/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-keygen.xml

  • Committer: Teddy Hogeborn
  • Date: 2008-08-29 05:53:59 UTC
  • Revision ID: teddy@fukt.bsnet.se-20080829055359-wkdasnyxtylmnxus
* mandos.xml (EXAMPLE): Replaced all occurences of command name with
                        "&COMMANDNAME;".

* plugins.d/password-prompt.c (main): Improved some documentation
                                      strings.  Do perror() of
                                      tcgetattr() fails.  Add debug
                                      output if interrupted by signal.
                                      Loop over write() instead of
                                      using fwrite() when outputting
                                      password.  Add debug output if
                                      getline() returns 0, unless it
                                      was caused by a signal.  Add
                                      exit status code to debug
                                      output.

* plugins.d/password-prompt.xml: Changed all single quotes to double
                                 quotes for consistency.  Removed
                                 <?xml-stylesheet>.
  (ENTITY TIMESTAMP): New.  Automatically updated by Emacs time-stamp
                      by using Emacs local variables.
  (/refentry/refentryinfo/title): Changed to "Mandos Manual".
  (/refentry/refentryinfo/productname): Changed to "Mandos".
  (/refentry/refentryinfo/date): New; set to "&TIMESTAMP;".
  (/refentry/refentryinfo/copyright): Split copyright holders.
  (/refentry/refnamediv/refpurpose): Improved wording.
  (SYNOPSIS): Fix to use correct markup.  Add short options.
  (DESCRIPTION, OPTIONS): Improved wording.
  (OPTIONS): Improved wording.  Use more correct markup.  Document
             short options.
  (EXIT STATUS): Add text.
  (ENVIRONMENT): Document use of "cryptsource" and "crypttarget".
  (FILES): REMOVED.
  (BUGS): Add text.
  (EXAMPLE): Added some examples.
  (SECURITY): Added text.
  (SEE ALSO): Remove reference to mandos(8).  Add reference to
              crypttab(5).

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-keygen.xml
1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
 
4
<!ENTITY VERSION "1.0">
4
5
<!ENTITY COMMANDNAME "mandos-keygen">
5
 
<!ENTITY TIMESTAMP "2017-02-23">
6
 
<!ENTITY % common SYSTEM "common.ent">
7
 
%common;
8
6
]>
9
7
 
10
8
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
11
9
  <refentryinfo>
12
 
    <title>Mandos Manual</title>
 
10
    <title>&COMMANDNAME;</title>
13
11
    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
14
 
    <productname>Mandos</productname>
15
 
    <productnumber>&version;</productnumber>
16
 
    <date>&TIMESTAMP;</date>
 
12
    <productname>&COMMANDNAME;</productname>
 
13
    <productnumber>&VERSION;</productnumber>
17
14
    <authorgroup>
18
15
      <author>
19
16
        <firstname>Björn</firstname>
20
17
        <surname>Påhlsson</surname>
21
18
        <address>
22
 
          <email>belorn@recompile.se</email>
 
19
          <email>belorn@fukt.bsnet.se</email>
23
20
        </address>
24
21
      </author>
25
22
      <author>
26
23
        <firstname>Teddy</firstname>
27
24
        <surname>Hogeborn</surname>
28
25
        <address>
29
 
          <email>teddy@recompile.se</email>
 
26
          <email>teddy@fukt.bsnet.se</email>
30
27
        </address>
31
28
      </author>
32
29
    </authorgroup>
33
30
    <copyright>
34
31
      <year>2008</year>
35
 
      <year>2009</year>
36
 
      <year>2010</year>
37
 
      <year>2011</year>
38
 
      <year>2012</year>
39
 
      <year>2013</year>
40
 
      <year>2014</year>
41
 
      <year>2015</year>
42
 
      <year>2016</year>
43
 
      <year>2017</year>
44
32
      <holder>Teddy Hogeborn</holder>
45
33
      <holder>Björn Påhlsson</holder>
46
34
    </copyright>
47
 
    <xi:include href="legalnotice.xml"/>
 
35
    <legalnotice>
 
36
      <para>
 
37
        This manual page is free software: you can redistribute it
 
38
        and/or modify it under the terms of the GNU General Public
 
39
        License as published by the Free Software Foundation,
 
40
        either version 3 of the License, or (at your option) any
 
41
        later version.
 
