From garbytrash at gmail.com  Sat Dec  1 10:36:19 2012
From: garbytrash at gmail.com (Zenny)
Date: Sat, 1 Dec 2012 10:36:19 +0100
Subject: Some starting documents
In-Reply-To: <CACuV5sBTAVdtRNdRN0uT3RFfBLomU6kWwswQVXX4=tje7fo7tQ@mail.gmail.com>
References: <CACuV5sBTAVdtRNdRN0uT3RFfBLomU6kWwswQVXX4=tje7fo7tQ@mail.gmail.com>
Message-ID: <CACuV5sBCbV2-mu-wd9ibGF45KmY9c7RSDb3nZdYd5+TV-ZwWsw@mail.gmail.com>

Hi again:

I thoroughly read the documents in the site, yet I cannot figure out
how to achieve this:

1) Two mandos servers-clients authenticating between each other which
in turn provide authentication passwords to the local clients

2) The /boot is not partitioned, yet / and swap is encrypted over LVM
(dm-crypt plus LUKS).

I searched over the Net and could not figure out how to achieve this.
Any pointers shall be appreciated.

Regards
zenny

On 11/30/12, Zenny <garbytrash at gmail.com> wrote:
> Hi:
>
> I happen to see your nice application just today and feel like
> deploying. Unfortunately I am getting errors while installing
> mados-client in embedded debian squeeze (voyage linux actually).
>
> 1) gpg: WARNING: some OpenPGP programs can't handle a DSA key with
> this digest size
>
> I know of this error maybe it is run on a i386 machine.
>
> 2) cryptsetup: WARNING: could not determine root device from /etc/fstab
>
> which looks like:
> root at voyage:~# cat /etc/fstab
> #/dev/hda1       /       ext2    defaults,noatime,rw     0       0
> proc            /proc   proc    defaults                0       0
> tmpfs 			/tmp 	tmpfs 	nosuid,nodev 			0 		0
> #tmpfs           /rw     tmpfs   defaults,size=32M        0       0
>
>
> Appreciate if there is any pointers! Is there any tutorials on how to
> deploy mandos? FYI, I am trying to share keys between two mandos
> servers. Thanks!
>

From dick at fouter.net  Sat Dec  1 12:43:43 2012
From: dick at fouter.net (Dick Middleton)
Date: Sat, 01 Dec 2012 11:43:43 +0000
Subject: Some starting documents
In-Reply-To: <CACuV5sBCbV2-mu-wd9ibGF45KmY9c7RSDb3nZdYd5+TV-ZwWsw@mail.gmail.com>
References: <CACuV5sBTAVdtRNdRN0uT3RFfBLomU6kWwswQVXX4=tje7fo7tQ@mail.gmail.com>
	<CACuV5sBCbV2-mu-wd9ibGF45KmY9c7RSDb3nZdYd5+TV-ZwWsw@mail.gmail.com>
Message-ID: <50B9ED6F.3020909@fouter.net>

On 12/01/12 09:36, Zenny wrote:
> Hi again:
> 
> I thoroughly read the documents in the site, yet I cannot figure out
> how to achieve this:
> 
> 1) Two mandos servers-clients authenticating between each other which
> in turn provide authentication passwords to the local clients

Mandos servers and Mandos clients are completely separate things. You need to
configure each server also as a client and give the other server its client
config.

> 2) The /boot is not partitioned, yet / and swap is encrypted over LVM
> (dm-crypt plus LUKS).

/boot can't be encrypted; kernel must be readable.  I'm not sure if it can
even be an LVM partition.  Need to check grub manual for that.  I usually make
the first partition on each disk about 250MB and install kernel/initrd and
grub etc in each.  You can mirror these boot partitions if you want RAID0.

> I searched over the Net and could not figure out how to achieve this.
> Any pointers shall be appreciated.

Usually the rest of the disk is made a single (possibly RAID) partition and
then LUKS encrypted.  lvm then uses the encrypted partition.  However you can,
if you prefer, use the un-encrypted partiton for lvm and encrypt each logical
volume individually as required.

I hope that helps

Dick



From garbytrash at gmail.com  Sun Dec  2 10:31:20 2012
From: garbytrash at gmail.com (Zenny)
Date: Sun, 2 Dec 2012 10:31:20 +0100
Subject: Some starting documents
In-Reply-To: <CACuV5sBCbV2-mu-wd9ibGF45KmY9c7RSDb3nZdYd5+TV-ZwWsw@mail.gmail.com>
References: <CACuV5sBTAVdtRNdRN0uT3RFfBLomU6kWwswQVXX4=tje7fo7tQ@mail.gmail.com>
	<CACuV5sBCbV2-mu-wd9ibGF45KmY9c7RSDb3nZdYd5+TV-ZwWsw@mail.gmail.com>
Message-ID: <CACuV5sCHiRWSX_aC0__g0AZmQeQGoUaErJP-PactnhLhBrBfgw@mail.gmail.com>

Thanks Dick for information.

About the first mandos server-client pair I meant the mandos server
which also tries to authenticate as client with each other, I
installed mandos sever and clients in both of them and copied the
output of 'mandos-keygen --passphrase' to the server's
/etc/mandos/clients.conf yet it does not authenticate, yet asks for
the passphrase in console?

Tried to execute the following in the client console (as stated in
http://bzr.recompile.se/loggerhead/mandos/trunk/annotate/head:/debian/mandos-client.README.Debian),
but nothing happens even for hours.

#/usr/lib/mandos/plugins.d/mandos-client \
> --pubkey=/etc/keys/mandos/pubkey.txt \
> --seckey=/etc/keys/mandos/seckey.txt; echo

What did I miss? What other configuration changes that I need to make
to make it work?

Thanks!

On 12/1/12, Zenny <garbytrash at gmail.com> wrote:
> Hi again:
>
> I thoroughly read the documents in the site, yet I cannot figure out
> how to achieve this:
>
> 1) Two mandos servers-clients authenticating between each other which
> in turn provide authentication passwords to the local clients
>
> 2) The /boot is not partitioned, yet / and swap is encrypted over LVM
> (dm-crypt plus LUKS).
>
> I searched over the Net and could not figure out how to achieve this.
> Any pointers shall be appreciated.
>
> Regards
> zenny
>
> On 11/30/12, Zenny <garbytrash at gmail.com> wrote:
>> Hi:
>>
>> I happen to see your nice application just today and feel like
>> deploying. Unfortunately I am getting errors while installing
>> mados-client in embedded debian squeeze (voyage linux actually).
>>
>> 1) gpg: WARNING: some OpenPGP programs can't handle a DSA key with
>> this digest size
>>
>> I know of this error maybe it is run on a i386 machine.
>>
>> 2) cryptsetup: WARNING: could not determine root device from /etc/fstab
>>
>> which looks like:
>> root at voyage:~# cat /etc/fstab
>> #/dev/hda1       /       ext2    defaults,noatime,rw     0       0
>> proc            /proc   proc    defaults                0       0
>> tmpfs 			/tmp 	tmpfs 	nosuid,nodev 			0 		0
>> #tmpfs           /rw     tmpfs   defaults,size=32M        0       0
>>
>>
>> Appreciate if there is any pointers! Is there any tutorials on how to
>> deploy mandos? FYI, I am trying to share keys between two mandos
>> servers. Thanks!
>>
>

From teddy at recompile.se  Sun Dec  2 16:51:47 2012
From: teddy at recompile.se (Teddy Hogeborn)
Date: Sun, 02 Dec 2012 16:51:47 +0100
Subject: Some starting documents
In-Reply-To: <CACuV5sBTAVdtRNdRN0uT3RFfBLomU6kWwswQVXX4=tje7fo7tQ@mail.gmail.com>
	(Zenny's message of "Fri, 30 Nov 2012 10:19:40 +0100")
References: <CACuV5sBTAVdtRNdRN0uT3RFfBLomU6kWwswQVXX4=tje7fo7tQ@mail.gmail.com>
Message-ID: <87sj7oih9o.fsf@tower.recompile.se>

Zenny <garbytrash at gmail.com> writes:

> I happen to see your nice application just today and feel like
> deploying. Unfortunately I am getting errors while installing
> mados-client in embedded debian squeeze (voyage linux actually).
>
> 1) gpg: WARNING: some OpenPGP programs can't handle a DSA key with
> this digest size
>
> I know of this error maybe it is run on a i386 machine.

No; it happens on all platforms, but it is a harmless warning concerning
a use case which doesn't apply for Mandos.

> 2) cryptsetup: WARNING: could not determine root device from /etc/fstab
>
> which looks like:
> root at voyage:~# cat /etc/fstab
> #/dev/hda1       /       ext2    defaults,noatime,rw     0       0
> proc            /proc   proc    defaults                0       0
> tmpfs 			/tmp 	tmpfs 	nosuid,nodev 			0 		0
> #tmpfs           /rw     tmpfs   defaults,size=32M        0       0

You don't have a root file system at all?  What?  I am confused.

> Appreciate if there is any pointers! Is there any tutorials on how to
> deploy mandos? FYI, I am trying to share keys between two mandos
> servers. Thanks!

Step 1: Install Debian (or derivative) using full-disk encryption.

Step 2: Install the Mandos packages and read the README.Debian files in
/usr/share/doc/<package>.

/Teddy Hogeborn

From dick at fouter.net  Sun Dec  2 17:06:13 2012
From: dick at fouter.net (Dick Middleton)
Date: Sun, 02 Dec 2012 16:06:13 +0000
Subject: Some starting documents
In-Reply-To: <CACuV5sCHiRWSX_aC0__g0AZmQeQGoUaErJP-PactnhLhBrBfgw@mail.gmail.com>
References: <CACuV5sBTAVdtRNdRN0uT3RFfBLomU6kWwswQVXX4=tje7fo7tQ@mail.gmail.com>
	<CACuV5sBCbV2-mu-wd9ibGF45KmY9c7RSDb3nZdYd5+TV-ZwWsw@mail.gmail.com>
	<CACuV5sCHiRWSX_aC0__g0AZmQeQGoUaErJP-PactnhLhBrBfgw@mail.gmail.com>
Message-ID: <50BB7C75.7040104@fouter.net>

On 12/02/12 09:31, Zenny wrote:
> Thanks Dick for information.
> 
> About the first mandos server-client pair I meant the mandos server
> which also tries to authenticate as client with each other, I
> installed mandos sever and clients in both of them and copied the
> output of 'mandos-keygen --passphrase' to the server's
> /etc/mandos/clients.conf yet it does not authenticate, yet asks for
> the passphrase in console?

