57
68
<refname><command>&COMMANDNAME;</command></refname>
59
Generate key and password for Mandos client and server.
70
Generate keys for <citerefentry><refentrytitle>password-request
71
</refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
65
77
<command>&COMMANDNAME;</command>
67
<arg choice="plain"><option>--dir
68
<replaceable>DIRECTORY</replaceable></option></arg>
69
<arg choice="plain"><option>-d
70
<replaceable>DIRECTORY</replaceable></option></arg>
74
<arg choice="plain"><option>--type
75
<replaceable>KEYTYPE</replaceable></option></arg>
76
<arg choice="plain"><option>-t
77
<replaceable>KEYTYPE</replaceable></option></arg>
81
<arg choice="plain"><option>--length
82
<replaceable>BITS</replaceable></option></arg>
83
<arg choice="plain"><option>-l
84
<replaceable>BITS</replaceable></option></arg>
88
<arg choice="plain"><option>--subtype
89
<replaceable>KEYTYPE</replaceable></option></arg>
90
<arg choice="plain"><option>-s
91
<replaceable>KEYTYPE</replaceable></option></arg>
95
<arg choice="plain"><option>--sublength
96
<replaceable>BITS</replaceable></option></arg>
97
<arg choice="plain"><option>-L
98
<replaceable>BITS</replaceable></option></arg>
102
<arg choice="plain"><option>--name
103
<replaceable>NAME</replaceable></option></arg>
104
<arg choice="plain"><option>-n
105
<replaceable>NAME</replaceable></option></arg>
109
<arg choice="plain"><option>--email
110
<replaceable>ADDRESS</replaceable></option></arg>
111
<arg choice="plain"><option>-e
112
<replaceable>ADDRESS</replaceable></option></arg>
116
<arg choice="plain"><option>--comment
117
<replaceable>TEXT</replaceable></option></arg>
118
<arg choice="plain"><option>-c
119
<replaceable>TEXT</replaceable></option></arg>
123
<arg choice="plain"><option>--expire
124
<replaceable>TIME</replaceable></option></arg>
125
<arg choice="plain"><option>-x
126
<replaceable>TIME</replaceable></option></arg>
130
<arg choice="plain"><option>--tls-keytype
131
<replaceable>KEYTYPE</replaceable></option></arg>
132
<arg choice="plain"><option>-T
133
<replaceable>KEYTYPE</replaceable></option></arg>
79
<arg choice="plain"><option>--dir</option>
80
<replaceable>directory</replaceable></arg>
83
<arg choice="plain"><option>--type</option>
84
<replaceable>type</replaceable></arg>
87
<arg choice="plain"><option>--length</option>
88
<replaceable>bits</replaceable></arg>
91
<arg choice="plain"><option>--subtype</option>
92
<replaceable>type</replaceable></arg>
95
<arg choice="plain"><option>--sublength</option>
96
<replaceable>bits</replaceable></arg>
99
<arg choice="plain"><option>--name</option>
100
<replaceable>NAME</replaceable></arg>
103
<arg choice="plain"><option>--email</option>
104
<replaceable>EMAIL</replaceable></arg>
107
<arg choice="plain"><option>--comment</option>
108
<replaceable>COMMENT</replaceable></arg>
111
<arg choice="plain"><option>--expire</option>
112
<replaceable>TIME</replaceable></arg>
137
115
<arg choice="plain"><option>--force</option></arg>
119
<command>&COMMANDNAME;</command>
121
<arg choice="plain"><option>-d</option>
122
<replaceable>directory</replaceable></arg>
125
<arg choice="plain"><option>-t</option>
126
<replaceable>type</replaceable></arg>
129
<arg choice="plain"><option>-l</option>
130
<replaceable>bits</replaceable></arg>
133
<arg choice="plain"><option>-s</option>
134
<replaceable>type</replaceable></arg>
137
<arg choice="plain"><option>-L</option>
138
<replaceable>bits</replaceable></arg>
141
<arg choice="plain"><option>-n</option>
142
<replaceable>NAME</replaceable></arg>
145
<arg choice="plain"><option>-e</option>
146
<replaceable>EMAIL</replaceable></arg>
149
<arg choice="plain"><option>-c</option>
150
<replaceable>COMMENT</replaceable></arg>
153
<arg choice="plain"><option>-x</option>
154
<replaceable>TIME</replaceable></arg>
138
157
<arg choice="plain"><option>-f</option></arg>
142
161
