--- name: "mandos.conf" section: "5" platform: "linux" package: "mandos" version: "1.8.19-1" release: "Debian 13 (Trixie)" platforms: ["linux"] url: "https://new.carta.tech/mandos.conf" --- # mandos.conf(5) Configuration file for the Mandos server ## NAME mandos.conf - Configuration file for the Mandos server ## SYNOPSIS ``` /etc/mandos/mandos.conf ``` ## DESCRIPTION The file /etc/mandos/mandos.conf is a configuration file for [**mandos**(8)](/mandos/8.md), and is read by it at startup. The configuration file starts with “\[DEFAULT\]” on a line by itself, followed by any number of “*option*=*value*” entries, with continuations in the style of RFC 822. “*option*: *value*” is also accepted. Note that leading whitespace is removed from values. Lines beginning with “#” or “;” are ignored and may be used to provide comments. ## OPTIONS **interface =** *NAME* If this is specified, the server will only announce the service and listen to requests on the specified network interface. Default is to use all available interfaces. *Note:* a failure to bind to the specified interface is not considered critical, and the server will not exit, but instead continue normally. **address =** *ADDRESS* If this option is used, the server will only listen to the specified IPv6 address. If a link-local address is specified, an interface should be set, since a link-local address is only valid on a single interface. By default, the server will listen to all available addresses. If set, this must normally be an IPv6 address; an IPv4 address can only be specified using IPv4-mapped IPv6 address syntax: “::FFFF:192.0.2.3”. (Only if IPv6 usage is *disabled* (see below) must this be an IPv4 address.) **port =** *NUMBER* If this option is used, the server will bind to that port. By default, the server will listen to an arbitrary port given by the operating system. **debug = { 1 \| yes \| true \| on \| 0 \| no \| false \| off }** If the server is run in debug mode, it will run in the foreground and print a lot of debugging information. The default is to *not* run in debug mode. **priority =** *STRING* GnuTLS priority string for the TLS handshake. The default is “SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA:!VERS-ALL:+VERS-TLS1.3:%PROFILE\_ULTRA” when using raw public keys in TLS, and “SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA:+SIGN-DSA-SHA256” when using OpenPGP keys in TLS,. See [**gnutls\_priority\_init**(3)](/gnutls_priority_init/3.md) for the syntax. *Warning*: changing this may make the TLS handshake fail, making server-client communication impossible. Changing this option may also make the network traffic decryptable by an attacker. **servicename =** *NAME* Zeroconf service name. The default is “Mandos”. This only needs to be changed if for some reason is would be necessary to run more than one server on the same *host*. This would not normally be useful. If there are name collisions on the same *network*, the newer server will automatically rename itself to “Mandos #2”, and so on; therefore, this option is not needed in that case. **use\_dbus = { 1 \| yes \| true \| on \| 0 \| no \| false \| off }** This option controls whether the server will provide a D-Bus system bus interface. The default is to provide such an interface. **use\_ipv6 = { 1 \| yes \| true \| on \| 0 \| no \| false \| off }** This option controls whether the server will use IPv6 sockets and addresses. The default is to use IPv6. This option should *never* normally be turned off, *even in IPv4-only environments*. This is because [**mandos-client**(8mandos)](/mandos-client/8mandos.md) will normally use IPv6 link-local addresses, and will not be able to find or connect to the server if this option is turned off. *Only advanced users should consider changing this option*. **restore = { 1 \| yes \| true \| on \| 0 \| no \| false \| off }** This option controls whether the server will restore its state from the last time it ran. Default is to restore last state. **statedir =** *DIRECTORY* Directory to save (and restore) state in. Default is “/var/lib/mandos”. **socket =** *NUMBER* If this option is used, the server will not create a new network socket, but will instead use the supplied file descriptor. By default, the server will create a new network socket. ## FILES The file described here is /etc/mandos/mandos.conf ## BUGS The \[DEFAULT\] is necessary because the Python built-in module ConfigParser requires it. Please report bugs to the Mandos development mailing list: \ (subscription required). Note that this list is public. The developers can be reached privately at \ (OpenPGP key fingerprint 153A 37F1 0BBA 0435 987F 2C4A 7223 2973 CA34 C2C4 for encrypted mail). ## EXAMPLE No options are actually required: ``` [DEFAULT] ``` An example using all the options: ``` [DEFAULT] # A configuration example interface = enp1s0 address = fe80::aede:48ff:fe71:f6f2 port = 1025 debug = True priority = SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA:!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA servicename = Daena use_dbus = False use_ipv6 = True restore = True statedir = /var/lib/mandos ``` ## SEE ALSO [**intro**(8mandos)](/intro/8mandos.md), [**gnutls\_priority\_init**(3)](/gnutls_priority_init/3.md), [**mandos**(8)](/mandos/8.md), [**mandos-clients.conf**(5)](/mandos-clients.conf/5.md) RFC 4291: IP Version 6 Addressing Architecture Section 2.2: Text Representation of Addresses Section 2.5.5.2: IPv4-Mapped IPv6 Address Section 2.5.6, Link-Local IPv6 Unicast Addresses The clients use IPv6 link-local addresses, which are immediately usable since a link-local addresses is automatically assigned to a network interface when it is brought up. **Zeroconf**\[1\] Zeroconf is the network protocol standard used by clients for finding the Mandos server on the local network. ## COPYRIGHT Copyright © 2008-2024 Teddy Hogeborn, Björn Påhlsson\ This manual page is part of Mandos. Mandos is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. Mandos is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with Mandos. If not, see **http://www.gnu.org/licenses/**. ## NOTES - 1\. Zeroconf http://www.zeroconf.org/