=== added file 'clients.conf.xml'
--- clients.conf.xml 1970-01-01 00:00:00 +0000
+++ clients.conf.xml 2008-08-08 01:31:58 +0000
@@ -0,0 +1,248 @@
+
+
+
+
+/etc/mandos/clients.conf">
+]>
+
+
+
+ &CONFNAME;
+
+ &CONFNAME;
+ &VERSION;
+
+
+ Björn
+ Påhlsson
+
+ belorn@fukt.bsnet.se
+
+
+
+ Teddy
+ Hogeborn
+
+ teddy@fukt.bsnet.se
+
+
+
+
+ 2008
+ Teddy Hogeborn & Björn Påhlsson
+
+
+
+ This manual page is free software: you can redistribute it
+ and/or modify it under the terms of the GNU General Public
+ License as published by the Free Software Foundation,
+ either version 3 of the License, or (at your option) any
+ later version.
+
+
+
+ This manual page is distributed in the hope that it will
+ be useful, but WITHOUT ANY WARRANTY; without even the
+ implied warranty of MERCHANTABILITY or FITNESS FOR A
+ PARTICULAR PURPOSE. See the GNU General Public License
+ for more details.
+
+
+
+ You should have received a copy of the GNU General Public
+ License along with this program; If not, see
+ .
+
+
+
+
+
+ &CONFNAME;
+ 5
+
+
+
+ &CONFNAME;
+
+ Configuration file for Mandos clients
+
+
+
+
+
+ &CONFPATH;
+
+
+
+
+ DESCRIPTION
+
+ The file &CONFPATH; is the configuration file for mandos where
+ each client that will be abel to use the service need to be
+ specified. The configuration file is looked on at the startup of
+ the service, so to reenable timedout clients one need to only
+ restart the server. The format starts with a section under []
+ which is eather [DEFAULT] or a client
+ name. Values is set through the use of VAR = VALUE pair. Values
+ may not be empty.
+
+
+
+
+ DEFAULT
+
+ The paramters for [DEFAULT] are:
+
+
+
+
+
+ timeout
+
+
+ This option allows you to override the default timeout
+ that clients will get. By default mandos will use 1hr.
+
+
+
+
+
+ interval
+
+
+ This option allows you to override the default interval
+ used between checkups for disconnected clients. By default
+ mandos will use 5m.
+
+
+
+
+
+ checker
+
+
+ This option allows you to override the default shell
+ command that the server will use to check up if the client
+ is still up. By default mandos will "fping -q -- %%(fqdn)s"
+
+
+
+
+
+
+
+
+ CLIENTS
+
+ The paramters for clients are:
+
+
+
+
+
+ fingerprint
+
+
+ This option sets the openpgp fingerprint that identifies
+ the public certificate that clients authenticates themself
+ through gnutls. The string need to be in hex-decimal form.
+
+
+
+
+
+ secret
+
+
+ Base 64 encoded OpenPGP encrypted password encrypted by
+ the clients openpgp certificate.
+
+
+
+
+
+ secfile
+
+
+ Base 64 encoded OpenPGP encrypted password encrypted by
+ the clients openpgp certificate as a binary file.
+
+
+
+
+
+ fqdn
+
+
+ FQDN, that can be used in for checking that the client is up.
+
+
+
+
+
+ checker
+
+
+ Shell command that the server will use to check up if the
+ client is still up.
+
+
+
+
+
+ timeout
+
+
+ Duration that a client can be down whitout be removed from
+ the client list.
