/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos-keygen.xml

  • Committer: Teddy Hogeborn
  • Date: 2013-06-23 15:13:06 UTC
  • mto: (237.7.272 trunk)
  • mto: This revision was merged to the branch mainline in revision 303.
  • Revision ID: teddy@recompile.se-20130623151306-3y4zwy76d95hcvpq
* mandos: Bug fix: Make boolean options work from the config file
          again.
          Bug fix: Make --no-ipv6 work again.
          Bug fix: Add extra magic to GnuTLS priority to make it work
          with current version of GnuTLS.
* mandos-options.xml (priority): Document new default value.
* mandos.conf (priority): - '' -
* plugins.d/mandos-client.xml (EXAMPLE): Minor grammar fix.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-keygen.xml
1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
 
<!ENTITY VERSION "1.0">
5
4
<!ENTITY COMMANDNAME "mandos-keygen">
6
 
<!ENTITY TIMESTAMP "2008-08-29">
 
5
<!ENTITY TIMESTAMP "2012-01-01">
 
6
<!ENTITY % common SYSTEM "common.ent">
 
7
%common;
7
8
]>
8
9
 
9
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
11
12
    <title>Mandos Manual</title>
12
13
    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
13
14
    <productname>Mandos</productname>
14
 
    <productnumber>&VERSION;</productnumber>
 
15
    <productnumber>&version;</productnumber>
15
16
    <date>&TIMESTAMP;</date>
16
17
    <authorgroup>
17
18
      <author>
18
19
        <firstname>Björn</firstname>
19
20
        <surname>Påhlsson</surname>
20
21
        <address>
21
 
          <email>belorn@fukt.bsnet.se</email>
 
22
          <email>belorn@recompile.se</email>
22
23
        </address>
23
24
      </author>
24
25
      <author>
25
26
        <firstname>Teddy</firstname>
26
27
        <surname>Hogeborn</surname>
27
28
        <address>
28
 
          <email>teddy@fukt.bsnet.se</email>
 
29
          <email>teddy@recompile.se</email>
29
30
        </address>
30
31
      </author>
31
32
    </authorgroup>
32
33
    <copyright>
33
34
      <year>2008</year>
 
35
      <year>2009</year>
 
36
      <year>2011</year>
 
37
      <year>2012</year>
34
38
      <holder>Teddy Hogeborn</holder>
35
39
      <holder>Björn Påhlsson</holder>
36
40
    </copyright>
37
 
    <legalnotice>
38
 
      <para>
39
 
        This manual page is free software: you can redistribute it
40
 
        and/or modify it under the terms of the GNU General Public
41
 
        License as published by the Free Software Foundation,
42
 
        either version 3 of the License, or (at your option) any
43
 
        later version.
44
 
      </para>
45
 
 
46
 
      <para>
47
 
        This manual page is distributed in the hope that it will
48
 
        be useful, but WITHOUT ANY WARRANTY; without even the
49
 
        implied warranty of MERCHANTABILITY or FITNESS FOR A
50
 
        PARTICULAR PURPOSE.  See the GNU General Public License
51
 
        for more details.
52
 
      </para>
53
 
 
54
 
      <para>
55
 
        You should have received a copy of the GNU General Public
56
 
        License along with this program; If not, see
57
 
        <ulink url="http://www.gnu.org/licenses/"/>.
58
 
      </para>
59
 
    </legalnotice>
 
41
    <xi:include href="legalnotice.xml"/>
60
42
  </refentryinfo>
61
 
 
 
43
  
62
44
  <refmeta>
63
45
    <refentrytitle>&COMMANDNAME;</refentrytitle>
64
46
    <manvolnum>8</manvolnum>
67
49
  <refnamediv>
68
50
    <refname><command>&COMMANDNAME;</command></refname>
69
51
    <refpurpose>
70
 
      Generate keys for <citerefentry><refentrytitle>password-request
71
 
      </refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
 
52
      Generate key and password for Mandos client and server.
72
53
    </refpurpose>
73
54
  </refnamediv>
74
 
 
 
