MANDOS.CONF(5)

📦
version 1.8.19 · 3 versions
, in debian trixie, ubuntu questing, ubuntu resolute, ubuntu stonking

🎀 NAME 🎀

mandos.conf — the configuration file for the Mandos server, bestie. That's it, that's the whole name. Iconic.

✨ SYNOPSIS ✨

/etc/mandos/mandos.conf

💖 DESCRIPTION 💖

Okay so listen. This file, /etc/mandos/mandos.conf, is the configuration file for mandos(8), and the server reads it the moment it starts up. That's the whole relationship. 🫶

Here's how the format works, no cap:

  • The file kicks off with [DEFAULT] sitting on a line all by itself. Main character energy. It goes first.
  • After that? Any number of option=value entries. As many as you want, go off. 💅
  • Continuations follow the style of RFC 822, so you can wrap long lines if you're feeling fancy.
  • option: value is also accepted, if the = key isn't your vibe today.
  • Heads up: leading whitespace gets removed from values. So don't try to sneak spaces in at the front, it's not gonna work.
  • Lines starting with # or ; are ignored — those are your comment lines, use them liberally, they're free. 🌸

👑 OPTIONS 👑

Every single one, in order, no skips. Periodt.

  • interface = NAME — If you set this, the server will only announce the service and listen to requests on that one network interface. Default is to just use all available interfaces. ⚠️ Note: if it fails to bind to the interface you named, that's not considered critical — the server won't exit, it'll just keep going like nothing happened. Chill of it, honestly.
  • address = ADDRESS — Set this and the server will only listen to that specific IPv6 address. If you're using a link-local address, you should also set an interface, because a link-local address is only valid on a single interface. By default the server listens to all available addresses. If you set it, it normally has to be an IPv6 address; an IPv4 address can only be specified using IPv4-mapped IPv6 address syntax: ::FFFF:192.0.2.3. (Only if IPv6 usage is disabled — see use_ipv6 below — must this be an IPv4 address.) 🦋
  • port = NUMBER — Set it and the server binds to that port. Default behavior is to let the operating system hand out an arbitrary port. Surprise port, love that for us.
  • debug = { 1 | yes | true | on | 0 | no | false | off } — Debug mode makes the server run in the foreground and print a LOT of debugging info. Default is to not run in debug mode. So if you're like "where is my output going" — that's why, bestie. 😭
  • priority = STRING — The GnuTLS priority string for the TLS handshake. Defaults are:
    • SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA:!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA when using raw public keys in TLS
    • SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA:+SIGN-DSA-SHA256 when using OpenPGP keys in TLS

For the syntax, check gnutls_priority_init(3). 🧚

WARNING, FR FR: changing this can make the TLS handshake fail, which makes server-client communication literally impossible. It can also make your network traffic decryptable by an attacker. So like… don't touch it unless you know exactly what you're doing. 💀
  • servicename = NAME — The Zeroconf service name. Default is "Mandos". You'd only change this if you somehow needed to run more than one server on the same host, which would not normally be useful. And if there are name collisions on the same network, the newer server automatically renames itself to "Mandos #2", and so on — so you don't even need this option in that case. The software handles it. Queen behavior. 👑
  • use_dbus = { 1 | yes | true | on | 0 | no | false | off } — Controls whether the server provides a D-Bus system bus interface. Default is yes, it provides one.
  • use_ipv6 = { 1 | yes | true | on | 0 | no | false | off } — Controls whether the server uses IPv6 sockets and addresses. Default is to use IPv6. And bestie, this option should never normally be turned off, even in IPv4-only environments. Why? Because mandos-client(8mandos) normally uses IPv6 link-local addresses, and it will not be able to find or connect to the server if you turn this off. Only advanced users should even consider changing it. 🚨
  • restore = { 1 | yes | true | on | 0 | no | false | off } — Controls whether the server restores its state from the last time it ran. Default is to restore last state. Glow-up continuity. ✨
  • statedir = DIRECTORY — The directory to save (and restore) state in. Default is /var/lib/mandos.
  • socket = NUMBER — Set this and the server will not create a new network socket — instead it uses the supplied file descriptor. By default, the server creates a new network socket. 🍓

🌈 FILES 🌈

The file described here is /etc/mandos/mandos.conf. Yes, the same one from the top. It's that girl.

💀 BUGS 💀

The [DEFAULT] is necessary because the Python built-in module ConfigParser requires it. Not our fault. Blame the module. 🙈

Please report bugs to the Mandos development mailing list: <mandos-dev@recompile.se> (subscription required). Note that this list is public. The developers can be reached privately at <mandos@recompile.se> (OpenPGP key fingerprint 153A 37F1 0BBA 0435 987F 2C4A 7223 2973 CA34 C2C4 for encrypted mail). 🔐

🌸 EXAMPLE 🌸

Plot twist: no options are actually required. Minimalism ate. 💅

[DEFAULT]

And here's one using all the options, for when you're feeling extra:

[DEFAULT]
# A configuration example
interface = enp1s0
address = fe80::aede:48ff:fe71:f6f2
port = 1025
debug = True
priority = SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA:!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA
servicename = Daena
use_dbus = False
use_ipv6 = True
restore = True
statedir = /var/lib/mandos

🦋 SEE ALSO 🦋

  • intro(8mandos)
  • gnutls_priority_init(3)
  • mandos(8)
  • mandos-clients.conf(5)
  • RFC 4291: IP Version 6 Addressing Architecture
    • Section 2.2: Text Representation of Addresses
    • Section 2.5.5.2: IPv4-Mapped IPv6 Address
    • Section 2.5.6, Link-Local IPv6 Unicast Addresses — the clients use IPv6 link-local addresses, which are immediately usable since a link-local address is automatically assigned to a network interface when it is brought up.
  • Zeroconf[1] — Zeroconf is the network protocol standard used by clients for finding the Mandos server on the local network.

Copyright © 2008-2024 Teddy Hogeborn, Björn Påhlsson

This manual page is part of Mandos.

Mandos is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

Mandos is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with Mandos. If not, see http://www.gnu.org/licenses/.

⭐ NOTES ⭐

  1. Zeroconf — http://www.zeroconf.org/

Okay that's the whole page, you're fully caught up bestie. 💖 This was Mandos 1.8.19, dated 2025-06-27, and it's the MANDOS.CONF(5) page from the Mandos Manual. Now go forth and configure responsibly — and don't touch priority, I'm literally begging you. 🎀✨🫶

📦 where this page comes from