/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos-keygen.xml

  • Committer: Teddy Hogeborn
  • Date: 2015-07-20 03:03:33 UTC
  • mto: (237.7.594 trunk)
  • mto: This revision was merged to the branch mainline in revision 325.
  • Revision ID: teddy@recompile.se-20150720030333-203m2aeblypcsfte
Bug fix for GnuTLS 3: be compatible with old 2048-bit DSA keys.

The mandos-keygen program in Mandos version 1.6.0 and older generated
2048-bit DSA keys, and when GnuTLS uses these it has trouble
connecting using the Mandos default priority string.  This was
previously fixed in Mandos 1.6.2, but the bug reappeared when using
GnuTLS 3, so the default priority string has to change again; this
time also the Mandos client has to change its default, so now the
server and the client should use the same default priority string:

SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA:+SIGN-DSA-SHA256

* mandos (main/server_defaults): Changed default priority string.
* mandos-options.xml (/section/para[id="priority_compat"]): Removed.
  (/section/para[id="priority"]): Changed default priority string.
* mandos.conf ([DEFAULT]/priority): - '' -
* mandos.conf.xml (OPTIONS/priority): Refer to the id "priority"
                                      instead of "priority_compat".
* mandos.xml (OPTIONS/--priority): - '' -
* plugins.d/mandos-client.c (main): Changed default priority string.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-keygen.xml
1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
 
<!ENTITY VERSION "1.0">
5
4
<!ENTITY COMMANDNAME "mandos-keygen">
6
 
<!ENTITY TIMESTAMP "2008-09-20">
 
5
<!ENTITY TIMESTAMP "2014-06-22">
 
6
<!ENTITY % common SYSTEM "common.ent">
 
7
%common;
7
8
]>
8
9
 
9
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
11
12
    <title>Mandos Manual</title>
12
13
    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
13
14
    <productname>Mandos</productname>
14
 
    <productnumber>&VERSION;</productnumber>
 
15
    <productnumber>&version;</productnumber>
15
16
    <date>&TIMESTAMP;</date>
16
17
    <authorgroup>
17
18
      <author>
18
19
        <firstname>Björn</firstname>
19
20
        <surname>Påhlsson</surname>
20
21
        <address>
21
 
          <email>belorn@fukt.bsnet.se</email>
 
22
          <email>belorn@recompile.se</email>
22
23
        </address>
23
24
      </author>
24
25
      <author>
25
26
        <firstname>Teddy</firstname>
26
27
        <surname>Hogeborn</surname>
27
28
        <address>
28
 
          <email>teddy@fukt.bsnet.se</email>
 
29
          <email>teddy@recompile.se</email>
29
30
        </address>
30
31
      </author>
31
32
    </authorgroup>
32
33
    <copyright>
33
34
      <year>2008</year>
 
35
      <year>2009</year>
 
36
      <year>2011</year>
 
37
      <year>2012</year>
34
38
      <holder>Teddy Hogeborn</holder>
35
39
      <holder>Björn Påhlsson</holder>
36
40
    </copyright>
115
119
        <replaceable>TIME</replaceable></option></arg>
116
120
      </group>
117
121
      <sbr/>
118
 
      <arg><option>--force</option></arg>
 
122
      <group>
 
123
        <arg choice="plain"><option>--force</option></arg>
 
124
        <arg choice="plain"><option>-f</option></arg>
 
125
      </group>
119
126
    </cmdsynopsis>
120
127
    <cmdsynopsis>
121
128
      <command>&COMMANDNAME;</command>
141
148
        <arg choice="plain"><option>-n
142
149
        <replaceable>NAME</replaceable></option></arg>
143
150
      </group>
 
151
      <group>
 
152
        <arg choice="plain"><option>--no-ssh</option></arg>
 
153
        <arg choice="plain"><option>-S</option></arg>
 
154
      </group>
144
155
    </cmdsynopsis>
145
156
    <cmdsynopsis>
146
157
      <command>&COMMANDNAME;</command>
211
222
        <listitem>
212
223
          <para>
213
224
            Target directory for key files.  Default is
214
 
            <filename>/etc/mandos</filename>.
 
225
            <filename class="directory">/etc/mandos</filename>.
215
226
          </para>
216
227
        </listitem>
217
228
      </varlistentry>
223
234
        <replaceable>TYPE</replaceable></option></term>
224
235
        <listitem>
225
236
          <para>
226
 
            Key type.  Default is <quote>DSA</quote>.
 
