12
11
<title>Mandos Manual</title>
13
12
<!-- NWalsh’s docbook scripts use this to generate the footer: -->
14
13
<productname>Mandos</productname>
15
<productnumber>&version;</productnumber>
14
<productnumber>&VERSION;</productnumber>
16
15
<date>&TIMESTAMP;</date>
19
18
<firstname>Björn</firstname>
20
19
<surname>Påhlsson</surname>
22
<email>belorn@recompile.se</email>
21
<email>belorn@fukt.bsnet.se</email>
26
25
<firstname>Teddy</firstname>
27
26
<surname>Hogeborn</surname>
29
<email>teddy@recompile.se</email>
28
<email>teddy@fukt.bsnet.se</email>
45
34
<holder>Teddy Hogeborn</holder>
46
35
<holder>Björn Påhlsson</holder>
48
<xi:include href="legalnotice.xml"/>
39
This manual page is free software: you can redistribute it
40
and/or modify it under the terms of the GNU General Public
41
License as published by the Free Software Foundation,
42
either version 3 of the License, or (at your option) any
47
This manual page is distributed in the hope that it will
48
be useful, but WITHOUT ANY WARRANTY; without even the
49
implied warranty of MERCHANTABILITY or FITNESS FOR A
50
PARTICULAR PURPOSE. See the GNU General Public License
55
You should have received a copy of the GNU General Public
56
License along with this program; If not, see
57
<ulink url="http://www.gnu.org/licenses/"/>.
52
63
<refentrytitle>&COMMANDNAME;</refentrytitle>
53
64
<manvolnum>8</manvolnum>
126
138
<replaceable>TIME</replaceable></option></arg>
130
<arg choice="plain"><option>--tls-keytype
131
<replaceable>KEYTYPE</replaceable></option></arg>
132
<arg choice="plain"><option>-T
133
<replaceable>KEYTYPE</replaceable></option></arg>
137
<arg choice="plain"><option>--force</option></arg>
138
<arg choice="plain"><option>-f</option></arg>
141
<arg><option>--force</option></arg>
142
144
<command>&COMMANDNAME;</command>
143
145
<group choice="req">
146
<arg choice="plain"><option>-p</option></arg>
144
147
<arg choice="plain"><option>--password</option></arg>
145
<arg choice="plain"><option>-p</option></arg>
146
<arg choice="plain"><option>--passfile
147
<replaceable>FILE</replaceable></option></arg>
148
<arg choice="plain"><option>-F</option>
149
<replaceable>FILE</replaceable></arg>
162
160
<arg choice="plain"><option>-n
163
161
<replaceable>NAME</replaceable></option></arg>
166
<arg choice="plain"><option>--no-ssh</option></arg>
167
<arg choice="plain"><option>-S</option></arg>
171
165
<command>&COMMANDNAME;</command>
172
166
<group choice="req">
167
<arg choice="plain"><option>-h</option></arg>
173
168
<arg choice="plain"><option>--help</option></arg>
174
<arg choice="plain"><option>-h</option></arg>
178
172
<command>&COMMANDNAME;</command>
179
173
<group choice="req">
174
<arg choice="plain"><option>-v</option></arg>
180
175
<arg choice="plain"><option>--version</option></arg>
181
<arg choice="plain"><option>-v</option></arg>
184
178
</refsynopsisdiv>
186
180
<refsect1 id="description">
187
181
<title>DESCRIPTION</title>
189
183
<command>&COMMANDNAME;</command> is a program to generate the
190
TLS and OpenPGP keys used by
191
<citerefentry><refentrytitle>mandos-client</refentrytitle>
185
<citerefentry><refentrytitle>password-request</refentrytitle>
192
186
<manvolnum>8mandos</manvolnum></citerefentry>. The keys are
193
187
normally written to /etc/mandos for later installation into the
194
initrd image, but this, and most other things, can be changed
195
with command line options.
188
initrd image, but this, like most things, can be changed with
189
command line options.
198
This program can also be used with the
199
<option>--password</option> or <option>--passfile</option>
200
options to generate a ready-made section for
201
<filename>clients.conf</filename> (see
192
It can also be used to generate ready-made sections for
202
193
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
203
<manvolnum>5</manvolnum></citerefentry>).
194
<manvolnum>5</manvolnum></citerefentry> using the
195
<option>--password</option> option.
207
199
<refsect1 id="purpose">
208
200
<title>PURPOSE</title>
210
203
The purpose of this is to enable <emphasis>remote and unattended
211
204
rebooting</emphasis> of client host computer with an
212
205
<emphasis>encrypted root file system</emphasis>. See <xref
213
206
linkend="overview"/> for details.
217
211
<refsect1 id="options">
218
212
<title>OPTIONS</title>
222
<term><option>--help</option></term>
223
<term><option>-h</option></term>
216
<term><literal>-h</literal>, <literal>--help</literal></term>
226
219
Show a help message and exit
233
<replaceable>DIRECTORY</replaceable></option></term>
235
<replaceable>DIRECTORY</replaceable></option></term>
225
<term><literal>-d</literal>, <literal>--dir
226
<replaceable>directory</replaceable></literal></term>
238
229
Target directory for key files. Default is
239
<filename class="directory">/etc/mandos</filename>.
246
<replaceable>TYPE</replaceable></option></term>
248
<replaceable>TYPE</replaceable></option></term>
251
OpenPGP key type. Default is <quote>RSA</quote>.
257
<term><option>--length
258
<replaceable>BITS</replaceable></option></term>
260
<replaceable>BITS</replaceable></option></term>
263
OpenPGP key length in bits. Default is 4096.
