/mandos/release : revision 24.1.75

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos-keygen.xml

Committer: Björn Påhlsson
Date: 2008-08-30 19:59:42 UTC
mfrom: (121 mandos)
mto: (237.7.1 mandos) (24.1.154 mandos)
mto: This revision was merged to the branch mainline in revision 132.
Revision ID: belorn@braxen-20080830195942-o76ct0zo0ximvgfz

merge

files added:
.bzrignore

COPYING

initramfs-tools-hook

initramfs-tools-hook-conf

initramfs-tools-script

mandos-clients.conf.xml

mandos-keygen

mandos-keygen.xml

mandos-options.xml

mandos.conf

mandos.conf.xml

mandos.xml

overview.xml

plugin-runner.xml

plugins.d/password-prompt.xml

plugins.d/password-request.xml

plugins.d/usplash

files removed:
ca.pem

cert.pem

client-cert.pem

client-key.pem

crl.pem

key.pem

files renamed:
mandos-clients.conf => clients.conf

server.py => mandos

plugbasedclient.c => plugin-runner.c

plugins.d/passprompt.c => plugins.d/password-prompt.c

plugins.d/mandosclient.c => plugins.d/password-request.c

files modified:
Makefile

TODO

Show diffs side-by-side

added added

removed removed

mandos-keygen.xml

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

<!ENTITY VERSION "1.0">

<!ENTITY COMMANDNAME "mandos-keygen">

<!ENTITY TIMESTAMP "2008-08-30">

<title>Mandos Manual</title>

<productname>Mandos</productname>

<productnumber>&VERSION;</productnumber>

<date>&TIMESTAMP;</date>

<firstname>Björn</firstname>

<surname>Påhlsson</surname>

<email>belorn@fukt.bsnet.se</email>

</address>

</author>

<firstname>Teddy</firstname>

<surname>Hogeborn</surname>

<email>teddy@fukt.bsnet.se</email>

</address>

</author>

</authorgroup>

<holder>Teddy Hogeborn</holder>

<holder>Björn Påhlsson</holder>

</copyright>

<para>

This manual page is free software: you can redistribute it

and/or modify it under the terms of the GNU General Public

License as published by the Free Software Foundation,

either version 3 of the License, or (at your option) any

later version.

</para>

<para>

This manual page is distributed in the hope that it will

be useful, but WITHOUT ANY WARRANTY; without even the

implied warranty of MERCHANTABILITY or FITNESS FOR A

PARTICULAR PURPOSE. See the GNU General Public License

for more details.

</para>

<para>

You should have received a copy of the GNU General Public

License along with this program; If not, see

<ulink url="http://www.gnu.org/licenses/"/>.

