To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos-keygen.xml
- browse files at revision 1313
- compare with another revision
- download diff
- download tarball
- view history from revision 1313
- Committer: Teddy Hogeborn
- Date: 2024-11-22 20:28:54 UTC
- Revision ID: teddy@recompile.se-20241122202854-dycuf117byxhxl32
mandos-monitor: Avoid debug messages from urwid
Avoid debug messages from urwid. Any logging output before the screen
has been set up will mangle the screen.
* mandos-monitor: When setting up logging, set urwid to only show log
messages of level INFO or above.
(Thanks to an anonymous contributor for reporting this.)
Avoid debug messages from urwid. Any logging output before the screen
has been set up will mangle the screen.
* mandos-monitor: When setting up logging, set urwid to only show log
messages of level INFO or above.
(Thanks to an anonymous contributor for reporting this.)
- files added:
- .bzr-builddeb
- debian
- debian/po
- debian/source
- debian/tests
- debian/upstream
- dracut-module
- network-hooks.d
- plugin-helpers
- files removed:
- initramfs-tools-hook-conf
- files renamed:
- plugins.d/password-request.c => plugins.d/mandos-client.c
- plugins.d/password-request.xml => plugins.d/mandos-client.xml
- files modified:
- .bzrignore
added
removed
mandos-keygen.xml
1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
<!ENTITY VERSION "1.0">
5
4
<!ENTITY COMMANDNAME "mandos-keygen">
6
<!ENTITY TIMESTAMP "2008-08-30">
5
<!ENTITY TIMESTAMP "2019-07-18">
6
<!ENTITY % common SYSTEM "common.ent">
7
%common;
7
8
]>
8
9
9
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
11
12
<title>Mandos Manual</title>
12
13
<!-- NWalsh’s docbook scripts use this to generate the footer: -->
13
14
<productname>Mandos</productname>
14
<productnumber>&VERSION;</productnumber>
15
<productnumber>&version;</productnumber>
15
16
<date>&TIMESTAMP;</date>
16
17
<authorgroup>
17
18
<author>
18
19
<firstname>Björn</firstname>
19
20
<surname>Påhlsson</surname>
20
21
<address>
21
<email>belorn@fukt.bsnet.se</email>
22
<email>belorn@recompile.se</email>
22
23
</address>
23
24
</author>
24
25
<author>
25
26
<firstname>Teddy</firstname>
26
27
<surname>Hogeborn</surname>
27
28
<address>
28
<email>teddy@fukt.bsnet.se</email>
29
<email>teddy@recompile.se</email>
29
30
</address>
30
31
</author>
31
32
</authorgroup>
32
33
<copyright>
33
34
<year>2008</year>
35
<year>2009</year>
36
<year>2010</year>
37
<year>2011</year>
38
<year>2012</year>
39
<year>2013</year>
40
<year>2014</year>
41
<year>2015</year>
42
<year>2016</year>
43
<year>2017</year>
44
<year>2018</year>
45
<year>2019</year>
34
46
<holder>Teddy Hogeborn</holder>
35
47
<holder>Björn Påhlsson</holder>
36
48
</copyright>
37
<legalnotice>
38
<para>
39
This manual page is free software: you can redistribute it
40
and/or modify it under the terms of the GNU General Public
41
License as published by the Free Software Foundation,
42
either version 3 of the License, or (at your option) any
43
later version.
44
</para>
45
46
<para>
47
This manual page is distributed in the hope that it will
48
be useful, but WITHOUT ANY WARRANTY; without even the
49
implied warranty of MERCHANTABILITY or FITNESS FOR A
50
PARTICULAR PURPOSE. See the GNU General Public License
51
for more details.
52
</para>
53
54
<para>
55
You should have received a copy of the GNU General Public
56
License along with this program; If not, see
57
<ulink url="http://www.gnu.org/licenses/"/>.
