/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-keygen.xml

  • Committer: Teddy Hogeborn
  • Date: 2008-08-31 13:55:04 UTC
  • Revision ID: teddy@fukt.bsnet.se-20080831135504-2ka1cccglsghslxy
* plugin-runner.xml (/refentry/refentryinfo/copyright): Split
                                                        copyright
                                                        holders.
* plugins.d/password-request.xml (/refentry/refentryinfo/copyright):
                                 Split copyright holders.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-keygen.xml
1
 
<?xml version='1.0' encoding='UTF-8'?>
 
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY VERSION "1.0">
5
5
<!ENTITY COMMANDNAME "mandos-keygen">
6
 
<!ENTITY OVERVIEW SYSTEM "overview.xml">
 
6
<!ENTITY TIMESTAMP "2008-08-31">
7
7
]>
8
8
 
9
 
<refentry>
 
9
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
10
10
  <refentryinfo>
11
 
    <title>&COMMANDNAME;</title>
12
 
    <!-- NWalsh's docbook scripts use this to generate the footer: -->
13
 
    <productname>&COMMANDNAME;</productname>
 
11
    <title>Mandos Manual</title>
 
12
    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
 
13
    <productname>Mandos</productname>
14
14
    <productnumber>&VERSION;</productnumber>
 
15
    <date>&TIMESTAMP;</date>
15
16
    <authorgroup>
16
17
      <author>
17
18
        <firstname>Björn</firstname>
30
31
    </authorgroup>
31
32
    <copyright>
32
33
      <year>2008</year>
33
 
      <holder>Teddy Hogeborn &amp; Björn Påhlsson</holder>
 
34
      <holder>Teddy Hogeborn</holder>
 
35
      <holder>Björn Påhlsson</holder>
34
36
    </copyright>
35
37
    <legalnotice>
36
38
      <para>
65
67
  <refnamediv>
66
68
    <refname><command>&COMMANDNAME;</command></refname>
67
69
    <refpurpose>
68
 
      Generate keys for <citerefentry><refentrytitle>password-request
69
 
      </refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
 
70
      Generate key and password for Mandos client and server.
70
71
    </refpurpose>
71
72
  </refnamediv>
72
73
 
73
74
  <refsynopsisdiv>
74
75
    <cmdsynopsis>
75
76
      <command>&COMMANDNAME;</command>
76
 
