To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos-keygen.xml
- browse files at revision 1204
- compare with another revision
- download diff
- download tarball
- view history from revision 1204
- Committer: teddy at recompile
- Date: 2020-02-08 14:01:38 UTC
- Revision ID: teddy@recompile.se-20200208140138-h3ett0amdelfpt90
mandos: If possible, use shlex.quote() instead of re.escape()
* mandos: Make sure shlex.quote() exists (falling back to assigning
re.escape to it).
(Client.start_checker): Use shlex.quote() instead of re.escape().
* mandos: Make sure shlex.quote() exists (falling back to assigning
re.escape to it).
(Client.start_checker): Use shlex.quote() instead of re.escape().
- files added:
- .bzr-builddeb
- debian
- debian/po
- debian/source
- debian/tests
- debian/upstream
- dracut-module
- network-hooks.d
- plugin-helpers
- files removed:
- initramfs-tools-hook-conf
- files renamed:
- plugins.d/password-request.c => plugins.d/mandos-client.c
- plugins.d/password-request.xml => plugins.d/mandos-client.xml
- files modified:
- Makefile
added
removed
mandos-keygen.xml
1
<?xml version='1.0' encoding='UTF-8'?>
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
<!ENTITY VERSION "1.0">
5
4
<!ENTITY COMMANDNAME "mandos-keygen">
5
<!ENTITY TIMESTAMP "2019-07-18">
6
<!ENTITY % common SYSTEM "common.ent">
7
%common;
6
8
]>
7
9
8
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
9
11
<refentryinfo>
10
<title>&COMMANDNAME;</title>
11
<!-- NWalsh's docbook scripts use this to generate the footer: -->
12
<productname>&COMMANDNAME;</productname>
13
<productnumber>&VERSION;</productnumber>
12
<title>Mandos Manual</title>
13
<!-- NWalsh’s docbook scripts use this to generate the footer: -->
14
<productname>Mandos</productname>
15
<productnumber>&version;</productnumber>
16
<date>&TIMESTAMP;</date>
14
17
<authorgroup>
15
18
<author>
16
19
<firstname>Björn</firstname>
17
20
<surname>Påhlsson</surname>
18
21
<address>
19
<email>belorn@fukt.bsnet.se</email>
22
<email>belorn@recompile.se</email>
20
23
</address>
21
24
</author>
22
25
<author>
23
26
<firstname>Teddy</firstname>
24
27
<surname>Hogeborn</surname>
25
28
<address>
26
<email>teddy@fukt.bsnet.se</email>
29
<email>teddy@recompile.se</email>
27
30
</address>
28
31
</author>
29
32
</authorgroup>
30
33
<copyright>
31
34
<year>2008</year>
32
<holder>Teddy Hogeborn & Björn Påhlsson</holder>
35
<year>2009</year>
36
<year>2010</year>
37
<year>2011</year>
38
<year>2012</year>
39
<year>2013</year>
40
<year>2014</year>
41
<year>2015</year>
42
<year>2016</year>
43
<year>2017</year>
44
<year>2018</year>
45
<year>2019</year>
46
<holder>Teddy Hogeborn</holder>
47
<holder>Björn Påhlsson</holder>
33
48
</copyright>
34
<legalnotice>
35
<para>
36
This manual page is free software: you can redistribute it
37
and/or modify it under the terms of the GNU General Public
38
License as published by the Free Software Foundation,
39
either version 3 of the License, or (at your option) any
40
later version.
41
</para>
42
43
<para>
44
This manual page is distributed in the hope that it will
45
be useful, but WITHOUT ANY WARRANTY; without even the
46
implied warranty of MERCHANTABILITY or FITNESS FOR A
47
PARTICULAR PURPOSE. See the GNU General Public License
48
for more details.
49
</para>
50
51
<para>
52
You should have received a copy of the GNU General Public
53
License along with this program; If not, see
54
<ulink url="http://www.gnu.org/licenses/"/>.
