/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos-keygen.xml

merge

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-keygen.xml
1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
 
4
<!ENTITY VERSION "1.0">
4
5
<!ENTITY COMMANDNAME "mandos-keygen">
5
 
<!ENTITY TIMESTAMP "2016-03-05">
6
 
<!ENTITY % common SYSTEM "common.ent">
7
 
%common;
 
6
<!ENTITY TIMESTAMP "2008-08-29">
8
7
]>
9
8
 
10
9
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
12
11
    <title>Mandos Manual</title>
13
12
    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
14
13
    <productname>Mandos</productname>
15
 
    <productnumber>&version;</productnumber>
 
14
    <productnumber>&VERSION;</productnumber>
16
15
    <date>&TIMESTAMP;</date>
17
16
    <authorgroup>
18
17
      <author>
19
18
        <firstname>Björn</firstname>
20
19
        <surname>Påhlsson</surname>
21
20
        <address>
22
 
          <email>belorn@recompile.se</email>
 
21
          <email>belorn@fukt.bsnet.se</email>
23
22
        </address>
24
23
      </author>
25
24
      <author>
26
25
        <firstname>Teddy</firstname>
27
26
        <surname>Hogeborn</surname>
28
27
        <address>
29
 
          <email>teddy@recompile.se</email>
 
28
          <email>teddy@fukt.bsnet.se</email>
30
29
        </address>
31
30
      </author>
32
31
    </authorgroup>
33
32
    <copyright>
34
33
      <year>2008</year>
35
 
      <year>2009</year>
36
 
      <year>2010</year>
37
 
      <year>2011</year>
38
 
      <year>2012</year>
39
 
      <year>2013</year>
40
 
      <year>2014</year>
41
 
      <year>2015</year>
42
 
      <year>2016</year>
43
34
      <holder>Teddy Hogeborn</holder>
44
35
      <holder>Björn Påhlsson</holder>
45
36
    </copyright>
46
 
    <xi:include href="legalnotice.xml"/>
 
37
    <legalnotice>
 
38
      <para>
 
39
        This manual page is free software: you can redistribute it
 
40
        and/or modify it under the terms of the GNU General Public
 
41
        License as published by the Free Software Foundation,
 
42
        either version 3 of the License, or (at your option) any
 
43
        later version.
 
44
      </para>
 
45
 
 
46
      <para>
 
47
        This manual page is distributed in the hope that it will
 
48
        be useful, but WITHOUT ANY WARRANTY; without even the
 
49
        implied warranty of MERCHANTABILITY or FITNESS FOR A
 
50
        PARTICULAR PURPOSE.  See the GNU General Public License
 
51
        for more details.
 
52
      </para>
 
53
 
 
54
      <para>
 
55
        You should have received a copy of the GNU General Public
 
56
        License along with this program; If not, see
 
57
        <ulink url="http://www.gnu.org/licenses/"/>.
 
58
      </para>
 
59
    </legalnotice>
47
60
  </refentryinfo>
48
 
  
 
61
 
49
62
  <refmeta>
50
63
    <refentrytitle>&COMMANDNAME;</refentrytitle>
51
64
    <manvolnum>8</manvolnum>
54
67
  <refnamediv>
55
68
    <refname><command>&COMMANDNAME;</command></refname>
56
69
    <refpurpose>
57
 
      Generate key and password for Mandos client and server.
 
70
      Generate keys for <citerefentry><refentrytitle>password-request
 
71
      </refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
58
72
    </refpurpose>
59
73
  </refnamediv>
60
 
  
 
74
 
61
75
  <refsynopsisdiv>
62
76
    <cmdsynopsis>
63
77
      <command>&COMMANDNAME;</command>
64
 
