/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to plugins.d/password-request.xml

  • Committer: Teddy Hogeborn
  • Date: 2008-08-17 06:17:10 UTC
  • Revision ID: teddy@fukt.bsnet.se-20080817061710-epkw87paysoo9g7w
* mandos-keygen.xml (NOTES): Removed section, since it is
                             automatically created for footnotes.

Show diffs side-by-side

added added

removed removed

Lines of Context:
plugins.d/password-request.xml
1
 
<?xml version="1.0" encoding="UTF-8"?>
 
1
<?xml version='1.0' encoding='UTF-8'?>
 
2
<?xml-stylesheet type="text/xsl"
 
3
        href="http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl"?>
2
4
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
5
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
6
<!ENTITY VERSION "1.0">
5
7
<!ENTITY COMMANDNAME "password-request">
6
 
<!ENTITY TIMESTAMP "2008-09-03">
7
8
]>
8
9
 
9
 
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
 
10
<refentry>
10
11
  <refentryinfo>
11
 
    <title>Mandos Manual</title>
12
 
    <!-- Nwalsh’s docbook scripts use this to generate the footer: -->
13
 
    <productname>Mandos</productname>
 
12
    <title>&COMMANDNAME;</title>
 
13
    <!-- NWalsh's docbook scripts use this to generate the footer: -->
 
14
    <productname>&COMMANDNAME;</productname>
14
15
    <productnumber>&VERSION;</productnumber>
15
 
    <date>&TIMESTAMP;</date>
16
16
    <authorgroup>
17
17
      <author>
18
18
        <firstname>Björn</firstname>
31
31
    </authorgroup>
32
32
    <copyright>
33
33
      <year>2008</year>
34
 
      <holder>Teddy Hogeborn</holder>
35
 
      <holder>Björn Påhlsson</holder>
 
34
      <holder>Teddy Hogeborn &amp; Björn Påhlsson</holder>
36
35
    </copyright>
37
 
    <xi:include href="../legalnotice.xml"/>
 
36
    <legalnotice>
 
37
      <para>
 
38
        This manual page is free software: you can redistribute it
 
39
        and/or modify it under the terms of the GNU General Public
 
40
        License as published by the Free Software Foundation,
 
41
        either version 3 of the License, or (at your option) any
 
42
        later version.
 
43
      </para>
 
44
 
 
45
      <para>
 
46
        This manual page is distributed in the hope that it will
 
47
        be useful, but WITHOUT ANY WARRANTY; without even the
 
48
        implied warranty of MERCHANTABILITY or FITNESS FOR A
 
49
        PARTICULAR PURPOSE.  See the GNU General Public License
 
50
        for more details.
 
51
      </para>
 
52
 
 
53
      <para>
 
54
        You should have received a copy of the GNU General Public
 
55
        License along with this program; If not, see
 
56
        <ulink url="http://www.gnu.org/licenses/"/>.
 
57
      </para>
 
58
    </legalnotice>
38
59
  </refentryinfo>
39
60
 
40
61
  <refmeta>
52
73
  <refsynopsisdiv>
53
74
    <cmdsynopsis>
54
75
      <command>&COMMANDNAME;</command>
55
 