If it asks for a passphrase it means the password is not being returned by mandos.

> 
> Tried to execute the following in the client console (as stated in
> http://bzr.recompile.se/loggerhead/mandos/trunk/annotate/head:/debian/mandos-client.README.Debian),
> but nothing happens even for hours.
> 
> #/usr/lib/mandos/plugins.d/mandos-client \
>> --pubkey=/etc/keys/mandos/pubkey.txt \
>> --seckey=/etc/keys/mandos/seckey.txt; echo

That's a good clue.   It means it's not working.

If you've put the key from mandos-keygen --passphrase of computer A into
clients.conf on computer B and then run mandos-client on computer A the
password should be returned.

If it isn't then you need to check that the mandos server on computer B hears
the request.  If it does but fails to respond with password then you may have
a problem with the keys.  If it doesn't hear the request then you have a
problem with avahi or possibly firewall.

You need to increase debug level on client and server so there are useful
error messages.  To help further you need to post error messages on this list.

Dick



From teddy at recompile.se  Sun Dec  2 17:12:35 2012
From: teddy at recompile.se (Teddy Hogeborn)
Date: Sun, 02 Dec 2012 17:12:35 +0100
Subject: Some starting documents
In-Reply-To: <50B87CE8.1090702@fouter.net> (Dick Middleton's message of "Fri, 
	30 Nov 2012 09:31:20 +0000")
References: <CACuV5sBTAVdtRNdRN0uT3RFfBLomU6kWwswQVXX4=tje7fo7tQ@mail.gmail.com>
	<50B87CE8.1090702@fouter.net>
Message-ID: <87lidgigb0.fsf@tower.recompile.se>

Dick Middleton <dick at fouter.net> writes:

> On 11/30/12 09:19, Zenny wrote:
>
>> I happen to see your nice application just today and feel like
>> deploying. Unfortunately I am getting errors while installing
>> mados-client in embedded debian squeeze (voyage linux actually).
>> 
>> 1) gpg: WARNING: some OpenPGP programs can't handle a DSA key with
>> this digest size
>
> I've had a lot of trouble with keys.  There is a strong suspicion it's
> gnutls causing this.  Try shorter keys and try RSA also if possible
> get the same gnutls library version on server and client.

That particular warning comes from GPG when generating new keys, not
from GnuTLS.  Shorter keys or RSA keys instead of DSA should work fine
too, so that is indeed something to try if one experiences trouble later
on.  But this warning is not a reason to worry.

(The warning concerns interoperability with other OpenPGP
implementations when using DSA keys with the very long key length used
by default by mandos-keygen.  This is not a problem for Mandos since
both the server and client uses GnuPG.)

>> 2) cryptsetup: WARNING: could not determine root device from /etc/fstab
>> 
>> which looks like:
>> root at voyage:~# cat /etc/fstab
>> #/dev/hda1       /       ext2    defaults,noatime,rw     0       0
>
> You've commented it out!  Whether it is a real partition or a LUKS
> partition it needs to be here.

Yes.  Probably something like /dev/mapper/voyage-root instead of
/dev/hda1, but all this should have been automatically set up by the
Debian installation.  (Converting from a non-encrypted file system to an
encrypted one is somewhat involved and the few times I've done it I did
it by hand using various custom strategies each time.)

> The documentation on the website and supplied is probably the best.
> It is concise though so read very carefully.  If you need something
> more cuddly you'll need to google.

:-)

We apologize for the terseness of the documentation, but when having
limited resources when writing documentation it's a choice of being
complete or verbose; we chose completeness.

/Teddy

From garbytrash at gmail.com  Sun Dec  2 21:28:16 2012
From: garbytrash at gmail.com (Zenny)
Date: Sun, 2 Dec 2012 21:28:16 +0100
Subject: Some starting documents
In-Reply-To: <CACuV5sCHiRWSX_aC0__g0AZmQeQGoUaErJP-PactnhLhBrBfgw@mail.gmail.com>
References: <CACuV5sBTAVdtRNdRN0uT3RFfBLomU6kWwswQVXX4=tje7fo7tQ@mail.gmail.com>
	<CACuV5sBCbV2-mu-wd9ibGF45KmY9c7RSDb3nZdYd5+TV-ZwWsw@mail.gmail.com>
	<CACuV5sCHiRWSX_aC0__g0AZmQeQGoUaErJP-PactnhLhBrBfgw@mail.gmail.com>
Message-ID: <CACuV5sBv8MoiYsgVSS-D-_wLD5SxRNor0Y5Gs9Qr=r0fSi4tUQ@mail.gmail.com>

Dear Teddy and Dick:

I tried also with a completely new debian squeeze installation with
dm-crypt and LUKS which has the following in the fstab:

# <file system> <mount point>   <type>  <options>       <dump>  <pass>
proc            /proc           proc    defaults        0       0
/dev/mapper/gw0-root /               ext3    errors=remount-ro 0       1
# /boot was on /dev/sda1 during installation
UUID=22c1e040-0527-4845-b14d-3db74829167f /boot           ext2
defaults        0       2
/dev/mapper/gw0-home /home           ext3    defaults        0       2
/dev/mapper/gw0-tmp /tmp            ext3    defaults        0       2
/dev/mapper/gw0-usr /usr            ext3    defaults        0       2
/dev/mapper/gw0-var /var            ext3    defaults        0       2
/dev/mapper/gw0-swap_1 none            swap    sw              0       0
/dev/scd0       /media/cdrom0   udf,iso9660 user,noauto     0       0

This time the installation on the mandor-client in the machine works
and still executing:

#/usr/lib/mandos/plugins.d/mandos-client \
> --pubkey=/etc/keys/mandos/pubkey.txt \
> --seckey=/etc/keys/mandos/seckey.txt; echo

Does not give any output even after eons of time.

What I did was:

1) Installed a completely new instance of debian squeeze using guided
installation with encryption in two VMs,
2) then installed mandos-server in VM A and mandos-client in VM B.
3) Generated the client info (mandos-keygen --password) in VM B
(mandos-client) and pasted that in /etc/mandos/clients.conf of VM A
(mandos server)
4) Restarted mandos server in A and rebooted VM B to check whether it
can fetch information from server A to boot.
5) Executed the above command to echo the password, but no output.

There is nothing I could see where I can see the debug command,
because VM B cannot fetch the password from mandos-server in VM A,
meaning I have to feed the encryption password manually to boot VM B.

BTW, Teddy, the documentation is neither complete or verbose. It is
wholly incomplete. At least I could have helped you to create a
document, provided something works in my case. And it is not working
at all? I am struggling for the last two days to make it work, yet no
go! Maybe this is the reason there is little adoption of mandos is not
so strong.

I followed a longer solution for a similar solution (using a longer
method with manual remote feeding of the key), but that is not what I
am seeking rather something like mandos. But there is no luck that it
worked.

I wish...

zenny

On 12/2/12, Zenny <garbytrash at gmail.com> wrote:
> Thanks Dick for information.
>
> About the first mandos server-client pair I meant the mandos server
> which also tries to authenticate as client with each other, I
> installed mandos sever and clients in both of them and copied the
> output of 'mandos-keygen --passphrase' to the server's
> /etc/mandos/clients.conf yet it does not authenticate, yet asks for
> the passphrase in console?
>
> Tried to execute the following in the client console (as stated in
> http://bzr.recompile.se/loggerhead/mandos/trunk/annotate/head:/debian/mandos-client.README.Debian),
> but nothing happens even for hours.
>
> #/usr/lib/mandos/plugins.d/mandos-client \
>> --pubkey=/etc/keys/mandos/pubkey.txt \
>> --seckey=/etc/keys/mandos/seckey.txt; echo
>
> What did I miss? What other configuration changes that I need to make
> to make it work?
>
> Thanks!
>
> On 12/1/12, Zenny <garbytrash at gmail.com> wrote:
>> Hi again:
>>
>> I thoroughly read the documents in the site, yet I cannot figure out
>> how to achieve this:
>>
>> 1) Two mandos servers-clients authenticating between each other which
>> in turn provide authentication passwords to the local clients
>>
>> 2) The /boot is not partitioned, yet / and swap is encrypted over LVM
>> (dm-crypt plus LUKS).
>>
>> I searched over the Net and could not figure out how to achieve this.
>> Any pointers shall be appreciated.
>>
>> Regards
>> zenny
>>
>> On 11/30/12, Zenny <garbytrash at gmail.com> wrote:
>>> Hi:
>>>
>>> I happen to see your nice application just today and feel like
>>> deploying. Unfortunately I am getting errors while installing
>>> mados-client in embedded debian squeeze (voyage linux actually).
>>>
>>> 1) gpg: WARNING: some OpenPGP programs can't handle a DSA key with
>>> this digest size
>>>
>>> I know of this error maybe it is run on a i386 machine.
>>>
>>> 2) cryptsetup: WARNING: could not determine root device from /etc/fstab
>>>
>>> which looks like:
>>> root at voyage:~# cat /etc/fstab
>>> #/dev/hda1       /       ext2    defaults,noatime,rw     0       0
>>> proc            /proc   proc    defaults                0       0
>>> tmpfs 			/tmp 	tmpfs 	nosuid,nodev 			0 		0
>>> #tmpfs           /rw     tmpfs   defaults,size=32M        0       0
>>>
>>>
>>> Appreciate if there is any pointers! Is there any tutorials on how to
>>> deploy mandos? FYI, I am trying to share keys between two mandos
>>> servers. Thanks!
>>>
>>
>

From garbytrash at gmail.com  Sun Dec  2 21:32:04 2012
From: garbytrash at gmail.com (Zenny)
Date: Sun, 2 Dec 2012 21:32:04 +0100
Subject: Some starting documents
In-Reply-To: <CACuV5sBv8MoiYsgVSS-D-_wLD5SxRNor0Y5Gs9Qr=r0fSi4tUQ@mail.gmail.com>
References: <CACuV5sBTAVdtRNdRN0uT3RFfBLomU6kWwswQVXX4=tje7fo7tQ@mail.gmail.com>
	<CACuV5sBCbV2-mu-wd9ibGF45KmY9c7RSDb3nZdYd5+TV-ZwWsw@mail.gmail.com>
	<CACuV5sCHiRWSX_aC0__g0AZmQeQGoUaErJP-PactnhLhBrBfgw@mail.gmail.com>
	<CACuV5sBv8MoiYsgVSS-D-_wLD5SxRNor0Y5Gs9Qr=r0fSi4tUQ@mail.gmail.com>
Message-ID: <CACuV5sBisc7zQ4w_XhFKxJhmMhtTxbALmYZo=uHN33-zRMeADw@mail.gmail.com>

And there is no firewall involved between these machines, because I
have not configured any. No firewall configured at all at the moment.

# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

On 12/2/12, Zenny <garbytrash at gmail.com> wrote:
> Dear Teddy and Dick:
>
> I tried also with a completely new debian squeeze installation with
> dm-crypt and LUKS which has the following in the fstab:
>
> # <file system> <mount point>   <type>  <options>       <dump>  <pass>
> proc            /proc           proc    defaults        0       0
> /dev/mapper/gw0-root /               ext3    errors=remount-ro 0       1
> # /boot was on /dev/sda1 during installation
> UUID=22c1e040-0527-4845-b14d-3db74829167f /boot           ext2
> defaults        0       2
> /dev/mapper/gw0-home /home           ext3    defaults        0       2
> /dev/mapper/gw0-tmp /tmp            ext3    defaults        0       2
> /dev/mapper/gw0-usr /usr            ext3    defaults        0       2
> /dev/mapper/gw0-var /var            ext3    defaults        0       2
> /dev/mapper/gw0-swap_1 none            swap    sw              0       0
> /dev/scd0       /media/cdrom0   udf,iso9660 user,noauto     0       0
>
> This time the installation on the mandor-client in the machine works
> and still executing:
>
> #/usr/lib/mandos/plugins.d/mandos-client \
>> --pubkey=/etc/keys/mandos/pubkey.txt \
>> --seckey=/etc/keys/mandos/seckey.txt; echo
>
> Does not give any output even after eons of time.
>
> What I did was:
>
> 1) Installed a completely new instance of debian squeeze using guided
> installation with encryption in two VMs,
> 2) then installed mandos-server in VM A and mandos-client in VM B.
> 3) Generated the client info (mandos-keygen --password) in VM B
> (mandos-client) and pasted that in /etc/mandos/clients.conf of VM A
> (mandos server)
> 4) Restarted mandos server in A and rebooted VM B to check whether it
> can fetch information from server A to boot.
> 5) Executed the above command to echo the password, but no output.
>
> There is nothing I could see where I can see the debug command,
> because VM B cannot fetch the password from mandos-server in VM A,
> meaning I have to feed the encryption password manually to boot VM B.
>
> BTW, Teddy, the documentation is neither complete or verbose. It is
> wholly incomplete. At least I could have helped you to create a
> document, provided something works in my case. And it is not working
> at all? I am struggling for the last two days to make it work, yet no
> go! Maybe this is the reason there is little adoption of mandos is not
> so strong.
>
> I followed a longer solution for a similar solution (using a longer
> method with manual remote feeding of the key), but that is not what I
> am seeking rather something like mandos. But there is no luck that it
> worked.
>
> I wish...
>
> zenny
>
> On 12/2/12, Zenny <garbytrash at gmail.com> wrote:
>> Thanks Dick for information.
>>
>> About the first mandos server-client pair I meant the mandos server
>> which also tries to authenticate as client with each other, I
>> installed mandos sever and clients in both of them and copied the
>> output of 'mandos-keygen --passphrase' to the server's
>> /etc/mandos/clients.conf yet it does not authenticate, yet asks for
>> the passphrase in console?
>>
>> Tried to execute the following in the client console (as stated in
>> http://bzr.recompile.se/loggerhead/mandos/trunk/annotate/head:/debian/mandos-client.README.Debian),
>> but nothing happens even for hours.
>>
>> #/usr/lib/mandos/plugins.d/mandos-client \
>>> --pubkey=/etc/keys/mandos/pubkey.txt \
>>> --seckey=/etc/keys/mandos/seckey.txt; echo
>>
>> What did I miss? What other configuration changes that I need to make
>> to make it work?
>>
>> Thanks!
>>
>> On 12/1/12, Zenny <garbytrash at gmail.com> wrote:
>>> Hi again:
>>>
>>> I thoroughly read the documents in the site, yet I cannot figure out
>>> how to achieve this:
>>>
>>> 1) Two mandos servers-clients authenticating between each other which
>>> in turn provide authentication passwords to the local clients
>>>
>>> 2) The /boot is not partitioned, yet / and swap is encrypted over LVM
>>> (dm-crypt plus LUKS).
>>>
>>> I searched over the Net and could not figure out how to achieve this.
>>> Any pointers shall be appreciated.
>>>
>>> Regards
>>> zenny
>>>
>>> On 11/30/12, Zenny <garbytrash at gmail.com> wrote:
>>>> Hi:
>>>>
>>>> I happen to see your nice application just today and feel like
>>>> deploying. Unfortunately I am getting errors while installing
>>>> mados-client in embedded debian squeeze (voyage linux actually).
>>>>
>>>> 1) gpg: WARNING: some OpenPGP programs can't handle a DSA key with
>>>> this digest size
>>>>
>>>> I know of this error maybe it is run on a i386 machine.
>>>>
>>>> 2) cryptsetup: WARNING: could not determine root device from /etc/fstab
>>>>
>>>> which looks like:
>>>> root at voyage:~# cat /etc/fstab
>>>> #/dev/hda1       /       ext2    defaults,noatime,rw     0       0
>>>> proc            /proc   proc    defaults                0       0
>>>> tmpfs 			/tmp 	tmpfs 	nosuid,nodev 			0 		0
>>>> #tmpfs           /rw     tmpfs   defaults,size=32M        0       0
>>>>
>>>>
>>>> Appreciate if there is any pointers! Is there any tutorials on how to
>>>> deploy mandos? FYI, I am trying to share keys between two mandos
>>>> servers. Thanks!
>>>>
>>>
>>
>

From garbytrash at gmail.com  Sun Dec  2 21:38:34 2012
From: garbytrash at gmail.com (Zenny)
Date: Sun, 2 Dec 2012 21:38:34 +0100
Subject: Some starting documents
In-Reply-To: <CACuV5sBisc7zQ4w_XhFKxJhmMhtTxbALmYZo=uHN33-zRMeADw@mail.gmail.com>
References: <CACuV5sBTAVdtRNdRN0uT3RFfBLomU6kWwswQVXX4=tje7fo7tQ@mail.gmail.com>
	<CACuV5sBCbV2-mu-wd9ibGF45KmY9c7RSDb3nZdYd5+TV-ZwWsw@mail.gmail.com>
	<CACuV5sCHiRWSX_aC0__g0AZmQeQGoUaErJP-PactnhLhBrBfgw@mail.gmail.com>
	<CACuV5sBv8MoiYsgVSS-D-_wLD5SxRNor0Y5Gs9Qr=r0fSi4tUQ@mail.gmail.com>
	<CACuV5sBisc7zQ4w_XhFKxJhmMhtTxbALmYZo=uHN33-zRMeADw@mail.gmail.com>
Message-ID: <CACuV5sB2=x73EJ94L3kr6t1ahZy-r1OcMhY7PXY+pcFn_s4btA@mail.gmail.com>

BTW, I forgot to mention that I get 'A checker has failed!' error in
VM A (mandos-server) when I check with mandos-monitor command.

I enabled all  and get the following output:

# mandos-ctl -e --all
# mandos-ctl
Name             Enabled Timeout  Last Successful Check
gw1.domain.tld Yes     00:05:00

Is it something helpful to debug? Thanks!