+
+
+
+
+
+
+
+
+ EXAMPLES
+
+
+[DEFAULT]
+timeout = 1h
+interval = 5m
+checker = fping -q -- %%(fqdn)s
+
+[example_client]
+fingerprint = 7788 2722 5BA7 DE53 9C5A 7CFA 59CF F7CD BD9A 5920
+
+secret =
+hQIOA6QdEjBs2L/HEAf/TCyrDe5Xnm9esa+Pb/vWF9CUqfn4srzVgSu234REJMVv
+7lBSrPE2132Lmd2gqF1HeLKDJRSVxJpt6xoWOChGHg+TMyXDxK+NXl89vGvdU1Xf
+hKkVm9MDLOgT5ECDPysDGHFPDhqHOSu3Kaw2DWMV/iH9vz3Z20erVNbdcvyBnuoj
+coWO/6yfB5EQO0BXp7kcyy00USA3CjD5FGZdoQGITb8A/ar0tVA5crSQmaSotm6K
+mNLhrFnZ5BxX+TiE+eTUTqSloWRY6VAvqWQHC7OASxK5E6RXPBuFH5IohUA2Qbk5
+AHt99pYvsIPX88j2rWauOokoiKZot/9leJ8VxO5l3wf/U64IH8bkPIoWmWZfd/nq
+h4uwGNbCgKMyT+AnvH7kMJ3i7DivfWl2mKLV0PyPHUNva0VQxX6yYjcOhj1R6fCr
+/at8/NSLe2OhLchzdC+Ls9h+kvJXgF8Sisv+Wk/1RadPLFmraRlqvJwt6Ww21Lpi
+XqXHV2mIgqWnR98YgSvUi3TJHrUQiNc9YyBzuRo0AjgG2C9qiE3FM+Y28+iQ/sR3
++bFszYuZKVTObqiIslwXu7imO0cvvFRgJF/6u3HNFQ4LUTGhiM3FQmC6NNlF3/vJ
+M2hwRDMcJqDd54Twx90Wh+tYz0z7QMsK4ANXWHHWHR0JchnLWmenzbtW5MHdW9AY
+sNJZAQSOpirE4Xi31CSlWAi9KV+cUCmWF5zOFy1x23P6PjdaRm4T2zw4dxS5NswX
+WU0sVEXxjs6PYxuIiCTL7vdpx8QjBkrPWDrAbcMyBr2OQlnHIvPzEArRQLo=
+=iHhv
+
+fqdn = localhost
+interval = 5m
+
+
+
+
+
+ FILES
+
+ The file described here is &CONFPATH;
+
+
+
=== added file 'mandos-client.xml'
--- mandos-client.xml 1970-01-01 00:00:00 +0000
+++ mandos-client.xml 2008-08-08 01:31:58 +0000
@@ -0,0 +1,194 @@
+
+
+
+
+]>
+
+
+
+ &COMMANDNAME;
+
+ &COMMANDNAME;
+ &VERSION;
+
+
+ Björn
+ Påhlsson
+
+ belorn@fukt.bsnet.se
+
+
+
+ Teddy
+ Hogeborn
+
+ teddy@fukt.bsnet.se
+
+
+
+
+ 2008
+ Teddy Hogeborn & Björn Påhlsson
+
+
+
+ This manual page is free software: you can redistribute it
+ and/or modify it under the terms of the GNU General Public
+ License as published by the Free Software Foundation,
+ either version 3 of the License, or (at your option) any
+ later version.
+
+
+
+ This manual page is distributed in the hope that it will
+ be useful, but WITHOUT ANY WARRANTY; without even the
+ implied warranty of MERCHANTABILITY or FITNESS FOR A
+ PARTICULAR PURPOSE. See the GNU General Public License
+ for more details.
+
+
+
+ You should have received a copy of the GNU General Public
+ License along with this program; If not, see
+ .
+
+
+
+
+
+ &COMMANDNAME;
+ 8mandos
+
+
+
+ &COMMANDNAME;
+
+ get password for encrypted rootdisk
+
+
+
+
+
+ &COMMANDNAME;
+ OPTION
+
+
+
+
+ DESCRIPTION
+
+ &COMMANDNAME; is a plugin runner that waits
+ for any of its plugins to return sucessfull with a password, and
+ passes it to cryptsetup. plugins is defined as any executables
+ in the plugins directory will by default will be
+ /conf/conf.d/mandos/plugins.d. to stdout.
+
+
+
+
+ -g,--global-options
+ OPTIONS
+
+
+ Global options given to all plugins as additional start
+ arguments. Options are specified with a -o flag followed
+ by a comma separated string of options.
