/mandos/trunk

To get this branch, use:
bzr branch /loggerhead/mandos/trunk
84 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Use the local manpages/docbook.xsl file, do
1
<?xml version="1.0" encoding="UTF-8"?>
24.1.23 by Björn Påhlsson
Added manual pages for:
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
84 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Use the local manpages/docbook.xsl file, do
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
24.1.23 by Björn Påhlsson
Added manual pages for:
4
<!ENTITY COMMANDNAME "mandos">
1121 by Teddy Hogeborn
Change URL for Avahi to use HTTPS
5
<!ENTITY TIMESTAMP "2019-07-24">
217 by Teddy Hogeborn
* .bzrignore: Added "man" directory (created by "make install-html").
6
<!ENTITY % common SYSTEM "common.ent">
7
%common;
24.1.23 by Björn Påhlsson
Added manual pages for:
8
]>
9
90 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Added "--xinclude".
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
217 by Teddy Hogeborn
* .bzrignore: Added "man" directory (created by "make install-html").
11
   <refentryinfo>
112 by Teddy Hogeborn
* mandos-clients.conf.xml (/refentry/refentryinfo/title): Changed to
12
    <title>Mandos Manual</title>
84 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Use the local manpages/docbook.xsl file, do
13
    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
112 by Teddy Hogeborn
* mandos-clients.conf.xml (/refentry/refentryinfo/title): Changed to
14
    <productname>Mandos</productname>
217 by Teddy Hogeborn
* .bzrignore: Added "man" directory (created by "make install-html").
15
    <productnumber>&version;</productnumber>
111 by Teddy Hogeborn
* mandos-clients.conf.xml (ENTITY TIMESTAMP): New. Automatically
16
    <date>&TIMESTAMP;</date>
24.1.23 by Björn Påhlsson
Added manual pages for:
17
    <authorgroup>
18
      <author>
19
	<firstname>Björn</firstname>
20
	<surname>Påhlsson</surname>
21
	<address>
505.1.2 by Teddy Hogeborn
Change "fukt.bsnet.se" to "recompile.se" throughout.
22
	  <email>belorn@recompile.se</email>
24.1.23 by Björn Påhlsson
Added manual pages for:
23
	</address>
24
      </author>
25
      <author>
26
	<firstname>Teddy</firstname>
27
	<surname>Hogeborn</surname>
28
	<address>
505.1.2 by Teddy Hogeborn
Change "fukt.bsnet.se" to "recompile.se" throughout.
29
	  <email>teddy@recompile.se</email>
24.1.23 by Björn Påhlsson
Added manual pages for:
30
	</address>
31
      </author>
32
    </authorgroup>
33
    <copyright>
34
      <year>2008</year>
246 by Teddy Hogeborn
* README: Update copyright year; add "2009".
35
      <year>2009</year>
444 by Teddy Hogeborn
Update copyright year to "2010" wherever appropriate.
36
      <year>2010</year>
466 by Teddy Hogeborn
Update copyright year to "2011" wherever appropriate.
37
      <year>2011</year>
544 by Teddy Hogeborn
Updated year in copyright notices.
38
      <year>2012</year>
626 by Teddy Hogeborn
* Makefile (CFLAGS, LDFLAGS): Keep default flags from environment.
39
      <year>2013</year>
778 by Teddy Hogeborn
Update copyright year.
40
      <year>2014</year>
41
      <year>2015</year>
807 by Teddy Hogeborn
Update copyright year.
42
      <year>2016</year>
899 by Teddy Hogeborn
Update copyright year to 2017
43
      <year>2017</year>
923 by Teddy Hogeborn
Update copyright year to 2018
44
      <year>2018</year>
969 by Teddy Hogeborn
Update copyright year to 2019
45
      <year>2019</year>
81 by Teddy Hogeborn
* Makefile (GNUTLS_CFLAGS, GNUTLS_LIBS, AVAHI_CFLAGS, AVAHI_LIBS,
46
      <holder>Teddy Hogeborn</holder>
47
      <holder>Björn Påhlsson</holder>
24.1.23 by Björn Påhlsson
Added manual pages for:
48
    </copyright>
131 by Teddy Hogeborn
* Makefile: Make all DocBook rules include legalnotice.xml as a
49
    <xi:include href="legalnotice.xml"/>
24.1.23 by Björn Påhlsson
Added manual pages for:
50
  </refentryinfo>
182 by Teddy Hogeborn
* Makefile (install): Use "install-client-nokey".
51
  
24.1.23 by Björn Påhlsson
Added manual pages for:
52
  <refmeta>
53
    <refentrytitle>&COMMANDNAME;</refentrytitle>
24.1.24 by Björn Påhlsson
minor edits
54
    <manvolnum>8</manvolnum>
24.1.23 by Björn Påhlsson
Added manual pages for:
55
  </refmeta>
56
  
57
  <refnamediv>
58
    <refname><command>&COMMANDNAME;</command></refname>
59
    <refpurpose>
116 by Teddy Hogeborn
* mandos-options.xml (priority): Added <acronym> tags.
60
      Gives encrypted passwords to authenticated Mandos clients
24.1.23 by Björn Påhlsson
Added manual pages for:
61
    </refpurpose>
62
  </refnamediv>
182 by Teddy Hogeborn
* Makefile (install): Use "install-client-nokey".
63
  