<command>&COMMANDNAME;</command>
143
162
<group choice="req">
163
<arg choice="plain"><option>-p</option></arg>
144
164
<arg choice="plain"><option>--password</option></arg>
145
<arg choice="plain"><option>-p</option></arg>
146
<arg choice="plain"><option>--passfile
147
<replaceable>FILE</replaceable></option></arg>
148
<arg choice="plain"><option>-F</option>
149
<replaceable>FILE</replaceable></arg>
153
<arg choice="plain"><option>--dir
154
<replaceable>DIRECTORY</replaceable></option></arg>
155
<arg choice="plain"><option>-d
156
<replaceable>DIRECTORY</replaceable></option></arg>
160
<arg choice="plain"><option>--name
161
<replaceable>NAME</replaceable></option></arg>
162
<arg choice="plain"><option>-n
163
<replaceable>NAME</replaceable></option></arg>
166
<arg choice="plain"><option>--no-ssh</option></arg>
167
<arg choice="plain"><option>-S</option></arg>
167
<arg choice="plain"><option>--dir</option>
168
<replaceable>directory</replaceable></arg>
171
<arg choice="plain"><option>--name</option>
172
<replaceable>NAME</replaceable></arg>
171
176
<command>&COMMANDNAME;</command>
172
177
<group choice="req">
178
<arg choice="plain"><option>-h</option></arg>
173
179
<arg choice="plain"><option>--help</option></arg>
174
<arg choice="plain"><option>-h</option></arg>
178
183
<command>&COMMANDNAME;</command>
179
184
<group choice="req">
185
<arg choice="plain"><option>-v</option></arg>
180
186
<arg choice="plain"><option>--version</option></arg>
181
<arg choice="plain"><option>-v</option></arg>
184
189
</refsynopsisdiv>
186
191
<refsect1 id="description">
187
192
<title>DESCRIPTION</title>
189
194
<command>&COMMANDNAME;</command> is a program to generate the
190
TLS and OpenPGP keys used by
191
<citerefentry><refentrytitle>mandos-client</refentrytitle>
196
<citerefentry><refentrytitle>password-request</refentrytitle>
192
197
<manvolnum>8mandos</manvolnum></citerefentry>. The keys are
193
198
normally written to /etc/mandos for later installation into the
194
initrd image, but this, and most other things, can be changed
195
with command line options.
199
initrd image, but this, like most things, can be changed with
200
command line options.
198
This program can also be used with the
199
<option>--password</option> or <option>--passfile</option>
200
options to generate a ready-made section for
201
<filename>clients.conf</filename> (see
203
It can also be used to generate ready-made sections for
202
204
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
203
<manvolnum>5</manvolnum></citerefentry>).
205
<manvolnum>5</manvolnum></citerefentry> using the
206
<option>--password</option> option.
207
210
<refsect1 id="purpose">
208
211
<title>PURPOSE</title>
210
214
The purpose of this is to enable <emphasis>remote and unattended
211
215
rebooting</emphasis> of client host computer with an
212
216
<emphasis>encrypted root file system</emphasis>. See <xref
213
217
linkend="overview"/> for details.
217
222
<refsect1 id="options">
218
223
<title>OPTIONS</title>
222
<term><option>--help</option></term>
223
<term><option>-h</option></term>
227
<term><literal>-h</literal>, <literal>--help</literal></term>
226
230
Show a help message and exit
233
<replaceable>DIRECTORY</replaceable></option></term>
235
<replaceable>DIRECTORY</replaceable></option></term>
236
<term><literal>-d</literal>, <literal>--dir
237
<replaceable>directory</replaceable></literal></term>
238
240
Target directory for key files. Default is
239
<filename class="directory">/etc/mandos</filename>.
246
<replaceable>TYPE</replaceable></option></term>
248
<replaceable>TYPE</replaceable></option></term>
251
OpenPGP key type. Default is <quote>RSA</quote>.
257
<term><option>--length
258
<replaceable>BITS</replaceable></option></term>
260
<replaceable>BITS</replaceable></option></term>
263
OpenPGP key length in bits. Default is 4096.