      <group>
65
 
        <arg choice="plain"><option>--dir
66
 
        <replaceable>DIRECTORY</replaceable></option></arg>
67
 
        <arg choice="plain"><option>-d
68
 
        <replaceable>DIRECTORY</replaceable></option></arg>
69
 
      </group>
70
 
      <sbr/>
71
 
      <group>
72
 
        <arg choice="plain"><option>--type
73
 
        <replaceable>KEYTYPE</replaceable></option></arg>
74
 
        <arg choice="plain"><option>-t
75
 
        <replaceable>KEYTYPE</replaceable></option></arg>
76
 
      </group>
77
 
      <sbr/>
78
 
      <group>
79
 
        <arg choice="plain"><option>--length
80
 
        <replaceable>BITS</replaceable></option></arg>
81
 
        <arg choice="plain"><option>-l
82
 
        <replaceable>BITS</replaceable></option></arg>
83
 
      </group>
84
 
      <sbr/>
85
 
      <group>
86
 
        <arg choice="plain"><option>--subtype
87
 
        <replaceable>KEYTYPE</replaceable></option></arg>
88
 
        <arg choice="plain"><option>-s
89
 
        <replaceable>KEYTYPE</replaceable></option></arg>
90
 
      </group>
91
 
      <sbr/>
92
 
      <group>
93
 
        <arg choice="plain"><option>--sublength
94
 
        <replaceable>BITS</replaceable></option></arg>
95
 
        <arg choice="plain"><option>-L
96
 
        <replaceable>BITS</replaceable></option></arg>
97
 
      </group>
98
 
      <sbr/>
99
 
      <group>
100
 
        <arg choice="plain"><option>--name
101
 
        <replaceable>NAME</replaceable></option></arg>
102
 
        <arg choice="plain"><option>-n
103
 
        <replaceable>NAME</replaceable></option></arg>
104
 
      </group>
105
 
      <sbr/>
106
 
      <group>
107
 
        <arg choice="plain"><option>--email
108
 
        <replaceable>ADDRESS</replaceable></option></arg>
109
 
        <arg choice="plain"><option>-e
110
 
        <replaceable>ADDRESS</replaceable></option></arg>
111
 
      </group>
112
 
      <sbr/>
113
 
      <group>
114
 
        <arg choice="plain"><option>--comment
115
 
        <replaceable>TEXT</replaceable></option></arg>
116
 
        <arg choice="plain"><option>-c
117
 
        <replaceable>TEXT</replaceable></option></arg>
118
 
      </group>
119
 
      <sbr/>
120
 
      <group>
121
 
        <arg choice="plain"><option>--expire
122
 
        <replaceable>TIME</replaceable></option></arg>
123
 
        <arg choice="plain"><option>-x
124
 
        <replaceable>TIME</replaceable></option></arg>
125
 
      </group>
126
 
      <sbr/>
127
 
      <group>
 
78
      <group choice="opt">
 
79
        <arg choice="plain"><option>--dir</option>
 
80
        <replaceable>directory</replaceable></arg>
 
81
      </group>
 
82
      <group choice="opt">
 
83
        <arg choice="plain"><option>--type</option>
 
84
        <replaceable>type</replaceable></arg>
 
85
      </group>
 
86
      <group choice="opt">
 
87
        <arg choice="plain"><option>--length</option>
 
88
        <replaceable>bits</replaceable></arg>
 
89
      </group>
 
90
      <group choice="opt">
 
91
        <arg choice="plain"><option>--subtype</option>
 
92
        <replaceable>type</replaceable></arg>
 
93
      </group>
 
94
      <group choice="opt">
 
95
        <arg choice="plain"><option>--sublength</option>
 
96
        <replaceable>bits</replaceable></arg>
 
97
      </group>
 
98
      <group choice="opt">
 
99
        <arg choice="plain"><option>--name</option>
 
100
        <replaceable>NAME</replaceable></arg>
 
101
      </group>
 
102
      <group choice="opt">
 
103
        <arg choice="plain"><option>--email</option>
 
104
        <replaceable>EMAIL</replaceable></arg>
 
105
      </group>
 
106
      <group choice="opt">
 
107
        <arg choice="plain"><option>--comment</option>
 
108
        <replaceable>COMMENT</replaceable></arg>
 
109
      </group>
 
110
      <group choice="opt">
 
111
        <arg choice="plain"><option>--expire</option>
 
112
        <replaceable>TIME</replaceable></arg>
 
113
      </group>
 
114
      <group choice="opt">
128
115
        <arg choice="plain"><option>--force</option></arg>
 
