/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos-keygen.xml

  • Committer: Teddy Hogeborn
  • Date: 2015-07-27 09:23:56 UTC
  • mto: (237.7.594 trunk)
  • mto: This revision was merged to the branch mainline in revision 325.
  • Revision ID: teddy@recompile.se-20150727092356-65ul6jsiozlkjw4e
Debian bug fix for mandos-client: Remove dhparams.pem on purge.

* debian/mandos-client.postrm (purge): Bug fix: Remove dhparams.pem.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-keygen.xml
1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
 
<!ENTITY VERSION "1.0">
5
4
<!ENTITY COMMANDNAME "mandos-keygen">
6
 
<!ENTITY TIMESTAMP "2008-08-29">
 
5
<!ENTITY TIMESTAMP "2015-07-20">
 
6
<!ENTITY % common SYSTEM "common.ent">
 
7
%common;
7
8
]>
8
9
 
9
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
11
12
    <title>Mandos Manual</title>
12
13
    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
13
14
    <productname>Mandos</productname>
14
 
    <productnumber>&VERSION;</productnumber>
 
15
    <productnumber>&version;</productnumber>
15
16
    <date>&TIMESTAMP;</date>
16
17
    <authorgroup>
17
18
      <author>
18
19
        <firstname>Björn</firstname>
19
20
        <surname>Påhlsson</surname>
20
21
        <address>
21
 
          <email>belorn@fukt.bsnet.se</email>
 
22
          <email>belorn@recompile.se</email>
22
23
        </address>
23
24
      </author>
24
25
      <author>
25
26
        <firstname>Teddy</firstname>
26
27
        <surname>Hogeborn</surname>
27
28
        <address>
28
 
          <email>teddy@fukt.bsnet.se</email>
 
29
          <email>teddy@recompile.se</email>
29
30
        </address>
30
31
      </author>
31
32
    </authorgroup>
32
33
    <copyright>
33
34
      <year>2008</year>
 
35
      <year>2009</year>
 
36
      <year>2010</year>
 
37
      <year>2011</year>
 
38
      <year>2012</year>
 
39
      <year>2013</year>
 
40
      <year>2014</year>
 
41
      <year>2015</year>
34
42
      <holder>Teddy Hogeborn</holder>
35
43
      <holder>Björn Påhlsson</holder>
36
44
    </copyright>
37
 
    <legalnotice>
38
 
      <para>
39
 
        This manual page is free software: you can redistribute it
40
 
        and/or modify it under the terms of the GNU General Public
41
 
        License as published by the Free Software Foundation,
42
 
        either version 3 of the License, or (at your option) any
43
 
        later version.
44
 
      </para>
45
 
 
46
 
      <para>
47
 
        This manual page is distributed in the hope that it will
48
 
        be useful, but WITHOUT ANY WARRANTY; without even the
49
 
        implied warranty of MERCHANTABILITY or FITNESS FOR A
50
 
        PARTICULAR PURPOSE.  See the GNU General Public License
51
 
        for more details.
52
 
      </para>
53
 
 
54
 
      <para>
55
 
        You should have received a copy of the GNU General Public
56
 
        License along with this program; If not, see
57
 
        <ulink url="http://www.gnu.org/licenses/"/>.
58
 
      </para>
59
 
    </legalnotice>
 
45
    <xi:include href="legalnotice.xml"/>
60
46
  </refentryinfo>
61
 
 
 
47
  
62
48
  <refmeta>
63
49
    <refentrytitle>&COMMANDNAME;</refentrytitle>
64
50
    <manvolnum>8</manvolnum>
67
53
  <refnamediv>
68
54
    <refname><command>&COMMANDNAME;</command></refname>
69
55
    <refpurpose>
70
 
      Generate keys for <citerefentry><refentrytitle>password-request
71
 
      </refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
 
56
      Generate key and password for Mandos client and server.
72
57
    </refpurpose>
73
58
  </refnamediv>
74
 
 
 
59
  
75
60
  <refsynopsisdiv>
76
61
    <cmdsynopsis>
77
62
      <command>&COMMANDNAME;</command>
78
 
