/mandos/trunk

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"

	"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

<!ENTITY VERSION "1.0">

<!ENTITY COMMANDNAME "mandos-keygen">

<!ENTITY TIMESTAMP "2008-08-31">

]>

<refentry xmlns:xi="http://www.w3.org/2001/XInclude">

  <refentryinfo>

    <title>Mandos Manual</title>

    <!-- NWalsh’s docbook scripts use this to generate the footer: -->

    <productname>Mandos</productname>

    <productnumber>&VERSION;</productnumber>

    <date>&TIMESTAMP;</date>

    <authorgroup>

      <author>

	<firstname>Björn</firstname>

	<surname>Påhlsson</surname>

	<address>

	  <email>belorn@fukt.bsnet.se</email>

	</address>

      </author>

      <author>

	<firstname>Teddy</firstname>

	<surname>Hogeborn</surname>

	<address>

	  <email>teddy@fukt.bsnet.se</email>

	</address>

      </author>

    </authorgroup>

    <copyright>

      <year>2008</year>

      <holder>Teddy Hogeborn</holder>

      <holder>Björn Påhlsson</holder>

    </copyright>

    <legalnotice>

      <para>

	This manual page is free software: you can redistribute it

	and/or modify it under the terms of the GNU General Public

	License as published by the Free Software Foundation,

	either version 3 of the License, or (at your option) any

	later version.

      </para>

      <para>

	This manual page is distributed in the hope that it will

	be useful, but WITHOUT ANY WARRANTY; without even the

	implied warranty of MERCHANTABILITY or FITNESS FOR A

	PARTICULAR PURPOSE.  See the GNU General Public License

	for more details.

      </para>

      <para>

	You should have received a copy of the GNU General Public

	License along with this program; If not, see

	<ulink url="http://www.gnu.org/licenses/"/>.