+
+
+
+
+
+ -o, --options-for
+ PLUGIN:OPTION
+
+
+
+ Plugin specific options given to the plugin as additional
+ start arguments. Options are specified with a -o flag
+ followed by a comma separated string of options.
+
+
+
+
+
+ -d, --disable
+ PLUGIN
+
+
+
+ Disable a specific plugin
+
+
+
+
+
+ --groupid ID
+
+
+
+ Group ID the plugins will run as
+
+
+
+
+
+ --userid ID
+
+
+
+ User ID the plugins will run as
+
+
+
+
+
+ --plugin-dir DIRECTORY
+
+
+
+ Specify a different plugin directory
+
+
+
+
+
+ --debug
+
+
+ Debug mode
+
+
+
+
+
+ -?, --help
+
+
+ Gives a help message
+
+
+
+
+
+ --usage
+
+
+ Gives a short usage message
+
+
+
+
+
+ -V, --version
+
+
+ Prints the program version
+
+
+
+
+
+
=== added file 'mandos.conf.xml'
--- mandos.conf.xml 1970-01-01 00:00:00 +0000
+++ mandos.conf.xml 2008-08-08 01:31:58 +0000
@@ -0,0 +1,189 @@
+
+
+
+
+/etc/mandos/mandos.conf">
+]>
+
+
+
+ &CONFNAME;
+
+ &CONFNAME;
+ &VERSION;
+
+
+ Björn
+ Påhlsson
+
+ belorn@fukt.bsnet.se
+
+
+
+ Teddy
+ Hogeborn
+
+ teddy@fukt.bsnet.se
+
+
+
+
+ 2008
+ Teddy Hogeborn & Björn Påhlsson
+
+
+
+ This manual page is free software: you can redistribute it
+ and/or modify it under the terms of the GNU General Public
+ License as published by the Free Software Foundation,
+ either version 3 of the License, or (at your option) any
+ later version.
+
+
+
+ This manual page is distributed in the hope that it will
+ be useful, but WITHOUT ANY WARRANTY; without even the
+ implied warranty of MERCHANTABILITY or FITNESS FOR A
+ PARTICULAR PURPOSE. See the GNU General Public License
+ for more details.
+
+
+
+ You should have received a copy of the GNU General Public
+ License along with this program; If not, see
+ .
+
+
+
+
+
+ &CONFNAME;
+ 5
+
+
+
+ &CONFNAME;
+
+ Configuration file for Mandos
+
+
+
+
+
+ &CONFPATH;
+
+
+
+
+ DESCRIPTION
+
+ The file &CONFPATH; is a simple configuration file for mandos
+ and is looked on at startup of the service. The configuration
+ file must start with [server]. The format for
+ the rest is a simple VAR = VALUE pair. Values may not be empty.
+
+
+
+ The paramters are:
+
+
+
+
+ interface
+
+
+ This option allows you to override the default network
+ interfaces. By default mandos will not bind to any
+ specific interface but instead use default avahi-server
+ behaviour.
+
+
+
+
+
+ address
+
+
+ This option allows you to override the default network
+ address. By default mandos will not bind to any
+ specific address but instead use default avahi-server
+ behaviour.
+
+
+
+
+
+ port
+
+
+ This option allows you to override the default port to
+ listen on. By default mandos will not specify any specific
+ port and instead use a random port given by the OS from
+ the use of INADDR_ANY.
+
+
+
+
+
+ debug
+
+
+ This option allows you to modify debug mode with a true/false
+ boolean value. By default is debug set to false.
+
+
+
+
+
+ priority
+
+
+ This option allows you to override the default gnutls
+ priority that will be used in gnutls session. See
+ gnutls_priority_init
+ 3for
+ more information on gnutls priority strings.
+
+
+
+
+
+ servicename
+
+
+ This option allows you to override the default Zeroconf
+ service name use to announce mandos as a avahi service. By
+ default mandos will use "Mandos".
