/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos-keygen.xml

  • Committer: Teddy Hogeborn
  • Date: 2019-02-09 23:34:15 UTC
  • mto: (237.7.594 trunk)
  • mto: This revision was merged to the branch mainline in revision 370.
  • Revision ID: teddy@recompile.se-20190209233415-m1ntebuepwna1xg1
Doc fix: Change some "/etc/mandos" to "/etc/keys/mandos"

* clients.conf: Change "/etc/mandos" to "/etc/keys/mandos" where
                appropriate
* mandos-keygen.xml: - '' -

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-keygen.xml
1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
 
<!ENTITY VERSION "1.0">
5
4
<!ENTITY COMMANDNAME "mandos-keygen">
 
5
<!ENTITY TIMESTAMP "2019-02-10">
 
6
<!ENTITY % common SYSTEM "common.ent">
 
7
%common;
6
8
]>
7
9
 
8
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
9
11
  <refentryinfo>
10
 
    <title>&COMMANDNAME;</title>
 
12
    <title>Mandos Manual</title>
11
13
    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
12
 
    <productname>&COMMANDNAME;</productname>
13
 
    <productnumber>&VERSION;</productnumber>
 
14
    <productname>Mandos</productname>
 
15
    <productnumber>&version;</productnumber>
 
16
    <date>&TIMESTAMP;</date>
14
17
    <authorgroup>
15
18
      <author>
16
19
        <firstname>Björn</firstname>
17
20
        <surname>Påhlsson</surname>
18
21
        <address>
19
 
          <email>belorn@fukt.bsnet.se</email>
 
22
          <email>belorn@recompile.se</email>
20
23
        </address>
21
24
      </author>
22
25
      <author>
23
26
        <firstname>Teddy</firstname>
24
27
        <surname>Hogeborn</surname>
25
28
        <address>
26
 
          <email>teddy@fukt.bsnet.se</email>
 
29
          <email>teddy@recompile.se</email>
27
30
        </address>
28
31
      </author>
29
32
    </authorgroup>
30
33
    <copyright>
31
34
      <year>2008</year>
 
35
      <year>2009</year>
 
36
      <year>2010</year>
 
37
      <year>2011</year>
 
38
      <year>2012</year>
 
39
      <year>2013</year>
 
40
      <year>2014</year>
 
41
      <year>2015</year>
 
42
      <year>2016</year>
 
43
      <year>2017</year>
 
44
      <year>2018</year>
32
45
      <holder>Teddy Hogeborn</holder>
33
46
      <holder>Björn Påhlsson</holder>
34
47
    </copyright>
35
 
    <legalnotice>
36
 
      <para>
37
 
        This manual page is free software: you can redistribute it
38
 
        and/or modify it under the terms of the GNU General Public
39
 
        License as published by the Free Software Foundation,
40
 
        either version 3 of the License, or (at your option) any
41
 
        later version.
42
 
      </para>
43
 
 
44
 
      <para>
45
 
        This manual page is distributed in the hope that it will
46
 
        be useful, but WITHOUT ANY WARRANTY; without even the
47
 
        implied warranty of MERCHANTABILITY or FITNESS FOR A
48
 
        PARTICULAR PURPOSE.  See the GNU General Public License
49
 
        for more details.
50
 
      </para>
51
 
 
52
 
      <para>
53
 
        You should have received a copy of the GNU General Public
54
 
        License along with this program; If not, see
55
 
        <ulink url="http://www.gnu.org/licenses/"/>.
56
 
      </para>
57
 
    </legalnotice>
 
48
    <xi:include href="legalnotice.xml"/>
58
49
  </refentryinfo>
59
 
 
 
50
  
60
51
  <refmeta>
61
52
    <refentrytitle>&COMMANDNAME;</refentrytitle>
62
53
    <manvolnum>8</manvolnum>
65
56
  <refnamediv>
66
57
    <refname><command>&COMMANDNAME;</command></refname>
67
58
    <refpurpose>
68
 
