/mandos/trunk : revision 971

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to debian/mandos.templates

Committer: Teddy Hogeborn
Date: 2019-02-10 08:41:14 UTC
Revision ID: teddy@recompile.se-20190210084114-u91mijrxtifvzra5

Bug fix: Only create TLS key with certtool, and read correct key file

* debian/mandos-client.postinst (create_keys): Remove any bad keys
                                               created by 1.8.0-1.
                                               Only create TLS keys if
                                               certtool succeeds.
* debian/mandos.postinst (configure): Remove any bad keys from
                                      clients.conf, and inform the
                                      user if any were found.
* debian/mandos.templates (mandos/removed_bad_key_ids): New message.
* mandos (MandosServer.handle_ipc): Do not trust a key_id with a known
                                    bad key ID.
* mandos-keygen (keygen): Only create TLS keys if certtool succeeds.
  (password): Bug fix: Generate key_id correctly, and only output
              key_id if TLS key exists.

Show diffs side-by-side

added added

removed removed

debian/mandos.templates

mandos-keygen -F/dev/null|grep ^key_id

Note: the clients must all also be using GnuTLS 3.6.6 or later; the server cannot serve passwords for both old and new clients!

Note: the client must all also be using GnuTLS 3.6.6 or later; the server cannot serve passwords for both old and new clients!

Rationale: With GnuTLS 3.6.6, Mandos has been forced to stop using OpenPGP keys as TLS session keys. A new TLS key pair will be generated on each client and will be used as identification, but the key ID of the public key needs to be added to this server, since this will now be used to identify the client to the server.

Template: mandos/removed_bad_key_ids

Type: note

Description: Bad key IDs have been removed from clients.conf

Bad key IDs, which were created by a bug in Mandos client 1.8.0, have been removed from /etc/mandos/clients.conf

Bad key IDs, which were reported by a bug in Mandos client 1.8.0, have been removed from /etc/mandos/clients.conf

Older »