55
  
75
56
  <refsynopsisdiv>
76
57
    <cmdsynopsis>
77
58
      <command>&COMMANDNAME;</command>
78
 
      <group choice="opt">
79
 
        <arg choice="plain"><option>--dir</option>
80
 
        <replaceable>directory</replaceable></arg>
81
 
      </group>
82
 
      <group choice="opt">
83
 
        <arg choice="plain"><option>--type</option>
84
 
        <replaceable>type</replaceable></arg>
85
 
      </group>
86
 
      <group choice="opt">
87
 
        <arg choice="plain"><option>--length</option>
88
 
        <replaceable>bits</replaceable></arg>
89
 
      </group>
90
 
      <group choice="opt">
91
 
        <arg choice="plain"><option>--subtype</option>
92
 
        <replaceable>type</replaceable></arg>
93
 
      </group>
94
 
      <group choice="opt">
95
 
        <arg choice="plain"><option>--sublength</option>
96
 
        <replaceable>bits</replaceable></arg>
97
 
      </group>
98
 
      <group choice="opt">
99
 
        <arg choice="plain"><option>--name</option>
100
 
        <replaceable>NAME</replaceable></arg>
101
 
      </group>
102
 
      <group choice="opt">
103
 
        <arg choice="plain"><option>--email</option>
104
 
        <replaceable>EMAIL</replaceable></arg>
105
 
      </group>
106
 
      <group choice="opt">
107
 
        <arg choice="plain"><option>--comment</option>
108
 
        <replaceable>COMMENT</replaceable></arg>
109
 
      </group>
110
 
      <group choice="opt">
111
 
        <arg choice="plain"><option>--expire</option>
112
 
        <replaceable>TIME</replaceable></arg>
113
 
      </group>
114
 
      <group choice="opt">
115
 
        <arg choice="plain"><option>--force</option></arg>
116
 
      </group>
117
 
    </cmdsynopsis>
118
 
    <cmdsynopsis>
119
 
      <command>&COMMANDNAME;</command>
120
 
      <group choice="opt">
121
 
        <arg choice="plain"><option>-d</option>
122
 
        <replaceable>directory</replaceable></arg>
123
 
      </group>
124
 
      <group choice="opt">
125
 
        <arg choice="plain"><option>-t</option>
126
 
        <replaceable>type</replaceable></arg>
127
 
      </group>
128
 
      <group choice="opt">
129
 
        <arg choice="plain"><option>-l</option>
130
 
        <replaceable>bits</replaceable></arg>
131
 
      </group>
132
 
      <group choice="opt">
133
 
        <arg choice="plain"><option>-s</option>
134
 
        <replaceable>type</replaceable></arg>
135
 
      </group>
136
 
      <group choice="opt">
137
 
        <arg choice="plain"><option>-L</option>
138
 
        <replaceable>bits</replaceable></arg>
139
 
      </group>
140
 
      <group choice="opt">
141
 
        <arg choice="plain"><option>-n</option>
142
 
        <replaceable>NAME</replaceable></arg>
143
 
      </group>
144
 
      <group choice="opt">
145
 
        <arg choice="plain"><option>-e</option>
146
 
        <replaceable>EMAIL</replaceable></arg>
147
 
      </group>
148
 
      <group choice="opt">
149
 
        <arg choice="plain"><option>-c</option>
150
 
        <replaceable>COMMENT</replaceable></arg>
151
 
      </group>
