To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos-keygen.xml
- browse files at revision 1286
- compare with another revision
- download diff
- download tarball
- view history from revision 1286
- Committer: Teddy Hogeborn
- Date: 2024-09-08 03:27:08 UTC
- Revision ID: teddy@recompile.se-20240908032708-d0mwgln797i3ddat
Use new package name "libgnutls30t64" when available
* debian/control (Package: mandos/Depends): Add "libgnutls30t64" as an
alternative to libgnutls30.
Reported-By: Bastian Germann <Bastian.Germann@gmx.de>
Suggested-by: Bastian Germann <Bastian.Germann@gmx.de>
* debian/control (Package: mandos/Depends): Add "libgnutls30t64" as an
alternative to libgnutls30.
Reported-By: Bastian Germann <Bastian.Germann@gmx.de>
Suggested-by: Bastian Germann <Bastian.Germann@gmx.de>
- files added:
- .bzr-builddeb
- debian
- debian/po
- debian/source
- debian/tests
- debian/upstream
- dracut-module
- network-hooks.d
- plugin-helpers
- files removed:
- initramfs-tools-hook-conf
- files renamed:
- plugins.d/password-request.c => plugins.d/mandos-client.c
- plugins.d/password-request.xml => plugins.d/mandos-client.xml
- files modified:
- Makefile
added
removed
mandos-keygen.xml
1
<?xml version='1.0' encoding='UTF-8'?>
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
<!ENTITY VERSION "1.0">
5
4
<!ENTITY COMMANDNAME "mandos-keygen">
6
<!ENTITY OVERVIEW SYSTEM "overview.xml">
5
<!ENTITY TIMESTAMP "2019-07-18">
6
<!ENTITY % common SYSTEM "common.ent">
7
%common;
7
8
]>
8
9
9
<refentry>
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
10
11
<refentryinfo>
11
<title>&COMMANDNAME;</title>
12
<!-- NWalsh's docbook scripts use this to generate the footer: -->
13
<productname>&COMMANDNAME;</productname>
14
<productnumber>&VERSION;</productnumber>
12
<title>Mandos Manual</title>
13
<!-- NWalsh’s docbook scripts use this to generate the footer: -->
14
<productname>Mandos</productname>
15
<productnumber>&version;</productnumber>
16
<date>&TIMESTAMP;</date>
15
17
<authorgroup>
16
18
<author>
17
19
<firstname>Björn</firstname>
18
20
<surname>Påhlsson</surname>
19
21
<address>
20
<email>belorn@fukt.bsnet.se</email>
22
<email>belorn@recompile.se</email>
21
23
</address>
22
24
</author>
23
25
<author>
24
26
<firstname>Teddy</firstname>
25
27
<surname>Hogeborn</surname>
26
28
<address>
27
<email>teddy@fukt.bsnet.se</email>
29
<email>teddy@recompile.se</email>
28
30
</address>
29
31
</author>
30
32
</authorgroup>
31
33
<copyright>
32
34
<year>2008</year>
33
<holder>Teddy Hogeborn & Björn Påhlsson</holder>
35
<year>2009</year>
36
<year>2010</year>
37
<year>2011</year>
38
<year>2012</year>
39
<year>2013</year>
40
<year>2014</year>
41
<year>2015</year>
42
<year>2016</year>
43
<year>2017</year>
44
<year>2018</year>
45
<year>2019</year>
46
<holder>Teddy Hogeborn</holder>
47
<holder>Björn Påhlsson</holder>
34
48
</copyright>
35
<legalnotice>
36
<para>
37
This manual page is free software: you can redistribute it
38
and/or modify it under the terms of the GNU General Public
39
License as published by the Free Software Foundation,
40
either version 3 of the License, or (at your option) any
41
later version.
42
</para>
43
44
<para>
45
This manual page is distributed in the hope that it will
46
be useful, but WITHOUT ANY WARRANTY; without even the
47
implied warranty of MERCHANTABILITY or FITNESS FOR A
48
PARTICULAR PURPOSE. See the GNU General Public License
49
for more details.
