/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos.conf.xml

  • Committer: Teddy Hogeborn
  • Date: 2015-03-10 18:03:38 UTC
  • Revision ID: teddy@recompile.se-20150310180338-pcxw6r2qmw9k6br9
Add ":!RSA" to GnuTLS priority string, to disallow non-DHE kx.

If Mandos was somehow made to use a non-ephemeral Diffie-Hellman key
exchange algorithm in the TLS handshake, any saved network traffic
could then be decrypted later if the Mandos client key was obtained.
By default, Mandos uses ephemeral DH key exchanges which does not have
this problem, but a non-ephemeral key exchange algorithm was still
enabled by default.  The simplest solution is to simply turn that off,
which ensures that Mandos will always use ephemeral DH key exchanges.

There is a "PFS" priority string specifier, but we can't use it because:

1. Security-wise, it is a mix between "NORMAL" and "SECURE128" - it
   enables a lot more algorithms than "SECURE256".

2. It is only available since GnuTLS 3.2.4.

Thanks to Andreas Fischer <af@bantuX.org> for reporting this issue.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos.conf.xml
1
 
<?xml version='1.0' encoding='UTF-8'?>
2
 
<?xml-stylesheet type="text/xsl"
3
 
        href="http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl"?>
 
1
<?xml version="1.0" encoding="UTF-8"?>
4
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
5
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
6
 
<!ENTITY VERSION "1.0">
7
4
<!ENTITY CONFNAME "mandos.conf">
8
5
<!ENTITY CONFPATH "<filename>/etc/mandos/mandos.conf</filename>">
 
6
<!ENTITY TIMESTAMP "2013-10-23">
 
7
<!ENTITY % common SYSTEM "common.ent">
 
8
%common;
9
9
]>
10
10
 
11
 
<refentry>
 
11
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
12
12
  <refentryinfo>
13
 
    <title>&CONFNAME;</title>
14
 
    <!-- NWalsh's docbook scripts use this to generate the footer: -->
15
 
    <productname>&CONFNAME;</productname>
16
 
    <productnumber>&VERSION;</productnumber>
 
13
    <title>Mandos Manual</title>
 
14
    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
 
15
    <productname>Mandos</productname>
 
16
    <productnumber>&version;</productnumber>
 
17
    <date>&TIMESTAMP;</date>
17
18
    <authorgroup>
18
19
      <author>
19
20
        <firstname>Björn</firstname>
20
21
        <surname>Påhlsson</surname>
21
22
        <address>
22
 
          <email>belorn@fukt.bsnet.se</email>
 
23
          <email>belorn@recompile.se</email>
23
24
        </address>
24
25
      </author>
25
26
      <author>
26
27
        <firstname>Teddy</firstname>
27
28
        <surname>Hogeborn</surname>
28
29
        <address>
29
 
          <email>teddy@fukt.bsnet.se</email>
 
30
          <email>teddy@recompile.se</email>
30
31
        </address>
31
32
      </author>
32
33
    </authorgroup>
33
34
    <copyright>
34
35
      <year>2008</year>
35
 
      <holder>Teddy Hogeborn &amp; Björn Påhlsson</holder>
 
36
      <year>2009</year>
 
37
      <year>2011</year>
 
38
      <year>2012</year>
 
39
      <year>2013</year>
 
40
      <holder>Teddy Hogeborn</holder>
 
41
      <holder>Björn Påhlsson</holder>
36
42
    </copyright>
37
 
    <legalnotice>
38
 
      <para>
39
 
        This manual page is free software: you can redistribute it
40
 
        and/or modify it under the terms of the GNU General Public
41
 
        License as published by the Free Software Foundation,
42
 
        either version 3 of the License, or (at your option) any
43
 
        later version.
44
 
      </para>
45
 
 
46
 
      <para>
47
 
        This manual page is distributed in the hope that it will
48
 
        be useful, but WITHOUT ANY WARRANTY; without even the
49
 
        implied warranty of MERCHANTABILITY or FITNESS FOR A
50
 
        PARTICULAR PURPOSE.  See the GNU General Public License
51
 
        for more details.
52
 
      </para>
53
 
 
54
 
      <para>
55
 
        You should have received a copy of the GNU General Public
56
 
        License along with this program; If not, see
57
 
        <ulink url="http://www.gnu.org/licenses/"/>.
58
 
      </para>
59
 
    </legalnotice>
 
43
    <xi:include href="legalnotice.xml"/>
60
44
  </refentryinfo>
61
 
 
 
45
  
62
46
  <refmeta>
63
47
    <refentrytitle>&CONFNAME;</refentrytitle>
64
48
    <manvolnum>5</manvolnum>
67
51
  <refnamediv>
68
52
    <refname><filename>&CONFNAME;</filename></refname>
69
53
    <refpurpose>
70
 
