=== modified file 'Makefile'
--- Makefile 2008-08-18 23:55:28 +0000
+++ Makefile 2008-08-19 23:44:17 +0000
@@ -32,13 +32,16 @@
$(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS)
LDFLAGS=$(COVERAGE)
-DOCBOOKTOMAN=xsltproc --nonet \
+# Commands to format a DocBook refentry document into a manual page
+DOCBOOKTOMAN=cd $(dir $^); xsltproc --nonet --xinclude \
--param man.charmap.use.subset 0 \
--param make.year.ranges 1 \
--param make.single.year.ranges 1 \
--param man.output.quietly 1 \
--param man.authors.section.enabled 0 \
- /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl
+ /usr/share/xml/docbook/stylesheet/nwalsh/manpages/docbook.xsl \
+ $(notdir $<); \
+ $(MANPOST) $(notdir $@)
# DocBook-to-man post-processing to fix a \n escape bug
MANPOST=sed --in-place --expression='s,\\en,\en,g;s,\\een,\\en,g'
@@ -56,13 +59,19 @@
doc: $(DOCS)
%.5: %.xml
- cd $(dir $^); $(DOCBOOKTOMAN) $(notdir $^); $(MANPOST) $(notdir $@)
+ $(DOCBOOKTOMAN)
%.8: %.xml
- cd $(dir $^); $(DOCBOOKTOMAN) $(notdir $^); $(MANPOST) $(notdir $@)
+ $(DOCBOOKTOMAN)
%.8mandos: %.xml
- cd $(dir $^); $(DOCBOOKTOMAN) $(notdir $^); $(MANPOST) $(notdir $@)
+ $(DOCBOOKTOMAN)
+
+mandos.8: mandos.xml mandos-options.xml
+ $(DOCBOOKTOMAN)
+
+mandos.conf.5: mandos.conf.xml mandos-options.xml
+ $(DOCBOOKTOMAN)
plugins.d/password-request: plugins.d/password-request.o
$(LINK.o) $(GNUTLS_LIBS) $(AVAHI_LIBS) $(GPGME_LIBS) \
=== modified file 'TODO'
--- TODO 2008-08-18 05:57:11 +0000
+++ TODO 2008-08-22 00:16:20 +0000
@@ -83,8 +83,8 @@
[[http://www.steve.org.uk/Reference/Unix/faq_4.html#SEC48][Unix Programming FAQ 3.1 How can I make my program not echo input?]]
* mandos (server)
-** [#A] Config file man page: man5/mandos.conf (mandos.conf)
** [#A] Config file man page: man5/mandos-clients.conf (clients.conf)
+*** For option "secret", document which program can help generate it.
** [#A] /etc/init.d/mandos-server :teddy:
** [#B] Log level :bugs:
** /etc/mandos/clients.d/*.conf
=== modified file 'clients.conf'
--- clients.conf 2008-08-10 20:35:01 +0000
+++ clients.conf 2008-08-22 00:16:20 +0000
@@ -9,12 +9,12 @@
# How often to run the checker to confirm that a client is still up.
# Note: a new checker will not be started if an old one is still
# running. The server will wait for a checker to complete until the
-# "timeout" above occurs, at which time the client will be marked
+# above "timeout" occurs, at which time the client will be marked
# invalid, and any running checker killed.
;interval = 5m
# What command to run as "the checker".
-;checker = fping -q -- %%(host)s
+;checker = fping -q -- %(host)s
;####
=== modified file 'mandos'
--- mandos 2008-08-18 23:55:28 +0000
+++ mandos 2008-08-22 00:16:20 +0000
@@ -337,13 +337,17 @@
try:
logger.info(u"Starting checker %r for %s",
command, self.name)
+ # We don't need to redirect stdout and stderr, since
+ # in normal mode, that is already done by daemon(),
+ # and in debug mode we don't want to. (Stdin is
+ # always replaced by /dev/null.)
