/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos-keygen.xml

merge

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-keygen.xml
1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
 
4
<!ENTITY VERSION "1.0">
4
5
<!ENTITY COMMANDNAME "mandos-keygen">
5
 
<!ENTITY TIMESTAMP "2015-07-20">
6
 
<!ENTITY % common SYSTEM "common.ent">
7
 
%common;
8
6
]>
9
7
 
10
8
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
11
9
  <refentryinfo>
12
 
    <title>Mandos Manual</title>
 
10
    <title>&COMMANDNAME;</title>
13
11
    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
14
 
    <productname>Mandos</productname>
15
 
    <productnumber>&version;</productnumber>
16
 
    <date>&TIMESTAMP;</date>
 
12
    <productname>&COMMANDNAME;</productname>
 
13
    <productnumber>&VERSION;</productnumber>
17
14
    <authorgroup>
18
15
      <author>
19
16
        <firstname>Björn</firstname>
20
17
        <surname>Påhlsson</surname>
21
18
        <address>
22
 
          <email>belorn@recompile.se</email>
 
19
          <email>belorn@fukt.bsnet.se</email>
23
20
        </address>
24
21
      </author>
25
22
      <author>
26
23
        <firstname>Teddy</firstname>
27
24
        <surname>Hogeborn</surname>
28
25
        <address>
29
 
          <email>teddy@recompile.se</email>
 
26
          <email>teddy@fukt.bsnet.se</email>
30
27
        </address>
31
28
      </author>
32
29
    </authorgroup>
33
30
    <copyright>
34
31
      <year>2008</year>
35
 
      <year>2009</year>
36
 
      <year>2010</year>
37
 
      <year>2011</year>
38
 
      <year>2012</year>
39
 
      <year>2013</year>
40
 
      <year>2014</year>
41
 
      <year>2015</year>
42
32
      <holder>Teddy Hogeborn</holder>
43
33
      <holder>Björn Påhlsson</holder>
44
34
    </copyright>
45
 
    <xi:include href="legalnotice.xml"/>
 
35
    <legalnotice>
 
36
      <para>
 
37
        This manual page is free software: you can redistribute it
 
38
        and/or modify it under the terms of the GNU General Public
 
39
        License as published by the Free Software Foundation,
 
40
        either version 3 of the License, or (at your option) any
 
41
        later version.
 
42
      </para>
 
43
 
 
44
      <para>
 
45
        This manual page is distributed in the hope that it will
 
46
        be useful, but WITHOUT ANY WARRANTY; without even the
 
47
        implied warranty of MERCHANTABILITY or FITNESS FOR A
 
48
        PARTICULAR PURPOSE.  See the GNU General Public License
 
49
        for more details.
 
50
      </para>
 
51
 
 
52
      <para>
 
53
        You should have received a copy of the GNU General Public
 
54
        License along with this program; If not, see
 
55
        <ulink url="http://www.gnu.org/licenses/"/>.
 
56
      </para>
 
57
    </legalnotice>
46
58
  </refentryinfo>
47
 
  
 
59
 
48
60
  <refmeta>
49
61
    <refentrytitle>&COMMANDNAME;</refentrytitle>
50
62
    <manvolnum>8</manvolnum>
53
65
  <refnamediv>
54
66
    <refname><command>&COMMANDNAME;</command></refname>
55
67
    <refpurpose>
56
 
      Generate key and password for Mandos client and server.
 
68
      Generate keys for <citerefentry><refentrytitle>password-request
 
69
      </refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
57
70
    </refpurpose>
58
71
  </refnamediv>
59
 
  
 
72
 
60
73
  <refsynopsisdiv>
61
74
    <cmdsynopsis>
62
75
      <command>&COMMANDNAME;</command>
63
 
