/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-keygen.xml

  • Committer: Teddy Hogeborn
  • Date: 2008-07-20 06:33:48 UTC
  • Revision ID: teddy@fukt.bsnet.se-20080720063348-jscgy5p0itrgvlo8
* mandos-clients.conf ([foo]): Uncommented.
  ([foo]/secret): New.
  ([foo]/secfile): Commented out.
  ([foo]/checker): Changed to "fping -q -- %%(fqdn)s".
  ([foo]/timeout): New.

* server.py: New modeline for Python and Emacs.  Set a logging format.
  (Client.__init__): Bug fix: Choose either the value from the options
                     object or pass the argument through string_to_delta
                     for both "timeout" and "interval".
  (Client.checker_callback): Bug fix: Do not log spurious "Checker for
                             <foo> failed" messages.
  (Client.start_checker): Moved "Starting checker" log message down to
                          just before actually starting the subprocess.
                          Do not redirect the subprocesses' stdout to a
                          pipe.
  (peer_certificate, fingerprint): Added docstrings.
  (entry_group_state_changed): Call "killme()" instead of
                               "main_loop.quit()".
  (daemon, killme): New functions.
  (exitstatus, main_loop_started): New global variables.
  (__main__): Removed the "--cert", "--key", "--ca", and "--crl"
              options.  Removed the sleep command from the default
              checker.  Add a console logger in debug mode.  Call
              "killme()" instead of "main_loop.quit()" when there are no
              more clients.  Call "daemon()" if not in debug mode.
              Register "cleanup()" to run at exit.  Ignore some
              signals.  Catch DBusException to detect another running
              server and exit cleanly.  Exit with "exitstatus".
  (cleanup): New function.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-keygen.xml
1
 