      Configuration file for Mandos
 
54
      Configuration file for the Mandos server
71
55
    </refpurpose>
72
56
  </refnamediv>
73
 
 
 
57
  
74
58
  <refsynopsisdiv>
75
 
    <synopsis>
76
 
      &CONFPATH;
77
 
    </synopsis>
 
59
    <synopsis>&CONFPATH;</synopsis>
78
60
  </refsynopsisdiv>
79
 
 
 
61
  
80
62
  <refsect1 id="description">
81
63
    <title>DESCRIPTION</title>
82
64
    <para>
83
 
      The file &CONFPATH; is a simple configuration file for mandos
84
 
      and is looked on at startup of the service. The configuration
85
 
      file must start with <literal>[server]</literal>. The format for
86
 
      the rest is a simple VAR = VALUE pair. Values may not be empty.
87
 
    </para>
88
 
 
89
 
    <para>
90
 
      The paramters are:
91
 
    </para>
92
 
 
 
65
      The file &CONFPATH; is a simple configuration file for
 
66
      <citerefentry><refentrytitle>mandos</refentrytitle>
 
67
      <manvolnum>8</manvolnum></citerefentry>, and is read by it at
 
68
      startup.  The configuration file starts with <quote><literal
 
69
      >[DEFAULT]</literal></quote> on a line by itself, followed by
 
70
      any number of <quote><varname><replaceable>option</replaceable
 
71
      ></varname>=<replaceable>value</replaceable></quote> entries,
 
72
      with continuations in the style of RFC 822.  <quote><varname
 
73
      ><replaceable>option</replaceable></varname>: <replaceable
 
74
      >value</replaceable></quote> is also accepted.  Note that
 
75
      leading whitespace is removed from values.  Lines beginning with
 
76
      <quote>#</quote> or <quote>;</quote> are ignored and may be used
 
77
      to provide comments.
 
