66
68
<refname><command>&COMMANDNAME;</command></refname>
68
Generate keys for <citerefentry><refentrytitle>password-request
69
</refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
70
Generate key and password for Mandos client and server.
75
76
<command>&COMMANDNAME;</command>
77
<arg choice="plain"><option>--dir</option>
78
<replaceable>directory</replaceable></arg>
81
<arg choice="plain"><option>--type</option>
82
<replaceable>type</replaceable></arg>
85
<arg choice="plain"><option>--length</option>
86
<replaceable>bits</replaceable></arg>
89
<arg choice="plain"><option>--name</option>
90
<replaceable>NAME</replaceable></arg>
93
<arg choice="plain"><option>--email</option>
94
<replaceable>EMAIL</replaceable></arg>
97
<arg choice="plain"><option>--comment</option>
98
<replaceable>COMMENT</replaceable></arg>
101
<arg choice="plain"><option>--expire</option>
102
<replaceable>TIME</replaceable></arg>
105
<arg choice="plain"><option>--force</option></arg>
109
<command>&COMMANDNAME;</command>
111
<arg choice="plain"><option>-d</option>
112
<replaceable>directory</replaceable></arg>
115
<arg choice="plain"><option>-t</option>
116
<replaceable>type</replaceable></arg>
119
<arg choice="plain"><option>-l</option>
120
<replaceable>bits</replaceable></arg>
123
<arg choice="plain"><option>-n</option>
124
<replaceable>NAME</replaceable></arg>
127
<arg choice="plain"><option>-e</option>
128
<replaceable>EMAIL</replaceable></arg>
131
<arg choice="plain"><option>-c</option>
132
<replaceable>COMMENT</replaceable></arg>
135
<arg choice="plain"><option>-x</option>
136
<replaceable>TIME</replaceable></arg>
139
<arg choice="plain"><option>-f</option></arg>
143
<command>&COMMANDNAME;</command>
145
<arg choice='plain'><option>-h</option></arg>
146
<arg choice='plain'><option>--help</option></arg>
150
<command>&COMMANDNAME;</command>
152
<arg choice='plain'><option>-v</option></arg>
153
<arg choice='plain'><option>--version</option></arg>
78
<arg choice="plain"><option>--dir
79
<replaceable>DIRECTORY</replaceable></option></arg>
80
<arg choice="plain"><option>-d
81
<replaceable>DIRECTORY</replaceable></option></arg>
85
<arg choice="plain"><option>--type
86
<replaceable>KEYTYPE</replaceable></option></arg>
87
<arg choice="plain"><option>-t
88
<replaceable>KEYTYPE</replaceable></option></arg>
92
<arg choice="plain"><option>--length
93
<replaceable>BITS</replaceable></option></arg>
94
<arg choice="plain"><option>-l
95
<replaceable>BITS</replaceable></option></arg>
99
<arg choice="plain"><option>--subtype
100
<replaceable>KEYTYPE</replaceable></option></arg>
101
<arg choice="plain"><option>-s
102
<replaceable>KEYTYPE</replaceable></option></arg>
106
<arg choice="plain"><option>--sublength
107
<replaceable>BITS</replaceable></option></arg>
108
<arg choice="plain"><option>-L
109
<replaceable>BITS</replaceable></option></arg>
113
<arg choice="plain"><option>--name
114
<replaceable>NAME</replaceable></option></arg>
115
<arg choice="plain"><option>-n
116
<replaceable>NAME</replaceable></option></arg>
120
<arg choice="plain"><option>--email
121
<replaceable>ADDRESS</replaceable></option></arg>
122
<arg choice="plain"><option>-e
123
<replaceable>ADDRESS</replaceable></option></arg>
127
<arg choice="plain"><option>--comment
128
<replaceable>TEXT</replaceable></option></arg>
129
<arg choice="plain"><option>-c
130
<replaceable>TEXT</replaceable></option></arg>
134
<arg choice="plain"><option>--expire
135
<replaceable>TIME</replaceable></option></arg>
136
<arg choice="plain"><option>-x
137
<replaceable>TIME</replaceable></option></arg>
140
<arg><option>--force</option></arg>
143
