To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos-keygen.xml
- browse files at revision 1242
- compare with another revision
- download diff
- download tarball
- view history from revision 1242
- Committer: Teddy Hogeborn
- Date: 2021-03-21 19:51:15 UTC
- Revision ID: teddy@recompile.se-20210321195115-qe6g0fyj1kabwlav
Fix theoretical GnuTLS bug
Fix "NameError: global name '_error_code' is not defined" error if
GNUTLS_E_INTERRUPTED or GNUTLS_E_AGAIN was ever returned from
gnutls_record_send().
* mandos (gnutls._retry_on_error): Import "_error_code" from outer
class scope to local function scope via a keyword argument.
Fix "NameError: global name '_error_code' is not defined" error if
GNUTLS_E_INTERRUPTED or GNUTLS_E_AGAIN was ever returned from
gnutls_record_send().
* mandos (gnutls._retry_on_error): Import "_error_code" from outer
class scope to local function scope via a keyword argument.
- files added:
- .bzr-builddeb
- debian
- debian/po
- debian/source
- debian/tests
- debian/upstream
- dracut-module
- network-hooks.d
- plugin-helpers
- files removed:
- initramfs-tools-hook-conf
- files renamed:
- plugins.d/password-request.c => plugins.d/mandos-client.c
- plugins.d/password-request.xml => plugins.d/mandos-client.xml
- files modified:
- Makefile
added
removed
mandos-keygen.xml
1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
<!ENTITY VERSION "1.0">
5
4
<!ENTITY COMMANDNAME "mandos-keygen">
5
<!ENTITY TIMESTAMP "2019-07-18">
6
<!ENTITY % common SYSTEM "common.ent">
7
%common;
6
8
]>
7
9
8
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
9
11
<refentryinfo>
10
<title>&COMMANDNAME;</title>
12
<title>Mandos Manual</title>
11
13
<!-- NWalsh’s docbook scripts use this to generate the footer: -->
12
<productname>&COMMANDNAME;</productname>
13
<productnumber>&VERSION;</productnumber>
14
<productname>Mandos</productname>
15
<productnumber>&version;</productnumber>
16
<date>&TIMESTAMP;</date>
14
17
<authorgroup>
15
18
<author>
16
19
<firstname>Björn</firstname>
17
20
<surname>Påhlsson</surname>
18
21
<address>
19
<email>belorn@fukt.bsnet.se</email>
22
<email>belorn@recompile.se</email>
20
23
</address>
21
24
</author>
22
25
<author>
23
26
<firstname>Teddy</firstname>
24
27
<surname>Hogeborn</surname>
25
28
<address>
26
<email>teddy@fukt.bsnet.se</email>
29
<email>teddy@recompile.se</email>
27
30
</address>
28
31
</author>
29
32
</authorgroup>
30
33
<copyright>
31
34
<year>2008</year>
35
<year>2009</year>
36
<year>2010</year>
37
<year>2011</year>
38
<year>2012</year>
39
<year>2013</year>
40
<year>2014</year>
41
<year>2015</year>
42
<year>2016</year>
43
<year>2017</year>
44
<year>2018</year>
45
<year>2019</year>
32
46
<holder>Teddy Hogeborn</holder>
33
47
<holder>Björn Påhlsson</holder>
34
48
</copyright>
35
<legalnotice>
36
<para>
37
This manual page is free software: you can redistribute it
38
and/or modify it under the terms of the GNU General Public
39
License as published by the Free Software Foundation,
40
either version 3 of the License, or (at your option) any
41
later version.
42
</para>
43
44
<para>
45
This manual page is distributed in the hope that it will
46
be useful, but WITHOUT ANY WARRANTY; without even the
47
implied warranty of MERCHANTABILITY or FITNESS FOR A
48
PARTICULAR PURPOSE. See the GNU General Public License
49
for more details.
50
</para>
51
52
<para>
53
You should have received a copy of the GNU General Public
54
License along with this program; If not, see
55
<ulink url="http://www.gnu.org/licenses/"/>.