42
      </para>
 
43
 
 
44
      <para>
 
45
        This manual page is distributed in the hope that it will
 
46
        be useful, but WITHOUT ANY WARRANTY; without even the
 
47
        implied warranty of MERCHANTABILITY or FITNESS FOR A
 
48
        PARTICULAR PURPOSE.  See the GNU General Public License
 
49
        for more details.
 
50
      </para>
 
51
 
 
52
      <para>
 
53
        You should have received a copy of the GNU General Public
 
54
        License along with this program; If not, see
 
55
        <ulink url="http://www.gnu.org/licenses/"/>.
 
56
      </para>
 
57
    </legalnotice>
48
58
  </refentryinfo>
49
 
  
 
59
 
50
60
  <refmeta>
51
61
    <refentrytitle>&COMMANDNAME;</refentrytitle>
52
62
    <manvolnum>8</manvolnum>
55
65
  <refnamediv>
56
66
    <refname><command>&COMMANDNAME;</command></refname>
57
67
    <refpurpose>
58
 
      Generate key and password for Mandos client and server.
 
68
      Generate keys for <citerefentry><refentrytitle>password-request
 
69
      </refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
59
70
    </refpurpose>
60
71
  </refnamediv>
61
 
  
 
72
 
62
73
  <refsynopsisdiv>
63
74
    <cmdsynopsis>
64
75
      <command>&COMMANDNAME;</command>
65
 