269
<term><option>--subtype
270
<replaceable>KEYTYPE</replaceable></option></term>
272
<replaceable>KEYTYPE</replaceable></option></term>
275
OpenPGP subkey type. Default is <quote>RSA</quote>
281
<term><option>--sublength
282
<replaceable>BITS</replaceable></option></term>
284
<replaceable>BITS</replaceable></option></term>
287
OpenPGP subkey length in bits. Default is 4096.
293
<term><option>--email
294
<replaceable>ADDRESS</replaceable></option></term>
296
<replaceable>ADDRESS</replaceable></option></term>
241
<filename>/etc/mandos</filename>.
247
<term><literal>-t</literal>, <literal>--type
248
<replaceable>type</replaceable></literal></term>
251
Key type. Default is <quote>DSA</quote>.
257
<term><literal>-l</literal>, <literal>--length
258
<replaceable>bits</replaceable></literal></term>
261
Key length in bits. Default is 2048.
267
<term><literal>-s</literal>, <literal>--subtype
268
<replaceable>type</replaceable></literal></term>
271
Subkey type. Default is <quote>ELG-E</quote> (Elgamal
278
<term><literal>-L</literal>, <literal>--sublength
279
<replaceable>bits</replaceable></literal></term>
282
Subkey length in bits. Default is 2048.
288
<term><literal>-e</literal>, <literal>--email</literal>
289
<replaceable>address</replaceable></term>
299
292
Email address of key. Default is empty.
305
<term><option>--comment
306
<replaceable>TEXT</replaceable></option></term>
308
<replaceable>TEXT</replaceable></option></term>
298
<term><literal>-c</literal>, <literal>--comment</literal>
299
<replaceable>comment</replaceable></term>
311
Comment field for key. Default is empty.
302
Comment field for key. The default value is
303
<quote><literal>Mandos client key</literal></quote>.
317
<term><option>--expire
318
<replaceable>TIME</replaceable></option></term>
320
<replaceable>TIME</replaceable></option></term>
309
<term><literal>-x</literal>, <literal>--expire</literal>
310
<replaceable>time</replaceable></term>
323
313
Key expire time. Default is no expiration. See
515
448
</informalexample>
518
Prompt for a password, encrypt it with the key in <filename
519
class="directory">/etc/mandos</filename> and output a section
520
suitable for <filename>clients.conf</filename>.
523
<userinput>&COMMANDNAME; --password</userinput>
528
Prompt for a password, encrypt it with the key in the
529
<filename>client-key</filename> directory and output a section
530
suitable for <filename>clients.conf</filename>.
534
<!-- do not wrap this line -->
535
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
541
451
<refsect1 id="security">
542
452
<title>SECURITY</title>
544
454
The <option>--type</option>, <option>--length</option>,
545
455
<option>--subtype</option>, and <option>--sublength</option>
546
options can be used to create keys of low security. If in
547
doubt, leave them to the default values.
456
options can be used to create keys of insufficient security. If
457
in doubt, leave them to the default values.
550
The key expire time is <emphasis>not</emphasis> guaranteed to be
551
honored by <citerefentry><refentrytitle>mandos</refentrytitle>
460
The key expire time is not guaranteed to be honored by
461
<citerefentry><refentrytitle>mandos</refentrytitle>
552
462
<manvolnum>8</manvolnum></citerefentry>.
556
466
<refsect1 id="see_also">
557
467
<title>SEE ALSO</title>
559
<citerefentry><refentrytitle>intro</refentrytitle>
560
<manvolnum>8mandos</manvolnum></citerefentry>,
561
469
<citerefentry><refentrytitle>gpg</refentrytitle>
562
470
<manvolnum>1</manvolnum></citerefentry>,
563
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
564
<manvolnum>5</manvolnum></citerefentry>,
565
471
<citerefentry><refentrytitle>mandos</refentrytitle>
566
472
<manvolnum>8</manvolnum></citerefentry>,
567
<citerefentry><refentrytitle>mandos-client</refentrytitle>
568
<manvolnum>8mandos</manvolnum></citerefentry>,
569
<citerefentry><refentrytitle>ssh-keyscan</refentrytitle>
570
<manvolnum>1</manvolnum></citerefentry>
473
<citerefentry><refentrytitle>password-request</refentrytitle>
474
<manvolnum>8mandos</manvolnum></citerefentry>