55
</para>
56
</legalnotice>
49
<xi:include href="legalnotice.xml"/>
57
50
</refentryinfo>
58
51
59
52
<refmeta>
60
53
<refentrytitle>&COMMANDNAME;</refentrytitle>
61
54
<manvolnum>8</manvolnum>
64
57
<refnamediv>
65
58
<refname><command>&COMMANDNAME;</command></refname>
66
59
<refpurpose>
67
Generate keys for <citerefentry><refentrytitle>password-request
68
</refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
60
Generate key and password for Mandos client and server.
69
61
</refpurpose>
70
62
</refnamediv>
71
63
72
64
<refsynopsisdiv>
73
65
<cmdsynopsis>
74
66
<command>&COMMANDNAME;</command>
75
<group choice="opt">
76
<arg choice="plain"><option>--dir</option>
77
<replaceable>directory</replaceable></arg>
78
</group>
79
<group choice="opt">
80
<arg choice="plain"><option>--type</option>
81
<replaceable>type</replaceable></arg>
82
</group>
83
<group choice="opt">
84
<arg choice="plain"><option>--length</option>
85
<replaceable>bits</replaceable></arg>
86
</group>
87
<group choice="opt">
88
<arg choice="plain"><option>--name</option>
89
<replaceable>NAME</replaceable></arg>
90
</group>
91
<group choice="opt">
92
<arg choice="plain"><option>--email</option>
93
<replaceable>EMAIL</replaceable></arg>
94
</group>
95
<group choice="opt">
96
<arg choice="plain"><option>--comment</option>
97
<replaceable>COMMENT</replaceable></arg>
98
</group>
99
<group choice="opt">
100
<arg choice="plain"><option>--expire</option>
101
<replaceable>TIME</replaceable></arg>
102
</group>
103
<group choice="opt">
67
<group>
68
<arg choice="plain"><option>--dir
69
<replaceable>DIRECTORY</replaceable></option></arg>
70
<arg choice="plain"><option>-d
71
<replaceable>DIRECTORY</replaceable></option></arg>
72
</group>
73
<sbr/>
74
<group>
75
<arg choice="plain"><option>--type
76
<replaceable>KEYTYPE</replaceable></option></arg>
77
<arg choice="plain"><option>-t
78
<replaceable>KEYTYPE</replaceable></option></arg>
79
</group>
80
<sbr/>
81
<group>
82
<arg choice="plain"><option>--length
83
<replaceable>BITS</replaceable></option></arg>
84
<arg choice="plain"><option>-l
85
<replaceable>BITS</replaceable></option></arg>
86
</group>
87
<sbr/>
88
<group>
89
<arg choice="plain"><option>--subtype
90
<replaceable>KEYTYPE</replaceable></option></arg>
91
<arg choice="plain"><option>-s
92
<replaceable>KEYTYPE</replaceable></option></arg>
93
</group>
94
<sbr/>
95
<group>
96
<arg choice="plain"><option>--sublength
97
<replaceable>BITS</replaceable></option></arg>
98
<arg choice="plain"><option>-L
99
<replaceable>BITS</replaceable></option></arg>
100
</group>
101
<sbr/>
102
<group>
103
<arg choice="plain"><option>--name
104
<replaceable>NAME</replaceable></option></arg>
105
<arg choice="plain"><option>-n
106
<replaceable>NAME</replaceable></option></arg>
107
</group>
108
<sbr/>
109
<group>
110
<arg choice="plain"><option>--email
111
<replaceable>ADDRESS</replaceable></option></arg>
112
<arg choice="plain"><option>-e
113
<replaceable>ADDRESS</replaceable></option></arg>
114
</group>
115
<sbr/>
116
<group>
117
<arg choice="plain"><option>--comment
118
<replaceable>TEXT</replaceable></option></arg>
119
<arg choice="plain"><option>-c
120
<replaceable>TEXT</replaceable></option></arg>
121
</group>
122
<sbr/>
123
<group>
124
<arg choice="plain"><option>--expire
125
<replaceable>TIME</replaceable></option></arg>
126
<arg choice="plain"><option>-x
127
<replaceable>TIME</replaceable></option></arg>
128
</group>
129
<sbr/>
130
<group>
131
<arg choice="plain"><option>--tls-keytype
132
<replaceable>KEYTYPE</replaceable></option></arg>
133
<arg choice="plain"><option>-T
