/mandos/trunk : revision 965

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to plugins.d/mandos-client.xml

Committer: Teddy Hogeborn
Date: 2019-02-09 23:36:11 UTC
Revision ID: teddy@recompile.se-20190209233611-qurtq0kpsoct9uwf

Doc fix: Minor clarification

* mandos-clients.conf.xml (OPTIONS/checker): Be more clear that it's
specifically an SSH key fingerprint that is being compared, and no
other kind of fingerprint.

Show diffs side-by-side

added added

removed removed

plugins.d/mandos-client.xml

<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

<!ENTITY COMMANDNAME "mandos-client">

<!ENTITY TIMESTAMP "2018-02-08">

<!ENTITY TIMESTAMP "2019-02-09">

<!ENTITY % common SYSTEM "../common.ent">

%common;

</group>

<sbr/>

<group>

<arg choice="plain"><option>--tls-privkey

100

101

<arg choice="plain"><option>-t

102

103

</group>

104

<sbr/>

105

<group>

106

<arg choice="plain"><option>--tls-pubkey

107

108

<arg choice="plain"><option>-T

109

110

</group>

111

<sbr/>

112

<arg>

113

<option>--priority <replaceable>STRING</replaceable></option>

100

114

</arg>

154

168

brings up network interfaces, uses the interfaces’ IPv6

155

169

link-local addresses to get network connectivity, uses Zeroconf

156

170

to find servers on the local network, and communicates with

157

servers using TLS with an OpenPGP key to ensure authenticity and

158

confidentiality. This client program keeps running, trying all

159

servers on the network, until it receives a satisfactory reply

160

or a TERM signal. After all servers have been tried, all

171

servers using TLS with a raw public key to ensure authenticity

172

and confidentiality. This client program keeps running, trying

173

all servers on the network, until it receives a satisfactory

174

reply or a TERM signal. After all servers have been tried, all

161

175

servers are periodically retried. If no servers are found it

162

176

will wait indefinitely for new servers to appear.

163

177

</para>

307

321

</varlistentry>

308

322

309

323

324

<term><option>--tls-pubkey=<replaceable

325

>FILE</replaceable></option></term>

326

<term><option>-T

327

328

329

<para>

330

TLS raw public key file name. The default name is

331

<quote><filename>/conf/conf.d/mandos/tls-pubkey.pem</filename

332

></quote>.

333

</para>

334

</listitem>

335

</varlistentry>

336

337

338

<term><option>--tls-privkey=<replaceable

339

>FILE</replaceable></option></term>

340

<term><option>-t

341

342

343

<para>

344

TLS secret key file name. The default name is

345

<quote><filename>/conf/conf.d/mandos/tls-privkey.pem</filename

346

></quote>.

347

</para>

348

</listitem>

349

</varlistentry>

350

351

310

352

<term><option>--priority=<replaceable

311

353

>STRING</replaceable></option></term>

312

354

322

364

<para>

323

365

Sets the number of bits to use for the prime number in the

324

366

TLS Diffie-Hellman key exchange. The default value is

325

selected automatically based on the OpenPGP key. Note

326

that if the <option>--dh-params</option> option is used,

327

the values from that file will be used instead.

367

selected automatically based on the GnuTLS security

368

profile set in its priority string. Note that if the

369

<option>--dh-params</option> option is used, the values

370

from that file will be used instead.

328

371

</para>

329

372

</listitem>

330

373

</varlistentry>

682

725

</listitem>

683

726

</varlistentry>

684

727

728

<term><filename>/conf/conf.d/mandos/tls-pubkey.pem</filename

729

></term>

730

<term><filename>/conf/conf.d/mandos/tls-privkey.pem</filename

731

></term>

732

733

<para>

734

Public and private raw key files, in <quote>PEM</quote>

735

format. These are the default file names, they can be

736

changed with the <option>--tls-pubkey</option> and

737

<option>--tls-privkey</option> options.