</para>

</legalnotice>

</refentryinfo>

<refentrytitle>&COMMANDNAME;</refentrytitle>

</refmeta>

<refname><command>&COMMANDNAME;</command></refname>

Generate keys for <citerefentry><refentrytitle>password-request

</refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>

</refpurpose>

</refnamediv>

<command>&COMMANDNAME;</command>

<group>

<arg choice="plain"><option>--dir

<replaceable>DIRECTORY</replaceable></option></arg>

<arg choice="plain"><option>-d

<replaceable>DIRECTORY</replaceable></option></arg>

</group>

<sbr/>

<group>

<arg choice="plain"><option>--type

<replaceable>KEYTYPE</replaceable></option></arg>

<arg choice="plain"><option>-t

<replaceable>KEYTYPE</replaceable></option></arg>

</group>

<sbr/>

<group>

<arg choice="plain"><option>--length

<arg choice="plain"><option>-l

</group>

<sbr/>

<group>

100

<arg choice="plain"><option>--subtype

101

<replaceable>KEYTYPE</replaceable></option></arg>

102

<arg choice="plain"><option>-s

103

<replaceable>KEYTYPE</replaceable></option></arg>

104

</group>

105

<sbr/>

106

<group>

107

<arg choice="plain"><option>--sublength

108

109

<arg choice="plain"><option>-L

110

111

</group>

112

<sbr/>

113

<group>

114

<arg choice="plain"><option>--name

115

116

<arg choice="plain"><option>-n

117

118

</group>

119

<sbr/>

120

<group>

121

<arg choice="plain"><option>--email

122

<replaceable>ADDRESS</replaceable></option></arg>

123

<arg choice="plain"><option>-e

124

<replaceable>ADDRESS</replaceable></option></arg>

125

</group>

126

<sbr/>

127

<group>

128

<arg choice="plain"><option>--comment

129

130

<arg choice="plain"><option>-c

131

132

</group>

133

<sbr/>

134

<group>

135

<arg choice="plain"><option>--expire

136

137

<arg choice="plain"><option>-x

138

139

</group>

140

<sbr/>

141

<arg><option>--force</option></arg>

142

</cmdsynopsis>

143

144

<command>&COMMANDNAME;</command>

145

146

147

<arg choice="plain"><option>--password</option></arg>

148

</group>

149

<sbr/>

150

<group>

151

<arg choice="plain"><option>--dir

152

<replaceable>DIRECTORY</replaceable></option></arg>

153

<arg choice="plain"><option>-d

154

<replaceable>DIRECTORY</replaceable></option></arg>

155

</group>

156

<sbr/>

157

<group>

158

<arg choice="plain"><option>--name

159

160

<arg choice="plain"><option>-n

161

162

</group>

163

</cmdsynopsis>

164

165

<command>&COMMANDNAME;</command>

166

167

168

169

</group>

170

</cmdsynopsis>

171

172

<command>&COMMANDNAME;</command>

173

174

175

<arg choice="plain"><option>--version</option></arg>

176

</group>

177

</cmdsynopsis>

178

</refsynopsisdiv>

179

180

181

<title>DESCRIPTION</title>

182

<para>

183

<command>&COMMANDNAME;</command> is a program to generate the

184

OpenPGP keys used by

185

<citerefentry><refentrytitle>password-request</refentrytitle>

186

<manvolnum>8mandos</manvolnum></citerefentry>. The keys are

187

normally written to /etc/mandos for later installation into the

188

initrd image, but this, like most things, can be changed with

189

command line options.

190

</para>

191

<para>

192

It can also be used to generate ready-made sections for

193

<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>

194

<manvolnum>5</manvolnum></citerefentry> using the

195

<option>--password</option> option.

196

</para>

197

</refsect1>

198

199

200

<title>PURPOSE</title>

201

202

<para>

203

The purpose of this is to enable <emphasis>remote and unattended

204

rebooting</emphasis> of client host computer with an

205

<emphasis>encrypted root file system</emphasis>. See <xref

206

linkend="overview"/> for details.

207

</para>

208

209

</refsect1>

210

211

212

<title>OPTIONS</title>

213

214

215

216

217

218

<para>

219

Show a help message and exit

220

</para>

221

</listitem>

222

</varlistentry>

223

224

225

<term><literal>-d</literal>, <literal>--dir

226

<replaceable>directory</replaceable></literal></term>

227

228

<para>

229

Target directory for key files. Default is

230

<filename>/etc/mandos</filename>.

231

</para>

232

</listitem>

233

</varlistentry>

234

235

236

<term><literal>-t</literal>, <literal>--type

237

238

239

<para>

240

Key type. Default is <quote>DSA</quote>.

241

</para>

242

</listitem>

243

</varlistentry>

244

245

246

<term><literal>-l</literal>, <literal>--length

247

248

249

<para>

250

Key length in bits. Default is 2048.

251

</para>

252

</listitem>

253

</varlistentry>

254

255

256

<term><literal>-s</literal>, <literal>--subtype

257

258

259

<para>

260

Subkey type. Default is <quote>ELG-E</quote> (Elgamal

261

encryption-only).

262

</para>

263

</listitem>

264

</varlistentry>

265

266

267

<term><literal>-L</literal>, <literal>--sublength

268

269

270

<para>

271

Subkey length in bits. Default is 2048.

272

</para>

273

</listitem>

274

</varlistentry>

275

276

277

<term><literal>-e</literal>, <literal>--email</literal>

278

<replaceable>address</replaceable></term>

279

280

<para>

281

Email address of key. Default is empty.

282

</para>

283

</listitem>

284

</varlistentry>

285

286

287

<term><literal>-c</literal>, <literal>--comment</literal>

288

<replaceable>comment</replaceable></term>

289

290

<para>

291

Comment field for key. The default value is

292

<quote><literal>Mandos client key</literal></quote>.

293

</para>

294

</listitem>

295

</varlistentry>

296

297

298

<term><literal>-x</literal>, <literal>--expire</literal>

299

300

301

<para>

302

Key expire time. Default is no expiration. See

303

304

<manvolnum>1</manvolnum></citerefentry> for syntax.