58
</para>
59
</legalnotice>
49
<xi:include href="legalnotice.xml"/>
60
50
</refentryinfo>
61
51
62
52
<refmeta>
63
53
<refentrytitle>&COMMANDNAME;</refentrytitle>
64
54
<manvolnum>8</manvolnum>
67
57
<refnamediv>
68
58
<refname><command>&COMMANDNAME;</command></refname>
69
59
<refpurpose>
70
Generate keys for <citerefentry><refentrytitle>password-request
71
</refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
60
Generate key and password for Mandos client and server.
72
61
</refpurpose>
73
62
</refnamediv>
74
63
75
64
<refsynopsisdiv>
76
65
<cmdsynopsis>
77
66
<command>&COMMANDNAME;</command>
78
<group choice="opt">
79
<arg choice="plain"><option>--dir</option>
80
<replaceable>directory</replaceable></arg>
81
</group>
82
<group choice="opt">
83
<arg choice="plain"><option>--type</option>
84
<replaceable>type</replaceable></arg>
85
</group>
86
<group choice="opt">
87
<arg choice="plain"><option>--length</option>
88
<replaceable>bits</replaceable></arg>
89
</group>
90
<group choice="opt">
91
<arg choice="plain"><option>--subtype</option>
92
<replaceable>type</replaceable></arg>
93
</group>
94
<group choice="opt">
95
<arg choice="plain"><option>--sublength</option>
96
<replaceable>bits</replaceable></arg>
97
</group>
98
<group choice="opt">
99
<arg choice="plain"><option>--name</option>
100
<replaceable>NAME</replaceable></arg>
101
</group>
102
<group choice="opt">
103
<arg choice="plain"><option>--email</option>
104
<replaceable>EMAIL</replaceable></arg>
105
</group>
106
<group choice="opt">
107
<arg choice="plain"><option>--comment</option>
108
<replaceable>COMMENT</replaceable></arg>
109
</group>
110
<group choice="opt">
111
<arg choice="plain"><option>--expire</option>
112
<replaceable>TIME</replaceable></arg>
113
</group>
114
<group choice="opt">
67
<group>
68
<arg choice="plain"><option>--dir
69
<replaceable>DIRECTORY</replaceable></option></arg>
70
<arg choice="plain"><option>-d
71
<replaceable>DIRECTORY</replaceable></option></arg>
72
</group>
73
<sbr/>
74
<group>
75
<arg choice="plain"><option>--type
76
<replaceable>KEYTYPE</replaceable></option></arg>
77
<arg choice="plain"><option>-t
78
<replaceable>KEYTYPE</replaceable></option></arg>
79
</group>
80
<sbr/>
81
<group>
82
<arg choice="plain"><option>--length
83
<replaceable>BITS</replaceable></option></arg>
84
<arg choice="plain"><option>-l
85
<replaceable>BITS</replaceable></option></arg>
86
</group>
87
<sbr/>
88
<group>
89
<arg choice="plain"><option>--subtype
90
<replaceable>KEYTYPE</replaceable></option></arg>
91
<arg choice="plain"><option>-s
92
<replaceable>KEYTYPE</replaceable></option></arg>
93
</group>
94
<sbr/>
95
<group>
96
<arg choice="plain"><option>--sublength
97
<replaceable>BITS</replaceable></option></arg>
98
<arg choice="plain"><option>-L
99
<replaceable>BITS</replaceable></option></arg>
100
</group>
101
<sbr/>
102
<group>
103
<arg choice="plain"><option>--name
104
<replaceable>NAME</replaceable></option></arg>
105
<arg choice="plain"><option>-n
106
<replaceable>NAME</replaceable></option></arg>
107
</group>
108
<sbr/>
109
<group>
110
<arg choice="plain"><option>--email
111
<replaceable>ADDRESS</replaceable></option></arg>
112
<arg choice="plain"><option>-e
113
<replaceable>ADDRESS</replaceable></option></arg>
114
</group>
115
<sbr/>
116
<group>
117
<arg choice="plain"><option>--comment
118
<replaceable>TEXT</replaceable></option></arg>
119
<arg choice="plain"><option>-c
120
<replaceable>TEXT</replaceable></option></arg>
121
</group>
122
<sbr/>
123
<group>
124
<arg choice="plain"><option>--expire
125
<replaceable>TIME</replaceable></option></arg>
126
<arg choice="plain"><option>-x
127
<replaceable>TIME</replaceable></option></arg>
128
</group>
129
<sbr/>
130
<group>
131
<arg choice="plain"><option>--tls-keytype
132
<replaceable>KEYTYPE</replaceable></option></arg>
133
<arg choice="plain"><option>-T
134
<replaceable>KEYTYPE</replaceable></option></arg>
135
</group>
