/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-keygen.xml

  • Committer: Teddy Hogeborn
  • Date: 2008-08-29 06:38:27 UTC
  • Revision ID: teddy@fukt.bsnet.se-20080829063827-hbjl6t92tyjl5305
* mandos-clients.conf.xml (ENTITY TIMESTAMP): New.  Automatically
                                              updated by Emacs
                                              time-stamp by using
                                              Emacs local variables.
  (/refentry/refentryinfo/date): New; set to "&TIMESTAMP;".
* mandos-keygen.xml: - '' -
* mandos.conf.xml: - '' -
* mandos.xml: - '' -
* plugin-runner.xml: - '' -
* plugins.d/password-request.xml: - '' -

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-keygen.xml
1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
 
4
<!ENTITY VERSION "1.0">
4
5
<!ENTITY COMMANDNAME "mandos-keygen">
5
 
<!ENTITY TIMESTAMP "2017-02-23">
6
 
<!ENTITY % common SYSTEM "common.ent">
7
 
%common;
 
6
<!ENTITY TIMESTAMP "2008-08-29">
8
7
]>
9
8
 
10
9
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
11
10
  <refentryinfo>
12
 
    <title>Mandos Manual</title>
 
11
    <title>&COMMANDNAME;</title>
13
12
    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
14
 
    <productname>Mandos</productname>
15
 
    <productnumber>&version;</productnumber>
 
13
    <productname>&COMMANDNAME;</productname>
 
14
    <productnumber>&VERSION;</productnumber>
16
15
    <date>&TIMESTAMP;</date>
17
16
    <authorgroup>
18
17
      <author>
19
18
        <firstname>Björn</firstname>
20
19
        <surname>Påhlsson</surname>
21
20
        <address>
22
 
          <email>belorn@recompile.se</email>
 
21
          <email>belorn@fukt.bsnet.se</email>
23
22
        </address>
24
23
      </author>
25
24
      <author>
26
25
        <firstname>Teddy</firstname>
27
26
        <surname>Hogeborn</surname>
28
27
        <address>
29
 
          <email>teddy@recompile.se</email>
 
28
          <email>teddy@fukt.bsnet.se</email>
30
29
        </address>
31
30
      </author>
32
31
    </authorgroup>
33
32
    <copyright>
34
33
      <year>2008</year>
35
 
      <year>2009</year>
36
 
      <year>2010</year>
37
 
      <year>2011</year>
38
 
      <year>2012</year>
39
 
      <year>2013</year>
40
 
      <year>2014</year>
41
 
      <year>2015</year>
42
 
      <year>2016</year>
43
 
      <year>2017</year>
44
34
      <holder>Teddy Hogeborn</holder>
45
35
      <holder>Björn Påhlsson</holder>
46
36
    </copyright>
47
 
    <xi:include href="legalnotice.xml"/>
 
37
    <legalnotice>
 
38
      <para>
 
39
        This manual page is free software: you can redistribute it
 
40
        and/or modify it under the terms of the GNU General Public
 
41
        License as published by the Free Software Foundation,
 
42
        either version 3 of the License, or (at your option) any
 
43
        later version.
 
44
      </para>
 
45
 
 
46
      <para>
 
47
        This manual page is distributed in the hope that it will
 
48
        be useful, but WITHOUT ANY WARRANTY; without even the
 
49
        implied warranty of MERCHANTABILITY or FITNESS FOR A
 
50
        PARTICULAR PURPOSE.  See the GNU General Public License
 
51
        for more details.
 
52
      </para>
 
53
 
 
54
      <para>
 
55
        You should have received a copy of the GNU General Public
 
56
        License along with this program; If not, see
 
57
        <ulink url="http://www.gnu.org/licenses/"/>.
 
58
      </para>
 
59
    </legalnotice>
48
60
  </refentryinfo>
49
 
  
 
61
 
50
62
  <refmeta>
51
63
    <refentrytitle>&COMMANDNAME;</refentrytitle>
52
64
    <manvolnum>8</manvolnum>
55
67
  <refnamediv>
56
68
    <refname><command>&COMMANDNAME;</command></refname>
57
69
    <refpurpose>
58
 
      Generate key and password for Mandos client and server.
 
