/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos-keygen.xml

  • Committer: Teddy Hogeborn
  • Date: 2019-02-10 03:50:20 UTC
  • mto: (237.7.594 trunk)
  • mto: This revision was merged to the branch mainline in revision 370.
  • Revision ID: teddy@recompile.se-20190210035020-nttr1tybgwwixueu
http://bugs.debian.org/879538
http://bugs.debian.org/916673
Show debconf note about new TLS key IDs

If mandos-client did not see TLS keys and had to create them, or if
mandos sees GnuTLS version 3.6.6 or later, show an important notice on
package installation about the importance of adding the new key_id
options to clients.conf on the Mandos server.

* debian/control (Package: mandos, Package: mandos-client): Depend on
                                                            debconf.
* debian/mandos-client.lintian-overrides: Override warnings.
* debian/mandos-client.postinst (create_keys): Show notice if new TLS
                                               key files were created.
* debian/mandos-client.templates: New.
* debian/mandos.lintian-overrides: Override warnings.
* debian/mandos.postinst (configure): If GnuTLS 3.6.6 or later is
                                      detected, show an important
                                      notice (once) about the new
                                      key_id option required in
                                      clients.conf.
* debian/mandos.templates: New.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-keygen.xml
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY COMMANDNAME "mandos-keygen">
5
 
<!ENTITY TIMESTAMP "2014-06-22">
 
5
<!ENTITY TIMESTAMP "2019-02-10">
6
6
<!ENTITY % common SYSTEM "common.ent">
7
7
%common;
8
8
]>
33
33
    <copyright>
34
34
      <year>2008</year>
35
35
      <year>2009</year>
 
36
      <year>2010</year>
36
37
      <year>2011</year>
37
38
      <year>2012</year>
 
39
      <year>2013</year>
 
40
      <year>2014</year>
 
41
      <year>2015</year>
 
42
      <year>2016</year>
 
43
      <year>2017</year>
 
44
      <year>2018</year>
38
45
      <holder>Teddy Hogeborn</holder>
39
46
      <holder>Björn Påhlsson</holder>
40
47
    </copyright>
120
127
      </group>
121
128
      <sbr/>
122
129
      <group>
 
130
        <arg choice="plain"><option>--tls-keytype
 
131
        <replaceable>KEYTYPE</replaceable></option></arg>
 
132
        <arg choice="plain"><option>-T
 
133
        <replaceable>KEYTYPE</replaceable></option></arg>
 
134
      </group>
 
135
      <sbr/>
 
136
      <group>
123
137
        <arg choice="plain"><option>--force</option></arg>
124
138
        <arg choice="plain"><option>-f</option></arg>
125
139
      </group>
173
187
    <title>DESCRIPTION</title>
174
188
    <para>
175
189
      <command>&COMMANDNAME;</command> is a program to generate the
176
 
      OpenPGP key used by
 
190
      TLS and OpenPGP keys used by
177
191
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
178
 
      <manvolnum>8mandos</manvolnum></citerefentry>.  The key is
179
 
      normally written to /etc/mandos for later installation into the
180
 
      initrd image, but this, and most other things, can be changed
181
 
      with command line options.
 
192
      <manvolnum>8mandos</manvolnum></citerefentry>.  The keys are
 
193
      normally written to /etc/keys/mandos for later installation into
 
194
      the initrd image, but this, and most other things, can be
 
195
      changed with command line options.
182
196
    </para>
183
197
    <para>
184
198
      This program can also be used with the
221
235
        <replaceable>DIRECTORY</replaceable></option></term>
222
236
        <listitem>
223
237
          <para>
224
 
            Target directory for key files.  Default is
225
 
            <filename class="directory">/etc/mandos</filename>.
 
238
            Target directory for key files.  Default is <filename
 
239
            class="directory">/etc/keys/mandos</filename>.
226
240
          </para>
227
241
        </listitem>
228
242
      </varlistentry>
234
248
        <replaceable>TYPE</replaceable></option></term>
235
249
        <listitem>
236
250
          <para>
237
 
            Key type.  Default is <quote>RSA</quote>.
 
251
            OpenPGP key type.  Default is <quote>RSA</quote>.
238
252
          </para>
239
253
        </listitem>
240
254
      </varlistentry>
246
260
        <replaceable>BITS</replaceable></option></term>
247
261
        <listitem>
248
262
          <para>
249
 
            Key length in bits.  Default is 4096.
 
263
            OpenPGP key length in bits.  Default is 4096.
250
264
          </para>
251
265
        </listitem>
252
266
      </varlistentry>
258
272
        <replaceable>KEYTYPE</replaceable></option></term>
259
273
        <listitem>
260
274
          <para>
261
 
            Subkey type.  Default is <quote>RSA</quote> (Elgamal
262
 
            encryption-only).
 
275
            OpenPGP subkey type.  Default is <quote>RSA</quote>
263
276
          </para>
264
277
        </listitem>
265
278
      </varlistentry>
271
284
        <replaceable>BITS</replaceable></option></term>
272
285
        <listitem>
273
286
          <para>
274
 
            Subkey length in bits.  Default is 4096.
 