152
 
      <group choice="opt">
153
 
        <arg choice="plain"><option>-x</option>
154
 
        <replaceable>TIME</replaceable></arg>
155
 
      </group>
156
 
      <group choice="opt">
157
 
        <arg choice="plain"><option>-f</option></arg>
158
 
      </group>
 
59
      <group>
 
60
        <arg choice="plain"><option>--dir
 
61
        <replaceable>DIRECTORY</replaceable></option></arg>
 
62
        <arg choice="plain"><option>-d
 
63
        <replaceable>DIRECTORY</replaceable></option></arg>
 
64
      </group>
 
65
      <sbr/>
 
66
      <group>
 
67
        <arg choice="plain"><option>--type
 
68
        <replaceable>KEYTYPE</replaceable></option></arg>
 
69
        <arg choice="plain"><option>-t
 
70
        <replaceable>KEYTYPE</replaceable></option></arg>
 
71
      </group>
 
72
      <sbr/>
 
73
      <group>
 
74
        <arg choice="plain"><option>--length
 
75
        <replaceable>BITS</replaceable></option></arg>
 
76
        <arg choice="plain"><option>-l
 
77
        <replaceable>BITS</replaceable></option></arg>
 
78
      </group>
 
79
      <sbr/>
 
80
      <group>
 
81
        <arg choice="plain"><option>--subtype
 
82
        <replaceable>KEYTYPE</replaceable></option></arg>
 
83
        <arg choice="plain"><option>-s
 
84
        <replaceable>KEYTYPE</replaceable></option></arg>
 
85
      </group>
 
86
      <sbr/>
 
87
      <group>
 
88
        <arg choice="plain"><option>--sublength
 
89
        <replaceable>BITS</replaceable></option></arg>
 
90
        <arg choice="plain"><option>-L
 
91
        <replaceable>BITS</replaceable></option></arg>
 
92
      </group>
 
93
      <sbr/>
 
94
      <group>
 
95
        <arg choice="plain"><option>--name
 
96
        <replaceable>NAME</replaceable></option></arg>
 
97
        <arg choice="plain"><option>-n
 
98
        <replaceable>NAME</replaceable></option></arg>
 
99
      </group>
 
100
      <sbr/>
 
101
      <group>
 
102
        <arg choice="plain"><option>--email
 
103
        <replaceable>ADDRESS</replaceable></option></arg>
 
104
        <arg choice="plain"><option>-e
 
105
        <replaceable>ADDRESS</replaceable></option></arg>
 
106
      </group>
 
107
      <sbr/>
 
108
      <group>
 
109
        <arg choice="plain"><option>--comment
 
110
        <replaceable>TEXT</replaceable></option></arg>
 
111
        <arg choice="plain"><option>-c
 
112
        <replaceable>TEXT</replaceable></option></arg>
 
113
      </group>
 
114
      <sbr/>
 
115
      <group>
 
116
        <arg choice="plain"><option>--expire
 
117
        <replaceable>TIME</replaceable></option></arg>
 
118
        <arg choice="plain"><option>-x
 
119
        <replaceable>TIME</replaceable></option></arg>
 
120
      </group>
 
121
      <sbr/>
 
122
      <arg><option>--force</option></arg>
159
123
    </cmdsynopsis>
160
124
    <cmdsynopsis>
161
125
      <command>&COMMANDNAME;</command>
162
126
      <group choice="req">
 
127
        <arg choice="plain"><option>--password</option></arg>
163
128
        <arg choice="plain"><option>-p</option></arg>
164
 
