/mandos/trunk : revision 13

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-keygen.xml

Committer: Björn Påhlsson
Date: 2008-07-20 02:52:20 UTC
Revision ID: belorn@braxen-20080720025220-r5u0388uy9iu23h6

Added following support:
Pluginbased client handler
rewritten Mandos client
Avahi instead of udp server discovery
openpgp encrypted key support
Passprompt stand alone application for direct console input
Added logging for Mandos server

files added:
ca.pem

cert.pem

client-cert.pem

client-key.pem

crl.pem

key.pem

plugins.d/Makefile

files removed:
.bzrignore

COPYING

initramfs-tools-hook

initramfs-tools-hook-conf

initramfs-tools-script

mandos-clients.conf.xml

mandos-keygen

mandos-keygen.xml

mandos-options.xml

mandos.conf

mandos.conf.xml

mandos.xml

overview.xml

plugin-runner.xml

plugins.d/password-prompt.xml

plugins.d/password-request.xml

plugins.d/usplash

files renamed:
clients.conf => mandos-clients.conf

plugin-runner.c => plugbasedclient.c

plugins.d/password-request.c => plugins.d/mandosclient.c

plugins.d/password-prompt.c => plugins.d/passprompt.c

mandos => server.py

files modified:
Makefile

TODO

Show diffs side-by-side

added added

removed removed

mandos-keygen.xml

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

<!ENTITY VERSION "1.0">

<!ENTITY COMMANDNAME "mandos-keygen">

<!ENTITY TIMESTAMP "2008-08-31">

<title>Mandos Manual</title>

<productname>Mandos</productname>

<productnumber>&VERSION;</productnumber>

<date>&TIMESTAMP;</date>

<firstname>Björn</firstname>

<surname>Påhlsson</surname>

<email>belorn@fukt.bsnet.se</email>

</address>

</author>

<firstname>Teddy</firstname>

<surname>Hogeborn</surname>

<email>teddy@fukt.bsnet.se</email>

</address>

</author>

</authorgroup>

<holder>Teddy Hogeborn</holder>

<holder>Björn Påhlsson</holder>

</copyright>

<para>

This manual page is free software: you can redistribute it

and/or modify it under the terms of the GNU General Public

License as published by the Free Software Foundation,

either version 3 of the License, or (at your option) any

later version.

</para>

<para>

This manual page is distributed in the hope that it will

be useful, but WITHOUT ANY WARRANTY; without even the

implied warranty of MERCHANTABILITY or FITNESS FOR A

PARTICULAR PURPOSE. See the GNU General Public License

for more details.

</para>

<para>

You should have received a copy of the GNU General Public

License along with this program; If not, see

<ulink url="http://www.gnu.org/licenses/"/>.

</para>

</legalnotice>

</refentryinfo>

<refentrytitle>&COMMANDNAME;</refentrytitle>

</refmeta>

<refname><command>&COMMANDNAME;</command></refname>

Generate key and password for Mandos client and server.

