/mandos/trunk : revision 589

2

<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"

3

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

4

<!ENTITY COMMANDNAME "mandos-client">

5

<!ENTITY TIMESTAMP "2012-07-23">

5

<!ENTITY TIMESTAMP "2012-01-01">

6

<!ENTITY % common SYSTEM "../common.ent">

7

%common;

8

]>

64

><replaceable>PORT</replaceable></option></arg>

65

</group>

66

<sbr/>

67

67

<group>

68

<arg choice="plain"><option>--interface

69

<replaceable>NAME</replaceable><arg rep='repeat'

70

>,<replaceable>NAME</replaceable></arg></option></arg>

71

<arg choice="plain"><option>-i <replaceable>NAME</replaceable

72

><arg rep='repeat'>,<replaceable>NAME</replaceable></arg

73

></option></arg>

69

70

<arg choice="plain"><option>-i

71

74

72

</group>

75

73

<sbr/>

76

74

<group>

139

137

communicates with <citerefentry><refentrytitle

140

138

>mandos</refentrytitle><manvolnum>8</manvolnum></citerefentry>

141

139

to get a password. In slightly more detail, this client program

142

brings up network interfaces, uses the interfaces’ IPv6

143

link-local addresses to get network connectivity, uses Zeroconf

144

to find servers on the local network, and communicates with

145

servers using TLS with an OpenPGP key to ensure authenticity and

140

brings up a network interface, uses the interface’s IPv6

141

link-local address to get network connectivity, uses Zeroconf to

142

find servers on the local network, and communicates with servers

143

using TLS with an OpenPGP key to ensure authenticity and

146

144

confidentiality. This client program keeps running, trying all

147

145

servers on the network, until it receives a satisfactory reply

148

146

or a TERM signal. After all servers have been tried, all

150

148

will wait indefinitely for new servers to appear.

151

149

</para>

152

150

<para>

153

The network interfaces are selected like this: If any interfaces

154

are specified using the <option>--interface</option> option,

155

those interface are used. Otherwise,

156

<command>&COMMANDNAME;</command> will use all interfaces that

157

are not loopback interfaces, are not point-to-point interfaces,

158

are capable of broadcasting and do not have the NOARP flag (see

151

The network interface is selected like this: If an interface is

152

specified using the <option>--interface</option> option, that

153

interface is used. Otherwise, <command>&COMMANDNAME;</command>

154

will choose any interface that is up and running and is not a

155

loopback interface, is not a point-to-point interface, is

156

capable of broadcasting and does not have the NOARP flag (see

159

157

<citerefentry><refentrytitle>netdevice</refentrytitle>

160

158

<manvolnum>7</manvolnum></citerefentry>). (If the

161

159

<option>--connect</option> option is used, point-to-point

162

interfaces and non-broadcast interfaces are accepted.) If any

163

used interfaces are not up and running, they are first taken up

164

(and later taken down again on program exit).

160

interfaces and non-broadcast interfaces are accepted.) If no

161

acceptable interfaces are found, re-run the check but without

162

the <quote>up and running</quote> requirement, and manually take

163

the selected interface up (and later take it down on program

164

exit).

165

</para>

166

<para>

167

Before network interfaces are selected, all <quote>network

167

Before a network interface is selected, all <quote>network

168

hooks</quote> are run; see <xref linkend="network-hooks"/>.

169

</para>

170

<para>

226

227

228

<term><option>--interface=<replaceable

229

>NAME</replaceable><arg rep='repeat'>,<replaceable

230

>NAME</replaceable></arg></option></term>

229

>NAME</replaceable></option></term>

231

230

<term><option>-i

232

<replaceable>NAME</replaceable><arg rep='repeat'>,<replaceable

233

>NAME</replaceable></arg></option></term>

231

234

232

235

233

<para>

236

Comma separated list of network interfaces that will be

237

brought up and scanned for Mandos servers to connect to.

238

The default is the empty string, which will automatically

239

use all appropriate interfaces.

234

Network interface that will be brought up and scanned for

235

Mandos servers to connect to. The default is the empty

236

string, which will automatically choose an appropriate

237

interface.

240

238

</para>

241

239

<para>

242

If the <option>--connect</option> option is used, and

243

exactly one interface name is specified (except

244

<quote><literal>none</literal></quote>), this specifies

245

the interface to use to connect to the address given.

240

If the <option>--connect</option> option is used, this

241

specifies the interface to use to connect to the address

242

given.

246

243

</para>

247

244

<para>

248

245

Note that since this program will normally run in the

249

246

initial RAM disk environment, the interface must be an

250

247

interface which exists at that stage. Thus, the interface

251

can normally not be a pseudo-interface such as

252

<quote>br0</quote> or <quote>tun0</quote>; such interfaces

253

will not exist until much later in the boot process, and

254

can not be used by this program, unless created by a

255

<quote>network hook</quote> — see <xref

256

linkend="network-hooks"/>.

248

can not be a pseudo-interface such as <quote>br0</quote>

249

or <quote>tun0</quote>; such interfaces will not exist

250

until much later in the boot process, and can not be used

251

by this program, unless created by a <quote>network

252

hook</quote> — see <xref linkend="network-hooks"/>.

257

253

</para>

258

254

<para>

259

255

<replaceable>NAME</replaceable> can be the string

260

<quote><literal>none</literal></quote>; this will make

261

<command>&COMMANDNAME;</command> not bring up

262

<emphasis>any</emphasis> interfaces specified

263

<emphasis>after</emphasis> this string. This is not

264

recommended, and only meant for advanced users.

256

<quote><literal>none</literal></quote>; this will not use

257

any specific interface, and will not bring up an interface

258

on startup. This is not recommended, and only meant for

259

advanced users.

265

260

</para>

266

261

</listitem>

267

262

</varlistentry>

319

314

>SECONDS</replaceable></option></term>

320

315

321

316

<para>

322

After bringing a network interface up, the program waits

317

After bringing the network interface up, the program waits

323

318

for the interface to arrive in a <quote>running</quote>

324

319

state before proceeding. During this time, the kernel log

325

320

level will be lowered to reduce clutter on the system

512

507

It is not necessary to print any non-executable files

513

508

already in the network hook directory, these will be

514

509

copied implicitly if they otherwise satisfy the name

515

requirements.

510

requirement.

516

511

</para>

517

512

</listitem>

518

513

</varlistentry>

552

547

<term><envar>DEVICE</envar></term>

553

548

554

549

<para>

555

The network interfaces, as specified to

550

The network interface, as specified to

556

551

<command>&COMMANDNAME;</command> by the

557

<option>--interface</option> option, combined to one

558

string and separated by commas. If this is set, and

559

does not contain the interface a hook will bring up,

560

there is no reason for a hook to continue.

552

<option>--interface</option> option. If this is not the

553

interface a hook will bring up, there is no reason for a

554

hook to continue.

561

555

</para>

562

556

</listitem>

563

557

</varlistentry>

667

661

668

662

<para>

669

663

Normal invocation needs no options, if the network interface

670

can be automatically determined:

664

is <quote>eth0</quote>:

671

665

</para>

672

666

<para>

673

667

<userinput>&COMMANDNAME;</userinput>

846

840

<para>

847

841

This client uses IPv6 link-local addresses, which are

848

842

immediately usable since a link-local addresses is

849

automatically assigned to a network interface when it

843

automatically assigned to a network interfaces when it

850

844

is brought up.

851

845

</para>

852

846

</listitem>