50
</para>
51
52
<para>
53
You should have received a copy of the GNU General Public
54
License along with this program; If not, see
55
<ulink url="http://www.gnu.org/licenses/"/>.
56
</para>
57
</legalnotice>
49
<xi:include href="legalnotice.xml"/>
58
50
</refentryinfo>
59
51
60
52
<refmeta>
61
53
<refentrytitle>&COMMANDNAME;</refentrytitle>
62
54
<manvolnum>8</manvolnum>
65
57
<refnamediv>
66
58
<refname><command>&COMMANDNAME;</command></refname>
67
59
<refpurpose>
68
Generate keys for <citerefentry><refentrytitle>password-request
69
</refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
60
Generate key and password for Mandos client and server.
70
61
</refpurpose>
71
62
</refnamediv>
72
63
73
64
<refsynopsisdiv>
74
65
<cmdsynopsis>
75
66
<command>&COMMANDNAME;</command>
76
<group choice="opt">
77
<arg choice="plain"><option>--dir</option>
78
<replaceable>directory</replaceable></arg>
79
</group>
80
<group choice="opt">
81
<arg choice="plain"><option>--type</option>
82
<replaceable>type</replaceable></arg>
83
</group>
84
<group choice="opt">
85
<arg choice="plain"><option>--length</option>
86
<replaceable>bits</replaceable></arg>
87
</group>
88
<group choice="opt">
89
<arg choice="plain"><option>--name</option>
90
<replaceable>NAME</replaceable></arg>
91
</group>
92
<group choice="opt">
93
<arg choice="plain"><option>--email</option>
94
<replaceable>EMAIL</replaceable></arg>
95
</group>
96
<group choice="opt">
97
<arg choice="plain"><option>--comment</option>
98
<replaceable>COMMENT</replaceable></arg>
99
</group>
100
<group choice="opt">
101
<arg choice="plain"><option>--expire</option>
102
<replaceable>TIME</replaceable></arg>
103
</group>
104
<group choice="opt">
67
<group>
68
<arg choice="plain"><option>--dir
69
<replaceable>DIRECTORY</replaceable></option></arg>
70
<arg choice="plain"><option>-d
71
<replaceable>DIRECTORY</replaceable></option></arg>
72
</group>
73
<sbr/>
74
<group>
75
<arg choice="plain"><option>--type
76
<replaceable>KEYTYPE</replaceable></option></arg>
77
<arg choice="plain"><option>-t
78
<replaceable>KEYTYPE</replaceable></option></arg>
79
</group>
80
<sbr/>
81
<group>
82
<arg choice="plain"><option>--length
83
<replaceable>BITS</replaceable></option></arg>
84
<arg choice="plain"><option>-l
85
<replaceable>BITS</replaceable></option></arg>
86
</group>
87
<sbr/>
88
<group>
89
<arg choice="plain"><option>--subtype
90
<replaceable>KEYTYPE</replaceable></option></arg>
91
<arg choice="plain"><option>-s
92
<replaceable>KEYTYPE</replaceable></option></arg>
93
</group>
94
<sbr/>
95
<group>
96
<arg choice="plain"><option>--sublength
97
<replaceable>BITS</replaceable></option></arg>
98
<arg choice="plain"><option>-L
99
<replaceable>BITS</replaceable></option></arg>
100
</group>
101
<sbr/>
102
<group>
103
<arg choice="plain"><option>--name
104
<replaceable>NAME</replaceable></option></arg>
105
<arg choice="plain"><option>-n
106
<replaceable>NAME</replaceable></option></arg>
107
</group>
108
<sbr/>
109
<group>
110
<arg choice="plain"><option>--email
111
<replaceable>ADDRESS</replaceable></option></arg>
112
<arg choice="plain"><option>-e
113
<replaceable>ADDRESS</replaceable></option></arg>
114
</group>
115
<sbr/>
116
<group>
117
<arg choice="plain"><option>--comment
118
<replaceable>TEXT</replaceable></option></arg>
119
<arg choice="plain"><option>-c
120
<replaceable>TEXT</replaceable></option></arg>
121
</group>
122
<sbr/>
123
<group>
124
<arg choice="plain"><option>--expire
125
<replaceable>TIME</replaceable></option></arg>
126
<arg choice="plain"><option>-x
127
<replaceable>TIME</replaceable></option></arg>
128
</group>
129
<sbr/>
130
<group>
131
<arg choice="plain"><option>--tls-keytype