      <group>
66
 
        <arg choice="plain"><option>--dir
67
 
        <replaceable>DIRECTORY</replaceable></option></arg>
68
 
        <arg choice="plain"><option>-d
69
 
        <replaceable>DIRECTORY</replaceable></option></arg>
70
 
      </group>
71
 
      <sbr/>
72
 
      <group>
73
 
        <arg choice="plain"><option>--type
74
 
        <replaceable>KEYTYPE</replaceable></option></arg>
75
 
        <arg choice="plain"><option>-t
76
 
        <replaceable>KEYTYPE</replaceable></option></arg>
77
 
      </group>
78
 
      <sbr/>
79
 
      <group>
80
 
        <arg choice="plain"><option>--length
81
 
        <replaceable>BITS</replaceable></option></arg>
82
 
        <arg choice="plain"><option>-l
83
 
        <replaceable>BITS</replaceable></option></arg>
84
 
      </group>
85
 
      <sbr/>
86
 
      <group>
87
 
        <arg choice="plain"><option>--subtype
88
 
        <replaceable>KEYTYPE</replaceable></option></arg>
89
 
        <arg choice="plain"><option>-s
90
 
        <replaceable>KEYTYPE</replaceable></option></arg>
91
 
      </group>
92
 
      <sbr/>
93
 
      <group>
94
 
        <arg choice="plain"><option>--sublength
95
 
        <replaceable>BITS</replaceable></option></arg>
96
 
        <arg choice="plain"><option>-L
97
 
        <replaceable>BITS</replaceable></option></arg>
98
 
      </group>
99
 
      <sbr/>
100
 
      <group>
101
 
        <arg choice="plain"><option>--name
102
 
        <replaceable>NAME</replaceable></option></arg>
103
 
        <arg choice="plain"><option>-n
104
 
        <replaceable>NAME</replaceable></option></arg>
105
 
      </group>
106
 
      <sbr/>
107
 
      <group>
108
 
        <arg choice="plain"><option>--email
109
 
        <replaceable>ADDRESS</replaceable></option></arg>
110
 
        <arg choice="plain"><option>-e
111
 
        <replaceable>ADDRESS</replaceable></option></arg>
112
 
      </group>
113
 
      <sbr/>
114
 
      <group>
115
 
        <arg choice="plain"><option>--comment
116
 
        <replaceable>TEXT</replaceable></option></arg>
117
 
        <arg choice="plain"><option>-c
118
 
        <replaceable>TEXT</replaceable></option></arg>
119
 
      </group>
120
 
      <sbr/>
121
 
      <group>
122
 
        <arg choice="plain"><option>--expire
123
 
        <replaceable>TIME</replaceable></option></arg>
124
 
        <arg choice="plain"><option>-x
125
 
        <replaceable>TIME</replaceable></option></arg>
126
 
      </group>
127
 
      <sbr/>
128
 
      <group>
 
76
      <group choice="opt">
 
77
        <arg choice="plain"><option>--dir</option>
 
78
        <replaceable>directory</replaceable></arg>
 
79
      </group>
 
80
      <group choice="opt">
 
81
        <arg choice="plain"><option>--type</option>
 
82
        <replaceable>type</replaceable></arg>
 
83
      </group>
 
84
      <group choice="opt">
 
85
        <arg choice="plain"><option>--length</option>
 
86
        <replaceable>bits</replaceable></arg>
 
87
      </group>
 
88
      <group choice="opt">
 
89
        <arg choice="plain"><option>--subtype</option>
 
90
        <replaceable>type</replaceable></arg>
 
91
      </group>
 
92
      <group choice="opt">
 
93
        <arg choice="plain"><option>--sublength</option>
 
94
        <replaceable>bits</replaceable></arg>
 
95
      </group>
 
96
      <group choice="opt">
 
97
        <arg choice="plain"><option>--name</option>
 
98
        <replaceable>NAME</replaceable></arg>
 
99
      </group>
 
100
      <group choice="opt">
 
101
        <arg choice="plain"><option>--email</option>
 
102
        <replaceable>EMAIL</replaceable></arg>
 
103
      </group>
 
104
      <group choice="opt">
 
105
        <arg choice="plain"><option>--comment</option>
 
106
        <replaceable>COMMENT</replaceable></arg>
 
107
      </group>
 
108
      <group choice="opt">
 
109
        <arg choice="plain"><option>--expire</option>
 
110
        <replaceable>TIME</replaceable></arg>
 
111
      </group>
 
112
      <group choice="opt">
129
113
        <arg choice="plain"><option>--force</option></arg>
 
114
      </group>
 
115
    </cmdsynopsis>
 
116
    <cmdsynopsis>
 
117
      <command>&COMMANDNAME;</command>
 
118
      <group choice="opt">
 
119
        <arg choice="plain"><option>-d</option>
 
120
        <replaceable>directory</replaceable></arg>
 
121
      </group>
 
122
      <group choice="opt">
 
123
        <arg choice="plain"><option>-t</option>
 
124
        <replaceable>type</replaceable></arg>
 
125
      </group>
 
126
      <group choice="opt">
 
127
        <arg choice="plain"><option>-l</option>
 
128
        <replaceable>bits</replaceable></arg>
 
129
      </group>
 
130
      <group choice="opt">
 
131
        <arg choice="plain"><option>-s</option>
 
132
        <replaceable>type</replaceable></arg>
 
133
      </group>
 
134
      <group choice="opt">
 
135
        <arg choice="plain"><option>-L</option>
 
136
        <replaceable>bits</replaceable></arg>
 
137
      </group>
 
138
      <group choice="opt">
 
139
        <arg choice="plain"><option>-n</option>
 
140
        <replaceable>NAME</replaceable></arg>
 
141
      </group>
 
142
      <group choice="opt">
 
143
        <arg choice="plain"><option>-e</option>
 
144
        <replaceable>EMAIL</replaceable></arg>
 
145
      </group>
 
146
      <group choice="opt">
 
147
        <arg choice="plain"><option>-c</option>
 
148
        <replaceable>COMMENT</replaceable></arg>
 
149
      </group>
 
150
      <group choice="opt">
 
151
        <arg choice="plain"><option>-x</option>
 
152
        <replaceable>TIME</replaceable></arg>
 
153
      </group>
 
154
      <group choice="opt">
130
155
        <arg choice="plain"><option>-f</option></arg>
131
156
      </group>
132
157
    </cmdsynopsis>
133
158
    <cmdsynopsis>
134
159
      <command>&COMMANDNAME;</command>
135
160
      <group choice="req">
 