134
<replaceable>KEYTYPE</replaceable></option></arg>
135
</group>
136
<sbr/>
137
<group>
104
138
<arg choice="plain"><option>--force</option></arg>
105
</group>
106
</cmdsynopsis>
107
<cmdsynopsis>
108
<command>&COMMANDNAME;</command>
109
<group choice="opt">
110
<arg choice="plain"><option>-d</option>
111
<replaceable>directory</replaceable></arg>
112
</group>
113
<group choice="opt">
114
<arg choice="plain"><option>-t</option>
115
<replaceable>type</replaceable></arg>
116
</group>
117
<group choice="opt">
118
<arg choice="plain"><option>-l</option>
119
<replaceable>bits</replaceable></arg>
120
</group>
121
<group choice="opt">
122
<arg choice="plain"><option>-n</option>
123
<replaceable>NAME</replaceable></arg>
124
</group>
125
<group choice="opt">
126
<arg choice="plain"><option>-e</option>
127
<replaceable>EMAIL</replaceable></arg>
128
</group>
129
<group choice="opt">
130
<arg choice="plain"><option>-c</option>
131
<replaceable>COMMENT</replaceable></arg>
132
</group>
133
<group choice="opt">
134
<arg choice="plain"><option>-x</option>
135
<replaceable>TIME</replaceable></arg>
136
</group>
137
<group choice="opt">
138
139
<arg choice="plain"><option>-f</option></arg>
139
140
</group>
140
141
</cmdsynopsis>
141
142
<cmdsynopsis>
142
143
<command>&COMMANDNAME;</command>
143
144
<group choice="req">
144
<arg choice='plain'><option>-h</option></arg>
145
<arg choice='plain'><option>--help</option></arg>
146
</group>
147
</cmdsynopsis>
148
<cmdsynopsis>
149
<command>&COMMANDNAME;</command>
150
<group choice="req">
151
<arg choice='plain'><option>-v</option></arg>
152
<arg choice='plain'><option>--version</option></arg>
145
<arg choice="plain"><option>--password</option></arg>
146
<arg choice="plain"><option>-p</option></arg>
147
<arg choice="plain"><option>--passfile
148
<replaceable>FILE</replaceable></option></arg>
149
<arg choice="plain"><option>-F</option>
150
<replaceable>FILE</replaceable></arg>
151
</group>
152
<sbr/>
153
<group>
154
<arg choice="plain"><option>--dir
155
<replaceable>DIRECTORY</replaceable></option></arg>
156
<arg choice="plain"><option>-d
157
<replaceable>DIRECTORY</replaceable></option></arg>
158
</group>
159
<sbr/>
160
<group>
161
<arg choice="plain"><option>--name
162
<replaceable>NAME</replaceable></option></arg>
163
<arg choice="plain"><option>-n
164
<replaceable>NAME</replaceable></option></arg>
165
</group>
166
<group>
167
<arg choice="plain"><option>--no-ssh</option></arg>
168
<arg choice="plain"><option>-S</option></arg>
169
</group>
170
</cmdsynopsis>
171
<cmdsynopsis>
172
<command>&COMMANDNAME;</command>
173
<group choice="req">
174
<arg choice="plain"><option>--help</option></arg>
175
<arg choice="plain"><option>-h</option></arg>
176
</group>
177
</cmdsynopsis>
178
<cmdsynopsis>
179
<command>&COMMANDNAME;</command>
180
<group choice="req">
181
<arg choice="plain"><option>--version</option></arg>
182
<arg choice="plain"><option>-v</option></arg>
153
183
</group>
154
184
</cmdsynopsis>
155
185
</refsynopsisdiv>
156
186
157
187
<refsect1 id="description">
158
188
<title>DESCRIPTION</title>
159
189
<para>
160
190
<command>&COMMANDNAME;</command> is a program to generate the
161
OpenPGP keys used by
162
<citerefentry><refentrytitle>password-request</refentrytitle>
191
TLS and OpenPGP keys used by
192
<citerefentry><refentrytitle>mandos-client</refentrytitle>
163
193
<manvolnum>8mandos</manvolnum></citerefentry>. The keys are
164
normally written to /etc/mandos for later installation into the
165
initrd image, but this, like most things, can be changed with
166
command line options.
