/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-keygen.xml

  • Committer: Teddy Hogeborn
  • Date: 2008-07-20 06:33:48 UTC
  • Revision ID: teddy@fukt.bsnet.se-20080720063348-jscgy5p0itrgvlo8
* mandos-clients.conf ([foo]): Uncommented.
  ([foo]/secret): New.
  ([foo]/secfile): Commented out.
  ([foo]/checker): Changed to "fping -q -- %%(fqdn)s".
  ([foo]/timeout): New.

* server.py: New modeline for Python and Emacs.  Set a logging format.
  (Client.__init__): Bug fix: Choose either the value from the options
                     object or pass the argument through string_to_delta
                     for both "timeout" and "interval".
  (Client.checker_callback): Bug fix: Do not log spurious "Checker for
                             <foo> failed" messages.
  (Client.start_checker): Moved "Starting checker" log message down to
                          just before actually starting the subprocess.
                          Do not redirect the subprocesses' stdout to a
                          pipe.
  (peer_certificate, fingerprint): Added docstrings.
  (entry_group_state_changed): Call "killme()" instead of
                               "main_loop.quit()".
  (daemon, killme): New functions.
  (exitstatus, main_loop_started): New global variables.
  (__main__): Removed the "--cert", "--key", "--ca", and "--crl"
              options.  Removed the sleep command from the default
              checker.  Add a console logger in debug mode.  Call
              "killme()" instead of "main_loop.quit()" when there are no
              more clients.  Call "daemon()" if not in debug mode.
              Register "cleanup()" to run at exit.  Ignore some
              signals.  Catch DBusException to detect another running
              server and exit cleanly.  Exit with "exitstatus".
  (cleanup): New function.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-keygen.xml
1
 
