/mandos/trunk : revision 530

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos.xml

Committer: teddy at bsnet
Date: 2011-12-23 20:00:52 UTC
Revision ID: teddy@fukt.bsnet.se-20111223200052-nehnjfy0fogvm4ii

* mandos (initlogger): Take new "debug" argument; all callers changed.
Only add console logger in debug mode.
(main/cleanup): Remove temp file on failure.

Show diffs side-by-side

added added

removed removed

mandos.xml

<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

<!ENTITY COMMANDNAME "mandos">

<!ENTITY TIMESTAMP "2011-10-22">

<!ENTITY TIMESTAMP "2011-11-26">

<!ENTITY % common SYSTEM "common.ent">

%common;

<sbr/>

<arg><option>--no-restore</option></arg>

<sbr/>

100

<arg><option>--statedir

101

<replaceable>DIRECTORY</replaceable></option></arg>

102

</cmdsynopsis>

100

103

101

104

<command>&COMMANDNAME;</command>

284

287

<xi:include href="mandos-options.xml" xpointer="restore"/>

285

288

</listitem>

286

289

</varlistentry>

290

291

292

<term><option>--statedir

293

<replaceable>DIRECTORY</replaceable></option></term>

294

295

<xi:include href="mandos-options.xml" xpointer="statedir"/>

296

</listitem>

297

</varlistentry>

287

298

</variablelist>

288

299

</refsect1>

289

300

479

490

</varlistentry>

480

491

481

492

493

</varlistentry>

494

495

<term><filename

496

class="directory">/var/lib/mandos</filename></term>

497

498

<para>

499

Directory where persistent state will be saved. Change

500

this with the <option>--statedir</option> option. See

501

also the <option>--no-restore</option> option.

502

</para>

503

</listitem>

504

</varlistentry>

505

506

482

507

483

508

<para>

484

509

The Unix domain socket to where local syslog messages are

507

532

backtrace. This could be considered a feature.

508

533

</para>

509

534

<para>

510

Currently, if a client is disabled due to having timed out, the

511

server does not record this fact onto permanent storage. This

512

has some security implications, see <xref linkend="clients"/>.

513

</para>

514

<para>

515

535

There is no fine-grained control over logging and debug output.

516

536

</para>

517

537

<para>

536

556

537

557

<para>

538

558

Run the server in debug mode, read configuration files from

539

the <filename>~/mandos</filename> directory, and use the

540

Zeroconf service name <quote>Test</quote> to not collide with

541

any other official Mandos server on this host:

559

the <filename class="directory">~/mandos</filename> directory,

560

and use the Zeroconf service name <quote>Test</quote> to not

561

collide with any other official Mandos server on this host:

542

562

</para>

543

563

<para>

544

564

593

613

compromised if they are gone for too long.

594

614

</para>

595

615

<para>

596

If a client is compromised, its downtime should be duly noted

597

by the server which would therefore disable the client. But

598

if the server was ever restarted, it would re-read its client

599

list from its configuration file and again regard all clients

600

therein as enabled, and hence eligible to receive their

601

passwords. Therefore, be careful when restarting servers if

602

it is suspected that a client has, in fact, been compromised

603

by parties who may now be running a fake Mandos client with

604

the keys from the non-encrypted initial <acronym>RAM</acronym>

605

image of the client host. What should be done in that case

606

(if restarting the server program really is necessary) is to

607

stop the server program, edit the configuration file to omit

608

any suspect clients, and restart the server program.

609

</para>

610

<para>

611

616

For more details on client-side security, see

612

617

<citerefentry><refentrytitle>mandos-client</refentrytitle>

613

618

<manvolnum>8mandos</manvolnum></citerefentry>.

Older »