      Generate keys for <citerefentry><refentrytitle>password-request
69
 
      </refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
 
59
      Generate key and password for Mandos client and server.
70
60
    </refpurpose>
71
61
  </refnamediv>
72
 
 
 
62
  
73
63
  <refsynopsisdiv>
74
64
    <cmdsynopsis>
75
65
      <command>&COMMANDNAME;</command>
76
 
      <group choice="opt">
77
 
        <arg choice="plain"><option>--dir</option>
78
 
        <replaceable>directory</replaceable></arg>
79
 
      </group>
80
 
      <group choice="opt">
81
 
        <arg choice="plain"><option>--type</option>
82
 
        <replaceable>type</replaceable></arg>
83
 
      </group>
84
 
      <group choice="opt">
85
 
        <arg choice="plain"><option>--length</option>
86
 
        <replaceable>bits</replaceable></arg>
87
 
      </group>
88
 
      <group choice="opt">
89
 
        <arg choice="plain"><option>--subtype</option>
90
 
        <replaceable>type</replaceable></arg>
91
 
      </group>
92
 
      <group choice="opt">
93
 
        <arg choice="plain"><option>--sublength</option>
94
 
        <replaceable>bits</replaceable></arg>
95
 
      </group>
96
 
      <group choice="opt">
97
 
        <arg choice="plain"><option>--name</option>
98
 
        <replaceable>NAME</replaceable></arg>
99
 
      </group>
100
 
      <group choice="opt">
101
 
        <arg choice="plain"><option>--email</option>
102
 
        <replaceable>EMAIL</replaceable></arg>
103
 
      </group>
104
 
      <group choice="opt">
105
 
        <arg choice="plain"><option>--comment</option>
106
 
        <replaceable>COMMENT</replaceable></arg>
107
 
      </group>
108
 
      <group choice="opt">
109
 
        <arg choice="plain"><option>--expire</option>
110
 
        <replaceable>TIME</replaceable></arg>
111
 
      </group>
112
 
      <group choice="opt">
 
66
      <group>
 
67
        <arg choice="plain"><option>--dir
 
68
        <replaceable>DIRECTORY</replaceable></option></arg>
 
69
        <arg choice="plain"><option>-d
 
70
        <replaceable>DIRECTORY</replaceable></option></arg>
 
71
      </group>
 
72
      <sbr/>
 
73
      <group>
 
74
        <arg choice="plain"><option>--type
 
75
        <replaceable>KEYTYPE</replaceable></option></arg>
 
76
        <arg choice="plain"><option>-t
 
77
        <replaceable>KEYTYPE</replaceable></option></arg>
 
78
      </group>
 
79
      <sbr/>
 
80
      <group>
 
81
        <arg choice="plain"><option>--length
 
82
        <replaceable>BITS</replaceable></option></arg>
 
83
        <arg choice="plain"><option>-l
 
84
        <replaceable>BITS</replaceable></option></arg>
 
85
      </group>
 
86
      <sbr/>
 
87
      <group>
 
88
        <arg choice="plain"><option>--subtype
 
89
        <replaceable>KEYTYPE</replaceable></option></arg>
 
90
        <arg choice="plain"><option>-s
 
91
        <replaceable>KEYTYPE</replaceable></option></arg>
 
92
      </group>
 
93
      <sbr/>
 
94
      <group>
 
95
        <arg choice="plain"><option>--sublength
 
96
        <replaceable>BITS</replaceable></option></arg>
 
97
        <arg choice="plain"><option>-L
 
98
        <replaceable>BITS</replaceable></option></arg>
 
99
      </group>
 
100
      <sbr/>
 
101
      <group>
 
102