<?xml version="1.0" encoding="UTF-8"?>
2
 
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
 
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
 
<!ENTITY COMMANDNAME "mandos-keygen">
5
 
<!ENTITY TIMESTAMP "2018-02-08">
6
 
<!ENTITY % common SYSTEM "common.ent">
7
 
%common;
8
 
]>
9
 
 
10
 
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
11
 
  <refentryinfo>
12
 
    <title>Mandos Manual</title>
13
 
    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
14
 
    <productname>Mandos</productname>
15
 
    <productnumber>&version;</productnumber>
16
 
    <date>&TIMESTAMP;</date>
17
 
    <authorgroup>
18
 
      <author>
19
 
        <firstname>Björn</firstname>
20
 
        <surname>Påhlsson</surname>
21
 
        <address>
22
 
          <email>belorn@recompile.se</email>
23
 
        </address>
24
 
      </author>
25
 
      <author>
26
 
        <firstname>Teddy</firstname>
27
 
        <surname>Hogeborn</surname>
28
 
        <address>
29
 
          <email>teddy@recompile.se</email>
30
 
        </address>
31
 
      </author>
32
 
    </authorgroup>
33
 
    <copyright>
34
 
      <year>2008</year>
35
 
      <year>2009</year>
36
 
      <year>2010</year>
37
 
      <year>2011</year>
38
 
      <year>2012</year>
39
 
      <year>2013</year>
40
 
      <year>2014</year>
41
 
      <year>2015</year>
42
 
      <year>2016</year>
43
 
      <year>2017</year>
44
 
      <year>2018</year>
45
 
      <holder>Teddy Hogeborn</holder>
46
 
      <holder>Björn Påhlsson</holder>
47
 
    </copyright>
48
 
    <xi:include href="legalnotice.xml"/>
49
 
  </refentryinfo>
50
 
  
51
 
  <refmeta>
52
 
    <refentrytitle>&COMMANDNAME;</refentrytitle>
53
 
    <manvolnum>8</manvolnum>
54
 
  </refmeta>
55
 
  
56
 
  <refnamediv>
57
 
    <refname><command>&COMMANDNAME;</command></refname>
58
 
    <refpurpose>
59
 
      Generate key and password for Mandos client and server.
60
 
    </refpurpose>
61
 
  </refnamediv>
62
 
  
63
 
  <refsynopsisdiv>
64
 
    <cmdsynopsis>
65
 
      <command>&COMMANDNAME;</command>
66
 
      <group>
67
 
        <arg choice="plain"><option>--dir
68
 
        <replaceable>DIRECTORY</replaceable></option></arg>
69
 
        <arg choice="plain"><option>-d
70
 
        <replaceable>DIRECTORY</replaceable></option></arg>
71
 
      </group>
72
 
      <sbr/>
73
 
      <group>
74
 
        <arg choice="plain"><option>--type
75
 
        <replaceable>KEYTYPE</replaceable></option></arg>
76
 
        <arg choice="plain"><option>-t
77
 
        <replaceable>KEYTYPE</replaceable></option></arg>
78
 
      </group>
79
 
      <sbr/>
80
 
      <group>
81
 
        <arg choice="plain"><option>--length
82
 
        <replaceable>BITS</replaceable></option></arg>
83
 
        <arg choice="plain"><option>-l
84
 
        <replaceable>BITS</replaceable></option></arg>
85
 
      </group>
86
 
      <sbr/>
87
 
      <group>
88
 
        <arg choice="plain"><option>--subtype
89
 
        <replaceable>KEYTYPE</replaceable></option></arg>
90
 
        <arg choice="plain"><option>-s
91
 
        <replaceable>KEYTYPE</replaceable></option></arg>
92
 
      </group>
93
 
      <sbr/>
94
 
      <group>
95
 
        <arg choice="plain"><option>--sublength
96
 
        <replaceable>BITS</replaceable></option></arg>
97
 
        <arg choice="plain"><option>-L
98
 
        <replaceable>BITS</replaceable></option></arg>
99
 
      </group>
100
 
      <sbr/>
101
 
      <group>
102
 
        <arg choice="plain"><option>--name
103
 
        <replaceable>NAME</replaceable></option></arg>
104
 
        <arg choice="plain"><option>-n
105
 
        <replaceable>NAME</replaceable></option></arg>
106
 
      </group>
107
 
      <sbr/>
108
 
      <group>
109
 
        <arg choice="plain"><option>--email
110
 
        <replaceable>ADDRESS</replaceable></option></arg>
111
 
        <arg choice="plain"><option>-e
112
 
        <replaceable>ADDRESS</replaceable></option></arg>
113
 
      </group>
114
 
      <sbr/>
115
 
      <group>
116
 
        <arg choice="plain"><option>--comment
117
 
        <replaceable>TEXT</replaceable></option></arg>
118
 
        <arg choice="plain"><option>-c
119
 
        <replaceable>TEXT</replaceable></option></arg>
120
 
      </group>
121
 
      <sbr/>
122
 
      <group>
123
 
        <arg choice="plain"><option>--expire
124
 
        <replaceable>TIME</replaceable></option></arg>
125
 
        <arg choice="plain"><option>-x
126
 
        <replaceable>TIME</replaceable></option></arg>
127
 
      </group>
128
 
      <sbr/>
129
 
      <group>
130
 
        <arg choice="plain"><option>--force</option></arg>
131
 
        <arg choice="plain"><option>-f</option></arg>
132
 
      </group>
133
 
    </cmdsynopsis>
134
 
    <cmdsynopsis>
135
 
      <command>&COMMANDNAME;</command>
136
 
      <group choice="req">
137
 
        <arg choice="plain"><option>--password</option></arg>
138
 
        <arg choice="plain"><option>-p</option></arg>
139
 
        <arg choice="plain"><option>--passfile
140
 
        <replaceable>FILE</replaceable></option></arg>
141
 
        <arg choice="plain"><option>-F</option>
142
 
        <replaceable>FILE</replaceable></arg>
143
 
      </group>
144
 
      <sbr/>
145
 
      <group>
146
 
        <arg choice="plain"><option>--dir
147
 
        <replaceable>DIRECTORY</replaceable></option></arg>
148
 
        <arg choice="plain"><option>-d
149
 
        <replaceable>DIRECTORY</replaceable></option></arg>
150
 
      </group>
151
 
      <sbr/>
152
 
      <group>
153
 
        <arg choice="plain"><option>--name
154
 
        <replaceable>NAME</replaceable></option></arg>
155
 
        <arg choice="plain"><option>-n
156
 
        <replaceable>NAME</replaceable></option></arg>
157
 
      </group>
158
 
      <group>