24.1.23 by Björn Påhlsson
Added manual pages for:
64
  <refsynopsisdiv>
65
    <cmdsynopsis>
66
      <command>&COMMANDNAME;</command>
120 by Teddy Hogeborn
* mandos.xml (SYNOPSIS): Use <option> and <replaceable> tags. Unify
67
      <group>
68
	<arg choice="plain"><option>--interface
69
	<replaceable>NAME</replaceable></option></arg>
70
	<arg choice="plain"><option>-i
71
	<replaceable>NAME</replaceable></option></arg>
72
      </group>
73
      <sbr/>
74
      <group>
75
	<arg choice="plain"><option>--address
76
	<replaceable>ADDRESS</replaceable></option></arg>
77
	<arg choice="plain"><option>-a
78
	<replaceable>ADDRESS</replaceable></option></arg>
79
      </group>
80
      <sbr/>
81
      <group>
82
	<arg choice="plain"><option>--port
83
	<replaceable>PORT</replaceable></option></arg>
84
	<arg choice="plain"><option>-p
85
	<replaceable>PORT</replaceable></option></arg>
86
      </group>
87
      <sbr/>
88
      <arg><option>--priority
89
      <replaceable>PRIORITY</replaceable></option></arg>
90
      <sbr/>
91
      <arg><option>--servicename
92
      <replaceable>NAME</replaceable></option></arg>
93
      <sbr/>
94
      <arg><option>--configdir
95
      <replaceable>DIRECTORY</replaceable></option></arg>
96
      <sbr/>
97
      <arg><option>--debug</option></arg>
271 by Teddy Hogeborn
Merge from release branch.
98
      <sbr/>
447 by teddy at bsnet
* mandos: Fixed "--help" output.
99
      <arg><option>--debuglevel
100
      <replaceable>LEVEL</replaceable></option></arg>
101
      <sbr/>
324 by Teddy Hogeborn
Merge from release branch.
102
      <arg><option>--no-dbus</option></arg>
103
      <sbr/>
314 by Teddy Hogeborn
Support not using IPv6 in server:
104
      <arg><option>--no-ipv6</option></arg>
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
105
      <sbr/>
106
      <arg><option>--no-restore</option></arg>
518.2.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
107
      <sbr/>
108
      <arg><option>--statedir
109
      <replaceable>DIRECTORY</replaceable></option></arg>
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
110
      <sbr/>
111
      <arg><option>--socket
112
      <replaceable>FD</replaceable></option></arg>
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
113
      <sbr/>
114
      <arg><option>--foreground</option></arg>
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
115
      <sbr/>
116
      <arg><option>--no-zeroconf</option></arg>
85 by Teddy Hogeborn
* mandos.xml (SYNOPSIS): Removed unnecessary 'choice="opt"' from <arg>
117
    </cmdsynopsis>
118
    <cmdsynopsis>
119
      <command>&COMMANDNAME;</command>
120
      <group choice="req">
122 by Teddy Hogeborn
* mandos-keygen.xml (SYNOPSIS): Put long options before short.
121
	<arg choice="plain"><option>--help</option></arg>
120 by Teddy Hogeborn
* mandos.xml (SYNOPSIS): Use <option> and <replaceable> tags. Unify
122
	<arg choice="plain"><option>-h</option></arg>
85 by Teddy Hogeborn
* mandos.xml (SYNOPSIS): Removed unnecessary 'choice="opt"' from <arg>
123
      </group>
84 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Use the local manpages/docbook.xsl file, do
124
    </cmdsynopsis>
125
    <cmdsynopsis>
126
      <command>&COMMANDNAME;</command>
120 by Teddy Hogeborn
* mandos.xml (SYNOPSIS): Use <option> and <replaceable> tags. Unify
127
      <arg choice="plain"><option>--version</option></arg>
84 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Use the local manpages/docbook.xsl file, do
128
    </cmdsynopsis>
129
    <cmdsynopsis>
130
      <command>&COMMANDNAME;</command>
120 by Teddy Hogeborn
* mandos.xml (SYNOPSIS): Use <option> and <replaceable> tags. Unify
131
      <arg choice="plain"><option>--check</option></arg>
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
132
    </cmdsynopsis>
24.1.23 by Björn Påhlsson
Added manual pages for:
133
  </refsynopsisdiv>
182 by Teddy Hogeborn
* Makefile (install): Use "install-client-nokey".
134
  
24.1.23 by Björn Påhlsson
Added manual pages for:
135
  <refsect1 id="description">
136
    <title>DESCRIPTION</title>
137
    <para>
81 by Teddy Hogeborn
* Makefile (GNUTLS_CFLAGS, GNUTLS_LIBS, AVAHI_CFLAGS, AVAHI_LIBS,
138
      <command>&COMMANDNAME;</command> is a server daemon which
139
      handles incoming request for passwords for a pre-defined list of
24.1.179 by Björn Påhlsson
New feature:
140
      client host computers. For an introduction, see
141
      <citerefentry><refentrytitle>intro</refentrytitle>
142
      <manvolnum>8mandos</manvolnum></citerefentry>. The Mandos server
143
      uses Zeroconf to announce itself on the local network, and uses
144
      TLS to communicate securely with and to authenticate the
145
      clients.  The Mandos server uses IPv6 to allow Mandos clients to
146
      use IPv6 link-local addresses, since the clients will probably
147
      not have any other addresses configured (see <xref
148
      linkend="overview"/>).  Any authenticated client is then given
149
      the stored pre-encrypted password for that specific client.
81 by Teddy Hogeborn
* Makefile (GNUTLS_CFLAGS, GNUTLS_LIBS, AVAHI_CFLAGS, AVAHI_LIBS,
150
    </para>
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
151
  </refsect1>
81 by Teddy Hogeborn
* Makefile (GNUTLS_CFLAGS, GNUTLS_LIBS, AVAHI_CFLAGS, AVAHI_LIBS,
152
  
153
  <refsect1 id="purpose">
154
    <title>PURPOSE</title>
155
    <para>
156
      The purpose of this is to enable <emphasis>remote and unattended
84 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Use the local manpages/docbook.xsl file, do
157
      rebooting</emphasis> of client host computer with an
158
      <emphasis>encrypted root file system</emphasis>.  See <xref
159
      linkend="overview"/> for details.
81 by Teddy Hogeborn
* Makefile (GNUTLS_CFLAGS, GNUTLS_LIBS, AVAHI_CFLAGS, AVAHI_LIBS,
160
    </para>
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
161
  </refsect1>
24.1.55 by Björn Påhlsson
updated some partial manual pages
162
  
163
  <refsect1 id="options">
164
    <title>OPTIONS</title>
24.1.23 by Björn Påhlsson
Added manual pages for:
165
    <variablelist>
166
      <varlistentry>
124 by Teddy Hogeborn
* mandos.xml (OPTIONS): Moved long options before short. Use <option>
167
	<term><option>--help</option></term>
115 by Teddy Hogeborn
* mandos.xml (SYNOPSIS): Split <term> tags for the "--help" and
168
	<term><option>-h</option></term>
24.1.23 by Björn Påhlsson
Added manual pages for:
169
	<listitem>
170
	  <para>
81 by Teddy Hogeborn
* Makefile (GNUTLS_CFLAGS, GNUTLS_LIBS, AVAHI_CFLAGS, AVAHI_LIBS,
171
	    Show a help message and exit
24.1.23 by Björn Påhlsson
Added manual pages for:
172
	  </para>
173
	</listitem>
174
      </varlistentry>
124 by Teddy Hogeborn
* mandos.xml (OPTIONS): Moved long options before short. Use <option>
175
      