136
<sbr/>
137
<group>
115
138
<arg choice="plain"><option>--force</option></arg>
116
</group>
117
</cmdsynopsis>
118
<cmdsynopsis>
119
<command>&COMMANDNAME;</command>
120
<group choice="opt">
121
<arg choice="plain"><option>-d</option>
122
<replaceable>directory</replaceable></arg>
123
</group>
124
<group choice="opt">
125
<arg choice="plain"><option>-t</option>
126
<replaceable>type</replaceable></arg>
127
</group>
128
<group choice="opt">
129
<arg choice="plain"><option>-l</option>
130
<replaceable>bits</replaceable></arg>
131
</group>
132
<group choice="opt">
133
<arg choice="plain"><option>-s</option>
134
<replaceable>type</replaceable></arg>
135
</group>
136
<group choice="opt">
137
<arg choice="plain"><option>-L</option>
138
<replaceable>bits</replaceable></arg>
139
</group>
140
<group choice="opt">
141
<arg choice="plain"><option>-n</option>
142
<replaceable>NAME</replaceable></arg>
143
</group>
144
<group choice="opt">
145
<arg choice="plain"><option>-e</option>
146
<replaceable>EMAIL</replaceable></arg>
147
</group>
148
<group choice="opt">
149
<arg choice="plain"><option>-c</option>
150
<replaceable>COMMENT</replaceable></arg>
151
</group>
152
<group choice="opt">
153
<arg choice="plain"><option>-x</option>
154
<replaceable>TIME</replaceable></arg>
155
</group>
156
<group choice="opt">
157
139
<arg choice="plain"><option>-f</option></arg>
158
140
</group>
159
141
</cmdsynopsis>
160
142
<cmdsynopsis>
161
143
<command>&COMMANDNAME;</command>
162
144
<group choice="req">
145
<arg choice="plain"><option>--password</option></arg>
163
146
<arg choice="plain"><option>-p</option></arg>
164
<arg choice="plain"><option>--password</option></arg>
165
</group>
166
<group choice="opt">
167
<arg choice="plain"><option>--dir</option>
168
<replaceable>directory</replaceable></arg>
169
</group>
170
<group choice="opt">
171
<arg choice="plain"><option>--name</option>
172
<replaceable>NAME</replaceable></arg>
147
<arg choice="plain"><option>--passfile
148
<replaceable>FILE</replaceable></option></arg>
149
<arg choice="plain"><option>-F</option>
150
<replaceable>FILE</replaceable></arg>
151
</group>
152
<sbr/>
153
<group>
154
<arg choice="plain"><option>--dir
155
<replaceable>DIRECTORY</replaceable></option></arg>
156
<arg choice="plain"><option>-d
157
<replaceable>DIRECTORY</replaceable></option></arg>
158
</group>
159
<sbr/>
160
<group>
161
<arg choice="plain"><option>--name
162
<replaceable>NAME</replaceable></option></arg>
163
<arg choice="plain"><option>-n
164
<replaceable>NAME</replaceable></option></arg>
165
</group>
166
<group>
167
<arg choice="plain"><option>--no-ssh</option></arg>
168
<arg choice="plain"><option>-S</option></arg>
173
169
</group>
174
170
</cmdsynopsis>
175
171
<cmdsynopsis>
176
172
<command>&COMMANDNAME;</command>
177
173
<group choice="req">
174
<arg choice="plain"><option>--help</option></arg>
178
175
<arg choice="plain"><option>-h</option></arg>
179
<arg choice="plain"><option>--help</option></arg>
180
176
</group>
181
177
</cmdsynopsis>
182
178
<cmdsynopsis>
183
179
<command>&COMMANDNAME;</command>
184
180
<group choice="req">
181
<arg choice="plain"><option>--version</option></arg>
185
182
<arg choice="plain"><option>-v</option></arg>
186
<arg choice="plain"><option>--version</option></arg>
187
183
</group>
188
184
</cmdsynopsis>
189
185
</refsynopsisdiv>
190
186
191
187
<refsect1 id="description">
192
188
<title>DESCRIPTION</title>
193
189
<para>
194
190
<command>&COMMANDNAME;</command> is a program to generate the
195
OpenPGP keys used by
196
<citerefentry><refentrytitle>password-request</refentrytitle>
191
TLS and OpenPGP keys used by
192
<citerefentry><refentrytitle>mandos-client</refentrytitle>
197
193
<manvolnum>8mandos</manvolnum></citerefentry>. The keys are
198
normally written to /etc/mandos for later installation into the
199
initrd image, but this, like most things, can be changed with
200
command line options.