70
      Generate keys for <citerefentry><refentrytitle>password-request
 
71
      </refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
59
72
    </refpurpose>
60
73
  </refnamediv>
61
 
  
 
74
 
62
75
  <refsynopsisdiv>
63
76
    <cmdsynopsis>
64
77
      <command>&COMMANDNAME;</command>
65
 
      <group>
66
 
        <arg choice="plain"><option>--dir
67
 
        <replaceable>DIRECTORY</replaceable></option></arg>
68
 
        <arg choice="plain"><option>-d
69
 
        <replaceable>DIRECTORY</replaceable></option></arg>
70
 
      </group>
71
 
      <sbr/>
72
 
      <group>
73
 
        <arg choice="plain"><option>--type
74
 
        <replaceable>KEYTYPE</replaceable></option></arg>
75
 
        <arg choice="plain"><option>-t
76
 
        <replaceable>KEYTYPE</replaceable></option></arg>
77
 
      </group>
78
 
      <sbr/>
79
 
      <group>
80
 
        <arg choice="plain"><option>--length
81
 
        <replaceable>BITS</replaceable></option></arg>
82
 
        <arg choice="plain"><option>-l
83
 
        <replaceable>BITS</replaceable></option></arg>
84
 
      </group>
85
 
      <sbr/>
86
 
      <group>
87
 
        <arg choice="plain"><option>--subtype
88
 
        <replaceable>KEYTYPE</replaceable></option></arg>
89
 
        <arg choice="plain"><option>-s
90
 
        <replaceable>KEYTYPE</replaceable></option></arg>
91
 
      </group>
92
 
      <sbr/>
93
 
      <group>
94
 
        <arg choice="plain"><option>--sublength
95
 
        <replaceable>BITS</replaceable></option></arg>
96
 
        <arg choice="plain"><option>-L
97
 
        <replaceable>BITS</replaceable></option></arg>
98
 
      </group>
99
 
      <sbr/>
100
 
      <group>
101
 
        <arg choice="plain"><option>--name
102
 
        <replaceable>NAME</replaceable></option></arg>
103
 
        <arg choice="plain"><option>-n
104
 
        <replaceable>NAME</replaceable></option></arg>
105
 
      </group>
106
 
      <sbr/>
107
 
      <group>
108
 
        <arg choice="plain"><option>--email
109
 
        <replaceable>ADDRESS</replaceable></option></arg>
110
 
        <arg choice="plain"><option>-e
111
 
        <replaceable>ADDRESS</replaceable></option></arg>
112
 
      </group>
113
 
      <sbr/>
114
 
      <group>
115
 
        <arg choice="plain"><option>--comment
116
 
        <replaceable>TEXT</replaceable></option></arg>
117
 
        <arg choice="plain"><option>-c
118
 
        <replaceable>TEXT</replaceable></option></arg>
119
 
      </group>
120
 
      <sbr/>
121
 
      <group>
122
 
        <arg choice="plain"><option>--expire
123
 
        <replaceable>TIME</replaceable></option></arg>
124
 
        <arg choice="plain"><option>-x
125
 
        <replaceable>TIME</replaceable></option></arg>
126
 
      </group>
127
 
      <sbr/>
128
 
      <group>
 
78
      <group choice="opt">
 
79
        <arg choice="plain"><option>--dir</option>
 
80
        <replaceable>directory</replaceable></arg>
 
81
      </group>
 
82
      <group choice="opt">
 
83
        <arg choice="plain"><option>--type</option>
 
84
        <replaceable>type</replaceable></arg>
 
85
      </group>
 
86
      <group choice="opt">
 
87
        <arg choice="plain"><option>--length</option>
 
88
        <replaceable>bits</replaceable></arg>
 
89
      </group>
 
90
      <group choice="opt">
 
91
        <arg choice="plain"><option>--subtype</option>
 
92
        <replaceable>type</replaceable></arg>
 
93
      </group>
 
94
      <group choice="opt">
 
95
        <arg choice="plain"><option>--sublength</option>
 
96
        <replaceable>bits</replaceable></arg>
 
97
      </group>
 
98
      <group choice="opt">
 
99
        <arg choice="plain"><option>--name</option>
 
100
        <replaceable>NAME</replaceable></arg>
 
101
      </group>
 
102
      <group choice="opt">
 
103
        <arg choice="plain"><option>--email</option>
 
104
        <replaceable>EMAIL</replaceable></arg>
 
105
      </group>
 
106
      <group choice="opt">
 
107
        <arg choice="plain"><option>--comment</option>
 
108
        <replaceable>COMMENT</replaceable></arg>
 
109
      </group>
 
110
      <group choice="opt">
 
111
        <arg choice="plain"><option>--expire</option>
 
112
        <replaceable>TIME</replaceable></arg>
 
113
      </group>
 
114
      <group choice="opt">
129
115
        <arg choice="plain"><option>--force</option></arg>
 