116
      </group>
 
117
    </cmdsynopsis>
 
118
    <cmdsynopsis>
 
119
      <command>&COMMANDNAME;</command>
 
120
      <group choice="opt">
 
121
        <arg choice="plain"><option>-d</option>
 
122
        <replaceable>directory</replaceable></arg>
 
123
      </group>
 
124
      <group choice="opt">
 
125
        <arg choice="plain"><option>-t</option>
 
126
        <replaceable>type</replaceable></arg>
 
127
      </group>
 
128
      <group choice="opt">
 
129
        <arg choice="plain"><option>-l</option>
 
130
        <replaceable>bits</replaceable></arg>
 
131
      </group>
 
132
      <group choice="opt">
 
133
        <arg choice="plain"><option>-s</option>
 
134
        <replaceable>type</replaceable></arg>
 
135
      </group>
 
136
      <group choice="opt">
 
137
        <arg choice="plain"><option>-L</option>
 
138
        <replaceable>bits</replaceable></arg>
 
139
      </group>
 
140
      <group choice="opt">
 
141
        <arg choice="plain"><option>-n</option>
 
142
        <replaceable>NAME</replaceable></arg>
 
143
      </group>
 
144
      <group choice="opt">
 
145
        <arg choice="plain"><option>-e</option>
 
146
        <replaceable>EMAIL</replaceable></arg>
 
147
      </group>
 
148
      <group choice="opt">
 
149
        <arg choice="plain"><option>-c</option>
 
150
        <replaceable>COMMENT</replaceable></arg>
 
151
      </group>
 
152
      <group choice="opt">
 
153
        <arg choice="plain"><option>-x</option>
 
154
        <replaceable>TIME</replaceable></arg>
 
155
      </group>
 
156
      <group choice="opt">
129
157
        <arg choice="plain"><option>-f</option></arg>
130
158
      </group>
131
159
    </cmdsynopsis>
132
160
    <cmdsynopsis>
133
161
      <command>&COMMANDNAME;</command>
134
162
      <group choice="req">
 
163
        <arg choice="plain"><option>-p</option></arg>
135
164
        <arg choice="plain"><option>--password</option></arg>
136
 
        <arg choice="plain"><option>-p</option></arg>
137
 
        <arg choice="plain"><option>--passfile
138
 
        <replaceable>FILE</replaceable></option></arg>
139
 
        <arg choice="plain"><option>-F</option>
140
 
        <replaceable>FILE</replaceable></arg>
141
 
      </group>
142
 
      <sbr/>
143
 
      <group>
144
 
        <arg choice="plain"><option>--dir
145
 
        <replaceable>DIRECTORY</replaceable></option></arg>
146
 
        <arg choice="plain"><option>-d
147
 
        <replaceable>DIRECTORY</replaceable></option></arg>
148
 
      </group>
149
 
      <sbr/>
150
 
      <group>
151
 
        <arg choice="plain"><option>--name
152
 
        <replaceable>NAME</replaceable></option></arg>
153
 
        <arg choice="plain"><option>-n
154
 
        <replaceable>NAME</replaceable></option></arg>
155
 
      </group>
156
 
      <group>
157
 
        <arg choice="plain"><option>--no-ssh</option></arg>
158
 
        <arg choice="plain"><option>-S</option></arg>
 
165
      </group>
 
166
      <group choice="opt">
 
167
        <arg choice="plain"><option>--dir</option>
 
168
        <replaceable>directory</replaceable></arg>
 
169
      </group>
 
170
      <group choice="opt">
 
171
        <arg choice="plain"><option>--name</option>
 
172
        <replaceable>NAME</replaceable></arg>
159
173
      </group>
160
174
    </cmdsynopsis>
161
175
    <cmdsynopsis>
162
176
      <command>&COMMANDNAME;</command>
163
177
      <group choice="req">
 
178
        <arg choice="plain"><option>-h</option></arg>
164
179
        <arg choice="plain"><option>--help</option></arg>
165
 
