/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to plugins.d/mandos-client.xml

  • Committer: Teddy Hogeborn
  • Date: 2015-05-22 20:23:46 UTC
  • Revision ID: teddy@recompile.se-20150522202346-taccq232srbszyd9
mandos-keygen: Bug fix: Only use one SSH key from ssh-keyscan

If ssh-keyscan found keys of more than one type, the generated output
would be incorrect.  Restrict the output to one type of key.

Show diffs side-by-side

added added

removed removed

Lines of Context:
plugins.d/mandos-client.xml
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY COMMANDNAME "mandos-client">
5
 
<!ENTITY TIMESTAMP "2013-10-20">
 
5
<!ENTITY TIMESTAMP "2015-03-08">
6
6
<!ENTITY % common SYSTEM "../common.ent">
7
7
%common;
8
8
]>
35
35
      <year>2009</year>
36
36
      <year>2012</year>
37
37
      <year>2013</year>
 
38
      <year>2014</year>
38
39
      <holder>Teddy Hogeborn</holder>
39
40
      <holder>Björn Påhlsson</holder>
40
41
    </copyright>
219
220
            assumed to separate the address from the port number.
220
221
          </para>
221
222
          <para>
222
 
            This option is normally only useful for testing and
223
 
            debugging.
 
223
            Normally, Zeroconf would be used to locate Mandos servers,
 
224
            in which case this option would only be used when testing
 
225
            and debugging.
224
226
          </para>
225
227
        </listitem>
226
228
      </varlistentry>
259
261
          <para>
260
262
            <replaceable>NAME</replaceable> can be the string
261
263
            <quote><literal>none</literal></quote>; this will make
262
 
            <command>&COMMANDNAME;</command> not bring up
263
 
            <emphasis>any</emphasis> interfaces specified
264
 
            <emphasis>after</emphasis> this string.  This is not
265
 
            recommended, and only meant for advanced users.
 
264
            <command>&COMMANDNAME;</command> only bring up interfaces
 
265
            specified <emphasis>before</emphasis> this string.  This
 
266
            is not recommended, and only meant for advanced users.
266
267
          </para>
267
268
        </listitem>
268
269
      </varlistentry>
310
311
        <listitem>
311
312
          <para>
312
313
            Sets the number of bits to use for the prime number in the
313
 
            TLS Diffie-Hellman key exchange.  Default is 1024.
 
314
            TLS Diffie-Hellman key exchange.  The default value is
 
315
            selected automatically based on the OpenPGP key.
314
316
          </para>
315
317
        </listitem>
316
318
      </varlistentry>
747
749
    <para>
748
750
      It will also help if the checker program on the server is
749
751
      configured to request something from the client which can not be
750
 
      spoofed by someone else on the network, unlike unencrypted
751
 
      <acronym>ICMP</acronym> echo (<quote>ping</quote>) replies.
 
752
      spoofed by someone else on the network, like SSH server key
 
753
      fingerprints, and unlike unencrypted <acronym>ICMP</acronym>
 
754
      echo (<quote>ping</quote>) replies.
752
755
    </para>
753
756
    <para>
754
757
      <emphasis>Note</emphasis>: This makes it completely insecure to