/mandos/trunk : revision 122

3

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

4

<!ENTITY VERSION "1.0">

5

<!ENTITY COMMANDNAME "mandos-keygen">

6

<!ENTITY TIMESTAMP "2008-09-03">

6

<!ENTITY TIMESTAMP "2008-08-31">

7

]>

8

9

34

<holder>Teddy Hogeborn</holder>

35

<holder>Björn Påhlsson</holder>

36

</copyright>

37

<xi:include href="legalnotice.xml"/>

37

38

<para>

39

This manual page is free software: you can redistribute it

40

and/or modify it under the terms of the GNU General Public

41

License as published by the Free Software Foundation,

42

either version 3 of the License, or (at your option) any

43

later version.

44

</para>

45

46

<para>

47

This manual page is distributed in the hope that it will

48

be useful, but WITHOUT ANY WARRANTY; without even the

49

implied warranty of MERCHANTABILITY or FITNESS FOR A

50

PARTICULAR PURPOSE. See the GNU General Public License

51

for more details.

52

</para>

53

54

<para>

55

You should have received a copy of the GNU General Public

56

License along with this program; If not, see

57

<ulink url="http://www.gnu.org/licenses/"/>.

58

</para>

59

</legalnotice>

38

60

</refentryinfo>

39

61

40

62

45

67

46

68

<refname><command>&COMMANDNAME;</command></refname>

47

69

48

Generate key and password for Mandos client and server.

70

Generate keys for <citerefentry><refentrytitle>password-request

71

</refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>

49

72

</refpurpose>

50

73

</refnamediv>

51

74

153

176

</group>

154

177

</cmdsynopsis>

155

178

</refsynopsisdiv>

156

179

157

180

158

181

<title>DESCRIPTION</title>

159

182

<para>

160

183

<command>&COMMANDNAME;</command> is a program to generate the

161

OpenPGP key used by

184

OpenPGP keys used by

162

185

<citerefentry><refentrytitle>password-request</refentrytitle>

163

<manvolnum>8mandos</manvolnum></citerefentry>. The key is

186

<manvolnum>8mandos</manvolnum></citerefentry>. The keys are

164

187

normally written to /etc/mandos for later installation into the

165

initrd image, but this, and most other things, can be changed

166

with command line options.

188

initrd image, but this, like most things, can be changed with

189

command line options.

167

190

</para>

168

191

<para>

169

This program can also be used with the

170

<option>--password</option> option to generate a ready-made

171

section for <filename>clients.conf</filename> (see

192

It can also be used to generate ready-made sections for

172

193

<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>

173

<manvolnum>5</manvolnum></citerefentry>).

194

<manvolnum>5</manvolnum></citerefentry> using the

195

<option>--password</option> option.

174

196

</para>

175

197

</refsect1>

176

198

177

199

178

200

<title>PURPOSE</title>

201

179

202

<para>

180

203

The purpose of this is to enable <emphasis>remote and unattended

181

204

rebooting</emphasis> of client host computer with an

182

205

<emphasis>encrypted root file system</emphasis>. See <xref

183

206

linkend="overview"/> for details.

184

207

</para>

208

185

209

</refsect1>

186

210

187

211

188

212

<title>OPTIONS</title>

189

213

190

214

191

215

192

193

216

194

217

195

218

<para>

196

219

Show a help message and exit

199

222

</varlistentry>

200

223

201

224

202

<term><option>--dir

203

<replaceable>DIRECTORY</replaceable></option></term>

204

<term><option>-d

205

<replaceable>DIRECTORY</replaceable></option></term>

225

<term><literal>-d</literal>, <literal>--dir

226

<replaceable>directory</replaceable></literal></term>

206

227

207

228

<para>

208

229

Target directory for key files. Default is

212

233

</varlistentry>

213

234

214

235

215

<term><option>--type

216

217

<term><option>-t

218

236

<term><literal>-t</literal>, <literal>--type

237

219

238

220

239

<para>

221

240

Key type. Default is <quote>DSA</quote>.

224

243

</varlistentry>

225

244

226

245

227

<term><option>--length

228

229

<term><option>-l

230

246

<term><literal>-l</literal>, <literal>--length

247

231

248

232

249

<para>

233

250

Key length in bits. Default is 2048.

236

253

</varlistentry>

237

254

238

255

239

<term><option>--subtype

240

<replaceable>KEYTYPE</replaceable></option></term>

241

<term><option>-s

242

<replaceable>KEYTYPE</replaceable></option></term>

256

<term><literal>-s</literal>, <literal>--subtype

257

243

258

244

259

<para>

245

260

Subkey type. Default is <quote>ELG-E</quote> (Elgamal

249

264

</varlistentry>

250

265

251

266

252

<term><option>--sublength

253

254

<term><option>-L

255

267

<term><literal>-L</literal>, <literal>--sublength

268

256

269

257

270

<para>

258

271

Subkey length in bits. Default is 2048.