self.checker = subprocess.Popen(command,
close_fds=True,
shell=True, cwd="/")
self.checker_callback_tag = gobject.child_watch_add\
(self.checker.pid,
self.checker_callback)
- except subprocess.OSError, error:
+ except OSError, error:
logger.error(u"Failed to start subprocess: %s",
error)
# Re-run this periodically if run by gobject.timeout_add
@@ -563,25 +567,30 @@
datetime.timedelta(1)
>>> string_to_delta(u'1w')
datetime.timedelta(7)
+ >>> string_to_delta('5m 30s')
+ datetime.timedelta(0, 330)
"""
- try:
- suffix=unicode(interval[-1])
- value=int(interval[:-1])
- if suffix == u"d":
- delta = datetime.timedelta(value)
- elif suffix == u"s":
- delta = datetime.timedelta(0, value)
- elif suffix == u"m":
- delta = datetime.timedelta(0, 0, 0, 0, value)
- elif suffix == u"h":
- delta = datetime.timedelta(0, 0, 0, 0, 0, value)
- elif suffix == u"w":
- delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
- else:
+ timevalue = datetime.timedelta(0)
+ for s in interval.split():
+ try:
+ suffix=unicode(s[-1])
+ value=int(s[:-1])
+ if suffix == u"d":
+ delta = datetime.timedelta(value)
+ elif suffix == u"s":
+ delta = datetime.timedelta(0, value)
+ elif suffix == u"m":
+ delta = datetime.timedelta(0, 0, 0, 0, value)
+ elif suffix == u"h":
+ delta = datetime.timedelta(0, 0, 0, 0, 0, value)
+ elif suffix == u"w":
+ delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
+ else:
+ raise ValueError
+ except (ValueError, IndexError):
raise ValueError
- except (ValueError, IndexError):
- raise ValueError
- return delta
+ timevalue += delta
+ return timevalue
def server_state_changed(state):
@@ -732,7 +741,8 @@
# Parse config file with clients
client_defaults = { "timeout": "1h",
"interval": "5m",
- "checker": "fping -q -- %%(host)s",
+ "checker": "fping -q -- %(host)s",
+ "host": "",
}
client_config = ConfigParser.SafeConfigParser(client_defaults)
client_config.read(os.path.join(server_settings["configdir"],
@@ -772,8 +782,16 @@
logger.critical(u"No clients defined")
sys.exit(1)
- if not debug:
+ if debug:
+ # Redirect stdin so all checkers get /dev/null
+ null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
+ os.dup2(null, sys.stdin.fileno())
+ if null > 2:
+ os.close(null)
+ else:
+ # No console logging
logger.removeHandler(console)
+ # Close all input and output, do double fork, etc.
daemon()
pidfilename = "/var/run/mandos/mandos.pid"
=== modified file 'mandos-clients.conf.xml'
--- mandos-clients.conf.xml 2008-08-09 01:39:09 +0000
+++ mandos-clients.conf.xml 2008-08-22 00:16:20 +0000
@@ -1,6 +1,4 @@
-
@@ -11,7 +9,7 @@
&CONFNAME;
-
+
&CONFNAME;&VERSION;
@@ -32,7 +30,8 @@
2008
- Teddy Hogeborn & Björn Påhlsson
+ Teddy Hogeborn
+ Björn Påhlsson
@@ -67,7 +66,7 @@
&CONFNAME;
- Configuration file for Mandos clients
+ Configuration file for the Mandos server
@@ -80,42 +79,89 @@
DESCRIPTION
- The file &CONFPATH; is the configuration file for mandos where
- each client that will be abel to use the service need to be
- specified. The configuration file is looked on at the startup of
- the service, so to reenable timedout clients one need to only
- restart the server. The format starts with a section under []
- which is eather [DEFAULT] or a client
- name. Values is set through the use of VAR = VALUE pair. Values
- may not be empty.
+ The file &CONFPATH; is the configuration file for mandos
+ 8, read by it at startup,
+ where each client that will be able to use the service needs to
+ be listed. All clients listed will be regarded as valid, even
+ if a client was declared invalid in a previous run of the
+ server.
