131
140
communicates with <citerefentry><refentrytitle
132
141
>mandos</refentrytitle><manvolnum>8</manvolnum></citerefentry>
133
142
to get a password. In slightly more detail, this client program
134
brings up a network interface, uses the interface’s IPv6
135
link-local address to get network connectivity, uses Zeroconf to
136
find servers on the local network, and communicates with servers
137
using TLS with an OpenPGP key to ensure authenticity and
143
brings up network interfaces, uses the interfaces’ IPv6
144
link-local addresses to get network connectivity, uses Zeroconf
145
to find servers on the local network, and communicates with
146
servers using TLS with an OpenPGP key to ensure authenticity and
138
147
confidentiality. This client program keeps running, trying all
139
148
servers on the network, until it receives a satisfactory reply
140
149
or a TERM signal. After all servers have been tried, all
142
151
will wait indefinitely for new servers to appear.
154
The network interfaces are selected like this: If any interfaces
155
are specified using the <option>--interface</option> option,
156
those interface are used. Otherwise,
157
<command>&COMMANDNAME;</command> will use all interfaces that
158
are not loopback interfaces, are not point-to-point interfaces,
159
are capable of broadcasting and do not have the NOARP flag (see
160
<citerefentry><refentrytitle>netdevice</refentrytitle>
161
<manvolnum>7</manvolnum></citerefentry>). (If the
162
<option>--connect</option> option is used, point-to-point
163
interfaces and non-broadcast interfaces are accepted.) If any
164
used interfaces are not up and running, they are first taken up
165
(and later taken down again on program exit).
168
Before network interfaces are selected, all <quote>network
169
hooks</quote> are run; see <xref linkend="network-hooks"/>.
145
172
This program is not meant to be run directly; it is really meant
146
173
to run as a plugin of the <application>Mandos</application>
147
174
<citerefentry><refentrytitle>plugin-runner</refentrytitle>
202
229
<term><option>--interface=<replaceable
203
>NAME</replaceable></option></term>
230
>NAME</replaceable><arg rep='repeat'>,<replaceable
231
>NAME</replaceable></arg></option></term>
205
<replaceable>NAME</replaceable></option></term>
233
<replaceable>NAME</replaceable><arg rep='repeat'>,<replaceable
234
>NAME</replaceable></arg></option></term>
208
Network interface that will be brought up and scanned for
209
Mandos servers to connect to. The default is the empty
210
string, which will automatically choose an appropriate
237
Comma separated list of network interfaces that will be
238
brought up and scanned for Mandos servers to connect to.
239
The default is the empty string, which will automatically
240
use all appropriate interfaces.
214
If the <option>--connect</option> option is used, this
215
specifies the interface to use to connect to the address
243
If the <option>--connect</option> option is used, and
244
exactly one interface name is specified (except
245
<quote><literal>none</literal></quote>), this specifies
246
the interface to use to connect to the address given.
219
249
Note that since this program will normally run in the
220
250
initial RAM disk environment, the interface must be an
221
251
interface which exists at that stage. Thus, the interface
222
can not be a pseudo-interface such as <quote>br0</quote>
223
or <quote>tun0</quote>; such interfaces will not exist
224
until much later in the boot process, and can not be used
252
can normally not be a pseudo-interface such as
253
<quote>br0</quote> or <quote>tun0</quote>; such interfaces
254
will not exist until much later in the boot process, and
255
can not be used by this program, unless created by a
256
<quote>network hook</quote> — see <xref
257
linkend="network-hooks"/>.
228
260
<replaceable>NAME</replaceable> can be the string
229
<quote><literal>none</literal></quote>; this will not use
230
any specific interface, and will not bring up an interface
231
on startup. This is not recommended, and only meant for
261
<quote><literal>none</literal></quote>; this will make
262
<command>&COMMANDNAME;</command> not bring up
263
<emphasis>any</emphasis> interfaces specified
264
<emphasis>after</emphasis> this string. This is not
265
recommended, and only meant for advanced users.