194
normally written to /etc/keys/mandos for later installation into
195
the initrd image, but this, and most other things, can be
196
changed with command line options.
201
197
</para>
202
198
<para>
203
It can also be used to generate ready-made sections for
199
This program can also be used with the
200
<option>--password</option> or <option>--passfile</option>
201
options to generate a ready-made section for
202
<filename>clients.conf</filename> (see
204
203
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
205
<manvolnum>5</manvolnum></citerefentry> using the
206
<option>--password</option> option.
204
<manvolnum>5</manvolnum></citerefentry>).
207
205
</para>
208
206
</refsect1>
209
207
210
208
<refsect1 id="purpose">
211
209
<title>PURPOSE</title>
212
213
210
<para>
214
211
The purpose of this is to enable <emphasis>remote and unattended
215
212
rebooting</emphasis> of client host computer with an
216
213
<emphasis>encrypted root file system</emphasis>. See <xref
217
214
linkend="overview"/> for details.
218
215
</para>
219
220
216
</refsect1>
221
217
222
218
<refsect1 id="options">
223
219
<title>OPTIONS</title>
224
220
225
221
<variablelist>
226
222
<varlistentry>
227
<term><literal>-h</literal>, <literal>--help</literal></term>
223
<term><option>--help</option></term>
224
<term><option>-h</option></term>
228
225
<listitem>
229
226
<para>
230
227
Show a help message and exit
231
228
</para>
232
229
</listitem>
233
230
</varlistentry>
234
235
<varlistentry>
236
<term><literal>-d</literal>, <literal>--dir
237
<replaceable>directory</replaceable></literal></term>
238
<listitem>
239
<para>
240
Target directory for key files. Default is
241
<filename>/etc/mandos</filename>.
242
</para>
243
</listitem>
244
</varlistentry>
245
246
<varlistentry>
247
<term><literal>-t</literal>, <literal>--type
248
<replaceable>type</replaceable></literal></term>
249
<listitem>
250
<para>
251
Key type. Default is <quote>DSA</quote>.
252
</para>
253
</listitem>
254
</varlistentry>
255
256
<varlistentry>
257
<term><literal>-l</literal>, <literal>--length
258
<replaceable>bits</replaceable></literal></term>
259
<listitem>
260
<para>
261
Key length in bits. Default is 2048.
262
</para>
263
</listitem>
264
</varlistentry>
265
266
<varlistentry>
267
<term><literal>-s</literal>, <literal>--subtype
268
<replaceable>type</replaceable></literal></term>
269
<listitem>
270
<para>
271
Subkey type. Default is <quote>ELG-E</quote> (Elgamal
272
encryption-only).
273
</para>
274
</listitem>
275
</varlistentry>
276
277
<varlistentry>
278
<term><literal>-L</literal>, <literal>--sublength
279
<replaceable>bits</replaceable></literal></term>
280
<listitem>
281
<para>
282
Subkey length in bits. Default is 2048.
283
</para>
284
</listitem>
285
</varlistentry>
286
287
<varlistentry>
288
<term><literal>-e</literal>, <literal>--email</literal>
289
<replaceable>address</replaceable></term>
231
232
<varlistentry>
233
<term><option>--dir
234
<replaceable>DIRECTORY</replaceable></option></term>
235
<term><option>-d
236
<replaceable>DIRECTORY</replaceable></option></term>
237
<listitem>
238
<para>
239
Target directory for key files. Default is <filename
240
class="directory">/etc/keys/mandos</filename>.