      <group choice="opt">
79
 
        <arg choice="plain"><option>--dir</option>
80
 
        <replaceable>directory</replaceable></arg>
81
 
      </group>
82
 
      <group choice="opt">
83
 
        <arg choice="plain"><option>--type</option>
84
 
        <replaceable>type</replaceable></arg>
85
 
      </group>
86
 
      <group choice="opt">
87
 
        <arg choice="plain"><option>--length</option>
88
 
        <replaceable>bits</replaceable></arg>
89
 
      </group>
90
 
      <group choice="opt">
91
 
        <arg choice="plain"><option>--subtype</option>
92
 
        <replaceable>type</replaceable></arg>
93
 
      </group>
94
 
      <group choice="opt">
95
 
        <arg choice="plain"><option>--sublength</option>
96
 
        <replaceable>bits</replaceable></arg>
97
 
      </group>
98
 
      <group choice="opt">
99
 
        <arg choice="plain"><option>--name</option>
100
 
        <replaceable>NAME</replaceable></arg>
101
 
      </group>
102
 
      <group choice="opt">
103
 
        <arg choice="plain"><option>--email</option>
104
 
        <replaceable>EMAIL</replaceable></arg>
105
 
      </group>
106
 
      <group choice="opt">
107
 
        <arg choice="plain"><option>--comment</option>
108
 
        <replaceable>COMMENT</replaceable></arg>
109
 
      </group>
110
 
      <group choice="opt">
111
 
        <arg choice="plain"><option>--expire</option>
112
 
        <replaceable>TIME</replaceable></arg>
113
 
      </group>
114
 
      <group choice="opt">
 
63
      <group>
 
64
        <arg choice="plain"><option>--dir
 
65
        <replaceable>DIRECTORY</replaceable></option></arg>
 
66
        <arg choice="plain"><option>-d
 
67
        <replaceable>DIRECTORY</replaceable></option></arg>
 
68
      </group>
 
69
      <sbr/>
 
70
      <group>
 
71
        <arg choice="plain"><option>--type
 
72
        <replaceable>KEYTYPE</replaceable></option></arg>
 
73
        <arg choice="plain"><option>-t
 
74
        <replaceable>KEYTYPE</replaceable></option></arg>
 
75
      </group>
 
76
      <sbr/>
 
77
      <group>
 
78
        <arg choice="plain"><option>--length
 
79
        <replaceable>BITS</replaceable></option></arg>
 
80
        <arg choice="plain"><option>-l
 
81
        <replaceable>BITS</replaceable></option></arg>
 
82
      </group>
 
83
      <sbr/>
 
84
      <group>
 
85
        <arg choice="plain"><option>--subtype
 
86
        <replaceable>KEYTYPE</replaceable></option></arg>
 
87
        <arg choice="plain"><option>-s
 
88
        <replaceable>KEYTYPE</replaceable></option></arg>
 
89
      </group>
 
90
      <sbr/>
 
91
      <group>
 
92
        <arg choice="plain"><option>--sublength
 
93
        <replaceable>BITS</replaceable></option></arg>
 
94
        <arg choice="plain"><option>-L
 
95
        <replaceable>BITS</replaceable></option></arg>
 
96
      </group>
 
97
      <sbr/>
 
98
      <group>
 
99
        <arg choice="plain"><option>--name
 
100
        <replaceable>NAME</replaceable></option></arg>
 
101
        <arg choice="plain"><option>-n
 
102
        <replaceable>NAME</replaceable></option></arg>
 
103
      </group>
 
104
      <sbr/>
 
105
      <group>
 
106
        <arg choice="plain"><option>--email
 
107
        <replaceable>ADDRESS</replaceable></option></arg>
 
108
        <arg choice="plain"><option>-e
 
109
        <replaceable>ADDRESS</replaceable></option></arg>
 
110
      </group>
 
111
      <sbr/>
 
112
      <group>
 
113
        <arg choice="plain"><option>--comment
 
114
        <replaceable>TEXT</replaceable></option></arg>
 
115
        <arg choice="plain"><option>-c
 
116
        <replaceable>TEXT</replaceable></option></arg>
 
117
      </group>
 
118
      <sbr/>
 
119
      <group>
 
120
        <arg choice="plain"><option>--expire
 
121
        <replaceable>TIME</replaceable></option></arg>
 
122
        <arg choice="plain"><option>-x
 
123
        <replaceable>TIME</replaceable></option></arg>
 
124
      </group>
 
125
      <sbr/>
 
126
      <group>
115
127
        <arg choice="plain"><option>--force</option></arg>
116
 