<command>&COMMANDNAME;</command>
145
<arg choice="plain"><option>--password</option></arg>
146
<arg choice="plain"><option>-p</option></arg>
150
<arg choice="plain"><option>--dir
151
<replaceable>DIRECTORY</replaceable></option></arg>
152
<arg choice="plain"><option>-d
153
<replaceable>DIRECTORY</replaceable></option></arg>
157
<arg choice="plain"><option>--name
158
<replaceable>NAME</replaceable></option></arg>
159
<arg choice="plain"><option>-n
160
<replaceable>NAME</replaceable></option></arg>
164
<command>&COMMANDNAME;</command>
166
<arg choice="plain"><option>--help</option></arg>
167
<arg choice="plain"><option>-h</option></arg>
171
<command>&COMMANDNAME;</command>
173
<arg choice="plain"><option>--version</option></arg>
174
<arg choice="plain"><option>-v</option></arg>
156
177
</refsynopsisdiv>
158
179
<refsect1 id="description">
159
180
<title>DESCRIPTION</title>
161
182
<command>&COMMANDNAME;</command> is a program to generate the
163
184
<citerefentry><refentrytitle>password-request</refentrytitle>
164
<manvolnum>8mandos</manvolnum></citerefentry>. The keys are
185
<manvolnum>8mandos</manvolnum></citerefentry>. The key is
165
186
normally written to /etc/mandos for later installation into the
166
initrd image, but this, like most things, can be changed with
167
command line options.
187
initrd image, but this, and most other things, can be changed
188
with command line options.
191
This program can also be used with the
192
<option>--password</option> option to generate a ready-made
193
section for <filename>clients.conf</filename> (see
194
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
195
<manvolnum>5</manvolnum></citerefentry>).
171
199
<refsect1 id="purpose">
172
200
<title>PURPOSE</title>
175
202
The purpose of this is to enable <emphasis>remote and unattended
176
203
rebooting</emphasis> of client host computer with an
177
204
<emphasis>encrypted root file system</emphasis>. See <xref
178
205
linkend="overview"/> for details.
183
209
<refsect1 id="options">
184
210
<title>OPTIONS</title>
188
<term><literal>-h</literal>, <literal>--help</literal></term>
214
<term><option>--help</option></term>
215
<term><option>-h</option></term>
191
218
Show a help message and exit
197
<term><literal>-d</literal>, <literal>--dir
198
<replaceable>directory</replaceable></literal></term>
201
Target directory for key files.
207
<term><literal>-t</literal>, <literal>--type
208
<replaceable>type</replaceable></literal></term>
211
Key type. Default is DSA.
217
<term><literal>-l</literal>, <literal>--length
218
<replaceable>bits</replaceable></literal></term>
221
Key length in bits. Default is 1024.
227
<term><literal>-e</literal>, <literal>--email</literal>
228
<replaceable>address</replaceable></term>
225
<replaceable>DIRECTORY</replaceable></option></term>
227
<replaceable>DIRECTORY</replaceable></option></term>
230
Target directory for key files. Default is
231
<filename>/etc/mandos</filename>.
238
<replaceable>TYPE</replaceable></option></term>
240
<replaceable>TYPE</replaceable></option></term>
243
Key type. Default is <quote>DSA</quote>.
249
<term><option>--length
250
<replaceable>BITS</replaceable></option></term>
252
<replaceable>BITS</replaceable></option></term>
255
Key length in bits. Default is 2048.
261
<term><option>--subtype
262
<replaceable>KEYTYPE</replaceable></option></term>
264
<replaceable>KEYTYPE</replaceable></option></term>
267
Subkey type. Default is <quote>ELG-E</quote> (Elgamal
274
<term><option>--sublength
275
<replaceable>BITS</replaceable></option></term>
277
<replaceable>BITS</replaceable></option></term>
280
Subkey length in bits. Default is 2048.