241
</para>
242
</listitem>
243
</varlistentry>
244
245
<varlistentry>
246
<term><option>--type
247
<replaceable>TYPE</replaceable></option></term>
248
<term><option>-t
249
<replaceable>TYPE</replaceable></option></term>
250
<listitem>
251
<para>
252
OpenPGP key type. Default is <quote>RSA</quote>.
253
</para>
254
</listitem>
255
</varlistentry>
256
257
<varlistentry>
258
<term><option>--length
259
<replaceable>BITS</replaceable></option></term>
260
<term><option>-l
261
<replaceable>BITS</replaceable></option></term>
262
<listitem>
263
<para>
264
OpenPGP key length in bits. Default is 4096.
265
</para>
266
</listitem>
267
</varlistentry>
268
269
<varlistentry>
270
<term><option>--subtype
271
<replaceable>KEYTYPE</replaceable></option></term>
272
<term><option>-s
273
<replaceable>KEYTYPE</replaceable></option></term>
274
<listitem>
275
<para>
276
OpenPGP subkey type. Default is <quote>RSA</quote>
277
</para>
278
</listitem>
279
</varlistentry>
280
281
<varlistentry>
282
<term><option>--sublength
283
<replaceable>BITS</replaceable></option></term>
284
<term><option>-L
285
<replaceable>BITS</replaceable></option></term>
286
<listitem>
287
<para>
288
OpenPGP subkey length in bits. Default is 4096.
289
</para>
290
</listitem>
291
</varlistentry>
292
293
<varlistentry>
294
<term><option>--email
295
<replaceable>ADDRESS</replaceable></option></term>
296
<term><option>-e
297
<replaceable>ADDRESS</replaceable></option></term>
290
298
<listitem>
291
299
<para>
292
300
Email address of key. Default is empty.
293
301
</para>
294
302
</listitem>
295
303
</varlistentry>
296
304
297
305
<varlistentry>
298
<term><literal>-c</literal>, <literal>--comment</literal>
299
<replaceable>comment</replaceable></term>
306
<term><option>--comment
307
<replaceable>TEXT</replaceable></option></term>
308
<term><option>-c
309
<replaceable>TEXT</replaceable></option></term>
300
310
<listitem>
301
311
<para>
302
Comment field for key. The default value is
303
<quote><literal>Mandos client key</literal></quote>.
312
Comment field for key. Default is empty.
304
313
</para>
305
314
</listitem>
306
315
</varlistentry>
307
316
308
317
<varlistentry>
309
<term><literal>-x</literal>, <literal>--expire</literal>
310
<replaceable>time</replaceable></term>
318
<term><option>--expire
319
<replaceable>TIME</replaceable></option></term>
320
<term><option>-x
321
<replaceable>TIME</replaceable></option></term>
311
322
<listitem>
312
323
<para>
313
324
Key expire time. Default is no expiration. See
316
327
</para>
317
328
</listitem>
318
329
</varlistentry>
319
320
<varlistentry>
321
<term><literal>-f</literal>, <literal>--force</literal></term>
322
<listitem>
323
<para>
324
Force overwriting old keys.
325
</para>
326
</listitem>
327
</varlistentry>
328
<varlistentry>
329
<term><literal>-p</literal>, <literal>--password</literal
330
></term>
330
331
<varlistentry>
332
<term><option>--tls-keytype
333
<replaceable>KEYTYPE</replaceable></option></term>
334
<term><option>-T
335
<replaceable>KEYTYPE</replaceable></option></term>
336
<listitem>
337
<para>
338
TLS key type. Default is <quote>ed25519</quote>
339
</para>
340
</listitem>
341
</varlistentry>
342
343
<varlistentry>
344
<term><option>--force</option></term>
345
<term><option>-f</option></term>
346
<listitem>
347
<para>
348
Force overwriting old key.