      <group>
64
 
        <arg choice="plain"><option>--dir
65
 
        <replaceable>DIRECTORY</replaceable></option></arg>
66
 
        <arg choice="plain"><option>-d
67
 
        <replaceable>DIRECTORY</replaceable></option></arg>
68
 
      </group>
69
 
      <sbr/>
70
 
      <group>
71
 
        <arg choice="plain"><option>--type
72
 
        <replaceable>KEYTYPE</replaceable></option></arg>
73
 
        <arg choice="plain"><option>-t
74
 
        <replaceable>KEYTYPE</replaceable></option></arg>
75
 
      </group>
76
 
      <sbr/>
77
 
      <group>
78
 
        <arg choice="plain"><option>--length
79
 
        <replaceable>BITS</replaceable></option></arg>
80
 
        <arg choice="plain"><option>-l
81
 
        <replaceable>BITS</replaceable></option></arg>
82
 
      </group>
83
 
      <sbr/>
84
 
      <group>
85
 
        <arg choice="plain"><option>--subtype
86
 
        <replaceable>KEYTYPE</replaceable></option></arg>
87
 
        <arg choice="plain"><option>-s
88
 
        <replaceable>KEYTYPE</replaceable></option></arg>
89
 
      </group>
90
 
      <sbr/>
91
 
      <group>
92
 
        <arg choice="plain"><option>--sublength
93
 
        <replaceable>BITS</replaceable></option></arg>
94
 
        <arg choice="plain"><option>-L
95
 
        <replaceable>BITS</replaceable></option></arg>
96
 
      </group>
97
 
      <sbr/>
98
 
      <group>
99
 
        <arg choice="plain"><option>--name
100
 
        <replaceable>NAME</replaceable></option></arg>
101
 
        <arg choice="plain"><option>-n
102
 
        <replaceable>NAME</replaceable></option></arg>
103
 
      </group>
104
 
      <sbr/>
105
 
      <group>
106
 
        <arg choice="plain"><option>--email
107
 
        <replaceable>ADDRESS</replaceable></option></arg>
108
 
        <arg choice="plain"><option>-e
109
 
        <replaceable>ADDRESS</replaceable></option></arg>
110
 
      </group>
111
 
      <sbr/>
112
 
      <group>
113
 
        <arg choice="plain"><option>--comment
114
 
        <replaceable>TEXT</replaceable></option></arg>
115
 
        <arg choice="plain"><option>-c
116
 
        <replaceable>TEXT</replaceable></option></arg>
117
 
      </group>
118
 
      <sbr/>
119
 
      <group>
120
 
        <arg choice="plain"><option>--expire
121
 
        <replaceable>TIME</replaceable></option></arg>
122
 
        <arg choice="plain"><option>-x
123
 
        <replaceable>TIME</replaceable></option></arg>
124
 
      </group>
125
 
      <sbr/>
126
 
      <group>
 
76
      <group choice="opt">
 
77
        <arg choice="plain"><option>--dir</option>
 
78
        <replaceable>directory</replaceable></arg>
 
79
      </group>
 
80
      <group choice="opt">
 
81
        <arg choice="plain"><option>--type</option>
 
82
        <replaceable>type</replaceable></arg>
 
83
      </group>
 
84
      <group choice="opt">
 
85
        <arg choice="plain"><option>--length</option>
 
86
        <replaceable>bits</replaceable></arg>
 
87
      </group>
 
88
      <group choice="opt">
 
89
        <arg choice="plain"><option>--subtype</option>
 
90
        <replaceable>type</replaceable></arg>
 
91
      </group>
 
92
      <group choice="opt">
 
93
        <arg choice="plain"><option>--sublength</option>
 
94
        <replaceable>bits</replaceable></arg>
 
95
      </group>
 
96
      <group choice="opt">
 
97
        <arg choice="plain"><option>--name</option>
 
98
        <replaceable>NAME</replaceable></arg>
 
99
      </group>
 
100
      <group choice="opt">
 
101
        <arg choice="plain"><option>--email</option>
 
102
        <replaceable>EMAIL</replaceable></arg>
 
103
      </group>
 
104
      <group choice="opt">
 
105
        <arg choice="plain"><option>--comment</option>
 
106
        <replaceable>COMMENT</replaceable></arg>
 
107
      </group>
 
108
      <group choice="opt">
 
109
        <arg choice="plain"><option>--expire</option>
 
110
        <replaceable>TIME</replaceable></arg>
 
111
      </group>
 
112
      <group choice="opt">
127
113
        <arg choice="plain"><option>--force</option></arg>
 