+
+
+ The format starts with a [section
+ header] which is either
+ [DEFAULT] or [client
+ name]. The client
+ name can be anything, and is not tied to a host
+ name. Following the section header is any number of
+ option=value entries,
+ with continuations in the style of RFC 822. option: value is also accepted. Note that
+ leading whitespace is removed from values. Values can contain
+ format strings which refer to other values in the same section,
+ or values in the DEFAULT section (see ). Lines beginning with #
+ or ; are ignored and may be used to provide
+ comments.
-
-
- DEFAULTS
+
+
+ OPTIONS
- The paramters for [DEFAULT] are:
+ The possible options are:
-
+
- timeout
+ timeout
-
- This option allows you to override the default timeout
- that clients will get. By default mandos will use 1hr.
+ timeout = TIME
+
+
+ The timeout is how long the server will wait for a
+ successful checker run until a client is considered
+ invalid - that is, ineligible to get the data this server
+ holds. By default Mandos will use 1 hour.
+
+
+ The TIME is specified as a
+ space-separated number of values, each of which is a
+ number and a one-character suffix. The suffix must be one
+ of d, s, m,
+ h, and w for days, seconds,
+ minutes, hours, and weeks, respectively. The values are
+ added together to give the total time value, so all of
+ 330s,
+ 110s 110s 110s, and
+ 5m 30s will give a value
+ of five minutes and thirty seconds.
- interval
+ interval
-
- This option allows you to override the default interval
- used between checkups for disconnected clients. By default
- mandos will use 5m.
+ interval = TIME
+
+
+ How often to run the checker to confirm that a client is
+ still up. Note: a new checker will
+ not be started if an old one is still running. The server
+ will wait for a checker to complete until the above
+ timeout occurs, at which
+ time the client will be marked invalid, and any running
+ checker killed. The default interval is 5 minutes.
+
+
+ The format of TIME is the same
+ as for timeout above.
@@ -123,32 +169,39 @@
checker
+ checker = COMMAND
+
This option allows you to override the default shell
- command that the server will use to check up if the client
- is still up. By default mandos will "fping -q -- %%(host)s"
+ command that the server will use to check if the client is
+ still up. The output of the command will be ignored, only
+ the exit code is checked. The command will be run using
+ /bin/sh
+ . The default
+ command is fping
+
+ %(host)s.
+
+
+ In addition to normal start time expansion, this option
+ will also be subject to runtime expansion; see .
-
-
-
-
- CLIENTS
-
- The paramters for clients are:
-
-
-
-
fingerprint
+ fingerprint = HEXSTRING
+
- This option sets the openpgp fingerprint that identifies
- the public certificate that clients authenticates themself
- through gnutls. The string need to be in hex-decimal form.
+ This option sets the OpenPGP fingerprint that identifies
+ the public key that clients authenticate themselves with
+ through TLS. The string needs to be in hexidecimal form,
+ but spaces or upper/lower case are not significant.
@@ -156,9 +209,25 @@
secret
-
- Base 64 encoded OpenPGP encrypted password encrypted by
- the clients openpgp certificate.
+ secret = BASE64_ENCODED_DATA
+
+
+ If present, this option must be set to a string of
+ base64-encoded binary data. It will be decoded and sent
+ to the client matching the above
+ . This should, of course, be
+ OpenPGP encrypted data, decryptable only by the client.
+
+
+
+
+
+
+ Note: this value of this option will probably run over
+ many lines, and will then have to use the fact that a line
+ beginning with white space adds to the value of the
+ previous line, RFC 822-style.
@@ -204,19 +273,93 @@
+
+
+ EXPANSION
+
+ There are two forms of expansion: Start time expansion and
+ runtime expansion.
+
+
+ START TIME EXPANSION
+
+ Any string in an option value of the form
+ %(foo)s will be replaced by the value of the option
+ foo either in the same section, or, if it
+ does not exist there, the [DEFAULT]
+ section. This is done at start time, when the configuration
+ file is read.
+
+
+ Note that this means that, in order to include an actual
+ percent character (%) in an option value, two
+ percent characters in a row (%%) must be
+ entered.
