/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-clients.conf.xml

  • Committer: Teddy Hogeborn
  • Date: 2019-02-10 03:50:20 UTC
  • Revision ID: teddy@recompile.se-20190210035020-nttr1tybgwwixueu
http://bugs.debian.org/879538
http://bugs.debian.org/916673
Show debconf note about new TLS key IDs

If mandos-client did not see TLS keys and had to create them, or if
mandos sees GnuTLS version 3.6.6 or later, show an important notice on
package installation about the importance of adding the new key_id
options to clients.conf on the Mandos server.

* debian/control (Package: mandos, Package: mandos-client): Depend on
                                                            debconf.
* debian/mandos-client.lintian-overrides: Override warnings.
* debian/mandos-client.postinst (create_keys): Show notice if new TLS
                                               key files were created.
* debian/mandos-client.templates: New.
* debian/mandos.lintian-overrides: Override warnings.
* debian/mandos.postinst (configure): If GnuTLS 3.6.6 or later is
                                      detected, show an important
                                      notice (once) about the new
                                      key_id option required in
                                      clients.conf.
* debian/mandos.templates: New.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-clients.conf.xml
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY CONFNAME "mandos-clients.conf">
5
5
<!ENTITY CONFPATH "<filename>/etc/mandos/clients.conf</filename>">
6
 
<!ENTITY TIMESTAMP "2013-10-15">
 
6
<!ENTITY TIMESTAMP "2019-02-09">
7
7
<!ENTITY % common SYSTEM "common.ent">
8
8
%common;
9
9
]>
37
37
      <year>2010</year>
38
38
      <year>2011</year>
39
39
      <year>2012</year>
 
40
      <year>2013</year>
 
41
      <year>2014</year>
 
42
      <year>2015</year>
 
43
      <year>2016</year>
 
44
      <year>2017</year>
 
45
      <year>2018</year>
40
46
      <holder>Teddy Hogeborn</holder>
41
47
      <holder>Björn Påhlsson</holder>
42
48
    </copyright>
177
183
            <varname>PATH</varname> will be searched.  The default
178
184
            value for the checker command is <quote><literal
179
185
            ><command>fping</command> <option>-q</option> <option
180
 
            >--</option> %%(host)s</literal></quote>.
 
186
            >--</option> %%(host)s</literal></quote>.  Note that
 
187
            <command>mandos-keygen</command>, when generating output
 
188
            to be inserted into this file, normally looks for an SSH
 
189
            server on the Mandos client, and, if it finds one, outputs
 
190
            a <option>checker</option> option to check for the
 
191
            client’s SSH key fingerprint – this is more secure against
 
192
            spoofing.
181
193
          </para>
182
194
          <para>
183
195
            In addition to normal start time expansion, this option
220
232
          <para>
221
233
            This option sets the OpenPGP fingerprint that identifies
222
234
            the public key that clients authenticate themselves with
223
 
            through TLS.  The string needs to be in hexidecimal form,
 
235
            through TLS.  The string needs to be in hexadecimal form,
 
236
            but spaces or upper/lower case are not significant.
 
237
          </para>
 
238
        </listitem>
 
239
      </varlistentry>
 
240
      
 
241
      <varlistentry>
 
242
        <term><option>key_id<literal> = </literal
 
243
        ><replaceable>HEXSTRING</replaceable></option></term>
 
244
        <listitem>
 
245
          <para>
 
246
            This option is <emphasis>optional</emphasis>.
 
247
          </para>
 
248
          <para>
 
249
            This option sets the certificate key ID that identifies
 
250
            the public key that clients authenticate themselves with
 
251
            through TLS.  The string needs to be in hexadecimal form,
224
252
            but spaces or upper/lower case are not significant.
225
253
          </para>
226
254
        </listitem>
302
330
          <para>
303
331
            If present, this option must be set to a string of
304
332
            base64-encoded binary data.  It will be decoded and sent
305
 
            to the client matching the above
306
 
            <option>fingerprint</option>.  This should, of course, be
307
 
            OpenPGP encrypted data, decryptable only by the client.
 
333
            to the client matching the above <option>key_id</option>
 
334
            or <option>fingerprint</option>.  This should, of course,
 
335
            be OpenPGP encrypted data, decryptable only by the client.
308
336
            The program <citerefentry><refentrytitle><command
309
337
            >mandos-keygen</command></refentrytitle><manvolnum
310
338
            >8</manvolnum></citerefentry> can, using its
405
433
        <quote><literal>created</literal></quote>,
406
434
        <quote><literal>enabled</literal></quote>,
407
435
        <quote><literal>expires</literal></quote>,
 
436
        <quote><literal>key_id</literal></quote>,
408
437
        <quote><literal>fingerprint</literal></quote>,
409
438
        <quote><literal>host</literal></quote>,
410
439
        <quote><literal>interval</literal></quote>,
453
482
      <literal>%(<replaceable>foo</replaceable>)s</literal> is
454
483
      obscure.
455
484
    </para>
 
485
    <xi:include href="bugs.xml"/>
456
486
  </refsect1>
457
487
  
458
488
  <refsect1 id="example">
466
496
 
467
497
# Client "foo"
468
498
[foo]
 
499
key_id = 788cd77115cd0bb7b2d5e0ae8496f6b48149d5e712c652076b1fd2d957ef7c1f
469
500
fingerprint =  7788 2722 5BA7 DE53 9C5A  7CFA 59CF F7CD BD9A 5920
470
501
secret =
471
502
        hQIOA6QdEjBs2L/HEAf/TCyrDe5Xnm9esa+Pb/vWF9CUqfn4srzVgSu234
488
519
 
489
520
# Client "bar"
490
521
[bar]
 
522
key_id = F90C7A81D72D1EA69A51031A91FF8885F36C8B46D155C8C58709A4C99AE9E361
491
523
fingerprint = 3e393aeaefb84c7e89e2f547b3a107558fca3a27
492
524
secfile = /etc/mandos/bar-secret
493
525
timeout = PT15M