      <group>
56
 
        <arg choice="plain"><option>--connect
57
 
        <replaceable>IPADDR</replaceable><literal>:</literal
58
 
        ><replaceable>PORT</replaceable></option></arg>
59
 
        <arg choice="plain"><option>-c
60
 
        <replaceable>IPADDR</replaceable><literal>:</literal
61
 
        ><replaceable>PORT</replaceable></option></arg>
62
 
      </group>
63
 
      <sbr/>
64
 
      <group>
65
 
        <arg choice="plain"><option>--keydir
66
 
        <replaceable>DIRECTORY</replaceable></option></arg>
67
 
        <arg choice="plain"><option>-d
68
 
        <replaceable>DIRECTORY</replaceable></option></arg>
69
 
      </group>
70
 
      <sbr/>
71
 
      <group>
72
 
        <arg choice="plain"><option>--interface
73
 
        <replaceable>NAME</replaceable></option></arg>
74
 
        <arg choice="plain"><option>-i
75
 
        <replaceable>NAME</replaceable></option></arg>
76
 
      </group>
77
 
      <sbr/>
78
 
      <group>
79
 
        <arg choice="plain"><option>--pubkey
80
 
        <replaceable>FILE</replaceable></option></arg>
81
 
        <arg choice="plain"><option>-p
82
 
        <replaceable>FILE</replaceable></option></arg>
83
 
      </group>
84
 
      <sbr/>
85
 
      <group>
86
 
        <arg choice="plain"><option>--seckey
87
 
        <replaceable>FILE</replaceable></option></arg>
88
 
        <arg choice="plain"><option>-s
89
 
        <replaceable>FILE</replaceable></option></arg>
90
 
      </group>
91
 
      <sbr/>
92
 
      <arg>
93
 
        <option>--priority <replaceable>STRING</replaceable></option>
94
 
      </arg>
95
 
      <sbr/>
96
 
      <arg>
97
 
        <option>--dh-bits <replaceable>BITS</replaceable></option>
98
 
      </arg>
99
 
      <sbr/>
100
 
      <arg>
101
 
        <option>--debug</option>
102
 
      </arg>
103
 
    </cmdsynopsis>
104
 
    <cmdsynopsis>
105
 
      <command>&COMMANDNAME;</command>
106
 
      <group choice="req">
107
 
        <arg choice="plain"><option>--help</option></arg>
108
 
        <arg choice="plain"><option>-?</option></arg>
109
 
      </group>
110
 
    </cmdsynopsis>
111
 
    <cmdsynopsis>
112
 
      <command>&COMMANDNAME;</command>
113
 
      <arg choice="plain"><option>--usage</option></arg>
114
 
    </cmdsynopsis>
115
 
    <cmdsynopsis>
116
 
      <command>&COMMANDNAME;</command>
117
 
      <group choice="req">
118
 
        <arg choice="plain"><option>--version</option></arg>
119
 
        <arg choice="plain"><option>-V</option></arg>
120
 
      </group>
121
 
    </cmdsynopsis>
 
76
      <arg choice='opt'>--connect<arg choice='plain'>IP</arg></arg>
 
77
      <arg choice='opt'>--keydir<arg choice='plain'>KEYDIR</arg></arg>
 
78
      <arg choice='opt'>--interface<arg choice='plain'>INTERFACE</arg></arg>
 
79
      <arg choice='opt'>--pubkey<arg choice='plain'>PUBKEY</arg></arg>
 
80
      <arg choice='opt'>--seckey<arg choice='plain'>SECKEY</arg></arg>
 
81
      <arg choice='opt'>--priority<arg choice='plain'>PRIORITY</arg></arg>
 
82
      <arg choice='opt'>--dh-bits<arg choice='plain'>BITS</arg></arg>      
 
83
      <arg choice='opt'>--debug</arg>
 
84
    </cmdsynopsis>
 
85
    <cmdsynopsis>
 
86
      <command>&COMMANDNAME;</command>
 
87
      <arg choice='plain'>--help</arg>
 
88
    </cmdsynopsis>
 
89
    <cmdsynopsis>
 
90
      <command>&COMMANDNAME;</command>
 
91
      <arg choice='plain'>--usage</arg>
 
92
    </cmdsynopsis>
 
93
    <cmdsynopsis>
 
94
      <command>&COMMANDNAME;</command>
 
95
      <arg choice='plain'>--version</arg>
 
96
    </cmdsynopsis>    
122
97
  </refsynopsisdiv>
123
98
 
124
99
  <refsect1 id="description">
125
100
    <title>DESCRIPTION</title>
126
101
    <para>
127
 