      </group>
117
 
    </cmdsynopsis>
118
 
    <cmdsynopsis>
119
 
      <command>&COMMANDNAME;</command>
120
 
      <group choice="opt">
121
 
        <arg choice="plain"><option>-d</option>
122
 
        <replaceable>directory</replaceable></arg>
123
 
      </group>
124
 
      <group choice="opt">
125
 
        <arg choice="plain"><option>-t</option>
126
 
        <replaceable>type</replaceable></arg>
127
 
      </group>
128
 
      <group choice="opt">
129
 
        <arg choice="plain"><option>-l</option>
130
 
        <replaceable>bits</replaceable></arg>
131
 
      </group>
132
 
      <group choice="opt">
133
 
        <arg choice="plain"><option>-s</option>
134
 
        <replaceable>type</replaceable></arg>
135
 
      </group>
136
 
      <group choice="opt">
137
 
        <arg choice="plain"><option>-L</option>
138
 
        <replaceable>bits</replaceable></arg>
139
 
      </group>
140
 
      <group choice="opt">
141
 
        <arg choice="plain"><option>-n</option>
142
 
        <replaceable>NAME</replaceable></arg>
143
 
      </group>
144
 
      <group choice="opt">
145
 
        <arg choice="plain"><option>-e</option>
146
 
        <replaceable>EMAIL</replaceable></arg>
147
 
      </group>
148
 
      <group choice="opt">
149
 
        <arg choice="plain"><option>-c</option>
150
 
        <replaceable>COMMENT</replaceable></arg>
151
 
      </group>
152
 
      <group choice="opt">
153
 
        <arg choice="plain"><option>-x</option>
154
 
        <replaceable>TIME</replaceable></arg>
155
 
      </group>
156
 
      <group choice="opt">
157
128
        <arg choice="plain"><option>-f</option></arg>
158
129
      </group>
159
130
    </cmdsynopsis>
160
131
    <cmdsynopsis>
161
132
      <command>&COMMANDNAME;</command>
162
133
      <group choice="req">
 
134
        <arg choice="plain"><option>--password</option></arg>
163
135
        <arg choice="plain"><option>-p</option></arg>
164
 
        <arg choice="plain"><option>--password</option></arg>
165
 
      </group>
166
 
      <group choice="opt">
167
 
        <arg choice="plain"><option>--dir</option>
168
 
        <replaceable>directory</replaceable></arg>
169
 
      </group>
170
 
      <group choice="opt">
171
 
        <arg choice="plain"><option>--name</option>
172
 
        <replaceable>NAME</replaceable></arg>
 
136
        <arg choice="plain"><option>--passfile
 
137
        <replaceable>FILE</replaceable></option></arg>
 
138
        <arg choice="plain"><option>-F</option>
 
139
        <replaceable>FILE</replaceable></arg>
 
140
      </group>
 
141
      <sbr/>
 
142
      <group>
 
143
        <arg choice="plain"><option>--dir
 
144
        <replaceable>DIRECTORY</replaceable></option></arg>
 
145
        <arg choice="plain"><option>-d
 
146
        <replaceable>DIRECTORY</replaceable></option></arg>
 
147
      </group>
 
148
      <sbr/>
 
149
      <group>
 
150
        <arg choice="plain"><option>--name
 
151
        <replaceable>NAME</replaceable></option></arg>
 
152
        <arg choice="plain"><option>-n
 
153
        <replaceable>NAME</replaceable></option></arg>
 
154
      </group>
 
155
      <group>
 
156
        <arg choice="plain"><option>--no-ssh</option></arg>
 
157
        <arg choice="plain"><option>-S</option></arg>
173
158
      </group>
174
159
    </cmdsynopsis>
175
160
    <cmdsynopsis>
176
161
      <command>&COMMANDNAME;</command>
177
162
      <group choice="req">
 
163
        <arg choice="plain"><option>--help</option></arg>
178
164
        <arg choice="plain"><option>-h</option></arg>
179
 