194
normally written to /etc/keys/mandos for later installation into
195
the initrd image, but this, and most other things, can be
196
changed with command line options.
197
</para>
198
<para>
199
This program can also be used with the
200
<option>--password</option> or <option>--passfile</option>
201
options to generate a ready-made section for
202
<filename>clients.conf</filename> (see
203
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
204
<manvolnum>5</manvolnum></citerefentry>).
167
205
</para>
168
206
</refsect1>
169
207
170
208
<refsect1 id="purpose">
171
209
<title>PURPOSE</title>
172
173
210
<para>
174
211
The purpose of this is to enable <emphasis>remote and unattended
175
212
rebooting</emphasis> of client host computer with an
176
213
<emphasis>encrypted root file system</emphasis>. See <xref
177
214
linkend="overview"/> for details.
178
215
</para>
179
180
216
</refsect1>
181
217
182
218
<refsect1 id="options">
183
219
<title>OPTIONS</title>
184
220
185
221
<variablelist>
186
222
<varlistentry>
187
<term><literal>-h</literal>, <literal>--help</literal></term>
223
<term><option>--help</option></term>
224
<term><option>-h</option></term>
188
225
<listitem>
189
226
<para>
190
227
Show a help message and exit
191
228
</para>
192
229
</listitem>
193
230
</varlistentry>
194
195
<varlistentry>
196
<term><literal>-d</literal>, <literal>--dir
197
<replaceable>directory</replaceable></literal></term>
198
<listitem>
199
<para>
200
Target directory for key files.
201
</para>
202
</listitem>
203
</varlistentry>
204
205
<varlistentry>
206
<term><literal>-t</literal>, <literal>--type
207
<replaceable>type</replaceable></literal></term>
208
<listitem>
209
<para>
210
Key type. Default is DSA.
211
</para>
212
</listitem>
213
</varlistentry>
214
215
<varlistentry>
216
<term><literal>-l</literal>, <literal>--length
217
<replaceable>bits</replaceable></literal></term>
218
<listitem>
219
<para>
220
Key length in bits. Default is 1024.
221
</para>
222
</listitem>
223
</varlistentry>
224
225
<varlistentry>
226
<term><literal>-e</literal>, <literal>--email</literal>
227
<replaceable>address</replaceable></term>
231
232
<varlistentry>
233
<term><option>--dir
234
<replaceable>DIRECTORY</replaceable></option></term>
235
<term><option>-d
236
<replaceable>DIRECTORY</replaceable></option></term>
237
<listitem>
238
<para>
239
Target directory for key files. Default is <filename
240
class="directory">/etc/keys/mandos</filename>.
241
</para>
242
</listitem>
243
</varlistentry>
244
245
<varlistentry>
246
<term><option>--type
247
<replaceable>TYPE</replaceable></option></term>
248
<term><option>-t
249
<replaceable>TYPE</replaceable></option></term>
250
<listitem>
251
<para>
252
OpenPGP key type. Default is <quote>RSA</quote>.
253
</para>
254
</listitem>
255
</varlistentry>
256
257
<varlistentry>
258
<term><option>--length
259
<replaceable>BITS</replaceable></option></term>
260
<term><option>-l
261
<replaceable>BITS</replaceable></option></term>
262
<listitem>
263
<para>
264
OpenPGP key length in bits. Default is 4096.