        <arg choice="plain"><option>--password</option></arg>
165
 
      </group>
166
 
      <group choice="opt">
167
 
        <arg choice="plain"><option>--dir</option>
168
 
        <replaceable>directory</replaceable></arg>
169
 
      </group>
170
 
      <group choice="opt">
171
 
        <arg choice="plain"><option>--name</option>
172
 
        <replaceable>NAME</replaceable></arg>
 
129
        <arg choice="plain"><option>--passfile
 
130
        <replaceable>FILE</replaceable></option></arg>
 
131
        <arg choice="plain"><option>-F</option>
 
132
        <replaceable>FILE</replaceable></arg>
 
133
      </group>
 
134
      <sbr/>
 
135
      <group>
 
136
        <arg choice="plain"><option>--dir
 
137
        <replaceable>DIRECTORY</replaceable></option></arg>
 
138
        <arg choice="plain"><option>-d
 
139
        <replaceable>DIRECTORY</replaceable></option></arg>
 
140
      </group>
 
141
      <sbr/>
 
142
      <group>
 
143
        <arg choice="plain"><option>--name
 
144
        <replaceable>NAME</replaceable></option></arg>
 
145
        <arg choice="plain"><option>-n
 
146
        <replaceable>NAME</replaceable></option></arg>
173
147
      </group>
174
148
    </cmdsynopsis>
175
149
    <cmdsynopsis>
176
150
      <command>&COMMANDNAME;</command>
177
151
      <group choice="req">
 
152
        <arg choice="plain"><option>--help</option></arg>
178
153
        <arg choice="plain"><option>-h</option></arg>
179
 
        <arg choice="plain"><option>--help</option></arg>
180
154
      </group>
181
155
    </cmdsynopsis>
182
156
    <cmdsynopsis>
183
157
      <command>&COMMANDNAME;</command>
184
158
      <group choice="req">
 
159
        <arg choice="plain"><option>--version</option></arg>
185
160
        <arg choice="plain"><option>-v</option></arg>
186
 
        <arg choice="plain"><option>--version</option></arg>
187
161
      </group>
188
162
    </cmdsynopsis>
189
163
  </refsynopsisdiv>
190
 
 
 
164
  
191
165
  <refsect1 id="description">
192
166
    <title>DESCRIPTION</title>
193
167
    <para>
194
168
      <command>&COMMANDNAME;</command> is a program to generate the
195
 
      OpenPGP keys used by
196
 
      <citerefentry><refentrytitle>password-request</refentrytitle>
197
 
      <manvolnum>8mandos</manvolnum></citerefentry>.  The keys are
 
169
      OpenPGP key used by
 
170
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
 
171
      <manvolnum>8mandos</manvolnum></citerefentry>.  The key is
198
172
      normally written to /etc/mandos for later installation into the
199
 
      initrd image, but this, like most things, can be changed with
200
 
      command line options.
 
173
      initrd image, but this, and most other things, can be changed
 
174
      with command line options.
201
175
    </para>
202
176
    <para>
203
 
      It can also be used to generate ready-made sections for
 
177
      This program can also be used with the
 
178
      <option>--password</option> or <option>--passfile</option>
 
179
      options to generate a ready-made section for
 
180
      <filename>clients.conf</filename> (see
204
181
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
205
 
      <manvolnum>5</manvolnum></citerefentry> using the
206
 
      <option>--password</option> option.
 
182
      <manvolnum>5</manvolnum></citerefentry>).
207
183
    </para>
208
184
  </refsect1>
209
185
  
210
186
  <refsect1 id="purpose">
211
187
    <title>PURPOSE</title>
212
 
 
213
188
    <para>
214
189
      The purpose of this is to enable <emphasis>remote and unattended
215
190
      rebooting</emphasis> of client host computer with an
216
191
      <emphasis>encrypted root file system</emphasis>.  See <xref
217
192
      linkend="overview"/> for details.
218
193
    </para>
219
 
 
220
194
  </refsect1>
221
195
  
222
196
  <refsect1 id="options">
223
197
    <title>OPTIONS</title>
224
 
 
 
198
    
225
199
    <variablelist>
226
200
      <varlistentry>
227
 
        <term><literal>-h</literal>, <literal>--help</literal></term>
 
201
        <term><option>--help</option></term>
 
202
        <term><option>-h</option></term>
228
203
        <listitem>
229
204
          <para>
230
205
            Show a help message and exit
231
206
          </para>
232
207
        </listitem>
233
208
      </varlistentry>
234
 
 
 
209
      
235
210
      <varlistentry>
236
 
        <term><literal>-d</literal>, <literal>--dir
237
 
        <replaceable>directory</replaceable></literal></term>
 
211
        <term><option>--dir
 
212
        <replaceable>DIRECTORY</replaceable></option></term>
 
213
        <term><option>-d
 
214
        <replaceable>DIRECTORY</replaceable></option></term>
238
215
        <listitem>
239
216
          <para>
240
217
            Target directory for key files.  Default is
241
 
            <filename>/etc/mandos</filename>.
 