        <arg choice="plain"><option>-h</option></arg>
166
180
      </group>
167
181
    </cmdsynopsis>
168
182
    <cmdsynopsis>
169
183
      <command>&COMMANDNAME;</command>
170
184
      <group choice="req">
 
185
        <arg choice="plain"><option>-v</option></arg>
171
186
        <arg choice="plain"><option>--version</option></arg>
172
 
        <arg choice="plain"><option>-v</option></arg>
173
187
      </group>
174
188
    </cmdsynopsis>
175
189
  </refsynopsisdiv>
176
 
  
 
190
 
177
191
  <refsect1 id="description">
178
192
    <title>DESCRIPTION</title>
179
193
    <para>
180
194
      <command>&COMMANDNAME;</command> is a program to generate the
181
 
      OpenPGP key used by
182
 
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
183
 
      <manvolnum>8mandos</manvolnum></citerefentry>.  The key is
 
195
      OpenPGP keys used by
 
196
      <citerefentry><refentrytitle>password-request</refentrytitle>
 
197
      <manvolnum>8mandos</manvolnum></citerefentry>.  The keys are
184
198
      normally written to /etc/mandos for later installation into the
185
 
      initrd image, but this, and most other things, can be changed
186
 
      with command line options.
 
199
      initrd image, but this, like most things, can be changed with
 
200
      command line options.
187
201
    </para>
188
202
    <para>
189
 
      This program can also be used with the
190
 
      <option>--password</option> or <option>--passfile</option>
191
 
      options to generate a ready-made section for
192
 
      <filename>clients.conf</filename> (see
 
203
      It can also be used to generate ready-made sections for
193
204
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
194
 
      <manvolnum>5</manvolnum></citerefentry>).
 
205
      <manvolnum>5</manvolnum></citerefentry> using the
 
206
      <option>--password</option> option.
195
207
    </para>
196
208
  </refsect1>
197
209
  
198
210
  <refsect1 id="purpose">
199
211
    <title>PURPOSE</title>
 
212
 
200
213
    <para>
201
214
      The purpose of this is to enable <emphasis>remote and unattended
202
215
      rebooting</emphasis> of client host computer with an
203
216
      <emphasis>encrypted root file system</emphasis>.  See <xref
204
217
      linkend="overview"/> for details.
205
218
    </para>
 
219
 
206
220
  </refsect1>
207
221
  
208
222
  <refsect1 id="options">
209
223
    <title>OPTIONS</title>
210
 
    
 
224
 
211
225
    <variablelist>
212
226
      <varlistentry>
213
 
        <term><option>--help</option></term>
214
 
        <term><option>-h</option></term>
 
227
        <term><literal>-h</literal>, <literal>--help</literal></term>
215
228
        <listitem>
216
229
          <para>
217
230
            Show a help message and exit
218
231
          </para>
219
232
        </listitem>
220
233
      </varlistentry>
221
 
      
 
234
 
222
235
      <varlistentry>
223
 
        <term><option>--dir
224
 
        <replaceable>DIRECTORY</replaceable></option></term>
225
 
        <term><option>-d
226
 
        <replaceable>DIRECTORY</replaceable></option></term>
 
236
        <term><literal>-d</literal>, <literal>--dir
 
237
        <replaceable>directory</replaceable></literal></term>
227
238
        <listitem>
228
239
          <para>
229
240
            Target directory for key files.  Default is
230
 