        <arg choice="plain"><option>--name
 
103
        <replaceable>NAME</replaceable></option></arg>
 
104
        <arg choice="plain"><option>-n
 
105
        <replaceable>NAME</replaceable></option></arg>
 
106
      </group>
 
107
      <sbr/>
 
108
      <group>
 
109
        <arg choice="plain"><option>--email
 
110
        <replaceable>ADDRESS</replaceable></option></arg>
 
111
        <arg choice="plain"><option>-e
 
112
        <replaceable>ADDRESS</replaceable></option></arg>
 
113
      </group>
 
114
      <sbr/>
 
115
      <group>
 
116
        <arg choice="plain"><option>--comment
 
117
        <replaceable>TEXT</replaceable></option></arg>
 
118
        <arg choice="plain"><option>-c
 
119
        <replaceable>TEXT</replaceable></option></arg>
 
120
      </group>
 
121
      <sbr/>
 
122
      <group>
 
123
        <arg choice="plain"><option>--expire
 
124
        <replaceable>TIME</replaceable></option></arg>
 
125
        <arg choice="plain"><option>-x
 
126
        <replaceable>TIME</replaceable></option></arg>
 
127
      </group>
 
128
      <sbr/>
 
129
      <group>
 
130
        <arg choice="plain"><option>--tls-keytype
 
131
        <replaceable>KEYTYPE</replaceable></option></arg>
 
132
        <arg choice="plain"><option>-T
 
133
        <replaceable>KEYTYPE</replaceable></option></arg>
 
134
      </group>
 
135
      <sbr/>
 
136
      <group>
113
137
        <arg choice="plain"><option>--force</option></arg>
114
 
      </group>
115
 
    </cmdsynopsis>
116
 
    <cmdsynopsis>
117
 
      <command>&COMMANDNAME;</command>
118
 
      <group choice="opt">
119
 
        <arg choice="plain"><option>-d</option>
120
 
        <replaceable>directory</replaceable></arg>
121
 
      </group>
122
 
      <group choice="opt">
123
 
        <arg choice="plain"><option>-t</option>
124
 
        <replaceable>type</replaceable></arg>
125
 
      </group>
126
 
      <group choice="opt">
127
 
        <arg choice="plain"><option>-l</option>
128
 
        <replaceable>bits</replaceable></arg>
129
 
      </group>
130
 
      <group choice="opt">
131
 
        <arg choice="plain"><option>-s</option>
132
 
        <replaceable>type</replaceable></arg>
133
 
      </group>
134
 
      <group choice="opt">
135
 
        <arg choice="plain"><option>-L</option>
136
 
        <replaceable>bits</replaceable></arg>
137
 
      </group>
138
 
      <group choice="opt">
139
 
        <arg choice="plain"><option>-n</option>
140
 
        <replaceable>NAME</replaceable></arg>
141
 
      </group>
142
 
      <group choice="opt">
143
 
        <arg choice="plain"><option>-e</option>
144
 
        <replaceable>EMAIL</replaceable></arg>
145
 
      </group>
146
 
      <group choice="opt">
147
 
        <arg choice="plain"><option>-c</option>
148
 
        <replaceable>COMMENT</replaceable></arg>
149
 
      </group>
150
 
      <group choice="opt">
151
 
        <arg choice="plain"><option>-x</option>
152
 
        <replaceable>TIME</replaceable></arg>
153
 
      </group>
154
 
      <group choice="opt">
155
138
        <arg choice="plain"><option>-f</option></arg>
156
139
      </group>
157
140
    </cmdsynopsis>
158
141
    <cmdsynopsis>
159
142
      <command>&COMMANDNAME;</command>
160
143
      <group choice="req">
 