24.1.23 by Björn Påhlsson
Added manual pages for:
176
      <varlistentry>
124 by Teddy Hogeborn
* mandos.xml (OPTIONS): Moved long options before short. Use <option>
177
	<term><option>--interface</option>
178
	<replaceable>NAME</replaceable></term>
115 by Teddy Hogeborn
* mandos.xml (SYNOPSIS): Split <term> tags for the "--help" and
179
	<term><option>-i</option>
180
	<replaceable>NAME</replaceable></term>
24.1.23 by Björn Påhlsson
Added manual pages for:
181
	<listitem>
90 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Added "--xinclude".
182
	  <xi:include href="mandos-options.xml" xpointer="interface"/>
24.1.23 by Björn Påhlsson
Added manual pages for:
183
	</listitem>
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
184
      </varlistentry>
124 by Teddy Hogeborn
* mandos.xml (OPTIONS): Moved long options before short. Use <option>
185
      
24.1.23 by Björn Påhlsson
Added manual pages for:
186
      <varlistentry>
124 by Teddy Hogeborn
* mandos.xml (OPTIONS): Moved long options before short. Use <option>
187
	<term><option>--address
188
	<replaceable>ADDRESS</replaceable></option></term>
189
	<term><option>-a
190
	<replaceable>ADDRESS</replaceable></option></term>
24.1.23 by Björn Påhlsson
Added manual pages for:
191
	<listitem>
90 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Added "--xinclude".
192
	  <xi:include href="mandos-options.xml" xpointer="address"/>
24.1.23 by Björn Påhlsson
Added manual pages for:
193
	</listitem>
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
194
      </varlistentry>
124 by Teddy Hogeborn
* mandos.xml (OPTIONS): Moved long options before short. Use <option>
195
      
24.1.23 by Björn Påhlsson
Added manual pages for:
196
      <varlistentry>
124 by Teddy Hogeborn
* mandos.xml (OPTIONS): Moved long options before short. Use <option>
197
	<term><option>--port
198
	<replaceable>PORT</replaceable></option></term>
199
	<term><option>-p
200
	<replaceable>PORT</replaceable></option></term>
24.1.23 by Björn Påhlsson
Added manual pages for:
201
	<listitem>
90 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Added "--xinclude".
202
	  <xi:include href="mandos-options.xml" xpointer="port"/>
24.1.23 by Björn Påhlsson
Added manual pages for:
203
	</listitem>
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
204
      </varlistentry>
124 by Teddy Hogeborn
* mandos.xml (OPTIONS): Moved long options before short. Use <option>
205
      
24.1.23 by Björn Påhlsson
Added manual pages for:
206
      <varlistentry>
124 by Teddy Hogeborn
* mandos.xml (OPTIONS): Moved long options before short. Use <option>
207
	<term><option>--check</option></term>
24.1.23 by Björn Påhlsson
Added manual pages for:
208
	<listitem>
209
	  <para>
84 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Use the local manpages/docbook.xsl file, do
210
	    Run the server’s self-tests.  This includes any unit
81 by Teddy Hogeborn
* Makefile (GNUTLS_CFLAGS, GNUTLS_LIBS, AVAHI_CFLAGS, AVAHI_LIBS,
211
	    tests, etc.
24.1.23 by Björn Påhlsson
Added manual pages for:
212
	  </para>
213
	</listitem>
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
214
      </varlistentry>
124 by Teddy Hogeborn
* mandos.xml (OPTIONS): Moved long options before short. Use <option>
215
      
24.1.23 by Björn Påhlsson
Added manual pages for:
216
      <varlistentry>
124 by Teddy Hogeborn
* mandos.xml (OPTIONS): Moved long options before short. Use <option>
217
	<term><option>--debug</option></term>
24.1.23 by Björn Påhlsson
Added manual pages for:
218
	<listitem>
90 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Added "--xinclude".
219
	  <xi:include href="mandos-options.xml" xpointer="debug"/>
24.1.23 by Björn Påhlsson
Added manual pages for:
220
	</listitem>
221
      </varlistentry>
182 by Teddy Hogeborn
* Makefile (install): Use "install-client-nokey".
222
      
24.1.23 by Björn Påhlsson
Added manual pages for:
223
      <varlistentry>
447 by teddy at bsnet
* mandos: Fixed "--help" output.
224
	<term><option>--debuglevel
225
	<replaceable>LEVEL</replaceable></option></term>
226
	<listitem>
227
	  <para>
228
	    Set the debugging log level.
229
	    <replaceable>LEVEL</replaceable> is a string, one of
230
	    <quote><literal>CRITICAL</literal></quote>,
231
	    <quote><literal>ERROR</literal></quote>,
232
	    <quote><literal>WARNING</literal></quote>,
233
	    <quote><literal>INFO</literal></quote>, or
234
	    <quote><literal>DEBUG</literal></quote>, in order of
235
	    increasing verbosity.  The default level is
236
	    <quote><literal>WARNING</literal></quote>.
237
	  </para>
238
	</listitem>
239
      </varlistentry>
240
      
241
      <varlistentry>
124 by Teddy Hogeborn
* mandos.xml (OPTIONS): Moved long options before short. Use <option>
242
	<term><option>--priority <replaceable>
243
	PRIORITY</replaceable></option></term>
24.1.23 by Björn Påhlsson
Added manual pages for:
244
	<listitem>
777 by Teddy Hogeborn
Bug fix for GnuTLS 3: be compatible with old 2048-bit DSA keys.
245
	  <xi:include href="mandos-options.xml" xpointer="priority"/>
24.1.23 by Björn Påhlsson
Added manual pages for:
246
	</listitem>
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
247
      </varlistentry>
182 by Teddy Hogeborn
* Makefile (install): Use "install-client-nokey".
248
      