56
</para>
57
</legalnotice>
49
<xi:include href="legalnotice.xml"/>
58
50
</refentryinfo>
59
51
60
52
<refmeta>
61
53
<refentrytitle>&COMMANDNAME;</refentrytitle>
62
54
<manvolnum>8</manvolnum>
65
57
<refnamediv>
66
58
<refname><command>&COMMANDNAME;</command></refname>
67
59
<refpurpose>
68
Generate keys for <citerefentry><refentrytitle>password-request
69
</refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
60
Generate key and password for Mandos client and server.
70
61
</refpurpose>
71
62
</refnamediv>
72
63
73
64
<refsynopsisdiv>
74
65
<cmdsynopsis>
75
66
<command>&COMMANDNAME;</command>
76
<group choice="opt">
77
<arg choice="plain"><option>--dir</option>
78
<replaceable>directory</replaceable></arg>
79
</group>
80
<group choice="opt">
81
<arg choice="plain"><option>--type</option>
82
<replaceable>type</replaceable></arg>
83
</group>
84
<group choice="opt">
85
<arg choice="plain"><option>--length</option>
86
<replaceable>bits</replaceable></arg>
87
</group>
88
<group choice="opt">
89
<arg choice="plain"><option>--subtype</option>
90
<replaceable>type</replaceable></arg>
91
</group>
92
<group choice="opt">
93
<arg choice="plain"><option>--sublength</option>
94
<replaceable>bits</replaceable></arg>
95
</group>
96
<group choice="opt">
97
<arg choice="plain"><option>--name</option>
98
<replaceable>NAME</replaceable></arg>
99
</group>
100
<group choice="opt">
101
<arg choice="plain"><option>--email</option>
102
<replaceable>EMAIL</replaceable></arg>
103
</group>
104
<group choice="opt">
105
<arg choice="plain"><option>--comment</option>
106
<replaceable>COMMENT</replaceable></arg>
107
</group>
108
<group choice="opt">
109
<arg choice="plain"><option>--expire</option>
110
<replaceable>TIME</replaceable></arg>
111
</group>
112
<group choice="opt">
67
<group>
68
<arg choice="plain"><option>--dir
69
<replaceable>DIRECTORY</replaceable></option></arg>
70
<arg choice="plain"><option>-d
71
<replaceable>DIRECTORY</replaceable></option></arg>
72
</group>
73
<sbr/>
74
<group>
75
<arg choice="plain"><option>--type
76
<replaceable>KEYTYPE</replaceable></option></arg>
77
<arg choice="plain"><option>-t
78
<replaceable>KEYTYPE</replaceable></option></arg>
79
</group>
80
<sbr/>
81
<group>
82
<arg choice="plain"><option>--length
83
<replaceable>BITS</replaceable></option></arg>
84
<arg choice="plain"><option>-l
85
<replaceable>BITS</replaceable></option></arg>
86
</group>
87
<sbr/>
88
<group>
89
<arg choice="plain"><option>--subtype
90
<replaceable>KEYTYPE</replaceable></option></arg>
91
<arg choice="plain"><option>-s
92
<replaceable>KEYTYPE</replaceable></option></arg>
93
</group>
94
<sbr/>
95
<group>
96
<arg choice="plain"><option>--sublength
97
<replaceable>BITS</replaceable></option></arg>
98
<arg choice="plain"><option>-L
99
<replaceable>BITS</replaceable></option></arg>
100
</group>
101
<sbr/>
102
<group>
103
<arg choice="plain"><option>--name
104
<replaceable>NAME</replaceable></option></arg>
105
<arg choice="plain"><option>-n
106
<replaceable>NAME</replaceable></option></arg>
107
</group>
108
<sbr/>
109
<group>
110
<arg choice="plain"><option>--email
111
<replaceable>ADDRESS</replaceable></option></arg>
112
<arg choice="plain"><option>-e
113
<replaceable>ADDRESS</replaceable></option></arg>
114
</group>
115
<sbr/>
116
<group>
117
<arg choice="plain"><option>--comment
118
<replaceable>TEXT</replaceable></option></arg>
119
<arg choice="plain"><option>-c
120
<replaceable>TEXT</replaceable></option></arg>
121
</group>
122
<sbr/>
123
<group>
124
<arg choice="plain"><option>--expire
125
<replaceable>TIME</replaceable></option></arg>
126
<arg choice="plain"><option>-x
127
<replaceable>TIME</replaceable></option></arg>
128
</group>
129
<sbr/>
130
<group>
131
<arg choice="plain"><option>--tls-keytype