161
        <arg choice="plain"><option>-p</option></arg>
136
162
        <arg choice="plain"><option>--password</option></arg>
137
 
        <arg choice="plain"><option>-p</option></arg>
138
 
        <arg choice="plain"><option>--passfile
139
 
        <replaceable>FILE</replaceable></option></arg>
140
 
        <arg choice="plain"><option>-F</option>
141
 
        <replaceable>FILE</replaceable></arg>
142
 
      </group>
143
 
      <sbr/>
144
 
      <group>
145
 
        <arg choice="plain"><option>--dir
146
 
        <replaceable>DIRECTORY</replaceable></option></arg>
147
 
        <arg choice="plain"><option>-d
148
 
        <replaceable>DIRECTORY</replaceable></option></arg>
149
 
      </group>
150
 
      <sbr/>
151
 
      <group>
152
 
        <arg choice="plain"><option>--name
153
 
        <replaceable>NAME</replaceable></option></arg>
154
 
        <arg choice="plain"><option>-n
155
 
        <replaceable>NAME</replaceable></option></arg>
156
 
      </group>
157
 
      <group>
158
 
        <arg choice="plain"><option>--no-ssh</option></arg>
159
 
        <arg choice="plain"><option>-S</option></arg>
 
163
      </group>
 
164
      <group choice="opt">
 
165
        <arg choice="plain"><option>--dir</option>
 
166
        <replaceable>directory</replaceable></arg>
 
167
      </group>
 
168
      <group choice="opt">
 
169
        <arg choice="plain"><option>--name</option>
 
170
        <replaceable>NAME</replaceable></arg>
160
171
      </group>
161
172
    </cmdsynopsis>
162
173
    <cmdsynopsis>
163
174
      <command>&COMMANDNAME;</command>
164
175
      <group choice="req">
 
176
        <arg choice="plain"><option>-h</option></arg>
165
177
        <arg choice="plain"><option>--help</option></arg>
166
 
        <arg choice="plain"><option>-h</option></arg>
167
178
      </group>
168
179
    </cmdsynopsis>
169
180
    <cmdsynopsis>
170
181
      <command>&COMMANDNAME;</command>
171
182
      <group choice="req">
 
183
        <arg choice="plain"><option>-v</option></arg>
172
184
        <arg choice="plain"><option>--version</option></arg>
173
 
        <arg choice="plain"><option>-v</option></arg>
174
185
      </group>
175
186
    </cmdsynopsis>
176
187
  </refsynopsisdiv>
177
 
  
 
188
 
178
189
  <refsect1 id="description">
179
190
    <title>DESCRIPTION</title>
180
191
    <para>
181
192
      <command>&COMMANDNAME;</command> is a program to generate the
182
 
      OpenPGP key used by
183
 
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
184
 
      <manvolnum>8mandos</manvolnum></citerefentry>.  The key is
 
193
      OpenPGP keys used by
 
194
      <citerefentry><refentrytitle>password-request</refentrytitle>
 
195
      <manvolnum>8mandos</manvolnum></citerefentry>.  The keys are
185
196
      normally written to /etc/mandos for later installation into the
186
 
      initrd image, but this, and most other things, can be changed
187
 
      with command line options.
 
197
      initrd image, but this, like most things, can be changed with
 
198
      command line options.
188
199
    </para>
189
200
    <para>
190
 
      This program can also be used with the
191
 
      <option>--password</option> or <option>--passfile</option>
192
 
      options to generate a ready-made section for
193
 
      <filename>clients.conf</filename> (see
 
201
      It can also be used to generate ready-made sections for
194
202
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
195
 
      <manvolnum>5</manvolnum></citerefentry>).
 
