68
66
<refname><command>&COMMANDNAME;</command></refname>
70
Generate key and password for Mandos client and server.
68
Generate keys for <citerefentry><refentrytitle>password-request
69
</refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
76
75
<command>&COMMANDNAME;</command>
78
<arg choice="plain"><option>--dir
79
<replaceable>DIRECTORY</replaceable></option></arg>
80
<arg choice="plain"><option>-d
81
<replaceable>DIRECTORY</replaceable></option></arg>
85
<arg choice="plain"><option>--type
86
<replaceable>KEYTYPE</replaceable></option></arg>
87
<arg choice="plain"><option>-t
88
<replaceable>KEYTYPE</replaceable></option></arg>
92
<arg choice="plain"><option>--length
93
<replaceable>BITS</replaceable></option></arg>
94
<arg choice="plain"><option>-l
95
<replaceable>BITS</replaceable></option></arg>
99
<arg choice="plain"><option>--subtype
100
<replaceable>KEYTYPE</replaceable></option></arg>
101
<arg choice="plain"><option>-s
102
<replaceable>KEYTYPE</replaceable></option></arg>
106
<arg choice="plain"><option>--sublength
107
<replaceable>BITS</replaceable></option></arg>
108
<arg choice="plain"><option>-L
109
<replaceable>BITS</replaceable></option></arg>
113
<arg choice="plain"><option>--name
114
<replaceable>NAME</replaceable></option></arg>
115
<arg choice="plain"><option>-n
116
<replaceable>NAME</replaceable></option></arg>
120
<arg choice="plain"><option>--email
121
<replaceable>ADDRESS</replaceable></option></arg>
122
<arg choice="plain"><option>-e
123
<replaceable>ADDRESS</replaceable></option></arg>
127
<arg choice="plain"><option>--comment
128
<replaceable>TEXT</replaceable></option></arg>
129
<arg choice="plain"><option>-c
130
<replaceable>TEXT</replaceable></option></arg>
134
<arg choice="plain"><option>--expire
135
<replaceable>TIME</replaceable></option></arg>
136
<arg choice="plain"><option>-x
137
<replaceable>TIME</replaceable></option></arg>
140
<arg><option>--force</option></arg>
143
<command>&COMMANDNAME;</command>
145
<arg choice="plain"><option>--password</option></arg>
146
<arg choice="plain"><option>-p</option></arg>
150
<arg choice="plain"><option>--dir
151
<replaceable>DIRECTORY</replaceable></option></arg>
152
<arg choice="plain"><option>-d
153
<replaceable>DIRECTORY</replaceable></option></arg>
157
<arg choice="plain"><option>--name
158
<replaceable>NAME</replaceable></option></arg>
159
<arg choice="plain"><option>-n
160
<replaceable>NAME</replaceable></option></arg>
164
<command>&COMMANDNAME;</command>
166
<arg choice="plain"><option>--help</option></arg>
167
<arg choice="plain"><option>-h</option></arg>
171
<command>&COMMANDNAME;</command>
173
<arg choice="plain"><option>--version</option></arg>
174
<arg choice="plain"><option>-v</option></arg>
77
<arg choice="plain"><option>--dir</option>
78
<replaceable>directory</replaceable></arg>
81
<arg choice="plain"><option>--type</option>
82
<replaceable>type</replaceable></arg>
85
<arg choice="plain"><option>--length</option>
86
<replaceable>bits</replaceable></arg>
89
<arg choice="plain"><option>--name</option>
90
<replaceable>NAME</replaceable></arg>
93
<arg choice="plain"><option>--email</option>
94
<replaceable>EMAIL</replaceable></arg>
97
<arg choice="plain"><option>--comment</option>
98
<replaceable>COMMENT</replaceable></arg>
101
<arg choice="plain"><option>--expire</option>
102
<replaceable>TIME</replaceable></arg>
105
<arg choice="plain"><option>--force</option></arg>
109
<command>&COMMANDNAME;</command>
111
<arg choice="plain"><option>-d</option>
112
<replaceable>directory</replaceable></arg>
115
<arg choice="plain"><option>-t</option>
116
<replaceable>type</replaceable></arg>
119