      <group choice="opt">
77
 
        <arg choice="plain"><option>--dir</option>
78
 
        <replaceable>directory</replaceable></arg>
79
 
      </group>
80
 
      <group choice="opt">
81
 
        <arg choice="plain"><option>--type</option>
82
 
        <replaceable>type</replaceable></arg>
83
 
      </group>
84
 
      <group choice="opt">
85
 
        <arg choice="plain"><option>--length</option>
86
 
        <replaceable>bits</replaceable></arg>
87
 
      </group>
88
 
      <group choice="opt">
89
 
        <arg choice="plain"><option>--name</option>
90
 
        <replaceable>NAME</replaceable></arg>
91
 
      </group>
92
 
      <group choice="opt">
93
 
        <arg choice="plain"><option>--email</option>
94
 
        <replaceable>EMAIL</replaceable></arg>
95
 
      </group>
96
 
      <group choice="opt">
97
 
        <arg choice="plain"><option>--comment</option>
98
 
        <replaceable>COMMENT</replaceable></arg>
99
 
      </group>
100
 
      <group choice="opt">
101
 
        <arg choice="plain"><option>--expire</option>
102
 
        <replaceable>TIME</replaceable></arg>
103
 
      </group>
104
 
      <group choice="opt">
105
 
        <arg choice="plain"><option>--force</option></arg>
106
 
      </group>
107
 
    </cmdsynopsis>
108
 
    <cmdsynopsis>
109
 
      <command>&COMMANDNAME;</command>
110
 
      <group choice="opt">
111
 
        <arg choice="plain"><option>-d</option>
112
 
        <replaceable>directory</replaceable></arg>
113
 
      </group>
114
 
      <group choice="opt">
115
 
        <arg choice="plain"><option>-t</option>
116
 
        <replaceable>type</replaceable></arg>
117
 
      </group>
118
 
      <group choice="opt">
119
 
        <arg choice="plain"><option>-l</option>
120
 
        <replaceable>bits</replaceable></arg>
121
 
      </group>
122
 
      <group choice="opt">
123
 
        <arg choice="plain"><option>-n</option>
124
 
        <replaceable>NAME</replaceable></arg>
125
 
      </group>
126
 
      <group choice="opt">
127
 
        <arg choice="plain"><option>-e</option>
128
 
        <replaceable>EMAIL</replaceable></arg>
129
 
      </group>
130
 
      <group choice="opt">
131
 
        <arg choice="plain"><option>-c</option>
132
 
        <replaceable>COMMENT</replaceable></arg>
133
 
      </group>
134
 
      <group choice="opt">
135
 
        <arg choice="plain"><option>-x</option>
136
 
        <replaceable>TIME</replaceable></arg>
137
 
      </group>
138
 
      <group choice="opt">
139
 
        <arg choice="plain"><option>-f</option></arg>
140
 
      </group>
141
 
    </cmdsynopsis>
142
 
    <cmdsynopsis>
143
 
      <command>&COMMANDNAME;</command>
144
 
      <group choice="req">
145
 
        <arg choice='plain'><option>-h</option></arg>
146
 
        <arg choice='plain'><option>--help</option></arg>
147
 
      </group>
148
 
    </cmdsynopsis>
149
 
    <cmdsynopsis>
150
 
      <command>&COMMANDNAME;</command>
151
 
      <group choice="req">
152
 
        <arg choice='plain'><option>-v</option></arg>
153
 
        <arg choice='plain'><option>--version</option></arg>
 
77
      <group>
 
78
        <arg choice="plain"><option>--dir
 
79
        <replaceable>DIRECTORY</replaceable></option></arg>
 
80
        <arg choice="plain"><option>-d
 
81
        <replaceable>DIRECTORY</replaceable></option></arg>
 
82
      </group>
 
83
      <sbr/>
 
84
      <group>
 
85
        <arg choice="plain"><option>--type
 
86
        <replaceable>KEYTYPE</replaceable></option></arg>
 
87
        <arg choice="plain"><option>-t
 
88
        <replaceable>KEYTYPE</replaceable></option></arg>
 
89
      </group>
 
90
      <sbr/>
 
91
      <group>
 
92
        <arg choice="plain"><option>--length
 
93
        <replaceable>BITS</replaceable></option></arg>
 
94
        <arg choice="plain"><option>-l
 
95
        <replaceable>BITS</replaceable></option></arg>
 
96
      </group>
 
97
      <sbr/>
 
98
      <group>
 
99
        <arg choice="plain"><option>--subtype
 
100
        <replaceable>KEYTYPE</replaceable></option></arg>
 
101
        <arg choice="plain"><option>-s
 
102
        <replaceable>KEYTYPE</replaceable></option></arg>
 
103
      </group>
 
104
      <sbr/>
 
105
      <group>
 
106
        <arg choice="plain"><option>--sublength
 
107
        <replaceable>BITS</replaceable></option></arg>
 
108
        <arg choice="plain"><option>-L
 
