/mandos/trunk : revision 610

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to plugins.d/mandos-client.xml

Committer: Teddy Hogeborn
Date: 2012-06-23 13:50:05 UTC
Revision ID: teddy@recompile.se-20120623135005-t0wtkmlw0ymnr2kg

* mandos (Client.start_checker): Return True (retry later) if starting
checker failed. Check for ECHILD
from waitpid().

Show diffs side-by-side

added added

removed removed

plugins.d/mandos-client.xml

<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

<!ENTITY COMMANDNAME "mandos-client">

<!ENTITY TIMESTAMP "2012-01-01">

<!ENTITY TIMESTAMP "2012-06-17">

<!ENTITY % common SYSTEM "../common.ent">

%common;

><replaceable>PORT</replaceable></option></arg>

</group>

<sbr/>

<group>

<arg choice="plain"><option>--interface

<arg choice="plain"><option>-i

<replaceable>NAME</replaceable><arg rep='repeat'

>,<replaceable>NAME</replaceable></arg></option></arg>

<arg choice="plain"><option>-i <replaceable>NAME</replaceable

><arg rep='repeat'>,<replaceable>NAME</replaceable></arg

></option></arg>

</group>

<sbr/>

<group>

137

139

communicates with <citerefentry><refentrytitle

138

140

>mandos</refentrytitle><manvolnum>8</manvolnum></citerefentry>

139

141

to get a password. In slightly more detail, this client program

140

brings up a network interface, uses the interface’s IPv6

141

link-local address to get network connectivity, uses Zeroconf to

142

find servers on the local network, and communicates with servers

143

using TLS with an OpenPGP key to ensure authenticity and

142

brings up network interfaces, uses the interfaces’ IPv6

143

link-local addresses to get network connectivity, uses Zeroconf

144

to find servers on the local network, and communicates with

145

servers using TLS with an OpenPGP key to ensure authenticity and

144

146

confidentiality. This client program keeps running, trying all

145

147

servers on the network, until it receives a satisfactory reply

146

148

or a TERM signal. After all servers have been tried, all

148

150

will wait indefinitely for new servers to appear.

149

151

</para>

150

152

<para>

151

The network interface is selected like this: If an interface is

152

specified using the <option>--interface</option> option, that

153

interface is used. Otherwise, <command>&COMMANDNAME;</command>

154

will choose any interface that is up and running and is not a

155

loopback interface, is not a point-to-point interface, is

156

capable of broadcasting and does not have the NOARP flag (see

153

The network interfaces are selected like this: If any interfaces

154

are specified using the <option>--interface</option> option,

155

those interface are used. Otherwise,

156

<command>&COMMANDNAME;</command> will use all interfaces that

157

are not loopback interfaces, are not point-to-point interfaces,

158

are capable of broadcasting and do not have the NOARP flag (see

157

159

<citerefentry><refentrytitle>netdevice</refentrytitle>

158

160

<manvolnum>7</manvolnum></citerefentry>). (If the

159

161

<option>--connect</option> option is used, point-to-point

160

interfaces and non-broadcast interfaces are accepted.) If no

161

acceptable interfaces are found, re-run the check but without

162

the <quote>up and running</quote> requirement, and manually take

163

the selected interface up (and later take it down on program

164

exit).

162

interfaces and non-broadcast interfaces are accepted.) If any

163

used interfaces are not up and running, they are first taken up

164

(and later taken down again on program exit).

165

</para>

166

<para>

167

Before a network interface is selected, all <quote>network

167

Before network interfaces are selected, all <quote>network

168

hooks</quote> are run; see <xref linkend="network-hooks"/>.

169

</para>

170

<para>

226

227

228

<term><option>--interface=<replaceable

229

>NAME</replaceable></option></term>

229

>NAME</replaceable><arg rep='repeat'>,<replaceable

230

>NAME</replaceable></arg></option></term>

230

231

<term><option>-i

231

232

<replaceable>NAME</replaceable><arg rep='repeat'>,<replaceable

233

>NAME</replaceable></arg></option></term>

232

234

233

235

<para>

234

Network interface that will be brought up and scanned for

235

Mandos servers to connect to. The default is the empty

236

string, which will automatically choose an appropriate

237

interface.

236

Comma separated list of network interfaces that will be

237

brought up and scanned for Mandos servers to connect to.

238

The default is the empty string, which will automatically

239

use all appropriate interfaces.

238

240

</para>

239

241

<para>

240

If the <option>--connect</option> option is used, this

241

specifies the interface to use to connect to the address

242

given.

242

If the <option>--connect</option> option is used, and

243

exactly one interface name is specified (except

244

<quote><literal>none</literal></quote>), this specifies

245

the interface to use to connect to the address given.

243

246

</para>

244

247

<para>

245

248

Note that since this program will normally run in the

246

249

initial RAM disk environment, the interface must be an

247

250

interface which exists at that stage. Thus, the interface

248

can not be a pseudo-interface such as <quote>br0</quote>

249

or <quote>tun0</quote>; such interfaces will not exist

250

until much later in the boot process, and can not be used

251

by this program, unless created by a <quote>network

252

hook</quote> — see <xref linkend="network-hooks"/>.

251

can normally not be a pseudo-interface such as

252

<quote>br0</quote> or <quote>tun0</quote>; such interfaces

253

will not exist until much later in the boot process, and

254

can not be used by this program, unless created by a

255

<quote>network hook</quote> — see <xref

256

linkend="network-hooks"/>.

253

257

</para>

254

258

<para>

255

259

<replaceable>NAME</replaceable> can be the string

256

<quote><literal>none</literal></quote>; this will not use

257

any specific interface, and will not bring up an interface

258

on startup. This is not recommended, and only meant for

259

advanced users.

260

<quote><literal>none</literal></quote>; this will make

261

<command>&COMMANDNAME;</command> not bring up

262

<emphasis>any</emphasis> interfaces specified

263

<emphasis>after</emphasis> this string. This is not

264

recommended, and only meant for advanced users.

260

265

</para>

261

266

</listitem>

262

267

</varlistentry>

314

319

>SECONDS</replaceable></option></term>

315

320

316

321

<para>

317

After bringing the network interface up, the program waits

322

After bringing a network interface up, the program waits

318

323

for the interface to arrive in a <quote>running</quote>

319

324

state before proceeding. During this time, the kernel log

320

325

level will be lowered to reduce clutter on the system

547

552

<term><envar>DEVICE</envar></term>

548

553

549

554

<para>

550

The network interface, as specified to

555

The network interfaces, as specified to

551

556

<command>&COMMANDNAME;</command> by the

552

<option>--interface</option> option. If this is not the

553

interface a hook will bring up, there is no reason for a

554

hook to continue.

557

<option>--interface</option> option, combined to one

558

string and separated by commas. If this is set, and

559

does not contain the interface a hook will bring up,

560

there is no reason for a hook to continue.

555

561

</para>

556

562

</listitem>

557

563

</varlistentry>

661

667

662

668

<para>

663

669

Normal invocation needs no options, if the network interface

664

is <quote>eth0</quote>:

670

can be automatically determined:

665

671

</para>

666

672

<para>

667

673

<userinput>&COMMANDNAME;</userinput>

Older »