      </para>

    </legalnotice>

  </refentryinfo>

  <refmeta>

    <refentrytitle>&COMMANDNAME;</refentrytitle>

    <manvolnum>8</manvolnum>

  </refmeta>

  <refnamediv>

    <refname><command>&COMMANDNAME;</command></refname>

    <refpurpose>

      Generate keys for <citerefentry><refentrytitle>password-request

      </refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>

    </refpurpose>

  </refnamediv>

  <refsynopsisdiv>

    <cmdsynopsis>

      <command>&COMMANDNAME;</command>

      <group>

	<arg choice="plain"><option>--dir

	<replaceable>DIRECTORY</replaceable></option></arg>

	<arg choice="plain"><option>-d

	<replaceable>DIRECTORY</replaceable></option></arg>

      </group>

      <sbr/>

      <group>

	<arg choice="plain"><option>--type

	<replaceable>KEYTYPE</replaceable></option></arg>

	<arg choice="plain"><option>-t

	<replaceable>KEYTYPE</replaceable></option></arg>

      </group>

      <sbr/>

      <group>

	<arg choice="plain"><option>--length

	<replaceable>BITS</replaceable></option></arg>

	<arg choice="plain"><option>-l

	<replaceable>BITS</replaceable></option></arg>

      </group>

      <sbr/>

      <group>

	<arg choice="plain"><option>--subtype

	<replaceable>KEYTYPE</replaceable></option></arg>

	<arg choice="plain"><option>-s

	<replaceable>KEYTYPE</replaceable></option></arg>

      </group>

      <sbr/>

      <group>

	<arg choice="plain"><option>--sublength

	<replaceable>BITS</replaceable></option></arg>

	<arg choice="plain"><option>-L

	<replaceable>BITS</replaceable></option></arg>

      </group>

      <sbr/>

      <group>

	<arg choice="plain"><option>--name

	<replaceable>NAME</replaceable></option></arg>

	<arg choice="plain"><option>-n

	<replaceable>NAME</replaceable></option></arg>

      </group>

      <sbr/>

      <group>

	<arg choice="plain"><option>--email

	<replaceable>ADDRESS</replaceable></option></arg>

	<arg choice="plain"><option>-e

	<replaceable>ADDRESS</replaceable></option></arg>

      </group>

      <sbr/>

      <group>

	<arg choice="plain"><option>--comment

	<replaceable>TEXT</replaceable></option></arg>

	<arg choice="plain"><option>-c

	<replaceable>TEXT</replaceable></option></arg>

      </group>

      <sbr/>

      <group>

	<arg choice="plain"><option>--expire

	<replaceable>TIME</replaceable></option></arg>

	<arg choice="plain"><option>-x

	<replaceable>TIME</replaceable></option></arg>

      </group>

      <sbr/>

      <arg><option>--force</option></arg>

    </cmdsynopsis>

    <cmdsynopsis>

      <command>&COMMANDNAME;</command>

      <group choice="req">

	<arg choice="plain"><option>--password</option></arg>

	<arg choice="plain"><option>-p</option></arg>

      </group>

      <sbr/>

      <group>

	<arg choice="plain"><option>--dir

	<replaceable>DIRECTORY</replaceable></option></arg>

	<arg choice="plain"><option>-d

	<replaceable>DIRECTORY</replaceable></option></arg>

      </group>

      <sbr/>

      <group>

	<arg choice="plain"><option>--name

	<replaceable>NAME</replaceable></option></arg>

	<arg choice="plain"><option>-n

	<replaceable>NAME</replaceable></option></arg>

      </group>

    </cmdsynopsis>

    <cmdsynopsis>

      <command>&COMMANDNAME;</command>

      <group choice="req">

	<arg choice="plain"><option>--help</option></arg>

	<arg choice="plain"><option>-h</option></arg>

      </group>

    </cmdsynopsis>

    <cmdsynopsis>

      <command>&COMMANDNAME;</command>

      <group choice="req">

	<arg choice="plain"><option>--version</option></arg>

	<arg choice="plain"><option>-v</option></arg>

      </group>

    </cmdsynopsis>

  </refsynopsisdiv>

  <refsect1 id="description">

    <title>DESCRIPTION</title>

    <para>

      <command>&COMMANDNAME;</command> is a program to generate the

      OpenPGP keys used by

      <citerefentry><refentrytitle>password-request</refentrytitle>

      <manvolnum>8mandos</manvolnum></citerefentry>.  The keys are

      normally written to /etc/mandos for later installation into the

      initrd image, but this, like most things, can be changed with

      command line options.

    </para>

    <para>

      It can also be used to generate ready-made sections for

      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>

      <manvolnum>5</manvolnum></citerefentry> using the

      <option>--password</option> option.

    </para>

  </refsect1>

  <refsect1 id="purpose">

    <title>PURPOSE</title>

    <para>

      The purpose of this is to enable <emphasis>remote and unattended

      rebooting</emphasis> of client host computer with an

      <emphasis>encrypted root file system</emphasis>.  See <xref

      linkend="overview"/> for details.

    </para>

  </refsect1>

  <refsect1 id="options">

    <title>OPTIONS</title>

    <variablelist>

      <varlistentry>

	<term><literal>-h</literal>, <literal>--help</literal></term>

	<listitem>

	  <para>

	    Show a help message and exit

	  </para>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term><literal>-d</literal>, <literal>--dir

	<replaceable>directory</replaceable></literal></term>

	<listitem>

	  <para>

	    Target directory for key files.  Default is

	    <filename>/etc/mandos</filename>.

	  </para>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term><literal>-t</literal>, <literal>--type

	<replaceable>type</replaceable></literal></term>

	<listitem>

	  <para>

	    Key type.  Default is <quote>DSA</quote>.

	  </para>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term><literal>-l</literal>, <literal>--length

	<replaceable>bits</replaceable></literal></term>

	<listitem>

	  <para>

	    Key length in bits.  Default is 2048.

	  </para>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term><literal>-s</literal>, <literal>--subtype

	<replaceable>type</replaceable></literal></term>

	<listitem>

	  <para>

	    Subkey type.  Default is <quote>ELG-E</quote> (Elgamal

	    encryption-only).

	  </para>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term><literal>-L</literal>, <literal>--sublength

	<replaceable>bits</replaceable></literal></term>

	<listitem>

	  <para>

	    Subkey length in bits.  Default is 2048.

	  </para>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term><literal>-e</literal>, <literal>--email</literal>

	<replaceable>address</replaceable></term>

	<listitem>

	  <para>

	    Email address of key.  Default is empty.

	  </para>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term><literal>-c</literal>, <literal>--comment</literal>

	<replaceable>comment</replaceable></term>

	<listitem>

	  <para>

	    Comment field for key.  The default value is

	    <quote><literal>Mandos client key</literal></quote>.

	  </para>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term><literal>-x</literal>, <literal>--expire</literal>

	<replaceable>time</replaceable></term>

	<listitem>

	  <para>

	    Key expire time.  Default is no expiration.  See

	    <citerefentry><refentrytitle>gpg</refentrytitle>

	    <manvolnum>1</manvolnum></citerefentry> for syntax.