287
            OpenPGP subkey length in bits.  Default is 4096.
275
288
          </para>
276
289
        </listitem>
277
290
      </varlistentry>
315
328
      </varlistentry>
316
329
      
317
330
      <varlistentry>
 
331
        <term><option>--tls-keytype
 
332
        <replaceable>KEYTYPE</replaceable></option></term>
 
333
        <term><option>-T
 
334
        <replaceable>KEYTYPE</replaceable></option></term>
 
335
        <listitem>
 
336
          <para>
 
337
            TLS key type.  Default is <quote>ed25519</quote>
 
338
          </para>
 
339
        </listitem>
 
340
      </varlistentry>
 
341
      
 
342
      <varlistentry>
318
343
        <term><option>--force</option></term>
319
344
        <term><option>-f</option></term>
320
345
        <listitem>
329
354
        <listitem>
330
355
          <para>
331
356
            Prompt for a password and encrypt it with the key already
332
 
            present in either <filename>/etc/mandos</filename> or the
333
 
            directory specified with the <option>--dir</option>
 
357
            present in either <filename>/etc/keys/mandos</filename> or
 
358
            the directory specified with the <option>--dir</option>
334
359
            option.  Outputs, on standard output, a section suitable
335
360
            for inclusion in <citerefentry><refentrytitle
336
361
            >mandos-clients.conf</refentrytitle><manvolnum
376
401
    <title>OVERVIEW</title>
377
402
    <xi:include href="overview.xml"/>
378
403
    <para>
379
 
      This program is a small utility to generate new OpenPGP keys for
380
 
      new Mandos clients, and to generate sections for inclusion in
381
 
      <filename>clients.conf</filename> on the server.
 
404
      This program is a small utility to generate new TLS and OpenPGP
 
405
      keys for new Mandos clients, and to generate sections for
 
406
      inclusion in <filename>clients.conf</filename> on the server.
382
407
    </para>
383
408
  </refsect1>
384
409
  
416
441
    </para>
417
442
    <variablelist>
418
443
      <varlistentry>
419
 
        <term><filename>/etc/mandos/seckey.txt</filename></term>
 
444
        <term><filename>/etc/keys/mandos/seckey.txt</filename></term>
420
445
        <listitem>
421
446
          <para>
422
447
            OpenPGP secret key file which will be created or
425
450
        </listitem>
426
451
      </varlistentry>
427
452
      <varlistentry>
428
 
        <term><filename>/etc/mandos/pubkey.txt</filename></term>
 
453
        <term><filename>/etc/keys/mandos/pubkey.txt</filename></term>
429
454
        <listitem>
430
455
          <para>
431
456
            OpenPGP public key file which will be created or
434
459
        </listitem>
435
460
      </varlistentry>
436
461
      <varlistentry>
 
462
        <term><filename>/etc/keys/mandos/tls-privkey.pem</filename></term>
 
463
        <listitem>
 
464
          <para>
 
465
            Private key file which will be created or overwritten.
 
466
          </para>
 
467
        </listitem>
 
468
      </varlistentry>
 
469
      <varlistentry>
 
470
        <term><filename>/etc/keys/mandos/tls-pubkey.pem</filename></term>
 
471
        <listitem>
 
472
          <para>
 
473
            Public key file which will be created or overwritten.
 
474
          </para>
 
475
        </listitem>
 
476
      </varlistentry>
 
477
      <varlistentry>
437
478
        <term><filename class="directory">/tmp</filename></term>
438
479
        <listitem>
439
480
          <para>
445
486
    </variablelist>
446
487
  </refsect1>
447
488
  
448
 
<!--   <refsect1 id="bugs"> -->
449
 
<!--     <title>BUGS</title> -->
450
 
<!--     <para> -->
451
 
<!--     </para> -->
452
 
<!--   </refsect1> -->
 
489
  <refsect1 id="bugs">
 
490
    <title>BUGS</title>
 
491
    <xi:include href="bugs.xml"/>
 
492
  </refsect1>
453
493
  
454
494
  <refsect1 id="example">
455
495
    <title>EXAMPLE</title>
475
515
    </informalexample>
476
516
    <informalexample>
477
517
      <para>
478
 
        Prompt for a password, encrypt it with the key in <filename
479
 
        class="directory">/etc/mandos</filename> and output a section
480
 
        suitable for <filename>clients.conf</filename>.
 
518
        Prompt for a password, encrypt it with the keys in <filename
 
519
        class="directory">/etc/keys/mandos</filename> and output a
 
520
        section suitable for <filename>clients.conf</filename>.
481
521
      </para>
482
522
      <para>
483
523
        <userinput>&COMMANDNAME; --password</userinput>
485
525
    </informalexample>
486
526
    <informalexample>
487
527
      <para>
488
 
        Prompt for a password, encrypt it with the key in the
 
528
        Prompt for a password, encrypt it with the keys in the
489
529
        <filename>client-key</filename> directory and output a section
490
530
        suitable for <filename>clients.conf</filename>.
491
531
      </para>