305

</para>

306

</listitem>

307

</varlistentry>

308

309

310

<term><literal>-f</literal>, <literal>--force</literal></term>

311

312

<para>

313

Force overwriting old keys.

314

</para>

315

</listitem>

316

</varlistentry>

317

318

<term><literal>-p</literal>, <literal>--password</literal

319

></term>

320

321

<para>

322

Prompt for a password and encrypt it with the key already

323

present in either <filename>/etc/mandos</filename> or the

324

directory specified with the <option>--dir</option>

325

option. Outputs, on standard output, a section suitable

326

for inclusion in <citerefentry><refentrytitle

327

>mandos-clients.conf</refentrytitle><manvolnum

328

>8</manvolnum></citerefentry>. The host name or the name

329

specified with the <option>--name</option> option is used

330

for the section header. All other options are ignored,

331

and no keys are created.

332

</para>

333

</listitem>

334

</varlistentry>

335

</variablelist>

336

</refsect1>

337

338

339

<title>OVERVIEW</title>

340

<xi:include href="overview.xml"/>

341

<para>

342

This program is a small utility to generate new OpenPGP keys for

343

new Mandos clients.

344

</para>

345

</refsect1>

346

347

348

<title>EXIT STATUS</title>

349

<para>

350

The exit status will be 0 if new keys were successfully created,

351

otherwise not.

352

</para>

353

</refsect1>

354

355

356

<title>ENVIRONMENT</title>

357

358

359

<term><envar>TMPDIR</envar></term>

360

361

<para>

362

If set, temporary files will be created here. See

363

<citerefentry><refentrytitle>mktemp</refentrytitle>

364

<manvolnum>1</manvolnum></citerefentry>.

365

</para>

366

</listitem>

367

</varlistentry>

368

</variablelist>

369

</refsect1>

370

371

372

<title>FILES</title>

373

<para>

374

Use the <option>--dir</option> option to change where

375

<command>&COMMANDNAME;</command> will write the key files. The

376

default file names are shown here.

377

</para>

378

379

380

<term><filename>/etc/mandos/seckey.txt</filename></term>

381

382

<para>

383

OpenPGP secret key file which will be created or

384

overwritten.

385

</para>

386

</listitem>

387

</varlistentry>

388

389

<term><filename>/etc/mandos/pubkey.txt</filename></term>

390

391

<para>

392

OpenPGP public key file which will be created or

393

overwritten.

394

</para>

395

</listitem>

396

</varlistentry>

397

398

399

400

<para>

401

Temporary files will be written here if

402

<varname>TMPDIR</varname> is not set.

403

</para>

404

</listitem>

405

</varlistentry>

406

</variablelist>

407

</refsect1>

408

409

410

411

<para>

412

None are known at this time.

413

</para>

414

</refsect1>

415

416

417

<title>EXAMPLE</title>

418

419

<para>

420

Normal invocation needs no options:

421

</para>

422

<para>

423

<userinput>&COMMANDNAME;</userinput>

424

</para>

425

</informalexample>

426

427

<para>

428

Create keys in another directory and of another type. Force

429

overwriting old key files:

430

</para>

431

<para>

432

433

434

<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>

435

436

</para>

437

</informalexample>

438

</refsect1>

439

440

441

<title>SECURITY</title>

442

<para>

443

The <option>--type</option>, <option>--length</option>,

444

<option>--subtype</option>, and <option>--sublength</option>

445

options can be used to create keys of insufficient security. If

446

in doubt, leave them to the default values.

447

</para>

448

<para>

449

The key expire time is not guaranteed to be honored by

450

<citerefentry><refentrytitle>mandos</refentrytitle>

451

<manvolnum>8</manvolnum></citerefentry>.

452

</para>

453

</refsect1>

454

455

456

457

<para>

458

459

<manvolnum>1</manvolnum></citerefentry>,

460

<citerefentry><refentrytitle>mandos</refentrytitle>

461

<manvolnum>8</manvolnum></citerefentry>,

462

<citerefentry><refentrytitle>password-request</refentrytitle>

463

<manvolnum>8mandos</manvolnum></citerefentry>

464

</para>

465

</refsect1>

466

467

</refentry>

468

469

470

471

472

Older »