        <arg choice="plain"><option>--help</option></arg>
180
165
      </group>
181
166
    </cmdsynopsis>
182
167
    <cmdsynopsis>
183
168
      <command>&COMMANDNAME;</command>
184
169
      <group choice="req">
 
170
        <arg choice="plain"><option>--version</option></arg>
185
171
        <arg choice="plain"><option>-v</option></arg>
186
 
        <arg choice="plain"><option>--version</option></arg>
187
172
      </group>
188
173
    </cmdsynopsis>
189
174
  </refsynopsisdiv>
190
 
 
 
175
  
191
176
  <refsect1 id="description">
192
177
    <title>DESCRIPTION</title>
193
178
    <para>
194
179
      <command>&COMMANDNAME;</command> is a program to generate the
195
 
      OpenPGP keys used by
196
 
      <citerefentry><refentrytitle>password-request</refentrytitle>
197
 
      <manvolnum>8mandos</manvolnum></citerefentry>.  The keys are
 
180
      OpenPGP key used by
 
181
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
 
182
      <manvolnum>8mandos</manvolnum></citerefentry>.  The key is
198
183
      normally written to /etc/mandos for later installation into the
199
 
      initrd image, but this, like most things, can be changed with
200
 
      command line options.
 
184
      initrd image, but this, and most other things, can be changed
 
185
      with command line options.
201
186
    </para>
202
187
    <para>
203
 
      It can also be used to generate ready-made sections for
 
188
      This program can also be used with the
 
189
      <option>--password</option> or <option>--passfile</option>
 
190
      options to generate a ready-made section for
 
191
      <filename>clients.conf</filename> (see
204
192
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
205
 
      <manvolnum>5</manvolnum></citerefentry> using the
206
 
      <option>--password</option> option.
 
193
      <manvolnum>5</manvolnum></citerefentry>).
207
194
    </para>
208
195
  </refsect1>
209
196
  
210
197
  <refsect1 id="purpose">
211
198
    <title>PURPOSE</title>
212
 
 
213
199
    <para>
214
200
      The purpose of this is to enable <emphasis>remote and unattended
215
201
      rebooting</emphasis> of client host computer with an
216
202
      <emphasis>encrypted root file system</emphasis>.  See <xref
217
203
      linkend="overview"/> for details.
218
204
    </para>
219
 
 
220
205
  </refsect1>
221
206
  
222
207
  <refsect1 id="options">
223
208
    <title>OPTIONS</title>
224
 
 
 
209
    
225
210
    <variablelist>
226
211
      <varlistentry>
227
 
        <term><literal>-h</literal>, <literal>--help</literal></term>
 
212
        <term><option>--help</option></term>
 
213
        <term><option>-h</option></term>
228
214
        <listitem>
229
215
          <para>
230
216
            Show a help message and exit
231
217
          </para>
232
218
        </listitem>
233
219
      </varlistentry>
234
 
 
 
220
      
235
221
      <varlistentry>
236
 
        <term><literal>-d</literal>, <literal>--dir
237
 
        <replaceable>directory</replaceable></literal></term>
 
222
        <term><option>--dir
 
223
        <replaceable>DIRECTORY</replaceable></option></term>
 
224
        <term><option>-d
 
225
        <replaceable>DIRECTORY</replaceable></option></term>
238
226
        <listitem>
239
227
          <para>
240
228
            Target directory for key files.  Default is
241
 
            <filename>/etc/mandos</filename>.
242
 
          </para>
243
 
        </listitem>
244
 
      </varlistentry>
245
 
 
246
 
      <varlistentry>
247
 
        <term><literal>-t</literal>, <literal>--type
248
 
        <replaceable>type</replaceable></literal></term>
249
 
        <listitem>
250
 
          <para>
251
 
            Key type.  Default is <quote>DSA</quote>.
252
 
          </para>
253
 
        </listitem>
254
 
      </varlistentry>
255
 
 
256
 
      <varlistentry>
257
 
        <term><literal>-l</literal>, <literal>--length
258
 
        <replaceable>bits</replaceable></literal></term>
259
 
        <listitem>
260
 
          <para>
261
 
            Key length in bits.  Default is 2048.
262
 
          </para>
263
 
        </listitem>
264
 
      </varlistentry>
265
 
 
266
 
      <varlistentry>
267
 
        <term><literal>-s</literal>, <literal>--subtype
268
 
        <replaceable>type</replaceable></literal></term>
269
 
        <listitem>
270
 
          <para>
271
 
            Subkey type.  Default is <quote>ELG-E</quote> (Elgamal
 
229
            <filename class="directory">/etc/mandos</filename>.
 
