/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos.xml

  • Committer: Teddy Hogeborn
  • Date: 2010-09-28 19:38:10 UTC
  • mfrom: (237.4.2 mandos-release)
  • Revision ID: teddy@fukt.bsnet.se-20100928193810-hw5fktxy93epthxx
Merge from release branch.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos.xml
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY COMMANDNAME "mandos">
5
 
<!ENTITY TIMESTAMP "2011-10-22">
 
5
<!ENTITY TIMESTAMP "2010-09-26">
6
6
<!ENTITY % common SYSTEM "common.ent">
7
7
%common;
8
8
]>
19
19
        <firstname>Björn</firstname>
20
20
        <surname>Påhlsson</surname>
21
21
        <address>
22
 
          <email>belorn@recompile.se</email>
 
22
          <email>belorn@fukt.bsnet.se</email>
23
23
        </address>
24
24
      </author>
25
25
      <author>
26
26
        <firstname>Teddy</firstname>
27
27
        <surname>Hogeborn</surname>
28
28
        <address>
29
 
          <email>teddy@recompile.se</email>
 
29
          <email>teddy@fukt.bsnet.se</email>
30
30
        </address>
31
31
      </author>
32
32
    </authorgroup>
34
34
      <year>2008</year>
35
35
      <year>2009</year>
36
36
      <year>2010</year>
37
 
      <year>2011</year>
38
37
      <holder>Teddy Hogeborn</holder>
39
38
      <holder>Björn Påhlsson</holder>
40
39
    </copyright>
94
93
      <arg><option>--no-dbus</option></arg>
95
94
      <sbr/>
96
95
      <arg><option>--no-ipv6</option></arg>
97
 
      <sbr/>
98
 
      <arg><option>--no-restore</option></arg>
99
96
    </cmdsynopsis>
100
97
    <cmdsynopsis>
101
98
      <command>&COMMANDNAME;</command>
119
116
    <para>
120
117
      <command>&COMMANDNAME;</command> is a server daemon which
121
118
      handles incoming request for passwords for a pre-defined list of
122
 
      client host computers. For an introduction, see
123
 
      <citerefentry><refentrytitle>intro</refentrytitle>
124
 
      <manvolnum>8mandos</manvolnum></citerefentry>. The Mandos server
125
 
      uses Zeroconf to announce itself on the local network, and uses
126
 
      TLS to communicate securely with and to authenticate the
127
 
      clients.  The Mandos server uses IPv6 to allow Mandos clients to
128
 
      use IPv6 link-local addresses, since the clients will probably
129
 
      not have any other addresses configured (see <xref
130
 
      linkend="overview"/>).  Any authenticated client is then given
131
 
      the stored pre-encrypted password for that specific client.
 
119
      client host computers.  The Mandos server uses Zeroconf to
 
120
      announce itself on the local network, and uses TLS to
 
121
      communicate securely with and to authenticate the clients.  The
 
122
      Mandos server uses IPv6 to allow Mandos clients to use IPv6
 
123
      link-local addresses, since the clients will probably not have
 
124
      any other addresses configured (see <xref linkend="overview"/>).
 
125
      Any authenticated client is then given the stored pre-encrypted
 
126
      password for that specific client.
132
127
    </para>
133
128
  </refsect1>
134
129
  
277
272
          <xi:include href="mandos-options.xml" xpointer="ipv6"/>
278
273
        </listitem>
279
274
      </varlistentry>
280
 
      
281
 
      <varlistentry>
282
 
        <term><option>--no-restore</option></term>
283
 
        <listitem>
284
 
          <xi:include href="mandos-options.xml" xpointer="restore"/>
285
 
        </listitem>
286
 
      </varlistentry>
287
275
    </variablelist>
288
276
  </refsect1>
289
277
  
363
351
      for some time, the client is assumed to be compromised and is no
364
352
      longer eligible to receive the encrypted password.  (Manual
365
353
      intervention is required to re-enable a client.)  The timeout,
366
 
      extended timeout, checker program, and interval between checks
367
 
      can be configured both globally and per client; see
368
 
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
 
354
      checker program, and interval between checks can be configured
 
355
      both globally and per client; see <citerefentry>
 
356
      <refentrytitle>mandos-clients.conf</refentrytitle>
369
357
      <manvolnum>5</manvolnum></citerefentry>.  A client successfully
370
358
      receiving its password will also be treated as a successful
371
359
      checker run.
396
384
    <title>LOGGING</title>
397
385
    <para>
398
386
      The server will send log message with various severity levels to
399
 
      <filename class="devicefile">/dev/log</filename>.  With the
 
387
      <filename>/dev/log</filename>.  With the
400
388
      <option>--debug</option> option, it will log even more messages,
401
389
      and also show them on the console.
402
390
    </para>
478
466
        </listitem>
479
467
      </varlistentry>
480
468
      <varlistentry>
481
 
        <term><filename class="devicefile">/dev/log</filename></term>
 
469
        <term><filename>/dev/log</filename></term>
482
470
        <listitem>
483
471
          <para>
484
472
            The Unix domain socket to where local syslog messages are
518
506
      Debug mode is conflated with running in the foreground.
519
507
    </para>
520
508
    <para>
 
509
      The console log messages do not show a time stamp.
 
510
    </para>
 
511
    <para>
521
512
      This server does not check the expire time of clients’ OpenPGP
522
513
      keys.
523
514
    </para>
618
609
  <refsect1 id="see_also">
619
610
    <title>SEE ALSO</title>
620
611
    <para>
621
 
      <citerefentry><refentrytitle>intro</refentrytitle>
622
 
      <manvolnum>8mandos</manvolnum></citerefentry>,
623
 
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
624
 
      <manvolnum>5</manvolnum></citerefentry>,
625
 
      <citerefentry><refentrytitle>mandos.conf</refentrytitle>
626
 
      <manvolnum>5</manvolnum></citerefentry>,
627
 
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
628
 
      <manvolnum>8mandos</manvolnum></citerefentry>,
629
 
      <citerefentry><refentrytitle>sh</refentrytitle>
630
 
      <manvolnum>1</manvolnum></citerefentry>
 
612
      <citerefentry>
 
613
        <refentrytitle>mandos-clients.conf</refentrytitle>
 
614
        <manvolnum>5</manvolnum></citerefentry>, <citerefentry>
 
615
        <refentrytitle>mandos.conf</refentrytitle>
 
616
        <manvolnum>5</manvolnum></citerefentry>, <citerefentry>
 
617
        <refentrytitle>mandos-client</refentrytitle>
 
618
        <manvolnum>8mandos</manvolnum></citerefentry>, <citerefentry>
 
619
        <refentrytitle>sh</refentrytitle><manvolnum>1</manvolnum>
 
620
      </citerefentry>
631
621
    </para>
632
622
    <variablelist>
633
623
      <varlistentry>