144
        <arg choice="plain"><option>--password</option></arg>
 
145
        <arg choice="plain"><option>-p</option></arg>
 
146
        <arg choice="plain"><option>--passfile
 
147
        <replaceable>FILE</replaceable></option></arg>
 
148
        <arg choice="plain"><option>-F</option>
 
149
        <replaceable>FILE</replaceable></arg>
 
150
      </group>
 
151
      <sbr/>
 
152
      <group>
 
153
        <arg choice="plain"><option>--dir
 
154
        <replaceable>DIRECTORY</replaceable></option></arg>
 
155
        <arg choice="plain"><option>-d
 
156
        <replaceable>DIRECTORY</replaceable></option></arg>
 
157
      </group>
 
158
      <sbr/>
 
159
      <group>
 
160
        <arg choice="plain"><option>--name
 
161
        <replaceable>NAME</replaceable></option></arg>
 
162
        <arg choice="plain"><option>-n
 
163
        <replaceable>NAME</replaceable></option></arg>
 
164
      </group>
 
165
      <group>
 
166
        <arg choice="plain"><option>--no-ssh</option></arg>
 
167
        <arg choice="plain"><option>-S</option></arg>
 
168
      </group>
 
169
    </cmdsynopsis>
 
170
    <cmdsynopsis>
 
171
      <command>&COMMANDNAME;</command>
 
172
      <group choice="req">
 
173
        <arg choice="plain"><option>--help</option></arg>
161
174
        <arg choice="plain"><option>-h</option></arg>
162
 
        <arg choice="plain"><option>--help</option></arg>
163
175
      </group>
164
176
    </cmdsynopsis>
165
177
    <cmdsynopsis>
166
178
      <command>&COMMANDNAME;</command>
167
179
      <group choice="req">
 
180
        <arg choice="plain"><option>--version</option></arg>
168
181
        <arg choice="plain"><option>-v</option></arg>
169
 
        <arg choice="plain"><option>--version</option></arg>
170
182
      </group>
171
183
    </cmdsynopsis>
172
184
  </refsynopsisdiv>
173
 
 
 
185
  
174
186
  <refsect1 id="description">
175
187
    <title>DESCRIPTION</title>
176
188
    <para>
177
189
      <command>&COMMANDNAME;</command> is a program to generate the
178
 
      OpenPGP keys used by
179
 
      <citerefentry><refentrytitle>password-request</refentrytitle>
 
190
      TLS and OpenPGP keys used by
 
191
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
180
192
      <manvolnum>8mandos</manvolnum></citerefentry>.  The keys are
181
 
      normally written to /etc/mandos for later installation into the
182
 
      initrd image, but this, like most things, can be changed with
183
 
      command line options.
 
193
      normally written to /etc/keys/mandos for later installation into
 
194
      the initrd image, but this, and most other things, can be
 
195
      changed with command line options.
 
196
    </para>
 
197
    <para>
 
198
      This program can also be used with the
 
199
      <option>--password</option> or <option>--passfile</option>
 
200
      options to generate a ready-made section for
 
201
      <filename>clients.conf</filename> (see
 
202
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
 
203
      <manvolnum>5</manvolnum></citerefentry>).
184
204
    </para>
185
205
  </refsect1>
186
206
  
187
207
  <refsect1 id="purpose">
188
208
    <title>PURPOSE</title>
189
 
 
190
209
    <para>
191
210
      The purpose of this is to enable <emphasis>remote and unattended
192
211
      rebooting</emphasis> of client host computer with an
193
212
      <emphasis>encrypted root file system</emphasis>.  See <xref
194
213
      linkend="overview"/> for details.
195
214
    </para>
196
 
 
197
215
  </refsect1>
198
216
  
199
217
  <refsect1 id="options">
200
218
    <title>OPTIONS</title>
201
 
 
 
219
    
202
220
    <variablelist>
203
221
      <varlistentry>
204
 
        <term><literal>-h</literal>, <literal>--help</literal></term>
 
222
        <term><option>--help</option></term>
 
223
        <term><option>-h</option></term>
205
224
        <listitem>
206
225
          <para>
207
226
            Show a help message and exit
208
227
          </para>
209
228
        </listitem>
210
229
      </varlistentry>
211
 
