To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.xml
- browse files at revision 597
- compare with another revision
- download diff
- download tarball
- view history from revision 597
- Committer: Teddy Hogeborn
- Date: 2012-06-14 17:03:12 UTC
- Revision ID: teddy@recompile.se-20120614170312-pl62gn832v09z4bi
* plugins.d/mandos-client.c: Don't use assert(). Use in_port_t for
port numbers everywhere except the
"resolve_callback" function; its
signature is forced by the signature of
the avahi_s_service_resolver_new
function.
port numbers everywhere except the
"resolve_callback" function; its
signature is forced by the signature of
the avahi_s_service_resolver_new
function.
- files added:
- DBUS-API
- debian/source
- network-hooks.d
- files removed:
- debian/mandos-client.config
- files modified:
- .bzrignore
added
removed
plugins.d/mandos-client.xml
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY COMMANDNAME "mandos-client">
5
<!ENTITY TIMESTAMP "2009-01-04">
5
<!ENTITY TIMESTAMP "2012-06-13">
6
6
<!ENTITY % common SYSTEM "../common.ent">
7
7
%common;
8
8
]>
19
19
<firstname>Björn</firstname>
20
20
<surname>Påhlsson</surname>
21
21
<address>
22
<email>belorn@fukt.bsnet.se</email>
22
<email>belorn@recompile.se</email>
23
23
</address>
24
24
</author>
25
25
<author>
26
26
<firstname>Teddy</firstname>
27
27
<surname>Hogeborn</surname>
28
28
<address>
29
<email>teddy@fukt.bsnet.se</email>
29
<email>teddy@recompile.se</email>
30
30
</address>
31
31
</author>
32
32
</authorgroup>
33
33
<copyright>
34
34
<year>2008</year>
35
35
<year>2009</year>
36
<year>2012</year>
36
37
<holder>Teddy Hogeborn</holder>
37
38
<holder>Björn Påhlsson</holder>
38
39
</copyright>
63
64
><replaceable>PORT</replaceable></option></arg>
64
65
</group>
65
66
<sbr/>
66
<group>
67
<group rep='repeat'>
67
68
<arg choice="plain"><option>--interface
68
<replaceable>NAME</replaceable></option></arg>
69
<arg choice="plain"><option>-i
70
<replaceable>NAME</replaceable></option></arg>
69
<replaceable>NAME</replaceable><arg rep='repeat'
70
>,<replaceable>NAME</replaceable></arg></option></arg>
71
<arg choice="plain"><option>-i <replaceable>NAME</replaceable
72
><arg rep='repeat'>,<replaceable>NAME</replaceable></arg
73
></option></arg>
71
74
</group>
72
75
<sbr/>
73
76
<group>
93
96
</arg>
94
97
<sbr/>
95
98
<arg>
99
<option>--delay <replaceable>SECONDS</replaceable></option>
100
</arg>
101
<sbr/>
102
<arg>
103
<option>--retry <replaceable>SECONDS</replaceable></option>
104
</arg>
105
<sbr/>
106
<arg>
107
<option>--network-hook-dir
108
<replaceable>DIR</replaceable></option>
109
</arg>
110
<sbr/>
111
<arg>
96
112
<option>--debug</option>
97
113
</arg>
98
114
</cmdsynopsis>
122
138
<command>&COMMANDNAME;</command> is a client program that
123
139
communicates with <citerefentry><refentrytitle
124
140
>mandos</refentrytitle><manvolnum>8</manvolnum></citerefentry>
125
to get a password. It uses IPv6 link-local addresses to get
126
network connectivity, Zeroconf to find servers, and TLS with an
127
OpenPGP key to ensure authenticity and confidentiality. It
128
keeps running, trying all servers on the network, until it
129
receives a satisfactory reply or a TERM signal is received.
141
to get a password. In slightly more detail, this client program
142
brings up network interfaces, uses the interfaces’ IPv6
143
link-local addresses to get network connectivity, uses Zeroconf
144
to find servers on the local network, and communicates with
145
servers using TLS with an OpenPGP key to ensure authenticity and
146
confidentiality. This client program keeps running, trying all
147
servers on the network, until it receives a satisfactory reply
148
or a TERM signal. After all servers have been tried, all
149
servers are periodically retried. If no servers are found it
150
will wait indefinitely for new servers to appear.