114
      </group>
 
115
    </cmdsynopsis>
 
116
    <cmdsynopsis>
 
117
      <command>&COMMANDNAME;</command>
 
118
      <group choice="opt">
 
119
        <arg choice="plain"><option>-d</option>
 
120
        <replaceable>directory</replaceable></arg>
 
121
      </group>
 
122
      <group choice="opt">
 
123
        <arg choice="plain"><option>-t</option>
 
124
        <replaceable>type</replaceable></arg>
 
125
      </group>
 
126
      <group choice="opt">
 
127
        <arg choice="plain"><option>-l</option>
 
128
        <replaceable>bits</replaceable></arg>
 
129
      </group>
 
130
      <group choice="opt">
 
131
        <arg choice="plain"><option>-s</option>
 
132
        <replaceable>type</replaceable></arg>
 
133
      </group>
 
134
      <group choice="opt">
 
135
        <arg choice="plain"><option>-L</option>
 
136
        <replaceable>bits</replaceable></arg>
 
137
      </group>
 
138
      <group choice="opt">
 
139
        <arg choice="plain"><option>-n</option>
 
140
        <replaceable>NAME</replaceable></arg>
 
141
      </group>
 
142
      <group choice="opt">
 
143
        <arg choice="plain"><option>-e</option>
 
144
        <replaceable>EMAIL</replaceable></arg>
 
145
      </group>
 
146
      <group choice="opt">
 
147
        <arg choice="plain"><option>-c</option>
 
148
        <replaceable>COMMENT</replaceable></arg>
 
149
      </group>
 
150
      <group choice="opt">
 
151
        <arg choice="plain"><option>-x</option>
 
152
        <replaceable>TIME</replaceable></arg>
 
153
      </group>
 
154
      <group choice="opt">
128
155
        <arg choice="plain"><option>-f</option></arg>
129
156
      </group>
130
157
    </cmdsynopsis>
131
158
    <cmdsynopsis>
132
159
      <command>&COMMANDNAME;</command>
133
160
      <group choice="req">
134
 
        <arg choice="plain"><option>--password</option></arg>
135
 
        <arg choice="plain"><option>-p</option></arg>
136
 
        <arg choice="plain"><option>--passfile
137
 
        <replaceable>FILE</replaceable></option></arg>
138
 
        <arg choice="plain"><option>-F</option>
139
 
        <replaceable>FILE</replaceable></arg>
140
 
      </group>
141
 
      <sbr/>
142
 
      <group>
143
 
        <arg choice="plain"><option>--dir
144
 
        <replaceable>DIRECTORY</replaceable></option></arg>
145
 
        <arg choice="plain"><option>-d
146
 
        <replaceable>DIRECTORY</replaceable></option></arg>
147
 
      </group>
148
 
      <sbr/>
149
 
      <group>
150
 
        <arg choice="plain"><option>--name
151
 
        <replaceable>NAME</replaceable></option></arg>
152
 
        <arg choice="plain"><option>-n
153
 
        <replaceable>NAME</replaceable></option></arg>
154
 
      </group>
155
 
      <group>
156
 
        <arg choice="plain"><option>--no-ssh</option></arg>
157
 
        <arg choice="plain"><option>-S</option></arg>
158
 
      </group>
159
 
    </cmdsynopsis>
160
 
    <cmdsynopsis>
161
 
      <command>&COMMANDNAME;</command>
162
 
      <group choice="req">
 
161
        <arg choice="plain"><option>-h</option></arg>
163
162
        <arg choice="plain"><option>--help</option></arg>
164
 
        <arg choice="plain"><option>-h</option></arg>
165
163
      </group>
166
164
    </cmdsynopsis>
167
165
    <cmdsynopsis>
168
166
      <command>&COMMANDNAME;</command>
169
167
      <group choice="req">
 
168
        <arg choice="plain"><option>-v</option></arg>
170
169
        <arg choice="plain"><option>--version</option></arg>
171
 
        <arg choice="plain"><option>-v</option></arg>
172
170
      </group>
173
171
    </cmdsynopsis>
174
172
  </refsynopsisdiv>
175
 
  
 
173
 
176
174
  <refsect1 id="description">
177
175
    <title>DESCRIPTION</title>
178
176
    <para>
179
177
      <command>&COMMANDNAME;</command> is a program to generate the
180
 