218
            <filename class="directory">/etc/mandos</filename>.
242
219
          </para>
243
220
        </listitem>
244
221
      </varlistentry>
245
 
 
 
222
      
246
223
      <varlistentry>
247
 
        <term><literal>-t</literal>, <literal>--type
248
 
        <replaceable>type</replaceable></literal></term>
 
224
        <term><option>--type
 
225
        <replaceable>TYPE</replaceable></option></term>
 
226
        <term><option>-t
 
227
        <replaceable>TYPE</replaceable></option></term>
249
228
        <listitem>
250
229
          <para>
251
230
            Key type.  Default is <quote>DSA</quote>.
252
231
          </para>
253
232
        </listitem>
254
233
      </varlistentry>
255
 
 
 
234
      
256
235
      <varlistentry>
257
 
        <term><literal>-l</literal>, <literal>--length
258
 
        <replaceable>bits</replaceable></literal></term>
 
236
        <term><option>--length
 
237
        <replaceable>BITS</replaceable></option></term>
 
238
        <term><option>-l
 
239
        <replaceable>BITS</replaceable></option></term>
259
240
        <listitem>
260
241
          <para>
261
242
            Key length in bits.  Default is 2048.
262
243
          </para>
263
244
        </listitem>
264
245
      </varlistentry>
265
 
 
 
246
      
266
247
      <varlistentry>
267
 
        <term><literal>-s</literal>, <literal>--subtype
268
 
        <replaceable>type</replaceable></literal></term>
 
248
        <term><option>--subtype
 
249
        <replaceable>KEYTYPE</replaceable></option></term>
 
250
        <term><option>-s
 
251
        <replaceable>KEYTYPE</replaceable></option></term>
269
252
        <listitem>
270
253
          <para>
271
254
            Subkey type.  Default is <quote>ELG-E</quote> (Elgamal
273
256
          </para>
274
257
        </listitem>
275
258
      </varlistentry>
276
 
 
 
259
      
277
260
      <varlistentry>
278
 
        <term><literal>-L</literal>, <literal>--sublength
279
 
        <replaceable>bits</replaceable></literal></term>
 
261
        <term><option>--sublength
 
262
        <replaceable>BITS</replaceable></option></term>
 
263
        <term><option>-L
 
264
        <replaceable>BITS</replaceable></option></term>
280
265
        <listitem>
281
266
          <para>
282
267
            Subkey length in bits.  Default is 2048.
283
268
          </para>
284
269
        </listitem>
285
270
      </varlistentry>
286
 
 
 
271
      
287
272
      <varlistentry>
288
 
        <term><literal>-e</literal>, <literal>--email</literal>
289
 
        <replaceable>address</replaceable></term>
 
273
        <term><option>--email
 
274
        <replaceable>ADDRESS</replaceable></option></term>
 
275
        <term><option>-e
 
276
        <replaceable>ADDRESS</replaceable></option></term>
290
277
        <listitem>
291
278
          <para>
292
279
            Email address of key.  Default is empty.
293
280
          </para>
294
281
        </listitem>
295
282
      </varlistentry>
296
 
 
 
283
      
297
284
      <varlistentry>
298
 
        <term><literal>-c</literal>, <literal>--comment</literal>
299
 
        <replaceable>comment</replaceable></term>
 
285
        <term><option>--comment
 
286
        <replaceable>TEXT</replaceable></option></term>
 
287
        <term><option>-c
 
288
        <replaceable>TEXT</replaceable></option></term>
300
289
        <listitem>
301
290
          <para>
302
291
            Comment field for key.  The default value is
304
293
          </para>
305
294
        </listitem>
306
295
      </varlistentry>
307
 