24.1.23 by Björn Påhlsson
Added manual pages for:
249
      <varlistentry>
124 by Teddy Hogeborn
* mandos.xml (OPTIONS): Moved long options before short. Use <option>
250
	<term><option>--servicename
251
	<replaceable>NAME</replaceable></option></term>
24.1.23 by Björn Påhlsson
Added manual pages for:
252
	<listitem>
90 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Added "--xinclude".
253
	  <xi:include href="mandos-options.xml"
254
		      xpointer="servicename"/>
24.1.23 by Björn Påhlsson
Added manual pages for:
255
	</listitem>
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
256
      </varlistentry>
182 by Teddy Hogeborn
* Makefile (install): Use "install-client-nokey".
257
      
24.1.23 by Björn Påhlsson
Added manual pages for:
258
      <varlistentry>
124 by Teddy Hogeborn
* mandos.xml (OPTIONS): Moved long options before short. Use <option>
259
	<term><option>--configdir
260
	<replaceable>DIRECTORY</replaceable></option></term>
24.1.23 by Björn Påhlsson
Added manual pages for:
261
	<listitem>
262
	  <para>
81 by Teddy Hogeborn
* Makefile (GNUTLS_CFLAGS, GNUTLS_LIBS, AVAHI_CFLAGS, AVAHI_LIBS,
263
	    Directory to search for configuration files.  Default is
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
264
	    <quote><literal>/etc/mandos</literal></quote>.  See
265
	    <citerefentry><refentrytitle>mandos.conf</refentrytitle>
81 by Teddy Hogeborn
* Makefile (GNUTLS_CFLAGS, GNUTLS_LIBS, AVAHI_CFLAGS, AVAHI_LIBS,
266
	    <manvolnum>5</manvolnum></citerefentry> and <citerefentry>
267
	    <refentrytitle>mandos-clients.conf</refentrytitle>
268
	    <manvolnum>5</manvolnum></citerefentry>.
24.1.23 by Björn Påhlsson
Added manual pages for:
269
	  </para>
270
	</listitem>
271
      </varlistentry>
182 by Teddy Hogeborn
* Makefile (install): Use "install-client-nokey".
272
      
24.1.35 by Björn Påhlsson
version 1.0
273
      <varlistentry>
124 by Teddy Hogeborn
* mandos.xml (OPTIONS): Moved long options before short. Use <option>
274
	<term><option>--version</option></term>
24.1.35 by Björn Påhlsson
version 1.0
275
	<listitem>
276
	  <para>
81 by Teddy Hogeborn
* Makefile (GNUTLS_CFLAGS, GNUTLS_LIBS, AVAHI_CFLAGS, AVAHI_LIBS,
277
	    Prints the program version and exit.
24.1.35 by Björn Påhlsson
version 1.0
278
	  </para>
279
	</listitem>
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
280
      </varlistentry>
271 by Teddy Hogeborn
Merge from release branch.
281
      
282
      <varlistentry>
324 by Teddy Hogeborn
Merge from release branch.
283
	<term><option>--no-dbus</option></term>
284
	<listitem>
285
	  <xi:include href="mandos-options.xml" xpointer="dbus"/>
286
	  <para>
287
	    See also <xref linkend="dbus_interface"/>.
288
	  </para>
289
	</listitem>
290
      </varlistentry>
291
      
292
      <varlistentry>
314 by Teddy Hogeborn
Support not using IPv6 in server:
293
	<term><option>--no-ipv6</option></term>
294
	<listitem>
295
	  <xi:include href="mandos-options.xml" xpointer="ipv6"/>
296
	</listitem>
297
      </varlistentry>
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
298
      
299
      <varlistentry>
300
	<term><option>--no-restore</option></term>
301
	<listitem>
302
	  <xi:include href="mandos-options.xml" xpointer="restore"/>
546 by Teddy Hogeborn
* debian/rules (binary-common): Exclude network-hooks.d from
303
	  <para>
304
	    See also <xref linkend="persistent_state"/>.
305
	  </para>
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
306
	</listitem>
307
      </varlistentry>
518.2.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
308
      
309
      <varlistentry>
310
	<term><option>--statedir
311
	<replaceable>DIRECTORY</replaceable></option></term>
312
	<listitem>
313
	  <xi:include href="mandos-options.xml" xpointer="statedir"/>
314
	</listitem>
315
      </varlistentry>
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
316
      
317
      <varlistentry>
318
	<term><option>--socket
319
	<replaceable>FD</replaceable></option></term>
320
	<listitem>
321
	  <xi:include href="mandos-options.xml" xpointer="socket"/>
322
	</listitem>
323
      </varlistentry>
324
      
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
325
      <varlistentry>
326
	<term><option>--foreground</option></term>
327
	<listitem>
328
	  <xi:include href="mandos-options.xml"
329
		      xpointer="foreground"/>
330
	</listitem>
331
      </varlistentry>
332
      
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
333
      <varlistentry>
334
	<term><option>--no-zeroconf</option></term>
335
	<listitem>
336
	  <xi:include href="mandos-options.xml" xpointer="zeroconf"/>
337
	</listitem>
338
      </varlistentry>
339
      
24.1.23 by Björn Påhlsson
Added manual pages for:
340
    </variablelist>
341
  </refsect1>
182 by Teddy Hogeborn
* Makefile (install): Use "install-client-nokey".
342
  
84 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Use the local manpages/docbook.xsl file, do
343
  <refsect1 id="overview">
344
    <title>OVERVIEW</title>
90 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Added "--xinclude".
345
    <xi:include href="overview.xml"/>
84 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Use the local manpages/docbook.xsl file, do
346
    <para>
347
      This program is the server part.  It is a normal server program
348
      and will run in a normal system environment, not in an initial
134 by Teddy Hogeborn
* mandos.xml: Enclose "RAM" with <acronym>.
349
      <acronym>RAM</acronym> disk environment.
84 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Use the local manpages/docbook.xsl file, do
350
    </para>
351
  </refsect1>
182 by Teddy Hogeborn
* Makefile (install): Use "install-client-nokey".
352
  