      OpenPGP key used by
181
 
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
182
 
      <manvolnum>8mandos</manvolnum></citerefentry>.  The key is
 
178
      OpenPGP keys used by
 
179
      <citerefentry><refentrytitle>password-request</refentrytitle>
 
180
      <manvolnum>8mandos</manvolnum></citerefentry>.  The keys are
183
181
      normally written to /etc/mandos for later installation into the
184
 
      initrd image, but this, and most other things, can be changed
185
 
      with command line options.
186
 
    </para>
187
 
    <para>
188
 
      This program can also be used with the
189
 
      <option>--password</option> or <option>--passfile</option>
190
 
      options to generate a ready-made section for
191
 
      <filename>clients.conf</filename> (see
192
 
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
193
 
      <manvolnum>5</manvolnum></citerefentry>).
 
182
      initrd image, but this, like most things, can be changed with
 
183
      command line options.
194
184
    </para>
195
185
  </refsect1>
196
186
  
197
187
  <refsect1 id="purpose">
198
188
    <title>PURPOSE</title>
 
189
 
199
190
    <para>
200
191
      The purpose of this is to enable <emphasis>remote and unattended
201
192
      rebooting</emphasis> of client host computer with an
202
193
      <emphasis>encrypted root file system</emphasis>.  See <xref
203
194
      linkend="overview"/> for details.
204
195
    </para>
 
196
 
205
197
  </refsect1>
206
198
  
207
199
  <refsect1 id="options">
208
200
    <title>OPTIONS</title>
209
 
    
 
201
 
210
202
    <variablelist>
211
203
      <varlistentry>
212
 
        <term><option>--help</option></term>
213
 
        <term><option>-h</option></term>
 
204
        <term><literal>-h</literal>, <literal>--help</literal></term>
214
205
        <listitem>
215
206
          <para>
216
207
            Show a help message and exit
217
208
          </para>
218
209
        </listitem>
219
210
      </varlistentry>
220
 