151
</para>
152
<para>
153
The network interfaces are selected like this: If any interfaces
154
are specified using the <option>--interface</option> option,
155
those interface are used. Otherwise,
156
<command>&COMMANDNAME;</command> will use all interfaces that
157
are not loopback interfaces, are not point-to-point interfaces,
158
are capable of broadcasting and do not have the NOARP flag (see
159
<citerefentry><refentrytitle>netdevice</refentrytitle>
160
<manvolnum>7</manvolnum></citerefentry>). (If the
161
<option>--connect</option> option is used, point-to-point
162
interfaces and non-broadcast interfaces are accepted.) If any
163
used interfaces are not up and running, they are first taken up
164
(and later taken down again on program exit).
165
</para>
166
<para>
167
Before network interfaces are selected, all <quote>network
168
hooks</quote> are run; see <xref linkend="network-hooks"/>.
130
169
</para>
131
170
<para>
132
171
This program is not meant to be run directly; it is really meant
186
225
</varlistentry>
187
226
188
227
<varlistentry>
189
<term><option>--interface=
190
<replaceable>NAME</replaceable></option></term>
228
<term><option>--interface=<replaceable
229
>NAME</replaceable></option></term>
191
230
<term><option>-i
192
231
<replaceable>NAME</replaceable></option></term>
193
232
<listitem>
194
233
<para>
195
Network interface that will be brought up and scanned for
196
Mandos servers to connect to. The default it
197
<quote><literal>eth0</literal></quote>.
234
Comma separated list of network interfaces that will be
235
brought up and scanned for Mandos servers to connect to.
236
The default is the empty string, which will automatically
237
use all appropriate interfaces.
198
238
</para>
199
239
<para>
200
240
If the <option>--connect</option> option is used, this
201
241
specifies the interface to use to connect to the address
202
242
given.
203
243
</para>
244
<para>
245
Note that since this program will normally run in the
246
initial RAM disk environment, the interface must be an
247
interface which exists at that stage. Thus, the interface
248
can normally not be a pseudo-interface such as
249
<quote>br0</quote> or <quote>tun0</quote>; such interfaces
250
will not exist until much later in the boot process, and
251
can not be used by this program, unless created by a
252
<quote>network hook</quote> — see <xref
253
linkend="network-hooks"/>.
254
</para>
255
<para>
256
<replaceable>NAME</replaceable> can be the string
257
<quote><literal>none</literal></quote>; this will not use
258
any specific interface, and will not bring up an interface
259
on startup. This is not recommended, and only meant for
260
advanced users.
261
</para>
204
262
</listitem>
205
263
</varlistentry>
206
264
251
309
</para>
252
310
</listitem>
253
311
</varlistentry>
312
313
<varlistentry>
314
<term><option>--delay=<replaceable
315
>SECONDS</replaceable></option></term>
316
<listitem>
317
<para>
318
After bringing a network interface up, the program waits
319
for the interface to arrive in a <quote>running</quote>
320
state before proceeding. During this time, the kernel log
321
level will be lowered to reduce clutter on the system
322
console, alleviating any other plugins which might be
323
using the system console. This option sets the upper
324
limit of seconds to wait. The default is 2.5 seconds.
325
</para>
326
</listitem>
327
</varlistentry>
328
329
<varlistentry>
330
<term><option>--retry=<replaceable
331
>SECONDS</replaceable></option></term>
332
<listitem>
333
<para>
334
All Mandos servers are tried repeatedly until a password
335
is received. This value specifies, in seconds, how long
336
between each successive try <emphasis>for the same
337
server</emphasis>. The default is 10 seconds.
338
</para>
339
</listitem>
340
</varlistentry>
341
342
<varlistentry>
343
<term><option>--network-hook-dir=<replaceable
344
>DIR</replaceable></option></term>
345
<listitem>
346
<para>
347
Network hook directory. The default directory is
348
<quote><filename class="directory"
349
>/lib/mandos/network-hooks.d</filename></quote>.
350
</para>
351
</listitem>
352
</varlistentry>
254
353
255
354
<varlistentry>
256
355
<term><option>--debug</option></term>
317
416
<refentrytitle>plugin-runner</refentrytitle>
318
417
<manvolnum>8mandos</manvolnum></citerefentry>) is used to run
319
418
both this program and others in in parallel,
320
<emphasis>one</emphasis> of which will prompt for passwords on
321
the system console.
419
<emphasis>one</emphasis> of which (<citerefentry>
420
<refentrytitle>password-prompt</refentrytitle>
421
<manvolnum>8mandos</manvolnum></citerefentry>) will prompt for
422
passwords on the system console.