81 by Teddy Hogeborn
* Makefile (GNUTLS_CFLAGS, GNUTLS_LIBS, AVAHI_CFLAGS, AVAHI_LIBS,
353
  <refsect1 id="protocol">
354
    <title>NETWORK PROTOCOL</title>
355
    <para>
356
      The Mandos server announces itself as a Zeroconf service of type
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
357
      <quote><literal>_mandos._tcp</literal></quote>.  The Mandos
358
      client connects to the announced address and port, and sends a
359
      line of text where the first whitespace-separated field is the
360
      protocol version, which currently is
361
      <quote><literal>1</literal></quote>.  The client and server then
362
      start a TLS protocol handshake with a slight quirk: the Mandos
363
      server program acts as a TLS <quote>client</quote> while the
364
      connecting Mandos client acts as a TLS <quote>server</quote>.
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
365
      The Mandos client must supply a TLS public key, and the key ID
366
      of this public key is used by the Mandos server to look up (in a
367
      list read from <filename>clients.conf</filename> at start time)
368
      which binary blob to give the client.  No other authentication
369
      or authorization is done by the server.
81 by Teddy Hogeborn
* Makefile (GNUTLS_CFLAGS, GNUTLS_LIBS, AVAHI_CFLAGS, AVAHI_LIBS,
370
    </para>
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
371
    <table>
372
      <title>Mandos Protocol (Version 1)</title><tgroup cols="3"><thead>
81 by Teddy Hogeborn
* Makefile (GNUTLS_CFLAGS, GNUTLS_LIBS, AVAHI_CFLAGS, AVAHI_LIBS,
373
      <row>
374
	<entry>Mandos Client</entry>
375
	<entry>Direction</entry>
376
	<entry>Mandos Server</entry>
377
      </row>
378
      </thead><tbody>
379
      <row>
380
	<entry>Connect</entry>
381
	<entry>-><!-- &rarr; --></entry>
382
      </row>
383
      <row>
91 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Include all DocBook-to-manpage-related
384
	<entry><quote><literal>1\r\n</literal></quote></entry>
81 by Teddy Hogeborn
* Makefile (GNUTLS_CFLAGS, GNUTLS_LIBS, AVAHI_CFLAGS, AVAHI_LIBS,
385
	<entry>-><!-- &rarr; --></entry>
386
      </row>
387
      <row>
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
388
	<entry>TLS handshake <emphasis>as TLS <quote>server</quote>
389
	</emphasis></entry>
81 by Teddy Hogeborn
* Makefile (GNUTLS_CFLAGS, GNUTLS_LIBS, AVAHI_CFLAGS, AVAHI_LIBS,
390
	<entry>&lt;-><!-- &xharr; --></entry>
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
391
	<entry>TLS handshake <emphasis>as TLS <quote>client</quote>
392
	</emphasis></entry>
81 by Teddy Hogeborn
* Makefile (GNUTLS_CFLAGS, GNUTLS_LIBS, AVAHI_CFLAGS, AVAHI_LIBS,
393
      </row>
394
      <row>
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
395
	<entry>Public key (part of TLS handshake)</entry>
81 by Teddy Hogeborn
* Makefile (GNUTLS_CFLAGS, GNUTLS_LIBS, AVAHI_CFLAGS, AVAHI_LIBS,
396
	<entry>-><!-- &rarr; --></entry>
397
      </row>
398
      <row>
399
	<entry/>
400
	<entry>&lt;-<!-- &larr; --></entry>
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
401
	<entry>Binary blob (client will assume OpenPGP data)</entry>
81 by Teddy Hogeborn
* Makefile (GNUTLS_CFLAGS, GNUTLS_LIBS, AVAHI_CFLAGS, AVAHI_LIBS,
402
      </row>
403
      <row>
404
	<entry/>
405
	<entry>&lt;-<!-- &larr; --></entry>
406
	<entry>Close</entry>
407
      </row>
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
408
    </tbody></tgroup></table>
409
  </refsect1>
182 by Teddy Hogeborn
* Makefile (install): Use "install-client-nokey".
410
  
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
411
  <refsect1 id="checking">
412
    <title>CHECKING</title>
413
    <para>
414
      The server will, by default, continually check that the clients
415
      are still up.  If a client has not been confirmed as being up
416
      for some time, the client is assumed to be compromised and is no
367 by Teddy Hogeborn
* init.d-mandos: Bug fix: Correct the LSB header.
417
      longer eligible to receive the encrypted password.  (Manual
418
      intervention is required to re-enable a client.)  The timeout,
24.1.179 by Björn Påhlsson
New feature:
419
      extended timeout, checker program, and interval between checks
420
      can be configured both globally and per client; see
421
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
558 by Teddy Hogeborn
* mandos.xml (CHECKING): Don't claim that a successful secret request
422
      <manvolnum>5</manvolnum></citerefentry>.
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
423
    </para>
81 by Teddy Hogeborn
* Makefile (GNUTLS_CFLAGS, GNUTLS_LIBS, AVAHI_CFLAGS, AVAHI_LIBS,
424
  </refsect1>
182 by Teddy Hogeborn
* Makefile (install): Use "install-client-nokey".
425
  
440 by Teddy Hogeborn
* mandos.xml (APPROVAL): New section.
426
  <refsect1 id="approval">
427
    <title>APPROVAL</title>
428
    <para>
429
      The server can be configured to require manual approval for a
430
      client before it is sent its secret.  The delay to wait for such
431
      approval and the default action (approve or deny) can be
432
      configured both globally and per client; see <citerefentry>
433
      <refentrytitle>mandos-clients.conf</refentrytitle>
434
      <manvolnum>5</manvolnum></citerefentry>.  By default all clients
435
      will be approved immediately without delay.
436
    </para>
437
    <para>
438
      This can be used to deny a client its secret if not manually
439
      approved within a specified time.  It can also be used to make
440
      the server delay before giving a client its secret, allowing
441
      optional manual denying of this specific client.
442
    </para>
443
    
444
  </refsect1>
445
  
81 by Teddy Hogeborn
* Makefile (GNUTLS_CFLAGS, GNUTLS_LIBS, AVAHI_CFLAGS, AVAHI_LIBS,
446
  <refsect1 id="logging">
447
    <title>LOGGING</title>
448
    <para>
91 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Include all DocBook-to-manpage-related
449
      The server will send log message with various severity levels to
521.1.1 by teddy at bsnet
* plugins.d/mandos-client.c (SYNOPSIS, OPTIONS): Document
450
      <filename class="devicefile">/dev/log</filename>.  With the
81 by Teddy Hogeborn
* Makefile (GNUTLS_CFLAGS, GNUTLS_LIBS, AVAHI_CFLAGS, AVAHI_LIBS,
451
      <option>--debug</option> option, it will log even more messages,
452
      and also show them on the console.
453
    </para>
454
  </refsect1>
182 by Teddy Hogeborn
* Makefile (install): Use "install-client-nokey".
455
  