      
221
 
      <varlistentry>
222
 
        <term><option>--dir
223
 
        <replaceable>DIRECTORY</replaceable></option></term>
224
 
        <term><option>-d
225
 
        <replaceable>DIRECTORY</replaceable></option></term>
226
 
        <listitem>
227
 
          <para>
228
 
            Target directory for key files.  Default is
229
 
            <filename class="directory">/etc/mandos</filename>.
230
 
          </para>
231
 
        </listitem>
232
 
      </varlistentry>
233
 
      
234
 
      <varlistentry>
235
 
        <term><option>--type
236
 
        <replaceable>TYPE</replaceable></option></term>
237
 
        <term><option>-t
238
 
        <replaceable>TYPE</replaceable></option></term>
239
 
        <listitem>
240
 
          <para>
241
 
            Key type.  Default is <quote>RSA</quote>.
242
 
          </para>
243
 
        </listitem>
244
 
      </varlistentry>
245
 
      
246
 
      <varlistentry>
247
 
        <term><option>--length
248
 
        <replaceable>BITS</replaceable></option></term>
249
 
        <term><option>-l
250
 
        <replaceable>BITS</replaceable></option></term>
251
 
        <listitem>
252
 
          <para>
253
 
            Key length in bits.  Default is 4096.
254
 
          </para>
255
 
        </listitem>
256
 
      </varlistentry>
257
 
      
258
 
      <varlistentry>
259
 
        <term><option>--subtype
260
 
        <replaceable>KEYTYPE</replaceable></option></term>
261
 
        <term><option>-s
262
 
        <replaceable>KEYTYPE</replaceable></option></term>
263
 
        <listitem>
264
 
          <para>
265
 
            Subkey type.  Default is <quote>RSA</quote> (Elgamal
 
211
 
 
212
      <varlistentry>
 
213
        <term><literal>-d</literal>, <literal>--dir
 
214
        <replaceable>directory</replaceable></literal></term>
 
215
        <listitem>
 
216
          <para>
 
217
            Target directory for key files.
 
218
          </para>
 
219
        </listitem>
 
220
      </varlistentry>
 
221
 
 
222
      <varlistentry>
 
223
        <term><literal>-t</literal>, <literal>--type
 
224
        <replaceable>type</replaceable></literal></term>
 
225
        <listitem>
 
226
          <para>
 
227
            Key type.  Default is <quote>DSA</quote>.
 
228
          </para>
 
229
        </listitem>
 
230
      </varlistentry>
 
231
 
 
232
      <varlistentry>
 
233
        <term><literal>-l</literal>, <literal>--length
 
234
        <replaceable>bits</replaceable></literal></term>
 
235
        <listitem>
 
236
          <para>
 
237
            Key length in bits.  Default is 1024.
 
238
          </para>
 
239
        </listitem>
 
240
      </varlistentry>
 
241
 
 
242
      <varlistentry>
 
243
        <term><literal>-s</literal>, <literal>--subtype
 
244
        <replaceable>type</replaceable></literal></term>
 
245
        <listitem>
 
246
          <para>
 
247
            Subkey type.  Default is <quote>ELG-E</quote> (Elgamal
266
248
            encryption-only).
267
249
          </para>
268
250
        </listitem>
269
251
      </varlistentry>
270
 
      
 
252
 
271
253
      <varlistentry>
272
 
        <term><option>--sublength
273
 
        <replaceable>BITS</replaceable></option></term>
274
 
        <term><option>-L
275
 
        <replaceable>BITS</replaceable></option></term>
 
254
        <term><literal>-L</literal>, <literal>--sublength
 
255
        <replaceable>bits</replaceable></literal></term>
276
256
        <listitem>
277
257
          <para>
278
 
            Subkey length in bits.  Default is 4096.
 
258
            Subkey length in bits.  Default is 2048.
279
259
          </para>
280
260
        </listitem>
281
261
      </varlistentry>
282
 
      
 
262
 
283
263
      <varlistentry>
284
 
        <term><option>--email
285
 
        <replaceable>ADDRESS</replaceable></option></term>
286
 
        <term><option>-e
287
 
        <replaceable>ADDRESS</replaceable></option></term>
 
264
        <term><literal>-e</literal>, <literal>--email</literal>
 
265
        <replaceable>address</replaceable></term>
288
266
        <listitem>
289
267
          <para>
290
268
            Email address of key.  Default is empty.
291
269
          </para>
292
270
        </listitem>
293
271
      </varlistentry>
294
 
      
 
272
 
295
273
      <varlistentry>
296
 
        <term><option>--comment
297
 
        <replaceable>TEXT</replaceable></option></term>
298
 
        <term><option>-c
299
 
        <replaceable>TEXT</replaceable></option></term>
 
274
        <term><literal>-c</literal>, <literal>--comment</literal>
 
275
        <replaceable>comment</replaceable></term>
300
276
        <listitem>
301
277
          <para>
302
 
            Comment field for key.  Default is empty.
 
278
            Comment field for key.  The default value is
 
279
            <quote><literal>Mandos client key</literal></quote>.
303
280
          </para>
304
281
        </listitem>
305
282
      </varlistentry>
306
 
      
 
283
 
307
284
      <varlistentry>
308
 
        <term><option>--expire
309
 
        <replaceable>TIME</replaceable></option></term>
310
 
        <term><option>-x
311
 
        <replaceable>TIME</replaceable></option></term>
 
285
        <term><literal>-x</literal>, <literal>--expire</literal>
 
286
        <replaceable>time</replaceable></term>
312
287
        <listitem>
313
288
          <para>
314
289
            Key expire time.  Default is no expiration.  See
317
292
          </para>
318
293
        </listitem>
319
294
      </varlistentry>
320
 