 
212
 
      <varlistentry>
213
 
        <term><literal>-d</literal>, <literal>--dir
214
 
        <replaceable>directory</replaceable></literal></term>
215
 
        <listitem>
216
 
          <para>
217
 
            Target directory for key files.
218
 
          </para>
219
 
        </listitem>
220
 
      </varlistentry>
221
 
 
222
 
      <varlistentry>
223
 
        <term><literal>-t</literal>, <literal>--type
224
 
        <replaceable>type</replaceable></literal></term>
225
 
        <listitem>
226
 
          <para>
227
 
            Key type.  Default is <quote>DSA</quote>.
228
 
          </para>
229
 
        </listitem>
230
 
      </varlistentry>
231
 
 
232
 
      <varlistentry>
233
 
        <term><literal>-l</literal>, <literal>--length
234
 
        <replaceable>bits</replaceable></literal></term>
235
 
        <listitem>
236
 
          <para>
237
 
            Key length in bits.  Default is 1024.
238
 
          </para>
239
 
        </listitem>
240
 
      </varlistentry>
241
 
 
242
 
      <varlistentry>
243
 
        <term><literal>-s</literal>, <literal>--subtype
244
 
        <replaceable>type</replaceable></literal></term>
245
 
        <listitem>
246
 
          <para>
247
 
            Subkey type.  Default is <quote>ELG-E</quote> (Elgamal
248
 
            encryption-only).
249
 
          </para>
250
 
        </listitem>
251
 
      </varlistentry>
252
 
 
253
 
      <varlistentry>
254
 
        <term><literal>-L</literal>, <literal>--sublength
255
 
        <replaceable>bits</replaceable></literal></term>
256
 
        <listitem>
257
 
          <para>
258
 
            Subkey length in bits.  Default is 2048.
259
 
          </para>
260
 
        </listitem>
261
 
      </varlistentry>
262
 
 
263
 
      <varlistentry>
264
 
        <term><literal>-e</literal>, <literal>--email</literal>
265
 
        <replaceable>address</replaceable></term>
 
230
      
 
231
      <varlistentry>
 
232
        <term><option>--dir
 
233
        <replaceable>DIRECTORY</replaceable></option></term>
 
234
        <term><option>-d
 
235
        <replaceable>DIRECTORY</replaceable></option></term>
 
236
        <listitem>
 
237
          <para>
 
238
            Target directory for key files.  Default is <filename
 
239
            class="directory">/etc/keys/mandos</filename>.
 
240
          </para>
 
241
        </listitem>
 
242
      </varlistentry>
 
243
      
 
244
      <varlistentry>
 
245
        <term><option>--type
 
246
        <replaceable>TYPE</replaceable></option></term>
 
247
        <term><option>-t
 
248
        <replaceable>TYPE</replaceable></option></term>
 
249
        <listitem>
 
250
          <para>
 
251
            OpenPGP key type.  Default is <quote>RSA</quote>.
 
252
          </para>
 
253
        </listitem>
 
254
      </varlistentry>
 
255
      
 
256
      <varlistentry>
 
257
        <term><option>--length
 
258
        <replaceable>BITS</replaceable></option></term>
 
259
        <term><option>-l
 
260
        <replaceable>BITS</replaceable></option></term>
 
261
        <listitem>
 
262
          <para>
 
263
            OpenPGP key length in bits.  Default is 4096.
 
264
          </para>
 
265
        </listitem>
 
266
      </varlistentry>
 
267
      
 
268
      <varlistentry>
 
269
        <term><option>--subtype
 
270
        <replaceable>KEYTYPE</replaceable></option></term>
 
271
        <term><option>-s
 
272
        <replaceable>KEYTYPE</replaceable></option></term>
 
273
        <listitem>
 
274
          <para>
 
275
            OpenPGP subkey type.  Default is <quote>RSA</quote>
 
276
          </para>
 
277
        </listitem>
 
278
      </varlistentry>
 
279
      
 
280
      <varlistentry>
 
281
        <term><option>--sublength
 
282
        <replaceable>BITS</replaceable></option></term>
 
283
        <term><option>-L
 
284
        <replaceable>BITS</replaceable></option></term>
 
285
        <listitem>
 
286
          <para>
 
287
            OpenPGP subkey length in bits.  Default is 4096.
 
288
          </para>
 
289
        </listitem>
 
290
      </varlistentry>
 
291
      
 
292
      <varlistentry>
 
293
        <term><option>--email
 
294
        <replaceable>ADDRESS</replaceable></option></term>
 
295
        <term><option>-e
 
296
        <replaceable>ADDRESS</replaceable></option></term>
266
297
        <listitem>
267
298
          <para>
268
299
            Email address of key.  Default is empty.
269
300
          </para>
270
301
        </listitem>
271
302
      </varlistentry>
272
 
 
 
303
      
273
304
      <varlistentry>
274
 
        <term><literal>-c</literal>, <literal>--comment</literal>
275
 
        <replaceable>comment</replaceable></term>
 
305
        <term><option>--comment
 
306
        <replaceable>TEXT</replaceable></option></term>
 
307
        <term><option>-c
 
308
        <replaceable>TEXT</replaceable></option></term>
276
309
        <listitem>
277
310
          <para>
278
 
            Comment field for key.  The default value is
279
 
            <quote><literal>Mandos client key</literal></quote>.
 