349
</para>
350
</listitem>
351
</varlistentry>
352
<varlistentry>
353
<term><option>--password</option></term>
354
<term><option>-p</option></term>
331
355
<listitem>
332
356
<para>
333
357
Prompt for a password and encrypt it with the key already
334
present in either <filename>/etc/mandos</filename> or the
335
directory specified with the <option>--dir</option>
358
present in either <filename>/etc/keys/mandos</filename> or
359
the directory specified with the <option>--dir</option>
336
360
option. Outputs, on standard output, a section suitable
337
361
for inclusion in <citerefentry><refentrytitle
338
362
>mandos-clients.conf</refentrytitle><manvolnum
339
363
>8</manvolnum></citerefentry>. The host name or the name
340
364
specified with the <option>--name</option> option is used
341
365
for the section header. All other options are ignored,
342
and no keys are created.
366
and no key is created. Note: white space is stripped from
367
the beginning and from the end of the password; See <xref
368
linkend="bugs"/>.
369
</para>
370
</listitem>
371
</varlistentry>
372
<varlistentry>
373
<term><option>--passfile
374
<replaceable>FILE</replaceable></option></term>
375
<term><option>-F
376
<replaceable>FILE</replaceable></option></term>
377
<listitem>
378
<para>
379
The same as <option>--password</option>, but read from
380
<replaceable>FILE</replaceable>, not the terminal, and
381
white space is not stripped from the password in any way.
382
</para>
383
</listitem>
384
</varlistentry>
385
<varlistentry>
386
<term><option>--no-ssh</option></term>
387
<term><option>-S</option></term>
388
<listitem>
389
<para>
390
When <option>--password</option> or
391
<option>--passfile</option> is given, this option will
392
prevent <command>&COMMANDNAME;</command> from calling
393
<command>ssh-keyscan</command> to get an SSH fingerprint
394
for this host and, if successful, output suitable config
395
options to use this fingerprint as a
396
<option>checker</option> option in the output. This is
397
otherwise the default behavior.
343
398
</para>
344
399
</listitem>
345
400
</varlistentry>
346
401
</variablelist>
347
402
</refsect1>
348
403
349
404
<refsect1 id="overview">
350
405
<title>OVERVIEW</title>
351
406
<xi:include href="overview.xml"/>
352
407
<para>
353
This program is a small utility to generate new OpenPGP keys for
354
new Mandos clients.
408
This program is a small utility to generate new TLS and OpenPGP
409
keys for new Mandos clients, and to generate sections for
410
inclusion in <filename>clients.conf</filename> on the server.
355
411
</para>
356
412
</refsect1>
357
413
358
414
<refsect1 id="exit_status">
359
415
<title>EXIT STATUS</title>
360
416
<para>
361
The exit status will be 0 if new keys were successfully created,
362
otherwise not.
417
The exit status will be 0 if a new key (or password, if the
418
<option>--password</option> option was used) was successfully
419
created, otherwise not.
363
420
</para>
364
421
</refsect1>
365
422
379
436
</variablelist>
380
437
</refsect1>
381
438
382
<refsect1 id="file">
439
<refsect1 id="files">
383
440
<title>FILES</title>
384
441
<para>
385
442
Use the <option>--dir</option> option to change where
388
445
</para>
389
446
<variablelist>
390
447
<varlistentry>
391
<term><filename>/etc/mandos/seckey.txt</filename></term>
448
<term><filename>/etc/keys/mandos/seckey.txt</filename></term>
392
449
<listitem>
393
450
<para>
394
451
OpenPGP secret key file which will be created or
397
454
</listitem>
398
455
</varlistentry>
399
456
<varlistentry>
400
<term><filename>/etc/mandos/pubkey.txt</filename></term>
457
<term><filename>/etc/keys/mandos/pubkey.txt</filename></term>
401
458
<listitem>
402
459
<para>
403
460
OpenPGP public key file which will be created or
406
463
</listitem>
407
464
</varlistentry>
408
465
<varlistentry>
409
<term><filename>/tmp</filename></term>
466
<term><filename>/etc/keys/mandos/tls-privkey.pem</filename></term>
467
<listitem>
468
<para>
469
Private key file which will be created or overwritten.