On 12/2/12, Zenny <garbytrash at gmail.com> wrote:
> And there is no firewall involved between these machines, because I
> have not configured any. No firewall configured at all at the moment.
>
> # iptables -L
> Chain INPUT (policy ACCEPT)
> target     prot opt source               destination
>
> Chain FORWARD (policy ACCEPT)
> target     prot opt source               destination
>
> Chain OUTPUT (policy ACCEPT)
> target     prot opt source               destination
>
> On 12/2/12, Zenny <garbytrash at gmail.com> wrote:
>> Dear Teddy and Dick:
>>
>> I tried also with a completely new debian squeeze installation with
>> dm-crypt and LUKS which has the following in the fstab:
>>
>> # <file system> <mount point>   <type>  <options>       <dump>  <pass>
>> proc            /proc           proc    defaults        0       0
>> /dev/mapper/gw0-root /               ext3    errors=remount-ro 0       1
>> # /boot was on /dev/sda1 during installation
>> UUID=22c1e040-0527-4845-b14d-3db74829167f /boot           ext2
>> defaults        0       2
>> /dev/mapper/gw0-home /home           ext3    defaults        0       2
>> /dev/mapper/gw0-tmp /tmp            ext3    defaults        0       2
>> /dev/mapper/gw0-usr /usr            ext3    defaults        0       2
>> /dev/mapper/gw0-var /var            ext3    defaults        0       2
>> /dev/mapper/gw0-swap_1 none            swap    sw              0       0
>> /dev/scd0       /media/cdrom0   udf,iso9660 user,noauto     0       0
>>
>> This time the installation on the mandor-client in the machine works
>> and still executing:
>>
>> #/usr/lib/mandos/plugins.d/mandos-client \
>>> --pubkey=/etc/keys/mandos/pubkey.txt \
>>> --seckey=/etc/keys/mandos/seckey.txt; echo
>>
>> Does not give any output even after eons of time.
>>
>> What I did was:
>>
>> 1) Installed a completely new instance of debian squeeze using guided
>> installation with encryption in two VMs,
>> 2) then installed mandos-server in VM A and mandos-client in VM B.
>> 3) Generated the client info (mandos-keygen --password) in VM B
>> (mandos-client) and pasted that in /etc/mandos/clients.conf of VM A
>> (mandos server)
>> 4) Restarted mandos server in A and rebooted VM B to check whether it
>> can fetch information from server A to boot.
>> 5) Executed the above command to echo the password, but no output.
>>
>> There is nothing I could see where I can see the debug command,
>> because VM B cannot fetch the password from mandos-server in VM A,
>> meaning I have to feed the encryption password manually to boot VM B.
>>
>> BTW, Teddy, the documentation is neither complete or verbose. It is
>> wholly incomplete. At least I could have helped you to create a
>> document, provided something works in my case. And it is not working
>> at all? I am struggling for the last two days to make it work, yet no
>> go! Maybe this is the reason there is little adoption of mandos is not
>> so strong.
>>
>> I followed a longer solution for a similar solution (using a longer
>> method with manual remote feeding of the key), but that is not what I
>> am seeking rather something like mandos. But there is no luck that it
>> worked.
>>
>> I wish...
>>
>> zenny
>>
>> On 12/2/12, Zenny <garbytrash at gmail.com> wrote:
>>> Thanks Dick for information.
>>>
>>> About the first mandos server-client pair I meant the mandos server
>>> which also tries to authenticate as client with each other, I
>>> installed mandos sever and clients in both of them and copied the
>>> output of 'mandos-keygen --passphrase' to the server's
>>> /etc/mandos/clients.conf yet it does not authenticate, yet asks for
>>> the passphrase in console?
>>>
>>> Tried to execute the following in the client console (as stated in
>>> http://bzr.recompile.se/loggerhead/mandos/trunk/annotate/head:/debian/mandos-client.README.Debian),
>>> but nothing happens even for hours.
>>>
>>> #/usr/lib/mandos/plugins.d/mandos-client \
>>>> --pubkey=/etc/keys/mandos/pubkey.txt \
>>>> --seckey=/etc/keys/mandos/seckey.txt; echo
>>>
>>> What did I miss? What other configuration changes that I need to make
>>> to make it work?
>>>
>>> Thanks!
>>>
>>> On 12/1/12, Zenny <garbytrash at gmail.com> wrote:
>>>> Hi again:
>>>>
>>>> I thoroughly read the documents in the site, yet I cannot figure out
>>>> how to achieve this:
>>>>
>>>> 1) Two mandos servers-clients authenticating between each other which
>>>> in turn provide authentication passwords to the local clients
>>>>
>>>> 2) The /boot is not partitioned, yet / and swap is encrypted over LVM
>>>> (dm-crypt plus LUKS).
>>>>
>>>> I searched over the Net and could not figure out how to achieve this.
>>>> Any pointers shall be appreciated.
>>>>
>>>> Regards
>>>> zenny
>>>>
>>>> On 11/30/12, Zenny <garbytrash at gmail.com> wrote:
>>>>> Hi:
>>>>>
>>>>> I happen to see your nice application just today and feel like
>>>>> deploying. Unfortunately I am getting errors while installing
>>>>> mados-client in embedded debian squeeze (voyage linux actually).
>>>>>
>>>>> 1) gpg: WARNING: some OpenPGP programs can't handle a DSA key with
>>>>> this digest size
>>>>>
>>>>> I know of this error maybe it is run on a i386 machine.
>>>>>
>>>>> 2) cryptsetup: WARNING: could not determine root device from
>>>>> /etc/fstab
>>>>>
>>>>> which looks like:
>>>>> root at voyage:~# cat /etc/fstab
>>>>> #/dev/hda1       /       ext2    defaults,noatime,rw     0       0
>>>>> proc            /proc   proc    defaults                0       0
>>>>> tmpfs 			/tmp 	tmpfs 	nosuid,nodev 			0 		0
>>>>> #tmpfs           /rw     tmpfs   defaults,size=32M        0       0
>>>>>
>>>>>
>>>>> Appreciate if there is any pointers! Is there any tutorials on how to
>>>>> deploy mandos? FYI, I am trying to share keys between two mandos
>>>>> servers. Thanks!
>>>>>
>>>>
>>>
>>
>

From garbytrash at gmail.com  Sun Dec  2 21:48:40 2012
From: garbytrash at gmail.com (Zenny)
Date: Sun, 2 Dec 2012 21:48:40 +0100
Subject: How to receive posts individually as soon as posted?
Message-ID: <CACuV5sADCqEEOPMYnecsb-jrcftsWdPLnHBn2GRNnvxrZe1pDg@mail.gmail.com>

Hi:

I checked 'digest mode' and I was not getting the posts to this list
as soon as I receive. I disabled 'digest mode' and yet I am not
getting individual post to this mailing list. Is there some way that I
get the threads to this mailing list forewarded to my email as soon as
they are posted? Thanks!

/zenny

From garbytrash at gmail.com  Sun Dec  2 22:06:39 2012
From: garbytrash at gmail.com (Zenny)
Date: Sun, 2 Dec 2012 22:06:39 +0100
Subject: Some starting documents
In-Reply-To: <CACuV5sB2=x73EJ94L3kr6t1ahZy-r1OcMhY7PXY+pcFn_s4btA@mail.gmail.com>
References: <CACuV5sBTAVdtRNdRN0uT3RFfBLomU6kWwswQVXX4=tje7fo7tQ@mail.gmail.com>
	<CACuV5sBCbV2-mu-wd9ibGF45KmY9c7RSDb3nZdYd5+TV-ZwWsw@mail.gmail.com>
	<CACuV5sCHiRWSX_aC0__g0AZmQeQGoUaErJP-PactnhLhBrBfgw@mail.gmail.com>
	<CACuV5sBv8MoiYsgVSS-D-_wLD5SxRNor0Y5Gs9Qr=r0fSi4tUQ@mail.gmail.com>
	<CACuV5sBisc7zQ4w_XhFKxJhmMhtTxbALmYZo=uHN33-zRMeADw@mail.gmail.com>
	<CACuV5sB2=x73EJ94L3kr6t1ahZy-r1OcMhY7PXY+pcFn_s4btA@mail.gmail.com>
Message-ID: <CACuV5sCTKn0Xqn=+NLQMyuRhyZ=Xyngv7NO-b-SOJ6J=5ozJFA@mail.gmail.com>

1) On mandos-server VM A, I am getting the following error:

"2012-12-02T22:03:17.346685: Checker for client gw1.domain.tld
(command "fping -q -- 192\.168\.53\.161") failed with exit code 1"

I even changed the host in /etc/mandos/clients.conf from alias to IP
with the same results.

2) On mandos-client VM B, I am getting the error as stated below:

"Mandos plugin mados-client: connect: Cannot assign requested address"

3) No iptables were configured, even flushed the iptables with 'iptables -L'

??