132
<replaceable>KEYTYPE</replaceable></option></arg>
133
<arg choice="plain"><option>-T
134
<replaceable>KEYTYPE</replaceable></option></arg>
135
</group>
136
<sbr/>
137
<group>
113
138
<arg choice="plain"><option>--force</option></arg>
114
</group>
115
</cmdsynopsis>
116
<cmdsynopsis>
117
<command>&COMMANDNAME;</command>
118
<group choice="opt">
119
<arg choice="plain"><option>-d</option>
120
<replaceable>directory</replaceable></arg>
121
</group>
122
<group choice="opt">
123
<arg choice="plain"><option>-t</option>
124
<replaceable>type</replaceable></arg>
125
</group>
126
<group choice="opt">
127
<arg choice="plain"><option>-l</option>
128
<replaceable>bits</replaceable></arg>
129
</group>
130
<group choice="opt">
131
<arg choice="plain"><option>-s</option>
132
<replaceable>type</replaceable></arg>
133
</group>
134
<group choice="opt">
135
<arg choice="plain"><option>-L</option>
136
<replaceable>bits</replaceable></arg>
137
</group>
138
<group choice="opt">
139
<arg choice="plain"><option>-n</option>
140
<replaceable>NAME</replaceable></arg>
141
</group>
142
<group choice="opt">
143
<arg choice="plain"><option>-e</option>
144
<replaceable>EMAIL</replaceable></arg>
145
</group>
146
<group choice="opt">
147
<arg choice="plain"><option>-c</option>
148
<replaceable>COMMENT</replaceable></arg>
149
</group>
150
<group choice="opt">
151
<arg choice="plain"><option>-x</option>
152
<replaceable>TIME</replaceable></arg>
153
</group>
154
<group choice="opt">
155
139
<arg choice="plain"><option>-f</option></arg>
156
140
</group>
157
141
</cmdsynopsis>
158
142
<cmdsynopsis>
159
143
<command>&COMMANDNAME;</command>
160
144
<group choice="req">
145
<arg choice="plain"><option>--password</option></arg>
146
<arg choice="plain"><option>-p</option></arg>
147
<arg choice="plain"><option>--passfile
148
<replaceable>FILE</replaceable></option></arg>
149
<arg choice="plain"><option>-F</option>
150
<replaceable>FILE</replaceable></arg>
151
</group>
152
<sbr/>
153
<group>
154
<arg choice="plain"><option>--dir
155
<replaceable>DIRECTORY</replaceable></option></arg>
156
<arg choice="plain"><option>-d
157
<replaceable>DIRECTORY</replaceable></option></arg>
158
</group>
159
<sbr/>
160
<group>
161
<arg choice="plain"><option>--name
162
<replaceable>NAME</replaceable></option></arg>
163
<arg choice="plain"><option>-n
164
<replaceable>NAME</replaceable></option></arg>
165
</group>
166
<group>
167
<arg choice="plain"><option>--no-ssh</option></arg>
168
<arg choice="plain"><option>-S</option></arg>
169
</group>
170
</cmdsynopsis>
171
<cmdsynopsis>
172
<command>&COMMANDNAME;</command>
173
<group choice="req">
174
<arg choice="plain"><option>--help</option></arg>
161
175
<arg choice="plain"><option>-h</option></arg>
162
<arg choice="plain"><option>--help</option></arg>
163
176
</group>
164
177
</cmdsynopsis>
165
178
<cmdsynopsis>
166
179
<command>&COMMANDNAME;</command>
167
180
<group choice="req">
181
<arg choice="plain"><option>--version</option></arg>
168
182
<arg choice="plain"><option>-v</option></arg>
169
<arg choice="plain"><option>--version</option></arg>
170
183
</group>
171
184
</cmdsynopsis>
172
185
</refsynopsisdiv>
173
186
174
187
<refsect1 id="description">
175
188
<title>DESCRIPTION</title>
176
189
<para>
177
190
<command>&COMMANDNAME;</command> is a program to generate the
178
OpenPGP keys used by
179
<citerefentry><refentrytitle>password-request</refentrytitle>
191
TLS and OpenPGP keys used by
192
<citerefentry><refentrytitle>mandos-client</refentrytitle>
180
193
<manvolnum>8mandos</manvolnum></citerefentry>. The keys are
181
normally written to /etc/mandos for later installation into the
182
initrd image, but this, like most things, can be changed with
183
command line options.