<?xml version="1.0" encoding="UTF-8"?>
2
 
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
 
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
 
<!ENTITY COMMANDNAME "mandos-keygen">
5
 
<!ENTITY TIMESTAMP "2012-01-01">
6
 
<!ENTITY % common SYSTEM "common.ent">
7
 
%common;
8
 
]>
9
 
 
10
 
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
11
 
  <refentryinfo>
12
 
    <title>Mandos Manual</title>
13
 
    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
14
 
    <productname>Mandos</productname>
15
 
    <productnumber>&version;</productnumber>
16
 
    <date>&TIMESTAMP;</date>
17
 
    <authorgroup>
18
 
      <author>
19
 
        <firstname>Björn</firstname>
20
 
        <surname>Påhlsson</surname>
21
 
        <address>
22
 
          <email>belorn@recompile.se</email>
23
 
        </address>
24
 
      </author>
25
 
      <author>
26
 
        <firstname>Teddy</firstname>
27
 
        <surname>Hogeborn</surname>
28
 
        <address>
29
 
          <email>teddy@recompile.se</email>
30
 
        </address>
31
 
      </author>
32
 
    </authorgroup>
33
 
    <copyright>
34
 
      <year>2008</year>
35
 
      <year>2009</year>
36
 
      <year>2011</year>
37
 
      <year>2012</year>
38
 
      <holder>Teddy Hogeborn</holder>
39
 
      <holder>Björn Påhlsson</holder>
40
 
    </copyright>
41
 
    <xi:include href="legalnotice.xml"/>
42
 
  </refentryinfo>
43
 
  
44
 
  <refmeta>
45
 
    <refentrytitle>&COMMANDNAME;</refentrytitle>
46
 
    <manvolnum>8</manvolnum>
47
 
  </refmeta>
48
 
  
49
 
  <refnamediv>
50
 
    <refname><command>&COMMANDNAME;</command></refname>
51
 
    <refpurpose>
52
 
      Generate key and password for Mandos client and server.
53
 
    </refpurpose>
54
 
  </refnamediv>
55
 
  
56
 
  <refsynopsisdiv>
57
 
    <cmdsynopsis>
58
 
      <command>&COMMANDNAME;</command>
59
 
      <group>
60
 
        <arg choice="plain"><option>--dir
61
 
        <replaceable>DIRECTORY</replaceable></option></arg>
62
 
        <arg choice="plain"><option>-d
63
 
        <replaceable>DIRECTORY</replaceable></option></arg>
64
 
      </group>
65
 
      <sbr/>
66
 
      <group>
67
 
        <arg choice="plain"><option>--type
68
 
        <replaceable>KEYTYPE</replaceable></option></arg>
69
 
        <arg choice="plain"><option>-t
70
 
        <replaceable>KEYTYPE</replaceable></option></arg>
71
 
      </group>
72
 
      <sbr/>
73
 
      <group>
74
 
        <arg choice="plain"><option>--length
75
 
        <replaceable>BITS</replaceable></option></arg>
76
 
        <arg choice="plain"><option>-l
77
 
        <replaceable>BITS</replaceable></option></arg>
78
 
      </group>
79
 
      <sbr/>
80
 
      <group>
81
 
        <arg choice="plain"><option>--subtype
82
 
        <replaceable>KEYTYPE</replaceable></option></arg>
83
 
        <arg choice="plain"><option>-s
84
 
        <replaceable>KEYTYPE</replaceable></option></arg>
85
 
      </group>
86
 
      <sbr/>
87
 
      <group>
88
 
        <arg choice="plain"><option>--sublength
89
 
        <replaceable>BITS</replaceable></option></arg>
90
 
        <arg choice="plain"><option>-L
91
 
        <replaceable>BITS</replaceable></option></arg>
92
 
      </group>
93
 
      <sbr/>
94
 
      <group>
95
 
        <arg choice="plain"><option>--name
96
 
        <replaceable>NAME</replaceable></option></arg>
97
 
        <arg choice="plain"><option>-n
98
 
        <replaceable>NAME</replaceable></option></arg>
99
 
      </group>
100
 
      <sbr/>
101
 
      <group>
102
 
        <arg choice="plain"><option>--email
103
 
        <replaceable>ADDRESS</replaceable></option></arg>
104
 
        <arg choice="plain"><option>-e
105
 
        <replaceable>ADDRESS</replaceable></option></arg>
106
 
      </group>
107
 
      <sbr/>
108
 
      <group>
109
 
        <arg choice="plain"><option>--comment
110
 
        <replaceable>TEXT</replaceable></option></arg>
111
 
        <arg choice="plain"><option>-c
112
 
        <replaceable>TEXT</replaceable></option></arg>
113
 
      </group>
114
 
      <sbr/>
115
 
      <group>
116
 
        <arg choice="plain"><option>--expire
117
 
        <replaceable>TIME</replaceable></option></arg>
118
 
        <arg choice="plain"><option>-x
119
 
        <replaceable>TIME</replaceable></option></arg>
120
 
      </group>
121
 
      <sbr/>
122
 
      <arg><option>--force</option></arg>
123
 
    </cmdsynopsis>
124
 
    <cmdsynopsis>
125
 
      <command>&COMMANDNAME;</command>
126
 
      <group choice="req">
127
 
        <arg choice="plain"><option>--password</option></arg>
128
 
        <arg choice="plain"><option>-p</option></arg>
129
 
        <arg choice="plain"><option>--passfile
130
 
        <replaceable>FILE</replaceable></option></arg>
131
 
        <arg choice="plain"><option>-F</option>