116
      </group>
 
117
    </cmdsynopsis>
 
118
    <cmdsynopsis>
 
119
      <command>&COMMANDNAME;</command>
 
120
      <group choice="opt">
 
121
        <arg choice="plain"><option>-d</option>
 
122
        <replaceable>directory</replaceable></arg>
 
123
      </group>
 
124
      <group choice="opt">
 
125
        <arg choice="plain"><option>-t</option>
 
126
        <replaceable>type</replaceable></arg>
 
127
      </group>
 
128
      <group choice="opt">
 
129
        <arg choice="plain"><option>-l</option>
 
130
        <replaceable>bits</replaceable></arg>
 
131
      </group>
 
132
      <group choice="opt">
 
133
        <arg choice="plain"><option>-s</option>
 
134
        <replaceable>type</replaceable></arg>
 
135
      </group>
 
136
      <group choice="opt">
 
137
        <arg choice="plain"><option>-L</option>
 
138
        <replaceable>bits</replaceable></arg>
 
139
      </group>
 
140
      <group choice="opt">
 
141
        <arg choice="plain"><option>-n</option>
 
142
        <replaceable>NAME</replaceable></arg>
 
143
      </group>
 
144
      <group choice="opt">
 
145
        <arg choice="plain"><option>-e</option>
 
146
        <replaceable>EMAIL</replaceable></arg>
 
147
      </group>
 
148
      <group choice="opt">
 
149
        <arg choice="plain"><option>-c</option>
 
150
        <replaceable>COMMENT</replaceable></arg>
 
151
      </group>
 
152
      <group choice="opt">
 
153
        <arg choice="plain"><option>-x</option>
 
154
        <replaceable>TIME</replaceable></arg>
 
155
      </group>
 
156
      <group choice="opt">
130
157
        <arg choice="plain"><option>-f</option></arg>
131
158
      </group>
132
159
    </cmdsynopsis>
133
160
    <cmdsynopsis>
134
161
      <command>&COMMANDNAME;</command>
135
162
      <group choice="req">
 
163
        <arg choice="plain"><option>-p</option></arg>
136
164
        <arg choice="plain"><option>--password</option></arg>
137
 
        <arg choice="plain"><option>-p</option></arg>
138
 
        <arg choice="plain"><option>--passfile
139
 
        <replaceable>FILE</replaceable></option></arg>
140
 
        <arg choice="plain"><option>-F</option>
141
 
        <replaceable>FILE</replaceable></arg>
142
 
      </group>
143
 
      <sbr/>
144
 
      <group>
145
 
        <arg choice="plain"><option>--dir
146
 
        <replaceable>DIRECTORY</replaceable></option></arg>
147
 
        <arg choice="plain"><option>-d
148
 
        <replaceable>DIRECTORY</replaceable></option></arg>
149
 
      </group>
150
 
      <sbr/>
151
 
      <group>
152
 
        <arg choice="plain"><option>--name
153
 
        <replaceable>NAME</replaceable></option></arg>
154
 
        <arg choice="plain"><option>-n
155
 
        <replaceable>NAME</replaceable></option></arg>
156
 
      </group>
157
 
      <group>
158
 
        <arg choice="plain"><option>--no-ssh</option></arg>
159
 
        <arg choice="plain"><option>-S</option></arg>
 
165
      </group>
 
166
      <group choice="opt">
 
167
        <arg choice="plain"><option>--dir</option>
 
168
        <replaceable>directory</replaceable></arg>
 
169
      </group>
 
170
      <group choice="opt">
 
171
        <arg choice="plain"><option>--name</option>
 
172
        <replaceable>NAME</replaceable></arg>
160
173
      </group>
161
174
    </cmdsynopsis>
162
175
    <cmdsynopsis>
163
176
      <command>&COMMANDNAME;</command>
164
177
      <group choice="req">
 