+
+
+
+ RUNTIME EXPANSION
+
+ This is currently only done for the checker
+ option.
+
+
+ Any string in an option value of the form
+ %%(foo)s will be replaced by the value of the attribute
+ foo of the internal
+ Client object. See the
+ source code for details, and let the authors know of any
+ attributes that are useful so they may be preserved to any new
+ versions of this software.
+
+
+ Note that this means that, in order to include an actual
+ percent character (%) in a
+ checker options, four
+ percent characters in a row (%%%%) must be
+ entered. Also, a bad format here will lead to an immediate
+ but silent run-time fatal exit; debug
+ mode is needed to track down an error of this kind.
+
+
-
- EXAMPLES
+
+
+
+ FILES
+
+ The file described here is &CONFPATH;
+
+
+
+
+ BUGS
+
+ The format for specifying times for timeout
+ and interval is not very good.
+
+
+ The difference between
+ %%(foo)s and
+ %(foo)s is
+ obscure.
+
+
+
+
+ EXAMPLE
[DEFAULT]
timeout = 1h
interval = 5m
-checker = fping -q -- %%(host)s
+checker = fping -q -- %(host)s
-[example_client]
+# Client "foo"
+[foo]
fingerprint = 7788 2722 5BA7 DE53 9C5A 7CFA 59CF F7CD BD9A 5920
-
secret =
hQIOA6QdEjBs2L/HEAf/TCyrDe5Xnm9esa+Pb/vWF9CUqfn4srzVgSu234
REJMVv7lBSrPE2132Lmd2gqF1HeLKDJRSVxJpt6xoWOChGHg+TMyXDxK+N
@@ -234,17 +377,16 @@
4T2zw4dxS5NswXWU0sVEXxjs6PYxuIiCTL7vdpx8QjBkrPWDrAbcMyBr2O
QlnHIvPzEArRQLo=
=iHhv
-
-host = localhost
+host = foo.example.org
interval = 5m
+
+# Client "bar"
+[bar]
+fingerprint = 3e393aeaefb84c7e89e2f547b3a107558fca3a27
+secfile = /etc/mandos/bar-secret.txt.asc
+
-
-
- FILES
-
- The file described here is &CONFPATH;
-
-
+
=== modified file 'mandos-keygen'
--- mandos-keygen 2008-08-18 05:24:20 +0000
+++ mandos-keygen 2008-08-22 00:16:20 +0000
@@ -142,7 +142,12 @@
PUBRING="`mktemp -t mandos-gpg-pubring.XXXXXXXXXX`"
# Remove temporary files on exit
-trap "rm --force $PUBRING $BATCHFILE; shred --remove $SECRING" EXIT
+trap "
+set +e
+rm --force $PUBRING $BATCHFILE;
+shred --remove $SECRING;
+stty echo
+" EXIT
# Create batch file for GnuPG
cat >"$BATCHFILE" <
-
]>
-
+&COMMANDNAME;
@@ -269,7 +268,7 @@
OVERVIEW
- &OVERVIEW;
+
This program is a small program to generate new OpenPGP keys for
new Mandos clients.
@@ -389,7 +388,7 @@
password-request8mandos,
mandos
- 8, and
+ 8,
gpg1
=== added file 'mandos-options.xml'
--- mandos-options.xml 1970-01-01 00:00:00 +0000
+++ mandos-options.xml 2008-08-19 23:44:17 +0000
@@ -0,0 +1,66 @@
+
+
+
+
+
+
+
+
+
+ If this is specified, the server will only announce the service
+ and listen to requests on network interface
+ IF. Default is to use all available
+ interfaces. Note: a failure to bind to the
+ specified interface is not considered critical, and the server
+ does not exit.
+
+
+
+ If this option is used, the server will only listen to a specific
+ address. If a link-local address is specified, an interface
+ should be set, since a link-local address is only valid on a
+ single interface. By default, the server will listen to all
+ available addresses. Also, this must currently be an IPv6
+ address; an IPv4 address can only be specified using the
+ ::FFFF:192.0.2.3 format.