            <filename class="directory">/etc/mandos</filename>.
231
 
          </para>
232
 
        </listitem>
233
 
      </varlistentry>
234
 
      
235
 
      <varlistentry>
236
 
        <term><option>--type
237
 
        <replaceable>TYPE</replaceable></option></term>
238
 
        <term><option>-t
239
 
        <replaceable>TYPE</replaceable></option></term>
240
 
        <listitem>
241
 
          <para>
242
 
            Key type.  Default is <quote>RSA</quote>.
243
 
          </para>
244
 
        </listitem>
245
 
      </varlistentry>
246
 
      
247
 
      <varlistentry>
248
 
        <term><option>--length
249
 
        <replaceable>BITS</replaceable></option></term>
250
 
        <term><option>-l
251
 
        <replaceable>BITS</replaceable></option></term>
252
 
        <listitem>
253
 
          <para>
254
 
            Key length in bits.  Default is 4096.
255
 
          </para>
256
 
        </listitem>
257
 
      </varlistentry>
258
 
      
259
 
      <varlistentry>
260
 
        <term><option>--subtype
261
 
        <replaceable>KEYTYPE</replaceable></option></term>
262
 
        <term><option>-s
263
 
        <replaceable>KEYTYPE</replaceable></option></term>
264
 
        <listitem>
265
 
          <para>
266
 
            Subkey type.  Default is <quote>RSA</quote> (Elgamal
 
241
            <filename>/etc/mandos</filename>.
 
242
          </para>
 
243
        </listitem>
 
244
      </varlistentry>
 
245
 
 
246
      <varlistentry>
 
247
        <term><literal>-t</literal>, <literal>--type
 
248
        <replaceable>type</replaceable></literal></term>
 
249
        <listitem>
 
250
          <para>
 
251
            Key type.  Default is <quote>DSA</quote>.
 
252
          </para>
 
253
        </listitem>
 
254
      </varlistentry>
 
255
 
 
256
      <varlistentry>
 
257
        <term><literal>-l</literal>, <literal>--length
 
258
        <replaceable>bits</replaceable></literal></term>
 
259
        <listitem>
 
260
          <para>
 
261
            Key length in bits.  Default is 2048.
 
262
          </para>
 
263
        </listitem>
 
264
      </varlistentry>
 
265
 
 
266
      <varlistentry>
 
267
        <term><literal>-s</literal>, <literal>--subtype
 
268
        <replaceable>type</replaceable></literal></term>
 
269
        <listitem>
 
270
          <para>
 
271
            Subkey type.  Default is <quote>ELG-E</quote> (Elgamal
267
272
            encryption-only).
268
273
          </para>
269
274
        </listitem>
270
275
      </varlistentry>
271
 
      
 
276
 
272
277
      <varlistentry>
273
 
        <term><option>--sublength
274
 
        <replaceable>BITS</replaceable></option></term>
275
 
        <term><option>-L
276
 
        <replaceable>BITS</replaceable></option></term>
 
278
        <term><literal>-L</literal>, <literal>--sublength
 
279
        <replaceable>bits</replaceable></literal></term>
277
280
        <listitem>
278
281
          <para>
279
 
            Subkey length in bits.  Default is 4096.
 
282
            Subkey length in bits.  Default is 2048.
280
283
          </para>
281
284
        </listitem>
282
285
      </varlistentry>
283
 
      
 
286
 
284
287
      <varlistentry>
285
 
        <term><option>--email
286
 
        <replaceable>ADDRESS</replaceable></option></term>
287
 
        <term><option>-e
288
 
        <replaceable>ADDRESS</replaceable></option></term>
 
288
        <term><literal>-e</literal>, <literal>--email</literal>
 
289
        <replaceable>address</replaceable></term>
289
290
        <listitem>
290
291
          <para>
291
292
            Email address of key.  Default is empty.
292
293
          </para>
293
294
        </listitem>
294
295
      </varlistentry>
295
 
      
 
296
 
296
297
      <varlistentry>
297
 
        <term><option>--comment
298
 
        <replaceable>TEXT</replaceable></option></term>
299
 
        <term><option>-c
300
 
        <replaceable>TEXT</replaceable></option></term>
 
298
        <term><literal>-c</literal>, <literal>--comment</literal>
 
299
        <replaceable>comment</replaceable></term>
301
300
        <listitem>
302
301
          <para>
303
 
            Comment field for key.  Default is empty.
 
