1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
<!ENTITY VERSION "1.0">
4
5
<!ENTITY COMMANDNAME "mandos">
5
<!ENTITY TIMESTAMP "2012-01-01">
6
<!ENTITY % common SYSTEM "common.ent">
6
<!ENTITY OVERVIEW SYSTEM "overview.xml">
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
12
<title>Mandos Manual</title>
11
<title>&COMMANDNAME;</title>
13
12
<!-- NWalsh’s docbook scripts use this to generate the footer: -->
14
<productname>Mandos</productname>
15
<productnumber>&version;</productnumber>
16
<date>&TIMESTAMP;</date>
13
<productname>&COMMANDNAME;</productname>
14
<productnumber>&VERSION;</productnumber>
19
17
<firstname>Björn</firstname>
20
18
<surname>Påhlsson</surname>
22
<email>belorn@recompile.se</email>
20
<email>belorn@fukt.bsnet.se</email>
26
24
<firstname>Teddy</firstname>
27
25
<surname>Hogeborn</surname>
29
<email>teddy@recompile.se</email>
27
<email>teddy@fukt.bsnet.se</email>
39
33
<holder>Teddy Hogeborn</holder>
40
34
<holder>Björn Påhlsson</holder>
42
<xi:include href="legalnotice.xml"/>
38
This manual page is free software: you can redistribute it
39
and/or modify it under the terms of the GNU General Public
40
License as published by the Free Software Foundation,
41
either version 3 of the License, or (at your option) any
46
This manual page is distributed in the hope that it will
47
be useful, but WITHOUT ANY WARRANTY; without even the
48
implied warranty of MERCHANTABILITY or FITNESS FOR A
49
PARTICULAR PURPOSE. See the GNU General Public License
54
You should have received a copy of the GNU General Public
55
License along with this program; If not, see
56
<ulink url="http://www.gnu.org/licenses/"/>.
46
62
<refentrytitle>&COMMANDNAME;</refentrytitle>
47
63
<manvolnum>8</manvolnum>
51
67
<refname><command>&COMMANDNAME;</command></refname>
53
Gives encrypted passwords to authenticated Mandos clients
69
Sends encrypted passwords to authenticated Mandos clients
59
75
<command>&COMMANDNAME;</command>
61
<arg choice="plain"><option>--interface
62
<replaceable>NAME</replaceable></option></arg>
63
<arg choice="plain"><option>-i
64
<replaceable>NAME</replaceable></option></arg>
68
<arg choice="plain"><option>--address
69
<replaceable>ADDRESS</replaceable></option></arg>
70
<arg choice="plain"><option>-a
71
<replaceable>ADDRESS</replaceable></option></arg>
75
<arg choice="plain"><option>--port
76
<replaceable>PORT</replaceable></option></arg>
77
<arg choice="plain"><option>-p
78
<replaceable>PORT</replaceable></option></arg>
81
<arg><option>--priority
82
<replaceable>PRIORITY</replaceable></option></arg>
84
<arg><option>--servicename
85
<replaceable>NAME</replaceable></option></arg>
87
<arg><option>--configdir
88
<replaceable>DIRECTORY</replaceable></option></arg>
90
<arg><option>--debug</option></arg>
92
<arg><option>--debuglevel
93
<replaceable>LEVEL</replaceable></option></arg>
95
<arg><option>--no-dbus</option></arg>
97
<arg><option>--no-ipv6</option></arg>
99
<arg><option>--no-restore</option></arg>
101
<arg><option>--statedir
102
<replaceable>DIRECTORY</replaceable></option></arg>
76
<arg>--interface<arg choice="plain">IF</arg></arg>
77
<arg>--address<arg choice="plain">ADDRESS</arg></arg>
78
<arg>--port<arg choice="plain">PORT</arg></arg>
79
<arg>--priority<arg choice="plain">PRIORITY</arg></arg>
80
<arg>--servicename<arg choice="plain">NAME</arg></arg>
81
<arg>--configdir<arg choice="plain">DIRECTORY</arg></arg>
85
<command>&COMMANDNAME;</command>
86
<arg>-i<arg choice="plain">IF</arg></arg>
87
<arg>-a<arg choice="plain">ADDRESS</arg></arg>
88
<arg>-p<arg choice="plain">PORT</arg></arg>
89
<arg>--priority<arg choice="plain">PRIORITY</arg></arg>
90
<arg>--servicename<arg choice="plain">NAME</arg></arg>
91
<arg>--configdir<arg choice="plain">DIRECTORY</arg></arg>
105
95
<command>&COMMANDNAME;</command>
106
96
<group choice="req">
107
<arg choice="plain"><option>--help</option></arg>