454
<refsect1 id="network-hooks">
455
<title>NETWORK HOOKS</title>
457
If a network interface like a bridge or tunnel is required to
458
find a Mandos server, this requires the interface to be up and
459
running before <command>&COMMANDNAME;</command> starts looking
460
for Mandos servers. This can be accomplished by creating a
461
<quote>network hook</quote> program, and placing it in a special
465
Before the network is used (and again before program exit), any
466
runnable programs found in the network hook directory are run
467
with the argument <quote><literal>start</literal></quote> or
468
<quote><literal>stop</literal></quote>. This should bring up or
469
down, respectively, any network interface which
470
<command>&COMMANDNAME;</command> should use.
472
<refsect2 id="hook-requirements">
473
<title>REQUIREMENTS</title>
475
A network hook must be an executable file, and its name must
476
consist entirely of upper and lower case letters, digits,
477
underscores, periods, and hyphens.
480
A network hook will receive one argument, which can be one of
485
<term><literal>start</literal></term>
488
This should make the network hook create (if necessary)
489
and bring up a network interface.
494
<term><literal>stop</literal></term>
497
This should make the network hook take down a network
498
interface, and delete it if it did not exist previously.
503
<term><literal>files</literal></term>
506
This should make the network hook print, <emphasis>one
507
file per line</emphasis>, all the files needed for it to
508
run. (These files will be copied into the initial RAM
509
filesystem.) Typical use is for a network hook which is
510
a shell script to print its needed binaries.
513
It is not necessary to print any non-executable files
514
already in the network hook directory, these will be
515
copied implicitly if they otherwise satisfy the name
521
<term><literal>modules</literal></term>
524
This should make the network hook print, <emphasis>on
525
separate lines</emphasis>, all the kernel modules needed
526
for it to run. (These modules will be copied into the
527
initial RAM filesystem.) For instance, a tunnel
529
<quote><literal>tun</literal></quote> module.
535
The network hook will be provided with a number of environment
540
<term><envar>MANDOSNETHOOKDIR</envar></term>
543
The network hook directory, specified to
544
<command>&COMMANDNAME;</command> by the
545
<option>--network-hook-dir</option> option. Note: this
546
should <emphasis>always</emphasis> be used by the
547
network hook to refer to itself or any files in the hook
548
directory it may require.
553
<term><envar>DEVICE</envar></term>
556
The network interfaces, as specified to
557
<command>&COMMANDNAME;</command> by the
558
<option>--interface</option> option, combined to one
559
string and separated by commas. If this is set, and
560
does not contain the interface a hook will bring up,
561
there is no reason for a hook to continue.
566
<term><envar>MODE</envar></term>
569
This will be the same as the first argument;
570
i.e. <quote><literal>start</literal></quote>,
571
<quote><literal>stop</literal></quote>,
572
<quote><literal>files</literal></quote>, or
573
<quote><literal>modules</literal></quote>.
578
<term><envar>VERBOSITY</envar></term>
581
This will be the <quote><literal>1</literal></quote> if
582
the <option>--debug</option> option is passed to
583
<command>&COMMANDNAME;</command>, otherwise
584
<quote><literal>0</literal></quote>.
589
<term><envar>DELAY</envar></term>
592
This will be the same as the <option>--delay</option>
593
option passed to <command>&COMMANDNAME;</command>. Is
594
only set if <envar>MODE</envar> is
595
<quote><literal>start</literal></quote> or
596
<quote><literal>stop</literal></quote>.
601
<term><envar>CONNECT</envar></term>
604
This will be the same as the <option>--connect</option>
605
option passed to <command>&COMMANDNAME;</command>. Is
606
only set if <option>--connect</option> is passed and
607
<envar>MODE</envar> is
608
<quote><literal>start</literal></quote> or
609
<quote><literal>stop</literal></quote>.
615
A hook may not read from standard input, and should be
616
restrictive in printing to standard output or standard error
617
unless <varname>VERBOSITY</varname> is
618
<quote><literal>1</literal></quote>.
407
623
<refsect1 id="files">
408
624
<title>FILES</title>