+
+
+
+
+
+
+
+
+ EXAMPLES
+
+
+ [server]
+ # A configuration example
+ interface = eth0
+ address = 2001:DB8:
+ port = 1025
+ debug = true
+ priority = SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP
+ servicename = Mandos
+
+
+
+
+
+ FILES
+
+ The file described here is &CONFPATH;
+
+
+
=== added file 'mandos.xml'
--- mandos.xml 1970-01-01 00:00:00 +0000
+++ mandos.xml 2008-08-08 01:31:58 +0000
@@ -0,0 +1,182 @@
+
+
+
+
+]>
+
+
+
+ &COMMANDNAME;
+
+ &COMMANDNAME;
+ &VERSION;
+
+
+ Björn
+ Påhlsson
+
+ belorn@fukt.bsnet.se
+
+
+
+ Teddy
+ Hogeborn
+
+ teddy@fukt.bsnet.se
+
+
+
+
+ 2008
+ Teddy Hogeborn & Björn Påhlsson
+
+
+
+ This manual page is free software: you can redistribute it
+ and/or modify it under the terms of the GNU General Public
+ License as published by the Free Software Foundation,
+ either version 3 of the License, or (at your option) any
+ later version.
+
+
+
+ This manual page is distributed in the hope that it will
+ be useful, but WITHOUT ANY WARRANTY; without even the
+ implied warranty of MERCHANTABILITY or FITNESS FOR A
+ PARTICULAR PURPOSE. See the GNU General Public License
+ for more details.
+
+
+
+ You should have received a copy of the GNU General Public
+ License along with this program; If not, see
+ .
+
+
+
+
+
+ &COMMANDNAME;
+ 8mandos
+
+
+
+ &COMMANDNAME;
+
+ Sends encrypted passwords to authenticated mandos clients
+
+
+
+
+
+ &COMMANDNAME;
+ OPTION
+
+
+
+
+ DESCRIPTION
+
+ &COMMANDNAME; is a server daemon that handels
+ incomming passwords request for passwords. Mandos use avahi to
+ announce the service, and through gnutls authenticates
+ clients. Any authenticated client is then given its encrypted
+ password.
+
+
+
+
+ -h, --help
+
+
+ show a help message and exit
+
+
+
+
+
+ -i, --interface
+ IF
+
+
+ Bind to interface IF
+
+
+
+
+
+ -a, --address
+ ADDRESS
+
+
+ Address to listen for requests on
+
+
+
+
+
+ -p, --port
+ PORT
+
+
+ Port number to receive requests on
+
+
+
+
+
+ --check
+
+
+ Run self-test on the server
+
+
+
+
+
+ --debug
+
+
+ Debug mode
+
+
+
+
+
+ --priority
+ PRIORITY
+
+
+ GnuTLS priority string. See
+ gnutls_priority_init
+ 3
+
+
+
+
+
+ --servicename NAME
+
+
+
+ Zeroconf service name
+
+
+
+
+
+ --configdir DIR
+
+
+
+ Directory to search for configuration files
+
+
+
+
+
+
+
=== added file 'plugins.d/password-prompt.xml'
--- plugins.d/password-prompt.xml 1970-01-01 00:00:00 +0000
+++ plugins.d/password-prompt.xml 2008-08-08 01:31:58 +0000
@@ -0,0 +1,140 @@
+
+
+
+
+]>
+
+
+
+ &COMMANDNAME;
+
+ &COMMANDNAME;
+ &VERSION;
+
+
+ Björn
+ Påhlsson
+
+ belorn@fukt.bsnet.se
+
+
+
+ Teddy
+ Hogeborn
+
+ teddy@fukt.bsnet.se
+
+
+
+
+ 2008
+ Teddy Hogeborn & Björn Påhlsson
+
+
+
+ This manual page is free software: you can redistribute it
+ and/or modify it under the terms of the GNU General Public
+ License as published by the Free Software Foundation,
+ either version 3 of the License, or (at your option) any
+ later version.
+
+
+
+ This manual page is distributed in the hope that it will
+ be useful, but WITHOUT ANY WARRANTY; without even the
+ implied warranty of MERCHANTABILITY or FITNESS FOR A
+ PARTICULAR PURPOSE. See the GNU General Public License
+ for more details.
+
+
+
+ You should have received a copy of the GNU General Public
+ License along with this program; If not, see
+ .