108
<arg choice="plain"><option>-h</option></arg>
97
<arg choice="plain">-h</arg>
98
<arg choice="plain">--help</arg>
112
102
<command>&COMMANDNAME;</command>
113
<arg choice="plain"><option>--version</option></arg>
103
<arg choice="plain">--version</arg>
116
106
<command>&COMMANDNAME;</command>
117
<arg choice="plain"><option>--check</option></arg>
107
<arg choice="plain">--check</arg>
119
109
</refsynopsisdiv>
121
111
<refsect1 id="description">
122
112
<title>DESCRIPTION</title>
124
114
<command>&COMMANDNAME;</command> is a server daemon which
125
115
handles incoming request for passwords for a pre-defined list of
126
client host computers. For an introduction, see
127
<citerefentry><refentrytitle>intro</refentrytitle>
128
<manvolnum>8mandos</manvolnum></citerefentry>. The Mandos server
129
uses Zeroconf to announce itself on the local network, and uses
130
TLS to communicate securely with and to authenticate the
131
clients. The Mandos server uses IPv6 to allow Mandos clients to
132
use IPv6 link-local addresses, since the clients will probably
133
not have any other addresses configured (see <xref
134
linkend="overview"/>). Any authenticated client is then given
135
the stored pre-encrypted password for that specific client.
116
client host computers. The Mandos server uses Zeroconf to
117
announce itself on the local network, and uses TLS to
118
communicate securely with and to authenticate the clients. The
119
Mandos server uses IPv6 to allow Mandos clients to use IPv6
120
link-local addresses, since the clients will probably not have
121
any other addresses configured (see <xref linkend="overview"/>).
122
Any authenticated client is then given the stored pre-encrypted
123
password for that specific client.
139
128
<refsect1 id="purpose">
140
129
<title>PURPOSE</title>
142
132
The purpose of this is to enable <emphasis>remote and unattended
143
133
rebooting</emphasis> of client host computer with an
144
134
<emphasis>encrypted root file system</emphasis>. See <xref
145
135
linkend="overview"/> for details.
149
140
<refsect1 id="options">
150
141
<title>OPTIONS</title>
153
<term><option>--help</option></term>
154
<term><option>-h</option></term>
145
<term><literal>-h</literal>, <literal>--help</literal></term>
157
148
Show a help message and exit
163
<term><option>--interface</option>
164
<replaceable>NAME</replaceable></term>
165
<term><option>-i</option>
166
<replaceable>NAME</replaceable></term>
168
<xi:include href="mandos-options.xml" xpointer="interface"/>
173
<term><option>--address
174
<replaceable>ADDRESS</replaceable></option></term>
176
<replaceable>ADDRESS</replaceable></option></term>
178
<xi:include href="mandos-options.xml" xpointer="address"/>
184
<replaceable>PORT</replaceable></option></term>
186
<replaceable>PORT</replaceable></option></term>
188
<xi:include href="mandos-options.xml" xpointer="port"/>
193
<term><option>--check</option></term>
154
<term><literal>-i</literal>, <literal>--interface <replaceable>
155
IF</replaceable></literal></term>
158
Only announce the server and listen to requests on network
159
interface <replaceable>IF</replaceable>. Default is to
160
use all available interfaces. <emphasis>Note:</emphasis>
161
a failure to bind to the specified interface is not
162
considered critical, and the server does not exit.
168
<term><literal>-a</literal>, <literal>--address <replaceable>
169
ADDRESS</replaceable></literal></term>
172
If this option is used, the server will only listen to a
173
specific address. This must currently be an IPv6 address;
174
an IPv4 address can be specified using the
175
<quote><literal>::FFFF:192.0.2.3</literal></quote> syntax.
176
Also, if a link-local address is specified, an interface
177
should be set, since a link-local address is only valid on
178
a single interface. By default, the server will listen to
179
all available addresses.