109
        <replaceable>BITS</replaceable></option></arg>
 
110
      </group>
 
111
      <sbr/>
 
112
      <group>
 
113
        <arg choice="plain"><option>--name
 
114
        <replaceable>NAME</replaceable></option></arg>
 
115
        <arg choice="plain"><option>-n
 
116
        <replaceable>NAME</replaceable></option></arg>
 
117
      </group>
 
118
      <sbr/>
 
119
      <group>
 
120
        <arg choice="plain"><option>--email
 
121
        <replaceable>ADDRESS</replaceable></option></arg>
 
122
        <arg choice="plain"><option>-e
 
123
        <replaceable>ADDRESS</replaceable></option></arg>
 
124
      </group>
 
125
      <sbr/>
 
126
      <group>
 
127
        <arg choice="plain"><option>--comment
 
128
        <replaceable>TEXT</replaceable></option></arg>
 
129
        <arg choice="plain"><option>-c
 
130
        <replaceable>TEXT</replaceable></option></arg>
 
131
      </group>
 
132
      <sbr/>
 
133
      <group>
 
134
        <arg choice="plain"><option>--expire
 
135
        <replaceable>TIME</replaceable></option></arg>
 
136
        <arg choice="plain"><option>-x
 
137
        <replaceable>TIME</replaceable></option></arg>
 
138
      </group>
 
139
      <sbr/>
 
140
      <arg><option>--force</option></arg>
 
141
    </cmdsynopsis>
 
142
    <cmdsynopsis>
 
143
      <command>&COMMANDNAME;</command>
 
144
      <group choice="req">
 
145
        <arg choice="plain"><option>--password</option></arg>
 
146
        <arg choice="plain"><option>-p</option></arg>
 
147
      </group>
 
148
      <sbr/>
 
149
      <group>
 
150
        <arg choice="plain"><option>--dir
 
151
        <replaceable>DIRECTORY</replaceable></option></arg>
 
152
        <arg choice="plain"><option>-d
 
153
        <replaceable>DIRECTORY</replaceable></option></arg>
 
154
      </group>
 
155
      <sbr/>
 
156
      <group>
 
157
        <arg choice="plain"><option>--name
 
158
        <replaceable>NAME</replaceable></option></arg>
 
159
        <arg choice="plain"><option>-n
 
160
        <replaceable>NAME</replaceable></option></arg>
 
161
      </group>
 
162
    </cmdsynopsis>
 
163
    <cmdsynopsis>
 
164
      <command>&COMMANDNAME;</command>
 
165
      <group choice="req">
 
166
        <arg choice="plain"><option>--help</option></arg>
 
167
        <arg choice="plain"><option>-h</option></arg>
 
168
      </group>
 
169
    </cmdsynopsis>
 
170
    <cmdsynopsis>
 
171
      <command>&COMMANDNAME;</command>
 
172
      <group choice="req">
 
173
        <arg choice="plain"><option>--version</option></arg>
 
174
        <arg choice="plain"><option>-v</option></arg>
154
175
      </group>
155
176
    </cmdsynopsis>
156
177
  </refsynopsisdiv>
157
 
 
 
178
  
158
179
  <refsect1 id="description">
159
180
    <title>DESCRIPTION</title>
160
181
    <para>
161
182
      <command>&COMMANDNAME;</command> is a program to generate the
162
 
      OpenPGP keys used by
 
183
      OpenPGP key used by
163
184
      <citerefentry><refentrytitle>password-request</refentrytitle>
164
 
      <manvolnum>8mandos</manvolnum></citerefentry>.  The keys are
 
185
      <manvolnum>8mandos</manvolnum></citerefentry>.  The key is
165
186
      normally written to /etc/mandos for later installation into the
166
 
      initrd image, but this, like most things, can be changed with
167
 
      command line options.
 
187
      initrd image, but this, and most other things, can be changed
 
188
      with command line options.
 
189
    </para>
 
190
    <para>
 
191
      This program can also be used with the
 
192
      <option>--password</option> option to generate a ready-made
 
193
      section for <filename>clients.conf</filename> (see
 
194
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
 
195
      <manvolnum>5</manvolnum></citerefentry>).
168
196
    </para>
169
197
  </refsect1>
170
198
  
171
199
  <refsect1 id="purpose">
172
200
    <title>PURPOSE</title>
173
 
 
174
201
    <para>
175
202
      The purpose of this is to enable <emphasis>remote and unattended
176
203
      rebooting</emphasis> of client host computer with an
177
204
      <emphasis>encrypted root file system</emphasis>.  See <xref
178
205
      linkend="overview"/> for details.
179
206
    </para>
180
 
 
181
207
  </refsect1>
182
208
  
183
209
  <refsect1 id="options">
184
210
    <title>OPTIONS</title>
185
 
 
 