203
      <manvolnum>5</manvolnum></citerefentry> using the
 
204
      <option>--password</option> option.
196
205
    </para>
197
206
  </refsect1>
198
207
  
199
208
  <refsect1 id="purpose">
200
209
    <title>PURPOSE</title>
 
210
 
201
211
    <para>
202
212
      The purpose of this is to enable <emphasis>remote and unattended
203
213
      rebooting</emphasis> of client host computer with an
204
214
      <emphasis>encrypted root file system</emphasis>.  See <xref
205
215
      linkend="overview"/> for details.
206
216
    </para>
 
217
 
207
218
  </refsect1>
208
219
  
209
220
  <refsect1 id="options">
210
221
    <title>OPTIONS</title>
211
 
    
 
222
 
212
223
    <variablelist>
213
224
      <varlistentry>
214
 
        <term><option>--help</option></term>
215
 
        <term><option>-h</option></term>
 
225
        <term><literal>-h</literal>, <literal>--help</literal></term>
216
226
        <listitem>
217
227
          <para>
218
228
            Show a help message and exit
219
229
          </para>
220
230
        </listitem>
221
231
      </varlistentry>
222
 
      
 
232
 
223
233
      <varlistentry>
224
 
        <term><option>--dir
225
 
        <replaceable>DIRECTORY</replaceable></option></term>
226
 
        <term><option>-d
227
 
        <replaceable>DIRECTORY</replaceable></option></term>
 
234
        <term><literal>-d</literal>, <literal>--dir
 
235
        <replaceable>directory</replaceable></literal></term>
228
236
        <listitem>
229
237
          <para>
230
238
            Target directory for key files.  Default is
231
 
            <filename class="directory">/etc/mandos</filename>.
232
 
          </para>
233
 
        </listitem>
234
 
      </varlistentry>
235
 
      
236
 
      <varlistentry>
237
 
        <term><option>--type
238
 
        <replaceable>TYPE</replaceable></option></term>
239
 
        <term><option>-t
240
 
        <replaceable>TYPE</replaceable></option></term>
241
 
        <listitem>
242
 
          <para>
243
 
            Key type.  Default is <quote>RSA</quote>.
244
 
          </para>
245
 
        </listitem>
246
 
      </varlistentry>
247
 
      
248
 
      <varlistentry>
249
 
        <term><option>--length
250
 
        <replaceable>BITS</replaceable></option></term>
251
 
        <term><option>-l
252
 
        <replaceable>BITS</replaceable></option></term>
253
 
        <listitem>
254
 
          <para>
255
 
            Key length in bits.  Default is 4096.
256
 
          </para>
257
 
        </listitem>
258
 
      </varlistentry>
259
 
      
260
 
      <varlistentry>
261
 
        <term><option>--subtype
262
 
        <replaceable>KEYTYPE</replaceable></option></term>
263
 
        <term><option>-s
264
 
        <replaceable>KEYTYPE</replaceable></option></term>
265
 
        <listitem>
266
 
          <para>
267
 
            Subkey type.  Default is <quote>RSA</quote> (Elgamal
 
239
            <filename>/etc/mandos</filename>.
 
