/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-keygen.xml

  • Committer: Teddy Hogeborn
  • Date: 2008-07-20 06:33:48 UTC
  • Revision ID: teddy@fukt.bsnet.se-20080720063348-jscgy5p0itrgvlo8
* mandos-clients.conf ([foo]): Uncommented.
  ([foo]/secret): New.
  ([foo]/secfile): Commented out.
  ([foo]/checker): Changed to "fping -q -- %%(fqdn)s".
  ([foo]/timeout): New.

* server.py: New modeline for Python and Emacs.  Set a logging format.
  (Client.__init__): Bug fix: Choose either the value from the options
                     object or pass the argument through string_to_delta
                     for both "timeout" and "interval".
  (Client.checker_callback): Bug fix: Do not log spurious "Checker for
                             <foo> failed" messages.
  (Client.start_checker): Moved "Starting checker" log message down to
                          just before actually starting the subprocess.
                          Do not redirect the subprocesses' stdout to a
                          pipe.
  (peer_certificate, fingerprint): Added docstrings.
  (entry_group_state_changed): Call "killme()" instead of
                               "main_loop.quit()".
  (daemon, killme): New functions.
  (exitstatus, main_loop_started): New global variables.
  (__main__): Removed the "--cert", "--key", "--ca", and "--crl"
              options.  Removed the sleep command from the default
              checker.  Add a console logger in debug mode.  Call
              "killme()" instead of "main_loop.quit()" when there are no
              more clients.  Call "daemon()" if not in debug mode.
              Register "cleanup()" to run at exit.  Ignore some
              signals.  Catch DBusException to detect another running
              server and exit cleanly.  Exit with "exitstatus".
  (cleanup): New function.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-keygen.xml
1
 