546 by Teddy Hogeborn
* debian/rules (binary-common): Exclude network-hooks.d from
456
  <refsect1 id="persistent_state">
457
    <title>PERSISTENT STATE</title>
458
    <para>
459
      Client settings, initially read from
460
      <filename>clients.conf</filename>, are persistent across
461
      restarts, and run-time changes will override settings in
462
      <filename>clients.conf</filename>.  However, if a setting is
463
      <emphasis>changed</emphasis> (or a client added, or removed) in
464
      <filename>clients.conf</filename>, this will take precedence.
465
    </para>
466
  </refsect1>
467
  
324 by Teddy Hogeborn
Merge from release branch.
468
  <refsect1 id="dbus_interface">
469
    <title>D-BUS INTERFACE</title>
470
    <para>
471
      The server will by default provide a D-Bus system bus interface.
472
      This interface will only be accessible by the root user or a
423 by Teddy Hogeborn
Documentation changes:
473
      Mandos-specific user, if such a user exists.  For documentation
474
      of the D-Bus API, see the file <filename>DBUS-API</filename>.
324 by Teddy Hogeborn
Merge from release branch.
475
    </para>
476
  </refsect1>
477
  
24.1.55 by Björn Påhlsson
updated some partial manual pages
478
  <refsect1 id="exit_status">
479
    <title>EXIT STATUS</title>
480
    <para>
81 by Teddy Hogeborn
* Makefile (GNUTLS_CFLAGS, GNUTLS_LIBS, AVAHI_CFLAGS, AVAHI_LIBS,
481
      The server will exit with a non-zero exit status only when a
482
      critical error is encountered.
24.1.55 by Björn Påhlsson
updated some partial manual pages
483
    </para>
484
  </refsect1>
182 by Teddy Hogeborn
* Makefile (install): Use "install-client-nokey".
485
  
85 by Teddy Hogeborn
* mandos.xml (SYNOPSIS): Removed unnecessary 'choice="opt"' from <arg>
486
  <refsect1 id="environment">
487
    <title>ENVIRONMENT</title>
488
    <variablelist>
489
      <varlistentry>
117 by Teddy Hogeborn
* mandos-keygen.xml (ENVIRONMENT): Replaced <varname> with <envar>.
490
	<term><envar>PATH</envar></term>
85 by Teddy Hogeborn
* mandos.xml (SYNOPSIS): Removed unnecessary 'choice="opt"' from <arg>
491
	<listitem>
492
	  <para>
493
	    To start the configured checker (see <xref
494
	    linkend="checking"/>), the server uses
495
	    <filename>/bin/sh</filename>, which in turn uses
496
	    <varname>PATH</varname> to search for matching commands if
497
	    an absolute path is not given.  See <citerefentry>
498
	    <refentrytitle>sh</refentrytitle><manvolnum>1</manvolnum>
91 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Include all DocBook-to-manpage-related
499
	    </citerefentry>.
85 by Teddy Hogeborn
* mandos.xml (SYNOPSIS): Removed unnecessary 'choice="opt"' from <arg>
500
	  </para>
501
	</listitem>
502
      </varlistentry>
503
    </variablelist>
504
  </refsect1>
182 by Teddy Hogeborn
* Makefile (install): Use "install-client-nokey".
505
  
224 by Teddy Hogeborn
* mandos-keygen.xml (FILES): Fixed id to be "files", not "file".
506
  <refsect1 id="files">
24.1.55 by Björn Påhlsson
updated some partial manual pages
507
    <title>FILES</title>
508
    <para>
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
509
      Use the <option>--configdir</option> option to change where
510
      <command>&COMMANDNAME;</command> looks for its configurations
511
      files.  The default file names are listed here.
24.1.55 by Björn Påhlsson
updated some partial manual pages
512
    </para>
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
513
    <variablelist>
514
      <varlistentry>
515
	<term><filename>/etc/mandos/mandos.conf</filename></term>
516
	<listitem>
517
	  <para>
518
	    Server-global settings.  See
519
	    <citerefentry><refentrytitle>mandos.conf</refentrytitle>
520
	    <manvolnum>5</manvolnum></citerefentry> for details.
521
	  </para>
522
	</listitem>
523
      </varlistentry>
524
      <varlistentry>
525
	<term><filename>/etc/mandos/clients.conf</filename></term>
526
	<listitem>
527
	  <para>
528
	    List of clients and client-specific settings.  See
529
	    <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
530
	    <manvolnum>5</manvolnum></citerefentry> for details.
531
	  </para>
532
	</listitem>
533
      </varlistentry>
534
      <varlistentry>
626 by Teddy Hogeborn
* Makefile (CFLAGS, LDFLAGS): Keep default flags from environment.
535
	<term><filename>/run/mandos.pid</filename></term>
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
536
	<listitem>
537
	  <para>
439 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
538
	    The file containing the process id of the
539
	    <command>&COMMANDNAME;</command> process started last.
636 by Teddy Hogeborn
Fall back to /var/run for pidfile if /run is not a directory.
540
	    <emphasis >Note:</emphasis> If the <filename
541
	    class="directory">/run</filename> directory does not
542
	    exist, <filename>/var/run/mandos.pid</filename> will be
543
	    used instead.
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
544
	  </para>
545
	</listitem>
546
      </varlistentry>
547
      <varlistentry>
518.2.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
548
	<term><filename
549
	class="directory">/var/lib/mandos</filename></term>
550
	<listitem>
551
	  <para>
552
	    Directory where persistent state will be saved.  Change
553
	    this with the <option>--statedir</option> option.  See
554
	    also the <option>--no-restore</option> option.
555
	  </para>
556
	</listitem>
557
      </varlistentry>
558
      <varlistentry>
795 by Teddy Hogeborn
* mandos.xml (FILES): Removed duplicate entry for “/dev/log”.
559
	<term><filename class="devicefile">/dev/log</filename></term>
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
560
	<listitem>
561
	  <para>
562
	    The Unix domain socket to where local syslog messages are
563
	    sent.
564
	  </para>
565
	</listitem>
566
      </varlistentry>
85 by Teddy Hogeborn
* mandos.xml (SYNOPSIS): Removed unnecessary 'choice="opt"' from <arg>
567
      <varlistentry>
568
	<term><filename>/bin/sh</filename></term>
569
	<listitem>
570
	  <para>
571
	    This is used to start the configured checker command for
572
	    each client.  See <citerefentry>
573
	    <refentrytitle>mandos-clients.conf</refentrytitle>
574
	    <manvolnum>5</manvolnum></citerefentry> for details.
575
	  </para>
576
	</listitem>
577
      </varlistentry>
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
578
    </variablelist>
579
  </refsect1>
85 by Teddy Hogeborn
* mandos.xml (SYNOPSIS): Removed unnecessary 'choice="opt"' from <arg>
580
  