230
          </para>
 
231
        </listitem>
 
232
      </varlistentry>
 
233
      
 
234
      <varlistentry>
 
235
        <term><option>--type
 
236
        <replaceable>TYPE</replaceable></option></term>
 
237
        <term><option>-t
 
238
        <replaceable>TYPE</replaceable></option></term>
 
239
        <listitem>
 
240
          <para>
 
241
            Key type.  Default is <quote>RSA</quote>.
 
242
          </para>
 
243
        </listitem>
 
244
      </varlistentry>
 
245
      
 
246
      <varlistentry>
 
247
        <term><option>--length
 
248
        <replaceable>BITS</replaceable></option></term>
 
249
        <term><option>-l
 
250
        <replaceable>BITS</replaceable></option></term>
 
251
        <listitem>
 
252
          <para>
 
253
            Key length in bits.  Default is 4096.
 
254
          </para>
 
255
        </listitem>
 
256
      </varlistentry>
 
257
      
 
258
      <varlistentry>
 
259
        <term><option>--subtype
 
260
        <replaceable>KEYTYPE</replaceable></option></term>
 
261
        <term><option>-s
 
262
        <replaceable>KEYTYPE</replaceable></option></term>
 
263
        <listitem>
 
264
          <para>
 
265
            Subkey type.  Default is <quote>RSA</quote> (Elgamal
272
266
            encryption-only).
273
267
          </para>
274
268
        </listitem>
275
269
      </varlistentry>
276
 
 
 
270
      
277
271
      <varlistentry>
278
 
        <term><literal>-L</literal>, <literal>--sublength
279
 
        <replaceable>bits</replaceable></literal></term>
 
272
        <term><option>--sublength
 
273
        <replaceable>BITS</replaceable></option></term>
 
274
        <term><option>-L
 
275
        <replaceable>BITS</replaceable></option></term>
280
276
        <listitem>
281
277
          <para>
282
 
            Subkey length in bits.  Default is 2048.
 
278
            Subkey length in bits.  Default is 4096.
283
279
          </para>
284
280
        </listitem>
285
281
      </varlistentry>
286
 
 
 
282
      
287
283
      <varlistentry>
288
 
        <term><literal>-e</literal>, <literal>--email</literal>
289
 
        <replaceable>address</replaceable></term>
 
284
        <term><option>--email
 
285
        <replaceable>ADDRESS</replaceable></option></term>
 
286
        <term><option>-e
 
287
        <replaceable>ADDRESS</replaceable></option></term>
290
288
        <listitem>
291
289
          <para>
292
290
            Email address of key.  Default is empty.
293
291
          </para>
294
292
        </listitem>
295
293
      </varlistentry>
296
 
 
 
294
      
297
295
      <varlistentry>
298
 
        <term><literal>-c</literal>, <literal>--comment</literal>
299
 
        <replaceable>comment</replaceable></term>
 
296
        <term><option>--comment
 
297
        <replaceable>TEXT</replaceable></option></term>
 
298
        <term><option>-c
 
299
        <replaceable>TEXT</replaceable></option></term>
300
300
        <listitem>
301
301
          <para>
302
 
            Comment field for key.  The default value is
303
 
            <quote><literal>Mandos client key</literal></quote>.
 
302
            Comment field for key.  Default is empty.
304
303
          </para>
305
304
        </listitem>
306
305
      </varlistentry>
307
 
 
 
306
      
308
307
      <varlistentry>
309
 
        <term><literal>-x</literal>, <literal>--expire</literal>
310
 
        <replaceable>time</replaceable></term>
 
308
        <term><option>--expire
 
309
        <replaceable>TIME</replaceable></option></term>
 
310
        <term><option>-x
 
311
        <replaceable>TIME</replaceable></option></term>
311
312
        <listitem>
312
313
          <para>
313
314
            Key expire time.  Default is no expiration.  See
316
317
          </para>
317
318
        </listitem>
318
319
      </varlistentry>
319
 
 
 
320
      
320
321
      <varlistentry>
321
 
        <term><literal>-f</literal>, <literal>--force</literal></term>
 
322
        <term><option>--force</option></term>
 
323
        <term><option>-f</option></term>
322
324
        <listitem>
323
325
          <para>
324
 
            Force overwriting old keys.
 