240
          </para>
 
241
        </listitem>
 
242
      </varlistentry>
 
243
 
 
244
      <varlistentry>
 
245
        <term><literal>-t</literal>, <literal>--type
 
246
        <replaceable>type</replaceable></literal></term>
 
247
        <listitem>
 
248
          <para>
 
249
            Key type.  Default is <quote>DSA</quote>.
 
250
          </para>
 
251
        </listitem>
 
252
      </varlistentry>
 
253
 
 
254
      <varlistentry>
 
255
        <term><literal>-l</literal>, <literal>--length
 
256
        <replaceable>bits</replaceable></literal></term>
 
257
        <listitem>
 
258
          <para>
 
259
            Key length in bits.  Default is 2048.
 
260
          </para>
 
261
        </listitem>
 
262
      </varlistentry>
 
263
 
 
264
      <varlistentry>
 
265
        <term><literal>-s</literal>, <literal>--subtype
 
266
        <replaceable>type</replaceable></literal></term>
 
267
        <listitem>
 
268
          <para>
 
269
            Subkey type.  Default is <quote>ELG-E</quote> (Elgamal
268
270
            encryption-only).
269
271
          </para>
270
272
        </listitem>
271
273
      </varlistentry>
272
 
      
 
274
 
273
275
      <varlistentry>
274
 
        <term><option>--sublength
275
 
        <replaceable>BITS</replaceable></option></term>
276
 
        <term><option>-L
277
 
        <replaceable>BITS</replaceable></option></term>
 
276
        <term><literal>-L</literal>, <literal>--sublength
 
277
        <replaceable>bits</replaceable></literal></term>
278
278
        <listitem>
279
279
          <para>
280
 
            Subkey length in bits.  Default is 4096.
 
280
            Subkey length in bits.  Default is 2048.
281
281
          </para>
282
282
        </listitem>
283
283
      </varlistentry>
284
 
      
 
284
 
285
285
      <varlistentry>
286
 
        <term><option>--email
287
 
        <replaceable>ADDRESS</replaceable></option></term>
288
 
        <term><option>-e
289
 
        <replaceable>ADDRESS</replaceable></option></term>
 
286
        <term><literal>-e</literal>, <literal>--email</literal>
 
287
        <replaceable>address</replaceable></term>
290
288
        <listitem>
291
289
          <para>
292
290
            Email address of key.  Default is empty.
293
291
          </para>
294
292
        </listitem>
295
293
      </varlistentry>
296
 
      
 
294
 
297
295
      <varlistentry>
298
 
        <term><option>--comment
299
 
        <replaceable>TEXT</replaceable></option></term>
300
 
        <term><option>-c
301
 
        <replaceable>TEXT</replaceable></option></term>
 
296
        <term><literal>-c</literal>, <literal>--comment</literal>
 
297
        <replaceable>comment</replaceable></term>
302
298
        <listitem>
303
299
          <para>
304
 
            Comment field for key.  Default is empty.
 
300
            Comment field for key.  The default value is
 
301
            <quote><literal>Mandos client key</literal></quote>.
305
302
          </para>
306
303
        </listitem>
307
304
      </varlistentry>
308
 
      
 
305
 
309
306
      <varlistentry>
310
 
        <term><option>--expire
311
 
        <replaceable>TIME</replaceable></option></term>
312
 
        <term><option>-x
313
 
        <replaceable>TIME</replaceable></option></term>
 
307
        <term><literal>-x</literal>, <literal>--expire</literal>
 
308
        <replaceable>time</replaceable></term>
314
309
        <listitem>
315
310
          <para>
316
311
            Key expire time.  Default is no expiration.  See
319
314
          </para>
320
315
        </listitem>
321
316
      </varlistentry>
322
 
      
 
317
 
323
318
      <varlistentry>
324
 
        <term><option>--force</option></term>
325
 
        <term><option>-f</option></term>
 
319
        <term><literal>-f</literal>, <literal>--force</literal></term>
326
320
        <listitem>
327
321
          <para>
328
 
            Force overwriting old key.
 