      
321
 
      <varlistentry>
322
 
        <term><option>--force</option></term>
323
 
        <term><option>-f</option></term>
324
 
        <listitem>
325
 
          <para>
326
 
            Force overwriting old key.
327
 
          </para>
328
 
        </listitem>
329
 
      </varlistentry>
330
 
      <varlistentry>
331
 
        <term><option>--password</option></term>
332
 
        <term><option>-p</option></term>
333
 
        <listitem>
334
 
          <para>
335
 
            Prompt for a password and encrypt it with the key already
336
 
            present in either <filename>/etc/mandos</filename> or the
337
 
            directory specified with the <option>--dir</option>
338
 
            option.  Outputs, on standard output, a section suitable
339
 
            for inclusion in <citerefentry><refentrytitle
340
 
            >mandos-clients.conf</refentrytitle><manvolnum
341
 
            >8</manvolnum></citerefentry>.  The host name or the name
342
 
            specified with the <option>--name</option> option is used
343
 
            for the section header.  All other options are ignored,
344
 
            and no key is created.
345
 
          </para>
346
 
        </listitem>
347
 
      </varlistentry>
348
 
      <varlistentry>
349
 
        <term><option>--passfile
350
 
        <replaceable>FILE</replaceable></option></term>
351
 
        <term><option>-F
352
 
        <replaceable>FILE</replaceable></option></term>
353
 
        <listitem>
354
 
          <para>
355
 
            The same as <option>--password</option>, but read from
356
 
            <replaceable>FILE</replaceable>, not the terminal.
357
 
          </para>
358
 
        </listitem>
359
 
      </varlistentry>
360
 
      <varlistentry>
361
 
        <term><option>--no-ssh</option></term>
362
 
        <term><option>-S</option></term>
363
 
        <listitem>
364
 
          <para>
365
 
            When <option>--password</option> or
366
 
            <option>--passfile</option> is given, this option will
367
 
            prevent <command>&COMMANDNAME;</command> from calling
368
 
            <command>ssh-keyscan</command> to get an SSH fingerprint
369
 
            for this host and, if successful, output suitable config
370
 
            options to use this fingerprint as a
371
 
            <option>checker</option> option in the output.  This is
372
 
            otherwise the default behavior.
 
295
 
 
296
      <varlistentry>
 
297
        <term><literal>-f</literal>, <literal>--force</literal></term>
 
298
        <listitem>
 
299
          <para>
 
300
            Force overwriting old keys.
373
301
          </para>
374
302
        </listitem>
375
303
      </varlistentry>
376
304
    </variablelist>
377
305
  </refsect1>
378
 
  
 
306
 
379
307
  <refsect1 id="overview">
380
308
    <title>OVERVIEW</title>
381
309
    <xi:include href="overview.xml"/>
382
310
    <para>
383
311
      This program is a small utility to generate new OpenPGP keys for
384
 
      new Mandos clients, and to generate sections for inclusion in
385
 
      <filename>clients.conf</filename> on the server.
 
312
      new Mandos clients.
386
313
    </para>
387
314
  </refsect1>
388
 
  
 
315
 
389
316
  <refsect1 id="exit_status">
390
317
    <title>EXIT STATUS</title>
391
318
    <para>
392
 
      The exit status will be 0 if a new key (or password, if the
393
 
      <option>--password</option> option was used) was successfully
394
 
      created, otherwise not.
 
319
      The exit status will be 0 if new keys were successfully created,
 
320
      otherwise not.
395
321
    </para>
396
322
  </refsect1>
397
323
  
399
325
    <title>ENVIRONMENT</title>
400
326
    <variablelist>
401
327
      <varlistentry>
402
 
        <term><envar>TMPDIR</envar></term>
 
328
        <term><varname>TMPDIR</varname></term>
403
329
        <listitem>
404
330
          <para>
405
331
            If set, temporary files will be created here. See
411
337
    </variablelist>
412
338
  </refsect1>
413
339
  
414
 
  <refsect1 id="files">
 
340
  <refsect1 id="file">
415
341
    <title>FILES</title>
416
342
    <para>
417
343
      Use the <option>--dir</option> option to change where
438
364
        </listitem>
439
365
      </varlistentry>
440
366
      <varlistentry>
441
 
        <term><filename class="directory">/tmp</filename></term>
 
367
        <term><filename>/tmp</filename></term>
442
368
        <listitem>
443
369
          <para>
444
370
            Temporary files will be written here if
448
374
      </varlistentry>
449
375
    </variablelist>
450
376
  </refsect1>
451
 
  
452
 
<!--   <refsect1 id="bugs"> -->
453
 
<!--     <title>BUGS</title> -->
454
 
<!--     <para> -->
455
 
<!--     </para> -->
456
 
<!--   </refsect1> -->
457
 
  
 