211
    
186
212
    <variablelist>
187
213
      <varlistentry>
188
 
        <term><literal>-h</literal>, <literal>--help</literal></term>
 
214
        <term><option>--help</option></term>
 
215
        <term><option>-h</option></term>
189
216
        <listitem>
190
217
          <para>
191
218
            Show a help message and exit
194
221
      </varlistentry>
195
222
 
196
223
      <varlistentry>
197
 
        <term><literal>-d</literal>, <literal>--dir
198
 
        <replaceable>directory</replaceable></literal></term>
199
 
        <listitem>
200
 
          <para>
201
 
            Target directory for key files.
202
 
          </para>
203
 
        </listitem>
204
 
      </varlistentry>
205
 
 
206
 
      <varlistentry>
207
 
        <term><literal>-t</literal>, <literal>--type
208
 
        <replaceable>type</replaceable></literal></term>
209
 
        <listitem>
210
 
          <para>
211
 
            Key type.  Default is DSA.
212
 
          </para>
213
 
        </listitem>
214
 
      </varlistentry>
215
 
 
216
 
      <varlistentry>
217
 
        <term><literal>-l</literal>, <literal>--length
218
 
        <replaceable>bits</replaceable></literal></term>
219
 
        <listitem>
220
 
          <para>
221
 
            Key length in bits.  Default is 1024.
222
 
          </para>
223
 
        </listitem>
224
 
      </varlistentry>
225
 
 
226
 
      <varlistentry>
227
 
        <term><literal>-e</literal>, <literal>--email</literal>
228
 
        <replaceable>address</replaceable></term>
 
224
        <term><option>--dir
 
225
        <replaceable>DIRECTORY</replaceable></option></term>
 
226
        <term><option>-d
 
227
        <replaceable>DIRECTORY</replaceable></option></term>
 
228
        <listitem>
 
229
          <para>
 
230
            Target directory for key files.  Default is
 
231
            <filename>/etc/mandos</filename>.
 
232
          </para>
 
233
        </listitem>
 
234
      </varlistentry>
 
235
 
 
236
      <varlistentry>
 
237
        <term><option>--type
 
238
        <replaceable>TYPE</replaceable></option></term>
 
239
        <term><option>-t
 
240
        <replaceable>TYPE</replaceable></option></term>
 
241
        <listitem>
 
242
          <para>
 
243
            Key type.  Default is <quote>DSA</quote>.
 
244
          </para>
 
245
        </listitem>
 
246
      </varlistentry>
 
247
 
 
248
      <varlistentry>
 
249
        <term><option>--length
 
250
        <replaceable>BITS</replaceable></option></term>
 
251
        <term><option>-l
 
252
        <replaceable>BITS</replaceable></option></term>
 
253
        <listitem>
 
254
          <para>
 
255
            Key length in bits.  Default is 2048.
 
256
          </para>
 
257
        </listitem>
 
258
      </varlistentry>
 
259
 
 
260
      <varlistentry>
 
261
        <term><option>--subtype
 
262
        <replaceable>KEYTYPE</replaceable></option></term>
 
263
        <term><option>-s
 
264
        <replaceable>KEYTYPE</replaceable></option></term>
 
265
        <listitem>
 
266
          <para>
 
267
            Subkey type.  Default is <quote>ELG-E</quote> (Elgamal
 
268
            encryption-only).
 
269
          </para>
 
270
        </listitem>
 
271
      </varlistentry>
 
272
 
 
273
      <varlistentry>
 
274
        <term><option>--sublength
 
275
        <replaceable>BITS</replaceable></option></term>
 
276
        <term><option>-L
 
277
        <replaceable>BITS</replaceable></option></term>
 
278
        <listitem>
 
279
          <para>
 
280
            Subkey length in bits.  Default is 2048.
 
281
          </para>
 
282
        </listitem>
 
283
      </varlistentry>
 
284
 
 
285
      <varlistentry>
 
286
        <term><option>--email
 
287
        <replaceable>ADDRESS</replaceable></option></term>
 
288
        <term><option>-e
 
289
        <replaceable>ADDRESS</replaceable></option></term>
229
290
        <listitem>
230
291
          <para>
231
292
            Email address of key.  Default is empty.
234
295
      </varlistentry>
235
296
 