</refpurpose>

</refnamediv>

<command>&COMMANDNAME;</command>

<group>

<arg choice="plain"><option>--dir

<replaceable>DIRECTORY</replaceable></option></arg>

<arg choice="plain"><option>-d

<replaceable>DIRECTORY</replaceable></option></arg>

</group>

<sbr/>

<group>

<arg choice="plain"><option>--type

<replaceable>KEYTYPE</replaceable></option></arg>

<arg choice="plain"><option>-t

<replaceable>KEYTYPE</replaceable></option></arg>

</group>

<sbr/>

<group>

<arg choice="plain"><option>--length

<arg choice="plain"><option>-l

</group>

<sbr/>

<group>

<arg choice="plain"><option>--subtype

100

<replaceable>KEYTYPE</replaceable></option></arg>

101

<arg choice="plain"><option>-s

102

<replaceable>KEYTYPE</replaceable></option></arg>

103

</group>

104

<sbr/>

105

<group>

106

<arg choice="plain"><option>--sublength

107

108

<arg choice="plain"><option>-L

109

110

</group>

111

<sbr/>

112

<group>

113

<arg choice="plain"><option>--name

114

115

<arg choice="plain"><option>-n

116

117

</group>

118

<sbr/>

119

<group>

120

<arg choice="plain"><option>--email

121

<replaceable>ADDRESS</replaceable></option></arg>

122

<arg choice="plain"><option>-e

123

<replaceable>ADDRESS</replaceable></option></arg>

124

</group>

125

<sbr/>

126

<group>

127

<arg choice="plain"><option>--comment

128

129

<arg choice="plain"><option>-c

130

131

</group>

132

<sbr/>

133

<group>

134

<arg choice="plain"><option>--expire

135

136

<arg choice="plain"><option>-x

137

138

</group>

139

<sbr/>

140

<arg><option>--force</option></arg>

141

</cmdsynopsis>

142

143

<command>&COMMANDNAME;</command>

144

145

<arg choice="plain"><option>--password</option></arg>

146

147

</group>

148

<sbr/>

149

<group>

150

<arg choice="plain"><option>--dir

151

<replaceable>DIRECTORY</replaceable></option></arg>

152

<arg choice="plain"><option>-d

153

<replaceable>DIRECTORY</replaceable></option></arg>

154

</group>

155

<sbr/>

156

<group>

157

<arg choice="plain"><option>--name

158

159

<arg choice="plain"><option>-n

160

161

</group>

162

</cmdsynopsis>

163

164

<command>&COMMANDNAME;</command>

165

166

167

168

</group>

169

</cmdsynopsis>

170

171

<command>&COMMANDNAME;</command>

172

173

<arg choice="plain"><option>--version</option></arg>

174

175

</group>

176

</cmdsynopsis>

177

</refsynopsisdiv>

178

179

180

<title>DESCRIPTION</title>

181

<para>

182

<command>&COMMANDNAME;</command> is a program to generate the

183

OpenPGP key used by

184

<citerefentry><refentrytitle>password-request</refentrytitle>

185

<manvolnum>8mandos</manvolnum></citerefentry>. The key is

186

normally written to /etc/mandos for later installation into the

187

initrd image, but this, and most other things, can be changed

188

with command line options.

189

</para>

190

<para>

191

This program can also be used with the

192

<option>--password</option> option to generate a ready-made

193

section for <filename>clients.conf</filename> (see

194

<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>

195

<manvolnum>5</manvolnum></citerefentry>).

196

</para>

197

</refsect1>

198

199

200

<title>PURPOSE</title>

201

<para>

202

The purpose of this is to enable <emphasis>remote and unattended

203

rebooting</emphasis> of client host computer with an

204

<emphasis>encrypted root file system</emphasis>. See <xref

205

linkend="overview"/> for details.

206

</para>

207

</refsect1>

208

209

210

<title>OPTIONS</title>

211

212

213

214

215

216

217

<para>

218

Show a help message and exit

219

</para>

220

</listitem>

221

</varlistentry>

222

223

224

<term><option>--dir

225

<replaceable>DIRECTORY</replaceable></option></term>

226

<term><option>-d

227

<replaceable>DIRECTORY</replaceable></option></term>

228

229

<para>

230

Target directory for key files. Default is

231

<filename>/etc/mandos</filename>.

232

</para>

233

</listitem>

234

</varlistentry>

235

236

237

<term><option>--type

238

239

<term><option>-t

240

241

242

<para>

243

Key type. Default is <quote>DSA</quote>.

244

</para>

245

</listitem>

246

</varlistentry>

247

248

249

<term><option>--length

250

251

<term><option>-l

252

253

254

<para>

255

Key length in bits. Default is 2048.

256

</para>

257

</listitem>

258

</varlistentry>

259

260

261

<term><option>--subtype

262

<replaceable>KEYTYPE</replaceable></option></term>

263

<term><option>-s

264

<replaceable>KEYTYPE</replaceable></option></term>

265

266

<para>

267

Subkey type. Default is <quote>ELG-E</quote> (Elgamal

268

encryption-only).

269

</para>

270

</listitem>

271

</varlistentry>

272

273

274

<term><option>--sublength

275

276

<term><option>-L

277

278

279

<para>

280

Subkey length in bits. Default is 2048.

281

</para>

282

</listitem>

283

</varlistentry>

284

285

286

<term><option>--email

287

<replaceable>ADDRESS</replaceable></option></term>

288

<term><option>-e

289

<replaceable>ADDRESS</replaceable></option></term>

290

291

<para>

292

Email address of key. Default is empty.

293

</para>

294

</listitem>

295

</varlistentry>

296

297

298

<term><option>--comment

299

300

<term><option>-c

301

302

303

<para>

304

Comment field for key. The default value is

305

<quote><literal>Mandos client key</literal></quote>.

306

</para>

307

</listitem>

308

</varlistentry>

309

310

311

<term><option>--expire

312

313

<term><option>-x

314

315

316

<para>

317

Key expire time. Default is no expiration. See

318

319

<manvolnum>1</manvolnum></citerefentry> for syntax.

320

</para>

321

</listitem>

322

</varlistentry>

323

324

325

<term><option>--force</option></term>

326

327

328

<para>

329

Force overwriting old key.