132
<replaceable>KEYTYPE</replaceable></option></arg>
133
<arg choice="plain"><option>-T
134
<replaceable>KEYTYPE</replaceable></option></arg>
135
</group>
136
<sbr/>
137
<group>
105
138
<arg choice="plain"><option>--force</option></arg>
106
</group>
107
</cmdsynopsis>
108
<cmdsynopsis>
109
<command>&COMMANDNAME;</command>
110
<group choice="opt">
111
<arg choice="plain"><option>-d</option>
112
<replaceable>directory</replaceable></arg>
113
</group>
114
<group choice="opt">
115
<arg choice="plain"><option>-t</option>
116
<replaceable>type</replaceable></arg>
117
</group>
118
<group choice="opt">
119
<arg choice="plain"><option>-l</option>
120
<replaceable>bits</replaceable></arg>
121
</group>
122
<group choice="opt">
123
<arg choice="plain"><option>-n</option>
124
<replaceable>NAME</replaceable></arg>
125
</group>
126
<group choice="opt">
127
<arg choice="plain"><option>-e</option>
128
<replaceable>EMAIL</replaceable></arg>
129
</group>
130
<group choice="opt">
131
<arg choice="plain"><option>-c</option>
132
<replaceable>COMMENT</replaceable></arg>
133
</group>
134
<group choice="opt">
135
<arg choice="plain"><option>-x</option>
136
<replaceable>TIME</replaceable></arg>
137
</group>
138
<group choice="opt">
139
139
<arg choice="plain"><option>-f</option></arg>
140
140
</group>
141
141
</cmdsynopsis>
142
142
<cmdsynopsis>
143
143
<command>&COMMANDNAME;</command>
144
144
<group choice="req">
145
<arg choice='plain'><option>-h</option></arg>
146
<arg choice='plain'><option>--help</option></arg>
147
</group>
148
</cmdsynopsis>
149
<cmdsynopsis>
150
<command>&COMMANDNAME;</command>
151
<group choice="req">
152
<arg choice='plain'><option>-v</option></arg>
153
<arg choice='plain'><option>--version</option></arg>
145
<arg choice="plain"><option>--password</option></arg>
146
<arg choice="plain"><option>-p</option></arg>
147
<arg choice="plain"><option>--passfile
148
<replaceable>FILE</replaceable></option></arg>
149
<arg choice="plain"><option>-F</option>
150
<replaceable>FILE</replaceable></arg>
151
</group>
152
<sbr/>
153
<group>
154
<arg choice="plain"><option>--dir
155
<replaceable>DIRECTORY</replaceable></option></arg>
156
<arg choice="plain"><option>-d
157
<replaceable>DIRECTORY</replaceable></option></arg>
158
</group>
159
<sbr/>
160
<group>
161
<arg choice="plain"><option>--name
162
<replaceable>NAME</replaceable></option></arg>
163
<arg choice="plain"><option>-n
164
<replaceable>NAME</replaceable></option></arg>
165
</group>
166
<group>
167
<arg choice="plain"><option>--no-ssh</option></arg>
168
<arg choice="plain"><option>-S</option></arg>
169
</group>
170
</cmdsynopsis>
171
<cmdsynopsis>
172
<command>&COMMANDNAME;</command>
173
<group choice="req">
174
<arg choice="plain"><option>--help</option></arg>
175
<arg choice="plain"><option>-h</option></arg>
176
</group>
177
</cmdsynopsis>
178
<cmdsynopsis>
179
<command>&COMMANDNAME;</command>
180
<group choice="req">
181
<arg choice="plain"><option>--version</option></arg>
182
<arg choice="plain"><option>-v</option></arg>
154
183
</group>
155
184
</cmdsynopsis>
156
185
</refsynopsisdiv>
157
186
158
187
<refsect1 id="description">
159
188
<title>DESCRIPTION</title>
160
189
<para>
161
190
<command>&COMMANDNAME;</command> is a program to generate the
162
OpenPGP keys used by
163
<citerefentry><refentrytitle>password-request</refentrytitle>
191
TLS and OpenPGP keys used by
192
<citerefentry><refentrytitle>mandos-client</refentrytitle>
164
193
<manvolnum>8mandos</manvolnum></citerefentry>. The keys are
165
normally written to /etc/mandos for later installation into the
166
initrd image, but this, like most things, can be changed with
167
command line options.