185
<term><literal>-p</literal>, <literal>--port <replaceable>
186
PORT</replaceable></literal></term>
189
If this option is used, the server to bind to that
190
port. By default, the server will listen to an arbitrary
191
port given by the operating system.
197
<term><literal>--check</literal></term>
196
200
Run the server’s self-tests. This includes any unit
203
<term><option>--debug</option></term>
205
<xi:include href="mandos-options.xml" xpointer="debug"/>
210
<term><option>--debuglevel
211
<replaceable>LEVEL</replaceable></option></term>
214
Set the debugging log level.
215
<replaceable>LEVEL</replaceable> is a string, one of
216
<quote><literal>CRITICAL</literal></quote>,
217
<quote><literal>ERROR</literal></quote>,
218
<quote><literal>WARNING</literal></quote>,
219
<quote><literal>INFO</literal></quote>, or
220
<quote><literal>DEBUG</literal></quote>, in order of
221
increasing verbosity. The default level is
222
<quote><literal>WARNING</literal></quote>.
228
<term><option>--priority <replaceable>
229
PRIORITY</replaceable></option></term>
231
<xi:include href="mandos-options.xml" xpointer="priority"/>
236
<term><option>--servicename
237
<replaceable>NAME</replaceable></option></term>
239
<xi:include href="mandos-options.xml"
240
xpointer="servicename"/>
245
<term><option>--configdir
246
<replaceable>DIRECTORY</replaceable></option></term>
207
<term><literal>--debug</literal></term>
210
If the server is run in debug mode, it will run in the
211
foreground and print a lot of debugging information. The
212
default is <emphasis>not</emphasis> to run in debug mode.
218
<term><literal>--priority <replaceable>
219
PRIORITY</replaceable></literal></term>
222
GnuTLS priority string for the TLS handshake with the
223
clients. The default is
224
<quote><literal>SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP</literal></quote>.
225
See <citerefentry><refentrytitle>gnutls_priority_init
226
</refentrytitle><manvolnum>3</manvolnum></citerefentry>
227
for the syntax. <emphasis>Warning</emphasis>: changing
228
this may make the TLS handshake fail, making communication
229
with clients impossible.
235
<term><literal>--servicename <replaceable>NAME</replaceable>
239
Zeroconf service name. The default is
240
<quote><literal>Mandos</literal></quote>. This only needs
241
to be changed this if it, for some reason, is necessary to
242
run more than one server on the same
243
<emphasis>host</emphasis>, which would not normally be
244
useful. If there are name collisions on the same
245
<emphasis>network</emphasis>, the newer server will
246
automatically rename itself to <quote><literal>Mandos
247
#2</literal></quote>, and so on; therefore, this option is
248
not needed in that case.
254
<term><literal>--configdir <replaceable>DIR</replaceable>
249
258
Directory to search for configuration files. Default is
367
344
</tbody></tgroup></table>
370
347
<refsect1 id="checking">
371
348
<title>CHECKING</title>
373
350
The server will, by default, continually check that the clients
374
351
are still up. If a client has not been confirmed as being up
375
352
for some time, the client is assumed to be compromised and is no
376
longer eligible to receive the encrypted password. (Manual
377
intervention is required to re-enable a client.) The timeout,
378
extended timeout, checker program, and interval between checks
379
can be configured both globally and per client; see
380
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
381
<manvolnum>5</manvolnum></citerefentry>. A client successfully
382
receiving its password will also be treated as a successful
387
<refsect1 id="approval">
388
<title>APPROVAL</title>
390
The server can be configured to require manual approval for a
391
client before it is sent its secret. The delay to wait for such
392
approval and the default action (approve or deny) can be
393
configured both globally and per client; see <citerefentry>
353
longer eligible to receive the encrypted password. The timeout,
354
checker program, and interval between checks can be configured
355
both globally and per client; see <citerefentry>
356
<refentrytitle>mandos.conf</refentrytitle>
357
<manvolnum>5</manvolnum></citerefentry> and <citerefentry>
394
358
<refentrytitle>mandos-clients.conf</refentrytitle>
395
<manvolnum>5</manvolnum></citerefentry>. By default all clients
396
will be approved immediately without delay.