+
+
+
+
+
+ &COMMANDNAME;
+ 8mandos
+
+
+
+ &COMMANDNAME;
+
+ Passprompt for luks during boot sequence
+
+
+
+
+
+ &COMMANDNAME;
+ OPTION
+
+
+
+
+ DESCRIPTION
+
+ &COMMANDNAME; is a terminal program that ask for
+ passwords during boot sequence. It is a plugin to
+ mandos, and is used as a fallback and
+ alternative to retriving passwords from a mandos server. During
+ boot sequence the user is prompted for the disk password, and
+ when a password is given it then gets forwarded to
+ LUKS.
+
+
+
+
+ -p, --prefix=PREFIX
+
+
+
+ Prefix used before the passprompt
+
+
+
+
+
+ --debug
+
+
+ Debug mode
+
+
+
+
+
+ -?, --help
+
+
+ Gives a help message
+
+
+
+
+
+ --usage
+
+
+ Gives a short usage message
+
+
+
+
+
+ -V, --version
+
+
+ Prints the program version
+
+
+
+
+
+
=== added file 'plugins.d/password-request.xml'
--- plugins.d/password-request.xml 1970-01-01 00:00:00 +0000
+++ plugins.d/password-request.xml 2008-08-08 01:31:58 +0000
@@ -0,0 +1,198 @@
+
+
+
+
+]>
+
+
+
+ &COMMANDNAME;
+
+ &COMMANDNAME;
+ &VERSION;
+
+
+ Björn
+ Påhlsson
+
+ belorn@fukt.bsnet.se
+
+
+
+ Teddy
+ Hogeborn
+
+ teddy@fukt.bsnet.se
+
+
+
+
+ 2008
+ Teddy Hogeborn & Björn Påhlsson
+
+
+
+ This manual page is free software: you can redistribute it
+ and/or modify it under the terms of the GNU General Public
+ License as published by the Free Software Foundation,
+ either version 3 of the License, or (at your option) any
+ later version.
+
+
+
+ This manual page is distributed in the hope that it will
+ be useful, but WITHOUT ANY WARRANTY; without even the
+ implied warranty of MERCHANTABILITY or FITNESS FOR A
+ PARTICULAR PURPOSE. See the GNU General Public License
+ for more details.
+
+
+
+ You should have received a copy of the GNU General Public
+ License along with this program; If not, see
+ .
+
+
+
+
+
+ &COMMANDNAME;
+ 8mandos
+
+
+
+ &COMMANDNAME;
+
+ Client for mandos
+
+
+
+
+
+ &COMMANDNAME;
+ OPTION
+
+
+
+
+ DESCRIPTION
+
+ &COMMANDNAME; is a mandos plugin that works
+ like a client program that through avahi detects mandos servers,
+ sets up a gnutls connect and request a encrypted password. Any
+ passwords given is automaticly decrypted and passed to
+ cryptsetup.
+
+
+
+
+ -c, --connect=
+ IP
+
+
+ Connect directly to a sepcified mandos server
+
+
+
+
+
+ -d, --keydir=
+ KEYDIR
+
+
+ Directory where the openpgp keyring is
+
+
+
+
+
+ -i, --interface=
+ INTERFACE
+
+
+ Interface that Avahi will conntect through
+
+
+
+
+
+ -p, --pubkey=
+ PUBKEY
+
+
+ Public openpgp key for gnutls authentication
+
+
+
+
+
+ -s, --seckey=
+ SECKEY
+
+
+ Secret openpgp key for gnutls authentication
+
+
+
+
+
+ --priority=PRIORITY
+
+
+
+ GNUTLS priority
+
+
+
+
+
+ --dh-bits=BITS
+
+
+
+ dh-bits to use in gnutls communication
+
+
+
+
+
+ --debug
+
+
+ Debug mode
+
+
+
+
+
+ -?, --help
+
+
+ Gives a help message
+
+
+
+
+
+ --usage
+
+
+ Gives a short usage message
+
+
+
+
+
+ -V, --version
+
+
+ Prints the program version
+
+
+
+
+
+