1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
<!ENTITY VERSION "1.0">
4
5
<!ENTITY COMMANDNAME "mandos-keygen">
5
<!ENTITY TIMESTAMP "2019-07-18">
6
<!ENTITY % common SYSTEM "common.ent">
6
<!ENTITY TIMESTAMP "2008-08-31">
10
9
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
12
11
<title>Mandos Manual</title>
13
12
<!-- NWalsh’s docbook scripts use this to generate the footer: -->
14
13
<productname>Mandos</productname>
15
<productnumber>&version;</productnumber>
14
<productnumber>&VERSION;</productnumber>
16
15
<date>&TIMESTAMP;</date>
19
18
<firstname>Björn</firstname>
20
19
<surname>Påhlsson</surname>
22
<email>belorn@recompile.se</email>
21
<email>belorn@fukt.bsnet.se</email>
26
25
<firstname>Teddy</firstname>
27
26
<surname>Hogeborn</surname>
29
<email>teddy@recompile.se</email>
28
<email>teddy@fukt.bsnet.se</email>
46
34
<holder>Teddy Hogeborn</holder>
47
35
<holder>Björn Påhlsson</holder>
49
<xi:include href="legalnotice.xml"/>
39
This manual page is free software: you can redistribute it
40
and/or modify it under the terms of the GNU General Public
41
License as published by the Free Software Foundation,
42
either version 3 of the License, or (at your option) any
47
This manual page is distributed in the hope that it will
48
be useful, but WITHOUT ANY WARRANTY; without even the
49
implied warranty of MERCHANTABILITY or FITNESS FOR A
50
PARTICULAR PURPOSE. See the GNU General Public License
55
You should have received a copy of the GNU General Public
56
License along with this program; If not, see
57
<ulink url="http://www.gnu.org/licenses/"/>.
53
63
<refentrytitle>&COMMANDNAME;</refentrytitle>
54
64
<manvolnum>8</manvolnum>
127
137
<replaceable>TIME</replaceable></option></arg>
131
<arg choice="plain"><option>--tls-keytype
132
<replaceable>KEYTYPE</replaceable></option></arg>
133
<arg choice="plain"><option>-T
134
<replaceable>KEYTYPE</replaceable></option></arg>
138
<arg choice="plain"><option>--force</option></arg>
139
<arg choice="plain"><option>-f</option></arg>
140
<arg><option>--force</option></arg>
143
143
<command>&COMMANDNAME;</command>
144
144
<group choice="req">
145
145
<arg choice="plain"><option>--password</option></arg>
146
146
<arg choice="plain"><option>-p</option></arg>
147
<arg choice="plain"><option>--passfile
148
<replaceable>FILE</replaceable></option></arg>
149
<arg choice="plain"><option>-F</option>
150
<replaceable>FILE</replaceable></arg>
188
180
<title>DESCRIPTION</title>
190
182
<command>&COMMANDNAME;</command> is a program to generate the
191
TLS and OpenPGP keys used by
192
<citerefentry><refentrytitle>mandos-client</refentrytitle>
193
<manvolnum>8mandos</manvolnum></citerefentry>. The keys are
194
normally written to /etc/keys/mandos for later installation into
195
the initrd image, but this, and most other things, can be
196
changed with command line options.
184
<citerefentry><refentrytitle>password-request</refentrytitle>
185
<manvolnum>8mandos</manvolnum></citerefentry>. The key is
186
normally written to /etc/mandos for later installation into the
187
initrd image, but this, and most other things, can be changed
188
with command line options.
199
191
This program can also be used with the
200
<option>--password</option> or <option>--passfile</option>
201
options to generate a ready-made section for
202
<filename>clients.conf</filename> (see
192
<option>--password</option> option to generate a ready-made
193
section for <filename>clients.conf</filename> (see
203
194
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
204
195
<manvolnum>5</manvolnum></citerefentry>).
236
227
<replaceable>DIRECTORY</replaceable></option></term>
239
Target directory for key files. Default is <filename
240
class="directory">/etc/keys/mandos</filename>.
230
Target directory for key files. Default is
231
<filename>/etc/mandos</filename>.