470
</para>
471
</listitem>
472
</varlistentry>
473
<varlistentry>
474
<term><filename>/etc/keys/mandos/tls-pubkey.pem</filename></term>
475
<listitem>
476
<para>
477
Public key file which will be created or overwritten.
478
</para>
479
</listitem>
480
</varlistentry>
481
<varlistentry>
482
<term><filename class="directory">/tmp</filename></term>
410
483
<listitem>
411
484
<para>
412
485
Temporary files will be written here if
416
489
</varlistentry>
417
490
</variablelist>
418
491
</refsect1>
419
492
420
493
<refsect1 id="bugs">
421
494
<title>BUGS</title>
422
495
<para>
423
None are known at this time.
496
The <option>--password</option>/<option>-p</option> option
497
strips white space from the start and from the end of the
498
password before using it. If this is a problem, use the
499
<option>--passfile</option> option instead, which does not do
500
this.
424
501
</para>
502
<xi:include href="bugs.xml"/>
425
503
</refsect1>
426
504
427
505
<refsect1 id="example">
428
506
<title>EXAMPLE</title>
429
507
<informalexample>
436
514
</informalexample>
437
515
<informalexample>
438
516
<para>
439
Create keys in another directory and of another type. Force
517
Create key in another directory and of another type. Force
440
518
overwriting old key files:
441
519
</para>
442
520
<para>
446
524
447
525
</para>
448
526
</informalexample>
527
<informalexample>
528
<para>
529
Prompt for a password, encrypt it with the keys in <filename
530
class="directory">/etc/keys/mandos</filename> and output a
531
section suitable for <filename>clients.conf</filename>.
532
</para>
533
<para>
534
<userinput>&COMMANDNAME; --password</userinput>
535
</para>
536
</informalexample>
537
<informalexample>
538
<para>
539
Prompt for a password, encrypt it with the keys in the
540
<filename>client-key</filename> directory and output a section
541
suitable for <filename>clients.conf</filename>.
542
</para>
543
<para>
544
545
<!-- do not wrap this line -->
546
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
547
548
</para>
549
</informalexample>
449
550
</refsect1>
450
551
451
552
<refsect1 id="security">
452
553
<title>SECURITY</title>
453
554
<para>
454
555
The <option>--type</option>, <option>--length</option>,
455
556
<option>--subtype</option>, and <option>--sublength</option>
456
options can be used to create keys of insufficient security. If
457
in doubt, leave them to the default values.
557
options can be used to create keys of low security. If in
558
doubt, leave them to the default values.
458
559
</para>
459
560
<para>
460
The key expire time is not guaranteed to be honored by
461
<citerefentry><refentrytitle>mandos</refentrytitle>
561
The key expire time is <emphasis>not</emphasis> guaranteed to be
562
honored by <citerefentry><refentrytitle>mandos</refentrytitle>
462
563
<manvolnum>8</manvolnum></citerefentry>.
463
564
</para>
464
565
</refsect1>
465
566
466
567
<refsect1 id="see_also">
467
568
<title>SEE ALSO</title>
468
569
<para>
570
<citerefentry><refentrytitle>intro</refentrytitle>
571
<manvolnum>8mandos</manvolnum></citerefentry>,
469
572
<citerefentry><refentrytitle>gpg</refentrytitle>
470
573
<manvolnum>1</manvolnum></citerefentry>,
574
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
575
<manvolnum>5</manvolnum></citerefentry>,
471
576
<citerefentry><refentrytitle>mandos</refentrytitle>
472
577
<manvolnum>8</manvolnum></citerefentry>,
473
<citerefentry><refentrytitle>password-request</refentrytitle>
474
<manvolnum>8mandos</manvolnum></citerefentry>
578
<citerefentry><refentrytitle>mandos-client</refentrytitle>
579
<manvolnum>8mandos</manvolnum></citerefentry>,
580
<citerefentry><refentrytitle>ssh-keyscan</refentrytitle>
581
<manvolnum>1</manvolnum></citerefentry>
475
582
</para>
476
583
</refsect1>
477
584
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0