+
+
+
+ If this option is used, the server will bind to that port. By
+ default, the server will listen to an arbitrary port given by the
+ operating system.
+
+
+
+ If the server is run in debug mode, it will run in the foreground
+ and print a lot of debugging information. The default is
+ not to run in debug mode.
+
+
+
+ GnuTLS priority string for the TLS handshake with the clients.
+ The default is
+ SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP.
+ See gnutls_priority_init
+ 3 for the
+ syntax. Warning: changing this may make the
+ TLS handshake fail, making communication with clients impossible.
+
+
+
+ Zeroconf service name. The default is
+ Mandos. This only needs to be
+ changed this if it, for some reason, is necessary to run more than
+ one server on the same host, which would not
+ normally be useful. If there are name collisions on the same
+ network, the newer server will automatically
+ rename itself to Mandos #2, and
+ so on; therefore, this option is not needed in that case.
+
+
+
=== modified file 'mandos.conf.xml'
--- mandos.conf.xml 2008-08-18 23:55:28 +0000
+++ mandos.conf.xml 2008-08-20 03:22:45 +0000
@@ -4,10 +4,9 @@
/etc/mandos/mandos.conf">
-
]>
-
+&CONFNAME;
@@ -83,111 +82,89 @@
The file &CONFPATH; is a simple configuration file for
mandos8, and is read by it at
- startup. The configuration file starts with
- [DEFAULT] on a line by itself,
- followed by any number of
- option=value
- entries, with continuations in the style of RFC 822.
- option:
- value is also accepted. Note
- that leading whitespace is removed from values. Lines beginning
- with # or ; are ignored and may be
- used to provide comments.
-
-
-
- The options are:
-
-
+ startup. The configuration file starts with [DEFAULT] on a line by itself, followed by
+ any number of option=value entries,
+ with continuations in the style of RFC 822. option: value is also accepted. Note that
+ leading whitespace is removed from values. Lines beginning with
+ # or ; are ignored and may be used
+ to provide comments.
+
+
+
+
+ OPTIONS
+
- interface
-
-
- This option allows you to override the default network
- interfaces. By default mandos will not bind to any
- specific interface but instead use default avahi-server
- behaviour.
-
-
-
-
-
- address
-
-
- This option allows you to override the default network
- address. By default mandos will not bind to any
- specific address but instead use default avahi-server
- behaviour.
-
-
-
-
-
- port
-
-
- This option allows you to override the default port to
- listen on. By default mandos will not specify any specific
- port and instead use a random port given by the OS from
- the use of INADDR_ANY.
-
-
-
-
-
- debug
-
-
- This option allows you to modify debug mode with a true/false
- boolean value. By default is debug set to false.
-
-
-
-
-
- priority
-
-
- This option allows you to override the default gnutls
- priority that will be used in gnutls session. See
- gnutls_priority_init
- 3for
- more information on gnutls priority strings.
-
-
-
-
-
- servicename
-
-
- This option allows you to override the default Zeroconf
- service name use to announce mandos as a avahi service. By
- default mandos will use "Mandos".
-
+ interface
+
+ interface = IF
+
+
+
+
+
+
+ address
+
+ address = ADDRESS
+
+
+
+
+
+
+ port
+
+ port = PORT
+
+
+
+
+
+
+ debug
+
+ debug = { 1 | yes | true | on | 0 | no | false | off }
+
+
+
+
+
+
+ priority
+
+ priority = PRIORITY
+
+
+
+
+
+
+ servicename
+
+ servicename = NAME
+
+
-
-
- EXAMPLES
-
-
- [server]
- # A configuration example
- interface = eth0
- address = 2001:DB8:
- port = 1025
- debug = true
- priority = SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP
- servicename = Mandos
-
-
- FILES
@@ -195,4 +172,51 @@
The file described here is &CONFPATH;
+
+
+ BUGS
+
+ The [DEFAULT] is necessary because the Python
+ built-in module ConfigParser
+ requres it.