326
            Force overwriting old key.
325
327
          </para>
326
328
        </listitem>
327
329
      </varlistentry>
328
330
      <varlistentry>
329
 
        <term><literal>-p</literal>, <literal>--password</literal
330
 
        ></term>
 
331
        <term><option>--password</option></term>
 
332
        <term><option>-p</option></term>
331
333
        <listitem>
332
334
          <para>
333
335
            Prompt for a password and encrypt it with the key already
339
341
            >8</manvolnum></citerefentry>.  The host name or the name
340
342
            specified with the <option>--name</option> option is used
341
343
            for the section header.  All other options are ignored,
342
 
            and no keys are created.
 
344
            and no key is created.
 
345
          </para>
 
346
        </listitem>
 
347
      </varlistentry>
 
348
      <varlistentry>
 
349
        <term><option>--passfile
 
350
        <replaceable>FILE</replaceable></option></term>
 
351
        <term><option>-F
 
352
        <replaceable>FILE</replaceable></option></term>
 
353
        <listitem>
 
354
          <para>
 
355
            The same as <option>--password</option>, but read from
 
356
            <replaceable>FILE</replaceable>, not the terminal.
 
357
          </para>
 
358
        </listitem>
 
359
      </varlistentry>
 
360
      <varlistentry>
 
361
        <term><option>--no-ssh</option></term>
 
362
        <term><option>-S</option></term>
 
363
        <listitem>
 
364
          <para>
 
365
            When <option>--password</option> or
 
366
            <option>--passfile</option> is given, this option will
 
367
            prevent <command>&COMMANDNAME;</command> from calling
 
368
            <command>ssh-keyscan</command> to get an SSH fingerprint
 
369
            for this host and, if successful, output suitable config
 
370
            options to use this fingerprint as a
 
371
            <option>checker</option> option in the output.  This is
 
372
            otherwise the default behavior.
343
373
          </para>
344
374
        </listitem>
345
375
      </varlistentry>
346
376
    </variablelist>
347
377
  </refsect1>
348
 
 
 
378
  
349
379
  <refsect1 id="overview">
350
380
    <title>OVERVIEW</title>
351
381
    <xi:include href="overview.xml"/>
352
382
    <para>
353
383
      This program is a small utility to generate new OpenPGP keys for
354
 
      new Mandos clients.
 
384
      new Mandos clients, and to generate sections for inclusion in
 
385
      <filename>clients.conf</filename> on the server.
355
386
    </para>
356
387
  </refsect1>
357
 
 
 
388
  
358
389
  <refsect1 id="exit_status">
359
390
    <title>EXIT STATUS</title>
360
391
    <para>
361
 
      The exit status will be 0 if new keys were successfully created,
362
 
      otherwise not.
 
392
      The exit status will be 0 if a new key (or password, if the
 
393
      <option>--password</option> option was used) was successfully
 
394
      created, otherwise not.
363
395
    </para>
364
396
  </refsect1>
365
397
  
367
399
    <title>ENVIRONMENT</title>
368
400
    <variablelist>
369
401
      <varlistentry>
370
 
        <term><varname>TMPDIR</varname></term>
 
402
        <term><envar>TMPDIR</envar></term>
371
403
        <listitem>
372
404
          <para>
373
405
            If set, temporary files will be created here. See
379
411
    </variablelist>
380
412
  </refsect1>
381
413
  
382
 
  <refsect1 id="file">
 
414
  <refsect1 id="files">
383
415
    <title>FILES</title>
384
416
    <para>
385
417
      Use the <option>--dir</option> option to change where
406
438
        </listitem>
407
439
      </varlistentry>
408
440
      <varlistentry>
409
 
        <term><filename>/tmp</filename></term>
 
441
        <term><filename class="directory">/tmp</filename></term>
410
442
        <listitem>
411
443
          <para>
412
444
            Temporary files will be written here if
416
448
      </varlistentry>
417
449
    </variablelist>
418
450
  </refsect1>
419
 