194
normally written to /etc/keys/mandos for later installation into
195
the initrd image, but this, and most other things, can be
196
changed with command line options.
197
</para>
198
<para>
199
This program can also be used with the
200
<option>--password</option> or <option>--passfile</option>
201
options to generate a ready-made section for
202
<filename>clients.conf</filename> (see
203
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
204
<manvolnum>5</manvolnum></citerefentry>).
168
205
</para>
169
206
</refsect1>
170
207
171
208
<refsect1 id="purpose">
172
209
<title>PURPOSE</title>
173
174
210
<para>
175
211
The purpose of this is to enable <emphasis>remote and unattended
176
212
rebooting</emphasis> of client host computer with an
177
213
<emphasis>encrypted root file system</emphasis>. See <xref
178
214
linkend="overview"/> for details.
179
215
</para>
180
181
216
</refsect1>
182
217
183
218
<refsect1 id="options">
184
219
<title>OPTIONS</title>
185
220
186
221
<variablelist>
187
222
<varlistentry>
188
<term><literal>-h</literal>, <literal>--help</literal></term>
223
<term><option>--help</option></term>
224
<term><option>-h</option></term>
189
225
<listitem>
190
226
<para>
191
227
Show a help message and exit
192
228
</para>
193
229
</listitem>
194
230
</varlistentry>
195
196
<varlistentry>
197
<term><literal>-d</literal>, <literal>--dir
198
<replaceable>directory</replaceable></literal></term>
199
<listitem>
200
<para>
201
Target directory for key files.
202
</para>
203
</listitem>
204
</varlistentry>
205
206
<varlistentry>
207
<term><literal>-t</literal>, <literal>--type
208
<replaceable>type</replaceable></literal></term>
209
<listitem>
210
<para>
211
Key type. Default is DSA.
212
</para>
213
</listitem>
214
</varlistentry>
215
216
<varlistentry>
217
<term><literal>-l</literal>, <literal>--length
218
<replaceable>bits</replaceable></literal></term>
219
<listitem>
220
<para>
221
Key length in bits. Default is 1024.
222
</para>
223
</listitem>
224
</varlistentry>
225
226
<varlistentry>
227
<term><literal>-e</literal>, <literal>--email</literal>
228
<replaceable>address</replaceable></term>
231
232
<varlistentry>
233
<term><option>--dir
234
<replaceable>DIRECTORY</replaceable></option></term>
235
<term><option>-d
236
<replaceable>DIRECTORY</replaceable></option></term>
237
<listitem>
238
<para>
239
Target directory for key files. Default is <filename
240
class="directory">/etc/keys/mandos</filename>.
241
</para>
242
</listitem>
243
</varlistentry>
244
245
<varlistentry>
246
<term><option>--type
247
<replaceable>TYPE</replaceable></option></term>
248
<term><option>-t
249
<replaceable>TYPE</replaceable></option></term>
250
<listitem>
251
<para>
252
OpenPGP key type. Default is <quote>RSA</quote>.
253
</para>
254
</listitem>
255
</varlistentry>
256
257
<varlistentry>
258
<term><option>--length
259
<replaceable>BITS</replaceable></option></term>
260
<term><option>-l
261
<replaceable>BITS</replaceable></option></term>
262
<listitem>
263
<para>
264
OpenPGP key length in bits. Default is 4096.