      <command>&COMMANDNAME;</command> is a client program that
128
 
      communicates with <citerefentry><refentrytitle
129
 
      >mandos</refentrytitle><manvolnum>8</manvolnum></citerefentry>
130
 
      to get a password.  It uses IPv6 link-local addresses to get
131
 
      network connectivity, Zeroconf to find the server, and TLS with
132
 
      an OpenPGP key to ensure authenticity and confidentiality.  It
133
 
      keeps running, trying all servers on the network, until it
134
 
      receives a satisfactory reply.
135
 
    </para>
136
 
    <para>
137
 
      This program is not meant to be run directly; it is really meant
138
 
      to run as a plugin of the <application>Mandos</application>
139
 
      <citerefentry><refentrytitle>plugin-runner</refentrytitle>
140
 
      <manvolnum>8mandos</manvolnum></citerefentry>, which runs in the
141
 
      initial <acronym>RAM</acronym> disk environment because it is
142
 
      specified as a <quote>keyscript</quote> in the <citerefentry>
143
 
      <refentrytitle>crypttab</refentrytitle><manvolnum>5</manvolnum>
144
 
      </citerefentry> file.
145
 
    </para>
146
 
  </refsect1>
147
 
  
148
 
  <refsect1 id="purpose">
149
 
    <title>PURPOSE</title>
150
 
    <para>
151
 
      The purpose of this is to enable <emphasis>remote and unattended
152
 
      rebooting</emphasis> of client host computer with an
153
 
      <emphasis>encrypted root file system</emphasis>.  See <xref
154
 
      linkend="overview"/> for details.
155
 
    </para>
156
 
  </refsect1>
 
102
      <command>&COMMANDNAME;</command> is a mandos plugin that works
 
103
      like a client program that through avahi detects mandos servers,
 
104
      sets up a gnutls connect and request a encrypted password. Any
 
105
      passwords given is automaticly decrypted and passed to
 
106
      cryptsetup.
 
107
    </para>
 
108
  </refsect1>  
157
109
  
158
110
  <refsect1 id="options">
159
111
    <title>OPTIONS</title>
160
112
    <para>
161
 
      This program is commonly not invoked from the command line; it
162
 
      is normally started by the <application>Mandos</application>
163
 
      plugin runner, see <citerefentry><refentrytitle
164
 
      >plugin-runner</refentrytitle><manvolnum>8mandos</manvolnum>
165
 
      </citerefentry>.  Any command line options this program accepts
166
 
      are therefore normally provided by the plugin runner, and not
167
 
      directly.
 
113
      Commonly not invoked as command lines but from configuration
 
114
      file of plugin runner.
168
115
    </para>
169
 
    
 