<?xml version="1.0" encoding="UTF-8"?>
2
 
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
 
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
 
<!ENTITY COMMANDNAME "mandos-keygen">
5
 
<!ENTITY TIMESTAMP "2016-02-28">
6
 
<!ENTITY % common SYSTEM "common.ent">
7
 
%common;
8
 
]>
9
 
 
10
 
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
11
 
  <refentryinfo>
12
 
    <title>Mandos Manual</title>
13
 
    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
14
 
    <productname>Mandos</productname>
15
 
    <productnumber>&version;</productnumber>
16
 
    <date>&TIMESTAMP;</date>
17
 
    <authorgroup>
18
 
      <author>
19
 
        <firstname>Björn</firstname>
20
 
        <surname>Påhlsson</surname>
21
 
        <address>
22
 
          <email>belorn@recompile.se</email>
23
 
        </address>
24
 
      </author>
25
 
      <author>
26
 
        <firstname>Teddy</firstname>
27
 
        <surname>Hogeborn</surname>
28
 
        <address>
29
 
          <email>teddy@recompile.se</email>
30
 
        </address>
31
 
      </author>
32
 
    </authorgroup>
33
 
    <copyright>
34
 
      <year>2008</year>
35
 
      <year>2009</year>
36
 
      <year>2010</year>
37
 
      <year>2011</year>
38
 
      <year>2012</year>
39
 
      <year>2013</year>
40
 
      <year>2014</year>
41
 
      <year>2015</year>
42
 
      <year>2016</year>
43
 
      <holder>Teddy Hogeborn</holder>
44
 
      <holder>Björn Påhlsson</holder>
45
 
    </copyright>
46
 
    <xi:include href="legalnotice.xml"/>
47
 
  </refentryinfo>
48
 
  
49
 
  <refmeta>
50
 
    <refentrytitle>&COMMANDNAME;</refentrytitle>
51
 
    <manvolnum>8</manvolnum>
52
 
  </refmeta>
53
 
  
54
 
  <refnamediv>
55
 
    <refname><command>&COMMANDNAME;</command></refname>
56
 
    <refpurpose>
57
 
      Generate key and password for Mandos client and server.
58
 
    </refpurpose>
59
 
  </refnamediv>
60
 
  
61
 
  <refsynopsisdiv>
62
 
    <cmdsynopsis>
63
 
      <command>&COMMANDNAME;</command>
64
 
      <group>
65
 
        <arg choice="plain"><option>--dir
66
 
        <replaceable>DIRECTORY</replaceable></option></arg>
67
 
        <arg choice="plain"><option>-d
68
 
        <replaceable>DIRECTORY</replaceable></option></arg>
69
 
      </group>
70
 
      <sbr/>
71
 
      <group>
72
 
        <arg choice="plain"><option>--type
73
 
        <replaceable>KEYTYPE</replaceable></option></arg>
74
 
        <arg choice="plain"><option>-t
75
 
        <replaceable>KEYTYPE</replaceable></option></arg>
76
 
      </group>
77
 
      <sbr/>
78
 
      <group>
79
 
        <arg choice="plain"><option>--length
80
 
        <replaceable>BITS</replaceable></option></arg>
81
 
        <arg choice="plain"><option>-l
82
 
        <replaceable>BITS</replaceable></option></arg>
83
 
      </group>
84
 
      <sbr/>
85
 
      <group>
86
 
        <arg choice="plain"><option>--subtype
87
 
        <replaceable>KEYTYPE</replaceable></option></arg>
88
 
        <arg choice="plain"><option>-s
89
 
        <replaceable>KEYTYPE</replaceable></option></arg>
90
 
      </group>
91
 
      <sbr/>
92
 
      <group>
93
 
        <arg choice="plain"><option>--sublength
94
 
        <replaceable>BITS</replaceable></option></arg>
95
 
        <arg choice="plain"><option>-L
96
 
        <replaceable>BITS</replaceable></option></arg>
97
 
      </group>
98
 
      <sbr/>
99
 
      <group>
100
 
        <arg choice="plain"><option>--name
101
 
        <replaceable>NAME</replaceable></option></arg>
102
 
        <arg choice="plain"><option>-n
103
 
        <replaceable>NAME</replaceable></option></arg>
104
 
      </group>
105
 
      <sbr/>
106
 
      <group>
107
 
        <arg choice="plain"><option>--email
108
 
        <replaceable>ADDRESS</replaceable></option></arg>
109
 
        <arg choice="plain"><option>-e
110
 
        <replaceable>ADDRESS</replaceable></option></arg>
111
 
      </group>
112
 
      <sbr/>
113
 
      <group>
114
 
        <arg choice="plain"><option>--comment
115
 
        <replaceable>TEXT</replaceable></option></arg>
116
 