322
423
</para>
323
424
</refsect1>
324
425
329
430
server could be found and the password received from it could be
330
431
successfully decrypted and output on standard output. The
331
432
program will exit with a non-zero exit status only if a critical
332
error occurs. Otherwise, it will forever connect to new
333
<application>Mandos</application> servers as they appear, trying
334
to get a decryptable password and print it.
433
error occurs. Otherwise, it will forever connect to any
434
discovered <application>Mandos</application> servers, trying to
435
get a decryptable password and print it.
335
436
</para>
336
437
</refsect1>
337
438
345
446
</para>
346
447
</refsect1>
347
448
449
<refsect1 id="network-hooks">
450
<title>NETWORK HOOKS</title>
451
<para>
452
If a network interface like a bridge or tunnel is required to
453
find a Mandos server, this requires the interface to be up and
454
running before <command>&COMMANDNAME;</command> starts looking
455
for Mandos servers. This can be accomplished by creating a
456
<quote>network hook</quote> program, and placing it in a special
457
directory.
458
</para>
459
<para>
460
Before the network is used (and again before program exit), any
461
runnable programs found in the network hook directory are run
462
with the argument <quote><literal>start</literal></quote> or
463
<quote><literal>stop</literal></quote>. This should bring up or
464
down, respectively, any network interface which
465
<command>&COMMANDNAME;</command> should use.
466
</para>
467
<refsect2 id="hook-requirements">
468
<title>REQUIREMENTS</title>
469
<para>
470
A network hook must be an executable file, and its name must
471
consist entirely of upper and lower case letters, digits,
472
underscores, periods, and hyphens.
473
</para>
474
<para>
475
A network hook will receive one argument, which can be one of
476
the following:
477
</para>
478
<variablelist>
479
<varlistentry>
480
<term><literal>start</literal></term>
481
<listitem>
482
<para>
483
This should make the network hook create (if necessary)
484
and bring up a network interface.
485
</para>
486
</listitem>
487
</varlistentry>
488
<varlistentry>
489
<term><literal>stop</literal></term>
490
<listitem>
491
<para>
492
This should make the network hook take down a network
493
interface, and delete it if it did not exist previously.
494
</para>
495
</listitem>
496
</varlistentry>
497
<varlistentry>
498
<term><literal>files</literal></term>
499
<listitem>
500
<para>
501
This should make the network hook print, <emphasis>one
502
file per line</emphasis>, all the files needed for it to
503
run. (These files will be copied into the initial RAM
504
filesystem.) Typical use is for a network hook which is
505
a shell script to print its needed binaries.
506
</para>
507
<para>
508
It is not necessary to print any non-executable files
509
already in the network hook directory, these will be
510
copied implicitly if they otherwise satisfy the name
511
requirement.
512
</para>
513
</listitem>
514
</varlistentry>
515
<varlistentry>
516
<term><literal>modules</literal></term>
517
<listitem>
518
<para>
519
This should make the network hook print, <emphasis>on
520
separate lines</emphasis>, all the kernel modules needed
521
for it to run. (These modules will be copied into the
522
initial RAM filesystem.) For instance, a tunnel
523
interface needs the
524
<quote><literal>tun</literal></quote> module.
525
</para>
526
</listitem>
527
</varlistentry>
528
</variablelist>
529
<para>
530
The network hook will be provided with a number of environment
531
variables:
532
</para>
533
<variablelist>
534
<varlistentry>
535
<term><envar>MANDOSNETHOOKDIR</envar></term>
536
<listitem>
537
<para>
538
The network hook directory, specified to
539
<command>&COMMANDNAME;</command> by the
540
<option>--network-hook-dir</option> option. Note: this
541
should <emphasis>always</emphasis> be used by the
542
network hook to refer to itself or any files in the hook
543
directory it may require.
544
</para>
545
</listitem>
546
</varlistentry>
547
<varlistentry>
548
<term><envar>DEVICE</envar></term>
549
<listitem>
550
<para>
551
The network interfaces, as specified to
552
<command>&COMMANDNAME;</command> by the
553
<option>--interface</option> option, combined to one
554
string and separated by commas. If this is set, and
555
does not contain the interface a hook will bring up,
556
there is no reason for a hook to continue.
