1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
<!ENTITY VERSION "1.0">
5
4
<!ENTITY COMMANDNAME "mandos-keygen">
6
<!ENTITY TIMESTAMP "2008-08-31">
5
<!ENTITY TIMESTAMP "2011-10-03">
6
<!ENTITY % common SYSTEM "common.ent">
9
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
11
12
<title>Mandos Manual</title>
12
13
<!-- NWalsh’s docbook scripts use this to generate the footer: -->
13
14
<productname>Mandos</productname>
14
<productnumber>&VERSION;</productnumber>
15
<productnumber>&version;</productnumber>
15
16
<date>&TIMESTAMP;</date>
18
19
<firstname>Björn</firstname>
19
20
<surname>Påhlsson</surname>
21
<email>belorn@fukt.bsnet.se</email>
22
<email>belorn@recompile.se</email>
25
26
<firstname>Teddy</firstname>
26
27
<surname>Hogeborn</surname>
28
<email>teddy@fukt.bsnet.se</email>
29
<email>teddy@recompile.se</email>
34
37
<holder>Teddy Hogeborn</holder>
35
38
<holder>Björn Påhlsson</holder>
39
This manual page is free software: you can redistribute it
40
and/or modify it under the terms of the GNU General Public
41
License as published by the Free Software Foundation,
42
either version 3 of the License, or (at your option) any
47
This manual page is distributed in the hope that it will
48
be useful, but WITHOUT ANY WARRANTY; without even the
49
implied warranty of MERCHANTABILITY or FITNESS FOR A
50
PARTICULAR PURPOSE. See the GNU General Public License
55
You should have received a copy of the GNU General Public
56
License along with this program; If not, see
57
<ulink url="http://www.gnu.org/licenses/"/>.
40
<xi:include href="legalnotice.xml"/>
63
44
<refentrytitle>&COMMANDNAME;</refentrytitle>
64
45
<manvolnum>8</manvolnum>
68
49
<refname><command>&COMMANDNAME;</command></refname>
70
Generate keys for <citerefentry><refentrytitle>password-request
71
</refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
51
Generate key and password for Mandos client and server.
77
57
<command>&COMMANDNAME;</command>
145
125
<group choice="req">
146
126
<arg choice="plain"><option>--password</option></arg>
147
127
<arg choice="plain"><option>-p</option></arg>
128
<arg choice="plain"><option>--passfile
129
<replaceable>FILE</replaceable></option></arg>
130
<arg choice="plain"><option>-F</option>
131
<replaceable>FILE</replaceable></arg>
178
162
</refsynopsisdiv>
180
164
<refsect1 id="description">
181
165
<title>DESCRIPTION</title>
183
167
<command>&COMMANDNAME;</command> is a program to generate the
185
<citerefentry><refentrytitle>password-request</refentrytitle>
186
<manvolnum>8mandos</manvolnum></citerefentry>. The keys are
169
<citerefentry><refentrytitle>mandos-client</refentrytitle>
170
<manvolnum>8mandos</manvolnum></citerefentry>. The key is
187
171
normally written to /etc/mandos for later installation into the
188
initrd image, but this, like most things, can be changed with
189
command line options.
172
initrd image, but this, and most other things, can be changed
173
with command line options.
192
It can also be used to generate ready-made sections for
176
This program can also be used with the
177
<option>--password</option> or <option>--passfile</option>
178
options to generate a ready-made section for
179
<filename>clients.conf</filename> (see
193
180
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
194
<manvolnum>5</manvolnum></citerefentry> using the
195
<option>--password</option> option.
181
<manvolnum>5</manvolnum></citerefentry>).
199
185
<refsect1 id="purpose">
200
186
<title>PURPOSE</title>
203
188
The purpose of this is to enable <emphasis>remote and unattended
204
189
rebooting</emphasis> of client host computer with an
205
190
<emphasis>encrypted root file system</emphasis>. See <xref
206
191
linkend="overview"/> for details.
211
195
<refsect1 id="options">
212
196
<title>OPTIONS</title>
216
<term><literal>-h</literal>, <literal>--help</literal></term>
200
<term><option>--help</option></term>
201
<term><option>-h</option></term>
219
204
Show a help message and exit
225
<term><literal>-d</literal>, <literal>--dir
226
<replaceable>directory</replaceable></literal></term>
211
<replaceable>DIRECTORY</replaceable></option></term>
213
<replaceable>DIRECTORY</replaceable></option></term>
229
216
Target directory for key files. Default is
236
<term><literal>-t</literal>, <literal>--type
237
<replaceable>type</replaceable></literal></term>
224
<replaceable>TYPE</replaceable></option></term>
226
<replaceable>TYPE</replaceable></option></term>
240
229
Key type. Default is <quote>DSA</quote>.
246
<term><literal>-l</literal>, <literal>--length
247
<replaceable>bits</replaceable></literal></term>
235
<term><option>--length
236
<replaceable>BITS</replaceable></option></term>
238
<replaceable>BITS</replaceable></option></term>
250
241
Key length in bits. Default is 2048.