265
</para>
266
</listitem>
267
</varlistentry>
268
269
<varlistentry>
270
<term><option>--subtype
271
<replaceable>KEYTYPE</replaceable></option></term>
272
<term><option>-s
273
<replaceable>KEYTYPE</replaceable></option></term>
274
<listitem>
275
<para>
276
OpenPGP subkey type. Default is <quote>RSA</quote>
277
</para>
278
</listitem>
279
</varlistentry>
280
281
<varlistentry>
282
<term><option>--sublength
283
<replaceable>BITS</replaceable></option></term>
284
<term><option>-L
285
<replaceable>BITS</replaceable></option></term>
286
<listitem>
287
<para>
288
OpenPGP subkey length in bits. Default is 4096.
289
</para>
290
</listitem>
291
</varlistentry>
292
293
<varlistentry>
294
<term><option>--email
295
<replaceable>ADDRESS</replaceable></option></term>
296
<term><option>-e
297
<replaceable>ADDRESS</replaceable></option></term>
229
298
<listitem>
230
299
<para>
231
300
Email address of key. Default is empty.
232
301
</para>
233
302
</listitem>
234
303
</varlistentry>
235
304
236
305
<varlistentry>
237
<term><literal>-c</literal>, <literal>--comment</literal>
238
<replaceable>comment</replaceable></term>
306
<term><option>--comment
307
<replaceable>TEXT</replaceable></option></term>
308
<term><option>-c
309
<replaceable>TEXT</replaceable></option></term>
239
310
<listitem>
240
311
<para>
241
Comment field for key. The default value is
242
"<literal>Mandos client key</literal>".
312
Comment field for key. Default is empty.
243
313
</para>
244
314
</listitem>
245
315
</varlistentry>
246
316
247
317
<varlistentry>
248
<term><literal>-x</literal>, <literal>--expire</literal>
249
<replaceable>time</replaceable></term>
318
<term><option>--expire
319
<replaceable>TIME</replaceable></option></term>
320
<term><option>-x
321
<replaceable>TIME</replaceable></option></term>
250
322
<listitem>
251
323
<para>
252
324
Key expire time. Default is no expiration. See
255
327
</para>
256
328
</listitem>
257
329
</varlistentry>
258
259
<varlistentry>
260
<term><literal>-f</literal>, <literal>--force</literal></term>
261
<listitem>
262
<para>
263
Force overwriting old keys.
330
331
<varlistentry>
332
<term><option>--tls-keytype
333
<replaceable>KEYTYPE</replaceable></option></term>
334
<term><option>-T
335
<replaceable>KEYTYPE</replaceable></option></term>
336
<listitem>
337
<para>
338
TLS key type. Default is <quote>ed25519</quote>
339
</para>
340
</listitem>
341
</varlistentry>
342
343
<varlistentry>
344
<term><option>--force</option></term>
345
<term><option>-f</option></term>
346
<listitem>
347
<para>
348
Force overwriting old key.
349
</para>
350
</listitem>
351
</varlistentry>
352
<varlistentry>
353
<term><option>--password</option></term>
354
<term><option>-p</option></term>
355
<listitem>
356
<para>
357
Prompt for a password and encrypt it with the key already
358
present in either <filename>/etc/keys/mandos</filename> or
359
the directory specified with the <option>--dir</option>
360
option. Outputs, on standard output, a section suitable
361
for inclusion in <citerefentry><refentrytitle
362
>mandos-clients.conf</refentrytitle><manvolnum
363
>8</manvolnum></citerefentry>. The host name or the name
364
specified with the <option>--name</option> option is used
365
for the section header. All other options are ignored,
366
and no key is created. Note: white space is stripped from
367
the beginning and from the end of the password; See <xref
368
linkend="bugs"/>.
369
</para>
370
</listitem>
371
</varlistentry>
372
<varlistentry>
373
<term><option>--passfile
374
<replaceable>FILE</replaceable></option></term>
375
<term><option>-F
376
<replaceable>FILE</replaceable></option></term>
377
<listitem>
378
<para>
379
The same as <option>--password</option>, but read from
380
<replaceable>FILE</replaceable>, not the terminal, and
381
white space is not stripped from the password in any way.