302
            Comment field for key.  The default value is
 
303
            <quote><literal>Mandos client key</literal></quote>.
304
304
          </para>
305
305
        </listitem>
306
306
      </varlistentry>
307
 
      
 
307
 
308
308
      <varlistentry>
309
 
        <term><option>--expire
310
 
        <replaceable>TIME</replaceable></option></term>
311
 
        <term><option>-x
312
 
        <replaceable>TIME</replaceable></option></term>
 
309
        <term><literal>-x</literal>, <literal>--expire</literal>
 
310
        <replaceable>time</replaceable></term>
313
311
        <listitem>
314
312
          <para>
315
313
            Key expire time.  Default is no expiration.  See
318
316
          </para>
319
317
        </listitem>
320
318
      </varlistentry>
321
 
      
 
319
 
322
320
      <varlistentry>
323
 
        <term><option>--force</option></term>
324
 
        <term><option>-f</option></term>
 
321
        <term><literal>-f</literal>, <literal>--force</literal></term>
325
322
        <listitem>
326
323
          <para>
327
 
            Force overwriting old key.
 
324
            Force overwriting old keys.
328
325
          </para>
329
326
        </listitem>
330
327
      </varlistentry>
331
328
      <varlistentry>
332
 
        <term><option>--password</option></term>
333
 
        <term><option>-p</option></term>
 
329
        <term><literal>-p</literal>, <literal>--password</literal
 
330
        ></term>
334
331
        <listitem>
335
332
          <para>
336
333
            Prompt for a password and encrypt it with the key already
342
339
            >8</manvolnum></citerefentry>.  The host name or the name
343
340
            specified with the <option>--name</option> option is used
344
341
            for the section header.  All other options are ignored,
345
 
            and no key is created.
346
 
          </para>
347
 
        </listitem>
348
 
      </varlistentry>
349
 
      <varlistentry>
350
 
        <term><option>--passfile
351
 
        <replaceable>FILE</replaceable></option></term>
352
 
        <term><option>-F
353
 
        <replaceable>FILE</replaceable></option></term>
354
 
        <listitem>
355
 
          <para>
356
 
            The same as <option>--password</option>, but read from
357
 
            <replaceable>FILE</replaceable>, not the terminal.
358
 
          </para>
359
 
        </listitem>
360
 
      </varlistentry>
361
 
      <varlistentry>
362
 
        <term><option>--no-ssh</option></term>
363
 
        <term><option>-S</option></term>
364
 
        <listitem>
365
 
          <para>
366
 
            When <option>--password</option> or
367
 
            <option>--passfile</option> is given, this option will
368
 
            prevent <command>&COMMANDNAME;</command> from calling
369
 
            <command>ssh-keyscan</command> to get an SSH fingerprint
370
 
            for this host and, if successful, output suitable config
371
 
            options to use this fingerprint as a
372
 
            <option>checker</option> option in the output.  This is
373
 
            otherwise the default behavior.
 
342
            and no keys are created.
374
343
          </para>
375
344
        </listitem>
376
345
      </varlistentry>
377
346
    </variablelist>
378
347
  </refsect1>
379
 
  
 
348
 
380
349
  <refsect1 id="overview">
381
350
    <title>OVERVIEW</title>
382
351
    <xi:include href="overview.xml"/>
383
352
    <para>
384
353
      This program is a small utility to generate new OpenPGP keys for
385
 
      new Mandos clients, and to generate sections for inclusion in
386
 
      <filename>clients.conf</filename> on the server.
 
354
      new Mandos clients.
387
355
    </para>
388
356
  </refsect1>
389
 
  
 
357
 
390
358
  <refsect1 id="exit_status">
391
359
    <title>EXIT STATUS</title>
392
360
    <para>
393
 
      The exit status will be 0 if a new key (or password, if the
394
 
      <option>--password</option> option was used) was successfully
395
 
      created, otherwise not.
 
361
      The exit status will be 0 if new keys were successfully created,
 
362
      otherwise not.
396
363
    </para>
397
364
  </refsect1>
398
365
  
400
367
    <title>ENVIRONMENT</title>
401
368
    <variablelist>
402
369
      <varlistentry>
403
 
        <term><envar>TMPDIR</envar></term>
 
370
        <term><varname>TMPDIR</varname></term>
404
371
        <listitem>
405
372
          <para>
406
373
            If set, temporary files will be created here. See
412
379
    </variablelist>
413
380
  </refsect1>
414
381
  
415
 
  <refsect1 id="files">
 
382
  <refsect1 id="file">
416
383
    <title>FILES</title>
417
384
    <para>
418
385
      Use the <option>--dir</option> option to change where
439
406
        </listitem>
440
407
      </varlistentry>
441
408
      <varlistentry>
442
 