265
</para>
266
</listitem>
267
</varlistentry>
268
269
<varlistentry>
270
<term><option>--subtype
271
<replaceable>KEYTYPE</replaceable></option></term>
272
<term><option>-s
273
<replaceable>KEYTYPE</replaceable></option></term>
274
<listitem>
275
<para>
276
OpenPGP subkey type. Default is <quote>RSA</quote>
277
</para>
278
</listitem>
279
</varlistentry>
280
281
<varlistentry>
282
<term><option>--sublength
283
<replaceable>BITS</replaceable></option></term>
284
<term><option>-L
285
<replaceable>BITS</replaceable></option></term>
286
<listitem>
287
<para>
288
OpenPGP subkey length in bits. Default is 4096.
289
</para>
290
</listitem>
291
</varlistentry>
292
293
<varlistentry>
294
<term><option>--email
295
<replaceable>ADDRESS</replaceable></option></term>
296
<term><option>-e
297
<replaceable>ADDRESS</replaceable></option></term>
228
298
<listitem>
229
299
<para>
230
300
Email address of key. Default is empty.
231
301
</para>
232
302
</listitem>
233
303
</varlistentry>
234
304
235
305
<varlistentry>
236
<term><literal>-c</literal>, <literal>--comment</literal>
237
<replaceable>comment</replaceable></term>
306
<term><option>--comment
307
<replaceable>TEXT</replaceable></option></term>
308
<term><option>-c
309
<replaceable>TEXT</replaceable></option></term>
238
310
<listitem>
239
311
<para>
240
Comment field for key. The default value is
241
"<literal>Mandos client key</literal>".
312
Comment field for key. Default is empty.
242
313
</para>
243
314
</listitem>
244
315
</varlistentry>
245
316
246
317
<varlistentry>
247
<term><literal>-x</literal>, <literal>--expire</literal>
248
<replaceable>time</replaceable></term>
318
<term><option>--expire
319
<replaceable>TIME</replaceable></option></term>
320
<term><option>-x
321
<replaceable>TIME</replaceable></option></term>
249
322
<listitem>
250
323
<para>
251
324
Key expire time. Default is no expiration. See
254
327
</para>
255
328
</listitem>
256
329
</varlistentry>
257
258
<varlistentry>
259
<term><literal>-f</literal>, <literal>--force</literal></term>
260
<listitem>
261
<para>
262
Force overwriting old keys.
330
331
<varlistentry>
332
<term><option>--tls-keytype
333
<replaceable>KEYTYPE</replaceable></option></term>
334
<term><option>-T
335
<replaceable>KEYTYPE</replaceable></option></term>
336
<listitem>
337
<para>
338
TLS key type. Default is <quote>ed25519</quote>
339
</para>
340
</listitem>
341
</varlistentry>
342
343
<varlistentry>
344
<term><option>--force</option></term>
345
<term><option>-f</option></term>
346
<listitem>
347
<para>
348
Force overwriting old key.
349
</para>
350
</listitem>
351
</varlistentry>
352
<varlistentry>
353
<term><option>--password</option></term>
354
<term><option>-p</option></term>
355
<listitem>
356
<para>
357
Prompt for a password and encrypt it with the key already
358
present in either <filename>/etc/keys/mandos</filename> or
359
the directory specified with the <option>--dir</option>
360
option. Outputs, on standard output, a section suitable
361
for inclusion in <citerefentry><refentrytitle
362
>mandos-clients.conf</refentrytitle><manvolnum
363
>8</manvolnum></citerefentry>. The host name or the name
364
specified with the <option>--name</option> option is used
365
for the section header. All other options are ignored,
366
and no key is created. Note: white space is stripped from
367
the beginning and from the end of the password; See <xref
368
linkend="bugs"/>.
369
</para>
370
</listitem>
371
</varlistentry>
372
<varlistentry>
373
<term><option>--passfile
374
<replaceable>FILE</replaceable></option></term>
375
<term><option>-F
376
<replaceable>FILE</replaceable></option></term>
377
<listitem>
378
<para>
379
The same as <option>--password</option>, but read from
380
<replaceable>FILE</replaceable>, not the terminal, and
381
white space is not stripped from the password in any way.
