1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
<!ENTITY VERSION "1.0">
4
5
<!ENTITY COMMANDNAME "mandos-keygen">
5
<!ENTITY TIMESTAMP "2015-07-20">
6
<!ENTITY % common SYSTEM "common.ent">
10
8
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
12
<title>Mandos Manual</title>
10
<title>&COMMANDNAME;</title>
13
11
<!-- NWalsh’s docbook scripts use this to generate the footer: -->
14
<productname>Mandos</productname>
15
<productnumber>&version;</productnumber>
16
<date>&TIMESTAMP;</date>
12
<productname>&COMMANDNAME;</productname>
13
<productnumber>&VERSION;</productnumber>
19
16
<firstname>Björn</firstname>
20
17
<surname>Påhlsson</surname>
22
<email>belorn@recompile.se</email>
19
<email>belorn@fukt.bsnet.se</email>
26
23
<firstname>Teddy</firstname>
27
24
<surname>Hogeborn</surname>
29
<email>teddy@recompile.se</email>
26
<email>teddy@fukt.bsnet.se</email>
42
32
<holder>Teddy Hogeborn</holder>
43
33
<holder>Björn Påhlsson</holder>
45
<xi:include href="legalnotice.xml"/>
37
This manual page is free software: you can redistribute it
38
and/or modify it under the terms of the GNU General Public
39
License as published by the Free Software Foundation,
40
either version 3 of the License, or (at your option) any
45
This manual page is distributed in the hope that it will
46
be useful, but WITHOUT ANY WARRANTY; without even the
47
implied warranty of MERCHANTABILITY or FITNESS FOR A
48
PARTICULAR PURPOSE. See the GNU General Public License
53
You should have received a copy of the GNU General Public
54
License along with this program; If not, see
55
<ulink url="http://www.gnu.org/licenses/"/>.
49
61
<refentrytitle>&COMMANDNAME;</refentrytitle>
50
62
<manvolnum>8</manvolnum>
54
66
<refname><command>&COMMANDNAME;</command></refname>
56
Generate key and password for Mandos client and server.
68
Generate keys for <citerefentry><refentrytitle>password-request
69
</refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
62
75
<command>&COMMANDNAME;</command>
64
<arg choice="plain"><option>--dir
65
<replaceable>DIRECTORY</replaceable></option></arg>
66
<arg choice="plain"><option>-d
67
<replaceable>DIRECTORY</replaceable></option></arg>
71
<arg choice="plain"><option>--type
72
<replaceable>KEYTYPE</replaceable></option></arg>
73
<arg choice="plain"><option>-t
74
<replaceable>KEYTYPE</replaceable></option></arg>
78
<arg choice="plain"><option>--length
79
<replaceable>BITS</replaceable></option></arg>
80
<arg choice="plain"><option>-l
81
<replaceable>BITS</replaceable></option></arg>
85
<arg choice="plain"><option>--subtype
86
<replaceable>KEYTYPE</replaceable></option></arg>
87
<arg choice="plain"><option>-s
88
<replaceable>KEYTYPE</replaceable></option></arg>
92
<arg choice="plain"><option>--sublength
93
<replaceable>BITS</replaceable></option></arg>
94
<arg choice="plain"><option>-L
95
<replaceable>BITS</replaceable></option></arg>
99
<arg choice="plain"><option>--name
100
<replaceable>NAME</replaceable></option></arg>
101
<arg choice="plain"><option>-n
102
<replaceable>NAME</replaceable></option></arg>
106
<arg choice="plain"><option>--email
107
<replaceable>ADDRESS</replaceable></option></arg>
108
<arg choice="plain"><option>-e
109
<replaceable>ADDRESS</replaceable></option></arg>
113
<arg choice="plain"><option>--comment
114
<replaceable>TEXT</replaceable></option></arg>
115
<arg choice="plain"><option>-c
116
<replaceable>TEXT</replaceable></option></arg>
120
<arg choice="plain"><option>--expire
121
<replaceable>TIME</replaceable></option></arg>
122
<arg choice="plain"><option>-x
123
<replaceable>TIME</replaceable></option></arg>
77
<arg choice="plain"><option>--dir</option>
78
<replaceable>directory</replaceable></arg>
81
<arg choice="plain"><option>--type</option>
82
<replaceable>type</replaceable></arg>
85
<arg choice="plain"><option>--length</option>
86
<replaceable>bits</replaceable></arg>
89
<arg choice="plain"><option>--subtype</option>
90
<replaceable>type</replaceable></arg>
93
<arg choice="plain"><option>--sublength</option>
94
<replaceable>bits</replaceable></arg>
97
<arg choice="plain"><option>--name</option>
98
<replaceable>NAME</replaceable></arg>
101
<arg choice="plain"><option>--email</option>
102
<replaceable>EMAIL</replaceable></arg>
105
<arg choice="plain"><option>--comment</option>
106
<replaceable>COMMENT</replaceable></arg>
109
<arg choice="plain"><option>--expire</option>
110
<replaceable>TIME</replaceable></arg>
127
113
<arg choice="plain"><option>--force</option></arg>
117
<command>&COMMANDNAME;</command>
119
<arg choice="plain"><option>-d</option>
120
<replaceable>directory</replaceable></arg>