132
 
        <replaceable>FILE</replaceable></arg>
133
 
      </group>
134
 
      <sbr/>
135
 
      <group>
136
 
        <arg choice="plain"><option>--dir
137
 
        <replaceable>DIRECTORY</replaceable></option></arg>
138
 
        <arg choice="plain"><option>-d
139
 
        <replaceable>DIRECTORY</replaceable></option></arg>
140
 
      </group>
141
 
      <sbr/>
142
 
      <group>
143
 
        <arg choice="plain"><option>--name
144
 
        <replaceable>NAME</replaceable></option></arg>
145
 
        <arg choice="plain"><option>-n
146
 
        <replaceable>NAME</replaceable></option></arg>
147
 
      </group>
148
 
    </cmdsynopsis>
149
 
    <cmdsynopsis>
150
 
      <command>&COMMANDNAME;</command>
151
 
      <group choice="req">
152
 
        <arg choice="plain"><option>--help</option></arg>
153
 
        <arg choice="plain"><option>-h</option></arg>
154
 
      </group>
155
 
    </cmdsynopsis>
156
 
    <cmdsynopsis>
157
 
      <command>&COMMANDNAME;</command>
158
 
      <group choice="req">
159
 
        <arg choice="plain"><option>--version</option></arg>
160
 
        <arg choice="plain"><option>-v</option></arg>
161
 
      </group>
162
 
    </cmdsynopsis>
163
 
  </refsynopsisdiv>
164
 
  
165
 
  <refsect1 id="description">
166
 
    <title>DESCRIPTION</title>
167
 
    <para>
168
 
      <command>&COMMANDNAME;</command> is a program to generate the
169
 
      OpenPGP key used by
170
 
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
171
 
      <manvolnum>8mandos</manvolnum></citerefentry>.  The key is
172
 
      normally written to /etc/mandos for later installation into the
173
 
      initrd image, but this, and most other things, can be changed
174
 
      with command line options.
175
 
    </para>
176
 
    <para>
177
 
      This program can also be used with the
178
 
      <option>--password</option> or <option>--passfile</option>
179
 
      options to generate a ready-made section for
180
 
      <filename>clients.conf</filename> (see
181
 
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
182
 
      <manvolnum>5</manvolnum></citerefentry>).
183
 
    </para>
184
 
  </refsect1>
185
 
  
186
 
  <refsect1 id="purpose">
187
 
    <title>PURPOSE</title>
188
 
    <para>
189
 
      The purpose of this is to enable <emphasis>remote and unattended
190
 
      rebooting</emphasis> of client host computer with an
191
 
      <emphasis>encrypted root file system</emphasis>.  See <xref
192
 
      linkend="overview"/> for details.
193
 
    </para>
194
 
  </refsect1>
195
 
  
196
 
  <refsect1 id="options">
197
 
    <title>OPTIONS</title>
198
 
    
199
 
    <variablelist>
200
 
      <varlistentry>
201
 
        <term><option>--help</option></term>
202
 
        <term><option>-h</option></term>
203
 
        <listitem>
204
 
          <para>
205
 
            Show a help message and exit
206
 
          </para>
207
 
        </listitem>
208
 
      </varlistentry>
209
 
      
210
 
      <varlistentry>
211
 
        <term><option>--dir
212
 
        <replaceable>DIRECTORY</replaceable></option></term>
213
 
        <term><option>-d
214
 
        <replaceable>DIRECTORY</replaceable></option></term>
215
 
        <listitem>
216
 
          <para>
217
 
            Target directory for key files.  Default is
218
 
            <filename class="directory">/etc/mandos</filename>.
219
 
          </para>
220
 
        </listitem>
221
 
      </varlistentry>
222
 
      
223
 
      <varlistentry>
224
 
        <term><option>--type
225
 
        <replaceable>TYPE</replaceable></option></term>
226
 
        <term><option>-t
227
 
        <replaceable>TYPE</replaceable></option></term>
228
 
        <listitem>
229
 
          <para>
230
 
            Key type.  Default is <quote>DSA</quote>.
231
 
          </para>
232
 
        </listitem>
233
 
      </varlistentry>
234
 
      
235
 
      <varlistentry>
236
 
        <term><option>--length
237
 
        <replaceable>BITS</replaceable></option></term>
238
 
        <term><option>-l
239
 
        <replaceable>BITS</replaceable></option></term>
240
 
        <listitem>
241
 
          <para>
242
 
            Key length in bits.  Default is 2048.
243
 
          </para>
244
 
        </listitem>
245
 
      </varlistentry>
246
 
      
247
 
      <varlistentry>
248
 
        <term><option>--subtype
249
 
        <replaceable>KEYTYPE</replaceable></option></term>
250
 
        <term><option>-s
251
 
        <replaceable>KEYTYPE</replaceable></option></term>
252
 
        <listitem>
253
 
          <para>
254
 
            Subkey type.  Default is <quote>ELG-E</quote> (Elgamal
255
 
            encryption-only).
256
 
          </para>
257
 
        </listitem>
258
 
      </varlistentry>