377
 
 
378
  <refsect1 id="bugs">
 
379
    <title>BUGS</title>
 
380
    <para>
 
381
      None are known at this time.
 
382
    </para>
 
383
  </refsect1>
 
384
 
458
385
  <refsect1 id="example">
459
386
    <title>EXAMPLE</title>
460
387
    <informalexample>
462
389
        Normal invocation needs no options:
463
390
      </para>
464
391
      <para>
465
 
        <userinput>&COMMANDNAME;</userinput>
 
392
        <userinput>mandos-keygen</userinput>
466
393
      </para>
467
394
    </informalexample>
468
395
    <informalexample>
469
396
      <para>
470
 
        Create key in another directory and of another type.  Force
 
397
        Create keys in another directory and of another type.  Force
471
398
        overwriting old key files:
472
399
      </para>
473
400
      <para>
474
401
 
475
402
<!-- do not wrap this line -->
476
 
<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>
477
 
 
478
 
      </para>
479
 
    </informalexample>
480
 
    <informalexample>
481
 
      <para>
482
 
        Prompt for a password, encrypt it with the key in <filename
483
 
        class="directory">/etc/mandos</filename> and output a section
484
 
        suitable for <filename>clients.conf</filename>.
485
 
      </para>
486
 
      <para>
487
 
        <userinput>&COMMANDNAME; --password</userinput>
488
 
      </para>
489
 
    </informalexample>
490
 
    <informalexample>
491
 
      <para>
492
 
        Prompt for a password, encrypt it with the key in the
493
 
        <filename>client-key</filename> directory and output a section
494
 
        suitable for <filename>clients.conf</filename>.
495
 
      </para>
496
 
      <para>
497
 
 
498
 
<!-- do not wrap this line -->
499
 
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
 
403
<userinput>mandos-keygen --dir ~/keydir --type RSA --force</userinput>
500
404
 
501
405
      </para>
502
406
    </informalexample>
503
407
  </refsect1>
504
 
  
 
408
 
505
409
  <refsect1 id="security">
506
410
    <title>SECURITY</title>
507
411
    <para>
508
412
      The <option>--type</option>, <option>--length</option>,
509
413
      <option>--subtype</option>, and <option>--sublength</option>
510
 
      options can be used to create keys of low security.  If in
511
 
      doubt, leave them to the default values.
 
414
      options can be used to create keys of insufficient security.  If
 
415
      in doubt, leave them to the default values.
512
416
    </para>
513
417
    <para>
514
 
      The key expire time is <emphasis>not</emphasis> guaranteed to be
515
 
      honored by <citerefentry><refentrytitle>mandos</refentrytitle>
 
418
      The key expire time is not guaranteed to be honored by
 
419
      <citerefentry><refentrytitle>mandos</refentrytitle>
516
420
      <manvolnum>8</manvolnum></citerefentry>.
517
421
    </para>
518
422
  </refsect1>
519
 
  
 
423
 
520
424
  <refsect1 id="see_also">
521
425
    <title>SEE ALSO</title>
522
426
    <para>
523
 
      <citerefentry><refentrytitle>intro</refentrytitle>
 
427
      <citerefentry><refentrytitle>password-request</refentrytitle>
524
428
      <manvolnum>8mandos</manvolnum></citerefentry>,
 
429
      <citerefentry><refentrytitle>mandos</refentrytitle>
 
430
      <manvolnum>8</manvolnum></citerefentry>,
525
431
      <citerefentry><refentrytitle>gpg</refentrytitle>
526
 
      <manvolnum>1</manvolnum></citerefentry>,
527
 
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
528
 
      <manvolnum>5</manvolnum></citerefentry>,
529
 
      <citerefentry><refentrytitle>mandos</refentrytitle>
530
 
      <manvolnum>8</manvolnum></citerefentry>,
531
 
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
532
 
      <manvolnum>8mandos</manvolnum></citerefentry>,
533
 
      <citerefentry><refentrytitle>ssh-keyscan</refentrytitle>
534
432
      <manvolnum>1</manvolnum></citerefentry>
535
433
    </para>
536
434
  </refsect1>
537
435
  
538
436
</refentry>
539
 
<!-- Local Variables: -->
540
 
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
541
 
<!-- time-stamp-end: "[\"']>" -->
542
 
<!-- time-stamp-format: "%:y-%02m-%02d" -->
543
 
<!-- End: -->