123
<arg choice="plain"><option>-t</option>
124
<replaceable>type</replaceable></arg>
127
<arg choice="plain"><option>-l</option>
128
<replaceable>bits</replaceable></arg>
131
<arg choice="plain"><option>-s</option>
132
<replaceable>type</replaceable></arg>
135
<arg choice="plain"><option>-L</option>
136
<replaceable>bits</replaceable></arg>
139
<arg choice="plain"><option>-n</option>
140
<replaceable>NAME</replaceable></arg>
143
<arg choice="plain"><option>-e</option>
144
<replaceable>EMAIL</replaceable></arg>
147
<arg choice="plain"><option>-c</option>
148
<replaceable>COMMENT</replaceable></arg>
151
<arg choice="plain"><option>-x</option>
152
<replaceable>TIME</replaceable></arg>
128
155
<arg choice="plain"><option>-f</option></arg>
132
159
<command>&COMMANDNAME;</command>
133
160
<group choice="req">
161
<arg choice="plain"><option>-p</option></arg>
134
162
<arg choice="plain"><option>--password</option></arg>
135
<arg choice="plain"><option>-p</option></arg>
136
<arg choice="plain"><option>--passfile
137
<replaceable>FILE</replaceable></option></arg>
138
<arg choice="plain"><option>-F</option>
139
<replaceable>FILE</replaceable></arg>
143
<arg choice="plain"><option>--dir
144
<replaceable>DIRECTORY</replaceable></option></arg>
145
<arg choice="plain"><option>-d
146
<replaceable>DIRECTORY</replaceable></option></arg>
150
<arg choice="plain"><option>--name
151
<replaceable>NAME</replaceable></option></arg>
152
<arg choice="plain"><option>-n
153
<replaceable>NAME</replaceable></option></arg>
156
<arg choice="plain"><option>--no-ssh</option></arg>
157
<arg choice="plain"><option>-S</option></arg>
165
<arg choice="plain"><option>--dir</option>
166
<replaceable>directory</replaceable></arg>
169
<arg choice="plain"><option>--name</option>
170
<replaceable>NAME</replaceable></arg>
161
174
<command>&COMMANDNAME;</command>
162
175
<group choice="req">
176
<arg choice="plain"><option>-h</option></arg>
163
177
<arg choice="plain"><option>--help</option></arg>
164
<arg choice="plain"><option>-h</option></arg>
168
181
<command>&COMMANDNAME;</command>
169
182
<group choice="req">
183
<arg choice="plain"><option>-v</option></arg>
170
184
<arg choice="plain"><option>--version</option></arg>
171
<arg choice="plain"><option>-v</option></arg>
174
187
</refsynopsisdiv>
176
189
<refsect1 id="description">
177
190
<title>DESCRIPTION</title>
179
192
<command>&COMMANDNAME;</command> is a program to generate the
181
<citerefentry><refentrytitle>mandos-client</refentrytitle>
182
<manvolnum>8mandos</manvolnum></citerefentry>. The key is
194
<citerefentry><refentrytitle>password-request</refentrytitle>
195
<manvolnum>8mandos</manvolnum></citerefentry>. The keys are
183
196
normally written to /etc/mandos for later installation into the
184
initrd image, but this, and most other things, can be changed
185
with command line options.
197
initrd image, but this, like most things, can be changed with
198
command line options.
188
This program can also be used with the
189
<option>--password</option> or <option>--passfile</option>
190
options to generate a ready-made section for
191
<filename>clients.conf</filename> (see
201
It can also be used to generate ready-made sections for
192
202
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
193
<manvolnum>5</manvolnum></citerefentry>).
203
<manvolnum>5</manvolnum></citerefentry> using the
204
<option>--password</option> option.
197
208
<refsect1 id="purpose">
198
209
<title>PURPOSE</title>
200
212
The purpose of this is to enable <emphasis>remote and unattended
201
213
rebooting</emphasis> of client host computer with an
202
214
<emphasis>encrypted root file system</emphasis>. See <xref
203
215
linkend="overview"/> for details.
207
220
<refsect1 id="options">
208
221
<title>OPTIONS</title>
212
<term><option>--help</option></term>
213
<term><option>-h</option></term>
225
<term><literal>-h</literal>, <literal>--help</literal></term>
216
228
Show a help message and exit
223
<replaceable>DIRECTORY</replaceable></option></term>
225
<replaceable>DIRECTORY</replaceable></option></term>
234
<term><literal>-d</literal>, <literal>--dir
235
<replaceable>directory</replaceable></literal></term>
228
238
Target directory for key files. Default is
229
<filename class="directory">/etc/mandos</filename>.
236
<replaceable>TYPE</replaceable></option></term>
238
<replaceable>TYPE</replaceable></option></term>
241
Key type. Default is <quote>RSA</quote>.
247
<term><option>--length
248
<replaceable>BITS</replaceable></option></term>
250
<replaceable>BITS</replaceable></option></term>
253
Key length in bits. Default is 4096.
