66
49
<refname><command>&COMMANDNAME;</command></refname>
68
Generate keys for <citerefentry><refentrytitle>password-request
69
</refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
51
Generate key and password for Mandos client and server.
75
57
<command>&COMMANDNAME;</command>
77
<arg choice="plain"><option>--dir</option>
78
<replaceable>directory</replaceable></arg>
81
<arg choice="plain"><option>--type</option>
82
<replaceable>type</replaceable></arg>
85
<arg choice="plain"><option>--length</option>
86
<replaceable>bits</replaceable></arg>
89
<arg choice="plain"><option>--name</option>
90
<replaceable>NAME</replaceable></arg>
93
<arg choice="plain"><option>--email</option>
94
<replaceable>EMAIL</replaceable></arg>
97
<arg choice="plain"><option>--comment</option>
98
<replaceable>COMMENT</replaceable></arg>
101
<arg choice="plain"><option>--expire</option>
102
<replaceable>TIME</replaceable></arg>
105
<arg choice="plain"><option>--force</option></arg>
109
<command>&COMMANDNAME;</command>
111
<arg choice="plain"><option>-d</option>
112
<replaceable>directory</replaceable></arg>
115
<arg choice="plain"><option>-t</option>
116
<replaceable>type</replaceable></arg>
119
<arg choice="plain"><option>-l</option>
120
<replaceable>bits</replaceable></arg>
123
<arg choice="plain"><option>-n</option>
124
<replaceable>NAME</replaceable></arg>
127
<arg choice="plain"><option>-e</option>
128
<replaceable>EMAIL</replaceable></arg>
131
<arg choice="plain"><option>-c</option>
132
<replaceable>COMMENT</replaceable></arg>
135
<arg choice="plain"><option>-x</option>
136
<replaceable>TIME</replaceable></arg>
139
<arg choice="plain"><option>-f</option></arg>
143
<command>&COMMANDNAME;</command>
145
<arg choice='plain'><option>-h</option></arg>
146
<arg choice='plain'><option>--help</option></arg>
150
<command>&COMMANDNAME;</command>
152
<arg choice='plain'><option>-v</option></arg>
153
<arg choice='plain'><option>--version</option></arg>
59
<arg choice="plain"><option>--dir
60
<replaceable>DIRECTORY</replaceable></option></arg>
61
<arg choice="plain"><option>-d
62
<replaceable>DIRECTORY</replaceable></option></arg>
66
<arg choice="plain"><option>--type
67
<replaceable>KEYTYPE</replaceable></option></arg>
68
<arg choice="plain"><option>-t
69
<replaceable>KEYTYPE</replaceable></option></arg>
73
<arg choice="plain"><option>--length
74
<replaceable>BITS</replaceable></option></arg>
75
<arg choice="plain"><option>-l
76
<replaceable>BITS</replaceable></option></arg>
80
<arg choice="plain"><option>--subtype
81
<replaceable>KEYTYPE</replaceable></option></arg>
82
<arg choice="plain"><option>-s
83
<replaceable>KEYTYPE</replaceable></option></arg>
87
<arg choice="plain"><option>--sublength
88
<replaceable>BITS</replaceable></option></arg>
89
<arg choice="plain"><option>-L
90
<replaceable>BITS</replaceable></option></arg>
94
<arg choice="plain"><option>--name
95
<replaceable>NAME</replaceable></option></arg>
96
<arg choice="plain"><option>-n
97
<replaceable>NAME</replaceable></option></arg>
101
<arg choice="plain"><option>--email
102
<replaceable>ADDRESS</replaceable></option></arg>
103
<arg choice="plain"><option>-e
104
<replaceable>ADDRESS</replaceable></option></arg>
108
<arg choice="plain"><option>--comment
109
<replaceable>TEXT</replaceable></option></arg>
110
<arg choice="plain"><option>-c
111
<replaceable>TEXT</replaceable></option></arg>
115
<arg choice="plain"><option>--expire
116
<replaceable>TIME</replaceable></option></arg>
117
<arg choice="plain"><option>-x
118
<replaceable>TIME</replaceable></option></arg>
121
<arg><option>--force</option></arg>
124
<command>&COMMANDNAME;</command>
126
<arg choice="plain"><option>--password</option></arg>
127
<arg choice="plain"><option>-p</option></arg>
128
<arg choice="plain"><option>--passfile
129
<replaceable>FILE</replaceable></option></arg>
130
<arg choice="plain"><option>-F</option>
131
<replaceable>FILE</replaceable></arg>
135
<arg choice="plain"><option>--dir
136
<replaceable>DIRECTORY</replaceable></option></arg>
137
<arg choice="plain"><option>-d
138
<replaceable>DIRECTORY</replaceable></option></arg>
142
<arg choice="plain"><option>--name
143
<replaceable>NAME</replaceable></option></arg>
144
<arg choice="plain"><option>-n
145
<replaceable>NAME</replaceable></option></arg>
149
<command>&COMMANDNAME;</command>
151
<arg choice="plain"><option>--help</option></arg>
152
<arg choice="plain"><option>-h</option></arg>
156
<command>&COMMANDNAME;</command>
158
<arg choice="plain"><option>--version</option></arg>
159
<arg choice="plain"><option>-v</option></arg>
156
162
</refsynopsisdiv>
158
164
<refsect1 id="description">
159
165
<title>DESCRIPTION</title>
161
167
<command>&COMMANDNAME;</command> is a program to generate the
163
<citerefentry><refentrytitle>password-request</refentrytitle>
164
<manvolnum>8mandos</manvolnum></citerefentry>. The keys are
169
<citerefentry><refentrytitle>mandos-client</refentrytitle>
170
<manvolnum>8mandos</manvolnum></citerefentry>. The key is
165
171
normally written to /etc/mandos for later installation into the
166
initrd image, but this, like most things, can be changed with
167
command line options.
