To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.xml
- browse files at revision 831
- compare with another revision
- download diff
- download tarball
- view history from revision 831
- Committer: Teddy Hogeborn
- Date: 2016-03-13 00:37:02 UTC
- Revision ID: teddy@recompile.se-20160313003702-dulwtwt8ilpojra9
Server: Fix bug where it did not exit timely on signals
Use GLib.unix_signal_add() instead of signal.signal() to catch
signals; this will allow GLib to do its internal magic with signal
file descriptors. (GLib does not handle signals properly otherwise.)
The function unix_signal_add() requires GLib 2.30 or later, which was
not required by PyGobject until version 3.7.1, so depend on this.
* INSTALL (Mandos Server): Document dependency on PyGObject 3.7.1
* mandos (main): Use GLib.unix_signal_add instead of signal.signal.
* init.d-mandos (do_stop): Remove workaround.
* mandos.service ([Service]): - '' -
Use GLib.unix_signal_add() instead of signal.signal() to catch
signals; this will allow GLib to do its internal magic with signal
file descriptors. (GLib does not handle signals properly otherwise.)
The function unix_signal_add() requires GLib 2.30 or later, which was
not required by PyGobject until version 3.7.1, so depend on this.
* INSTALL (Mandos Server): Document dependency on PyGObject 3.7.1
* mandos (main): Use GLib.unix_signal_add instead of signal.signal.
* init.d-mandos (do_stop): Remove workaround.
* mandos.service ([Service]): - '' -
- files added:
- bugs.xml
- debian/upstream
- network-hooks.d
- plugin-helpers
- files modified:
- .bzrignore
added
removed
plugins.d/mandos-client.xml
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY COMMANDNAME "mandos-client">
5
<!ENTITY TIMESTAMP "2010-09-26">
5
<!ENTITY TIMESTAMP "2016-03-05">
6
6
<!ENTITY % common SYSTEM "../common.ent">
7
7
%common;
8
8
]>
19
19
<firstname>Björn</firstname>
20
20
<surname>Påhlsson</surname>
21
21
<address>
22
<email>belorn@fukt.bsnet.se</email>
22
<email>belorn@recompile.se</email>
23
23
</address>
24
24
</author>
25
25
<author>
26
26
<firstname>Teddy</firstname>
27
27
<surname>Hogeborn</surname>
28
28
<address>
29
<email>teddy@fukt.bsnet.se</email>
29
<email>teddy@recompile.se</email>
30
30
</address>
31
31
</author>
32
32
</authorgroup>
33
33
<copyright>
34
34
<year>2008</year>
35
35
<year>2009</year>
36
<year>2010</year>
37
<year>2011</year>
38
<year>2012</year>
39
<year>2013</year>
40
<year>2014</year>
41
<year>2015</year>
42
<year>2016</year>
36
43
<holder>Teddy Hogeborn</holder>
37
44
<holder>Björn Påhlsson</holder>
38
45
</copyright>
63
70
><replaceable>PORT</replaceable></option></arg>
64
71
</group>
65
72
<sbr/>
66
<group>
73
<group rep='repeat'>
67
74
<arg choice="plain"><option>--interface
68
<replaceable>NAME</replaceable></option></arg>
69
<arg choice="plain"><option>-i
70
<replaceable>NAME</replaceable></option></arg>
75
<replaceable>NAME</replaceable><arg rep='repeat'
76
>,<replaceable>NAME</replaceable></arg></option></arg>
77
<arg choice="plain"><option>-i <replaceable>NAME</replaceable
78
><arg rep='repeat'>,<replaceable>NAME</replaceable></arg
79
></option></arg>
71
80
</group>
72
81
<sbr/>
73
82
<group>
93
102
</arg>
94
103
<sbr/>
95
104
<arg>
105
<option>--dh-params <replaceable>FILE</replaceable></option>
106
</arg>
107
<sbr/>
108
<arg>
96
109
<option>--delay <replaceable>SECONDS</replaceable></option>
97
110
</arg>
98
111
<sbr/>
101
114
</arg>
102
115
<sbr/>
103
116
<arg>
117
<option>--network-hook-dir
118
<replaceable>DIR</replaceable></option>
119
</arg>
120
<sbr/>
121
<arg>
104
122
<option>--debug</option>
105
123
</arg>
106
124
</cmdsynopsis>
131
149
communicates with <citerefentry><refentrytitle
132
150
>mandos</refentrytitle><manvolnum>8</manvolnum></citerefentry>
133
151
to get a password. In slightly more detail, this client program
134
brings up a network interface, uses the interface’s IPv6
135
link-local address to get network connectivity, uses Zeroconf to
136
find servers on the local network, and communicates with servers
137
using TLS with an OpenPGP key to ensure authenticity and
152
brings up network interfaces, uses the interfaces’ IPv6
153
link-local addresses to get network connectivity, uses Zeroconf
154
to find servers on the local network, and communicates with
155
servers using TLS with an OpenPGP key to ensure authenticity and
138
156
confidentiality. This client program keeps running, trying all
139
157
servers on the network, until it receives a satisfactory reply
140
or a TERM signal is received. If no servers are found, or after
141
all servers have been tried, it waits indefinitely for new
142
servers to appear.
