122
140
<command>&COMMANDNAME;</command> is a client program that
123
141
communicates with <citerefentry><refentrytitle
124
142
>mandos</refentrytitle><manvolnum>8</manvolnum></citerefentry>
125
to get a password. It brings up a network interface, uses its
126
IPv6 link-local address to get network connectivity, uses
127
Zeroconf to find servers, and uses TLS with an OpenPGP key to
128
ensure authenticity and confidentiality. It keeps running,
129
trying all servers on the network, until it receives a
130
satisfactory reply or a TERM signal is received.
143
to get a password. In slightly more detail, this client program
144
brings up network interfaces, uses the interfaces’ IPv6
145
link-local addresses to get network connectivity, uses Zeroconf
146
to find servers on the local network, and communicates with
147
servers using TLS with an OpenPGP key to ensure authenticity and
148
confidentiality. This client program keeps running, trying all
149
servers on the network, until it receives a satisfactory reply
150
or a TERM signal. After all servers have been tried, all
151
servers are periodically retried. If no servers are found it
152
will wait indefinitely for new servers to appear.
155
The network interfaces are selected like this: If any interfaces
156
are specified using the <option>--interface</option> option,
157
those interface are used. Otherwise,
158
<command>&COMMANDNAME;</command> will use all interfaces that
159
are not loopback interfaces, are not point-to-point interfaces,
160
are capable of broadcasting and do not have the NOARP flag (see
161
<citerefentry><refentrytitle>netdevice</refentrytitle>
162
<manvolnum>7</manvolnum></citerefentry>). (If the
163
<option>--connect</option> option is used, point-to-point
164
interfaces and non-broadcast interfaces are accepted.) If any
165
used interfaces are not up and running, they are first taken up
166
(and later taken down again on program exit).
169
Before network interfaces are selected, all <quote>network
170
hooks</quote> are run; see <xref linkend="network-hooks"/>.
133
173
This program is not meant to be run directly; it is really meant
180
220
assumed to separate the address from the port number.
183
This option is normally only useful for testing and
223
Normally, Zeroconf would be used to locate Mandos servers,
224
in which case this option would only be used when testing
190
<term><option>--interface=
191
<replaceable>NAME</replaceable></option></term>
231
<term><option>--interface=<replaceable
232
>NAME</replaceable><arg rep='repeat'>,<replaceable
233
>NAME</replaceable></arg></option></term>
193
<replaceable>NAME</replaceable></option></term>
235
<replaceable>NAME</replaceable><arg rep='repeat'>,<replaceable
236
>NAME</replaceable></arg></option></term>
196
Network interface that will be brought up and scanned for
197
Mandos servers to connect to. The default it
198
<quote><literal>eth0</literal></quote>.
201
If the <option>--connect</option> option is used, this
202
specifies the interface to use to connect to the address
239
Comma separated list of network interfaces that will be
240
brought up and scanned for Mandos servers to connect to.
241
The default is the empty string, which will automatically
242
use all appropriate interfaces.
245
If the <option>--connect</option> option is used, and
246
exactly one interface name is specified (except
247
<quote><literal>none</literal></quote>), this specifies
248
the interface to use to connect to the address given.
251
Note that since this program will normally run in the
252
initial RAM disk environment, the interface must be an
253
interface which exists at that stage. Thus, the interface
254
can normally not be a pseudo-interface such as
255
<quote>br0</quote> or <quote>tun0</quote>; such interfaces
256
will not exist until much later in the boot process, and
257
can not be used by this program, unless created by a
258
<quote>network hook</quote> — see <xref
259
linkend="network-hooks"/>.
262
<replaceable>NAME</replaceable> can be the string
263
<quote><literal>none</literal></quote>; this will make
264
<command>&COMMANDNAME;</command> only bring up interfaces
265
specified <emphasis>before</emphasis> this string. This
266
is not recommended, and only meant for advanced users.
320
<term><option>--delay=<replaceable
321
>SECONDS</replaceable></option></term>
324
After bringing a network interface up, the program waits
325
for the interface to arrive in a <quote>running</quote>
326
state before proceeding. During this time, the kernel log
327
level will be lowered to reduce clutter on the system
328
console, alleviating any other plugins which might be
329
using the system console. This option sets the upper
330
limit of seconds to wait. The default is 2.5 seconds.
336
<term><option>--retry=<replaceable
337
>SECONDS</replaceable></option></term>
340
All Mandos servers are tried repeatedly until a password
341
is received. This value specifies, in seconds, how long
342
between each successive try <emphasis>for the same
343
server</emphasis>. The default is 10 seconds.