261

274

</varlistentry>

262

275

263

276

264

<term><option>--email

265

<replaceable>ADDRESS</replaceable></option></term>

266

<term><option>-e

267

<replaceable>ADDRESS</replaceable></option></term>

277

<term><literal>-e</literal>, <literal>--email</literal>

278

<replaceable>address</replaceable></term>

268

279

269

280

<para>

270

281

Email address of key. Default is empty.

273

284

</varlistentry>

274

285

275

286

276

<term><option>--comment

277

278

<term><option>-c

279

287

<term><literal>-c</literal>, <literal>--comment</literal>

288

<replaceable>comment</replaceable></term>

280

289

281

290

<para>

282

291

Comment field for key. The default value is

286

295

</varlistentry>

287

296

288

297

289

<term><option>--expire

290

291

<term><option>-x

292

298

<term><literal>-x</literal>, <literal>--expire</literal>

299

293

300

294

301

<para>

295

302

Key expire time. Default is no expiration. See

300

307

</varlistentry>

301

308

302

309

303

<term><option>--force</option></term>

304

310

<term><literal>-f</literal>, <literal>--force</literal></term>

305

311

306

312

<para>

307

Force overwriting old key.

313

Force overwriting old keys.

308

314

</para>

309

315

</listitem>

310

316

</varlistentry>

311

317

312

<term><option>--password</option></term>

313

318

<term><literal>-p</literal>, <literal>--password</literal

319

></term>

314

320

315

321

<para>

316

322

Prompt for a password and encrypt it with the key already

322

328

>8</manvolnum></citerefentry>. The host name or the name

323

329

specified with the <option>--name</option> option is used

324

330

for the section header. All other options are ignored,

325

and no key is created.

331

and no keys are created.

326

332

</para>

327

333

</listitem>

328

334

</varlistentry>

334

340

<xi:include href="overview.xml"/>

335

341

<para>

336

342

This program is a small utility to generate new OpenPGP keys for

337

new Mandos clients, and to generate sections for inclusion in

338

<filename>clients.conf</filename> on the server.

343

new Mandos clients.

339

344

</para>

340

345

</refsect1>

341

346

342

347

343

348

<title>EXIT STATUS</title>

344

349

<para>

345

The exit status will be 0 if a new key (or password, if the

346

<option>--password</option> option was used) was successfully

347

created, otherwise not.

350

The exit status will be 0 if new keys were successfully created,

351

otherwise not.

348

352

</para>

349

353

</refsect1>

350

354

402

406

</variablelist>

403

407

</refsect1>

404

408

405

406

407

408

409

409

410

411

<para>

412

None are known at this time.

413

</para>

414

</refsect1>

410

415

411

416

412

417

<title>EXAMPLE</title>

420

425

</informalexample>

421

426

422

427

<para>

423

Create key in another directory and of another type. Force

428

Create keys in another directory and of another type. Force

424

429

overwriting old key files:

425

430

</para>

426

431

<para>

430

435

431

436

</para>

432

437

</informalexample>

433

434

<para>

435

Prompt for a password, encrypt it with the key in

436

<filename>/etc/mandos</filename> and output a section suitable

437

for <filename>clients.conf</filename>.

438

</para>

439

<para>

440

<userinput>&COMMANDNAME; --password</userinput>

441

</para>

442

</informalexample>

443

444

<para>

445

Prompt for a password, encrypt it with the key in the

446

<filename>client-key</filename> directory and output a section

447

suitable for <filename>clients.conf</filename>.

448

</para>

449

<para>

450

451

452

<userinput>&COMMANDNAME; --password --dir client-key</userinput>

453

454

</para>

455

</informalexample>

456

438

</refsect1>

457

439

458

440

460

442

<para>

461

443

The <option>--type</option>, <option>--length</option>,

462

444

<option>--subtype</option>, and <option>--sublength</option>

463

options can be used to create keys of low security. If in

464

doubt, leave them to the default values.

445

options can be used to create keys of insufficient security. If

446

in doubt, leave them to the default values.

465

447

</para>

466

448

<para>

467

The key expire time is <emphasis>not</emphasis> guaranteed to be

468

honored by <citerefentry><refentrytitle>mandos</refentrytitle>

449

The key expire time is not guaranteed to be honored by

450

<citerefentry><refentrytitle>mandos</refentrytitle>

469

451

<manvolnum>8</manvolnum></citerefentry>.

470

452

</para>

471

453

</refsect1>

475

457

<para>

476

458

477

459

<manvolnum>1</manvolnum></citerefentry>,

478

<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>

479

<manvolnum>5</manvolnum></citerefentry>,

480

460

<citerefentry><refentrytitle>mandos</refentrytitle>

481

461

<manvolnum>8</manvolnum></citerefentry>,

482

462

<citerefentry><refentrytitle>password-request</refentrytitle>