158
or a TERM signal. After all servers have been tried, all
159
servers are periodically retried. If no servers are found it
160
will wait indefinitely for new servers to appear.
161
</para>
162
<para>
163
The network interfaces are selected like this: If any interfaces
164
are specified using the <option>--interface</option> option,
165
those interface are used. Otherwise,
166
<command>&COMMANDNAME;</command> will use all interfaces that
167
are not loopback interfaces, are not point-to-point interfaces,
168
are capable of broadcasting and do not have the NOARP flag (see
169
<citerefentry><refentrytitle>netdevice</refentrytitle>
170
<manvolnum>7</manvolnum></citerefentry>). (If the
171
<option>--connect</option> option is used, point-to-point
172
interfaces and non-broadcast interfaces are accepted.) If any
173
used interfaces are not up and running, they are first taken up
174
(and later taken down again on program exit).
175
</para>
176
<para>
177
Before network interfaces are selected, all <quote>network
178
hooks</quote> are run; see <xref linkend="network-hooks"/>.
143
179
</para>
144
180
<para>
145
181
This program is not meant to be run directly; it is really meant
192
228
assumed to separate the address from the port number.
193
229
</para>
194
230
<para>
195
This option is normally only useful for testing and
196
debugging.
231
Normally, Zeroconf would be used to locate Mandos servers,
232
in which case this option would only be used when testing
233
and debugging.
197
234
</para>
198
235
</listitem>
199
236
</varlistentry>
200
237
201
238
<varlistentry>
202
239
<term><option>--interface=<replaceable
203
>NAME</replaceable></option></term>
240
>NAME</replaceable><arg rep='repeat'>,<replaceable
241
>NAME</replaceable></arg></option></term>
204
242
<term><option>-i
205
<replaceable>NAME</replaceable></option></term>
243
<replaceable>NAME</replaceable><arg rep='repeat'>,<replaceable
244
>NAME</replaceable></arg></option></term>
206
245
<listitem>
207
246
<para>
208
Network interface that will be brought up and scanned for
209
Mandos servers to connect to. The default is the empty
210
string, which will automatically choose an appropriate
211
interface.
247
Comma separated list of network interfaces that will be
248
brought up and scanned for Mandos servers to connect to.
249
The default is the empty string, which will automatically
250
use all appropriate interfaces.
212
251
</para>
213
252
<para>
214
If the <option>--connect</option> option is used, this
215
specifies the interface to use to connect to the address
216
given.
253
If the <option>--connect</option> option is used, and
254
exactly one interface name is specified (except
255
<quote><literal>none</literal></quote>), this specifies
256
the interface to use to connect to the address given.
217
257
</para>
218
258
<para>
219
259
Note that since this program will normally run in the
220
260
initial RAM disk environment, the interface must be an
221
261
interface which exists at that stage. Thus, the interface
222
can not be a pseudo-interface such as <quote>br0</quote>
223
or <quote>tun0</quote>; such interfaces will not exist
224
until much later in the boot process, and can not be used
225
by this program.
262
can normally not be a pseudo-interface such as
263
<quote>br0</quote> or <quote>tun0</quote>; such interfaces
264
will not exist until much later in the boot process, and
265
can not be used by this program, unless created by a
266
<quote>network hook</quote> — see <xref
267
linkend="network-hooks"/>.
226
268
</para>
227
269
<para>
228
270
<replaceable>NAME</replaceable> can be the string
229
<quote><literal>none</literal></quote>; this will not use
230
any specific interface, and will not bring up an interface
231
on startup. This is not recommended, and only meant for
232
advanced users.