172
initrd image, but this, and most other things, can be changed
173
with command line options.
176
This program can also be used with the
177
<option>--password</option> or <option>--passfile</option>
178
options to generate a ready-made section for
179
<filename>clients.conf</filename> (see
180
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
181
<manvolnum>5</manvolnum></citerefentry>).
171
185
<refsect1 id="purpose">
172
186
<title>PURPOSE</title>
175
188
The purpose of this is to enable <emphasis>remote and unattended
176
189
rebooting</emphasis> of client host computer with an
177
190
<emphasis>encrypted root file system</emphasis>. See <xref
178
191
linkend="overview"/> for details.
183
195
<refsect1 id="options">
184
196
<title>OPTIONS</title>
188
<term><literal>-h</literal>, <literal>--help</literal></term>
200
<term><option>--help</option></term>
201
<term><option>-h</option></term>
191
204
Show a help message and exit
197
<term><literal>-d</literal>, <literal>--dir
198
<replaceable>directory</replaceable></literal></term>
201
Target directory for key files.
207
<term><literal>-t</literal>, <literal>--type
208
<replaceable>type</replaceable></literal></term>
211
Key type. Default is DSA.
217
<term><literal>-l</literal>, <literal>--length
218
<replaceable>bits</replaceable></literal></term>
221
Key length in bits. Default is 1024.
227
<term><literal>-e</literal>, <literal>--email</literal>
228
<replaceable>address</replaceable></term>
211
<replaceable>DIRECTORY</replaceable></option></term>
213
<replaceable>DIRECTORY</replaceable></option></term>
216
Target directory for key files. Default is
217
<filename>/etc/mandos</filename>.
224
<replaceable>TYPE</replaceable></option></term>
226
<replaceable>TYPE</replaceable></option></term>
229
Key type. Default is <quote>DSA</quote>.
235
<term><option>--length
236
<replaceable>BITS</replaceable></option></term>
238
<replaceable>BITS</replaceable></option></term>
241
Key length in bits. Default is 2048.
247
<term><option>--subtype
248
<replaceable>KEYTYPE</replaceable></option></term>
250
<replaceable>KEYTYPE</replaceable></option></term>
253
Subkey type. Default is <quote>ELG-E</quote> (Elgamal
260
<term><option>--sublength
261
<replaceable>BITS</replaceable></option></term>
263
<replaceable>BITS</replaceable></option></term>
266
Subkey length in bits. Default is 2048.
272
<term><option>--email
273
<replaceable>ADDRESS</replaceable></option></term>
275
<replaceable>ADDRESS</replaceable></option></term>
231
278
Email address of key. Default is empty.
237
<term><literal>-c</literal>, <literal>--comment</literal>
238
<replaceable>comment</replaceable></term>
284
<term><option>--comment
285
<replaceable>TEXT</replaceable></option></term>
287
<replaceable>TEXT</replaceable></option></term>
241
290
Comment field for key. The default value is
242
"<literal>Mandos client key</literal>".
291
<quote><literal>Mandos client key</literal></quote>.
248
<term><literal>-x</literal>, <literal>--expire</literal>
249
<replaceable>time</replaceable></term>
297
<term><option>--expire
298
<replaceable>TIME</replaceable></option></term>
300
<replaceable>TIME</replaceable></option></term>
252
303
Key expire time. Default is no expiration. See
260
<term><literal>-f</literal>, <literal>--force</literal></term>
263
Force overwriting old keys.
311
<term><option>--force</option></term>
312
<term><option>-f</option></term>
315
Force overwriting old key.