 
420
 
  <refsect1 id="bugs">
421
 
    <title>BUGS</title>
422
 
    <para>
423
 
      None are known at this time.
424
 
    </para>
425
 
  </refsect1>
426
 
 
 
451
  
 
452
<!--   <refsect1 id="bugs"> -->
 
453
<!--     <title>BUGS</title> -->
 
454
<!--     <para> -->
 
455
<!--     </para> -->
 
456
<!--   </refsect1> -->
 
457
  
427
458
  <refsect1 id="example">
428
459
    <title>EXAMPLE</title>
429
460
    <informalexample>
431
462
        Normal invocation needs no options:
432
463
      </para>
433
464
      <para>
434
 
        <userinput>mandos-keygen</userinput>
 
465
        <userinput>&COMMANDNAME;</userinput>
435
466
      </para>
436
467
    </informalexample>
437
468
    <informalexample>
438
469
      <para>
439
 
        Create keys in another directory and of another type.  Force
 
470
        Create key in another directory and of another type.  Force
440
471
        overwriting old key files:
441
472
      </para>
442
473
      <para>
443
474
 
444
475
<!-- do not wrap this line -->
445
 
<userinput>mandos-keygen --dir ~/keydir --type RSA --force</userinput>
 
476
<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>
 
477
 
 
478
      </para>
 
479
    </informalexample>
 
480
    <informalexample>
 
481
      <para>
 
482
        Prompt for a password, encrypt it with the key in <filename
 
483
        class="directory">/etc/mandos</filename> and output a section
 
484
        suitable for <filename>clients.conf</filename>.
 
485
      </para>
 
486
      <para>
 
487
        <userinput>&COMMANDNAME; --password</userinput>
 
488
      </para>
 
489
    </informalexample>
 
490
    <informalexample>
 
491
      <para>
 
492
        Prompt for a password, encrypt it with the key in the
 
493
        <filename>client-key</filename> directory and output a section
 
494
        suitable for <filename>clients.conf</filename>.
 
495
      </para>
 
496
      <para>
 
497
 
 
498
<!-- do not wrap this line -->
 
499
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
446
500
 
447
501
      </para>
448
502
    </informalexample>
449
503
  </refsect1>
450
 
 
 
504
  
451
505
  <refsect1 id="security">
452
506
    <title>SECURITY</title>
453
507
    <para>
454
508
      The <option>--type</option>, <option>--length</option>,
455
509
      <option>--subtype</option>, and <option>--sublength</option>
456
 
      options can be used to create keys of insufficient security.  If
457
 
      in doubt, leave them to the default values.
 
510
      options can be used to create keys of low security.  If in
 
511
      doubt, leave them to the default values.
458
512
    </para>
459
513
    <para>
460
 
      The key expire time is not guaranteed to be honored by
461
 
      <citerefentry><refentrytitle>mandos</refentrytitle>
 
514
      The key expire time is <emphasis>not</emphasis> guaranteed to be
 
515
      honored by <citerefentry><refentrytitle>mandos</refentrytitle>
462
516
      <manvolnum>8</manvolnum></citerefentry>.
463
517
    </para>
464
518
  </refsect1>
465
 
 
 
519
  
466
520
  <refsect1 id="see_also">
467
521
    <title>SEE ALSO</title>
468
522
    <para>
469
 
      <citerefentry><refentrytitle>password-request</refentrytitle>
 
523
      <citerefentry><refentrytitle>intro</refentrytitle>
470
524
      <manvolnum>8mandos</manvolnum></citerefentry>,
 
525
      <citerefentry><refentrytitle>gpg</refentrytitle>
 
526
      <manvolnum>1</manvolnum></citerefentry>,
 
527
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
 
528
      <manvolnum>5</manvolnum></citerefentry>,
471
529
      <citerefentry><refentrytitle>mandos</refentrytitle>
472
530
      <manvolnum>8</manvolnum></citerefentry>,
473
 
      <citerefentry><refentrytitle>gpg</refentrytitle>
 
531
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
 
532
      <manvolnum>8mandos</manvolnum></citerefentry>,
 
533
      <citerefentry><refentrytitle>ssh-keyscan</refentrytitle>
474
534
      <manvolnum>1</manvolnum></citerefentry>
475
535
    </para>
476
536
  </refsect1>