382
</para>
383
</listitem>
384
</varlistentry>
385
<varlistentry>
386
<term><option>--no-ssh</option></term>
387
<term><option>-S</option></term>
388
<listitem>
389
<para>
390
When <option>--password</option> or
391
<option>--passfile</option> is given, this option will
392
prevent <command>&COMMANDNAME;</command> from calling
393
<command>ssh-keyscan</command> to get an SSH fingerprint
394
for this host and, if successful, output suitable config
395
options to use this fingerprint as a
396
<option>checker</option> option in the output. This is
397
otherwise the default behavior.
264
398
</para>
265
399
</listitem>
266
400
</varlistentry>
267
401
</variablelist>
268
402
</refsect1>
269
403
270
404
<refsect1 id="overview">
271
405
<title>OVERVIEW</title>
272
&OVERVIEW;
406
<xi:include href="overview.xml"/>
273
407
<para>
274
This program is a small program to generate new OpenPGP keys for
275
new Mandos clients.
408
This program is a small utility to generate new TLS and OpenPGP
409
keys for new Mandos clients, and to generate sections for
410
inclusion in <filename>clients.conf</filename> on the server.
276
411
</para>
277
412
</refsect1>
278
413
279
414
<refsect1 id="exit_status">
280
415
<title>EXIT STATUS</title>
281
416
<para>
282
The exit status will be 0 if new keys were successfully created,
283
otherwise not.
417
The exit status will be 0 if a new key (or password, if the
418
<option>--password</option> option was used) was successfully
419
created, otherwise not.
284
420
</para>
285
421
</refsect1>
286
422
288
424
<title>ENVIRONMENT</title>
289
425
<variablelist>
290
426
<varlistentry>
291
<term><varname>TMPDIR</varname></term>
427
<term><envar>TMPDIR</envar></term>
292
428
<listitem>
293
429
<para>
294
430
If set, temporary files will be created here. See
300
436
</variablelist>
301
437
</refsect1>
302
438
303
<refsect1 id="file">
439
<refsect1 id="files">
304
440
<title>FILES</title>
305
441
<para>
306
442
Use the <option>--dir</option> option to change where
309
445
</para>
310
446
<variablelist>
311
447
<varlistentry>
312
<term><filename>/etc/mandos/seckey.txt</filename></term>
448
<term><filename>/etc/keys/mandos/seckey.txt</filename></term>
313
449
<listitem>
314
450
<para>
315
451
OpenPGP secret key file which will be created or
318
454
</listitem>
319
455
</varlistentry>
320
456
<varlistentry>
321
<term><filename>/etc/mandos/pubkey.txt</filename></term>
457
<term><filename>/etc/keys/mandos/pubkey.txt</filename></term>
322
458
<listitem>
323
459
<para>
324
460
OpenPGP public key file which will be created or
327
463
</listitem>
328
464
</varlistentry>
329
465
<varlistentry>
330
<term><filename>/tmp</filename></term>
466
<term><filename>/etc/keys/mandos/tls-privkey.pem</filename></term>
467
<listitem>
468
<para>
469
Private key file which will be created or overwritten.
470
</para>
471
</listitem>
472
</varlistentry>
473
<varlistentry>
474
<term><filename>/etc/keys/mandos/tls-pubkey.pem</filename></term>
475
<listitem>
476
<para>
477
Public key file which will be created or overwritten.
478
</para>
479
</listitem>
480
</varlistentry>
481
<varlistentry>
482
<term><filename class="directory">/tmp</filename></term>
331
483
<listitem>
332
484
<para>
333
485
Temporary files will be written here if
337
489
</varlistentry>
338
490
</variablelist>
339
491
</refsect1>
340
492
341
493
<refsect1 id="bugs">
342
494
<title>BUGS</title>
343
495
<para>
344
None are known at this time.