259
 
      
260
 
      <varlistentry>
261
 
        <term><option>--sublength
262
 
        <replaceable>BITS</replaceable></option></term>
263
 
        <term><option>-L
264
 
        <replaceable>BITS</replaceable></option></term>
265
 
        <listitem>
266
 
          <para>
267
 
            Subkey length in bits.  Default is 2048.
268
 
          </para>
269
 
        </listitem>
270
 
      </varlistentry>
271
 
      
272
 
      <varlistentry>
273
 
        <term><option>--email
274
 
        <replaceable>ADDRESS</replaceable></option></term>
275
 
        <term><option>-e
276
 
        <replaceable>ADDRESS</replaceable></option></term>
277
 
        <listitem>
278
 
          <para>
279
 
            Email address of key.  Default is empty.
280
 
          </para>
281
 
        </listitem>
282
 
      </varlistentry>
283
 
      
284
 
      <varlistentry>
285
 
        <term><option>--comment
286
 
        <replaceable>TEXT</replaceable></option></term>
287
 
        <term><option>-c
288
 
        <replaceable>TEXT</replaceable></option></term>
289
 
        <listitem>
290
 
          <para>
291
 
            Comment field for key.  The default value is
292
 
            <quote><literal>Mandos client key</literal></quote>.
293
 
          </para>
294
 
        </listitem>
295
 
      </varlistentry>
296
 
      
297
 
      <varlistentry>
298
 
        <term><option>--expire
299
 
        <replaceable>TIME</replaceable></option></term>
300
 
        <term><option>-x
301
 
        <replaceable>TIME</replaceable></option></term>
302
 
        <listitem>
303
 
          <para>
304
 
            Key expire time.  Default is no expiration.  See
305
 
            <citerefentry><refentrytitle>gpg</refentrytitle>
306
 
            <manvolnum>1</manvolnum></citerefentry> for syntax.
307
 
          </para>
308
 
        </listitem>
309
 
      </varlistentry>
310
 
      
311
 
      <varlistentry>
312
 
        <term><option>--force</option></term>
313
 
        <term><option>-f</option></term>
314
 
        <listitem>
315
 
          <para>
316
 
            Force overwriting old key.
317
 
          </para>
318
 
        </listitem>
319
 
      </varlistentry>
320
 
      <varlistentry>
321
 
        <term><option>--password</option></term>
322
 
        <term><option>-p</option></term>
323
 
        <listitem>
324
 
          <para>
325
 
            Prompt for a password and encrypt it with the key already
326
 
            present in either <filename>/etc/mandos</filename> or the
327
 
            directory specified with the <option>--dir</option>
328
 
            option.  Outputs, on standard output, a section suitable
329
 
            for inclusion in <citerefentry><refentrytitle
330
 
            >mandos-clients.conf</refentrytitle><manvolnum
331
 
            >8</manvolnum></citerefentry>.  The host name or the name
332
 
            specified with the <option>--name</option> option is used
333
 
            for the section header.  All other options are ignored,
334
 
            and no key is created.
335
 
          </para>
336
 
        </listitem>
337
 
      </varlistentry>
338
 
      <varlistentry>
339
 
        <term><option>--passfile
340
 
        <replaceable>FILE</replaceable></option></term>
341
 
        <term><option>-F
342
 
        <replaceable>FILE</replaceable></option></term>
343
 
        <listitem>
344
 
          <para>
345
 
            The same as <option>--password</option>, but read from
346
 
            <replaceable>FILE</replaceable>, not the terminal.
347
 
          </para>
348
 
        </listitem>
349
 
      </varlistentry>
350
 
    </variablelist>
351
 
  </refsect1>
352
 
  
353
 
  <refsect1 id="overview">
354
 
    <title>OVERVIEW</title>
355
 
    <xi:include href="overview.xml"/>
356
 
    <para>
357
 
      This program is a small utility to generate new OpenPGP keys for
358
 
      new Mandos clients, and to generate sections for inclusion in
359
 
      <filename>clients.conf</filename> on the server.
360
 
    </para>
361
 
  </refsect1>
362
 
  
363
 
  <refsect1 id="exit_status">
364
 
    <title>EXIT STATUS</title>
365
 
    <para>
366
 
      The exit status will be 0 if a new key (or password, if the
367
 
      <option>--password</option> option was used) was successfully
368
 
      created, otherwise not.
369
 
    </para>
370
 
  </refsect1>
371
 
  
372
 
  <refsect1 id="environment">
373
 
    <title>ENVIRONMENT</title>
374
 
    <variablelist>
375
 
      <varlistentry>
376
 
        <term><envar>TMPDIR</envar></term>
377
 
        <listitem>
378
 
          <para>
379
 
            If set, temporary files will be created here. See
380
 
            <citerefentry><refentrytitle>mktemp</refentrytitle>
381
 
            <manvolnum>1</manvolnum></citerefentry>.