382
</para>
383
</listitem>
384
</varlistentry>
385
<varlistentry>
386
<term><option>--no-ssh</option></term>
387
<term><option>-S</option></term>
388
<listitem>
389
<para>
390
When <option>--password</option> or
391
<option>--passfile</option> is given, this option will
392
prevent <command>&COMMANDNAME;</command> from calling
393
<command>ssh-keyscan</command> to get an SSH fingerprint
394
for this host and, if successful, output suitable config
395
options to use this fingerprint as a
396
<option>checker</option> option in the output. This is
397
otherwise the default behavior.
263
398
</para>
264
399
</listitem>
265
400
</varlistentry>
266
401
</variablelist>
267
402
</refsect1>
268
403
269
404
<refsect1 id="overview">
270
405
<title>OVERVIEW</title>
271
406
<xi:include href="overview.xml"/>
272
407
<para>
273
This program is a small program to generate new OpenPGP keys for
274
new Mandos clients.
408
This program is a small utility to generate new TLS and OpenPGP
409
keys for new Mandos clients, and to generate sections for
410
inclusion in <filename>clients.conf</filename> on the server.
275
411
</para>
276
412
</refsect1>
277
413
278
414
<refsect1 id="exit_status">
279
415
<title>EXIT STATUS</title>
280
416
<para>
281
The exit status will be 0 if new keys were successfully created,
282
otherwise not.
417
The exit status will be 0 if a new key (or password, if the
418
<option>--password</option> option was used) was successfully
419
created, otherwise not.
283
420
</para>
284
421
</refsect1>
285
422
287
424
<title>ENVIRONMENT</title>
288
425
<variablelist>
289
426
<varlistentry>
290
<term><varname>TMPDIR</varname></term>
427
<term><envar>TMPDIR</envar></term>
291
428
<listitem>
292
429
<para>
293
430
If set, temporary files will be created here. See
299
436
</variablelist>
300
437
</refsect1>
301
438
302
<refsect1 id="file">
439
<refsect1 id="files">
303
440
<title>FILES</title>
304
441
<para>
305
442
Use the <option>--dir</option> option to change where
308
445
</para>
309
446
<variablelist>
310
447
<varlistentry>
311
<term><filename>/etc/mandos/seckey.txt</filename></term>
448
<term><filename>/etc/keys/mandos/seckey.txt</filename></term>
312
449
<listitem>
313
450
<para>
314
451
OpenPGP secret key file which will be created or
317
454
</listitem>
318
455
</varlistentry>
319
456
<varlistentry>
320
<term><filename>/etc/mandos/pubkey.txt</filename></term>
457
<term><filename>/etc/keys/mandos/pubkey.txt</filename></term>
321
458
<listitem>
322
459
<para>
323
460
OpenPGP public key file which will be created or
326
463
</listitem>
327
464
</varlistentry>
328
465
<varlistentry>
329
<term><filename>/tmp</filename></term>
466
<term><filename>/etc/keys/mandos/tls-privkey.pem</filename></term>
467
<listitem>
468
<para>
469
Private key file which will be created or overwritten.
470
</para>
471
</listitem>
472
</varlistentry>
473
<varlistentry>
474
<term><filename>/etc/keys/mandos/tls-pubkey.pem</filename></term>
475
<listitem>
476
<para>
477
Public key file which will be created or overwritten.
478
</para>
479
</listitem>
480
</varlistentry>
481
<varlistentry>
482
<term><filename class="directory">/tmp</filename></term>
330
483
<listitem>
331
484
<para>
332
485
Temporary files will be written here if
336
489
</varlistentry>
337
490
</variablelist>
338
491
</refsect1>
339
492
340
493
<refsect1 id="bugs">
341
494
<title>BUGS</title>
342
495
<para>
343
None are known at this time.