/zenny


On 12/2/12, Zenny <garbytrash at gmail.com> wrote:
> BTW, I forgot to mention that I get 'A checker has failed!' error in
> VM A (mandos-server) when I check with mandos-monitor command.
>
> I enabled all  and get the following output:
>
> # mandos-ctl -e --all
> # mandos-ctl
> Name             Enabled Timeout  Last Successful Check
> gw1.domain.tld Yes     00:05:00
>
> Is it something helpful to debug? Thanks!
>
> On 12/2/12, Zenny <garbytrash at gmail.com> wrote:
>> And there is no firewall involved between these machines, because I
>> have not configured any. No firewall configured at all at the moment.
>>
>> # iptables -L
>> Chain INPUT (policy ACCEPT)
>> target     prot opt source               destination
>>
>> Chain FORWARD (policy ACCEPT)
>> target     prot opt source               destination
>>
>> Chain OUTPUT (policy ACCEPT)
>> target     prot opt source               destination
>>
>> On 12/2/12, Zenny <garbytrash at gmail.com> wrote:
>>> Dear Teddy and Dick:
>>>
>>> I tried also with a completely new debian squeeze installation with
>>> dm-crypt and LUKS which has the following in the fstab:
>>>
>>> # <file system> <mount point>   <type>  <options>       <dump>  <pass>
>>> proc            /proc           proc    defaults        0       0
>>> /dev/mapper/gw0-root /               ext3    errors=remount-ro 0       1
>>> # /boot was on /dev/sda1 during installation
>>> UUID=22c1e040-0527-4845-b14d-3db74829167f /boot           ext2
>>> defaults        0       2
>>> /dev/mapper/gw0-home /home           ext3    defaults        0       2
>>> /dev/mapper/gw0-tmp /tmp            ext3    defaults        0       2
>>> /dev/mapper/gw0-usr /usr            ext3    defaults        0       2
>>> /dev/mapper/gw0-var /var            ext3    defaults        0       2
>>> /dev/mapper/gw0-swap_1 none            swap    sw              0       0
>>> /dev/scd0       /media/cdrom0   udf,iso9660 user,noauto     0       0
>>>
>>> This time the installation on the mandor-client in the machine works
>>> and still executing:
>>>
>>> #/usr/lib/mandos/plugins.d/mandos-client \
>>>> --pubkey=/etc/keys/mandos/pubkey.txt \
>>>> --seckey=/etc/keys/mandos/seckey.txt; echo
>>>
>>> Does not give any output even after eons of time.
>>>
>>> What I did was:
>>>
>>> 1) Installed a completely new instance of debian squeeze using guided
>>> installation with encryption in two VMs,
>>> 2) then installed mandos-server in VM A and mandos-client in VM B.
>>> 3) Generated the client info (mandos-keygen --password) in VM B
>>> (mandos-client) and pasted that in /etc/mandos/clients.conf of VM A
>>> (mandos server)
>>> 4) Restarted mandos server in A and rebooted VM B to check whether it
>>> can fetch information from server A to boot.
>>> 5) Executed the above command to echo the password, but no output.
>>>
>>> There is nothing I could see where I can see the debug command,
>>> because VM B cannot fetch the password from mandos-server in VM A,
>>> meaning I have to feed the encryption password manually to boot VM B.
>>>
>>> BTW, Teddy, the documentation is neither complete or verbose. It is
>>> wholly incomplete. At least I could have helped you to create a
>>> document, provided something works in my case. And it is not working
>>> at all? I am struggling for the last two days to make it work, yet no
>>> go! Maybe this is the reason there is little adoption of mandos is not
>>> so strong.
>>>
>>> I followed a longer solution for a similar solution (using a longer
>>> method with manual remote feeding of the key), but that is not what I
>>> am seeking rather something like mandos. But there is no luck that it
>>> worked.
>>>
>>> I wish...
>>>
>>> zenny
>>>
>>> On 12/2/12, Zenny <garbytrash at gmail.com> wrote:
>>>> Thanks Dick for information.
>>>>
>>>> About the first mandos server-client pair I meant the mandos server
>>>> which also tries to authenticate as client with each other, I
>>>> installed mandos sever and clients in both of them and copied the
>>>> output of 'mandos-keygen --passphrase' to the server's
>>>> /etc/mandos/clients.conf yet it does not authenticate, yet asks for
>>>> the passphrase in console?
>>>>
>>>> Tried to execute the following in the client console (as stated in
>>>> http://bzr.recompile.se/loggerhead/mandos/trunk/annotate/head:/debian/mandos-client.README.Debian),
>>>> but nothing happens even for hours.
>>>>
>>>> #/usr/lib/mandos/plugins.d/mandos-client \
>>>>> --pubkey=/etc/keys/mandos/pubkey.txt \
>>>>> --seckey=/etc/keys/mandos/seckey.txt; echo
>>>>
>>>> What did I miss? What other configuration changes that I need to make
>>>> to make it work?
>>>>
>>>> Thanks!
>>>>
>>>> On 12/1/12, Zenny <garbytrash at gmail.com> wrote:
>>>>> Hi again:
>>>>>
>>>>> I thoroughly read the documents in the site, yet I cannot figure out
>>>>> how to achieve this:
>>>>>
>>>>> 1) Two mandos servers-clients authenticating between each other which
>>>>> in turn provide authentication passwords to the local clients
>>>>>
>>>>> 2) The /boot is not partitioned, yet / and swap is encrypted over LVM
>>>>> (dm-crypt plus LUKS).
>>>>>
>>>>> I searched over the Net and could not figure out how to achieve this.
>>>>> Any pointers shall be appreciated.
>>>>>
>>>>> Regards
>>>>> zenny
>>>>>
>>>>> On 11/30/12, Zenny <garbytrash at gmail.com> wrote:
>>>>>> Hi:
>>>>>>
>>>>>> I happen to see your nice application just today and feel like
>>>>>> deploying. Unfortunately I am getting errors while installing
>>>>>> mados-client in embedded debian squeeze (voyage linux actually).
>>>>>>
>>>>>> 1) gpg: WARNING: some OpenPGP programs can't handle a DSA key with
>>>>>> this digest size
>>>>>>
>>>>>> I know of this error maybe it is run on a i386 machine.
>>>>>>
>>>>>> 2) cryptsetup: WARNING: could not determine root device from
>>>>>> /etc/fstab
>>>>>>
>>>>>> which looks like:
>>>>>> root at voyage:~# cat /etc/fstab
>>>>>> #/dev/hda1       /       ext2    defaults,noatime,rw     0       0
>>>>>> proc            /proc   proc    defaults                0       0
>>>>>> tmpfs 			/tmp 	tmpfs 	nosuid,nodev 			0 		0
>>>>>> #tmpfs           /rw     tmpfs   defaults,size=32M        0       0
>>>>>>
>>>>>>
>>>>>> Appreciate if there is any pointers! Is there any tutorials on how to
>>>>>> deploy mandos? FYI, I am trying to share keys between two mandos
>>>>>> servers. Thanks!
>>>>>>
>>>>>
>>>>
>>>
>>
>

From dick at fouter.net  Sun Dec  2 22:10:25 2012
From: dick at fouter.net (Dick Middleton)
Date: Sun, 02 Dec 2012 21:10:25 +0000
Subject: Some starting documents
In-Reply-To: <CACuV5sCTKn0Xqn=+NLQMyuRhyZ=Xyngv7NO-b-SOJ6J=5ozJFA@mail.gmail.com>
References: <CACuV5sBTAVdtRNdRN0uT3RFfBLomU6kWwswQVXX4=tje7fo7tQ@mail.gmail.com>
	<CACuV5sBCbV2-mu-wd9ibGF45KmY9c7RSDb3nZdYd5+TV-ZwWsw@mail.gmail.com>
	<CACuV5sCHiRWSX_aC0__g0AZmQeQGoUaErJP-PactnhLhBrBfgw@mail.gmail.com>
	<CACuV5sBv8MoiYsgVSS-D-_wLD5SxRNor0Y5Gs9Qr=r0fSi4tUQ@mail.gmail.com>
	<CACuV5sBisc7zQ4w_XhFKxJhmMhtTxbALmYZo=uHN33-zRMeADw@mail.gmail.com>
	<CACuV5sB2=x73EJ94L3kr6t1ahZy-r1OcMhY7PXY+pcFn_s4btA@mail.gmail.com>
	<CACuV5sCTKn0Xqn=+NLQMyuRhyZ=Xyngv7NO-b-SOJ6J=5ozJFA@mail.gmail.com>
Message-ID: <50BBC3C1.7060709@fouter.net>

On 12/02/12 21:06, Zenny wrote:
> 1) On mandos-server VM A, I am getting the following error:
> 
> "2012-12-02T22:03:17.346685: Checker for client gw1.domain.tld
> (command "fping -q -- 192\.168\.53\.161") failed with exit code 1"

why the \. and not just . ???

Is that what you typed in or just the format of the error message?

Dick


From teddy at recompile.se  Sun Dec  2 22:10:44 2012
From: teddy at recompile.se (Teddy Hogeborn)
Date: Sun, 02 Dec 2012 22:10:44 +0100
Subject: Some starting documents
In-Reply-To: <CACuV5sBCbV2-mu-wd9ibGF45KmY9c7RSDb3nZdYd5+TV-ZwWsw@mail.gmail.com>
	(Zenny's message of "Sat, 1 Dec 2012 10:36:19 +0100")
References: <CACuV5sBTAVdtRNdRN0uT3RFfBLomU6kWwswQVXX4=tje7fo7tQ@mail.gmail.com>
	<CACuV5sBCbV2-mu-wd9ibGF45KmY9c7RSDb3nZdYd5+TV-ZwWsw@mail.gmail.com>
Message-ID: <877gp0i2i3.fsf@tower.recompile.se>

Zenny <garbytrash at gmail.com> writes:

> 2) The /boot is not partitioned, yet / and swap is encrypted over LVM
> (dm-crypt plus LUKS).

That's impossible.  There must be something unencrypted to boot the
system.

/Teddy Hogeborn

-- 
The Mandos Project
http://www.recompile.se/mandos

From dick at fouter.net  Sun Dec  2 22:20:22 2012
From: dick at fouter.net (Dick Middleton)
Date: Sun, 02 Dec 2012 21:20:22 +0000
Subject: Some starting documents
In-Reply-To: <CACuV5sBfibVszA9AcSb=Q1Dp5FDkVM+B65fPNnuC_-ZHC0mc1Q@mail.gmail.com>
References: <CACuV5sBTAVdtRNdRN0uT3RFfBLomU6kWwswQVXX4=tje7fo7tQ@mail.gmail.com>
	<CACuV5sBCbV2-mu-wd9ibGF45KmY9c7RSDb3nZdYd5+TV-ZwWsw@mail.gmail.com>
	<CACuV5sCHiRWSX_aC0__g0AZmQeQGoUaErJP-PactnhLhBrBfgw@mail.gmail.com>
	<CACuV5sBv8MoiYsgVSS-D-_wLD5SxRNor0Y5Gs9Qr=r0fSi4tUQ@mail.gmail.com>
	<CACuV5sBisc7zQ4w_XhFKxJhmMhtTxbALmYZo=uHN33-zRMeADw@mail.gmail.com>
	<CACuV5sB2=x73EJ94L3kr6t1ahZy-r1OcMhY7PXY+pcFn_s4btA@mail.gmail.com>
	<CACuV5sCTKn0Xqn=+NLQMyuRhyZ=Xyngv7NO-b-SOJ6J=5ozJFA@mail.gmail.com>
	<50BBC3C1.7060709@fouter.net>
	<CACuV5sBfibVszA9AcSb=Q1Dp5FDkVM+B65fPNnuC_-ZHC0mc1Q@mail.gmail.com>
Message-ID: <50BBC616.1000200@fouter.net>

On 12/02/12 21:12, Zenny wrote:
> On 12/2/12, Dick Middleton <dick at fouter.net> wrote:
>> On 12/02/12 21:06, Zenny wrote:
>>> 1) On mandos-server VM A, I am getting the following error:
>>>
>>> "2012-12-02T22:03:17.346685: Checker for client gw1.domain.tld
>>> (command "fping -q -- 192\.168\.53\.161") failed with exit code 1"
>>
>> why the \. and not just . ???
>>
>> Is that what you typed in or just the format of the error message?
> 
> That is the what echoed on the screen though I have just 192.168.53.161

Phew :-)

Try temporarily putting this in the clients.conf block for the client under test:

checker = sleep 1

Then it won't do a ping but will always return true so it wont disable the client.

It should reduce the variables whilst you debug.