 
 
296
      
308
297
      <varlistentry>
309
 
        <term><literal>-x</literal>, <literal>--expire</literal>
310
 
        <replaceable>time</replaceable></term>
 
298
        <term><option>--expire
 
299
        <replaceable>TIME</replaceable></option></term>
 
300
        <term><option>-x
 
301
        <replaceable>TIME</replaceable></option></term>
311
302
        <listitem>
312
303
          <para>
313
304
            Key expire time.  Default is no expiration.  See
316
307
          </para>
317
308
        </listitem>
318
309
      </varlistentry>
319
 
 
 
310
      
320
311
      <varlistentry>
321
 
        <term><literal>-f</literal>, <literal>--force</literal></term>
 
312
        <term><option>--force</option></term>
 
313
        <term><option>-f</option></term>
322
314
        <listitem>
323
315
          <para>
324
 
            Force overwriting old keys.
 
316
            Force overwriting old key.
325
317
          </para>
326
318
        </listitem>
327
319
      </varlistentry>
328
320
      <varlistentry>
329
 
        <term><literal>-p</literal>, <literal>--password</literal
330
 
        ></term>
 
321
        <term><option>--password</option></term>
 
322
        <term><option>-p</option></term>
331
323
        <listitem>
332
324
          <para>
333
325
            Prompt for a password and encrypt it with the key already
339
331
            >8</manvolnum></citerefentry>.  The host name or the name
340
332
            specified with the <option>--name</option> option is used
341
333
            for the section header.  All other options are ignored,
342
 
            and no keys are created.
 
334
            and no key is created.
 
335
          </para>
 
336
        </listitem>
 
337
      </varlistentry>
 
338
      <varlistentry>
 
339
        <term><option>--passfile
 
340
        <replaceable>FILE</replaceable></option></term>
 
341
        <term><option>-F
 
342
        <replaceable>FILE</replaceable></option></term>
 
343
        <listitem>
 
344
          <para>
 
345
            The same as <option>--password</option>, but read from
 
346
            <replaceable>FILE</replaceable>, not the terminal.
343
347
          </para>
344
348
        </listitem>
345
349
      </varlistentry>
346
350
    </variablelist>
347
351
  </refsect1>
348
 
 
 
352
  
349
353
  <refsect1 id="overview">
350
354
    <title>OVERVIEW</title>
351
355
    <xi:include href="overview.xml"/>
352
356
    <para>
353
357
      This program is a small utility to generate new OpenPGP keys for
354
 
      new Mandos clients.
 
358
      new Mandos clients, and to generate sections for inclusion in
 
359
      <filename>clients.conf</filename> on the server.
355
360
    </para>
356
361
  </refsect1>
357
 
 
 
362
  
358
363
  <refsect1 id="exit_status">
359
364
    <title>EXIT STATUS</title>
360
365
    <para>
361
 
      The exit status will be 0 if new keys were successfully created,
362
 
      otherwise not.
 
366
      The exit status will be 0 if a new key (or password, if the
 
367
      <option>--password</option> option was used) was successfully
 
368
      created, otherwise not.
363
369
    </para>
364
370
  </refsect1>
365
371
  
367
373
    <title>ENVIRONMENT</title>
368
374
    <variablelist>
369
375
      <varlistentry>
370
 
        <term><varname>TMPDIR</varname></term>
 
376
        <term><envar>TMPDIR</envar></term>
371
377
        <listitem>
372
378
          <para>
373
379
            If set, temporary files will be created here. See
379
385
    </variablelist>
380
386
  </refsect1>
381
387
  
382
 
  <refsect1 id="file">
 
388
  <refsect1 id="files">
383
389
    <title>FILES</title>
384
390
    <para>
385
391
      Use the <option>--dir</option> option to change where
406
412
        </listitem>
407
413
      </varlistentry>
408
414
      <varlistentry>
409
 