271
<quote><literal>none</literal></quote>; this will make
272
<command>&COMMANDNAME;</command> only bring up interfaces
273
specified <emphasis>before</emphasis> this string. This
274
is not recommended, and only meant for advanced users.
233
275
</para>
234
276
</listitem>
235
277
</varlistentry>
277
319
<listitem>
278
320
<para>
279
321
Sets the number of bits to use for the prime number in the
280
TLS Diffie-Hellman key exchange. Default is 1024.
322
TLS Diffie-Hellman key exchange. The default value is
323
selected automatically based on the OpenPGP key. Note
324
that if the <option>--dh-params</option> option is used,
325
the values from that file will be used instead.
326
</para>
327
</listitem>
328
</varlistentry>
329
330
<varlistentry>
331
<term><option>--dh-params=<replaceable
332
>FILE</replaceable></option></term>
333
<listitem>
334
<para>
335
Specifies a PEM-encoded PKCS#3 file to read the parameters
336
needed by the TLS Diffie-Hellman key exchange from. If
337
this option is not given, or if the file for some reason
338
could not be used, the parameters will be generated on
339
startup, which will take some time and processing power.
340
Those using servers running under time, power or processor
341
constraints may want to generate such a file in advance
342
and use this option.
281
343
</para>
282
344
</listitem>
283
345
</varlistentry>
287
349
>SECONDS</replaceable></option></term>
288
350
<listitem>
289
351
<para>
290
After bringing the network interface up, the program waits
352
After bringing a network interface up, the program waits
291
353
for the interface to arrive in a <quote>running</quote>
292
354
state before proceeding. During this time, the kernel log
293
355
level will be lowered to reduce clutter on the system
303
365
>SECONDS</replaceable></option></term>
304
366
<listitem>
305
367
<para>
306
All Mandos servers servers are tried repeatedly until a
307
password is received. This value specifies, in seconds,
308
how long between each successive try <emphasis>for the
309
same server</emphasis>. The default is 10 seconds.
368
All Mandos servers are tried repeatedly until a password
369
is received. This value specifies, in seconds, how long
370
between each successive try <emphasis>for the same
371
server</emphasis>. The default is 10 seconds.
372
</para>
373
</listitem>
374
</varlistentry>
375
376
<varlistentry>
377
<term><option>--network-hook-dir=<replaceable
378
>DIR</replaceable></option></term>
379
<listitem>
380
<para>
381
Network hook directory. The default directory is
382
<quote><filename class="directory"
383
>/lib/mandos/network-hooks.d</filename></quote>.
310
384
</para>
311
385
</listitem>
312
386
</varlistentry>
376
450
<refentrytitle>plugin-runner</refentrytitle>
377
451
<manvolnum>8mandos</manvolnum></citerefentry>) is used to run
378
452
both this program and others in in parallel,
379
<emphasis>one</emphasis> of which will prompt for passwords on
380
the system console.
453
<emphasis>one</emphasis> of which (<citerefentry>
454
<refentrytitle>password-prompt</refentrytitle>
455
<manvolnum>8mandos</manvolnum></citerefentry>) will prompt for
456
passwords on the system console.
381
457
</para>
382
458
</refsect1>
383
459
388
464
server could be found and the password received from it could be
389
465
successfully decrypted and output on standard output. The
390
466
program will exit with a non-zero exit status only if a critical
391
error occurs. Otherwise, it will forever connect to new
392
<application>Mandos</application> servers as they appear, trying
393
to get a decryptable password and print it.
467
error occurs. Otherwise, it will forever connect to any
468
discovered <application>Mandos</application> servers, trying to
469
get a decryptable password and print it.
394
470
</para>
395
471
</refsect1>
396
472
397
473
<refsect1 id="environment">
398
474
<title>ENVIRONMENT</title>
475
<variablelist>
476
<varlistentry>
477
<term><envar>MANDOSPLUGINHELPERDIR</envar></term>
478
<listitem>
479
<para>
480
This environment variable will be assumed to contain the
481
directory containing any helper executables. The use and
482
nature of these helper executables, if any, is
483
purposefully not documented.
484
</para>
485
</listitem>
486
</varlistentry>
487
</variablelist>
399
488
<para>
400
This program does not use any environment variables, not even
401
the ones provided by <citerefentry><refentrytitle
489
This program does not use any other environment variables, not
490
even the ones provided by <citerefentry><refentrytitle
402
491
>cryptsetup</refentrytitle><manvolnum>8</manvolnum>
403
492
</citerefentry>.