311
            Comment field for key.  Default is empty.
280
312
          </para>
281
313
        </listitem>
282
314
      </varlistentry>
283
 
 
 
315
      
284
316
      <varlistentry>
285
 
        <term><literal>-x</literal>, <literal>--expire</literal>
286
 
        <replaceable>time</replaceable></term>
 
317
        <term><option>--expire
 
318
        <replaceable>TIME</replaceable></option></term>
 
319
        <term><option>-x
 
320
        <replaceable>TIME</replaceable></option></term>
287
321
        <listitem>
288
322
          <para>
289
323
            Key expire time.  Default is no expiration.  See
292
326
          </para>
293
327
        </listitem>
294
328
      </varlistentry>
295
 
 
296
 
      <varlistentry>
297
 
        <term><literal>-f</literal>, <literal>--force</literal></term>
298
 
        <listitem>
299
 
          <para>
300
 
            Force overwriting old keys.
 
329
      
 
330
      <varlistentry>
 
331
        <term><option>--tls-keytype
 
332
        <replaceable>KEYTYPE</replaceable></option></term>
 
333
        <term><option>-T
 
334
        <replaceable>KEYTYPE</replaceable></option></term>
 
335
        <listitem>
 
336
          <para>
 
337
            TLS key type.  Default is <quote>ed25519</quote>
 
338
          </para>
 
339
        </listitem>
 
340
      </varlistentry>
 
341
      
 
342
      <varlistentry>
 
343
        <term><option>--force</option></term>
 
344
        <term><option>-f</option></term>
 
345
        <listitem>
 
346
          <para>
 
347
            Force overwriting old key.
 
348
          </para>
 
349
        </listitem>
 
350
      </varlistentry>
 
351
      <varlistentry>
 
352
        <term><option>--password</option></term>
 
353
        <term><option>-p</option></term>
 
354
        <listitem>
 
355
          <para>
 
356
            Prompt for a password and encrypt it with the key already
 
357
            present in either <filename>/etc/keys/mandos</filename> or
 
358
            the directory specified with the <option>--dir</option>
 
359
            option.  Outputs, on standard output, a section suitable
 
360
            for inclusion in <citerefentry><refentrytitle
 
361
            >mandos-clients.conf</refentrytitle><manvolnum
 
362
            >8</manvolnum></citerefentry>.  The host name or the name
 
363
            specified with the <option>--name</option> option is used
 
364
            for the section header.  All other options are ignored,
 
365
            and no key is created.
 
366
          </para>
 
367
        </listitem>
 
368
      </varlistentry>
 
369
      <varlistentry>
 
370
        <term><option>--passfile
 
371
        <replaceable>FILE</replaceable></option></term>
 
372
        <term><option>-F
 
373
        <replaceable>FILE</replaceable></option></term>
 
374
        <listitem>
 
375
          <para>
 
376
            The same as <option>--password</option>, but read from
 
377
            <replaceable>FILE</replaceable>, not the terminal.
 
