no-dbus</option></arg>
95
90
      <sbr/>
96
91
      <arg><option>--no-ipv6</option></arg>
97
 
      <sbr/>
98
 
      <arg><option>--no-restore</option></arg>
99
92
    </cmdsynopsis>
100
93
    <cmdsynopsis>
101
94
      <command>&COMMANDNAME;</command>
119
112
    <para>
120
113
      <command>&COMMANDNAME;</command> is a server daemon which
121
114
      handles incoming request for passwords for a pre-defined list of
122
 
      client host computers. For an introduction, see
123
 
      <citerefentry><refentrytitle>intro</refentrytitle>
124
 
      <manvolnum>8mandos</manvolnum></citerefentry>. The Mandos server
125
 
      uses Zeroconf to announce itself on the local network, and uses
126
 
      TLS to communicate securely with and to authenticate the
127
 
      clients.  The Mandos server uses IPv6 to allow Mandos clients to
128
 
      use IPv6 link-local addresses, since the clients will probably
129
 
      not have any other addresses configured (see <xref
130
 
      linkend="overview"/>).  Any authenticated client is then given
131
 
      the stored pre-encrypted password for that specific client.
 
115
      client host computers.  The Mandos server uses Zeroconf to
 
116
      announce itself on the local network, and uses TLS to
 
117
      communicate securely with and to authenticate the clients.  The
 
118
      Mandos server uses IPv6 to allow Mandos clients to use IPv6
 
119
      link-local addresses, since the clients will probably not have
 
120
      any other addresses configured (see <xref linkend="overview"/>).
 
121
      Any authenticated client is then given the stored pre-encrypted
 
122
      password for that specific client.
132
123
    </para>
133
124
  </refsect1>
134
125
  
203
194
      </varlistentry>
204
195
      
205
196
      <varlistentry>
206
 
        <term><option>--debuglevel
207
 
        <replaceable>LEVEL</replaceable></option></term>
208
 
        <listitem>
209
 
          <para>
210
 
            Set the debugging log level.
211
 
            <replaceable>LEVEL</replaceable> is a string, one of
212
 
            <quote><literal>CRITICAL</literal></quote>,
213
 
            <quote><literal>ERROR</literal></quote>,
214
 
            <quote><literal>WARNING</literal></quote>,
215
 
            <quote><literal>INFO</literal></quote>, or
216
 
            <quote><literal>DEBUG</literal></quote>, in order of
217
 
            increasing verbosity.  The default level is
218
 
            <quote><literal>WARNING</literal></quote>.
219
 
          </para>
220
 
        </listitem>
221
 
      </varlistentry>
222
 
      
223
 
      <varlistentry>
224
197
        <term><option>--priority <replaceable>
225
198
        PRIORITY</replaceable></option></term>
226
199
        <listitem>
277
250
          <xi:include href="mandos-options.xml" xpointer="ipv6"/>
278
251
        </listitem>
279
252
      </varlistentry>
280
 
      
281
 
      <varlistentry>
282
 
        <term><option>--no-restore</option></term>
283
 
        <listitem>
284
 
          <xi:include href="mandos-options.xml" xpointer="restore"/>
285
 
        </listitem>
286
 
      </varlistentry>
287
253
    </variablelist>
288
254
  </refsect1>
289
255
  
363
329
      for some time, the client is assumed to be compromised and is no
364
330
      longer eligible to receive the encrypted password.  (Manual
365
331
      intervention is required to re-enable a client.)  The timeout,
366
 
      extended timeout, checker program, and interval between checks
367
 
      can be configured both globally and per client; see
368
 
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
 
332
      checker program, and interval between checks can be configured
 
333
      both globally and per client; see <citerefentry>
 
334
      <refentrytitle>mandos-clients.conf</refentrytitle>
369
335
      <manvolnum>5</manvolnum></citerefentry>.  A client successfully
370
336
      receiving its password will also be treated as a successful
371
337
      checker run.
518
484
      Debug mode is conflated with running in the foreground.
519
485
    </para>
520
486
    <para>
 
487
      The console log messages do not show a time stamp.
 
488
    </para>
 
489
    <para>
521
490
      This server does not check the expire time of clients’ OpenPGP
522
491
      keys.
523
492
    </para>
618
587
  <refsect1 id="see_also">
619
588
    <title>SEE ALSO</title>
620
589
    <para>
621
 
      <citerefentry><refentrytitle>intro</refentrytitle>
622
 
      <manvolnum>8mandos</manvolnum></citerefentry>,
623
 
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
624
 
      <manvolnum>5</manvolnum></citerefentry>,
625
 
      <citerefentry><refentrytitle>mandos.conf</refentrytitle>
626
 
      <manvolnum>5</manvolnum></citerefentry>,
627
 
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
628
 
      <manvolnum>8mandos</manvolnum></citerefentry>,
629
 
      <citerefentry><refentrytitle>sh</refentrytitle>
630
 
      <manvolnum>1</manvolnum></citerefentry>
 
590
      <citerefentry>
 
591
        <refentrytitle>mandos-clients.conf</refentrytitle>
 
592
        <manvolnum>5</manvolnum></citerefentry>, <citerefentry>
 
593
        <refentrytitle>mandos.conf</refentrytitle>
 
594
        <manvolnum>5</manvolnum></citerefentry>, <citerefentry>
 
595
        <refentrytitle>mandos-client</refentrytitle>
 
596
        <manvolnum>8mandos</manvolnum></citerefentry>, <citerefentry>
 
597
        <refentrytitle>sh</refentrytitle><manvolnum>1</manvolnum>
 
598
      </citerefentry>
631
599
    </para>
632
600
    <variablelist>
633
601
      <varlistentry>