/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos.conf.xml

  • Committer: Teddy Hogeborn
  • Date: 2015-03-10 18:03:38 UTC
  • Revision ID: teddy@recompile.se-20150310180338-pcxw6r2qmw9k6br9
Add ":!RSA" to GnuTLS priority string, to disallow non-DHE kx.

If Mandos was somehow made to use a non-ephemeral Diffie-Hellman key
exchange algorithm in the TLS handshake, any saved network traffic
could then be decrypted later if the Mandos client key was obtained.
By default, Mandos uses ephemeral DH key exchanges which does not have
this problem, but a non-ephemeral key exchange algorithm was still
enabled by default.  The simplest solution is to simply turn that off,
which ensures that Mandos will always use ephemeral DH key exchanges.

There is a "PFS" priority string specifier, but we can't use it because:

1. Security-wise, it is a mix between "NORMAL" and "SECURE128" - it
   enables a lot more algorithms than "SECURE256".

2. It is only available since GnuTLS 3.2.4.

Thanks to Andreas Fischer <af@bantuX.org> for reporting this issue.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos.conf.xml
1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
 
<!ENTITY VERSION "1.0">
5
4
<!ENTITY CONFNAME "mandos.conf">
6
5
<!ENTITY CONFPATH "<filename>/etc/mandos/mandos.conf</filename>">
7
 
<!ENTITY TIMESTAMP "2008-08-31">
 
6
<!ENTITY TIMESTAMP "2013-10-23">
 
7
<!ENTITY % common SYSTEM "common.ent">
 
8
%common;
8
9
]>
9
10
 
10
11
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
12
13
    <title>Mandos Manual</title>
13
14
    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
14
15
    <productname>Mandos</productname>
15
 
    <productnumber>&VERSION;</productnumber>
 
16
    <productnumber>&version;</productnumber>
16
17
    <date>&TIMESTAMP;</date>
17
18
    <authorgroup>
18
19
      <author>
19
20
        <firstname>Björn</firstname>
20
21
        <surname>Påhlsson</surname>
21
22
        <address>
22
 
          <email>belorn@fukt.bsnet.se</email>
 
23
          <email>belorn@recompile.se</email>
23
24
        </address>
24
25
      </author>
25
26
      <author>
26
27
        <firstname>Teddy</firstname>
27
28
        <surname>Hogeborn</surname>
28
29
        <address>
29
 
          <email>teddy@fukt.bsnet.se</email>
 
30
          <email>teddy@recompile.se</email>
30
31
        </address>
31
32
      </author>
32
33
    </authorgroup>
33
34
    <copyright>
34
35
      <year>2008</year>
 
36
      <year>2009</year>
 
37
      <year>2011</year>
 
38
      <year>2012</year>
 
39
      <year>2013</year>
35
40
      <holder>Teddy Hogeborn</holder>
36
41
      <holder>Björn Påhlsson</holder>
37
42
    </copyright>
38
43
    <xi:include href="legalnotice.xml"/>
39
44
  </refentryinfo>
40
 
 
 
45
  
41
46
  <refmeta>
42
47
    <refentrytitle>&CONFNAME;</refentrytitle>
43
48
    <manvolnum>5</manvolnum>
49
54
      Configuration file for the Mandos server
50
55
    </refpurpose>
51
56
  </refnamediv>
52
 
 
 
57
  
53
58
  <refsynopsisdiv>
54
59
    <synopsis>&CONFPATH;</synopsis>
55
60
  </refsynopsisdiv>
56
 
 
 
61
  
57
62
  <refsect1 id="description">
58
63
    <title>DESCRIPTION</title>
59
64
    <para>
71
76
      <quote>#</quote> or <quote>;</quote> are ignored and may be used
72
77
      to provide comments.
73
78
    </para>
74
 
 
 
79
    
75
80
  </refsect1>
76
81
  <refsect1>
77
82
    <title>OPTIONS</title>
84
89
          <xi:include href="mandos-options.xml" xpointer="interface"/>
85
90
        </listitem>
86
91
      </varlistentry>
87
 
 
 
92
      
88
93
      <varlistentry>
89
94
        <term><option>address<literal> = </literal><replaceable
90
95
          >ADDRESS</replaceable></option></term>
92
97
          <xi:include href="mandos-options.xml" xpointer="address"/>
93
98
        </listitem>
94
99
      </varlistentry>
95
 
 
 
100
      
96
101
      <varlistentry>
97
102
        <term><option>port<literal> = </literal><replaceable
98
103
        >NUMBER</replaceable></option></term>
100
105
          <xi:include href="mandos-options.xml" xpointer="port"/>
101
106
        </listitem>
102
107
      </varlistentry>
103
 
 
 
108
      
104
109
      <varlistentry>
105
110
        <term><option>debug<literal> = </literal>{ <literal
106
111
          >1</literal> | <literal>yes</literal> | <literal
111
116
          <xi:include href="mandos-options.xml" xpointer="debug"/>
112
117
        </listitem>
113
118
      </varlistentry>
114
 
 
 