738

</para>

739

</listitem>

740

</varlistentry>

741

685

742

<term><filename

686

743

class="directory">/lib/mandos/network-hooks.d</filename></term>

687

744

729

786

</informalexample>

730

787

731

788

<para>

732

Run in debug mode, and use a custom key:

789

Run in debug mode, and use custom keys:

733

790

</para>

734

791

<para>

735

792

736

793

737

<userinput>&COMMANDNAME; --debug --pubkey keydir/pubkey.txt --seckey keydir/seckey.txt</userinput>

794

<userinput>&COMMANDNAME; --debug --pubkey keydir/pubkey.txt --seckey keydir/seckey.txt --tls-pubkey keydir/tls-pubkey.pem --tls-privkey keydir/tls-privkey.pem</userinput>

738

795

739

796

</para>

740

797

</informalexample>

741

798

742

799

<para>

743

Run in debug mode, with a custom key, and do not use Zeroconf

800

Run in debug mode, with custom keys, and do not use Zeroconf

744

801

to locate a server; connect directly to the IPv6 link-local

745

802

address <quote><systemitem class="ipaddress"

746

803

>fe80::aede:48ff:fe71:f6f2</systemitem></quote>, port 4711,

749

806

<para>

750

807

751

808

752

<userinput>&COMMANDNAME; --debug --pubkey keydir/pubkey.txt --seckey keydir/seckey.txt --connect fe80::aede:48ff:fe71:f6f2:4711 --interface eth2</userinput>

809

<userinput>&COMMANDNAME; --debug --pubkey keydir/pubkey.txt --seckey keydir/seckey.txt --tls-pubkey keydir/tls-pubkey.pem --tls-privkey keydir/tls-privkey.pem --connect fe80::aede:48ff:fe71:f6f2:4711 --interface eth2</userinput>

753

810

754

811

</para>

755

812

</informalexample>

779

836

<para>

780

837

The only remaining weak point is that someone with physical

781

838

access to the client hard drive might turn off the client

782

computer, read the OpenPGP keys directly from the hard drive,

783

and communicate with the server. To safeguard against this, the

784

server is supposed to notice the client disappearing and stop

785

giving out the encrypted data. Therefore, it is important to

786

set the timeout and checker interval values tightly on the

787

server. See <citerefentry><refentrytitle

839

computer, read the OpenPGP and TLS keys directly from the hard

840

drive, and communicate with the server. To safeguard against

841

this, the server is supposed to notice the client disappearing

842

and stop giving out the encrypted data. Therefore, it is

843

important to set the timeout and checker interval values tightly

844

on the server. See <citerefentry><refentrytitle

788

845

>mandos</refentrytitle><manvolnum>8</manvolnum></citerefentry>.

789

846

</para>

790

847

<para>

850

907

<para>

851

908

GnuTLS is the library this client uses to implement TLS for

852

909

communicating securely with the server, and at the same time

853

send the public OpenPGP key to the server.

910

send the public key to the server.

854

911

</para>

855

912

</listitem>

856

913

</varlistentry>

922

979

</varlistentry>

923

980

924

981

<term>

982

RFC 7250: <citetitle>Using Raw Public Keys in Transport

983

Layer Security (TLS) and Datagram Transport Layer Security

984

(DTLS)</citetitle>

985

</term>

986

987

<para>

988

This is implemented by GnuTLS in version 3.6.6 and is, if

989

present, used by this program so that raw public keys can be

990

used.

991

</para>

992

</listitem>

993

</varlistentry>

994

995

<term>

925

996

RFC 6091: <citetitle>Using OpenPGP Keys for Transport Layer

926

997

Security</citetitle>

927

998

</term>

928

999

929

1000

<para>

930

This is implemented by GnuTLS and used by this program so

931

that OpenPGP keys can be used.

1001

This is implemented by GnuTLS before version 3.6.0 and is,

1002

if present, used by this program so that OpenPGP keys can be

1003

used.

932

1004

</para>

933

1005

</listitem>

934

1006

</varlistentry>

Older »