46
66
<refname><command>&COMMANDNAME;</command></refname>
48
Generate key and password for Mandos client and server.
68
Generate keys for <citerefentry><refentrytitle>password-request
69
</refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
54
75
<command>&COMMANDNAME;</command>
56
<arg choice="plain"><option>--dir
57
<replaceable>DIRECTORY</replaceable></option></arg>
58
<arg choice="plain"><option>-d
59
<replaceable>DIRECTORY</replaceable></option></arg>
63
<arg choice="plain"><option>--type
64
<replaceable>KEYTYPE</replaceable></option></arg>
65
<arg choice="plain"><option>-t
66
<replaceable>KEYTYPE</replaceable></option></arg>
70
<arg choice="plain"><option>--length
71
<replaceable>BITS</replaceable></option></arg>
72
<arg choice="plain"><option>-l
73
<replaceable>BITS</replaceable></option></arg>
77
<arg choice="plain"><option>--subtype
78
<replaceable>KEYTYPE</replaceable></option></arg>
79
<arg choice="plain"><option>-s
80
<replaceable>KEYTYPE</replaceable></option></arg>
84
<arg choice="plain"><option>--sublength
85
<replaceable>BITS</replaceable></option></arg>
86
<arg choice="plain"><option>-L
87
<replaceable>BITS</replaceable></option></arg>
91
<arg choice="plain"><option>--name
92
<replaceable>NAME</replaceable></option></arg>
93
<arg choice="plain"><option>-n
94
<replaceable>NAME</replaceable></option></arg>
98
<arg choice="plain"><option>--email
99
<replaceable>ADDRESS</replaceable></option></arg>
100
<arg choice="plain"><option>-e
101
<replaceable>ADDRESS</replaceable></option></arg>
105
<arg choice="plain"><option>--comment
106
<replaceable>TEXT</replaceable></option></arg>
107
<arg choice="plain"><option>-c
108
<replaceable>TEXT</replaceable></option></arg>
112
<arg choice="plain"><option>--expire
113
<replaceable>TIME</replaceable></option></arg>
114
<arg choice="plain"><option>-x
115
<replaceable>TIME</replaceable></option></arg>
118
<arg><option>--force</option></arg>
121
<command>&COMMANDNAME;</command>
123
<arg choice="plain"><option>--password</option></arg>
124
<arg choice="plain"><option>-p</option></arg>
125
<arg choice="plain"><option>--passfile
126
<replaceable>FILE</replaceable></option></arg>
127
<arg choice="plain"><option>-F</option>
128
<replaceable>FILE</replaceable></arg>
132
<arg choice="plain"><option>--dir
133
<replaceable>DIRECTORY</replaceable></option></arg>
134
<arg choice="plain"><option>-d
135
<replaceable>DIRECTORY</replaceable></option></arg>
139
<arg choice="plain"><option>--name
140
<replaceable>NAME</replaceable></option></arg>
141
<arg choice="plain"><option>-n
142
<replaceable>NAME</replaceable></option></arg>
146
<command>&COMMANDNAME;</command>
77
<arg choice="plain"><option>--dir</option>
78
<replaceable>directory</replaceable></arg>
81
<arg choice="plain"><option>--type</option>
82
<replaceable>type</replaceable></arg>
85
<arg choice="plain"><option>--length</option>
86
<replaceable>bits</replaceable></arg>
89
<arg choice="plain"><option>--subtype</option>
90
<replaceable>type</replaceable></arg>
93
<arg choice="plain"><option>--sublength</option>
94
<replaceable>bits</replaceable></arg>
97
<arg choice="plain"><option>--name</option>
98
<replaceable>NAME</replaceable></arg>
101
<arg choice="plain"><option>--email</option>
102
<replaceable>EMAIL</replaceable></arg>
105
<arg choice="plain"><option>--comment</option>
106
<replaceable>COMMENT</replaceable></arg>
109
<arg choice="plain"><option>--expire</option>
110
<replaceable>TIME</replaceable></arg>
113
<arg choice="plain"><option>--force</option></arg>
117
<command>&COMMANDNAME;</command>
119
<arg choice="plain"><option>-d</option>
120
<replaceable>directory</replaceable></arg>
123
<arg choice="plain"><option>-t</option>
124
<replaceable>type</replaceable></arg>
127
<arg choice="plain"><option>-l</option>
128
<replaceable>bits</replaceable></arg>
131