496
The <option>--password</option>/<option>-p</option> option
497
strips white space from the start and from the end of the
498
password before using it. If this is a problem, use the
499
<option>--passfile</option> option instead, which does not do
500
this.
344
501
</para>
502
<xi:include href="bugs.xml"/>
345
503
</refsect1>
346
504
347
505
<refsect1 id="example">
348
506
<title>EXAMPLE</title>
349
507
<informalexample>
351
509
Normal invocation needs no options:
352
510
</para>
353
511
<para>
354
<userinput>mandos-keygen</userinput>
512
<userinput>&COMMANDNAME;</userinput>
355
513
</para>
356
514
</informalexample>
357
515
<informalexample>
358
516
<para>
359
Create keys in another directory and of another type. Force
517
Create key in another directory and of another type. Force
360
518
overwriting old key files:
361
519
</para>
362
520
<para>
363
521
364
522
<!-- do not wrap this line -->
365
<userinput>mandos-keygen --dir ~/keydir --type RSA --force</userinput>
523
<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>
524
525
</para>
526
</informalexample>
527
<informalexample>
528
<para>
529
Prompt for a password, encrypt it with the keys in <filename
530
class="directory">/etc/keys/mandos</filename> and output a
531
section suitable for <filename>clients.conf</filename>.
532
</para>
533
<para>
534
<userinput>&COMMANDNAME; --password</userinput>
535
</para>
536
</informalexample>
537
<informalexample>
538
<para>
539
Prompt for a password, encrypt it with the keys in the
540
<filename>client-key</filename> directory and output a section
541
suitable for <filename>clients.conf</filename>.
542
</para>
543
<para>
544
545
<!-- do not wrap this line -->
546
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
366
547
367
548
</para>
368
549
</informalexample>
369
550
</refsect1>
370
551
371
552
<refsect1 id="security">
372
553
<title>SECURITY</title>
373
554
<para>
374
The <option>--type</option> and <option>--length</option>
375
options can be used to create keys of insufficient security. If
376
in doubt, leave them to the default values.
555
The <option>--type</option>, <option>--length</option>,
556
<option>--subtype</option>, and <option>--sublength</option>
557
options can be used to create keys of low security. If in
558
doubt, leave them to the default values.
377
559
</para>
378
560
<para>
379
The key expire time is not guaranteed to be honored by
380
<citerefentry><refentrytitle>mandos</refentrytitle>
561
The key expire time is <emphasis>not</emphasis> guaranteed to be
562
honored by <citerefentry><refentrytitle>mandos</refentrytitle>
381
563
<manvolnum>8</manvolnum></citerefentry>.
382
564
</para>
383
565
</refsect1>
384
566
385
567
<refsect1 id="see_also">
386
568
<title>SEE ALSO</title>
387
569
<para>
388
<citerefentry><refentrytitle>password-request</refentrytitle>
570
<citerefentry><refentrytitle>intro</refentrytitle>
389
571
<manvolnum>8mandos</manvolnum></citerefentry>,
390
<citerefentry><refentrytitle>mandos</refentrytitle>
391
<manvolnum>8</manvolnum></citerefentry>, and
392
572
<citerefentry><refentrytitle>gpg</refentrytitle>
573
<manvolnum>1</manvolnum></citerefentry>,
574
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
575
<manvolnum>5</manvolnum></citerefentry>,
576
<citerefentry><refentrytitle>mandos</refentrytitle>
577
<manvolnum>8</manvolnum></citerefentry>,
578
<citerefentry><refentrytitle>mandos-client</refentrytitle>
579
<manvolnum>8mandos</manvolnum></citerefentry>,
580
<citerefentry><refentrytitle>ssh-keyscan</refentrytitle>
393
581
<manvolnum>1</manvolnum></citerefentry>
394
582
</para>
395
583
</refsect1>
396
584
397
585
</refentry>
586
<!-- Local Variables: -->
587
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
588
<!-- time-stamp-end: "[\"']>" -->
589
<!-- time-stamp-format: "%:y-%02m-%02d" -->
590
<!-- End: -->
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0