	  </para>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term><literal>-f</literal>, <literal>--force</literal></term>

	<listitem>

	  <para>

	    Force overwriting old keys.

	  </para>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term><literal>-p</literal>, <literal>--password</literal

	></term>

	<listitem>

	  <para>

	    Prompt for a password and encrypt it with the key already

	    present in either <filename>/etc/mandos</filename> or the

	    directory specified with the <option>--dir</option>

	    option.  Outputs, on standard output, a section suitable

	    for inclusion in <citerefentry><refentrytitle

	    >mandos-clients.conf</refentrytitle><manvolnum

	    >8</manvolnum></citerefentry>.  The host name or the name

	    specified with the <option>--name</option> option is used

	    for the section header.  All other options are ignored,

	    and no keys are created.

	  </para>

	</listitem>

      </varlistentry>

    </variablelist>

  </refsect1>

  <refsect1 id="overview">

    <title>OVERVIEW</title>

    <xi:include href="overview.xml"/>

    <para>

      This program is a small utility to generate new OpenPGP keys for

      new Mandos clients.

    </para>

  </refsect1>

  <refsect1 id="exit_status">

    <title>EXIT STATUS</title>

    <para>

      The exit status will be 0 if new keys were successfully created,

      otherwise not.

    </para>

  </refsect1>

  <refsect1 id="environment">

    <title>ENVIRONMENT</title>

    <variablelist>

      <varlistentry>

	<term><envar>TMPDIR</envar></term>

	<listitem>

	  <para>

	    If set, temporary files will be created here. See

	    <citerefentry><refentrytitle>mktemp</refentrytitle>

	    <manvolnum>1</manvolnum></citerefentry>.

	  </para>

	</listitem>

      </varlistentry>

    </variablelist>

  </refsect1>

  <refsect1 id="file">

    <title>FILES</title>

    <para>

      Use the <option>--dir</option> option to change where

      <command>&COMMANDNAME;</command> will write the key files.  The

      default file names are shown here.

    </para>

    <variablelist>

      <varlistentry>

	<term><filename>/etc/mandos/seckey.txt</filename></term>

	<listitem>

	  <para>

	    OpenPGP secret key file which will be created or

	    overwritten.

	  </para>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term><filename>/etc/mandos/pubkey.txt</filename></term>

	<listitem>

	  <para>

	    OpenPGP public key file which will be created or

	    overwritten.

	  </para>

	</listitem>

      </varlistentry>

      <varlistentry>

	<term><filename>/tmp</filename></term>

	<listitem>

	  <para>

	    Temporary files will be written here if

	    <varname>TMPDIR</varname> is not set.

	  </para>

	</listitem>

      </varlistentry>

    </variablelist>

  </refsect1>

  <refsect1 id="bugs">

    <title>BUGS</title>

    <para>

      None are known at this time.

    </para>

  </refsect1>

  <refsect1 id="example">

    <title>EXAMPLE</title>

    <informalexample>

      <para>

	Normal invocation needs no options:

      </para>

      <para>

	<userinput>&COMMANDNAME;</userinput>

      </para>

    </informalexample>

    <informalexample>

      <para>

	Create keys in another directory and of another type.  Force

	overwriting old key files:

      </para>

      <para>

<!-- do not wrap this line -->

<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>

      </para>

    </informalexample>

  </refsect1>

  <refsect1 id="security">

    <title>SECURITY</title>

    <para>

      The <option>--type</option>, <option>--length</option>,

      <option>--subtype</option>, and <option>--sublength</option>

      options can be used to create keys of insufficient security.  If

      in doubt, leave them to the default values.

    </para>

    <para>

      The key expire time is not guaranteed to be honored by

      <citerefentry><refentrytitle>mandos</refentrytitle>

      <manvolnum>8</manvolnum></citerefentry>.

    </para>

  </refsect1>

  <refsect1 id="see_also">

    <title>SEE ALSO</title>

    <para>

      <citerefentry><refentrytitle>gpg</refentrytitle>

      <manvolnum>1</manvolnum></citerefentry>,

      <citerefentry><refentrytitle>mandos</refentrytitle>

      <manvolnum>8</manvolnum></citerefentry>,

      <citerefentry><refentrytitle>password-request</refentrytitle>

      <manvolnum>8mandos</manvolnum></citerefentry>

    </para>

  </refsect1>

</refentry>

<!-- Local Variables: -->

<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->

<!-- time-stamp-end: "[\"']>" -->

<!-- time-stamp-format: "%:y-%02m-%02d" -->

<!-- End: -->