286
<term><option>--email
287
<replaceable>ADDRESS</replaceable></option></term>
289
<replaceable>ADDRESS</replaceable></option></term>
231
292
Email address of key. Default is empty.
270
354
<refsect1 id="overview">
271
355
<title>OVERVIEW</title>
356
<xi:include href="overview.xml"/>
274
This program is a small program to generate new OpenPGP keys for
358
This program is a small utility to generate new OpenPGP keys for
359
new Mandos clients, and to generate sections for inclusion in
360
<filename>clients.conf</filename> on the server.
279
364
<refsect1 id="exit_status">
280
365
<title>EXIT STATUS</title>
367
The exit status will be 0 if a new key (or password, if the
368
<option>--password</option> option was used) was successfully
369
created, otherwise not.
373
<refsect1 id="environment">
374
<title>ENVIRONMENT</title>
377
<term><envar>TMPDIR</envar></term>
380
If set, temporary files will be created here. See
381
<citerefentry><refentrytitle>mktemp</refentrytitle>
382
<manvolnum>1</manvolnum></citerefentry>.
285
389
<refsect1 id="file">
286
390
<title>FILES</title>
392
Use the <option>--dir</option> option to change where
393
<command>&COMMANDNAME;</command> will write the key files. The
394
default file names are shown here.
398
<term><filename>/etc/mandos/seckey.txt</filename></term>
401
OpenPGP secret key file which will be created or
407
<term><filename>/etc/mandos/pubkey.txt</filename></term>
410
OpenPGP public key file which will be created or
416
<term><filename>/tmp</filename></term>
419
Temporary files will be written here if
420
<varname>TMPDIR</varname> is not set.
291
427
<refsect1 id="bugs">
292
428
<title>BUGS</title>
430
None are known at this time.
297
434
<refsect1 id="example">
298
435
<title>EXAMPLE</title>
438
Normal invocation needs no options:
441
<userinput>&COMMANDNAME;</userinput>
446
Create key in another directory and of another type. Force
447
overwriting old key files:
451
<!-- do not wrap this line -->
452
<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>
458
Prompt for a password, encrypt it with the key in
459
<filename>/etc/mandos</filename> and output a section suitable
460
for <filename>clients.conf</filename>.
463
<userinput>&COMMANDNAME; --password</userinput>
468
Prompt for a password, encrypt it with the key in the
469
<filename>client-key</filename> directory and output a section
470
suitable for <filename>clients.conf</filename>.
474
<!-- do not wrap this line -->
475
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
303
481
<refsect1 id="security">
304
482
<title>SECURITY</title>
484
The <option>--type</option>, <option>--length</option>,
485
<option>--subtype</option>, and <option>--sublength</option>
486
options can be used to create keys of low security. If in
487
doubt, leave them to the default values.
490
The key expire time is <emphasis>not</emphasis> guaranteed to be
491
honored by <citerefentry><refentrytitle>mandos</refentrytitle>
492
<manvolnum>8</manvolnum></citerefentry>.
309
496
<refsect1 id="see_also">
310
497
<title>SEE ALSO</title>
312
<citerefentry><refentrytitle>password-request</refentrytitle>
313
<manvolnum>8mandos</manvolnum></citerefentry>,
499
<citerefentry><refentrytitle>gpg</refentrytitle>
500
<manvolnum>1</manvolnum></citerefentry>,
501
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
502
<manvolnum>5</manvolnum></citerefentry>,
314
503
<citerefentry><refentrytitle>mandos</refentrytitle>
315
<manvolnum>8</manvolnum></citerefentry>, and
316
<citerefentry><refentrytitle>gpg</refentrytitle>
317
<manvolnum>1</manvolnum></citerefentry>
504
<manvolnum>8</manvolnum></citerefentry>,
505
<citerefentry><refentrytitle>password-request</refentrytitle>
506
<manvolnum>8mandos</manvolnum></citerefentry>
511
<!-- Local Variables: -->
512
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
513
<!-- time-stamp-end: "[\"']>" -->
514
<!-- time-stamp-format: "%:y-%02m-%02d" -->