24.1.55 by Björn Påhlsson
updated some partial manual pages
581
  <refsect1 id="bugs">
582
    <title>BUGS</title>
583
    <para>
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
584
      This server might, on especially fatal errors, emit a Python
585
      backtrace.  This could be considered a feature.
24.1.55 by Björn Påhlsson
updated some partial manual pages
586
    </para>
85 by Teddy Hogeborn
* mandos.xml (SYNOPSIS): Removed unnecessary 'choice="opt"' from <arg>
587
    <para>
588
      There is no fine-grained control over logging and debug output.
589
    </para>
821 by Teddy Hogeborn
Add bug reporting information to manual pages
590
    <xi:include href="bugs.xml"/>
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
591
  </refsect1>
85 by Teddy Hogeborn
* mandos.xml (SYNOPSIS): Removed unnecessary 'choice="opt"' from <arg>
592
  
593
  <refsect1 id="example">
594
    <title>EXAMPLE</title>
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
595
    <informalexample>
596
      <para>
597
	Normal invocation needs no options:
598
      </para>
599
      <para>
110 by Teddy Hogeborn
* mandos.xml (EXAMPLE): Replaced all occurences of command name with
600
	<userinput>&COMMANDNAME;</userinput>
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
601
      </para>
602
    </informalexample>
603
    <informalexample>
604
      <para>
84 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Use the local manpages/docbook.xsl file, do
605
	Run the server in debug mode, read configuration files from
518.2.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
606
	the <filename class="directory">~/mandos</filename> directory,
607
	and use the Zeroconf service name <quote>Test</quote> to not
608
	collide with any other official Mandos server on this host:
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
609
      </para>
610
      <para>
611
612
<!-- do not wrap this line -->
110 by Teddy Hogeborn
* mandos.xml (EXAMPLE): Replaced all occurences of command name with
613
<userinput>&COMMANDNAME; --debug --configdir ~/mandos --servicename Test</userinput>
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
614
615
      </para>
616
    </informalexample>
617
    <informalexample>
618
      <para>
619
	Run the server normally, but only listen to one interface and
620
	only on the link-local address on that interface:
621
      </para>
622
      <para>
623
624
<!-- do not wrap this line -->
110 by Teddy Hogeborn
* mandos.xml (EXAMPLE): Replaced all occurences of command name with
625
<userinput>&COMMANDNAME; --interface eth7 --address fe80::aede:48ff:fe71:f6f2</userinput>
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
626
627
      </para>
628
    </informalexample>
24.1.55 by Björn Påhlsson
updated some partial manual pages
629
  </refsect1>
182 by Teddy Hogeborn
* Makefile (install): Use "install-client-nokey".
630
  
24.1.55 by Björn Påhlsson
updated some partial manual pages
631
  <refsect1 id="security">
632
    <title>SECURITY</title>
224 by Teddy Hogeborn
* mandos-keygen.xml (FILES): Fixed id to be "files", not "file".
633
    <refsect2 id="server">
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
634
      <title>SERVER</title>
635
      <para>
85 by Teddy Hogeborn
* mandos.xml (SYNOPSIS): Removed unnecessary 'choice="opt"' from <arg>
636
	Running this <command>&COMMANDNAME;</command> server program
637
	should not in itself present any security risk to the host
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
638
	computer running it.  The program switches to a non-root user
639
	soon after startup.
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
640
      </para>
641
    </refsect2>
224 by Teddy Hogeborn
* mandos-keygen.xml (FILES): Fixed id to be "files", not "file".
642
    <refsect2 id="clients">
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
643
      <title>CLIENTS</title>
644
      <para>
645
	The server only gives out its stored data to clients which
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
646
	does have the correct key ID of the stored key ID.  This is
647
	guaranteed by the fact that the client sends its public key in
648
	the TLS handshake; this ensures it to be genuine.  The server
649
	computes the key ID of the key itself and looks up the key ID
650
	in its list of clients. The <filename>clients.conf</filename>
651
	file (see
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
652
	<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
84 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Use the local manpages/docbook.xsl file, do
653
	<manvolnum>5</manvolnum></citerefentry>)
654
	<emphasis>must</emphasis> be made non-readable by anyone
201 by Teddy Hogeborn
* mandos.xml (SECURITY): Minor wording improvement.
655
	except the user starting the server (usually root).
84 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Use the local manpages/docbook.xsl file, do
656
      </para>
657
      <para>
658
	As detailed in <xref linkend="checking"/>, the status of all
659
	client computers will continually be checked and be assumed
660
	compromised if they are gone for too long.
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
661
      </para>
662
      <para>
663
	For more details on client-side security, see
171 by Teddy Hogeborn
Renamed "password-request" to "mandos-client".
664
	<citerefentry><refentrytitle>mandos-client</refentrytitle>
83 by Teddy Hogeborn
* Makefile (MANPOST): Bug fix: do not replace *all* "een" with "en".
665
	<manvolnum>8mandos</manvolnum></citerefentry>.
666
      </para>
667
    </refsect2>
24.1.55 by Björn Påhlsson
updated some partial manual pages
668
  </refsect1>
182 by Teddy Hogeborn
* Makefile (install): Use "install-client-nokey".
669
  