236
297
      <varlistentry>
237
 
        <term><literal>-c</literal>, <literal>--comment</literal>
238
 
        <replaceable>comment</replaceable></term>
 
298
        <term><option>--comment
 
299
        <replaceable>TEXT</replaceable></option></term>
 
300
        <term><option>-c
 
301
        <replaceable>TEXT</replaceable></option></term>
239
302
        <listitem>
240
303
          <para>
241
304
            Comment field for key.  The default value is
242
 
            "<literal>Mandos client key</literal>".
 
305
            <quote><literal>Mandos client key</literal></quote>.
243
306
          </para>
244
307
        </listitem>
245
308
      </varlistentry>
246
309
 
247
310
      <varlistentry>
248
 
        <term><literal>-x</literal>, <literal>--expire</literal>
249
 
        <replaceable>time</replaceable></term>
 
311
        <term><option>--expire
 
312
        <replaceable>TIME</replaceable></option></term>
 
313
        <term><option>-x
 
314
        <replaceable>TIME</replaceable></option></term>
250
315
        <listitem>
251
316
          <para>
252
317
            Key expire time.  Default is no expiration.  See
257
322
      </varlistentry>
258
323
 
259
324
      <varlistentry>
260
 
        <term><literal>-f</literal>, <literal>--force</literal></term>
261
 
        <listitem>
262
 
          <para>
263
 
            Force overwriting old keys.
 
325
        <term><option>--force</option></term>
 
326
        <term><option>-f</option></term>
 
327
        <listitem>
 
328
          <para>
 
329
            Force overwriting old key.
 
330
          </para>
 
331
        </listitem>
 
332
      </varlistentry>
 
333
      <varlistentry>
 
334
        <term><option>--password</option></term>
 
335
        <term><option>-p</option></term>
 
336
        <listitem>
 
337
          <para>
 
338
            Prompt for a password and encrypt it with the key already
 
339
            present in either <filename>/etc/mandos</filename> or the
 
340
            directory specified with the <option>--dir</option>
 
341
            option.  Outputs, on standard output, a section suitable
 
342
            for inclusion in <citerefentry><refentrytitle
 
343
            >mandos-clients.conf</refentrytitle><manvolnum
 
344
            >8</manvolnum></citerefentry>.  The host name or the name
 
345
            specified with the <option>--name</option> option is used
 
346
            for the section header.  All other options are ignored,
 
347
            and no key is created.
264
348
          </para>
265
349
        </listitem>
266
350
      </varlistentry>
269
353
 
270
354
  <refsect1 id="overview">
271
355
    <title>OVERVIEW</title>
272
 
    &OVERVIEW;
 
356
    <xi:include href="overview.xml"/>
273
357
    <para>
274
 
      This program is a small program to generate new OpenPGP keys for
275
 
      new Mandos clients.
 
358
      This program is a small utility to generate new OpenPGP keys for
 
359
      new Mandos clients, and to generate sections for inclusion in
 
360
      <filename>clients.conf</filename> on the server.
276
361
    </para>
277
362
  </refsect1>
278
363
 
279
364
  <refsect1 id="exit_status">
280
365
    <title>EXIT STATUS</title>
281
366
    <para>
282
 
      The exit status will be 0 if new keys were successfully created,
283
 
      otherwise not.
 
