/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos-keygen.xml

  • Committer: Teddy Hogeborn
  • Date: 2015-03-10 18:03:38 UTC
  • mto: (237.7.304 trunk)
  • mto: This revision was merged to the branch mainline in revision 325.
  • Revision ID: teddy@recompile.se-20150310180338-pcxw6r2qmw9k6br9
Add ":!RSA" to GnuTLS priority string, to disallow non-DHE kx.

If Mandos was somehow made to use a non-ephemeral Diffie-Hellman key
exchange algorithm in the TLS handshake, any saved network traffic
could then be decrypted later if the Mandos client key was obtained.
By default, Mandos uses ephemeral DH key exchanges which does not have
this problem, but a non-ephemeral key exchange algorithm was still
enabled by default.  The simplest solution is to simply turn that off,
which ensures that Mandos will always use ephemeral DH key exchanges.

There is a "PFS" priority string specifier, but we can't use it because:

1. Security-wise, it is a mix between "NORMAL" and "SECURE128" - it
   enables a lot more algorithms than "SECURE256".

2. It is only available since GnuTLS 3.2.4.

Thanks to Andreas Fischer <af@bantuX.org> for reporting this issue.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-keygen.xml
1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
 
<!ENTITY VERSION "1.0">
5
4
<!ENTITY COMMANDNAME "mandos-keygen">
6
 
<!ENTITY TIMESTAMP "2008-09-20">
 
5
<!ENTITY TIMESTAMP "2014-06-22">
 
6
<!ENTITY % common SYSTEM "common.ent">
 
7
%common;
7
8
]>
8
9
 
9
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
11
12
    <title>Mandos Manual</title>
12
13
    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
13
14
    <productname>Mandos</productname>
14
 
    <productnumber>&VERSION;</productnumber>
 
15
    <productnumber>&version;</productnumber>
15
16
    <date>&TIMESTAMP;</date>
16
17
    <authorgroup>
17
18
      <author>
18
19
        <firstname>Björn</firstname>
19
20
        <surname>Påhlsson</surname>
20
21
        <address>
21
 
          <email>belorn@fukt.bsnet.se</email>
 
22
          <email>belorn@recompile.se</email>
22
23
        </address>
23
24
      </author>
24
25
      <author>
25
26
        <firstname>Teddy</firstname>
26
27
        <surname>Hogeborn</surname>
27
28
        <address>
28
 
          <email>teddy@fukt.bsnet.se</email>
 
29
          <email>teddy@recompile.se</email>
29
30
        </address>
30
31
      </author>
31
32
    </authorgroup>
32
33
    <copyright>
33
34
      <year>2008</year>
 
35
      <year>2009</year>
 
36
      <year>2011</year>
 
37
      <year>2012</year>
34
38
      <holder>Teddy Hogeborn</holder>
35
39
      <holder>Björn Påhlsson</holder>
36
40
    </copyright>
115
119
        <replaceable>TIME</replaceable></option></arg>
116
120
      </group>
117
121
      <sbr/>
118
 
      <arg><option>--force</option></arg>
 
122
      <group>
 
123
        <arg choice="plain"><option>--force</option></arg>
 
124
        <arg choice="plain"><option>-f</option></arg>
 
125
      </group>
119
126
    </cmdsynopsis>
120
127
    <cmdsynopsis>
121
128
      <command>&COMMANDNAME;</command>
141
148
        <arg choice="plain"><option>-n
142
149
        <replaceable>NAME</replaceable></option></arg>
143
150
      </group>
 
151
      <group>
 
152
        <arg choice="plain"><option>--no-ssh</option></arg>
 
153
        <arg choice="plain"><option>-S</option></arg>
 
154
      </group>
144
155
    </cmdsynopsis>
145
156
    <cmdsynopsis>
146
157
      <command>&COMMANDNAME;</command>
211
222
        <listitem>
212
223
          <para>
213
224
            Target directory for key files.  Default is
214
 
            <filename>/etc/mandos</filename>.
 
225
            <filename class="directory">/etc/mandos</filename>.
215
226
          </para>
216
227
        </listitem>
217
228
      </varlistentry>
223
234
        <replaceable>TYPE</replaceable></option></term>
224
235
        <listitem>
225
236
          <para>
226
 
            Key type.  Default is <quote>DSA</quote>.
 