194
normally written to /etc/keys/mandos for later installation into
195
the initrd image, but this, and most other things, can be
196
changed with command line options.
197
</para>
198
<para>
199
This program can also be used with the
200
<option>--password</option> or <option>--passfile</option>
201
options to generate a ready-made section for
202
<filename>clients.conf</filename> (see
203
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
204
<manvolnum>5</manvolnum></citerefentry>).
184
205
</para>
185
206
</refsect1>
186
207
187
208
<refsect1 id="purpose">
188
209
<title>PURPOSE</title>
189
190
210
<para>
191
211
The purpose of this is to enable <emphasis>remote and unattended
192
212
rebooting</emphasis> of client host computer with an
193
213
<emphasis>encrypted root file system</emphasis>. See <xref
194
214
linkend="overview"/> for details.
195
215
</para>
196
197
216
</refsect1>
198
217
199
218
<refsect1 id="options">
200
219
<title>OPTIONS</title>
201
220
202
221
<variablelist>
203
222
<varlistentry>
204
<term><literal>-h</literal>, <literal>--help</literal></term>
223
<term><option>--help</option></term>
224
<term><option>-h</option></term>
205
225
<listitem>
206
226
<para>
207
227
Show a help message and exit
208
228
</para>
209
229
</listitem>
210
230
</varlistentry>
211
212
<varlistentry>
213
<term><literal>-d</literal>, <literal>--dir
214
<replaceable>directory</replaceable></literal></term>
215
<listitem>
216
<para>
217
Target directory for key files.
218
</para>
219
</listitem>
220
</varlistentry>
221
222
<varlistentry>
223
<term><literal>-t</literal>, <literal>--type
224
<replaceable>type</replaceable></literal></term>
225
<listitem>
226
<para>
227
Key type. Default is <quote>DSA</quote>.
228
</para>
229
</listitem>
230
</varlistentry>
231
232
<varlistentry>
233
<term><literal>-l</literal>, <literal>--length
234
<replaceable>bits</replaceable></literal></term>
235
<listitem>
236
<para>
237
Key length in bits. Default is 1024.
238
</para>
239
</listitem>
240
</varlistentry>
241
242
<varlistentry>
243
<term><literal>-s</literal>, <literal>--subtype
244
<replaceable>type</replaceable></literal></term>
245
<listitem>
246
<para>
247
Subkey type. Default is <quote>ELG-E</quote> (Elgamal
248
encryption-only).
249
</para>
250
</listitem>
251
</varlistentry>
252
253
<varlistentry>
254
<term><literal>-L</literal>, <literal>--sublength
255
<replaceable>bits</replaceable></literal></term>
256
<listitem>
257
<para>
258
Subkey length in bits. Default is 2048.
259
</para>
260
</listitem>
261
</varlistentry>
262
263
<varlistentry>
264
<term><literal>-e</literal>, <literal>--email</literal>
265
<replaceable>address</replaceable></term>
231
232
<varlistentry>
233
<term><option>--dir
234
<replaceable>DIRECTORY</replaceable></option></term>
235
<term><option>-d
236
<replaceable>DIRECTORY</replaceable></option></term>
237
<listitem>
238
<para>
239
Target directory for key files. Default is <filename
240
class="directory">/etc/keys/mandos</filename>.
241
</para>
242
</listitem>
243
</varlistentry>
244
245
<varlistentry>
246
<term><option>--type
247
<replaceable>TYPE</replaceable></option></term>
248
<term><option>-t
249
<replaceable>TYPE</replaceable></option></term>
250
<listitem>
251
<para>
252
OpenPGP key type. Default is <quote>RSA</quote>.