        <arg choice="plain"><option>-c
117
 
        <replaceable>TEXT</replaceable></option></arg>
118
 
      </group>
119
 
      <sbr/>
120
 
      <group>
121
 
        <arg choice="plain"><option>--expire
122
 
        <replaceable>TIME</replaceable></option></arg>
123
 
        <arg choice="plain"><option>-x
124
 
        <replaceable>TIME</replaceable></option></arg>
125
 
      </group>
126
 
      <sbr/>
127
 
      <group>
128
 
        <arg choice="plain"><option>--force</option></arg>
129
 
        <arg choice="plain"><option>-f</option></arg>
130
 
      </group>
131
 
    </cmdsynopsis>
132
 
    <cmdsynopsis>
133
 
      <command>&COMMANDNAME;</command>
134
 
      <group choice="req">
135
 
        <arg choice="plain"><option>--password</option></arg>
136
 
        <arg choice="plain"><option>-p</option></arg>
137
 
        <arg choice="plain"><option>--passfile
138
 
        <replaceable>FILE</replaceable></option></arg>
139
 
        <arg choice="plain"><option>-F</option>
140
 
        <replaceable>FILE</replaceable></arg>
141
 
      </group>
142
 
      <sbr/>
143
 
      <group>
144
 
        <arg choice="plain"><option>--dir
145
 
        <replaceable>DIRECTORY</replaceable></option></arg>
146
 
        <arg choice="plain"><option>-d
147
 
        <replaceable>DIRECTORY</replaceable></option></arg>
148
 
      </group>
149
 
      <sbr/>
150
 
      <group>
151
 
        <arg choice="plain"><option>--name
152
 
        <replaceable>NAME</replaceable></option></arg>
153
 
        <arg choice="plain"><option>-n
154
 
        <replaceable>NAME</replaceable></option></arg>
155
 
      </group>
156
 
      <group>
157
 
        <arg choice="plain"><option>--no-ssh</option></arg>
158
 
        <arg choice="plain"><option>-S</option></arg>
159
 
      </group>
160
 
    </cmdsynopsis>
161
 
    <cmdsynopsis>
162
 
      <command>&COMMANDNAME;</command>
163
 
      <group choice="req">
164
 
        <arg choice="plain"><option>--help</option></arg>
165
 
        <arg choice="plain"><option>-h</option></arg>
166
 
      </group>
167
 
    </cmdsynopsis>
168
 
    <cmdsynopsis>
169
 
      <command>&COMMANDNAME;</command>
170
 
      <group choice="req">
171
 
        <arg choice="plain"><option>--version</option></arg>
172
 
        <arg choice="plain"><option>-v</option></arg>
173
 
      </group>
174
 
    </cmdsynopsis>
175
 
  </refsynopsisdiv>
176
 
  
177
 
  <refsect1 id="description">
178
 
    <title>DESCRIPTION</title>
179
 
    <para>
180
 
      <command>&COMMANDNAME;</command> is a program to generate the
181
 
      OpenPGP key used by
182
 
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
183
 
      <manvolnum>8mandos</manvolnum></citerefentry>.  The key is
184
 
      normally written to /etc/mandos for later installation into the
185
 
      initrd image, but this, and most other things, can be changed
186
 
      with command line options.
187
 
    </para>
188
 
    <para>
189
 
      This program can also be used with the
190
 
      <option>--password</option> or <option>--passfile</option>
191
 
      options to generate a ready-made section for
192
 
      <filename>clients.conf</filename> (see
193
 
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
194
 
      <manvolnum>5</manvolnum></citerefentry>).
195
 
    </para>
196
 
  </refsect1>
197
 
  
198
 
  <refsect1 id="purpose">
199
 
    <title>PURPOSE</title>
200
 
    <para>
201
 
      The purpose of this is to enable <emphasis>remote and unattended
202
 
      rebooting</emphasis> of client host computer with an
203
 
      <emphasis>encrypted root file system</emphasis>.  See <xref
204
 
      linkend="overview"/> for details.
205
 
    </para>
206
 
  </refsect1>
207
 
  
208
 
  <refsect1 id="options">
209
 
    <title>OPTIONS</title>
210
 
    
211
 
    <variablelist>
212
 
      <varlistentry>
213
 
        <term><option>--help</option></term>
214
 
        <term><option>-h</option></term>
215
 
        <listitem>
216
 
          <para>
217
 
            Show a help message and exit
218
 
          </para>
219
 