378
          </para>
 
379
        </listitem>
 
380
      </varlistentry>
 
381
      <varlistentry>
 
382
        <term><option>--no-ssh</option></term>
 
383
        <term><option>-S</option></term>
 
384
        <listitem>
 
385
          <para>
 
386
            When <option>--password</option> or
 
387
            <option>--passfile</option> is given, this option will
 
388
            prevent <command>&COMMANDNAME;</command> from calling
 
389
            <command>ssh-keyscan</command> to get an SSH fingerprint
 
390
            for this host and, if successful, output suitable config
 
391
            options to use this fingerprint as a
 
392
            <option>checker</option> option in the output.  This is
 
393
            otherwise the default behavior.
301
394
          </para>
302
395
        </listitem>
303
396
      </varlistentry>
304
397
    </variablelist>
305
398
  </refsect1>
306
 
 
 
399
  
307
400
  <refsect1 id="overview">
308
401
    <title>OVERVIEW</title>
309
402
    <xi:include href="overview.xml"/>
310
403
    <para>
311
 
      This program is a small utility to generate new OpenPGP keys for
312
 
      new Mandos clients.
 
404
      This program is a small utility to generate new TLS and OpenPGP
 
405
      keys for new Mandos clients, and to generate sections for
 
406
      inclusion in <filename>clients.conf</filename> on the server.
313
407
    </para>
314
408
  </refsect1>
315
 
 
 
409
  
316
410
  <refsect1 id="exit_status">
317
411
    <title>EXIT STATUS</title>
318
412
    <para>
319
 
      The exit status will be 0 if new keys were successfully created,
320
 
      otherwise not.
 
413
      The exit status will be 0 if a new key (or password, if the
 
414
      <option>--password</option> option was used) was successfully
 
415
      created, otherwise not.
321
416
    </para>
322
417
  </refsect1>
323
418
  
325
420
    <title>ENVIRONMENT</title>
326
421
    <variablelist>
327
422
      <varlistentry>
328
 
        <term><varname>TMPDIR</varname></term>
 
423
        <term><envar>TMPDIR</envar></term>
329
424
        <listitem>
330
425
          <para>
331
426
            If set, temporary files will be created here. See
337
432
    </variablelist>
338
433
  </refsect1>
339
434
  
340
 
  <refsect1 id="file">
 
435
  <refsect1 id="files">
341
436
    <title>FILES</title>
342
437
    <para>
343
438
      Use the <option>--dir</option> option to change where
346
441
    </para>
347
442
    <variablelist>
348
443
      <varlistentry>
349
 
        <term><filename>/etc/mandos/seckey.txt</filename></term>
 
444
        <term><filename>/etc/keys/mandos/seckey.txt</filename></term>
350
445
        <listitem>
351
446
          <para>
352
447
            OpenPGP secret key file which will be created or
355
450
        </listitem>
356
451
      </varlistentry>
357
452
      <varlistentry>
358
 
        <term><filename>/etc/mandos/pubkey.txt</filename></term>
 
453
        <term><filename>/etc/keys/mandos/pubkey.txt</filename></term>
359
454
        <listitem>
360
455
          <para>
361
456
            OpenPGP public key file which will be created or
364
459
        </listitem>
365
460
      </varlistentry>
366
461
      <varlistentry>
367
 
        <term><filename>/tmp</filename></term>
 
462
        <term><filename>/etc/keys/mandos/tls-privkey.pem</filename></term>
 
463
        <listitem>
 
464
          <para>
 
465
            Private key file which will be created or overwritten.
 
466
          </para>
 
467
        </listitem>
 
468
      </varlistentry>
 
469
      <varlistentry>
 
470
        <term><filename>/etc/keys/mandos/tls-pubkey.pem</filename></term>
 
471
        <listitem>
 
472
          <para>
 
473
            Public key file which will be created or overwritten.
 
474
          </para>
 
475
        </listitem>
 
476
      </varlistentry>
 
477
      <varlistentry>
 
478
        <term><filename class="directory">/tmp</filename></term>
368
479
        <listitem>
369
480
          <para>
370
481
            Temporary files will be written here if
374
485
      </varlistentry>
375
486
    </variablelist>
376
487
  </refsect1>
377
 
 
 
488
  
378
489
  <refsect1 id="bugs">
379
490
    <title>BUGS</title>
380
 
    <para>
381
 
      None are known at this time.
382
 
    </para>
 
491
    <xi:include href="bugs.xml"/>
383
492
  </refsect1>
384
 
 
 