78
    </para>
 
79
    
 
80
  </refsect1>
 
81
  <refsect1>
 
82
    <title>OPTIONS</title>
 
83
    
93
84
    <variablelist>
94
85
      <varlistentry>
95
 
        <term><literal>interface</literal></term>
96
 
        <listitem>
97
 
          <para>
98
 
            This option allows you to override the default network
99
 
            interfaces. By default mandos will not bind to any
100
 
            specific interface but instead use default avahi-server
101
 
            behaviour.
102
 
          </para>
103
 
        </listitem>
104
 
      </varlistentry>
105
 
 
106
 
      <varlistentry>
107
 
        <term><literal>address</literal></term>
108
 
        <listitem>
109
 
          <para>
110
 
            This option allows you to override the default network
111
 
            address. By default mandos will not bind to any
112
 
            specific address but instead use default avahi-server
113
 
            behaviour.
114
 
          </para>
115
 
        </listitem>
116
 
      </varlistentry>      
117
 
 
118
 
      <varlistentry>
119
 
        <term><literal>port</literal></term>
120
 
        <listitem>
121
 
          <para>
122
 
            This option allows you to override the default port to
123
 
            listen on. By default mandos will not specify any specific
124
 
            port and instead use a random port given by the OS from
125
 
            the use of INADDR_ANY.
126
 
          </para>
127
 
        </listitem>
128
 
      </varlistentry>
129
 
 
130
 
      <varlistentry>
131
 
        <term><literal>debug</literal></term>
132
 
        <listitem>
133
 
          <para>
134
 
            This option allows you to modify debug mode with a true/false
135
 
            boolean value. By default is debug set to <literal>false</literal>.
136
 
          </para>
137
 
        </listitem>
138
 
      </varlistentry>      
139
 
 
140
 
      <varlistentry>
141
 
        <term><literal>priority</literal></term>
142
 
        <listitem>
143
 
          <para>
144
 
            This option allows you to override the default gnutls
145
 
            priority that will be used in gnutls session. See
146
 
            <citerefentry><refentrytitle>gnutls_priority_init
147
 
            </refentrytitle><manvolnum>3</manvolnum></citerefentry>for
148
 
            more information on gnutls priority strings.
149
 
          </para>         
150
 
        </listitem>
151
 
      </varlistentry>
152
 
 
153
 
      <varlistentry>
154
 
        <term><literal>servicename</literal></term>
155
 
        <listitem>
156
 
          <para>
157
 
            This option allows you to override the default Zeroconf
158
 
            service name use to announce mandos as a avahi service. By
159
 
            default mandos will use "Mandos".
160
 
          </para>
 
86
        <term><option>interface<literal> = </literal><replaceable
 
87
        >NAME</replaceable></option></term>
 
88
        <listitem>
 
89
          <xi:include href="mandos-options.xml" xpointer="interface"/>
 
90
        </listitem>
 
91
      </varlistentry>
 
92
      
 
93
      <varlistentry>
 
94
        <term><option>address<literal> = </literal><replaceable
 
95
          >ADDRESS</replaceable></option></term>
 
96
        <listitem>
 
97
          <xi:include href="mandos-options.xml" xpointer="address"/>
 
98
        </listitem>
 
99
      </varlistentry>
 
100
      
 
101
      <varlistentry>
 
102
        <term><option>port<literal> = </literal><replaceable
 
103
        >NUMBER</replaceable></option></term>
 
104
        <listitem>
 
105
          <xi:include href="mandos-options.xml" xpointer="port"/>
 
106
        </listitem>
 
107
      </varlistentry>
 
108
      
 
109
      <varlistentry>
 
110
        <term><option>debug<literal> = </literal>{ <literal
 
111
          >1</literal> | <literal>yes</literal> | <literal
 
112
          >true</literal> | <literal>on</literal> | <literal
 
113
          >0</literal> | <literal>no</literal> | <literal
 
114
          >false</literal> | <literal>off</literal> }</option></term>
 
115
        <listitem>
 
116
          <xi:include href="mandos-options.xml" xpointer="debug"/>
 
117
        </listitem>
 
118
      </varlistentry>
 
119
      
 
120
      <varlistentry>
 
121
        <term><option>priority<literal> = </literal><replaceable
 
122
        >STRING</replaceable></option></term>
 
123
        <listitem>
 
124
          <xi:include href="mandos-options.xml"
 
125
                      xpointer="priority_compat"/>
 
126
        </listitem>
 
127
      </varlistentry>
 
128
      
 
129
      <varlistentry>
 
130
        <term><option>servicename<literal> = </literal
 
131
        ><replaceable>NAME</replaceable></option></term>
 
132
        <listitem>
 
133
          <xi:include href="mandos-options.xml"
 
134
                      xpointer="servicename"/>
 
135
        </listitem>
 
136
      </varlistentry>
 
137
      
 
138
      <varlistentry>
 
139
        <term><option>use_dbus<literal> = </literal>{ <literal
 
140
          >1</literal> | <literal>yes</literal> | <literal
 
141
          >true</literal> | <literal>on</literal> | <literal
 
142
          >0</literal> | <literal>no</literal> | <literal
 
143
          >false</literal> | <literal>off</literal> }</option></term>
 
144
        <listitem>
 
145
          <xi:include href="mandos-options.xml" xpointer="dbus"/>
 
146
        </listitem>
 
147
      </varlistentry>
 
148
      
 
149
      <varlistentry>
 
150
        <term><option>use_ipv6<literal> = </literal>{ <literal
 
151
          >1</literal> | <literal>yes</literal> | <literal
 
152
          >true</literal> | <literal>on</literal> | <literal
 
153
          >0</literal> | <literal>no</literal> | <literal
 
154
          >false</literal> | <literal>off</literal> }</option></term>
 
155
        <listitem>
 
156
          <xi:include href="mandos-options.xml" xpointer="ipv6"/>
 
157
        </listitem>
 
158
      </varlistentry>
 
159
      
 
160
      <varlistentry>
 
161
        <term><option>restore<literal> = </literal>{ <literal
 
162
          >1</literal> | <literal>yes</literal> | <literal
 
163
          >true</literal> | <literal>on</literal> | <literal
 
164
          >0</literal> | <literal>no</literal> | <literal
 
165
          >false</literal> | <literal>off</literal> }</option></term>
 
166
        <listitem>
 
167
          <xi:include href="mandos-options.xml" xpointer="restore"/>
 
168
        </listitem>
 
169
      </varlistentry>
 
170
      
 
171
      <varlistentry>
 
172
        <term><option>statedir<literal> = </literal><replaceable
 
173
        >DIRECTORY</replaceable></option></term>
 
174
        <listitem>
 
175
          <xi:include href="mandos-options.xml" xpointer="statedir"/>
 
176
        </listitem>
 
177
      </varlistentry>
 
178
      
 
179
      <varlistentry>
 
180
        <term><option>socket<literal> = </literal><replaceable
 
181
        >NUMBER</replaceable></option></term>
 
182
        <listitem>
 
183
          <xi:include href="mandos-options.xml" xpointer="socket"/>
161
184
        </listitem>
162
185
      </varlistentry>
163
186
      