<arg choice="plain"><option>-l</option>
120
<replaceable>bits</replaceable></arg>
123
<arg choice="plain"><option>-n</option>
124
<replaceable>NAME</replaceable></arg>
127
<arg choice="plain"><option>-e</option>
128
<replaceable>EMAIL</replaceable></arg>
131
<arg choice="plain"><option>-c</option>
132
<replaceable>COMMENT</replaceable></arg>
135
<arg choice="plain"><option>-x</option>
136
<replaceable>TIME</replaceable></arg>
139
<arg choice="plain"><option>-f</option></arg>
143
<command>&COMMANDNAME;</command>
145
<arg choice='plain'><option>-h</option></arg>
146
<arg choice='plain'><option>--help</option></arg>
150
<command>&COMMANDNAME;</command>
152
<arg choice='plain'><option>-v</option></arg>
153
<arg choice='plain'><option>--version</option></arg>
177
156
</refsynopsisdiv>
179
158
<refsect1 id="description">
180
159
<title>DESCRIPTION</title>
182
161
<command>&COMMANDNAME;</command> is a program to generate the
184
163
<citerefentry><refentrytitle>password-request</refentrytitle>
185
<manvolnum>8mandos</manvolnum></citerefentry>. The key is
164
<manvolnum>8mandos</manvolnum></citerefentry>. The keys are
186
165
normally written to /etc/mandos for later installation into the
187
initrd image, but this, and most other things, can be changed
188
with command line options.
191
This program can also be used with the
192
<option>--password</option> option to generate a ready-made
193
section for <filename>clients.conf</filename> (see
194
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
195
<manvolnum>5</manvolnum></citerefentry>).
166
initrd image, but this, like most things, can be changed with
167
command line options.
199
171
<refsect1 id="purpose">
200
172
<title>PURPOSE</title>
202
175
The purpose of this is to enable <emphasis>remote and unattended
203
176
rebooting</emphasis> of client host computer with an
204
177
<emphasis>encrypted root file system</emphasis>. See <xref
205
178
linkend="overview"/> for details.
209
183
<refsect1 id="options">
210
184
<title>OPTIONS</title>
214
<term><option>--help</option></term>
215
<term><option>-h</option></term>
188
<term><literal>-h</literal>, <literal>--help</literal></term>
218
191
Show a help message and exit
225
<replaceable>DIRECTORY</replaceable></option></term>
227
<replaceable>DIRECTORY</replaceable></option></term>
230
Target directory for key files. Default is
231
<filename>/etc/mandos</filename>.
238
<replaceable>TYPE</replaceable></option></term>
240
<replaceable>TYPE</replaceable></option></term>
243
Key type. Default is <quote>DSA</quote>.
249
<term><option>--length
250
<replaceable>BITS</replaceable></option></term>
252
<replaceable>BITS</replaceable></option></term>
255
Key length in bits. Default is 2048.
261
<term><option>--subtype
262
<replaceable>KEYTYPE</replaceable></option></term>
264
<replaceable>KEYTYPE</replaceable></option></term>
267
Subkey type. Default is <quote>ELG-E</quote> (Elgamal
274
<term><option>--sublength
275
<replaceable>BITS</replaceable></option></term>
277
<replaceable>BITS</replaceable></option></term>
280
Subkey length in bits. Default is 2048.
286
<term><option>--email
287
<replaceable>ADDRESS</replaceable></option></term>
289
<replaceable>ADDRESS</replaceable></option></term>
197
<term><literal>-d</literal>, <literal>--dir
198
<replaceable>directory</replaceable></literal></term>
201
Target directory for key files.
207
<term><literal>-t</literal>, <literal>--type
208
<replaceable>type</replaceable></literal></term>
211
Key type. Default is DSA.
217
<term><literal>-l</literal>, <literal>--length
218
<replaceable>bits</replaceable></literal></term>
221
Key length in bits. Default is 1024.