24.1.55 by Björn Påhlsson
updated some partial manual pages
670
  <refsect1 id="see_also">
671
    <title>SEE ALSO</title>
92 by Teddy Hogeborn
* mandos-keygen.xml (SEE ALSO): Remove "and".
672
    <para>
493 by Teddy Hogeborn
* Makefile (DOCS): Added "intro.8mandos".
673
      <citerefentry><refentrytitle>intro</refentrytitle>
674
      <manvolnum>8mandos</manvolnum></citerefentry>,
675
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
676
      <manvolnum>5</manvolnum></citerefentry>,
677
      <citerefentry><refentrytitle>mandos.conf</refentrytitle>
678
      <manvolnum>5</manvolnum></citerefentry>,
679
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
680
      <manvolnum>8mandos</manvolnum></citerefentry>,
681
      <citerefentry><refentrytitle>sh</refentrytitle>
682
      <manvolnum>1</manvolnum></citerefentry>
92 by Teddy Hogeborn
* mandos-keygen.xml (SEE ALSO): Remove "and".
683
    </para>
84 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Use the local manpages/docbook.xsl file, do
684
    <variablelist>
685
      <varlistentry>
686
	<term>
687
	  <ulink url="http://www.zeroconf.org/">Zeroconf</ulink>
688
	</term>
689
	<listitem>
690
	  <para>
691
	    Zeroconf is the network protocol standard used by clients
692
	    for finding this Mandos server on the local network.
693
	  </para>
694
	</listitem>
695
      </varlistentry>
696
      <varlistentry>
697
	<term>
1121 by Teddy Hogeborn
Change URL for Avahi to use HTTPS
698
	  <ulink url="https://www.avahi.org/">Avahi</ulink>
84 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Use the local manpages/docbook.xsl file, do
699
	</term>
700
      <listitem>
701
	<para>
702
	  Avahi is the library this server calls to implement
703
	  Zeroconf service announcements.
704
	</para>
705
      </listitem>
706
      </varlistentry>
707
      <varlistentry>
708
	<term>
868 by Teddy Hogeborn
Change all http:// URLs to https:// wherever possible.
709
	  <ulink url="https://gnutls.org/">GnuTLS</ulink>
84 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Use the local manpages/docbook.xsl file, do
710
	</term>
711
      <listitem>
712
	<para>
713
	  GnuTLS is the library this server uses to implement TLS for
714
	  communicating securely with the client, and at the same time
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
715
	  confidently get the client’s public key.
84 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Use the local manpages/docbook.xsl file, do
716
	</para>
717
      </listitem>
718
      </varlistentry>
719
      <varlistentry>
720
	<term>
108 by Teddy Hogeborn
* mandos-options.xml (address): Refer to IPv4-mapped IPv6 address
721
	  RFC 4291: <citetitle>IP Version 6 Addressing
722
	  Architecture</citetitle>
84 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Use the local manpages/docbook.xsl file, do
723
	</term>
724
	<listitem>
108 by Teddy Hogeborn
* mandos-options.xml (address): Refer to IPv4-mapped IPv6 address
725
	  <variablelist>
726
	    <varlistentry>
727
	      <term>Section 2.2: <citetitle>Text Representation of
728
	      Addresses</citetitle></term>
729
	      <listitem><para/></listitem>
730
	    </varlistentry>
731
	    <varlistentry>
732
	      <term>Section 2.5.5.2: <citetitle>IPv4-Mapped IPv6
733
	      Address</citetitle></term>
734
	      <listitem><para/></listitem>
735
	    </varlistentry>
736
	    <varlistentry>
737
	    <term>Section 2.5.6, <citetitle>Link-Local IPv6 Unicast
738
	    Addresses</citetitle></term>
739
	    <listitem>
740
	      <para>
741
		The clients use IPv6 link-local addresses, which are
742
		immediately usable since a link-local addresses is
743
		automatically assigned to a network interfaces when it
744
		is brought up.
745
	      </para>
746
	    </listitem>
747
	    </varlistentry>
748
	  </variablelist>
84 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Use the local manpages/docbook.xsl file, do
749
	</listitem>
750
      </varlistentry>
751
      <varlistentry>
752
	<term>
741 by Teddy Hogeborn
mandos.xml (SEE ALSO): Update links.
753
	  RFC 5246: <citetitle>The Transport Layer Security (TLS)
754
	  Protocol Version 1.2</citetitle>
84 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Use the local manpages/docbook.xsl file, do
755
	</term>
756
      <listitem>
757
	<para>
741 by Teddy Hogeborn
mandos.xml (SEE ALSO): Update links.
758
	  TLS 1.2 is the protocol implemented by GnuTLS.
84 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Use the local manpages/docbook.xsl file, do
759
	</para>
760
      </listitem>
761
      </varlistentry>
762
      <varlistentry>
763
	<term>
108 by Teddy Hogeborn
* mandos-options.xml (address): Refer to IPv4-mapped IPv6 address
764
	  RFC 4880: <citetitle>OpenPGP Message Format</citetitle>
84 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Use the local manpages/docbook.xsl file, do
765
	</term>
766
      <listitem>
767
	<para>
768
	  The data sent to clients is binary encrypted OpenPGP data.
769
	</para>
770
      </listitem>
771
      </varlistentry>
772
      <varlistentry>
773
	<term>
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
774
	  RFC 7250: <citetitle>Using Raw Public Keys in Transport
775
	  Layer Security (TLS) and Datagram Transport Layer Security
776
	  (DTLS)</citetitle>
777
	</term>
778
      <listitem>
779
	<para>
780
	  This is implemented by GnuTLS version 3.6.6 and is, if
781
	  present, used by this server so that raw public keys can be
782
	  used.
783
	</para>
784
      </listitem>
785
      </varlistentry>
786
      <varlistentry>
787
	<term>
741 by Teddy Hogeborn
mandos.xml (SEE ALSO): Update links.
788
	  RFC 6091: <citetitle>Using OpenPGP Keys for Transport Layer
789
	  Security (TLS) Authentication</citetitle>
84 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Use the local manpages/docbook.xsl file, do
790
	</term>
791
      <listitem>
792
	<para>
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
793
	  This is implemented by GnuTLS before version 3.6.0 and is,
794
	  if present, used by this server so that OpenPGP keys can be
795
	  used.
84 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Use the local manpages/docbook.xsl file, do
796
	</para>
797
      </listitem>
798
      </varlistentry>
799
    </variablelist>
24.1.55 by Björn Påhlsson
updated some partial manual pages
800
  </refsect1>
24.1.23 by Björn Påhlsson
Added manual pages for:
801
</refentry>
111 by Teddy Hogeborn
* mandos-clients.conf.xml (ENTITY TIMESTAMP): New. Automatically
802
<!-- Local Variables: -->
803
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
804
<!-- time-stamp-end: "[\"']>" -->
805
<!-- time-stamp-format: "%:y-%02m-%02d" -->
806
<!-- End: -->