399
This can be used to deny a client its secret if not manually
400
approved within a specified time. It can also be used to make
401
the server delay before giving a client its secret, allowing
402
optional manual denying of this specific client.
359
<manvolnum>5</manvolnum></citerefentry>.
407
363
<refsect1 id="logging">
408
364
<title>LOGGING</title>
410
The server will send log message with various severity levels to
411
<filename class="devicefile">/dev/log</filename>. With the
366
The server will send log messaged with various severity levels
367
to <filename>/dev/log</filename>. With the
412
368
<option>--debug</option> option, it will log even more messages,
413
369
and also show them on the console.
417
<refsect1 id="dbus_interface">
418
<title>D-BUS INTERFACE</title>
420
The server will by default provide a D-Bus system bus interface.
421
This interface will only be accessible by the root user or a
422
Mandos-specific user, if such a user exists. For documentation
423
of the D-Bus API, see the file <filename>DBUS-API</filename>.
427
373
<refsect1 id="exit_status">
428
374
<title>EXIT STATUS</title>
614
556
compromised if they are gone for too long.
559
If a client is compromised, its downtime should be duly noted
560
by the server which would therefore declare the client
561
invalid. But if the server was ever restarted, it would
562
re-read its client list from its configuration file and again
563
regard all clients therein as valid, and hence eligible to
564
receive their passwords. Therefore, be careful when
565
restarting servers if it is suspected that a client has, in
566
fact, been compromised by parties who may now be running a
567
fake Mandos client with the keys from the non-encrypted
568
initial RAM image of the client host. What should be done in
569
that case (if restarting the server program really is
570
necessary) is to stop the server program, edit the
571
configuration file to omit any suspect clients, and restart
617
575
For more details on client-side security, see
618
<citerefentry><refentrytitle>mandos-client</refentrytitle>
576
<citerefentry><refentrytitle>password-request</refentrytitle>
619
577
<manvolnum>8mandos</manvolnum></citerefentry>.
624
582
<refsect1 id="see_also">
625
583
<title>SEE ALSO</title>
627
<citerefentry><refentrytitle>intro</refentrytitle>
628
<manvolnum>8mandos</manvolnum></citerefentry>,
629
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
630
<manvolnum>5</manvolnum></citerefentry>,
631
<citerefentry><refentrytitle>mandos.conf</refentrytitle>
632
<manvolnum>5</manvolnum></citerefentry>,
633
<citerefentry><refentrytitle>mandos-client</refentrytitle>
634
<manvolnum>8mandos</manvolnum></citerefentry>,
635
<citerefentry><refentrytitle>sh</refentrytitle>
636
<manvolnum>1</manvolnum></citerefentry>
588
<refentrytitle>password-request</refentrytitle>
589
<manvolnum>8mandos</manvolnum>
594
This is the actual program which talks to this server.
595
Note that it is normally not invoked directly, and is only
596
run in the initial RAM disk environment, and not on a
597
fully started system.
641
603
<ulink url="http://www.zeroconf.org/">Zeroconf</ulink>
676
RFC 4291: <citetitle>IP Version 6 Addressing
677
Architecture</citetitle>
638
<citation>RFC 4291: <citetitle>IP Version 6 Addressing
639
Architecture</citetitle>, section 2.5.6, Link-Local IPv6
640
Unicast Addresses</citation>
682
<term>Section 2.2: <citetitle>Text Representation of
683
Addresses</citetitle></term>
684
<listitem><para/></listitem>
687
<term>Section 2.5.5.2: <citetitle>IPv4-Mapped IPv6
688
Address</citetitle></term>
689
<listitem><para/></listitem>
692
<term>Section 2.5.6, <citetitle>Link-Local IPv6 Unicast
693
Addresses</citetitle></term>
696
The clients use IPv6 link-local addresses, which are
697
immediately usable since a link-local addresses is
698
automatically assigned to a network interfaces when it
644
The clients use IPv6 link-local addresses, which are
645
immediately usable since a link-local addresses is
646
automatically assigned to a network interfaces when it is
708
RFC 4346: <citetitle>The Transport Layer Security (TLS)
709
Protocol Version 1.1</citetitle>
653
<citation>RFC 4346: <citetitle>The Transport Layer Security
654
(TLS) Protocol Version 1.1</citetitle></citation>