322
            Force overwriting old keys.
329
323
          </para>
330
324
        </listitem>
331
325
      </varlistentry>
332
326
      <varlistentry>
333
 
        <term><option>--password</option></term>
334
 
        <term><option>-p</option></term>
 
327
        <term><literal>-p</literal>, <literal>--password</literal
 
328
        ></term>
335
329
        <listitem>
336
330
          <para>
337
331
            Prompt for a password and encrypt it with the key already
343
337
            >8</manvolnum></citerefentry>.  The host name or the name
344
338
            specified with the <option>--name</option> option is used
345
339
            for the section header.  All other options are ignored,
346
 
            and no key is created.
347
 
          </para>
348
 
        </listitem>
349
 
      </varlistentry>
350
 
      <varlistentry>
351
 
        <term><option>--passfile
352
 
        <replaceable>FILE</replaceable></option></term>
353
 
        <term><option>-F
354
 
        <replaceable>FILE</replaceable></option></term>
355
 
        <listitem>
356
 
          <para>
357
 
            The same as <option>--password</option>, but read from
358
 
            <replaceable>FILE</replaceable>, not the terminal.
359
 
          </para>
360
 
        </listitem>
361
 
      </varlistentry>
362
 
      <varlistentry>
363
 
        <term><option>--no-ssh</option></term>
364
 
        <term><option>-S</option></term>
365
 
        <listitem>
366
 
          <para>
367
 
            When <option>--password</option> or
368
 
            <option>--passfile</option> is given, this option will
369
 
            prevent <command>&COMMANDNAME;</command> from calling
370
 
            <command>ssh-keyscan</command> to get an SSH fingerprint
371
 
            for this host and, if successful, output suitable config
372
 
            options to use this fingerprint as a
373
 
            <option>checker</option> option in the output.  This is
374
 
            otherwise the default behavior.
 
340
            and no keys are created.
375
341
          </para>
376
342
        </listitem>
377
343
      </varlistentry>
378
344
    </variablelist>
379
345
  </refsect1>
380
 
  
 
346
 
381
347
  <refsect1 id="overview">
382
348
    <title>OVERVIEW</title>
383
349
    <xi:include href="overview.xml"/>
384
350
    <para>
385
351
      This program is a small utility to generate new OpenPGP keys for
386
 
      new Mandos clients, and to generate sections for inclusion in
387
 
      <filename>clients.conf</filename> on the server.
 
352
      new Mandos clients.
388
353
    </para>
389
354
  </refsect1>
390
 
  
 
355
 
391
356
  <refsect1 id="exit_status">
392
357
    <title>EXIT STATUS</title>
393
358
    <para>
394
 
      The exit status will be 0 if a new key (or password, if the
395
 
      <option>--password</option> option was used) was successfully
396
 
      created, otherwise not.
 
359
      The exit status will be 0 if new keys were successfully created,
 
360
      otherwise not.
397
361
    </para>
398
362
  </refsect1>
399
363
  
401
365
    <title>ENVIRONMENT</title>
402
366
    <variablelist>
403
367
      <varlistentry>
404
 
        <term><envar>TMPDIR</envar></term>
 
368
        <term><varname>TMPDIR</varname></term>
405
369
        <listitem>
406
370
          <para>
407
371
            If set, temporary files will be created here. See
413
377
    </variablelist>
414
378
  </refsect1>
415
379
  
416
 
  <refsect1 id="files">
 
380
  <refsect1 id="file">
417
381
    <title>FILES</title>
418
382
    <para>
419
383
      Use the <option>--dir</option> option to change where
440
404
        </listitem>
441
405
      </varlistentry>
442
406
      <varlistentry>
443
 
        <term><filename class="directory">/tmp</filename></term>
 
407
        <term><filename>/tmp</filename></term>
444
408
        <listitem>
445
409
          <para>
446
410
            Temporary files will be written here if
450
414
      </varlistentry>
451
415
    </variablelist>
452
416
  </refsect1>
453
 
  
 
417
 
454
418
  <refsect1 id="bugs">
455
419
    <title>BUGS</title>
456
 
    <xi:include href="bugs.xml"/>
 
420
    <para>
 
421
      None are known at this time.
 
422
    </para>
457
423
  </refsect1>
458
 
  
 
424
 
459
425
  <refsect1 id="example">
460
426
    <title>EXAMPLE</title>
461
427
    <informalexample>
463
429
        Normal invocation needs no options:
464
430
      </para>
465
431
      <para>
466
 