<arg choice="plain"><option>-s</option>
132
<replaceable>type</replaceable></arg>
135
<arg choice="plain"><option>-L</option>
136
<replaceable>bits</replaceable></arg>
139
<arg choice="plain"><option>-n</option>
140
<replaceable>NAME</replaceable></arg>
143
<arg choice="plain"><option>-e</option>
144
<replaceable>EMAIL</replaceable></arg>
147
<arg choice="plain"><option>-c</option>
148
<replaceable>COMMENT</replaceable></arg>
151
<arg choice="plain"><option>-x</option>
152
<replaceable>TIME</replaceable></arg>
155
<arg choice="plain"><option>-f</option></arg>
159
<command>&COMMANDNAME;</command>
161
<arg choice="plain"><option>-h</option></arg>
148
162
<arg choice="plain"><option>--help</option></arg>
149
<arg choice="plain"><option>-h</option></arg>
153
166
<command>&COMMANDNAME;</command>
154
167
<group choice="req">
168
<arg choice="plain"><option>-v</option></arg>
155
169
<arg choice="plain"><option>--version</option></arg>
156
<arg choice="plain"><option>-v</option></arg>
159
172
</refsynopsisdiv>
161
174
<refsect1 id="description">
162
175
<title>DESCRIPTION</title>
164
177
<command>&COMMANDNAME;</command> is a program to generate the
166
<citerefentry><refentrytitle>mandos-client</refentrytitle>
167
<manvolnum>8mandos</manvolnum></citerefentry>. The key is
179
<citerefentry><refentrytitle>password-request</refentrytitle>
180
<manvolnum>8mandos</manvolnum></citerefentry>. The keys are
168
181
normally written to /etc/mandos for later installation into the
169
initrd image, but this, and most other things, can be changed
170
with command line options.
173
This program can also be used with the
174
<option>--password</option> or <option>--passfile</option>
175
options to generate a ready-made section for
176
<filename>clients.conf</filename> (see
177
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
178
<manvolnum>5</manvolnum></citerefentry>).
182
initrd image, but this, like most things, can be changed with
183
command line options.
182
187
<refsect1 id="purpose">
183
188
<title>PURPOSE</title>
185
191
The purpose of this is to enable <emphasis>remote and unattended
186
192
rebooting</emphasis> of client host computer with an
187
193
<emphasis>encrypted root file system</emphasis>. See <xref
188
194
linkend="overview"/> for details.
192
199
<refsect1 id="options">
193
200
<title>OPTIONS</title>
197
<term><option>--help</option></term>
198
<term><option>-h</option></term>
204
<term><literal>-h</literal>, <literal>--help</literal></term>
201
207
Show a help message and exit
208
<replaceable>DIRECTORY</replaceable></option></term>
210
<replaceable>DIRECTORY</replaceable></option></term>
213
<term><literal>-d</literal>, <literal>--dir
214
<replaceable>directory</replaceable></literal></term>
213
Target directory for key files. Default is
214
<filename>/etc/mandos</filename>.
217
Target directory for key files.
221
<replaceable>TYPE</replaceable></option></term>
223
<replaceable>TYPE</replaceable></option></term>
223
<term><literal>-t</literal>, <literal>--type
224
<replaceable>type</replaceable></literal></term>
226
227
Key type. Default is <quote>DSA</quote>.
232
<term><option>--length
233
<replaceable>BITS</replaceable></option></term>
235
<replaceable>BITS</replaceable></option></term>
233
<term><literal>-l</literal>, <literal>--length
234
<replaceable>bits</replaceable></literal></term>
238
Key length in bits. Default is 2048.
237
Key length in bits. Default is 1024.
244
<term><option>--subtype
245
<replaceable>KEYTYPE</replaceable></option></term>
247
<replaceable>KEYTYPE</replaceable></option></term>
243
<term><literal>-s</literal>, <literal>--subtype
244
<replaceable>type</replaceable></literal></term>
250
247
Subkey type. Default is <quote>ELG-E</quote> (Elgamal
308
<term><option>--force</option></term>
309
<term><option>-f</option></term>
312
Force overwriting old key.