367
      The exit status will be 0 if a new key (or password, if the
 
368
      <option>--password</option> option was used) was successfully
 
369
      created, otherwise not.
284
370
    </para>
285
371
  </refsect1>
286
372
  
288
374
    <title>ENVIRONMENT</title>
289
375
    <variablelist>
290
376
      <varlistentry>
291
 
        <term><varname>TMPDIR</varname></term>
 
377
        <term><envar>TMPDIR</envar></term>
292
378
        <listitem>
293
379
          <para>
294
380
            If set, temporary files will be created here. See
352
438
        Normal invocation needs no options:
353
439
      </para>
354
440
      <para>
355
 
        <userinput>mandos-keygen</userinput>
 
441
        <userinput>&COMMANDNAME;</userinput>
356
442
      </para>
357
443
    </informalexample>
358
444
    <informalexample>
359
445
      <para>
360
 
        Create keys in another directory and of another type.  Force
 
446
        Create key in another directory and of another type.  Force
361
447
        overwriting old key files:
362
448
      </para>
363
449
      <para>
364
450
 
365
451
<!-- do not wrap this line -->
366
 
<userinput>mandos-keygen --dir ~/keydir --type RSA --force</userinput>
 
452
<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>
 
453
 
 
454
      </para>
 
455
    </informalexample>
 
456
    <informalexample>
 
457
      <para>
 
458
        Prompt for a password, encrypt it with the key in
 
459
        <filename>/etc/mandos</filename> and output a section suitable
 
460
        for <filename>clients.conf</filename>.
 
461
      </para>
 
462
      <para>
 
463
        <userinput>&COMMANDNAME; --password</userinput>
 
464
      </para>
 
465
    </informalexample>
 
466
    <informalexample>
 
467
      <para>
 
468
        Prompt for a password, encrypt it with the key in the
 
469
        <filename>client-key</filename> directory and output a section
 
470
        suitable for <filename>clients.conf</filename>.
 
471
      </para>
 
472
      <para>
 
473
 
 
474
<!-- do not wrap this line -->
 
475
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
367
476
 
368
477
      </para>
369
478
    </informalexample>
372
481
  <refsect1 id="security">
373
482
    <title>SECURITY</title>
374
483
    <para>
375
 
      The <option>--type</option> and <option>--length</option>
376
 
      options can be used to create keys of insufficient security.  If
377
 
      in doubt, leave them to the default values.
 
484
      The <option>--type</option>, <option>--length</option>,
 
485
      <option>--subtype</option>, and <option>--sublength</option>
 
486
      options can be used to create keys of low security.  If in
 
487
      doubt, leave them to the default values.
378
488
    </para>
379
489
    <para>
380
 
      The key expire time is not guaranteed to be honored by
381
 
      <citerefentry><refentrytitle>mandos</refentrytitle>
 
490
      The key expire time is <emphasis>not</emphasis> guaranteed to be
 
491
      honored by <citerefentry><refentrytitle>mandos</refentrytitle>
382
492
      <manvolnum>8</manvolnum></citerefentry>.
383
493
    </para>
384
494
  </refsect1>
386
496
  <refsect1 id="see_also">
387
497
    <title>SEE ALSO</title>
388
498
    <para>
389
 
      <citerefentry><refentrytitle>password-request</refentrytitle>
390
 
      <manvolnum>8mandos</manvolnum></citerefentry>,
391
 
      <citerefentry><refentrytitle>mandos</refentrytitle>
392
 
      <manvolnum>8</manvolnum></citerefentry>, and
393
499
      <citerefentry><refentrytitle>gpg</refentrytitle>
394
 
      <manvolnum>1</manvolnum></citerefentry>
 
500
      <manvolnum>1</manvolnum></citerefentry>,
 
501
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
 
502
      <manvolnum>5</manvolnum></citerefentry>,
 
503
      <citerefentry><refentrytitle>mandos</refentrytitle>
 
504
      <manvolnum>8</manvolnum></citerefentry>,
 
505
      <citerefentry><refentrytitle>password-request</refentrytitle>
 
506
      <manvolnum>8mandos</manvolnum></citerefentry>
395
507
    </para>
396
508
  </refsect1>
397
509
  
398
510
</refentry>
 
511
<!-- Local Variables: -->
 
512
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
 
513
<!-- time-stamp-end: "[\"']>" -->
 
514
<!-- time-stamp-format: "%:y-%02m-%02d" -->
 
515
<!-- End: -->