253
</para>
254
</listitem>
255
</varlistentry>
256
257
<varlistentry>
258
<term><option>--length
259
<replaceable>BITS</replaceable></option></term>
260
<term><option>-l
261
<replaceable>BITS</replaceable></option></term>
262
<listitem>
263
<para>
264
OpenPGP key length in bits. Default is 4096.
265
</para>
266
</listitem>
267
</varlistentry>
268
269
<varlistentry>
270
<term><option>--subtype
271
<replaceable>KEYTYPE</replaceable></option></term>
272
<term><option>-s
273
<replaceable>KEYTYPE</replaceable></option></term>
274
<listitem>
275
<para>
276
OpenPGP subkey type. Default is <quote>RSA</quote>
277
</para>
278
</listitem>
279
</varlistentry>
280
281
<varlistentry>
282
<term><option>--sublength
283
<replaceable>BITS</replaceable></option></term>
284
<term><option>-L
285
<replaceable>BITS</replaceable></option></term>
286
<listitem>
287
<para>
288
OpenPGP subkey length in bits. Default is 4096.
289
</para>
290
</listitem>
291
</varlistentry>
292
293
<varlistentry>
294
<term><option>--email
295
<replaceable>ADDRESS</replaceable></option></term>
296
<term><option>-e
297
<replaceable>ADDRESS</replaceable></option></term>
266
298
<listitem>
267
299
<para>
268
300
Email address of key. Default is empty.
269
301
</para>
270
302
</listitem>
271
303
</varlistentry>
272
304
273
305
<varlistentry>
274
<term><literal>-c</literal>, <literal>--comment</literal>
275
<replaceable>comment</replaceable></term>
306
<term><option>--comment
307
<replaceable>TEXT</replaceable></option></term>
308
<term><option>-c
309
<replaceable>TEXT</replaceable></option></term>
276
310
<listitem>
277
311
<para>
278
Comment field for key. The default value is
279
<quote><literal>Mandos client key</literal></quote>.
312
Comment field for key. Default is empty.
280
313
</para>
281
314
</listitem>
282
315
</varlistentry>
283
316
284
317
<varlistentry>
285
<term><literal>-x</literal>, <literal>--expire</literal>
286
<replaceable>time</replaceable></term>
318
<term><option>--expire
319
<replaceable>TIME</replaceable></option></term>
320
<term><option>-x
321
<replaceable>TIME</replaceable></option></term>
287
322
<listitem>
288
323
<para>
289
324
Key expire time. Default is no expiration. See
292
327
</para>
293
328
</listitem>
294
329
</varlistentry>
295
296
<varlistentry>
297
<term><literal>-f</literal>, <literal>--force</literal></term>
298
<listitem>
299
<para>
300
Force overwriting old keys.
330
331
<varlistentry>
332
<term><option>--tls-keytype
333
<replaceable>KEYTYPE</replaceable></option></term>
334
<term><option>-T
335
<replaceable>KEYTYPE</replaceable></option></term>
336
<listitem>
337
<para>
338
TLS key type. Default is <quote>ed25519</quote>
339
</para>
340
</listitem>
341
</varlistentry>
342
343
<varlistentry>
344
<term><option>--force</option></term>
345
<term><option>-f</option></term>
346
<listitem>
347
<para>
348
Force overwriting old key.
349
</para>
350
</listitem>
351
</varlistentry>
352
<varlistentry>
353
<term><option>--password</option></term>
354
<term><option>-p</option></term>
355
<listitem>
356
<para>
357
Prompt for a password and encrypt it with the key already
358
present in either <filename>/etc/keys/mandos</filename> or
359
the directory specified with the <option>--dir</option>
360
option. Outputs, on standard output, a section suitable
361
for inclusion in <citerefentry><refentrytitle
362
>mandos-clients.conf</refentrytitle><manvolnum
363
>8</manvolnum></citerefentry>. The host name or the name
364
specified with the <option>--name</option> option is used
365
for the section header. All other options are ignored,
366
and no key is created. Note: white space is stripped from
367
the beginning and from the end of the password; See <xref
368
linkend="bugs"/>.