330

</para>

331

</listitem>

332

</varlistentry>

333

334

<term><option>--password</option></term>

335

336

337

<para>

338

Prompt for a password and encrypt it with the key already

339

present in either <filename>/etc/mandos</filename> or the

340

directory specified with the <option>--dir</option>

341

option. Outputs, on standard output, a section suitable

342

for inclusion in <citerefentry><refentrytitle

343

>mandos-clients.conf</refentrytitle><manvolnum

344

>8</manvolnum></citerefentry>. The host name or the name

345

specified with the <option>--name</option> option is used

346

for the section header. All other options are ignored,

347

and no key is created.

348

</para>

349

</listitem>

350

</varlistentry>

351

</variablelist>

352

</refsect1>

353

354

355

<title>OVERVIEW</title>

356

<xi:include href="overview.xml"/>

357

<para>

358

This program is a small utility to generate new OpenPGP keys for

359

new Mandos clients, and to generate sections for inclusion in

360

<filename>clients.conf</filename> on the server.

361

</para>

362

</refsect1>

363

364

365

<title>EXIT STATUS</title>

366

<para>

367

The exit status will be 0 if a new key (or password, if the

368

<option>--password</option> option was used) was successfully

369

created, otherwise not.

370

</para>

371

</refsect1>

372

373

374

<title>ENVIRONMENT</title>

375

376

377

<term><envar>TMPDIR</envar></term>

378

379

<para>

380

If set, temporary files will be created here. See

381

<citerefentry><refentrytitle>mktemp</refentrytitle>

382

<manvolnum>1</manvolnum></citerefentry>.

383

</para>

384

</listitem>

385

</varlistentry>

386

</variablelist>

387

</refsect1>

388

389

390

<title>FILES</title>

391

<para>

392

Use the <option>--dir</option> option to change where

393

<command>&COMMANDNAME;</command> will write the key files. The

394

default file names are shown here.

395

</para>

396

397

398

<term><filename>/etc/mandos/seckey.txt</filename></term>

399

400

<para>

401

OpenPGP secret key file which will be created or

402

overwritten.

403

</para>

404

</listitem>

405

</varlistentry>

406

407

<term><filename>/etc/mandos/pubkey.txt</filename></term>

408

409

<para>

410

OpenPGP public key file which will be created or

411

overwritten.

412

</para>

413

</listitem>

414

</varlistentry>

415

416

417

418

<para>

419

Temporary files will be written here if

420

<varname>TMPDIR</varname> is not set.

421

</para>

422

</listitem>

423

</varlistentry>

424

</variablelist>

425

</refsect1>

426

427

428

429

<para>

430

None are known at this time.

431

</para>

432

</refsect1>

433

434

435

<title>EXAMPLE</title>

436

437

<para>

438

Normal invocation needs no options:

439

</para>

440

<para>

441

<userinput>&COMMANDNAME;</userinput>

442

</para>

443

</informalexample>

444

445

<para>

446

Create key in another directory and of another type. Force

447

overwriting old key files:

448

</para>

449

<para>

450

451

452

<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>

453

454

</para>

455

</informalexample>

456

457

<para>

458

Prompt for a password, encrypt it with the key in

459

<filename>/etc/mandos</filename> and output a section suitable

460

for <filename>clients.conf</filename>.

461

</para>

462

<para>

463

<userinput>&COMMANDNAME; --password</userinput>

464

</para>

465

</informalexample>

466

467

<para>

468

Prompt for a password, encrypt it with the key in the

469

<filename>client-key</filename> directory and output a section

470

suitable for <filename>clients.conf</filename>.

471

</para>

472

<para>

473

474

475

<userinput>&COMMANDNAME; --password --dir client-key</userinput>

476

477

</para>

478

</informalexample>

479

</refsect1>

480

481

482

<title>SECURITY</title>

483

<para>

484

The <option>--type</option>, <option>--length</option>,

485

<option>--subtype</option>, and <option>--sublength</option>

486

options can be used to create keys of low security. If in

487

doubt, leave them to the default values.

488

</para>

489

<para>

490

The key expire time is <emphasis>not</emphasis> guaranteed to be

491

honored by <citerefentry><refentrytitle>mandos</refentrytitle>

492

<manvolnum>8</manvolnum></citerefentry>.

493

</para>

494

</refsect1>

495

496

497

498

<para>

499

500

<manvolnum>1</manvolnum></citerefentry>,

501

<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>

502

<manvolnum>5</manvolnum></citerefentry>,

503

<citerefentry><refentrytitle>mandos</refentrytitle>

504

<manvolnum>8</manvolnum></citerefentry>,

505

<citerefentry><refentrytitle>password-request</refentrytitle>

506

<manvolnum>8mandos</manvolnum></citerefentry>

507

</para>

508

</refsect1>

509

510

</refentry>

511

512

513

514

515

Older »