493
  
385
494
  <refsect1 id="example">
386
495
    <title>EXAMPLE</title>
387
496
    <informalexample>
389
498
        Normal invocation needs no options:
390
499
      </para>
391
500
      <para>
392
 
        <userinput>mandos-keygen</userinput>
 
501
        <userinput>&COMMANDNAME;</userinput>
393
502
      </para>
394
503
    </informalexample>
395
504
    <informalexample>
396
505
      <para>
397
 
        Create keys in another directory and of another type.  Force
 
506
        Create key in another directory and of another type.  Force
398
507
        overwriting old key files:
399
508
      </para>
400
509
      <para>
401
510
 
402
511
<!-- do not wrap this line -->
403
 
<userinput>mandos-keygen --dir ~/keydir --type RSA --force</userinput>
 
512
<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>
 
513
 
 
514
      </para>
 
515
    </informalexample>
 
516
    <informalexample>
 
517
      <para>
 
518
        Prompt for a password, encrypt it with the keys in <filename
 
519
        class="directory">/etc/keys/mandos</filename> and output a
 
520
        section suitable for <filename>clients.conf</filename>.
 
521
      </para>
 
522
      <para>
 
523
        <userinput>&COMMANDNAME; --password</userinput>
 
524
      </para>
 
525
    </informalexample>
 
526
    <informalexample>
 
527
      <para>
 
528
        Prompt for a password, encrypt it with the keys in the
 
529
        <filename>client-key</filename> directory and output a section
 
530
        suitable for <filename>clients.conf</filename>.
 
531
      </para>
 
532
      <para>
 
533
 
 
534
<!-- do not wrap this line -->
 
535
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
404
536
 
405
537
      </para>
406
538
    </informalexample>
407
539
  </refsect1>
408
 
 
 
540
  
409
541
  <refsect1 id="security">
410
542
    <title>SECURITY</title>
411
543
    <para>
412
544
      The <option>--type</option>, <option>--length</option>,
413
545
      <option>--subtype</option>, and <option>--sublength</option>
414
 
      options can be used to create keys of insufficient security.  If
415
 
      in doubt, leave them to the default values.
 
546
      options can be used to create keys of low security.  If in
 
547
      doubt, leave them to the default values.
416
548
    </para>
417
549
    <para>
418
 
      The key expire time is not guaranteed to be honored by
419
 
      <citerefentry><refentrytitle>mandos</refentrytitle>
 
550
      The key expire time is <emphasis>not</emphasis> guaranteed to be
 
551
      honored by <citerefentry><refentrytitle>mandos</refentrytitle>
420
552
      <manvolnum>8</manvolnum></citerefentry>.
421
553
    </para>
422
554
  </refsect1>
423
 
 
 
555
  
424
556
  <refsect1 id="see_also">
425
557
    <title>SEE ALSO</title>
426
558
    <para>
427
 
      <citerefentry><refentrytitle>password-request</refentrytitle>
 
559
      <citerefentry><refentrytitle>intro</refentrytitle>
428
560
      <manvolnum>8mandos</manvolnum></citerefentry>,
 
561
      <citerefentry><refentrytitle>gpg</refentrytitle>
 
562
      <manvolnum>1</manvolnum></citerefentry>,
 
563
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
 
564
      <manvolnum>5</manvolnum></citerefentry>,
429
565
      <citerefentry><refentrytitle>mandos</refentrytitle>
430
566
      <manvolnum>8</manvolnum></citerefentry>,
431
 
      <citerefentry><refentrytitle>gpg</refentrytitle>
 
567
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
 
568
      <manvolnum>8mandos</manvolnum></citerefentry>,
 
569
      <citerefentry><refentrytitle>ssh-keyscan</refentrytitle>
432
570
      <manvolnum>1</manvolnum></citerefentry>
433
571
    </para>
434
572
  </refsect1>
435
573
  
436
574
</refentry>
 
575
<!-- Local Variables: -->
 
576
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
 
577
<!-- time-stamp-end: "[\"']>" -->
 
578
<!-- time-stamp-format: "%:y-%02m-%02d" -->
 
579
<!-- End: -->