369
</para>
370
</listitem>
371
</varlistentry>
372
<varlistentry>
373
<term><option>--passfile
374
<replaceable>FILE</replaceable></option></term>
375
<term><option>-F
376
<replaceable>FILE</replaceable></option></term>
377
<listitem>
378
<para>
379
The same as <option>--password</option>, but read from
380
<replaceable>FILE</replaceable>, not the terminal, and
381
white space is not stripped from the password in any way.
382
</para>
383
</listitem>
384
</varlistentry>
385
<varlistentry>
386
<term><option>--no-ssh</option></term>
387
<term><option>-S</option></term>
388
<listitem>
389
<para>
390
When <option>--password</option> or
391
<option>--passfile</option> is given, this option will
392
prevent <command>&COMMANDNAME;</command> from calling
393
<command>ssh-keyscan</command> to get an SSH fingerprint
394
for this host and, if successful, output suitable config
395
options to use this fingerprint as a
396
<option>checker</option> option in the output. This is
397
otherwise the default behavior.
301
398
</para>
302
399
</listitem>
303
400
</varlistentry>
304
401
</variablelist>
305
402
</refsect1>
306
403
307
404
<refsect1 id="overview">
308
405
<title>OVERVIEW</title>
309
406
<xi:include href="overview.xml"/>
310
407
<para>
311
This program is a small utility to generate new OpenPGP keys for
312
new Mandos clients.
408
This program is a small utility to generate new TLS and OpenPGP
409
keys for new Mandos clients, and to generate sections for
410
inclusion in <filename>clients.conf</filename> on the server.
313
411
</para>
314
412
</refsect1>
315
413
316
414
<refsect1 id="exit_status">
317
415
<title>EXIT STATUS</title>
318
416
<para>
319
The exit status will be 0 if new keys were successfully created,
320
otherwise not.
417
The exit status will be 0 if a new key (or password, if the
418
<option>--password</option> option was used) was successfully
419
created, otherwise not.
321
420
</para>
322
421
</refsect1>
323
422
325
424
<title>ENVIRONMENT</title>
326
425
<variablelist>
327
426
<varlistentry>
328
<term><varname>TMPDIR</varname></term>
427
<term><envar>TMPDIR</envar></term>
329
428
<listitem>
330
429
<para>
331
430
If set, temporary files will be created here. See
337
436
</variablelist>
338
437
</refsect1>
339
438
340
<refsect1 id="file">
439
<refsect1 id="files">
341
440
<title>FILES</title>
342
441
<para>
343
442
Use the <option>--dir</option> option to change where
346
445
</para>
347
446
<variablelist>
348
447
<varlistentry>
349
<term><filename>/etc/mandos/seckey.txt</filename></term>
448
<term><filename>/etc/keys/mandos/seckey.txt</filename></term>
350
449
<listitem>
351
450
<para>
352
451
OpenPGP secret key file which will be created or
355
454
</listitem>
356
455
</varlistentry>
357
456
<varlistentry>
358
<term><filename>/etc/mandos/pubkey.txt</filename></term>
457
<term><filename>/etc/keys/mandos/pubkey.txt</filename></term>
359
458
<listitem>
360
459
<para>
361
460
OpenPGP public key file which will be created or
364
463
</listitem>
365
464
</varlistentry>
366
465
<varlistentry>
367
<term><filename>/tmp</filename></term>
466
<term><filename>/etc/keys/mandos/tls-privkey.pem</filename></term>
467
<listitem>
468
<para>
469
Private key file which will be created or overwritten.
470
</para>
471
</listitem>
472
</varlistentry>
473
<varlistentry>
474
<term><filename>/etc/keys/mandos/tls-pubkey.pem</filename></term>
475
<listitem>
476
<para>
477
Public key file which will be created or overwritten.
478
</para>
479
</listitem>
480
</varlistentry>
481
<varlistentry>
482
<term><filename class="directory">/tmp</filename></term>
368
483
<listitem>
369
484
<para>
370
485
Temporary files will be written here if
374
489
</varlistentry>
375
490
</variablelist>
376
491
</refsect1>
377
492
378
493
<refsect1 id="bugs">
379
494
<title>BUGS</title>
380
495
<para>
381
None are known at this time.