404
493
</para>
405
494
</refsect1>
406
495
496
<refsect1 id="network-hooks">
497
<title>NETWORK HOOKS</title>
498
<para>
499
If a network interface like a bridge or tunnel is required to
500
find a Mandos server, this requires the interface to be up and
501
running before <command>&COMMANDNAME;</command> starts looking
502
for Mandos servers. This can be accomplished by creating a
503
<quote>network hook</quote> program, and placing it in a special
504
directory.
505
</para>
506
<para>
507
Before the network is used (and again before program exit), any
508
runnable programs found in the network hook directory are run
509
with the argument <quote><literal>start</literal></quote> or
510
<quote><literal>stop</literal></quote>. This should bring up or
511
down, respectively, any network interface which
512
<command>&COMMANDNAME;</command> should use.
513
</para>
514
<refsect2 id="hook-requirements">
515
<title>REQUIREMENTS</title>
516
<para>
517
A network hook must be an executable file, and its name must
518
consist entirely of upper and lower case letters, digits,
519
underscores, periods, and hyphens.
520
</para>
521
<para>
522
A network hook will receive one argument, which can be one of
523
the following:
524
</para>
525
<variablelist>
526
<varlistentry>
527
<term><literal>start</literal></term>
528
<listitem>
529
<para>
530
This should make the network hook create (if necessary)
531
and bring up a network interface.
532
</para>
533
</listitem>
534
</varlistentry>
535
<varlistentry>
536
<term><literal>stop</literal></term>
537
<listitem>
538
<para>
539
This should make the network hook take down a network
540
interface, and delete it if it did not exist previously.
541
</para>
542
</listitem>
543
</varlistentry>
544
<varlistentry>
545
<term><literal>files</literal></term>
546
<listitem>
547
<para>
548
This should make the network hook print, <emphasis>one
549
file per line</emphasis>, all the files needed for it to
550
run. (These files will be copied into the initial RAM
551
filesystem.) Typical use is for a network hook which is
552
a shell script to print its needed binaries.
553
</para>
554
<para>
555
It is not necessary to print any non-executable files
556
already in the network hook directory, these will be
557
copied implicitly if they otherwise satisfy the name
558
requirements.
559
</para>
560
</listitem>
561
</varlistentry>
562
<varlistentry>
563
<term><literal>modules</literal></term>
564
<listitem>
565
<para>
566
This should make the network hook print, <emphasis>on
567
separate lines</emphasis>, all the kernel modules needed
568
for it to run. (These modules will be copied into the
569
initial RAM filesystem.) For instance, a tunnel
570
interface needs the
571
<quote><literal>tun</literal></quote> module.
572
</para>
573
</listitem>
574
</varlistentry>
575
</variablelist>
576
<para>
577
The network hook will be provided with a number of environment
578
variables:
579
</para>
580
<variablelist>
581
<varlistentry>
582
<term><envar>MANDOSNETHOOKDIR</envar></term>
583
<listitem>
584
<para>
585
The network hook directory, specified to
586
<command>&COMMANDNAME;</command> by the
587
<option>--network-hook-dir</option> option. Note: this
588
should <emphasis>always</emphasis> be used by the
589
network hook to refer to itself or any files in the hook
590
directory it may require.
591
</para>
592
</listitem>
593
</varlistentry>
594
<varlistentry>
595
<term><envar>DEVICE</envar></term>
596
<listitem>
597
<para>
598
The network interfaces, as specified to
599
<command>&COMMANDNAME;</command> by the
600
<option>--interface</option> option, combined to one
601
string and separated by commas. If this is set, and
602
does not contain the interface a hook will bring up,
603
there is no reason for a hook to continue.
604
</para>
605
</listitem>
606
</varlistentry>
607
<varlistentry>
608
<term><envar>MODE</envar></term>
609
<listitem>
610
<para>
611
This will be the same as the first argument;
612
i.e. <quote><literal>start</literal></quote>,
613
<quote><literal>stop</literal></quote>,
614
<quote><literal>files</literal></quote>, or
615
<quote><literal>modules</literal></quote>.
616
</para>
617
</listitem>
618
</varlistentry>
619
<varlistentry>
620
<term><envar>VERBOSITY</envar></term>
621
<listitem>
622
<para>
623
This will be the <quote><literal>1</literal></quote> if
624
the <option>--debug</option> option is passed to
625
<command>&COMMANDNAME;</command>, otherwise
626
<quote><literal>0</literal></quote>.