178
        <arg choice="plain"><option>-h</option></arg>
165
179
        <arg choice="plain"><option>--help</option></arg>
166
 
        <arg choice="plain"><option>-h</option></arg>
167
180
      </group>
168
181
    </cmdsynopsis>
169
182
    <cmdsynopsis>
170
183
      <command>&COMMANDNAME;</command>
171
184
      <group choice="req">
 
185
        <arg choice="plain"><option>-v</option></arg>
172
186
        <arg choice="plain"><option>--version</option></arg>
173
 
        <arg choice="plain"><option>-v</option></arg>
174
187
      </group>
175
188
    </cmdsynopsis>
176
189
  </refsynopsisdiv>
177
 
  
 
190
 
178
191
  <refsect1 id="description">
179
192
    <title>DESCRIPTION</title>
180
193
    <para>
181
194
      <command>&COMMANDNAME;</command> is a program to generate the
182
 
      OpenPGP key used by
183
 
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
184
 
      <manvolnum>8mandos</manvolnum></citerefentry>.  The key is
 
195
      OpenPGP keys used by
 
196
      <citerefentry><refentrytitle>password-request</refentrytitle>
 
197
      <manvolnum>8mandos</manvolnum></citerefentry>.  The keys are
185
198
      normally written to /etc/mandos for later installation into the
186
 
      initrd image, but this, and most other things, can be changed
187
 
      with command line options.
 
199
      initrd image, but this, like most things, can be changed with
 
200
      command line options.
188
201
    </para>
189
202
    <para>
190
 
      This program can also be used with the
191
 
      <option>--password</option> or <option>--passfile</option>
192
 
      options to generate a ready-made section for
193
 
      <filename>clients.conf</filename> (see
 
203
      It can also be used to generate ready-made sections for
194
204
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
195
 
      <manvolnum>5</manvolnum></citerefentry>).
 
205
      <manvolnum>5</manvolnum></citerefentry> using the
 
206
      <option>--password</option> option.
196
207
    </para>
197
208
  </refsect1>
198
209
  
199
210
  <refsect1 id="purpose">
200
211
    <title>PURPOSE</title>
 
212
 
201
213
    <para>
202
214
      The purpose of this is to enable <emphasis>remote and unattended
203
215
      rebooting</emphasis> of client host computer with an
204
216
      <emphasis>encrypted root file system</emphasis>.  See <xref
205
217
      linkend="overview"/> for details.
206
218
    </para>
 
219
 
207
220
  </refsect1>
208
221
  
209
222
  <refsect1 id="options">
210
223
    <title>OPTIONS</title>
211
 
    
 
224
 
212
225
    <variablelist>
213
226
      <varlistentry>
214
 
        <term><option>--help</option></term>
215
 
        <term><option>-h</option></term>
 
227
        <term><literal>-h</literal>, <literal>--help</literal></term>
216
228
        <listitem>
217
229
          <para>
218
230
            Show a help message and exit
219
231
          </para>
220
232
        </listitem>
221
233
      </varlistentry>
222
 
      
 
234
 
223
235
      <varlistentry>
224
 
        <term><option>--dir
225
 
        <replaceable>DIRECTORY</replaceable></option></term>
226
 
        <term><option>-d
227
 
        <replaceable>DIRECTORY</replaceable></option></term>
 
236
        <term><literal>-d</literal>, <literal>--dir
 
237
        <replaceable>directory</replaceable></literal></term>
228
238
        <listitem>
229
239
          <para>
230
240
            Target directory for key files.  Default is
231
 