+
+
+
+
+ EXAMPLE
+
+
+ No options are actually required:
+
+
+[DEFAULT]
+
+
+
+
+ An example using all the options:
+
+
+[DEFAULT]
+# A configuration example
+interface = eth0
+address = 2001:db8:f983:bd0b:30de:ae4a:71f2:f672
+port = 1025
+debug = true
+priority = SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP
+servicename = Daena
+
+
+
+
+
+ SEE ALSO
+
+
+ mandos
+ 8,
+ mandos-clients.conf
+ 5
+
+
=== modified file 'mandos.xml'
--- mandos.xml 2008-08-18 03:50:28 +0000
+++ mandos.xml 2008-08-20 00:35:41 +0000
@@ -3,10 +3,9 @@
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
-
]>
-
+&COMMANDNAME;
@@ -154,13 +153,7 @@
-i, --interface
IF
-
- Only announce the server and listen to requests on network
- interface IF. Default is to
- use all available interfaces. Note:
- a failure to bind to the specified interface is not
- considered critical, and the server does not exit.
-
+
@@ -168,16 +161,7 @@
-a, --address
ADDRESS
-
- If this option is used, the server will only listen to a
- specific address. This must currently be an IPv6 address;
- an IPv4 address can be specified using the
- ::FFFF:192.0.2.3 syntax.
- Also, if a link-local address is specified, an interface
- should be set, since a link-local address is only valid on
- a single interface. By default, the server will listen to
- all available addresses.
-
+
@@ -185,11 +169,7 @@
-p, --port
PORT
-
- If this option is used, the server to bind to that
- port. By default, the server will listen to an arbitrary
- port given by the operating system.
-
+
@@ -206,11 +186,7 @@
--debug
-
- If the server is run in debug mode, it will run in the
- foreground and print a lot of debugging information. The
- default is not to run in debug mode.
-
+
@@ -218,16 +194,7 @@
--priority
PRIORITY
-
- GnuTLS priority string for the TLS handshake with the
- clients. The default is
- SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP.
- See gnutls_priority_init
- 3
- for the syntax. Warning: changing
- this may make the TLS handshake fail, making communication
- with clients impossible.
-
+
@@ -235,18 +202,8 @@
--servicename NAME
-
- Zeroconf service name. The default is
- Mandos. This only needs
- to be changed this if it, for some reason, is necessary to
- run more than one server on the same
- host, which would not normally be
- useful. If there are name collisions on the same
- network, the newer server will
- automatically rename itself to Mandos
- #2, and so on; therefore, this option is
- not needed in that case.
-
+
@@ -278,7 +235,7 @@
OVERVIEW
- &OVERVIEW;
+
This program is the server part. It is a normal server program
and will run in a normal system environment, not in an initial
@@ -317,7 +274,7 @@
->
- 1\r\en
+ 1\r\n->
@@ -353,8 +310,6 @@
longer eligible to receive the encrypted password. The timeout,
checker program, and interval between checks can be configured
both globally and per client; see
- mandos.conf
- 5 and mandos-clients.conf5.
@@ -363,8 +318,8 @@
LOGGING
- The server will send log messaged with various severity levels
- to /dev/log. With the
+ The server will send log message with various severity levels to
+ /dev/log. With the
option, it will log even more messages,
and also show them on the console.
@@ -391,7 +346,7 @@
PATH to search for matching commands if
an absolute path is not given. See sh1
-
+ .
@@ -581,25 +536,20 @@
SEE ALSO
+
+
+ mandos.conf
+ 5,
+ mandos-clients.conf
+ 5,
+ password-request
+ 8mandos,
+ sh1
+
+
-
- password-request
- 8mandos
-
-
-
-
- This is the actual program which talks to this server.
- Note that it is normally not invoked directly, and is only
- run in the initial RAM disk environment, and not on a
- fully started system.
-
-
-
-
- Zeroconf
=== modified file 'overview.xml'
--- overview.xml 2008-08-17 22:42:28 +0000
+++ overview.xml 2008-08-19 13:25:14 +0000
@@ -1,4 +1,6 @@
+
This is part of the Mandos system for allowing host computers to
have encrypted root file systems and also be capable of remote and