349
<term><option>--network-hook-dir=<replaceable
350
>DIR</replaceable></option></term>
353
Network hook directory. The default directory is
354
<quote><filename class="directory"
355
>/lib/mandos/network-hooks.d</filename></quote>.
257
361
<term><option>--debug</option></term>
455
<refsect1 id="network-hooks">
456
<title>NETWORK HOOKS</title>
458
If a network interface like a bridge or tunnel is required to
459
find a Mandos server, this requires the interface to be up and
460
running before <command>&COMMANDNAME;</command> starts looking
461
for Mandos servers. This can be accomplished by creating a
462
<quote>network hook</quote> program, and placing it in a special
466
Before the network is used (and again before program exit), any
467
runnable programs found in the network hook directory are run
468
with the argument <quote><literal>start</literal></quote> or
469
<quote><literal>stop</literal></quote>. This should bring up or
470
down, respectively, any network interface which
471
<command>&COMMANDNAME;</command> should use.
473
<refsect2 id="hook-requirements">
474
<title>REQUIREMENTS</title>
476
A network hook must be an executable file, and its name must
477
consist entirely of upper and lower case letters, digits,
478
underscores, periods, and hyphens.
481
A network hook will receive one argument, which can be one of
486
<term><literal>start</literal></term>
489
This should make the network hook create (if necessary)
490
and bring up a network interface.
495
<term><literal>stop</literal></term>
498
This should make the network hook take down a network
499
interface, and delete it if it did not exist previously.
504
<term><literal>files</literal></term>
507
This should make the network hook print, <emphasis>one
508
file per line</emphasis>, all the files needed for it to
509
run. (These files will be copied into the initial RAM
510
filesystem.) Typical use is for a network hook which is
511
a shell script to print its needed binaries.
514
It is not necessary to print any non-executable files
515
already in the network hook directory, these will be
516
copied implicitly if they otherwise satisfy the name
522
<term><literal>modules</literal></term>
525
This should make the network hook print, <emphasis>on
526
separate lines</emphasis>, all the kernel modules needed
527
for it to run. (These modules will be copied into the
528
initial RAM filesystem.) For instance, a tunnel
530
<quote><literal>tun</literal></quote> module.
536
The network hook will be provided with a number of environment
541
<term><envar>MANDOSNETHOOKDIR</envar></term>
544
The network hook directory, specified to
545
<command>&COMMANDNAME;</command> by the
546
<option>--network-hook-dir</option> option. Note: this
547
should <emphasis>always</emphasis> be used by the
548
network hook to refer to itself or any files in the hook
549
directory it may require.
554
<term><envar>DEVICE</envar></term>
557
The network interfaces, as specified to
558
<command>&COMMANDNAME;</command> by the
559
<option>--interface</option> option, combined to one
560
string and separated by commas. If this is set, and
561
does not contain the interface a hook will bring up,
562
there is no reason for a hook to continue.
567
<term><envar>MODE</envar></term>
570
This will be the same as the first argument;
571
i.e. <quote><literal>start</literal></quote>,
572
<quote><literal>stop</literal></quote>,
573
<quote><literal>files</literal></quote>, or
574
<quote><literal>modules</literal></quote>.
579
<term><envar>VERBOSITY</envar></term>
582
This will be the <quote><literal>1</literal></quote> if
583
the <option>--debug</option> option is passed to
584
<command>&COMMANDNAME;</command>, otherwise
585
<quote><literal>0</literal></quote>.
590
<term><envar>DELAY</envar></term>
593
This will be the same as the <option>--delay</option>
594
option passed to <command>&COMMANDNAME;</command>. Is
595
only set if <envar>MODE</envar> is
596
<quote><literal>start</literal></quote> or
597
<quote><literal>stop</literal></quote>.
602
<term><envar>CONNECT</envar></term>
605
This will be the same as the <option>--connect</option>
606
option passed to <command>&COMMANDNAME;</command>. Is
607
only set if <option>--connect</option> is passed and
608
<envar>MODE</envar> is
609
<quote><literal>start</literal></quote> or
610
<quote><literal>stop</literal></quote>.
616
A hook may not read from standard input, and should be
617
restrictive in printing to standard output or standard error
618
unless <varname>VERBOSITY</varname> is
619
<quote><literal>1</literal></quote>.
349
624
<refsect1 id="files">
350
625
<title>FILES</title>