496
The <option>--password</option>/<option>-p</option> option
497
strips white space from the start and from the end of the
498
password before using it. If this is a problem, use the
499
<option>--passfile</option> option instead, which does not do
500
this.
345
501
</para>
502
<xi:include href="bugs.xml"/>
346
503
</refsect1>
347
504
348
505
<refsect1 id="example">
349
506
<title>EXAMPLE</title>
350
507
<informalexample>
352
509
Normal invocation needs no options:
353
510
</para>
354
511
<para>
355
<userinput>mandos-keygen</userinput>
512
<userinput>&COMMANDNAME;</userinput>
356
513
</para>
357
514
</informalexample>
358
515
<informalexample>
359
516
<para>
360
Create keys in another directory and of another type. Force
517
Create key in another directory and of another type. Force
361
518
overwriting old key files:
362
519
</para>
363
520
<para>
364
521
365
522
<!-- do not wrap this line -->
366
<userinput>mandos-keygen --dir ~/keydir --type RSA --force</userinput>
523
<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>
524
525
</para>
526
</informalexample>
527
<informalexample>
528
<para>
529
Prompt for a password, encrypt it with the keys in <filename
530
class="directory">/etc/keys/mandos</filename> and output a
531
section suitable for <filename>clients.conf</filename>.
532
</para>
533
<para>
534
<userinput>&COMMANDNAME; --password</userinput>
535
</para>
536
</informalexample>
537
<informalexample>
538
<para>
539
Prompt for a password, encrypt it with the keys in the
540
<filename>client-key</filename> directory and output a section
541
suitable for <filename>clients.conf</filename>.
542
</para>
543
<para>
544
545
<!-- do not wrap this line -->
546
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
367
547
368
548
</para>
369
549
</informalexample>
370
550
</refsect1>
371
551
372
552
<refsect1 id="security">
373
553
<title>SECURITY</title>
374
554
<para>
375
The <option>--type</option> and <option>--length</option>
376
options can be used to create keys of insufficient security. If
377
in doubt, leave them to the default values.
555
The <option>--type</option>, <option>--length</option>,
556
<option>--subtype</option>, and <option>--sublength</option>
557
options can be used to create keys of low security. If in
558
doubt, leave them to the default values.
378
559
</para>
379
560
<para>
380
The key expire time is not guaranteed to be honored by
381
<citerefentry><refentrytitle>mandos</refentrytitle>
561
The key expire time is <emphasis>not</emphasis> guaranteed to be
562
honored by <citerefentry><refentrytitle>mandos</refentrytitle>
382
563
<manvolnum>8</manvolnum></citerefentry>.
383
564
</para>
384
565
</refsect1>
385
566
386
567
<refsect1 id="see_also">
387
568
<title>SEE ALSO</title>
388
569
<para>
389
<citerefentry><refentrytitle>password-request</refentrytitle>
570
<citerefentry><refentrytitle>intro</refentrytitle>
390
571
<manvolnum>8mandos</manvolnum></citerefentry>,
391
<citerefentry><refentrytitle>mandos</refentrytitle>
392
<manvolnum>8</manvolnum></citerefentry>, and
393
572
<citerefentry><refentrytitle>gpg</refentrytitle>
573
<manvolnum>1</manvolnum></citerefentry>,
574
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
575
<manvolnum>5</manvolnum></citerefentry>,
576
<citerefentry><refentrytitle>mandos</refentrytitle>
577
<manvolnum>8</manvolnum></citerefentry>,
578
<citerefentry><refentrytitle>mandos-client</refentrytitle>
579
<manvolnum>8mandos</manvolnum></citerefentry>,
580
<citerefentry><refentrytitle>ssh-keyscan</refentrytitle>
394
581
<manvolnum>1</manvolnum></citerefentry>
395
582
</para>
396
583
</refsect1>
397
584
398
585
</refentry>
586
<!-- Local Variables: -->
587
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
588
<!-- time-stamp-end: "[\"']>" -->
589
<!-- time-stamp-format: "%:y-%02m-%02d" -->
590
<!-- End: -->
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0