        <userinput>&COMMANDNAME;</userinput>
 
432
        <userinput>mandos-keygen</userinput>
467
433
      </para>
468
434
    </informalexample>
469
435
    <informalexample>
470
436
      <para>
471
 
        Create key in another directory and of another type.  Force
 
437
        Create keys in another directory and of another type.  Force
472
438
        overwriting old key files:
473
439
      </para>
474
440
      <para>
475
441
 
476
442
<!-- do not wrap this line -->
477
 
<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>
478
 
 
479
 
      </para>
480
 
    </informalexample>
481
 
    <informalexample>
482
 
      <para>
483
 
        Prompt for a password, encrypt it with the key in <filename
484
 
        class="directory">/etc/mandos</filename> and output a section
485
 
        suitable for <filename>clients.conf</filename>.
486
 
      </para>
487
 
      <para>
488
 
        <userinput>&COMMANDNAME; --password</userinput>
489
 
      </para>
490
 
    </informalexample>
491
 
    <informalexample>
492
 
      <para>
493
 
        Prompt for a password, encrypt it with the key in the
494
 
        <filename>client-key</filename> directory and output a section
495
 
        suitable for <filename>clients.conf</filename>.
496
 
      </para>
497
 
      <para>
498
 
 
499
 
<!-- do not wrap this line -->
500
 
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
 
443
<userinput>mandos-keygen --dir ~/keydir --type RSA --force</userinput>
501
444
 
502
445
      </para>
503
446
    </informalexample>
504
447
  </refsect1>
505
 
  
 
448
 
506
449
  <refsect1 id="security">
507
450
    <title>SECURITY</title>
508
451
    <para>
509
452
      The <option>--type</option>, <option>--length</option>,
510
453
      <option>--subtype</option>, and <option>--sublength</option>
511
 
      options can be used to create keys of low security.  If in
512
 
      doubt, leave them to the default values.
 
454
      options can be used to create keys of insufficient security.  If
 
455
      in doubt, leave them to the default values.
513
456
    </para>
514
457
    <para>
515
 
      The key expire time is <emphasis>not</emphasis> guaranteed to be
516
 
      honored by <citerefentry><refentrytitle>mandos</refentrytitle>
 
458
      The key expire time is not guaranteed to be honored by
 
459
      <citerefentry><refentrytitle>mandos</refentrytitle>
517
460
      <manvolnum>8</manvolnum></citerefentry>.
518
461
    </para>
519
462
  </refsect1>
520
 
  
 
463
 
521
464
  <refsect1 id="see_also">
522
465
    <title>SEE ALSO</title>
523
466
    <para>
524
 
      <citerefentry><refentrytitle>intro</refentrytitle>
 
467
      <citerefentry><refentrytitle>password-request</refentrytitle>
525
468
      <manvolnum>8mandos</manvolnum></citerefentry>,
 
469
      <citerefentry><refentrytitle>mandos</refentrytitle>
 
470
      <manvolnum>8</manvolnum></citerefentry>,
526
471
      <citerefentry><refentrytitle>gpg</refentrytitle>
527
 
      <manvolnum>1</manvolnum></citerefentry>,
528
 
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
529
 
      <manvolnum>5</manvolnum></citerefentry>,
530
 
      <citerefentry><refentrytitle>mandos</refentrytitle>
531
 
      <manvolnum>8</manvolnum></citerefentry>,
532
 
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
533
 
      <manvolnum>8mandos</manvolnum></citerefentry>,
534
 
      <citerefentry><refentrytitle>ssh-keyscan</refentrytitle>
535
472
      <manvolnum>1</manvolnum></citerefentry>
536
473
    </para>
537
474
  </refsect1>
538
475
  
539
476
</refentry>
540
 
<!-- Local Variables: -->
541
 
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
542
 
<!-- time-stamp-end: "[\"']>" -->
543
 
<!-- time-stamp-format: "%:y-%02m-%02d" -->
544
 
<!-- End: -->