259
<term><option>--subtype
260
<replaceable>KEYTYPE</replaceable></option></term>
262
<replaceable>KEYTYPE</replaceable></option></term>
265
Subkey type. Default is <quote>RSA</quote> (Elgamal
239
<filename>/etc/mandos</filename>.
245
<term><literal>-t</literal>, <literal>--type
246
<replaceable>type</replaceable></literal></term>
249
Key type. Default is <quote>DSA</quote>.
255
<term><literal>-l</literal>, <literal>--length
256
<replaceable>bits</replaceable></literal></term>
259
Key length in bits. Default is 1024.
265
<term><literal>-s</literal>, <literal>--subtype
266
<replaceable>type</replaceable></literal></term>
269
Subkey type. Default is <quote>ELG-E</quote> (Elgamal
266
270
encryption-only).
272
<term><option>--sublength
273
<replaceable>BITS</replaceable></option></term>
275
<replaceable>BITS</replaceable></option></term>
276
<term><literal>-L</literal>, <literal>--sublength
277
<replaceable>bits</replaceable></literal></term>
278
Subkey length in bits. Default is 4096.
280
Subkey length in bits. Default is 2048.
284
<term><option>--email
285
<replaceable>ADDRESS</replaceable></option></term>
287
<replaceable>ADDRESS</replaceable></option></term>
286
<term><literal>-e</literal>, <literal>--email</literal>
287
<replaceable>address</replaceable></term>
290
290
Email address of key. Default is empty.
296
<term><option>--comment
297
<replaceable>TEXT</replaceable></option></term>
299
<replaceable>TEXT</replaceable></option></term>
296
<term><literal>-c</literal>, <literal>--comment</literal>
297
<replaceable>comment</replaceable></term>
302
Comment field for key. Default is empty.
300
Comment field for key. The default value is
301
<quote><literal>Mandos client key</literal></quote>.
308
<term><option>--expire
309
<replaceable>TIME</replaceable></option></term>
311
<replaceable>TIME</replaceable></option></term>
307
<term><literal>-x</literal>, <literal>--expire</literal>
308
<replaceable>time</replaceable></term>
314
311
Key expire time. Default is no expiration. See
462
429
Normal invocation needs no options:
465
<userinput>&COMMANDNAME;</userinput>
432
<userinput>mandos-keygen</userinput>
467
434
</informalexample>
468
435
<informalexample>
470
Create key in another directory and of another type. Force
437
Create keys in another directory and of another type. Force
471
438
overwriting old key files:
475
442
<!-- do not wrap this line -->
476
<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>
482
Prompt for a password, encrypt it with the key in <filename
483
class="directory">/etc/mandos</filename> and output a section
484
suitable for <filename>clients.conf</filename>.
487
<userinput>&COMMANDNAME; --password</userinput>
492
Prompt for a password, encrypt it with the key in the
493
<filename>client-key</filename> directory and output a section
494
suitable for <filename>clients.conf</filename>.
498
<!-- do not wrap this line -->
499
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
443
<userinput>mandos-keygen --dir ~/keydir --type RSA --force</userinput>
502
446
</informalexample>
505
449
<refsect1 id="security">
506
450
<title>SECURITY</title>
508
452
The <option>--type</option>, <option>--length</option>,
509
453
<option>--subtype</option>, and <option>--sublength</option>
510
options can be used to create keys of low security. If in
511
doubt, leave them to the default values.
454
options can be used to create keys of insufficient security. If
455
in doubt, leave them to the default values.
514
The key expire time is <emphasis>not</emphasis> guaranteed to be
515
honored by <citerefentry><refentrytitle>mandos</refentrytitle>
458
The key expire time is not guaranteed to be honored by
459
<citerefentry><refentrytitle>mandos</refentrytitle>
516
460
<manvolnum>8</manvolnum></citerefentry>.
520
464
<refsect1 id="see_also">
521
465
<title>SEE ALSO</title>
523
<citerefentry><refentrytitle>intro</refentrytitle>
467
<citerefentry><refentrytitle>password-request</refentrytitle>
524
468
<manvolnum>8mandos</manvolnum></citerefentry>,
469
<citerefentry><refentrytitle>mandos</refentrytitle>
470
<manvolnum>8</manvolnum></citerefentry>,
525
471
<citerefentry><refentrytitle>gpg</refentrytitle>
526
<manvolnum>1</manvolnum></citerefentry>,
527
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
528
<manvolnum>5</manvolnum></citerefentry>,
529
<citerefentry><refentrytitle>mandos</refentrytitle>
530
<manvolnum>8</manvolnum></citerefentry>,
531
<citerefentry><refentrytitle>mandos-client</refentrytitle>
532
<manvolnum>8mandos</manvolnum></citerefentry>,
533
<citerefentry><refentrytitle>ssh-keyscan</refentrytitle>
534
472
<manvolnum>1</manvolnum></citerefentry>
539
<!-- Local Variables: -->
540
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
541
<!-- time-stamp-end: "[\"']>" -->
542
<!-- time-stamp-format: "%:y-%02m-%02d" -->