317
<term><option>--password</option></term>
318
<term><option>-p</option></term>
321
Prompt for a password and encrypt it with the key already
322
present in either <filename>/etc/mandos</filename> or the
323
directory specified with the <option>--dir</option>
324
option. Outputs, on standard output, a section suitable
325
for inclusion in <citerefentry><refentrytitle
326
>mandos-clients.conf</refentrytitle><manvolnum
327
>8</manvolnum></citerefentry>. The host name or the name
328
specified with the <option>--name</option> option is used
329
for the section header. All other options are ignored,
330
and no key is created.
335
<term><option>--passfile
336
<replaceable>FILE</replaceable></option></term>
338
<replaceable>FILE</replaceable></option></term>
341
The same as <option>--password</option>, but read from
342
<replaceable>FILE</replaceable>, not the terminal.
297
<term><literal>-f</literal>, <literal>--force</literal></term>
300
Force overwriting old keys.
349
307
<refsect1 id="overview">
350
308
<title>OVERVIEW</title>
351
309
<xi:include href="overview.xml"/>
353
311
This program is a small utility to generate new OpenPGP keys for
354
new Mandos clients, and to generate sections for inclusion in
355
<filename>clients.conf</filename> on the server.
359
316
<refsect1 id="exit_status">
360
317
<title>EXIT STATUS</title>
362
The exit status will be 0 if a new key (or password, if the
363
<option>--password</option> option was used) was successfully
364
created, otherwise not.
319
The exit status will be 0 if new keys were successfully created,
432
389
Normal invocation needs no options:
435
<userinput>&COMMANDNAME;</userinput>
392
<userinput>mandos-keygen</userinput>
437
394
</informalexample>
438
395
<informalexample>
440
Create key in another directory and of another type. Force
397
Create keys in another directory and of another type. Force
441
398
overwriting old key files:
445
402
<!-- do not wrap this line -->
446
<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>
452
Prompt for a password, encrypt it with the key in
453
<filename>/etc/mandos</filename> and output a section suitable
454
for <filename>clients.conf</filename>.
457
<userinput>&COMMANDNAME; --password</userinput>
462
Prompt for a password, encrypt it with the key in the
463
<filename>client-key</filename> directory and output a section
464
suitable for <filename>clients.conf</filename>.
468
<!-- do not wrap this line -->
469
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
403
<userinput>mandos-keygen --dir ~/keydir --type RSA --force</userinput>
472
406
</informalexample>
475
409
<refsect1 id="security">
476
410
<title>SECURITY</title>
478
412
The <option>--type</option>, <option>--length</option>,
479
413
<option>--subtype</option>, and <option>--sublength</option>
480
options can be used to create keys of low security. If in
481
doubt, leave them to the default values.
414
options can be used to create keys of insufficient security. If
415
in doubt, leave them to the default values.
484
The key expire time is <emphasis>not</emphasis> guaranteed to be
485
honored by <citerefentry><refentrytitle>mandos</refentrytitle>
418
The key expire time is not guaranteed to be honored by
419
<citerefentry><refentrytitle>mandos</refentrytitle>
486
420
<manvolnum>8</manvolnum></citerefentry>.
490
424
<refsect1 id="see_also">
491
425
<title>SEE ALSO</title>
427
<citerefentry><refentrytitle>password-request</refentrytitle>
428
<manvolnum>8mandos</manvolnum></citerefentry>,
429
<citerefentry><refentrytitle>mandos</refentrytitle>
430
<manvolnum>8</manvolnum></citerefentry>,
493
431
<citerefentry><refentrytitle>gpg</refentrytitle>
494
<manvolnum>1</manvolnum></citerefentry>,
495
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
496
<manvolnum>5</manvolnum></citerefentry>,
497
<citerefentry><refentrytitle>mandos</refentrytitle>
498
<manvolnum>8</manvolnum></citerefentry>,
499
<citerefentry><refentrytitle>mandos-client</refentrytitle>
500
<manvolnum>8mandos</manvolnum></citerefentry>
432
<manvolnum>1</manvolnum></citerefentry>
505
<!-- Local Variables: -->
506
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
507
<!-- time-stamp-end: "[\"']>" -->
508
<!-- time-stamp-format: "%:y-%02m-%02d" -->