116
 
170
117
    <variablelist>
171
118
      <varlistentry>
172
 
        <term><option>--connect=<replaceable
173
 
        >ADDRESS</replaceable><literal>:</literal><replaceable
174
 
        >PORT</replaceable></option></term>
175
 
        <term><option>-c
176
 
        <replaceable>ADDRESS</replaceable><literal>:</literal
177
 
        ><replaceable>PORT</replaceable></option></term>
178
 
        <listitem>
179
 
          <para>
180
 
            Do not use Zeroconf to locate servers.  Connect directly
181
 
            to only one specified <application>Mandos</application>
182
 
            server.  Note that an IPv6 address has colon characters in
183
 
            it, so the <emphasis>last</emphasis> colon character is
184
 
            assumed to separate the address from the port number.
185
 
          </para>
186
 
          <para>
187
 
            This option is normally only useful for testing and
188
 
            debugging.
189
 
          </para>
190
 
        </listitem>
191
 
      </varlistentry>
192
 
      
193
 
      <varlistentry>
194
 
        <term><option>--keydir=<replaceable
195
 
        >DIRECTORY</replaceable></option></term>
196
 
        <term><option>-d
197
 
        <replaceable>DIRECTORY</replaceable></option></term>
198
 
        <listitem>
199
 
          <para>
200
 
            Directory to read the OpenPGP key files
201
 
            <filename>pubkey.txt</filename> and
202
 
            <filename>seckey.txt</filename> from.  The default is
203
 
            <filename>/conf/conf.d/mandos</filename> (in the initial
204
 
            <acronym>RAM</acronym> disk environment).
205
 
          </para>
206
 
        </listitem>
207
 
      </varlistentry>
208
 
 
209
 
      <varlistentry>
210
 
        <term><option>--interface=
211
 
        <replaceable>NAME</replaceable></option></term>
212
 
        <term><option>-i
213
 
        <replaceable>NAME</replaceable></option></term>
214
 
        <listitem>
215
 
          <para>
216
 
            Network interface that will be brought up and scanned for
217
 
            Mandos servers to connect to.  The default it
218
 
            <quote><literal>eth0</literal></quote>.
219
 
          </para>
220
 
        </listitem>
221
 
      </varlistentry>
222
 
      
223
 
      <varlistentry>
224
 
        <term><option>--pubkey=<replaceable
225
 
        >FILE</replaceable></option></term>
226
 
        <term><option>-p
227
 
        <replaceable>FILE</replaceable></option></term>
228
 
        <listitem>
229
 
          <para>
230
 
            OpenPGP public key file base name.  This will be combined
231
 
            with the directory from the <option>--keydir</option>
232
 
            option to form an absolute file name.  The default name is
233
 
            <quote><literal>pubkey.txt</literal></quote>.
234
 
          </para>
235
 
        </listitem>
236
 
      </varlistentry>
237
 
 
238
 
      <varlistentry>
239
 
        <term><option>--seckey=<replaceable
240
 
        >FILE</replaceable></option></term>
241
 
        <term><option>-s
242
 
        <replaceable>FILE</replaceable></option></term>
243
 
        <listitem>
244
 
          <para>
245
 
            OpenPGP secret key file base name.  This will be combined
246
 
            with the directory from the <option>--keydir</option>
247
 
            option to form an absolute file name.  The default name is
248
 
            <quote><literal>seckey.txt</literal></quote>.
249
 
          </para>
250
 
        </listitem>
251
 
      </varlistentry>
252
 
      
253
 
      <varlistentry>
254
 
        <term><option>--priority=<replaceable
255
 
        >STRING</replaceable></option></term>
256
 
        <listitem>
257
 
          <xi:include href="../mandos-options.xml"
258
 
                      xpointer="priority"/>
259
 
        </listitem>
260
 
      </varlistentry>
261
 
 
262
 
      <varlistentry>
263
 
        <term><option>--dh-bits=<replaceable
264
 
        >BITS</replaceable></option></term>
265
 
        <listitem>
266
 
          <para>
267
 
            Sets the number of bits to use for the prime number in the
268
 
            TLS Diffie-Hellman key exchange.  Default is 1024.
269
 
          </para>
270
 
        </listitem>
271
 
      </varlistentry>
272
 
      
273
 
      <varlistentry>
274
 
        <term><option>--debug</option></term>
275
 
        <listitem>
276
 
          <para>
277
 
            Enable debug mode.  This will enable a lot of output to
278
 
            standard error about what the program is doing.  The
279
 
            program will still perform all other functions normally.
280
 
          </para>
281
 
          <para>
282
 
            It will also enable debug mode in the Avahi and GnuTLS
283
 
            libraries, making them print large amounts of debugging
284
 
            output.
285
 
          </para>
286
 
        </listitem>
287
 
      </varlistentry>
288
 
      
289
 
      <varlistentry>
290
 
        <term><option>--help</option></term>
291
 
        <term><option>-?</option></term>
292
 
        <listitem>
293
 
          <para>
294
 
            Gives a help message about options and their meanings.