164
187
    </variablelist>
165
188
  </refsect1>
166
 
 
167
 
  <refsect1 id="examples">
168
 
    <title>EXAMPLES</title>
169
 
    <informalexample>
170
 
      <programlisting>
171
 
        [server]
172
 
        # A configuration example
173
 
        interface = eth0 
174
 
        address = 2001:DB8:
175
 
        port = 1025 
176
 
        debug = true 
177
 
        priority = SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP
178
 
        servicename = Mandos
179
 
      </programlisting>
180
 
    </informalexample>
181
 
  </refsect1>  
182
189
  
183
190
  <refsect1 id="files">
184
191
    <title>FILES</title>
186
193
      The file described here is &CONFPATH;
187
194
    </para>
188
195
  </refsect1>
 
196
  
 
197
  <refsect1 id="bugs">
 
198
    <title>BUGS</title>
 
199
    <para>
 
200
      The <literal>[DEFAULT]</literal> is necessary because the Python
 
201
      built-in module <systemitem class="library">ConfigParser</systemitem>
 
202
      requires it.
 
203
    </para>
 
204
  </refsect1>
 
205
  
 
206
  <refsect1 id="example">
 
207
    <title>EXAMPLE</title>
 
208
    <informalexample>
 
209
      <para>
 
210
        No options are actually required:
 
211
      </para>
 
212
      <programlisting>
 
213
[DEFAULT]
 
214
      </programlisting>
 
215
    </informalexample>
 
216
    <informalexample>
 
217
      <para>
 
218
        An example using all the options:
 
219
      </para>
 
220
      <programlisting>
 
221
[DEFAULT]
 
222
# A configuration example
 
223
interface = eth0
 
224
address = fe80::aede:48ff:fe71:f6f2
 
225
port = 1025
 
226
debug = true
 
227
priority = SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP
 
228
servicename = Daena
 
229
use_dbus = False
 
230
use_ipv6 = True
 
231
restore = True
 
232
statedir = /var/lib/mandos
 
233
      </programlisting>
 
234
    </informalexample>
 
235
  </refsect1>
 
236
  
 
237
  <refsect1 id="see_also">
 
238
    <title>SEE ALSO</title>
 
239
    <para>
 
240
      <citerefentry><refentrytitle>intro</refentrytitle>
 
241
      <manvolnum>8mandos</manvolnum></citerefentry>,
 
242
      <citerefentry><refentrytitle>gnutls_priority_init</refentrytitle
 
243
      ><manvolnum>3</manvolnum></citerefentry>,
 
244
      <citerefentry><refentrytitle>mandos</refentrytitle>
 
245
      <manvolnum>8</manvolnum></citerefentry>,
 
246
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
 
247
      <manvolnum>5</manvolnum></citerefentry>
 
248
    </para>
 
249
    
 
250
    <variablelist>
 
251
      <varlistentry>
 
252
        <term>
 
253
          RFC 4291: <citetitle>IP Version 6 Addressing
 
254
          Architecture</citetitle>
 
255
        </term>
 
256
        <listitem>
 
257
          <variablelist>
 
258
            <varlistentry>
 
259
              <term>Section 2.2: <citetitle>Text Representation of
 
260
              Addresses</citetitle></term>
 
261
              <listitem><para/></listitem>
 
262
            </varlistentry>
 
263
            <varlistentry>
 
264
              <term>Section 2.5.5.2: <citetitle>IPv4-Mapped IPv6
 
265
              Address</citetitle></term>
 
266
              <listitem><para/></listitem>
 
267
            </varlistentry>
 
268
            <varlistentry>
 
269
            <term>Section 2.5.6, <citetitle>Link-Local IPv6 Unicast
 
270
            Addresses</citetitle></term>
 
271
            <listitem>
 
272
              <para>
 
273
                The clients use IPv6 link-local addresses, which are
 
274
                immediately usable since a link-local addresses is
 
275
                automatically assigned to a network interface when it
 
276
                is brought up.
 
277
              </para>
 
278
            </listitem>
 
279
            </varlistentry>
 
280
          </variablelist>
 
281
        </listitem>
 
282
      </varlistentry>
 
283
      <varlistentry>
 
284
        <term>
 
285
          <ulink url="http://www.zeroconf.org/">Zeroconf</ulink>
 
286
        </term>
 
287
        <listitem>
 
288
          <para>
 
289
            Zeroconf is the network protocol standard used by clients
 
290
            for finding the Mandos server on the local network.
 
291
          </para>
 
292
        </listitem>
 
293
      </varlistentry>
 
294
    </variablelist>
 
295
  </refsect1>
189
296
</refentry>
 
297
<!-- Local Variables: -->
 
298
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
 
299
<!-- time-stamp-end: "[\"']>" -->
 
300
<!-- time-stamp-format: "%:y-%02m-%02d" -->
 
301
<!-- End: -->