627
</para>
628
</listitem>
629
</varlistentry>
630
<varlistentry>
631
<term><envar>DELAY</envar></term>
632
<listitem>
633
<para>
634
This will be the same as the <option>--delay</option>
635
option passed to <command>&COMMANDNAME;</command>. Is
636
only set if <envar>MODE</envar> is
637
<quote><literal>start</literal></quote> or
638
<quote><literal>stop</literal></quote>.
639
</para>
640
</listitem>
641
</varlistentry>
642
<varlistentry>
643
<term><envar>CONNECT</envar></term>
644
<listitem>
645
<para>
646
This will be the same as the <option>--connect</option>
647
option passed to <command>&COMMANDNAME;</command>. Is
648
only set if <option>--connect</option> is passed and
649
<envar>MODE</envar> is
650
<quote><literal>start</literal></quote> or
651
<quote><literal>stop</literal></quote>.
652
</para>
653
</listitem>
654
</varlistentry>
655
</variablelist>
656
<para>
657
A hook may not read from standard input, and should be
658
restrictive in printing to standard output or standard error
659
unless <varname>VERBOSITY</varname> is
660
<quote><literal>1</literal></quote>.
661
</para>
662
</refsect2>
663
</refsect1>
664
407
665
<refsect1 id="files">
408
666
<title>FILES</title>
409
667
<variablelist>
421
679
</para>
422
680
</listitem>
423
681
</varlistentry>
682
<varlistentry>
683
<term><filename
684
class="directory">/lib/mandos/network-hooks.d</filename></term>
685
<listitem>
686
<para>
687
Directory where network hooks are located. Change this
688
with the <option>--network-hook-dir</option> option. See
689
<xref linkend="network-hooks"/>.
690
</para>
691
</listitem>
692
</varlistentry>
424
693
</variablelist>
425
694
</refsect1>
426
695
427
<!-- <refsect1 id="bugs"> -->
428
<!-- <title>BUGS</title> -->
429
<!-- <para> -->
430
<!-- </para> -->
431
<!-- </refsect1> -->
696
<refsect1 id="bugs">
697
<title>BUGS</title>
698
<xi:include href="../bugs.xml"/>
699
</refsect1>
432
700
433
701
<refsect1 id="example">
434
702
<title>EXAMPLE</title>
440
708
</para>
441
709
<informalexample>
442
710
<para>
443
Normal invocation needs no options, if the network interface
444
is <quote>eth0</quote>:
711
Normal invocation needs no options, if the network interfaces
712
can be automatically determined:
445
713
</para>
446
714
<para>
447
715
<userinput>&COMMANDNAME;</userinput>
449
717
</informalexample>
450
718
<informalexample>
451
719
<para>
452
Search for Mandos servers (and connect to them) using another
453
interface:
720
Search for Mandos servers (and connect to them) using one
721
specific interface:
454
722
</para>
455
723
<para>
456
724
<!-- do not wrap this line -->
520
788
<para>
521
789
It will also help if the checker program on the server is
522
790
configured to request something from the client which can not be
523
spoofed by someone else on the network, unlike unencrypted
524
<acronym>ICMP</acronym> echo (<quote>ping</quote>) replies.
791
spoofed by someone else on the network, like SSH server key
792
fingerprints, and unlike unencrypted <acronym>ICMP</acronym>
793
echo (<quote>ping</quote>) replies.
525
794
</para>
526
795
<para>
527
796
<emphasis>Note</emphasis>: This makes it completely insecure to
535
804
<refsect1 id="see_also">
536
805
<title>SEE ALSO</title>
537
806
<para>
807
<citerefentry><refentrytitle>intro</refentrytitle>
808
<manvolnum>8mandos</manvolnum></citerefentry>,
538
809
<citerefentry><refentrytitle>cryptsetup</refentrytitle>
539
810
<manvolnum>8</manvolnum></citerefentry>,
540
811
<citerefentry><refentrytitle>crypttab</refentrytitle>
618
889
<para>
619
890
This client uses IPv6 link-local addresses, which are
620
891
immediately usable since a link-local addresses is
621
automatically assigned to a network interfaces when it
892
automatically assigned to a network interface when it
622
893
is brought up.
623
894
</para>
624
895
</listitem>
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0