295
 
          </para>
296
 
        </listitem>
297
 
      </varlistentry>
298
 
      
299
 
      <varlistentry>
300
 
        <term><option>--usage</option></term>
301
 
        <listitem>
302
 
          <para>
303
 
            Gives a short usage message.
304
 
          </para>
305
 
        </listitem>
306
 
      </varlistentry>
307
 
 
308
 
      <varlistentry>
309
 
        <term><option>--version</option></term>
310
 
        <term><option>-V</option></term>
311
 
        <listitem>
312
 
          <para>
313
 
            Prints the program version.
314
 
          </para>
315
 
        </listitem>
316
 
      </varlistentry>
 
119
        <term><literal>-c</literal>, <literal>--connect=<replaceable>
 
120
        IP</replaceable></literal></term>
 
121
        <listitem>
 
122
          <para>
 
123
            Connect directly to a specified mandos server
 
124
          </para>
 
125
        </listitem>
 
126
      </varlistentry>
 
127
 
 
128
      <varlistentry>
 
129
        <term><literal>-d</literal>, <literal>--keydir=<replaceable>
 
130
        KEYDIR</replaceable></literal></term>
 
131
        <listitem>
 
132
          <para>
 
133
            Directory where the openpgp keyring is
 
134
          </para>
 
135
        </listitem>
 
136
      </varlistentry>      
 
137
 
 
138
      <varlistentry>
 
139
        <term><literal>-i</literal>, <literal>--interface=
 
140
        <replaceable>INTERFACE</replaceable></literal></term>
 
141
        <listitem>
 
142
          <para>
 
143
            Interface that Avahi will conntect through
 
144
          </para>
 
145
        </listitem>
 
146
      </varlistentry>      
 
147
 
 
148
      <varlistentry>
 
149
        <term><literal>-p</literal>, <literal>--pubkey=<replaceable>
 
150
        PUBKEY</replaceable></literal></term>
 
151
        <listitem>
 
152
          <para>
 
153
            Public openpgp key for gnutls authentication
 
154
          </para>
 
155
        </listitem>
 
156
      </varlistentry>      
 
157
 
 
158
      <varlistentry>
 
159
        <term><literal>-s</literal>, <literal>--seckey=<replaceable>
 
160
        SECKEY</replaceable></literal></term>
 
161
        <listitem>
 
162
          <para>
 
163
            Secret openpgp key for gnutls authentication
 
164
          </para>
 
165
        </listitem>
 
166
      </varlistentry>            
 
167
      
 
168
      <varlistentry>
 
169
        <term><literal>--priority=<replaceable>PRIORITY</replaceable>
 
170
        </literal></term>
 
171
        <listitem>
 
172
          <para>
 
173
            GNUTLS priority
 
174
          </para>
 
175
        </listitem>
 
176
      </varlistentry>            
 
177
 
 
178
      <varlistentry>
 
179
        <term><literal>--dh-bits=<replaceable>BITS</replaceable>
 
180
        </literal></term>
 
181
        <listitem>
 
182
          <para>
 
183
            dh-bits to use in gnutls communication
 
184
          </para>
 
185
        </listitem>
 
186
      </varlistentry>      
 
187
      
 
188
      <varlistentry>
 
189
        <term><literal>--debug</literal></term>
 
190
        <listitem>
 
191
          <para>
 
192
            Debug mode
 
193
          </para>
 
194
        </listitem>
 
195
      </varlistentry>
 
196
      
 
197
      <varlistentry>
 
198
        <term><literal>-?</literal>, <literal>--help</literal></term>
 
199
        <listitem>
 
200
          <para>
 
201
            Gives a help message
 
202
          </para>
 
203
        </listitem>
 
204
      </varlistentry>
 
205
      
 
206
      <varlistentry>
 
207
        <term><literal>--usage</literal></term>
 
208
        <listitem>
 
209
          <para>
 
210
            Gives a short usage message
 
211
          </para>
 
212
        </listitem>
 
213
      </varlistentry>
 
214
 
 
215
      <varlistentry>
 
216
        <term><literal>-V</literal>, <literal>--version</literal></term>
 
217
        <listitem>
 
218
          <para>
 
219
            Prints the program version
 
220
          </para>
 
221
        </listitem>
 
222
      </varlistentry>            
317
223
    </variablelist>
318
224
  </refsect1>
319
225
 
320
 
  <refsect1 id="overview">
321
 
    <title>OVERVIEW</title>
322
 
    <xi:include href="../overview.xml"/>
323
 
    <para>
324
 
      This program is the client part.  It is a plugin started by
325
 
      <citerefentry><refentrytitle>plugin-runner</refentrytitle>
326
 
      <manvolnum>8mandos</manvolnum></citerefentry> which will run in
327
 
      an initial <acronym>RAM</acronym> disk environment.
328
 
    </para>
329
 
    <para>
330
 
      This program could, theoretically, be used as a keyscript in
331
 
      <filename>/etc/crypttab</filename>, but it would then be
332
 
      impossible to enter the encrypted root disk password at the
333
 
      console, since this program does not read from the console at
334
 
      all.  This is why a separate plugin does that, which will be run
335
 
      in parallell to this one.
336
 
    </para>
337
 
  </refsect1>
338
 
  
339
226
  <refsect1 id="exit_status">
340
227
    <title>EXIT STATUS</title>
341
228
    <para>
342
 