269
<term><option>--subtype
270
<replaceable>KEYTYPE</replaceable></option></term>
272
<replaceable>KEYTYPE</replaceable></option></term>
275
OpenPGP subkey type. Default is <quote>RSA</quote>
281
<term><option>--sublength
282
<replaceable>BITS</replaceable></option></term>
284
<replaceable>BITS</replaceable></option></term>
287
OpenPGP subkey length in bits. Default is 4096.
293
<term><option>--email
294
<replaceable>ADDRESS</replaceable></option></term>
296
<replaceable>ADDRESS</replaceable></option></term>
230
<filename>/etc/mandos</filename>.
236
<term><literal>-t</literal>, <literal>--type
237
<replaceable>type</replaceable></literal></term>
240
Key type. Default is <quote>DSA</quote>.
246
<term><literal>-l</literal>, <literal>--length
247
<replaceable>bits</replaceable></literal></term>
250
Key length in bits. Default is 2048.
256
<term><literal>-s</literal>, <literal>--subtype
257
<replaceable>type</replaceable></literal></term>
260
Subkey type. Default is <quote>ELG-E</quote> (Elgamal
267
<term><literal>-L</literal>, <literal>--sublength
268
<replaceable>bits</replaceable></literal></term>
271
Subkey length in bits. Default is 2048.
277
<term><literal>-e</literal>, <literal>--email</literal>
278
<replaceable>address</replaceable></term>
299
281
Email address of key. Default is empty.
305
<term><option>--comment
306
<replaceable>TEXT</replaceable></option></term>
308
<replaceable>TEXT</replaceable></option></term>
287
<term><literal>-c</literal>, <literal>--comment</literal>
288
<replaceable>comment</replaceable></term>
311
Comment field for key. Default is empty.
291
Comment field for key. The default value is
292
<quote><literal>Mandos client key</literal></quote>.
317
<term><option>--expire
318
<replaceable>TIME</replaceable></option></term>
320
<replaceable>TIME</replaceable></option></term>
298
<term><literal>-x</literal>, <literal>--expire</literal>
299
<replaceable>time</replaceable></term>
323
302
Key expire time. Default is no expiration. See
362
328
>8</manvolnum></citerefentry>. The host name or the name
363
329
specified with the <option>--name</option> option is used
364
330
for the section header. All other options are ignored,
365
and no key is created.
370
<term><option>--passfile
371
<replaceable>FILE</replaceable></option></term>
373
<replaceable>FILE</replaceable></option></term>
376
The same as <option>--password</option>, but read from
377
<replaceable>FILE</replaceable>, not the terminal.
382
<term><option>--no-ssh</option></term>
383
<term><option>-S</option></term>
386
When <option>--password</option> or
387
<option>--passfile</option> is given, this option will
388
prevent <command>&COMMANDNAME;</command> from calling
389
<command>ssh-keyscan</command> to get an SSH fingerprint
390
for this host and, if successful, output suitable config
391
options to use this fingerprint as a
392
<option>checker</option> option in the output. This is
393
otherwise the default behavior.
331
and no keys are created.
400
338
<refsect1 id="overview">
401
339
<title>OVERVIEW</title>
402
340
<xi:include href="overview.xml"/>
404
This program is a small utility to generate new TLS and OpenPGP
405
keys for new Mandos clients, and to generate sections for
406
inclusion in <filename>clients.conf</filename> on the server.
342
This program is a small utility to generate new OpenPGP keys for
410
347
<refsect1 id="exit_status">
411
348
<title>EXIT STATUS</title>
413
The exit status will be 0 if a new key (or password, if the
414
<option>--password</option> option was used) was successfully
415
created, otherwise not.
350
The exit status will be 0 if new keys were successfully created,
515
437
</informalexample>
518
Prompt for a password, encrypt it with the key in <filename
519
class="directory">/etc/mandos</filename> and output a section
520
suitable for <filename>clients.conf</filename>.
523
<userinput>&COMMANDNAME; --password</userinput>
528
Prompt for a password, encrypt it with the key in the
529
<filename>client-key</filename> directory and output a section
530
suitable for <filename>clients.conf</filename>.
534
<!-- do not wrap this line -->
535
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
541
440
<refsect1 id="security">
542
441
<title>SECURITY</title>
544
443
The <option>--type</option>, <option>--length</option>,
545
444
<option>--subtype</option>, and <option>--sublength</option>
546
options can be used to create keys of low security. If in
547
doubt, leave them to the default values.
445
options can be used to create keys of insufficient security. If
446
in doubt, leave them to the default values.
550
The key expire time is <emphasis>not</emphasis> guaranteed to be
551
honored by <citerefentry><refentrytitle>mandos</refentrytitle>
449
The key expire time is not guaranteed to be honored by
450
<citerefentry><refentrytitle>mandos</refentrytitle>
552
451
<manvolnum>8</manvolnum></citerefentry>.
556
455
<refsect1 id="see_also">
557
456
<title>SEE ALSO</title>
559
<citerefentry><refentrytitle>intro</refentrytitle>
560
<manvolnum>8mandos</manvolnum></citerefentry>,
561
458
<citerefentry><refentrytitle>gpg</refentrytitle>
562
459
<manvolnum>1</manvolnum></citerefentry>,
563
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
564
<manvolnum>5</manvolnum></citerefentry>,
565
460
<citerefentry><refentrytitle>mandos</refentrytitle>
566
461
<manvolnum>8</manvolnum></citerefentry>,
567
<citerefentry><refentrytitle>mandos-client</refentrytitle>
568
<manvolnum>8mandos</manvolnum></citerefentry>,
569
<citerefentry><refentrytitle>ssh-keyscan</refentrytitle>
570
<manvolnum>1</manvolnum></citerefentry>
462
<citerefentry><refentrytitle>password-request</refentrytitle>
463
<manvolnum>8mandos</manvolnum></citerefentry>