Dick

From garbytrash at gmail.com  Sun Dec  2 22:28:31 2012
From: garbytrash at gmail.com (Zenny)
Date: Sun, 2 Dec 2012 22:28:31 +0100
Subject: Some starting documents
In-Reply-To: <50BBC616.1000200@fouter.net>
References: <CACuV5sBTAVdtRNdRN0uT3RFfBLomU6kWwswQVXX4=tje7fo7tQ@mail.gmail.com>
	<CACuV5sBCbV2-mu-wd9ibGF45KmY9c7RSDb3nZdYd5+TV-ZwWsw@mail.gmail.com>
	<CACuV5sCHiRWSX_aC0__g0AZmQeQGoUaErJP-PactnhLhBrBfgw@mail.gmail.com>
	<CACuV5sBv8MoiYsgVSS-D-_wLD5SxRNor0Y5Gs9Qr=r0fSi4tUQ@mail.gmail.com>
	<CACuV5sBisc7zQ4w_XhFKxJhmMhtTxbALmYZo=uHN33-zRMeADw@mail.gmail.com>
	<CACuV5sB2=x73EJ94L3kr6t1ahZy-r1OcMhY7PXY+pcFn_s4btA@mail.gmail.com>
	<CACuV5sCTKn0Xqn=+NLQMyuRhyZ=Xyngv7NO-b-SOJ6J=5ozJFA@mail.gmail.com>
	<50BBC3C1.7060709@fouter.net>
	<CACuV5sBfibVszA9AcSb=Q1Dp5FDkVM+B65fPNnuC_-ZHC0mc1Q@mail.gmail.com>
	<50BBC616.1000200@fouter.net>
Message-ID: <CACuV5sBh6jsc6c6dy1VpaEXX_Dr4tRrjD8JPsRht02PX-bh_+g@mail.gmail.com>

On 12/2/12, Dick Middleton <dick at fouter.net> wrote:
> On 12/02/12 21:12, Zenny wrote:
>> On 12/2/12, Dick Middleton <dick at fouter.net> wrote:
>>> On 12/02/12 21:06, Zenny wrote:
>>>> 1) On mandos-server VM A, I am getting the following error:
>>>>
>>>> "2012-12-02T22:03:17.346685: Checker for client gw1.domain.tld
>>>> (command "fping -q -- 192\.168\.53\.161") failed with exit code 1"
>>>
>>> why the \. and not just . ???
>>>
>>> Is that what you typed in or just the format of the error message?
>>
>> That is the what echoed on the screen though I have just 192.168.53.161
>
> Phew :-)
>
> Try temporarily putting this in the clients.conf block for the client under
> test:
>
> checker = sleep 1
>
> Then it won't do a ping but will always return true so it wont disable the
> client.
>
> It should reduce the variables whilst you debug.

I appended the line checker = sleep 1 to client.conf block, restarted
mandos server (VM A) and rebooted the mandos-client (VM B) without any
output, but the VM B stopped at the point when it asks for the
passphrase to decrypt the encrypted /.

>
> Dick
>

From garbytrash at gmail.com  Sun Dec  2 22:32:20 2012
From: garbytrash at gmail.com (Zenny)
Date: Sun, 2 Dec 2012 22:32:20 +0100
Subject: How to receive posts individually as soon as posted?
In-Reply-To: <CACuV5sADCqEEOPMYnecsb-jrcftsWdPLnHBn2GRNnvxrZe1pDg@mail.gmail.com>
References: <CACuV5sADCqEEOPMYnecsb-jrcftsWdPLnHBn2GRNnvxrZe1pDg@mail.gmail.com>
Message-ID: <CACuV5sCyM2GzWDKy4XBYmYM-=7JrGk58=xs1TqPKx2uHMFZdiw@mail.gmail.com>

Now I started receiving individual posts. Thanks!

/zenny

On 12/2/12, Zenny <garbytrash at gmail.com> wrote:
> Hi:
>
> I checked 'digest mode' and I was not getting the posts to this list
> as soon as I receive. I disabled 'digest mode' and yet I am not
> getting individual post to this mailing list. Is there some way that I
> get the threads to this mailing list forewarded to my email as soon as
> they are posted? Thanks!
>
> /zenny
>

From dick at fouter.net  Sun Dec  2 22:41:33 2012
From: dick at fouter.net (Dick Middleton)
Date: Sun, 02 Dec 2012 21:41:33 +0000
Subject: Some starting documents
In-Reply-To: <CACuV5sBh6jsc6c6dy1VpaEXX_Dr4tRrjD8JPsRht02PX-bh_+g@mail.gmail.com>
References: <CACuV5sBTAVdtRNdRN0uT3RFfBLomU6kWwswQVXX4=tje7fo7tQ@mail.gmail.com>
	<CACuV5sBCbV2-mu-wd9ibGF45KmY9c7RSDb3nZdYd5+TV-ZwWsw@mail.gmail.com>
	<CACuV5sCHiRWSX_aC0__g0AZmQeQGoUaErJP-PactnhLhBrBfgw@mail.gmail.com>
	<CACuV5sBv8MoiYsgVSS-D-_wLD5SxRNor0Y5Gs9Qr=r0fSi4tUQ@mail.gmail.com>
	<CACuV5sBisc7zQ4w_XhFKxJhmMhtTxbALmYZo=uHN33-zRMeADw@mail.gmail.com>
	<CACuV5sB2=x73EJ94L3kr6t1ahZy-r1OcMhY7PXY+pcFn_s4btA@mail.gmail.com>
	<CACuV5sCTKn0Xqn=+NLQMyuRhyZ=Xyngv7NO-b-SOJ6J=5ozJFA@mail.gmail.com>
	<50BBC3C1.7060709@fouter.net>
	<CACuV5sBfibVszA9AcSb=Q1Dp5FDkVM+B65fPNnuC_-ZHC0mc1Q@mail.gmail.com>
	<50BBC616.1000200@fouter.net>
	<CACuV5sBh6jsc6c6dy1VpaEXX_Dr4tRrjD8JPsRht02PX-bh_+g@mail.gmail.com>
Message-ID: <50BBCB0D.9080200@fouter.net>

On 12/02/12 21:28, Zenny wrote:

> I appended the line checker = sleep 1 to client.conf block, restarted
> mandos server (VM A) and rebooted the mandos-client (VM B) without any
> output, but the VM B stopped at the point when it asks for the
> passphrase to decrypt the encrypted /.

I assume you also have enabled = yes in the block or the client is otherwise
enabled.

Use the mandos-client program to test.  Use --debug option to get more
messages and try again to get a reason for the failure.

Dick

From garbytrash at gmail.com  Sun Dec  2 23:03:55 2012
From: garbytrash at gmail.com (Zenny)
Date: Sun, 2 Dec 2012 23:03:55 +0100
Subject: Some starting documents
In-Reply-To: <50BBCB0D.9080200@fouter.net>
References: <CACuV5sBTAVdtRNdRN0uT3RFfBLomU6kWwswQVXX4=tje7fo7tQ@mail.gmail.com>
	<CACuV5sBCbV2-mu-wd9ibGF45KmY9c7RSDb3nZdYd5+TV-ZwWsw@mail.gmail.com>
	<CACuV5sCHiRWSX_aC0__g0AZmQeQGoUaErJP-PactnhLhBrBfgw@mail.gmail.com>
	<CACuV5sBv8MoiYsgVSS-D-_wLD5SxRNor0Y5Gs9Qr=r0fSi4tUQ@mail.gmail.com>
	<CACuV5sBisc7zQ4w_XhFKxJhmMhtTxbALmYZo=uHN33-zRMeADw@mail.gmail.com>
	<CACuV5sB2=x73EJ94L3kr6t1ahZy-r1OcMhY7PXY+pcFn_s4btA@mail.gmail.com>
	<CACuV5sCTKn0Xqn=+NLQMyuRhyZ=Xyngv7NO-b-SOJ6J=5ozJFA@mail.gmail.com>
	<50BBC3C1.7060709@fouter.net>
	<CACuV5sBfibVszA9AcSb=Q1Dp5FDkVM+B65fPNnuC_-ZHC0mc1Q@mail.gmail.com>
	<50BBC616.1000200@fouter.net>
	<CACuV5sBh6jsc6c6dy1VpaEXX_Dr4tRrjD8JPsRht02PX-bh_+g@mail.gmail.com>
	<50BBCB0D.9080200@fouter.net>
Message-ID: <CACuV5sDW+fB8JV_dj7Aw5QNROFuAhO-DB3vJO-2RzSed0JXp9A@mail.gmail.com>

On 12/2/12, Dick Middleton <dick at fouter.net> wrote:
> On 12/02/12 21:28, Zenny wrote:
>
>> I appended the line checker = sleep 1 to client.conf block, restarted
>> mandos server (VM A) and rebooted the mandos-client (VM B) without any
>> output, but the VM B stopped at the point when it asks for the
>> passphrase to decrypt the encrypted /.
>
> I assume you also have enabled = yes in the block or the client is
> otherwise
> enabled.
>
> Use the mandos-client program to test.  Use --debug option to get more
> messages and try again to get a reason for the failure.

I got the following from --debug flag:
# mandos --debug
2012-12-02 22:58:19,941 root [1475]: DEBUG: Creating client 'gw1.domain.tld'
2012-12-02 22:58:19,942 root [1475]: DEBUG:   Fingerprint:
B02CE46F07536AE88EDC9B6E9C52DBE1706FB573
2012-12-02 22:58:19,955 root [1475]: INFO: Now listening on address
'::', port 58051, flowinfo 0, scope_id 0
2012-12-02 22:58:19,960 root [1475]: DEBUG: Avahi server state change: 2
2012-12-02 22:58:19,962 root [1475]: DEBUG: Adding Zeroconf service
'Mandos' of type '_mandos._tcp' ...
2012-12-02 22:58:19,964 root [1475]: DEBUG: Starting main loop
2012-12-02 22:58:19,965 root [1475]: DEBUG: Avahi entry group state change: 1
2012-12-02 22:58:20,741 root [1475]: DEBUG: Avahi entry group state change: 2
2012-12-02 22:58:20,742 root [1475]: DEBUG: Zeroconf service established.