        <term><filename class="directory">/tmp</filename></term>
 
409
        <term><filename>/tmp</filename></term>
443
410
        <listitem>
444
411
          <para>
445
412
            Temporary files will be written here if
449
416
      </varlistentry>
450
417
    </variablelist>
451
418
  </refsect1>
452
 
  
 
419
 
453
420
  <refsect1 id="bugs">
454
421
    <title>BUGS</title>
455
 
    <xi:include href="bugs.xml"/>
 
422
    <para>
 
423
      None are known at this time.
 
424
    </para>
456
425
  </refsect1>
457
 
  
 
426
 
458
427
  <refsect1 id="example">
459
428
    <title>EXAMPLE</title>
460
429
    <informalexample>
467
436
    </informalexample>
468
437
    <informalexample>
469
438
      <para>
470
 
        Create key in another directory and of another type.  Force
 
439
        Create keys in another directory and of another type.  Force
471
440
        overwriting old key files:
472
441
      </para>
473
442
      <para>
477
446
 
478
447
      </para>
479
448
    </informalexample>
480
 
    <informalexample>
481
 
      <para>
482
 
        Prompt for a password, encrypt it with the key in <filename
483
 
        class="directory">/etc/mandos</filename> and output a section
484
 
        suitable for <filename>clients.conf</filename>.
485
 
      </para>
486
 
      <para>
487
 
        <userinput>&COMMANDNAME; --password</userinput>
488
 
      </para>
489
 
    </informalexample>
490
 
    <informalexample>
491
 
      <para>
492
 
        Prompt for a password, encrypt it with the key in the
493
 
        <filename>client-key</filename> directory and output a section
494
 
        suitable for <filename>clients.conf</filename>.
495
 
      </para>
496
 
      <para>
497
 
 
498
 
<!-- do not wrap this line -->
499
 
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
500
 
 
501
 
      </para>
502
 
    </informalexample>
503
449
  </refsect1>
504
 
  
 
450
 
505
451
  <refsect1 id="security">
506
452
    <title>SECURITY</title>
507
453
    <para>
508
454
      The <option>--type</option>, <option>--length</option>,
509
455
      <option>--subtype</option>, and <option>--sublength</option>
510
 
      options can be used to create keys of low security.  If in
511
 
      doubt, leave them to the default values.
 
456
      options can be used to create keys of insufficient security.  If
 
457
      in doubt, leave them to the default values.
512
458
    </para>
513
459
    <para>
514
 
      The key expire time is <emphasis>not</emphasis> guaranteed to be
515
 
      honored by <citerefentry><refentrytitle>mandos</refentrytitle>
 
460
      The key expire time is not guaranteed to be honored by
 
461
      <citerefentry><refentrytitle>mandos</refentrytitle>
516
462
      <manvolnum>8</manvolnum></citerefentry>.
517
463
    </para>
518
464
  </refsect1>
519
 
  
 
465
 
520
466
  <refsect1 id="see_also">
521
467
    <title>SEE ALSO</title>
522
468
    <para>
523
 
      <citerefentry><refentrytitle>intro</refentrytitle>
524
 
      <manvolnum>8mandos</manvolnum></citerefentry>,
525
469
      <citerefentry><refentrytitle>gpg</refentrytitle>
526
470
      <manvolnum>1</manvolnum></citerefentry>,
527
 
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
528
 
      <manvolnum>5</manvolnum></citerefentry>,
529
471
      <citerefentry><refentrytitle>mandos</refentrytitle>
530
472
      <manvolnum>8</manvolnum></citerefentry>,
531
 
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
532
 
      <manvolnum>8mandos</manvolnum></citerefentry>,
533
 
      <citerefentry><refentrytitle>ssh-keyscan</refentrytitle>
534
 
      <manvolnum>1</manvolnum></citerefentry>
 
473
      <citerefentry><refentrytitle>password-request</refentrytitle>
 
474
      <manvolnum>8mandos</manvolnum></citerefentry>
535
475
    </para>
536
476
  </refsect1>
537
477