320
<term><option>--password</option></term>
321
<term><option>-p</option></term>
324
Prompt for a password and encrypt it with the key already
325
present in either <filename>/etc/mandos</filename> or the
326
directory specified with the <option>--dir</option>
327
option. Outputs, on standard output, a section suitable
328
for inclusion in <citerefentry><refentrytitle
329
>mandos-clients.conf</refentrytitle><manvolnum
330
>8</manvolnum></citerefentry>. The host name or the name
331
specified with the <option>--name</option> option is used
332
for the section header. All other options are ignored,
333
and no key is created.
338
<term><option>--passfile
339
<replaceable>FILE</replaceable></option></term>
341
<replaceable>FILE</replaceable></option></term>
344
The same as <option>--password</option>, but read from
345
<replaceable>FILE</replaceable>, not the terminal.
270
352
<refsect1 id="overview">
271
353
<title>OVERVIEW</title>
354
<xi:include href="overview.xml"/>
274
This program is a small program to generate new OpenPGP keys for
356
This program is a small utility to generate new OpenPGP keys for
357
new Mandos clients, and to generate sections for inclusion in
358
<filename>clients.conf</filename> on the server.
279
362
<refsect1 id="exit_status">
280
363
<title>EXIT STATUS</title>
365
The exit status will be 0 if a new key (or password, if the
366
<option>--password</option> option was used) was successfully
367
created, otherwise not.
371
<refsect1 id="environment">
372
<title>ENVIRONMENT</title>
375
<term><envar>TMPDIR</envar></term>
378
If set, temporary files will be created here. See
379
<citerefentry><refentrytitle>mktemp</refentrytitle>
380
<manvolnum>1</manvolnum></citerefentry>.
387
<refsect1 id="files">
286
388
<title>FILES</title>
390
Use the <option>--dir</option> option to change where
391
<command>&COMMANDNAME;</command> will write the key files. The
392
default file names are shown here.
396
<term><filename>/etc/mandos/seckey.txt</filename></term>
399
OpenPGP secret key file which will be created or
405
<term><filename>/etc/mandos/pubkey.txt</filename></term>
408
OpenPGP public key file which will be created or
414
<term><filename>/tmp</filename></term>
417
Temporary files will be written here if
418
<varname>TMPDIR</varname> is not set.
425
<!-- <refsect1 id="bugs"> -->
426
<!-- <title>BUGS</title> -->
297
431
<refsect1 id="example">
298
432
<title>EXAMPLE</title>
435
Normal invocation needs no options:
438
<userinput>&COMMANDNAME;</userinput>
443
Create key in another directory and of another type. Force
444
overwriting old key files:
448
<!-- do not wrap this line -->
449
<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>
455
Prompt for a password, encrypt it with the key in
456
<filename>/etc/mandos</filename> and output a section suitable
457
for <filename>clients.conf</filename>.
460
<userinput>&COMMANDNAME; --password</userinput>
465
Prompt for a password, encrypt it with the key in the
466
<filename>client-key</filename> directory and output a section
467
suitable for <filename>clients.conf</filename>.
471
<!-- do not wrap this line -->
472
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
303
478
<refsect1 id="security">
304
479
<title>SECURITY</title>
481
The <option>--type</option>, <option>--length</option>,
482
<option>--subtype</option>, and <option>--sublength</option>
483
options can be used to create keys of low security. If in
484
doubt, leave them to the default values.
487
The key expire time is <emphasis>not</emphasis> guaranteed to be
488
honored by <citerefentry><refentrytitle>mandos</refentrytitle>
489
<manvolnum>8</manvolnum></citerefentry>.
309
493
<refsect1 id="see_also">
310
494
<title>SEE ALSO</title>
312
<citerefentry><refentrytitle>password-request</refentrytitle>
496
<citerefentry><refentrytitle>intro</refentrytitle>
313
497
<manvolnum>8mandos</manvolnum></citerefentry>,
498
<citerefentry><refentrytitle>gpg</refentrytitle>
499
<manvolnum>1</manvolnum></citerefentry>,
500
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
501
<manvolnum>5</manvolnum></citerefentry>,
314
502
<citerefentry><refentrytitle>mandos</refentrytitle>
315
<manvolnum>8</manvolnum></citerefentry>, and
316
<citerefentry><refentrytitle>gpg</refentrytitle>
317
<manvolnum>1</manvolnum></citerefentry>
503
<manvolnum>8</manvolnum></citerefentry>,
504
<citerefentry><refentrytitle>mandos-client</refentrytitle>
505
<manvolnum>8mandos</manvolnum></citerefentry>
510
<!-- Local Variables: -->
511
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
512
<!-- time-stamp-end: "[\"']>" -->
513
<!-- time-stamp-format: "%:y-%02m-%02d" -->