        </listitem>
220
 
      </varlistentry>
221
 
      
222
 
      <varlistentry>
223
 
        <term><option>--dir
224
 
        <replaceable>DIRECTORY</replaceable></option></term>
225
 
        <term><option>-d
226
 
        <replaceable>DIRECTORY</replaceable></option></term>
227
 
        <listitem>
228
 
          <para>
229
 
            Target directory for key files.  Default is
230
 
            <filename class="directory">/etc/mandos</filename>.
231
 
          </para>
232
 
        </listitem>
233
 
      </varlistentry>
234
 
      
235
 
      <varlistentry>
236
 
        <term><option>--type
237
 
        <replaceable>TYPE</replaceable></option></term>
238
 
        <term><option>-t
239
 
        <replaceable>TYPE</replaceable></option></term>
240
 
        <listitem>
241
 
          <para>
242
 
            Key type.  Default is <quote>RSA</quote>.
243
 
          </para>
244
 
        </listitem>
245
 
      </varlistentry>
246
 
      
247
 
      <varlistentry>
248
 
        <term><option>--length
249
 
        <replaceable>BITS</replaceable></option></term>
250
 
        <term><option>-l
251
 
        <replaceable>BITS</replaceable></option></term>
252
 
        <listitem>
253
 
          <para>
254
 
            Key length in bits.  Default is 4096.
255
 
          </para>
256
 
        </listitem>
257
 
      </varlistentry>
258
 
      
259
 
      <varlistentry>
260
 
        <term><option>--subtype
261
 
        <replaceable>KEYTYPE</replaceable></option></term>
262
 
        <term><option>-s
263
 
        <replaceable>KEYTYPE</replaceable></option></term>
264
 
        <listitem>
265
 
          <para>
266
 
            Subkey type.  Default is <quote>RSA</quote> (Elgamal
267
 
            encryption-only).
268
 
          </para>
269
 
        </listitem>
270
 
      </varlistentry>
271
 
      
272
 
      <varlistentry>
273
 
        <term><option>--sublength
274
 
        <replaceable>BITS</replaceable></option></term>
275
 
        <term><option>-L
276
 
        <replaceable>BITS</replaceable></option></term>
277
 
        <listitem>
278
 
          <para>
279
 
            Subkey length in bits.  Default is 4096.
280
 
          </para>
281
 
        </listitem>
282
 
      </varlistentry>
283
 
      
284
 
      <varlistentry>
285
 
        <term><option>--email
286
 
        <replaceable>ADDRESS</replaceable></option></term>
287
 
        <term><option>-e
288
 
        <replaceable>ADDRESS</replaceable></option></term>
289
 
        <listitem>
290
 
          <para>
291
 
            Email address of key.  Default is empty.
292
 
          </para>
293
 
        </listitem>
294
 
      </varlistentry>
295
 
      
296
 
      <varlistentry>
297
 
        <term><option>--comment
298
 
        <replaceable>TEXT</replaceable></option></term>
299
 
        <term><option>-c
300
 
        <replaceable>TEXT</replaceable></option></term>
301
 
        <listitem>
302
 
          <para>
303
 
            Comment field for key.  Default is empty.
304
 
          </para>
305
 
        </listitem>
306
 
      </varlistentry>
307
 
      
308
 
      <varlistentry>
309
 
        <term><option>--expire
310
 
        <replaceable>TIME</replaceable></option></term>
311
 
        <term><option>-x
312
 
        <replaceable>TIME</replaceable></option></term>
313
 
        <listitem>
314
 
          <para>
315
 
            Key expire time.  Default is no expiration.  See
316
 
            <citerefentry><refentrytitle>gpg</refentrytitle>
317
 
            <manvolnum>1</manvolnum></citerefentry> for syntax.
318
 
          </para>
319
 
        </listitem>
320
 
      </varlistentry>
321
 
      
322
 
      <varlistentry>
323
 
        <term><option>--force</option></term>
324
 
        <term><option>-f</option></term>
325
 
        <listitem>
326
 
          <para>
327
 
            Force overwriting old key.
328
 
          </para>
329
 
        </listitem>
330
 
      </varlistentry>
331
 
      <varlistentry>
332
 
        <term><option>--password</option></term>
333
 
        <term><option>-p</option></term>