237
            Key type.  Default is <quote>RSA</quote>.
227
238
          </para>
228
239
        </listitem>
229
240
      </varlistentry>
235
246
        <replaceable>BITS</replaceable></option></term>
236
247
        <listitem>
237
248
          <para>
238
 
            Key length in bits.  Default is 2048.
 
249
            Key length in bits.  Default is 4096.
239
250
          </para>
240
251
        </listitem>
241
252
      </varlistentry>
247
258
        <replaceable>KEYTYPE</replaceable></option></term>
248
259
        <listitem>
249
260
          <para>
250
 
            Subkey type.  Default is <quote>ELG-E</quote> (Elgamal
 
261
            Subkey type.  Default is <quote>RSA</quote> (Elgamal
251
262
            encryption-only).
252
263
          </para>
253
264
        </listitem>
260
271
        <replaceable>BITS</replaceable></option></term>
261
272
        <listitem>
262
273
          <para>
263
 
            Subkey length in bits.  Default is 2048.
 
274
            Subkey length in bits.  Default is 4096.
264
275
          </para>
265
276
        </listitem>
266
277
      </varlistentry>
284
295
        <replaceable>TEXT</replaceable></option></term>
285
296
        <listitem>
286
297
          <para>
287
 
            Comment field for key.  The default value is
288
 
            <quote><literal>Mandos client key</literal></quote>.
 
298
            Comment field for key.  Default is empty.
289
299
          </para>
290
300
        </listitem>
291
301
      </varlistentry>
343
353
          </para>
344
354
        </listitem>
345
355
      </varlistentry>
 
356
      <varlistentry>
 
357
        <term><option>--no-ssh</option></term>
 
358
        <term><option>-S</option></term>
 
359
        <listitem>
 
360
          <para>
 
361
            When <option>--password</option> or
 
362
            <option>--passfile</option> is given, this option will
 
363
            prevent <command>&COMMANDNAME;</command> from calling
 
364
            <command>ssh-keyscan</command> to get an SSH fingerprint
 
365
            for this host and, if successful, output suitable config
 
366
            options to use this fingerprint as a
 
367
            <option>checker</option> option in the output.  This is
 
368
            otherwise the default behavior.
 
369
          </para>
 
370
        </listitem>
 
371
      </varlistentry>
346
372
    </variablelist>
347
373
  </refsect1>
348
374
  
381
407
    </variablelist>
382
408
  </refsect1>
383
409
  
384
 
  <refsect1 id="file">
 
410
  <refsect1 id="files">
385
411
    <title>FILES</title>
386
412
    <para>
387
413
      Use the <option>--dir</option> option to change where
408
434
        </listitem>
409
435
      </varlistentry>
410
436
      <varlistentry>
411
 
        <term><filename>/tmp</filename></term>
 
437
        <term><filename class="directory">/tmp</filename></term>
412
438
        <listitem>
413
439
          <para>
414
440
            Temporary files will be written here if
449
475
    </informalexample>
450
476
    <informalexample>
451
477
      <para>
452
 
        Prompt for a password, encrypt it with the key in
453
 
        <filename>/etc/mandos</filename> and output a section suitable
454
 
        for <filename>clients.conf</filename>.
 
478
        Prompt for a password, encrypt it with the key in <filename
 
479
        class="directory">/etc/mandos</filename> and output a section
 
480
        suitable for <filename>clients.conf</filename>.
455
481
      </para>
456
482
      <para>
457
483
        <userinput>&COMMANDNAME; --password</userinput>
490
516
  <refsect1 id="see_also">
491
517
    <title>SEE ALSO</title>
492
518
    <para>
 
519
      <citerefentry><refentrytitle>intro</refentrytitle>
 
520
      <manvolnum>8mandos</manvolnum></citerefentry>,
493
521
      <citerefentry><refentrytitle>gpg</refentrytitle>
494
522
      <manvolnum>1</manvolnum></citerefentry>,
495
523
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
497
525
      <citerefentry><refentrytitle>mandos</refentrytitle>
498
526
      <manvolnum>8</manvolnum></citerefentry>,
499
527
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
500
 
      <manvolnum>8mandos</manvolnum></citerefentry>
 
528
      <manvolnum>8mandos</manvolnum></citerefentry>,
 
529
      <citerefentry><refentrytitle>ssh-keyscan</refentrytitle>
 
530
      <manvolnum>1</manvolnum></citerefentry>
501
531
    </para>
502
532
  </refsect1>
503
533