237
            Key type.  Default is <quote>RSA</quote>.
227
238
          </para>
228
239
        </listitem>
229
240
      </varlistentry>
235
246
        <replaceable>BITS</replaceable></option></term>
236
247
        <listitem>
237
248
          <para>
238
 
            Key length in bits.  Default is 2048.
 
249
            Key length in bits.  Default is 4096.
239
250
          </para>
240
251
        </listitem>
241
252
      </varlistentry>
247
258
        <replaceable>KEYTYPE</replaceable></option></term>
248
259
        <listitem>
249
260
          <para>
250
 
            Subkey type.  Default is <quote>ELG-E</quote> (Elgamal
 
261
            Subkey type.  Default is <quote>RSA</quote> (Elgamal
251
262
            encryption-only).
252
263
          </para>
253
264
        </listitem>
260
271
        <replaceable>BITS</replaceable></option></term>
261
272
        <listitem>
262
273
          <para>
263
 
            Subkey length in bits.  Default is 2048.
 
274
            Subkey length in bits.  Default is 4096.
264
275
          </para>
265
276
        </listitem>
266
277
      </varlistentry>
284
295
        <replaceable>TEXT</replaceable></option></term>
285
296
        <listitem>
286
297
          <para>
287
 
            Comment field for key.  The default value is
288
 
            <quote><literal>Mandos client key</literal></quote>.
 
298
            Comment field for key.  Default is empty.
289
299
          </para>
290
300
        </listitem>
291
301
      </varlistentry>
343
353
          </para>
344
354
        </listitem>
345
355
      </varlistentry>
 
356
      <varlistentry>
 
357
        <term><option>--no-ssh</option></term>
 
358
        <term><option>-S</option></term>
 
359
        <listitem>
 
360
          <para>
 
361
            When <option>--password</option> or
 
362
            <option>--passfile</option> is given, this option will
 
363
            prevent <command>&COMMANDNAME;</command> from calling
 
364
            <command>ssh-keyscan</command> to get an SSH fingerprint
 
365
            for this host and, if successful, output suitable config
 
366
            options to use this fingerprint as a
 
367
            <option>checker</option> option in the output.  This is
 
368
            otherwise the default behavior.
 
369
          </para>
 
370
        </listitem>
 
371
      </varlistentry>
346
372
    </variablelist>
347
373
  </refsect1>
348
374
  
381
407
    </variablelist>
382
408
  </refsect1>
383
409
  
384
 
  <refsect1 id="file">
 
410
  <refsect1 id="files">
385
411
    <title>FILES</title>
386
412
    <para>
387
413
      Use the <option>--dir</option> option to change where
408
434
        </listitem>
409
435
      </varlistentry>
410
436
      <varlistentry>
411
 
        <term><filename>/tmp</filename></term>
 
437
        <term><filename class="directory">/tmp</filename></term>
412
438
        <listitem>
413
439
          <para>
414
440
            Temporary files will be written here if
449
475
    </informalexample>
450
476
    <informalexample>
451
477
      <para>
452
 
        Prompt for a password, encrypt it with the key in
453
 
        <filename>/etc/mandos</filename> and output a section suitable
454
 
        for <filename>clients.conf</filename>.
 
478
        Prompt for a password, encrypt it with the key in <filename
 
479
        class="directory">/etc/mandos</filename> and output a section
 
480
        suitable for <filename>clients.conf</filename>.
455
481
      </para>
456
482
      <para>
457
483
        <userinput>&COMMANDNAME; --password</userinput>
490
516
  <refsect1 id="see_also">
491
517
    <title>SEE ALSO</title>
492
518
    <para>
 
519
      <citerefentry><refentrytitle>intro</refentrytitle>
 
520
      <manvolnum>8mandos</manvolnum></citerefentry>,
493
521
      <citerefentry><refentrytitle>gpg</refentrytitle>
494
522
      <manvolnum>1</manvolnum></citerefentry>,
495
523
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
497
525
      <citerefentry><refentrytitle>mandos</refentrytitle>
498
526
      <manvolnum>8</manvolnum></citerefentry>,
499
527
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
500
 
      <manvolnum>8mandos</manvolnum></citerefentry>
 
528
      <manvolnum>8mandos</manvolnum></citerefentry>,
 
529
      <citerefentry><refentrytitle>ssh-keyscan</refentrytitle>
 
530
      <manvolnum>1</manvolnum></citerefentry>
501
531
    </para>
502
532
  </refsect1>
503
533