227
<term><literal>-e</literal>, <literal>--email</literal>
228
<replaceable>address</replaceable></term>
292
231
Email address of key. Default is empty.
354
270
<refsect1 id="overview">
355
271
<title>OVERVIEW</title>
356
<xi:include href="overview.xml"/>
358
This program is a small utility to generate new OpenPGP keys for
359
new Mandos clients, and to generate sections for inclusion in
360
<filename>clients.conf</filename> on the server.
274
This program is a small program to generate new OpenPGP keys for
364
279
<refsect1 id="exit_status">
365
280
<title>EXIT STATUS</title>
367
The exit status will be 0 if a new key (or password, if the
368
<option>--password</option> option was used) was successfully
369
created, otherwise not.
373
<refsect1 id="environment">
374
<title>ENVIRONMENT</title>
377
<term><envar>TMPDIR</envar></term>
380
If set, temporary files will be created here. See
381
<citerefentry><refentrytitle>mktemp</refentrytitle>
382
<manvolnum>1</manvolnum></citerefentry>.
389
285
<refsect1 id="file">
390
286
<title>FILES</title>
392
Use the <option>--dir</option> option to change where
393
<command>&COMMANDNAME;</command> will write the key files. The
394
default file names are shown here.
398
<term><filename>/etc/mandos/seckey.txt</filename></term>
401
OpenPGP secret key file which will be created or
407
<term><filename>/etc/mandos/pubkey.txt</filename></term>
410
OpenPGP public key file which will be created or
416
<term><filename>/tmp</filename></term>
419
Temporary files will be written here if
420
<varname>TMPDIR</varname> is not set.
427
291
<refsect1 id="bugs">
428
292
<title>BUGS</title>
430
None are known at this time.
434
297
<refsect1 id="example">
435
298
<title>EXAMPLE</title>
438
Normal invocation needs no options:
441
<userinput>&COMMANDNAME;</userinput>
446
Create key in another directory and of another type. Force
447
overwriting old key files:
451
<!-- do not wrap this line -->
452
<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>
458
Prompt for a password, encrypt it with the key in
459
<filename>/etc/mandos</filename> and output a section suitable
460
for <filename>clients.conf</filename>.
463
<userinput>&COMMANDNAME; --password</userinput>
468
Prompt for a password, encrypt it with the key in the
469
<filename>client-key</filename> directory and output a section
470
suitable for <filename>clients.conf</filename>.
474
<!-- do not wrap this line -->
475
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
481
303
<refsect1 id="security">
482
304
<title>SECURITY</title>
484
The <option>--type</option>, <option>--length</option>,
485
<option>--subtype</option>, and <option>--sublength</option>
486
options can be used to create keys of low security. If in
487
doubt, leave them to the default values.
490
The key expire time is <emphasis>not</emphasis> guaranteed to be
491
honored by <citerefentry><refentrytitle>mandos</refentrytitle>
492
<manvolnum>8</manvolnum></citerefentry>.
496
309
<refsect1 id="see_also">
497
310
<title>SEE ALSO</title>
312
<citerefentry><refentrytitle>password-request</refentrytitle>
313
<manvolnum>8mandos</manvolnum></citerefentry>,
314
<citerefentry><refentrytitle>mandos</refentrytitle>
315
<manvolnum>8</manvolnum></citerefentry>, and
499
316
<citerefentry><refentrytitle>gpg</refentrytitle>
500
<manvolnum>1</manvolnum></citerefentry>,
501
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
502
<manvolnum>5</manvolnum></citerefentry>,
503
<citerefentry><refentrytitle>mandos</refentrytitle>
504
<manvolnum>8</manvolnum></citerefentry>,
505
<citerefentry><refentrytitle>password-request</refentrytitle>
506
<manvolnum>8mandos</manvolnum></citerefentry>
317
<manvolnum>1</manvolnum></citerefentry>
511
<!-- Local Variables: -->
512
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
513
<!-- time-stamp-end: "[\"']>" -->
514
<!-- time-stamp-format: "%:y-%02m-%02d" -->