            <filename class="directory">/etc/mandos</filename>.
232
 
          </para>
233
 
        </listitem>
234
 
      </varlistentry>
235
 
      
236
 
      <varlistentry>
237
 
        <term><option>--type
238
 
        <replaceable>TYPE</replaceable></option></term>
239
 
        <term><option>-t
240
 
        <replaceable>TYPE</replaceable></option></term>
241
 
        <listitem>
242
 
          <para>
243
 
            Key type.  Default is <quote>RSA</quote>.
244
 
          </para>
245
 
        </listitem>
246
 
      </varlistentry>
247
 
      
248
 
      <varlistentry>
249
 
        <term><option>--length
250
 
        <replaceable>BITS</replaceable></option></term>
251
 
        <term><option>-l
252
 
        <replaceable>BITS</replaceable></option></term>
253
 
        <listitem>
254
 
          <para>
255
 
            Key length in bits.  Default is 4096.
256
 
          </para>
257
 
        </listitem>
258
 
      </varlistentry>
259
 
      
260
 
      <varlistentry>
261
 
        <term><option>--subtype
262
 
        <replaceable>KEYTYPE</replaceable></option></term>
263
 
        <term><option>-s
264
 
        <replaceable>KEYTYPE</replaceable></option></term>
265
 
        <listitem>
266
 
          <para>
267
 
            Subkey type.  Default is <quote>RSA</quote> (Elgamal
 
241
            <filename>/etc/mandos</filename>.
 
242
          </para>
 
243
        </listitem>
 
244
      </varlistentry>
 
245
 
 
246
      <varlistentry>
 
247
        <term><literal>-t</literal>, <literal>--type
 
248
        <replaceable>type</replaceable></literal></term>
 
249
        <listitem>
 
250
          <para>
 
251
            Key type.  Default is <quote>DSA</quote>.
 
252
          </para>
 
253
        </listitem>
 
254
      </varlistentry>
 
255
 
 
256
      <varlistentry>
 
257
        <term><literal>-l</literal>, <literal>--length
 
258
        <replaceable>bits</replaceable></literal></term>
 
259
        <listitem>
 
260
          <para>
 
261
            Key length in bits.  Default is 2048.
 
262
          </para>
 
263
        </listitem>
 
264
      </varlistentry>
 
265
 
 
266
      <varlistentry>
 
267
        <term><literal>-s</literal>, <literal>--subtype
 
268
        <replaceable>type</replaceable></literal></term>
 
269
        <listitem>
 
270
          <para>
 
271
            Subkey type.  Default is <quote>ELG-E</quote> (Elgamal
268
272
            encryption-only).
269
273
          </para>
270
274
        </listitem>
271
275
      </varlistentry>
272
 
      
 
276
 
273
277
      <varlistentry>
274
 
        <term><option>--sublength
275
 
        <replaceable>BITS</replaceable></option></term>
276
 
        <term><option>-L
277
 
        <replaceable>BITS</replaceable></option></term>
 
278
        <term><literal>-L</literal>, <literal>--sublength
 
279
        <replaceable>bits</replaceable></literal></term>
278
280
        <listitem>
279
281
          <para>
280
 
            Subkey length in bits.  Default is 4096.
 
282
            Subkey length in bits.  Default is 2048.
281
283
          </para>
282
284
        </listitem>
283
285
      </varlistentry>
284
 
      
 
286
 
285
287
      <varlistentry>
286
 
        <term><option>--email
287
 
        <replaceable>ADDRESS</replaceable></option></term>
288
 
        <term><option>-e
289
 
        <replaceable>ADDRESS</replaceable></option></term>
 
288
        <term><literal>-e</literal>, <literal>--email</literal>
 
289
        <replaceable>address</replaceable></term>
290
290
        <listitem>
291
291
          <para>
292
292
            Email address of key.  Default is empty.
293
293
          </para>
294
294
        </listitem>
295
295
      </varlistentry>
296
 
      
 
296
 
297
297
      <varlistentry>
298
 
        <term><option>--comment
299
 
        <replaceable>TEXT</replaceable></option></term>
300
 
        <term><option>-c
301
 
        <replaceable>TEXT</replaceable></option></term>
 
298
        <term><literal>-c</literal>, <literal>--comment</literal>
 
299
        <replaceable>comment</replaceable></term>
302
300
        <listitem>
303
301
          <para>
304
 
            Comment field for key.  Default is empty.
 
302
            Comment field for key.  The default value is
 
303
            <quote><literal>Mandos client key</literal></quote>.
305
304
          </para>
306
305
        </listitem>
307
306
      </varlistentry>
308
 
      
 
307
 
309
308
      <varlistentry>
310
 
        <term><option>--expire
311
 
        <replaceable>TIME</replaceable></option></term>
312
 
        <term><option>-x
313
 
        <replaceable>TIME</replaceable></option></term>
 
309
        <term><literal>-x</literal>, <literal>--expire</literal>
 
310
        <replaceable>time</replaceable></term>
314
311
        <listitem>
315
312
          <para>
316
313
            Key expire time.  Default is no expiration.  See
319
316
          </para>
320
317
        </listitem>
321
318
      </varlistentry>
322
 
      
 
319
 
323
320
      <varlistentry>
324
 
        <term><option>--force</option></term>
325
 
        <term><option>-f</option></term>
 
321
        <term><literal>-f</literal>, <literal>--force</literal></term>
326
322
        <listitem>
327
323
          <para>
328
 
            Force overwriting old key.
 