246
237
<term><option>--type
247
238
<replaceable>TYPE</replaceable></option></term>
332
<term><option>--tls-keytype
333
<replaceable>KEYTYPE</replaceable></option></term>
335
<replaceable>KEYTYPE</replaceable></option></term>
338
TLS key type. Default is <quote>ed25519</quote>
344
325
<term><option>--force</option></term>
345
326
<term><option>-f</option></term>
357
338
Prompt for a password and encrypt it with the key already
358
present in either <filename>/etc/keys/mandos</filename> or
359
the directory specified with the <option>--dir</option>
339
present in either <filename>/etc/mandos</filename> or the
340
directory specified with the <option>--dir</option>
360
341
option. Outputs, on standard output, a section suitable
361
342
for inclusion in <citerefentry><refentrytitle
362
343
>mandos-clients.conf</refentrytitle><manvolnum
363
344
>8</manvolnum></citerefentry>. The host name or the name
364
345
specified with the <option>--name</option> option is used
365
346
for the section header. All other options are ignored,
366
and no key is created. Note: white space is stripped from
367
the beginning and from the end of the password; See <xref
373
<term><option>--passfile
374
<replaceable>FILE</replaceable></option></term>
376
<replaceable>FILE</replaceable></option></term>
379
The same as <option>--password</option>, but read from
380
<replaceable>FILE</replaceable>, not the terminal, and
381
white space is not stripped from the password in any way.
386
<term><option>--no-ssh</option></term>
387
<term><option>-S</option></term>
390
When <option>--password</option> or
391
<option>--passfile</option> is given, this option will
392
prevent <command>&COMMANDNAME;</command> from calling
393
<command>ssh-keyscan</command> to get an SSH fingerprint
394
for this host and, if successful, output suitable config
395
options to use this fingerprint as a
396
<option>checker</option> option in the output. This is
397
otherwise the default behavior.
347
and no key is created.
404
354
<refsect1 id="overview">
405
355
<title>OVERVIEW</title>
406
356
<xi:include href="overview.xml"/>
408
This program is a small utility to generate new TLS and OpenPGP
409
keys for new Mandos clients, and to generate sections for
410
inclusion in <filename>clients.conf</filename> on the server.
358
This program is a small utility to generate new OpenPGP keys for
359
new Mandos clients, and to generate sections for inclusion in
360
<filename>clients.conf</filename> on the server.
414
364
<refsect1 id="exit_status">
415
365
<title>EXIT STATUS</title>
466
<term><filename>/etc/keys/mandos/tls-privkey.pem</filename></term>
469
Private key file which will be created or overwritten.
474
<term><filename>/etc/keys/mandos/tls-pubkey.pem</filename></term>
477
Public key file which will be created or overwritten.
482
<term><filename class="directory">/tmp</filename></term>
416
<term><filename>/tmp</filename></term>
485
419
Temporary files will be written here if
493
427
<refsect1 id="bugs">
494
428
<title>BUGS</title>
496
The <option>--password</option>/<option>-p</option> option
497
strips white space from the start and from the end of the
498
password before using it. If this is a problem, use the
499
<option>--passfile</option> option instead, which does not do
430
None are known at this time.
502
<xi:include href="bugs.xml"/>
505
434
<refsect1 id="example">
506
435
<title>EXAMPLE</title>
507
436
<informalexample>
526
455
</informalexample>
527
456
<informalexample>
529
Prompt for a password, encrypt it with the keys in <filename
530
class="directory">/etc/keys/mandos</filename> and output a
531
section suitable for <filename>clients.conf</filename>.
458
Prompt for a password, encrypt it with the key in
459
<filename>/etc/mandos</filename> and output a section suitable
460
for <filename>clients.conf</filename>.
534
463
<userinput>&COMMANDNAME; --password</userinput>
563
492
<manvolnum>8</manvolnum></citerefentry>.
567
496
<refsect1 id="see_also">
568
497
<title>SEE ALSO</title>
570
<citerefentry><refentrytitle>intro</refentrytitle>
571
<manvolnum>8mandos</manvolnum></citerefentry>,
572
499
<citerefentry><refentrytitle>gpg</refentrytitle>
573
500
<manvolnum>1</manvolnum></citerefentry>,
574
501
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
575
502
<manvolnum>5</manvolnum></citerefentry>,
576
503
<citerefentry><refentrytitle>mandos</refentrytitle>
577
504
<manvolnum>8</manvolnum></citerefentry>,
578
<citerefentry><refentrytitle>mandos-client</refentrytitle>
579
<manvolnum>8mandos</manvolnum></citerefentry>,
580
<citerefentry><refentrytitle>ssh-keyscan</refentrytitle>
581
<manvolnum>1</manvolnum></citerefentry>
505
<citerefentry><refentrytitle>password-request</refentrytitle>
506
<manvolnum>8mandos</manvolnum></citerefentry>
added
removed
mandos-keygen.xml