119
      
115
120
      <varlistentry>
116
121
        <term><option>priority<literal> = </literal><replaceable
117
122
        >STRING</replaceable></option></term>
118
123
        <listitem>
119
 
          <xi:include href="mandos-options.xml" xpointer="priority"/>
 
124
          <xi:include href="mandos-options.xml"
 
125
                      xpointer="priority_compat"/>
120
126
        </listitem>
121
127
      </varlistentry>
122
 
 
 
128
      
123
129
      <varlistentry>
124
130
        <term><option>servicename<literal> = </literal
125
131
        ><replaceable>NAME</replaceable></option></term>
129
135
        </listitem>
130
136
      </varlistentry>
131
137
      
 
138
      <varlistentry>
 
139
        <term><option>use_dbus<literal> = </literal>{ <literal
 
140
          >1</literal> | <literal>yes</literal> | <literal
 
141
          >true</literal> | <literal>on</literal> | <literal
 
142
          >0</literal> | <literal>no</literal> | <literal
 
143
          >false</literal> | <literal>off</literal> }</option></term>
 
144
        <listitem>
 
145
          <xi:include href="mandos-options.xml" xpointer="dbus"/>
 
146
        </listitem>
 
147
      </varlistentry>
 
148
      
 
149
      <varlistentry>
 
150
        <term><option>use_ipv6<literal> = </literal>{ <literal
 
151
          >1</literal> | <literal>yes</literal> | <literal
 
152
          >true</literal> | <literal>on</literal> | <literal
 
153
          >0</literal> | <literal>no</literal> | <literal
 
154
          >false</literal> | <literal>off</literal> }</option></term>
 
155
        <listitem>
 
156
          <xi:include href="mandos-options.xml" xpointer="ipv6"/>
 
157
        </listitem>
 
158
      </varlistentry>
 
159
      
 
160
      <varlistentry>
 
161
        <term><option>restore<literal> = </literal>{ <literal
 
162
          >1</literal> | <literal>yes</literal> | <literal
 
163
          >true</literal> | <literal>on</literal> | <literal
 
164
          >0</literal> | <literal>no</literal> | <literal
 
165
          >false</literal> | <literal>off</literal> }</option></term>
 
166
        <listitem>
 
167
          <xi:include href="mandos-options.xml" xpointer="restore"/>
 
168
        </listitem>
 
169
      </varlistentry>
 
170
      
 
171
      <varlistentry>
 
172
        <term><option>statedir<literal> = </literal><replaceable
 
173
        >DIRECTORY</replaceable></option></term>
 
174
        <listitem>
 
175
          <xi:include href="mandos-options.xml" xpointer="statedir"/>
 
176
        </listitem>
 
177
      </varlistentry>
 
178
      
 
179
      <varlistentry>
 
180
        <term><option>socket<literal> = </literal><replaceable
 
181
        >NUMBER</replaceable></option></term>
 
182
        <listitem>
 
183
          <xi:include href="mandos-options.xml" xpointer="socket"/>
 
184
        </listitem>
 
185
      </varlistentry>
 
186
      
132
187
    </variablelist>
133
188
  </refsect1>
134
189
  
144
199
    <para>
145
200
      The <literal>[DEFAULT]</literal> is necessary because the Python
146
201
      built-in module <systemitem class="library">ConfigParser</systemitem>
147
 
      requres it.
 
202
      requires it.
148
203
    </para>
149
204
  </refsect1>
150
205
  
166
221
[DEFAULT]
167
222
# A configuration example
168
223
interface = eth0
169
 
address = 2001:db8:f983:bd0b:30de:ae4a:71f2:f672
 
224
address = fe80::aede:48ff:fe71:f6f2
170
225
port = 1025
171
226
debug = true
172
227
priority = SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP
173
228
servicename = Daena
 
229
use_dbus = False
 
230
use_ipv6 = True
 
231
restore = True
 
232
statedir = /var/lib/mandos
174
233
      </programlisting>
175
234
    </informalexample>
176
235
  </refsect1>
178
237
  <refsect1 id="see_also">
179
238
    <title>SEE ALSO</title>
180
239
    <para>
 
240
      <citerefentry><refentrytitle>intro</refentrytitle>
 
241
      <manvolnum>8mandos</manvolnum></citerefentry>,
181
242
      <citerefentry><refentrytitle>gnutls_priority_init</refentrytitle
182
243
      ><manvolnum>3</manvolnum></citerefentry>,
183
244
      <citerefentry><refentrytitle>mandos</refentrytitle>
185
246
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
186
247
      <manvolnum>5</manvolnum></citerefentry>
187
248
    </para>
188
 
 
 
249
    
189
250
    <variablelist>
190
251
      <varlistentry>
191
252
        <term>
211
272
              <para>
212
273
                The clients use IPv6 link-local addresses, which are
213
274
                immediately usable since a link-local addresses is
214
 
                automatically assigned to a network interfaces when it
 
275
                automatically assigned to a network interface when it
215
276
                is brought up.
216
277
              </para>
217
278
            </listitem>