>
> Dick
>

From garbytrash at gmail.com  Mon Dec  3 21:40:29 2012
From: garbytrash at gmail.com (Zenny)
Date: Mon, 3 Dec 2012 21:40:29 +0100
Subject: Some starting documents
In-Reply-To: <CACuV5sDW+fB8JV_dj7Aw5QNROFuAhO-DB3vJO-2RzSed0JXp9A@mail.gmail.com>
References: <CACuV5sBTAVdtRNdRN0uT3RFfBLomU6kWwswQVXX4=tje7fo7tQ@mail.gmail.com>
	<CACuV5sBCbV2-mu-wd9ibGF45KmY9c7RSDb3nZdYd5+TV-ZwWsw@mail.gmail.com>
	<CACuV5sCHiRWSX_aC0__g0AZmQeQGoUaErJP-PactnhLhBrBfgw@mail.gmail.com>
	<CACuV5sBv8MoiYsgVSS-D-_wLD5SxRNor0Y5Gs9Qr=r0fSi4tUQ@mail.gmail.com>
	<CACuV5sBisc7zQ4w_XhFKxJhmMhtTxbALmYZo=uHN33-zRMeADw@mail.gmail.com>
	<CACuV5sB2=x73EJ94L3kr6t1ahZy-r1OcMhY7PXY+pcFn_s4btA@mail.gmail.com>
	<CACuV5sCTKn0Xqn=+NLQMyuRhyZ=Xyngv7NO-b-SOJ6J=5ozJFA@mail.gmail.com>
	<50BBC3C1.7060709@fouter.net>
	<CACuV5sBfibVszA9AcSb=Q1Dp5FDkVM+B65fPNnuC_-ZHC0mc1Q@mail.gmail.com>
	<50BBC616.1000200@fouter.net>
	<CACuV5sBh6jsc6c6dy1VpaEXX_Dr4tRrjD8JPsRht02PX-bh_+g@mail.gmail.com>
	<50BBCB0D.9080200@fouter.net>
	<CACuV5sDW+fB8JV_dj7Aw5QNROFuAhO-DB3vJO-2RzSed0JXp9A@mail.gmail.com>
Message-ID: <CACuV5sARYioXu-+Rb0f+VMqeVmKfD8KKTtt=nTkBawwVY3Xg8Q@mail.gmail.com>

Hi again:

I tried with completely new installations (single mandos-server and
single-client), and yet I could not figure out exactly why mandos is
not working. Both debian squeeze boxes.

On mandos-monitor, I am getting:
"2012-12-03T21:33:27.142917: Checker for client debian64.domain.local
(command "f
ping -q -- debian64\.domain\.local") failed with exit code 2"

Any inputs will be appreciated!





On 12/2/12, Zenny <garbytrash at gmail.com> wrote:
> On 12/2/12, Dick Middleton <dick at fouter.net> wrote:
>> On 12/02/12 21:28, Zenny wrote:
>>
>>> I appended the line checker = sleep 1 to client.conf block, restarted
>>> mandos server (VM A) and rebooted the mandos-client (VM B) without any
>>> output, but the VM B stopped at the point when it asks for the
>>> passphrase to decrypt the encrypted /.
>>
>> I assume you also have enabled = yes in the block or the client is
>> otherwise
>> enabled.
>>
>> Use the mandos-client program to test.  Use --debug option to get more
>> messages and try again to get a reason for the failure.
>
> I got the following from --debug flag:
> # mandos --debug
> 2012-12-02 22:58:19,941 root [1475]: DEBUG: Creating client
> 'gw1.domain.tld'
> 2012-12-02 22:58:19,942 root [1475]: DEBUG:   Fingerprint:
> B02CE46F07536AE88EDC9B6E9C52DBE1706FB573
> 2012-12-02 22:58:19,955 root [1475]: INFO: Now listening on address
> '::', port 58051, flowinfo 0, scope_id 0
> 2012-12-02 22:58:19,960 root [1475]: DEBUG: Avahi server state change: 2
> 2012-12-02 22:58:19,962 root [1475]: DEBUG: Adding Zeroconf service
> 'Mandos' of type '_mandos._tcp' ...
> 2012-12-02 22:58:19,964 root [1475]: DEBUG: Starting main loop
> 2012-12-02 22:58:19,965 root [1475]: DEBUG: Avahi entry group state change:
> 1
> 2012-12-02 22:58:20,741 root [1475]: DEBUG: Avahi entry group state change:
> 2
> 2012-12-02 22:58:20,742 root [1475]: DEBUG: Zeroconf service established.
>
>
>>
>> Dick
>>
>

From dick at fouter.net  Mon Dec  3 22:21:58 2012
From: dick at fouter.net (Dick Middleton)
Date: Mon, 03 Dec 2012 21:21:58 +0000
Subject: Some starting documents
In-Reply-To: <CACuV5sARYioXu-+Rb0f+VMqeVmKfD8KKTtt=nTkBawwVY3Xg8Q@mail.gmail.com>
References: <CACuV5sBTAVdtRNdRN0uT3RFfBLomU6kWwswQVXX4=tje7fo7tQ@mail.gmail.com>
	<CACuV5sBCbV2-mu-wd9ibGF45KmY9c7RSDb3nZdYd5+TV-ZwWsw@mail.gmail.com>
	<CACuV5sCHiRWSX_aC0__g0AZmQeQGoUaErJP-PactnhLhBrBfgw@mail.gmail.com>
	<CACuV5sBv8MoiYsgVSS-D-_wLD5SxRNor0Y5Gs9Qr=r0fSi4tUQ@mail.gmail.com>
	<CACuV5sBisc7zQ4w_XhFKxJhmMhtTxbALmYZo=uHN33-zRMeADw@mail.gmail.com>
	<CACuV5sB2=x73EJ94L3kr6t1ahZy-r1OcMhY7PXY+pcFn_s4btA@mail.gmail.com>
	<CACuV5sCTKn0Xqn=+NLQMyuRhyZ=Xyngv7NO-b-SOJ6J=5ozJFA@mail.gmail.com>
	<50BBC3C1.7060709@fouter.net>
	<CACuV5sBfibVszA9AcSb=Q1Dp5FDkVM+B65fPNnuC_-ZHC0mc1Q@mail.gmail.com>
	<50BBC616.1000200@fouter.net>
	<CACuV5sBh6jsc6c6dy1VpaEXX_Dr4tRrjD8JPsRht02PX-bh_+g@mail.gmail.com>
	<50BBCB0D.9080200@fouter.net>
	<CACuV5sDW+fB8JV_dj7Aw5QNROFuAhO-DB3vJO-2RzSed0JXp9A@mail.gmail.com>
	<CACuV5sARYioXu-+Rb0f+VMqeVmKfD8KKTtt=nTkBawwVY3Xg8Q@mail.gmail.com>
Message-ID: <50BD17F6.2060201@fouter.net>

On 12/03/12 20:40, Zenny wrote:
> Hi again:
> 
> I tried with completely new installations (single mandos-server and
> single-client), and yet I could not figure out exactly why mandos is
> not working. Both debian squeeze boxes.
> 
> On mandos-monitor, I am getting:
> "2012-12-03T21:33:27.142917: Checker for client debian64.domain.local
> (command "f
> ping -q -- debian64\.domain\.local") failed with exit code 2"
> 
> Any inputs will be appreciated!

What is that's telling you?  Is ping actually working?  Do you have a network
connection?

If you've got 2 VMs on one machine they won't know about each other unless you
set up some sort of routing.  Are you using VirtualBox?  If so the default
network interface is NAT.  It would be easier if you used bridged interfaces
with either dhcp if that's what you have, to allocate IP addresses, or
manually allocated on the same network as the host. Make sure these 2 machines
can talk to each other.  Also make sure ipv6 is working.  If ifconfig reports
ipv6 addresses that should do.

You must give us some information. The debug report in your last message was
just the initialization.  There was no interaction.   Also what happened on
the client?  Debug on both server and client please.

I'll help you if I can but at the moment I can only give uninformed guesses.

Dick

From garbytrash at gmail.com  Tue Dec  4 07:10:56 2012
From: garbytrash at gmail.com (Zenny)
Date: Tue, 4 Dec 2012 07:10:56 +0100
Subject: Some starting documents
In-Reply-To: <50BD17F6.2060201@fouter.net>
References: <CACuV5sBTAVdtRNdRN0uT3RFfBLomU6kWwswQVXX4=tje7fo7tQ@mail.gmail.com>
	<CACuV5sBCbV2-mu-wd9ibGF45KmY9c7RSDb3nZdYd5+TV-ZwWsw@mail.gmail.com>
	<CACuV5sCHiRWSX_aC0__g0AZmQeQGoUaErJP-PactnhLhBrBfgw@mail.gmail.com>
	<CACuV5sBv8MoiYsgVSS-D-_wLD5SxRNor0Y5Gs9Qr=r0fSi4tUQ@mail.gmail.com>
	<CACuV5sBisc7zQ4w_XhFKxJhmMhtTxbALmYZo=uHN33-zRMeADw@mail.gmail.com>
	<CACuV5sB2=x73EJ94L3kr6t1ahZy-r1OcMhY7PXY+pcFn_s4btA@mail.gmail.com>
	<CACuV5sCTKn0Xqn=+NLQMyuRhyZ=Xyngv7NO-b-SOJ6J=5ozJFA@mail.gmail.com>
	<50BBC3C1.7060709@fouter.net>
	<CACuV5sBfibVszA9AcSb=Q1Dp5FDkVM+B65fPNnuC_-ZHC0mc1Q@mail.gmail.com>
	<50BBC616.1000200@fouter.net>
	<CACuV5sBh6jsc6c6dy1VpaEXX_Dr4tRrjD8JPsRht02PX-bh_+g@mail.gmail.com>
	<50BBCB0D.9080200@fouter.net>
	<CACuV5sDW+fB8JV_dj7Aw5QNROFuAhO-DB3vJO-2RzSed0JXp9A@mail.gmail.com>
	<CACuV5sARYioXu-+Rb0f+VMqeVmKfD8KKTtt=nTkBawwVY3Xg8Q@mail.gmail.com>
	<50BD17F6.2060201@fouter.net>
Message-ID: <CACuV5sD_HiiGWFEaTy_1qkQvqQdqmqEer0zkygQTHwNT=sYC+Q@mail.gmail.com>

On 12/3/12, Dick Middleton <dick at fouter.net> wrote:
> On 12/03/12 20:40, Zenny wrote:
>> Hi again:
>>
>> I tried with completely new installations (single mandos-server and
>> single-client), and yet I could not figure out exactly why mandos is
>> not working. Both debian squeeze boxes.
>>
>> On mandos-monitor, I am getting:
>> "2012-12-03T21:33:27.142917: Checker for client debian64.domain.local
>> (command "f
>> ping -q -- debian64\.domain\.local") failed with exit code 2"
>>
>> Any inputs will be appreciated!
>
> What is that's telling you?  Is ping actually working?  Do you have a
> network
> connection?
>
> If you've got 2 VMs on one machine they won't know about each other unless
> you
> set up some sort of routing.  Are you using VirtualBox?  If so the default
> network interface is NAT.  It would be easier if you used bridged
> interfaces
> with either dhcp if that's what you have, to allocate IP addresses, or
> manually allocated on the same network as the host. Make sure these 2
> machines
> can talk to each other.