557
</para>
558
</listitem>
559
</varlistentry>
560
<varlistentry>
561
<term><envar>MODE</envar></term>
562
<listitem>
563
<para>
564
This will be the same as the first argument;
565
i.e. <quote><literal>start</literal></quote>,
566
<quote><literal>stop</literal></quote>,
567
<quote><literal>files</literal></quote>, or
568
<quote><literal>modules</literal></quote>.
569
</para>
570
</listitem>
571
</varlistentry>
572
<varlistentry>
573
<term><envar>VERBOSITY</envar></term>
574
<listitem>
575
<para>
576
This will be the <quote><literal>1</literal></quote> if
577
the <option>--debug</option> option is passed to
578
<command>&COMMANDNAME;</command>, otherwise
579
<quote><literal>0</literal></quote>.
580
</para>
581
</listitem>
582
</varlistentry>
583
<varlistentry>
584
<term><envar>DELAY</envar></term>
585
<listitem>
586
<para>
587
This will be the same as the <option>--delay</option>
588
option passed to <command>&COMMANDNAME;</command>. Is
589
only set if <envar>MODE</envar> is
590
<quote><literal>start</literal></quote> or
591
<quote><literal>stop</literal></quote>.
592
</para>
593
</listitem>
594
</varlistentry>
595
<varlistentry>
596
<term><envar>CONNECT</envar></term>
597
<listitem>
598
<para>
599
This will be the same as the <option>--connect</option>
600
option passed to <command>&COMMANDNAME;</command>. Is
601
only set if <option>--connect</option> is passed and
602
<envar>MODE</envar> is
603
<quote><literal>start</literal></quote> or
604
<quote><literal>stop</literal></quote>.
605
</para>
606
</listitem>
607
</varlistentry>
608
</variablelist>
609
<para>
610
A hook may not read from standard input, and should be
611
restrictive in printing to standard output or standard error
612
unless <varname>VERBOSITY</varname> is
613
<quote><literal>1</literal></quote>.
614
</para>
615
</refsect2>
616
</refsect1>
617
348
618
<refsect1 id="files">
349
619
<title>FILES</title>
350
620
<variablelist>
362
632
</para>
363
633
</listitem>
364
634
</varlistentry>
635
<varlistentry>
636
<term><filename
637
class="directory">/lib/mandos/network-hooks.d</filename></term>
638
<listitem>
639
<para>
640
Directory where network hooks are located. Change this
641
with the <option>--network-hook-dir</option> option. See
642
<xref linkend="network-hooks"/>.
643
</para>
644
</listitem>
645
</varlistentry>
365
646
</variablelist>
366
647
</refsect1>
367
648
382
663
<informalexample>
383
664
<para>
384
665
Normal invocation needs no options, if the network interface
385
is <quote>eth0</quote>:
666
can be automatically determined:
386
667
</para>
387
668
<para>
388
669
<userinput>&COMMANDNAME;</userinput>
412
693
<informalexample>
413
694
<para>
414
695
Run in debug mode, with a custom key, and do not use Zeroconf
415
to locate a server; connect directly to the IPv6 address
416
<quote><systemitem class="ipaddress"
417
>2001:db8:f983:bd0b:30de:ae4a:71f2:f672</systemitem></quote>,
418
port 4711, using interface eth2:
696
to locate a server; connect directly to the IPv6 link-local
697
address <quote><systemitem class="ipaddress"
698
>fe80::aede:48ff:fe71:f6f2</systemitem></quote>, port 4711,
699
using interface eth2:
419
700
</para>
420
701
<para>
421
702
422
703
<!-- do not wrap this line -->
423
<userinput>&COMMANDNAME; --debug --pubkey keydir/pubkey.txt --seckey keydir/seckey.txt --connect 2001:db8:f983:bd0b:30de:ae4a:71f2:f672:4711 --interface eth2</userinput>
704
<userinput>&COMMANDNAME; --debug --pubkey keydir/pubkey.txt --seckey keydir/seckey.txt --connect fe80::aede:48ff:fe71:f6f2:4711 --interface eth2</userinput>
424
705
425
706
</para>
426
707
</informalexample>
476
757
<refsect1 id="see_also">
477
758
<title>SEE ALSO</title>
478
759
<para>
760
<citerefentry><refentrytitle>intro</refentrytitle>
761
<manvolnum>8mandos</manvolnum></citerefentry>,
479
762
<citerefentry><refentrytitle>cryptsetup</refentrytitle>
480
763
<manvolnum>8</manvolnum></citerefentry>,
481
764
<citerefentry><refentrytitle>crypttab</refentrytitle>
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0