334
 
        <listitem>
335
 
          <para>
336
 
            Prompt for a password and encrypt it with the key already
337
 
            present in either <filename>/etc/mandos</filename> or the
338
 
            directory specified with the <option>--dir</option>
339
 
            option.  Outputs, on standard output, a section suitable
340
 
            for inclusion in <citerefentry><refentrytitle
341
 
            >mandos-clients.conf</refentrytitle><manvolnum
342
 
            >8</manvolnum></citerefentry>.  The host name or the name
343
 
            specified with the <option>--name</option> option is used
344
 
            for the section header.  All other options are ignored,
345
 
            and no key is created.
346
 
          </para>
347
 
        </listitem>
348
 
      </varlistentry>
349
 
      <varlistentry>
350
 
        <term><option>--passfile
351
 
        <replaceable>FILE</replaceable></option></term>
352
 
        <term><option>-F
353
 
        <replaceable>FILE</replaceable></option></term>
354
 
        <listitem>
355
 
          <para>
356
 
            The same as <option>--password</option>, but read from
357
 
            <replaceable>FILE</replaceable>, not the terminal.
358
 
          </para>
359
 
        </listitem>
360
 
      </varlistentry>
361
 
      <varlistentry>
362
 
        <term><option>--no-ssh</option></term>
363
 
        <term><option>-S</option></term>
364
 
        <listitem>
365
 
          <para>
366
 
            When <option>--password</option> or
367
 
            <option>--passfile</option> is given, this option will
368
 
            prevent <command>&COMMANDNAME;</command> from calling
369
 
            <command>ssh-keyscan</command> to get an SSH fingerprint
370
 
            for this host and, if successful, output suitable config
371
 
            options to use this fingerprint as a
372
 
            <option>checker</option> option in the output.  This is
373
 
            otherwise the default behavior.
374
 
          </para>
375
 
        </listitem>
376
 
      </varlistentry>
377
 
    </variablelist>
378
 
  </refsect1>
379
 
  
380
 
  <refsect1 id="overview">
381
 
    <title>OVERVIEW</title>
382
 
    <xi:include href="overview.xml"/>
383
 
    <para>
384
 
      This program is a small utility to generate new OpenPGP keys for
385
 
      new Mandos clients, and to generate sections for inclusion in
386
 
      <filename>clients.conf</filename> on the server.
387
 
    </para>
388
 
  </refsect1>
389
 
  
390
 
  <refsect1 id="exit_status">
391
 
    <title>EXIT STATUS</title>
392
 
    <para>
393
 
      The exit status will be 0 if a new key (or password, if the
394
 
      <option>--password</option> option was used) was successfully
395
 
      created, otherwise not.
396
 
    </para>
397
 
  </refsect1>
398
 
  
399
 
  <refsect1 id="environment">
400
 
    <title>ENVIRONMENT</title>
401
 
    <variablelist>
402
 
      <varlistentry>
403
 
        <term><envar>TMPDIR</envar></term>
404
 
        <listitem>
405
 
          <para>
406
 
            If set, temporary files will be created here. See
407
 
            <citerefentry><refentrytitle>mktemp</refentrytitle>
408
 
            <manvolnum>1</manvolnum></citerefentry>.
409
 
          </para>
410
 
        </listitem>
411
 
      </varlistentry>
412
 
    </variablelist>
413
 
  </refsect1>
414
 
  
415
 
  <refsect1 id="files">
416
 
    <title>FILES</title>
417
 
    <para>
418
 
      Use the <option>--dir</option> option to change where
419
 
      <command>&COMMANDNAME;</command> will write the key files.  The
420
 
      default file names are shown here.
421
 
    </para>
422
 
    <variablelist>
423
 
      <varlistentry>
424
 
        <term><filename>/etc/mandos/seckey.txt</filename></term>
425
 
        <listitem>
426
 
          <para>
427
 
            OpenPGP secret key file which will be created or
428
 
            overwritten.
429
 
          </para>
430
 
        </listitem>
431
 
      </varlistentry>
432
 
      <varlistentry>
433
 