      This program will exit with a successful (zero) exit status if a
343
 
      server could be found and the password received from it could be
344
 
      successfully decrypted and output on standard output.  The
345
 
      program will exit with a non-zero exit status only if a critical
346
 
      error occurs.  Otherwise, it will forever connect to new
347
 
      <application>Mandosservers</application> servers as they appear,
348
 
      trying to get a decryptable password.
349
 
    </para>
350
 
  </refsect1>
351
 
  
352
 
  <refsect1 id="environment">
353
 
    <title>ENVIRONMENT</title>
354
 
    <para>
355
 
      This program does not use any environment variables, not even
356
 
      the ones provided by <citerefentry><refentrytitle
357
 
      >cryptsetup</refentrytitle><manvolnum>8</manvolnum>
358
 
    </citerefentry>.
359
 
    </para>
360
 
  </refsect1>
361
 
  
 
229
    </para>
 
230
  </refsect1>
 
231
 
362
232
  <refsect1 id="file">
363
233
    <title>FILES</title>
364
234
    <para>
365
235
    </para>
 
236
  </refsect1>  
 
237
 
 
238
  <refsect1 id="notes">
 
239
    <title>NOTES</title>
 
240
    <para>
 
241
    </para>
366
242
  </refsect1>
367
243
  
368
244
  <refsect1 id="bugs">
369
245
    <title>BUGS</title>
370
246
    <para>
371
247
    </para>
372
 
  </refsect1>
 
248
  </refsect1>  
373
249
 
374
 
  <refsect1 id="example">
375
 
    <title>EXAMPLE</title>
 
250
  <refsect1 id="examples">
 
251
    <title>EXAMPLES</title>
376
252
    <para>
377
253
    </para>
378
254
  </refsect1>
385
261
 
386
262
  <refsect1 id="see_also">
387
263
    <title>SEE ALSO</title>
388
 
    <para>
389
 
      <citerefentry><refentrytitle>mandos</refentrytitle>
390
 
      <manvolnum>8</manvolnum></citerefentry>,
391
 
      <citerefentry><refentrytitle>password-prompt</refentrytitle>
392
 
      <manvolnum>8mandos</manvolnum></citerefentry>,
393
 
      <citerefentry><refentrytitle>plugin-runner</refentrytitle>
394
 
      <manvolnum>8mandos</manvolnum></citerefentry>
395
 
    </para>
396
264
    <itemizedlist>
397
265
      <listitem><para>
 
266
        <citerefentry><refentrytitle>mandos</refentrytitle>
 
267
        <manvolnum>8</manvolnum></citerefentry>
 
268
      </para></listitem>
 
269
      
 
270
      <listitem><para>
 
271
        <citerefentry><refentrytitle>plugin-runner</refentrytitle>
 
272
        <manvolnum>8mandos</manvolnum></citerefentry>
 
273
      </para></listitem>
 
274
      
 
275
      <listitem><para>
 
276
        <citerefentry><refentrytitle>password-prompt</refentrytitle>
 
277
        <manvolnum>8mandos</manvolnum></citerefentry>
 
278
      </para></listitem>
 
279
      
 
280
      <listitem><para>
398
281
        <ulink url="http://www.zeroconf.org/">Zeroconf</ulink>
399
282
      </para></listitem>
400
283
      
409
292
      
410
293
      <listitem><para>
411
294
        <ulink
412
 
        url="http://www.gnupg.org/related_software/gpgme/"
413
 
        >GPGME</ulink>
 
295
        url="http://www.gnupg.org/related_software/gpgme/">
 
296
        GPGME</ulink>
414
297
      </para></listitem>
415
298
      
416
299
      <listitem><para>
432
315
  </refsect1>
433
316
 
434
317
</refentry>
435
 
<!-- Local Variables: -->
436
 
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
437
 
<!-- time-stamp-end: "[\"']>" -->
438
 
<!-- time-stamp-format: "%:y-%02m-%02d" -->
439
 
<!-- End: -->