496
The <option>--password</option>/<option>-p</option> option
497
strips white space from the start and from the end of the
498
password before using it. If this is a problem, use the
499
<option>--passfile</option> option instead, which does not do
500
this.
382
501
</para>
502
<xi:include href="bugs.xml"/>
383
503
</refsect1>
384
504
385
505
<refsect1 id="example">
386
506
<title>EXAMPLE</title>
387
507
<informalexample>
389
509
Normal invocation needs no options:
390
510
</para>
391
511
<para>
392
<userinput>mandos-keygen</userinput>
512
<userinput>&COMMANDNAME;</userinput>
393
513
</para>
394
514
</informalexample>
395
515
<informalexample>
396
516
<para>
397
Create keys in another directory and of another type. Force
517
Create key in another directory and of another type. Force
398
518
overwriting old key files:
399
519
</para>
400
520
<para>
401
521
402
522
<!-- do not wrap this line -->
403
<userinput>mandos-keygen --dir ~/keydir --type RSA --force</userinput>
523
<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>
524
525
</para>
526
</informalexample>
527
<informalexample>
528
<para>
529
Prompt for a password, encrypt it with the keys in <filename
530
class="directory">/etc/keys/mandos</filename> and output a
531
section suitable for <filename>clients.conf</filename>.
532
</para>
533
<para>
534
<userinput>&COMMANDNAME; --password</userinput>
535
</para>
536
</informalexample>
537
<informalexample>
538
<para>
539
Prompt for a password, encrypt it with the keys in the
540
<filename>client-key</filename> directory and output a section
541
suitable for <filename>clients.conf</filename>.
542
</para>
543
<para>
544
545
<!-- do not wrap this line -->
546
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
404
547
405
548
</para>
406
549
</informalexample>
407
550
</refsect1>
408
551
409
552
<refsect1 id="security">
410
553
<title>SECURITY</title>
411
554
<para>
412
555
The <option>--type</option>, <option>--length</option>,
413
556
<option>--subtype</option>, and <option>--sublength</option>
414
options can be used to create keys of insufficient security. If
415
in doubt, leave them to the default values.
557
options can be used to create keys of low security. If in
558
doubt, leave them to the default values.
416
559
</para>
417
560
<para>
418
The key expire time is not guaranteed to be honored by
419
<citerefentry><refentrytitle>mandos</refentrytitle>
561
The key expire time is <emphasis>not</emphasis> guaranteed to be
562
honored by <citerefentry><refentrytitle>mandos</refentrytitle>
420
563
<manvolnum>8</manvolnum></citerefentry>.
421
564
</para>
422
565
</refsect1>
423
566
424
567
<refsect1 id="see_also">
425
568
<title>SEE ALSO</title>
426
569
<para>
427
<citerefentry><refentrytitle>password-request</refentrytitle>
570
<citerefentry><refentrytitle>intro</refentrytitle>
428
571
<manvolnum>8mandos</manvolnum></citerefentry>,
572
<citerefentry><refentrytitle>gpg</refentrytitle>
573
<manvolnum>1</manvolnum></citerefentry>,
574
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
575
<manvolnum>5</manvolnum></citerefentry>,
429
576
<citerefentry><refentrytitle>mandos</refentrytitle>
430
577
<manvolnum>8</manvolnum></citerefentry>,
431
<citerefentry><refentrytitle>gpg</refentrytitle>
578
<citerefentry><refentrytitle>mandos-client</refentrytitle>
579
<manvolnum>8mandos</manvolnum></citerefentry>,
580
<citerefentry><refentrytitle>ssh-keyscan</refentrytitle>
432
581
<manvolnum>1</manvolnum></citerefentry>
433
582
</para>
434
583
</refsect1>
435
584
436
585
</refentry>
586
<!-- Local Variables: -->
587
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
588
<!-- time-stamp-end: "[\"']>" -->
589
<!-- time-stamp-format: "%:y-%02m-%02d" -->
590
<!-- End: -->
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0