        <term><filename>/etc/mandos/pubkey.txt</filename></term>
434
 
        <listitem>
435
 
          <para>
436
 
            OpenPGP public key file which will be created or
437
 
            overwritten.
438
 
          </para>
439
 
        </listitem>
440
 
      </varlistentry>
441
 
      <varlistentry>
442
 
        <term><filename class="directory">/tmp</filename></term>
443
 
        <listitem>
444
 
          <para>
445
 
            Temporary files will be written here if
446
 
            <varname>TMPDIR</varname> is not set.
447
 
          </para>
448
 
        </listitem>
449
 
      </varlistentry>
450
 
    </variablelist>
451
 
  </refsect1>
452
 
  
453
 
<!--   <refsect1 id="bugs"> -->
454
 
<!--     <title>BUGS</title> -->
455
 
<!--     <para> -->
456
 
<!--     </para> -->
457
 
<!--   </refsect1> -->
458
 
  
459
 
  <refsect1 id="example">
460
 
    <title>EXAMPLE</title>
461
 
    <informalexample>
462
 
      <para>
463
 
        Normal invocation needs no options:
464
 
      </para>
465
 
      <para>
466
 
        <userinput>&COMMANDNAME;</userinput>
467
 
      </para>
468
 
    </informalexample>
469
 
    <informalexample>
470
 
      <para>
471
 
        Create key in another directory and of another type.  Force
472
 
        overwriting old key files:
473
 
      </para>
474
 
      <para>
475
 
 
476
 
<!-- do not wrap this line -->
477
 
<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>
478
 
 
479
 
      </para>
480
 
    </informalexample>
481
 
    <informalexample>
482
 
      <para>
483
 
        Prompt for a password, encrypt it with the key in <filename
484
 
        class="directory">/etc/mandos</filename> and output a section
485
 
        suitable for <filename>clients.conf</filename>.
486
 
      </para>
487
 
      <para>
488
 
        <userinput>&COMMANDNAME; --password</userinput>
489
 
      </para>
490
 
    </informalexample>
491
 
    <informalexample>
492
 
      <para>
493
 
        Prompt for a password, encrypt it with the key in the
494
 
        <filename>client-key</filename> directory and output a section
495
 
        suitable for <filename>clients.conf</filename>.
496
 
      </para>
497
 
      <para>
498
 
 
499
 
<!-- do not wrap this line -->
500
 
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
501
 
 
502
 
      </para>
503
 
    </informalexample>
504
 
  </refsect1>
505
 
  
506
 
  <refsect1 id="security">
507
 
    <title>SECURITY</title>
508
 
    <para>
509
 
      The <option>--type</option>, <option>--length</option>,
510
 
      <option>--subtype</option>, and <option>--sublength</option>
511
 
      options can be used to create keys of low security.  If in
512
 
      doubt, leave them to the default values.
513
 
    </para>
514
 
    <para>
515
 
      The key expire time is <emphasis>not</emphasis> guaranteed to be
516
 
      honored by <citerefentry><refentrytitle>mandos</refentrytitle>
517
 
      <manvolnum>8</manvolnum></citerefentry>.
518
 
    </para>
519
 
  </refsect1>
520
 
  
521
 
  <refsect1 id="see_also">
522
 
    <title>SEE ALSO</title>
523
 
    <para>
524
 
      <citerefentry><refentrytitle>intro</refentrytitle>
525
 
      <manvolnum>8mandos</manvolnum></citerefentry>,
526
 
      <citerefentry><refentrytitle>gpg</refentrytitle>
527
 
      <manvolnum>1</manvolnum></citerefentry>,
528
 
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
529
 
      <manvolnum>5</manvolnum></citerefentry>,
530
 
      <citerefentry><refentrytitle>mandos</refentrytitle>
531
 
      <manvolnum>8</manvolnum></citerefentry>,
532
 
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
533
 
      <manvolnum>8mandos</manvolnum></citerefentry>,
534
 
      <citerefentry><refentrytitle>ssh-keyscan</refentrytitle>
535
 
      <manvolnum>1</manvolnum></citerefentry>
536
 
    </para>
537
 
  </refsect1>
538
 
  
539
 
</refentry>
540
 
<!-- Local Variables: -->
541
 
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
542
 
<!-- time-stamp-end: "[\"']>" -->
543
 
<!-- time-stamp-format: "%:y-%02m-%02d" -->
544
 
<!-- End: -->