        <term><filename>/tmp</filename></term>
 
415
        <term><filename class="directory">/tmp</filename></term>
410
416
        <listitem>
411
417
          <para>
412
418
            Temporary files will be written here if
416
422
      </varlistentry>
417
423
    </variablelist>
418
424
  </refsect1>
419
 
 
420
 
  <refsect1 id="bugs">
421
 
    <title>BUGS</title>
422
 
    <para>
423
 
      None are known at this time.
424
 
    </para>
425
 
  </refsect1>
426
 
 
 
425
  
 
426
<!--   <refsect1 id="bugs"> -->
 
427
<!--     <title>BUGS</title> -->
 
428
<!--     <para> -->
 
429
<!--     </para> -->
 
430
<!--   </refsect1> -->
 
431
  
427
432
  <refsect1 id="example">
428
433
    <title>EXAMPLE</title>
429
434
    <informalexample>
436
441
    </informalexample>
437
442
    <informalexample>
438
443
      <para>
439
 
        Create keys in another directory and of another type.  Force
 
444
        Create key in another directory and of another type.  Force
440
445
        overwriting old key files:
441
446
      </para>
442
447
      <para>
446
451
 
447
452
      </para>
448
453
    </informalexample>
 
454
    <informalexample>
 
455
      <para>
 
456
        Prompt for a password, encrypt it with the key in <filename
 
457
        class="directory">/etc/mandos</filename> and output a section
 
458
        suitable for <filename>clients.conf</filename>.
 
459
      </para>
 
460
      <para>
 
461
        <userinput>&COMMANDNAME; --password</userinput>
 
462
      </para>
 
463
    </informalexample>
 
464
    <informalexample>
 
465
      <para>
 
466
        Prompt for a password, encrypt it with the key in the
 
467
        <filename>client-key</filename> directory and output a section
 
468
        suitable for <filename>clients.conf</filename>.
 
469
      </para>
 
470
      <para>
 
471
 
 
472
<!-- do not wrap this line -->
 
473
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
 
474
 
 
475
      </para>
 
476
    </informalexample>
449
477
  </refsect1>
450
 
 
 
478
  
451
479
  <refsect1 id="security">
452
480
    <title>SECURITY</title>
453
481
    <para>
454
482
      The <option>--type</option>, <option>--length</option>,
455
483
      <option>--subtype</option>, and <option>--sublength</option>
456
 
      options can be used to create keys of insufficient security.  If
457
 
      in doubt, leave them to the default values.
 
484
      options can be used to create keys of low security.  If in
 
485
      doubt, leave them to the default values.
458
486
    </para>
459
487
    <para>
460
 
      The key expire time is not guaranteed to be honored by
461
 
      <citerefentry><refentrytitle>mandos</refentrytitle>
 
488
      The key expire time is <emphasis>not</emphasis> guaranteed to be
 
489
      honored by <citerefentry><refentrytitle>mandos</refentrytitle>
462
490
      <manvolnum>8</manvolnum></citerefentry>.
463
491
    </para>
464
492
  </refsect1>
465
 
 
 
493
  
466
494
  <refsect1 id="see_also">
467
495
    <title>SEE ALSO</title>
468
496
    <para>
 
497
      <citerefentry><refentrytitle>intro</refentrytitle>
 
498
      <manvolnum>8mandos</manvolnum></citerefentry>,
469
499
      <citerefentry><refentrytitle>gpg</refentrytitle>
470
500
      <manvolnum>1</manvolnum></citerefentry>,
 
501
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
 
502
      <manvolnum>5</manvolnum></citerefentry>,
471
503
      <citerefentry><refentrytitle>mandos</refentrytitle>
472
504
      <manvolnum>8</manvolnum></citerefentry>,
473
 
      <citerefentry><refentrytitle>password-request</refentrytitle>
 
505
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
474
506
      <manvolnum>8mandos</manvolnum></citerefentry>
475
507
    </para>
476
508
  </refsect1>