382
 
          </para>
383
 
        </listitem>
384
 
      </varlistentry>
385
 
    </variablelist>
386
 
  </refsect1>
387
 
  
388
 
  <refsect1 id="files">
389
 
    <title>FILES</title>
390
 
    <para>
391
 
      Use the <option>--dir</option> option to change where
392
 
      <command>&COMMANDNAME;</command> will write the key files.  The
393
 
      default file names are shown here.
394
 
    </para>
395
 
    <variablelist>
396
 
      <varlistentry>
397
 
        <term><filename>/etc/mandos/seckey.txt</filename></term>
398
 
        <listitem>
399
 
          <para>
400
 
            OpenPGP secret key file which will be created or
401
 
            overwritten.
402
 
          </para>
403
 
        </listitem>
404
 
      </varlistentry>
405
 
      <varlistentry>
406
 
        <term><filename>/etc/mandos/pubkey.txt</filename></term>
407
 
        <listitem>
408
 
          <para>
409
 
            OpenPGP public key file which will be created or
410
 
            overwritten.
411
 
          </para>
412
 
        </listitem>
413
 
      </varlistentry>
414
 
      <varlistentry>
415
 
        <term><filename class="directory">/tmp</filename></term>
416
 
        <listitem>
417
 
          <para>
418
 
            Temporary files will be written here if
419
 
            <varname>TMPDIR</varname> is not set.
420
 
          </para>
421
 
        </listitem>
422
 
      </varlistentry>
423
 
    </variablelist>
424
 
  </refsect1>
425
 
  
426
 
<!--   <refsect1 id="bugs"> -->
427
 
<!--     <title>BUGS</title> -->
428
 
<!--     <para> -->
429
 
<!--     </para> -->
430
 
<!--   </refsect1> -->
431
 
  
432
 
  <refsect1 id="example">
433
 
    <title>EXAMPLE</title>
434
 
    <informalexample>
435
 
      <para>
436
 
        Normal invocation needs no options:
437
 
      </para>
438
 
      <para>
439
 
        <userinput>&COMMANDNAME;</userinput>
440
 
      </para>
441
 
    </informalexample>
442
 
    <informalexample>
443
 
      <para>
444
 
        Create key in another directory and of another type.  Force
445
 
        overwriting old key files:
446
 
      </para>
447
 
      <para>
448
 
 
449
 
<!-- do not wrap this line -->
450
 
<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>
451
 
 
452
 
      </para>
453
 
    </informalexample>
454
 
    <informalexample>
455
 
      <para>
456
 
        Prompt for a password, encrypt it with the key in <filename
457
 
        class="directory">/etc/mandos</filename> and output a section
458
 
        suitable for <filename>clients.conf</filename>.
459
 
      </para>
460
 
      <para>
461
 
        <userinput>&COMMANDNAME; --password</userinput>
462
 
      </para>
463
 
    </informalexample>
464
 
    <informalexample>
465
 
      <para>
466
 
        Prompt for a password, encrypt it with the key in the
467
 
        <filename>client-key</filename> directory and output a section
468
 
        suitable for <filename>clients.conf</filename>.
469
 
      </para>
470
 
      <para>
471
 
 
472
 
<!-- do not wrap this line -->
473
 
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
474
 
 
475
 
      </para>
476
 
    </informalexample>
477
 
  </refsect1>
478
 
  
479
 
  <refsect1 id="security">
480
 
    <title>SECURITY</title>
481
 
    <para>
482
 
      The <option>--type</option>, <option>--length</option>,
483
 
      <option>--subtype</option>, and <option>--sublength</option>
484
 
      options can be used to create keys of low security.  If in
485
 
      doubt, leave them to the default values.
486
 
    </para>
487
 
    <para>
488
 
      The key expire time is <emphasis>not</emphasis> guaranteed to be
489
 
      honored by <citerefentry><refentrytitle>mandos</refentrytitle>
490
 
      <manvolnum>8</manvolnum></citerefentry>.
491
 
    </para>
492
 
  </refsect1>
493
 
  
494
 
  <refsect1 id="see_also">
495
 
    <title>SEE ALSO</title>
496
 
    <para>
497
 
      <citerefentry><refentrytitle>intro</refentrytitle>
498
 
      <manvolnum>8mandos</manvolnum></citerefentry>,
499
 
      <citerefentry><refentrytitle>gpg</refentrytitle>
500
 
      <manvolnum>1</manvolnum></citerefentry>,
501
 
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
502
 
      <manvolnum>5</manvolnum></citerefentry>,
503
 
      <citerefentry><refentrytitle>mandos</refentrytitle>
504
 
      <manvolnum>8</manvolnum></citerefentry>,
505
 
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
506
 
      <manvolnum>8mandos</manvolnum></citerefentry>
507
 
    </para>
508
 
  </refsect1>
509
 
  
510
 
</refentry>
511
 
<!-- Local Variables: -->
512
 
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
513
 
<!-- time-stamp-end: "[\"']>" -->
514
 
<!-- time-stamp-format: "%:y-%02m-%02d" -->
515
 
<!-- End: -->