256
<term><literal>-s</literal>, <literal>--subtype
257
<replaceable>type</replaceable></literal></term>
247
<term><option>--subtype
248
<replaceable>KEYTYPE</replaceable></option></term>
250
<replaceable>KEYTYPE</replaceable></option></term>
260
253
Subkey type. Default is <quote>ELG-E</quote> (Elgamal
267
<term><literal>-L</literal>, <literal>--sublength
268
<replaceable>bits</replaceable></literal></term>
260
<term><option>--sublength
261
<replaceable>BITS</replaceable></option></term>
263
<replaceable>BITS</replaceable></option></term>
271
266
Subkey length in bits. Default is 2048.
277
<term><literal>-e</literal>, <literal>--email</literal>
278
<replaceable>address</replaceable></term>
272
<term><option>--email
273
<replaceable>ADDRESS</replaceable></option></term>
275
<replaceable>ADDRESS</replaceable></option></term>
281
278
Email address of key. Default is empty.
287
<term><literal>-c</literal>, <literal>--comment</literal>
288
<replaceable>comment</replaceable></term>
284
<term><option>--comment
285
<replaceable>TEXT</replaceable></option></term>
287
<replaceable>TEXT</replaceable></option></term>
291
290
Comment field for key. The default value is
298
<term><literal>-x</literal>, <literal>--expire</literal>
299
<replaceable>time</replaceable></term>
297
<term><option>--expire
298
<replaceable>TIME</replaceable></option></term>
300
<replaceable>TIME</replaceable></option></term>
302
303
Key expire time. Default is no expiration. See
310
<term><literal>-f</literal>, <literal>--force</literal></term>
311
<term><option>--force</option></term>
312
<term><option>-f</option></term>
313
Force overwriting old keys.
315
Force overwriting old key.
318
<term><literal>-p</literal>, <literal>--password</literal
320
<term><option>--password</option></term>
321
<term><option>-p</option></term>
322
324
Prompt for a password and encrypt it with the key already
328
330
>8</manvolnum></citerefentry>. The host name or the name
329
331
specified with the <option>--name</option> option is used
330
332
for the section header. All other options are ignored,
331
and no keys are created.
333
and no key is created.
338
<term><option>--passfile
339
<replaceable>FILE</replaceable></option></term>
341
<replaceable>FILE</replaceable></option></term>
344
The same as <option>--password</option>, but read from
345
<replaceable>FILE</replaceable>, not the terminal.
338
352
<refsect1 id="overview">
339
353
<title>OVERVIEW</title>
340
354
<xi:include href="overview.xml"/>
342
356
This program is a small utility to generate new OpenPGP keys for
357
new Mandos clients, and to generate sections for inclusion in
358
<filename>clients.conf</filename> on the server.
347
362
<refsect1 id="exit_status">
348
363
<title>EXIT STATUS</title>
350
The exit status will be 0 if new keys were successfully created,
365
The exit status will be 0 if a new key (or password, if the
366
<option>--password</option> option was used) was successfully
367
created, otherwise not.
437
452
</informalexample>
455
Prompt for a password, encrypt it with the key in
456
<filename>/etc/mandos</filename> and output a section suitable
457
for <filename>clients.conf</filename>.
460
<userinput>&COMMANDNAME; --password</userinput>
465
Prompt for a password, encrypt it with the key in the
466
<filename>client-key</filename> directory and output a section
467
suitable for <filename>clients.conf</filename>.
471
<!-- do not wrap this line -->
472
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
440
478
<refsect1 id="security">
441
479
<title>SECURITY</title>
443
481
The <option>--type</option>, <option>--length</option>,
444
482
<option>--subtype</option>, and <option>--sublength</option>
445
options can be used to create keys of insufficient security. If
446
in doubt, leave them to the default values.
483
options can be used to create keys of low security. If in
484
doubt, leave them to the default values.
449
The key expire time is not guaranteed to be honored by
450
<citerefentry><refentrytitle>mandos</refentrytitle>
487
The key expire time is <emphasis>not</emphasis> guaranteed to be
488
honored by <citerefentry><refentrytitle>mandos</refentrytitle>
451
489
<manvolnum>8</manvolnum></citerefentry>.
455
493
<refsect1 id="see_also">
456
494
<title>SEE ALSO</title>
496
<citerefentry><refentrytitle>intro</refentrytitle>
497
<manvolnum>8mandos</manvolnum></citerefentry>,
458
498
<citerefentry><refentrytitle>gpg</refentrytitle>
459
499
<manvolnum>1</manvolnum></citerefentry>,
500
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
501
<manvolnum>5</manvolnum></citerefentry>,
460
502
<citerefentry><refentrytitle>mandos</refentrytitle>
461
503
<manvolnum>8</manvolnum></citerefentry>,
462
<citerefentry><refentrytitle>password-request</refentrytitle>
504
<citerefentry><refentrytitle>mandos-client</refentrytitle>
463
505
<manvolnum>8mandos</manvolnum></citerefentry>
added
removed
mandos-keygen.xml