I use qemu with a bridge created with the script here
(http://wiki.qemu.org/Documentation/Networking/NAT#Script) which
creates a bridge and nat the network with dnsmasq. Very nifty script.
So there is no doubt that the machines are behind a NAT and see each
other, because they are under the same bridged network (br0).

> Also make sure ipv6 is working.  If ifconfig
> reports
> ipv6 addresses that should do.

Maybe this is the cause. I didn't enable ipv6 manually because none of
my network are ipv6, all ipv4 (both private and public).

Is it mandatory to have ipv6 enabled?


>
> You must give us some information. The debug report in your last message
> was
> just the initialization.  There was no interaction.   Also what happened on
> the client?  Debug on both server and client please.
>
> I'll help you if I can but at the moment I can only give uninformed
> guesses.
>
> Dick
> _______________________________________________
> Mandos-Dev mailing list
> Mandos-Dev at recompile.se
> https://mail.recompile.se/cgi-bin/mailman/listinfo/mandos-dev
>

From garbytrash at gmail.com  Tue Dec  4 13:21:36 2012
From: garbytrash at gmail.com (Zenny)
Date: Tue, 4 Dec 2012 13:21:36 +0100
Subject: Some starting documents
In-Reply-To: <75d3506d-f9de-492c-b84b-4bc20f53073a@email.android.com>
References: <CACuV5sBTAVdtRNdRN0uT3RFfBLomU6kWwswQVXX4=tje7fo7tQ@mail.gmail.com>
	<CACuV5sBCbV2-mu-wd9ibGF45KmY9c7RSDb3nZdYd5+TV-ZwWsw@mail.gmail.com>
	<CACuV5sCHiRWSX_aC0__g0AZmQeQGoUaErJP-PactnhLhBrBfgw@mail.gmail.com>
	<CACuV5sBv8MoiYsgVSS-D-_wLD5SxRNor0Y5Gs9Qr=r0fSi4tUQ@mail.gmail.com>
	<CACuV5sBisc7zQ4w_XhFKxJhmMhtTxbALmYZo=uHN33-zRMeADw@mail.gmail.com>
	<CACuV5sB2=x73EJ94L3kr6t1ahZy-r1OcMhY7PXY+pcFn_s4btA@mail.gmail.com>
	<CACuV5sCTKn0Xqn=+NLQMyuRhyZ=Xyngv7NO-b-SOJ6J=5ozJFA@mail.gmail.com>
	<50BBC3C1.7060709@fouter.net>
	<CACuV5sBfibVszA9AcSb=Q1Dp5FDkVM+B65fPNnuC_-ZHC0mc1Q@mail.gmail.com>
	<50BBC616.1000200@fouter.net>
	<CACuV5sBh6jsc6c6dy1VpaEXX_Dr4tRrjD8JPsRht02PX-bh_+g@mail.gmail.com>
	<50BBCB0D.9080200@fouter.net>
	<CACuV5sDW+fB8JV_dj7Aw5QNROFuAhO-DB3vJO-2RzSed0JXp9A@mail.gmail.com>
	<CACuV5sARYioXu-+Rb0f+VMqeVmKfD8KKTtt=nTkBawwVY3Xg8Q@mail.gmail.com>
	<50BD17F6.2060201@fouter.net>
	<CACuV5sD_HiiGWFEaTy_1qkQvqQdqmqEer0zkygQTHwNT=sYC+Q@mail.gmail.com>
	<75d3506d-f9de-492c-b84b-4bc20f53073a@email.android.com>
Message-ID: <CACuV5sDuye2R-oV_9TjukzMXZjO_XxjESeV=QFh_aSw9EczffA@mail.gmail.com>

On 12/4/12, Dick Middleton <dick at lingbrae.com> wrote:
> <q>
> The Mandos server uses IPv6 to allow Mandos clients to use IPv6 link-local
> addresses, since the clients will probably not have any other addresses
> configured (see the section called ?OVERVIEW?).
> </q>

I did check the site again and read again and again, also INSTALL and
README file in the bzr repository, but could not exactly find the IPv6
requirement.

Is there any workout to make only IPv4-enabled mandos server and
clients to talk to each other? Just wondering.

>
> I still don't understand why ping fails. You need to find out.
>
> Dick.
>
> Zenny <garbytrash at gmail.com> wrote:
>
>>On 12/3/12, Dick Middleton <dick at fouter.net> wrote:
>>> On 12/03/12 20:40, Zenny wrote:
>>>> Hi again:
>>>>
>>>> I tried with completely new installations (single mandos-server and
>>>> single-client), and yet I could not figure out exactly why mandos is
>>>> not working. Both debian squeeze boxes.
>>>>
>>>> On mandos-monitor, I am getting:
>>>> "2012-12-03T21:33:27.142917: Checker for client
>>debian64.domain.local
>>>> (command "f
>>>> ping -q -- debian64\.domain\.local") failed with exit code 2"
>>>>
>>>> Any inputs will be appreciated!
>>>
>>> What is that's telling you?  Is ping actually working?  Do you have a
>>> network
>>> connection?
>>>
>>> If you've got 2 VMs on one machine they won't know about each other
>>unless
>>> you
>>> set up some sort of routing.  Are you using VirtualBox?  If so the
>>default
>>> network interface is NAT.  It would be easier if you used bridged
>>> interfaces
>>> with either dhcp if that's what you have, to allocate IP addresses,
>>or
>>> manually allocated on the same network as the host. Make sure these 2
>>> machines
>>> can talk to each other.
>>
>>I use qemu with a bridge created with the script here
>>(http://wiki.qemu.org/Documentation/Networking/NAT#Script) which
>>creates a bridge and nat the network with dnsmasq. Very nifty script.
>>So there is no doubt that the machines are behind a NAT and see each
>>other, because they are under the same bridged network (br0).
>>
>>> Also make sure ipv6 is working.  If ifconfig
>>> reports
>>> ipv6 addresses that should do.
>>
>>Maybe this is the cause. I didn't enable ipv6 manually because none of
>>my network are ipv6, all ipv4 (both private and public).
>>
>>Is it mandatory to have ipv6 enabled?
>>
>>
>>>
>>> You must give us some information. The debug report in your last
>>message
>>> was
>>> just the initialization.  There was no interaction.   Also what
>>happened on
>>> the client?  Debug on both server and client please.
>>>
>>> I'll help you if I can but at the moment I can only give uninformed
>>> guesses.
>>>
>>> Dick
>>> _______________________________________________
>>> Mandos-Dev mailing list
>>> Mandos-Dev at recompile.se
>>> https://mail.recompile.se/cgi-bin/mailman/listinfo/mandos-dev
>>>
>>_______________________________________________
>>Mandos-Dev mailing list
>>Mandos-Dev at recompile.se
>>https://mail.recompile.se/cgi-bin/mailman/listinfo/mandos-dev
>
> --
> Sent from my Android phone with K-9 Mail. Please excuse my brevity.

From garbytrash at gmail.com  Tue Dec  4 17:48:46 2012
From: garbytrash at gmail.com (Zenny)
Date: Tue, 4 Dec 2012 17:48:46 +0100
Subject: Ideal way to Enable IPv6 in Debian Squeeze for Mandos Deployment
Message-ID: <CACuV5sCG1Bis6BxnGSwvkUjwMNsuN+p+urRC3-860stpt_h2_w@mail.gmail.com>

Hi:

I have been trying to deploy Mandos server-client pair which
authenticates between each other while rendering mandos client
services to other clients in the network.

I have installed debian squeeze (6.0.6) in two qemu instances behind
NAT which can talk to each other. I use a script from
http://wiki.qemu.org/Documentation/Networking/NAT#Script which
broadcast IPv4 addresses using a br0 device and qemu starts with a tap
device.

However, I was recently told that Mandos requires IPv6 enabled.

So far I did the following to enable it:

# ifconfig eth0
eth0      Link encap:Ethernet  HWaddr 52:54:00:12:34:56
          inet addr:192.168.53.160  Bcast:192.168.53.255  Mask:255.255.255.0
          inet6 addr: fe80::5054:ff:fe12:3456/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:268 errors:0 dropped:0 overruns:0 frame:0
          TX packets:201 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:22377 (21.8 KiB)  TX bytes:26734 (26.1 KiB)
          Interrupt:11 Base address:0xc000

IPv6 enabled in avahi:
# cat /etc/avahi/avahi-daemon.conf | grep ipv6
use-ipv6=yes
##publish-a-on-ipv6=no

Prioritized ipv6 in nsswitch.conf:
# cat /etc/nsswitch.conf | grep mdns
##hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
hosts:          files mdns_minimal [NOTFOUND=return] dns

Installed rdnssd:
#aptitude install rdnssd

To filter network flow:
# aptitude install iptables iptables-persistent radvd

Appended IPv6 forward in sysctl.conf
#echo "net.ipv6.conf.default.forwarding=1" >> /etc/sysctl.conf

Can anyone tell me what else that I need to configure to make the pair
work? Whether this should be done both in the server running
mandos-server and mandos-client or only in mandos-server?

Still not working. :-(

Any help will be appreciated!

/zenny

From garbytrash at gmail.com  Fri Dec  7 07:36:10 2012
From: garbytrash at gmail.com (Zenny)
Date: Fri, 7 Dec 2012 07:36:10 +0100
Subject: dropbear in parallel with mandos-client in debian squeeze?
Message-ID: <CACuV5sBHnEiO9w=DbLGziVKT8MpPDiMS6R3a0HosQd8Cd8NrXQ@mail.gmail.com>

Hei:

I have a situation where I need to install both dropbear and
mandos-client on one machine for remote authentication, but they
conflict with each other.

My scenario is this:

1) It is about a headless machine running mandos-client. (yes there is
serial port, but everyone here do not know how to use)

2) For their convenience, I would like to make the mandos-client get
the key from the mandos server, and in case it cannot reach
mandos-server, use the remote key authentication using dropbear as
Plan B.

Appreciate if someone shares the way to embed mandos-client as Plan A
and dropbear+busybox as Plan B onto initram. Thanks!

/zenny