324
            Force overwriting old keys.
329
325
          </para>
330
326
        </listitem>
331
327
      </varlistentry>
332
328
      <varlistentry>
333
 
        <term><option>--password</option></term>
334
 
        <term><option>-p</option></term>
 
329
        <term><literal>-p</literal>, <literal>--password</literal
 
330
        ></term>
335
331
        <listitem>
336
332
          <para>
337
333
            Prompt for a password and encrypt it with the key already
343
339
            >8</manvolnum></citerefentry>.  The host name or the name
344
340
            specified with the <option>--name</option> option is used
345
341
            for the section header.  All other options are ignored,
346
 
            and no key is created.
347
 
          </para>
348
 
        </listitem>
349
 
      </varlistentry>
350
 
      <varlistentry>
351
 
        <term><option>--passfile
352
 
        <replaceable>FILE</replaceable></option></term>
353
 
        <term><option>-F
354
 
        <replaceable>FILE</replaceable></option></term>
355
 
        <listitem>
356
 
          <para>
357
 
            The same as <option>--password</option>, but read from
358
 
            <replaceable>FILE</replaceable>, not the terminal.
359
 
          </para>
360
 
        </listitem>
361
 
      </varlistentry>
362
 
      <varlistentry>
363
 
        <term><option>--no-ssh</option></term>
364
 
        <term><option>-S</option></term>
365
 
        <listitem>
366
 
          <para>
367
 
            When <option>--password</option> or
368
 
            <option>--passfile</option> is given, this option will
369
 
            prevent <command>&COMMANDNAME;</command> from calling
370
 
            <command>ssh-keyscan</command> to get an SSH fingerprint
371
 
            for this host and, if successful, output suitable config
372
 
            options to use this fingerprint as a
373
 
            <option>checker</option> option in the output.  This is
374
 
            otherwise the default behavior.
 
342
            and no keys are created.
375
343
          </para>
376
344
        </listitem>
377
345
      </varlistentry>
378
346
    </variablelist>
379
347
  </refsect1>
380
 
  
 
348
 
381
349
  <refsect1 id="overview">
382
350
    <title>OVERVIEW</title>
383
351
    <xi:include href="overview.xml"/>
384
352
    <para>
385
353
      This program is a small utility to generate new OpenPGP keys for
386
 
      new Mandos clients, and to generate sections for inclusion in
387
 
      <filename>clients.conf</filename> on the server.
 
354
      new Mandos clients.
388
355
    </para>
389
356
  </refsect1>
390
 
  
 
357
 
391
358
  <refsect1 id="exit_status">
392
359
    <title>EXIT STATUS</title>
393
360
    <para>
394
 
      The exit status will be 0 if a new key (or password, if the
395
 
      <option>--password</option> option was used) was successfully
396
 
      created, otherwise not.
 
361
      The exit status will be 0 if new keys were successfully created,
 
362
      otherwise not.
397
363
    </para>
398
364
  </refsect1>
399
365
  
401
367
    <title>ENVIRONMENT</title>
402
368
    <variablelist>
403
369
      <varlistentry>
404
 
        <term><envar>TMPDIR</envar></term>
 
370
        <term><varname>TMPDIR</varname></term>
405
371
        <listitem>
406
372
          <para>
407
373
            If set, temporary files will be created here. See
413
379
    </variablelist>
414
380
  </refsect1>
415
381
  
416
 
  <refsect1 id="files">
 
382
  <refsect1 id="file">
417
383
    <title>FILES</title>
418
384
    <para>
419
385
      Use the <option>--dir</option> option to change where
440
406
        </listitem>
441
407
      </varlistentry>
442
408
      <varlistentry>
443
 
        <term><filename class="directory">/tmp</filename></term>
 
409
        <term><filename>/tmp</filename></term>
444
410
        <listitem>
445
411
          <para>
446
412
            Temporary files will be written here if
450
416
      </varlistentry>
451
417
    </variablelist>
452
418
  </refsect1>
453
 
  
 
419
 
454
420
  <refsect1 id="bugs">
455
421
    <title>BUGS</title>
456
 
    <xi:include href="bugs.xml"/>
 
422
    <para>
 
423
      None are known at this time.
 
424
    </para>
457
425
  </refsect1>
458
 
  
 
426
 
459
427
  <refsect1 id="example">
460
428
    <title>EXAMPLE</title>
461
429
    <informalexample>
463
431
        Normal invocation needs no options:
464
432
      </para>
465
433
      <para>
466
 
        <userinput>&COMMANDNAME;</userinput>
 
434
        <userinput>mandos-keygen</userinput>
467
435
      </para>
468
436
    </informalexample>
469
437
    <informalexample>
470
438
      <para>
471
 
        Create key in another directory and of another type.  Force
 
439
        Create keys in another directory and of another type.  Force
472
440
        overwriting old key files:
473
441
      </para>
474
442
      <para>
475
443
 
476
444
<!-- do not wrap this line -->
477
 
<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>
478
 
 
479
 
      </para>
480
 
    </informalexample>
481
 
    <informalexample>
482
 
      <para>
483
 
        Prompt for a password, encrypt it with the key in <filename
484
 
        class="directory">/etc/mandos</filename> and output a section
485
 
        suitable for <filename>clients.conf</filename>.
486
 
      </para>
487
 
      <para>
488
 
        <userinput>&COMMANDNAME; --password</userinput>
489
 
      </para>
490
 
    </informalexample>
491
 
    <informalexample>
492
 
      <para>
493
 
        Prompt for a password, encrypt it with the key in the
494
 
        <filename>client-key</filename> directory and output a section
495
 
        suitable for <filename>clients.conf</filename>.
496
 
      </para>
497
 
      <para>
498
 
 
499
 
<!-- do not wrap this line -->
500
 
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
 
445
<userinput>mandos-keygen --dir ~/keydir --type RSA --force</userinput>
501
446
 
502
447
      </para>
503
448
    </informalexample>
504
449
  </refsect1>
505
 
  
 
450
 
506
451
  <refsect1 id="security">
507
452
    <title>SECURITY</title>
508
453
    <para>
509
454
      The <option>--type</option>, <option>--length</option>,
510
455
      <option>--subtype</option>, and <option>--sublength</option>
511
 
      options can be used to create keys of low security.  If in
512
 
      doubt, leave them to the default values.
 
456
      options can be used to create keys of insufficient security.  If
 
457
      in doubt, leave them to the default values.
513
458
    </para>
514
459
    <para>
515
 
      The key expire time is <emphasis>not</emphasis> guaranteed to be
516
 
      honored by <citerefentry><refentrytitle>mandos</refentrytitle>
 
460
      The key expire time is not guaranteed to be honored by
 
461
      <citerefentry><refentrytitle>mandos</refentrytitle>
517
462
      <manvolnum>8</manvolnum></citerefentry>.
518
463
    </para>
519
464
  </refsect1>
520
 
  
 
465
 
521
466
  <refsect1 id="see_also">
522
467
    <title>SEE ALSO</title>
523
468
    <para>
524
 
      <citerefentry><refentrytitle>intro</refentrytitle>
 
469
      <citerefentry><refentrytitle>password-request</refentrytitle>
525
470
      <manvolnum>8mandos</manvolnum></citerefentry>,
 
471
      <citerefentry><refentrytitle>mandos</refentrytitle>
 
472
      <manvolnum>8</manvolnum></citerefentry>,
526
473
      <citerefentry><refentrytitle>gpg</refentrytitle>
527
 
      <manvolnum>1</manvolnum></citerefentry>,
528
 
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
529
 
      <manvolnum>5</manvolnum></citerefentry>,
530
 
      <citerefentry><refentrytitle>mandos</refentrytitle>
531
 
      <manvolnum>8</manvolnum></citerefentry>,
532
 
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
533
 
      <manvolnum>8mandos</manvolnum></citerefentry>,
534
 
      <citerefentry><refentrytitle>ssh-keyscan</refentrytitle>
535
474
      <manvolnum>1</manvolnum></citerefentry>
536
475
    </para>
537
476
  </refsect1>