159
 
        <arg choice="plain"><option>--no-ssh</option></arg>
160
 
        <arg choice="plain"><option>-S</option></arg>
161
 
      </group>
162
 
    </cmdsynopsis>
163
 
    <cmdsynopsis>
164
 
      <command>&COMMANDNAME;</command>
165
 
      <group choice="req">
166
 
        <arg choice="plain"><option>--help</option></arg>
167
 
        <arg choice="plain"><option>-h</option></arg>
168
 
      </group>
169
 
    </cmdsynopsis>
170
 
    <cmdsynopsis>
171
 
      <command>&COMMANDNAME;</command>
172
 
      <group choice="req">
173
 
        <arg choice="plain"><option>--version</option></arg>
174
 
        <arg choice="plain"><option>-v</option></arg>
175
 
      </group>
176
 
    </cmdsynopsis>
177
 
  </refsynopsisdiv>
178
 
  
179
 
  <refsect1 id="description">
180
 
    <title>DESCRIPTION</title>
181
 
    <para>
182
 
      <command>&COMMANDNAME;</command> is a program to generate the
183
 
      OpenPGP key used by
184
 
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
185
 
      <manvolnum>8mandos</manvolnum></citerefentry>.  The key is
186
 
      normally written to /etc/mandos for later installation into the
187
 
      initrd image, but this, and most other things, can be changed
188
 
      with command line options.
189
 
    </para>
190
 
    <para>
191
 
      This program can also be used with the
192
 
      <option>--password</option> or <option>--passfile</option>
193
 
      options to generate a ready-made section for
194
 
      <filename>clients.conf</filename> (see
195
 
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
196
 
      <manvolnum>5</manvolnum></citerefentry>).
197
 
    </para>
198
 
  </refsect1>
199
 
  
200
 
  <refsect1 id="purpose">
201
 
    <title>PURPOSE</title>
202
 
    <para>
203
 
      The purpose of this is to enable <emphasis>remote and unattended
204
 
      rebooting</emphasis> of client host computer with an
205
 
      <emphasis>encrypted root file system</emphasis>.  See <xref
206
 
      linkend="overview"/> for details.
207
 
    </para>
208
 
  </refsect1>
209
 
  
210
 
  <refsect1 id="options">
211
 
    <title>OPTIONS</title>
212
 
    
213
 
    <variablelist>
214
 
      <varlistentry>
215
 
        <term><option>--help</option></term>
216
 
        <term><option>-h</option></term>
217
 
        <listitem>
218
 
          <para>
219
 
            Show a help message and exit
220
 
          </para>
221
 
        </listitem>
222
 
      </varlistentry>
223
 
      
224
 
      <varlistentry>
225
 
        <term><option>--dir
226
 
        <replaceable>DIRECTORY</replaceable></option></term>
227
 
        <term><option>-d
228
 
        <replaceable>DIRECTORY</replaceable></option></term>
229
 
        <listitem>
230
 
          <para>
231
 
            Target directory for key files.  Default is
232
 
            <filename class="directory">/etc/mandos</filename>.
233
 
          </para>
234
 
        </listitem>
235
 
      </varlistentry>
236
 
      
237
 
      <varlistentry>
238
 
        <term><option>--type
239
 
        <replaceable>TYPE</replaceable></option></term>
240
 
        <term><option>-t
241
 
        <replaceable>TYPE</replaceable></option></term>
242
 
        <listitem>
243
 
          <para>
244
 
            Key type.  Default is <quote>RSA</quote>.
245
 
          </para>
246
 
        </listitem>
247
 
      </varlistentry>
248
 
      
249
 
      <varlistentry>
250
 
        <term><option>--length
251
 
        <replaceable>BITS</replaceable></option></term>
252
 
        <term><option>-l
253
 
        <replaceable>BITS</replaceable></option></term>
254
 
        <listitem>
255
 
          <para>
256
 
            Key length in bits.  Default is 4096.
257
 
          </para>
258
 
        </listitem>
259
 
      </varlistentry>
260
 
      
261
 
      <varlistentry>
262
 
        <term><option>--subtype
263
 
        <replaceable>KEYTYPE</replaceable></option></term>
264
 
        <term><option>-s
265
 
        <replaceable>KEYTYPE</replaceable></option></term>
266
 
        <listitem>
267
 
          <para>
268
 
            Subkey type.  Default is <quote>RSA</quote> (Elgamal
269
 
            encryption-only).
270
 
          </para>
271
 
        </listitem>
272
 
      </varlistentry>
273
 
      
274
 
      <varlistentry>
275
 
        <term><option>--sublength
276
 
        <replaceable>BITS</replaceable></option></term>
277
 
        <term><option>-L
278
 
        <replaceable>BITS</replaceable></option></term>
279
 
        <listitem>
280
 
          <para>
281
 
            Subkey length in bits.  Default is 4096.
282
 
          </para>
283
 
        </listitem>
284
 
      </varlistentry>
285
 
      
286
 
      <varlistentry>
287
 
        <term><option>--email
288
 
        <replaceable>ADDRESS</replaceable></option></term>
289
 
        <term><option>-e
290
 
        <replaceable>ADDRESS</replaceable></option></term>
291
 
        <listitem>
292
 
          <para>
293
 
            Email address of key.  Default is empty.
294
 
          </para>
295
 
        </listitem>
296
 
      </varlistentry>
297
 
      
298
 
      <varlistentry>
299
 
        <term><option>--comment
300
 
        <replaceable>TEXT</replaceable></option></term>
301
 
        <term><option>-c
302
 
        <replaceable>TEXT</replaceable></option></term>
303
 
        <listitem>
304
 
          <para>
305
 
            Comment field for key.  Default is empty.
306
 
          </para>
307
 
        </listitem>
308
 
      </varlistentry>
309
 
      
310
 
      <varlistentry>
311
 
        <term><option>--expire
312
 
        <replaceable>TIME</replaceable></option></term>
313
 
        <term><option>-x
314
 
        <replaceable>TIME</replaceable></option></term>
315
 
        <listitem>
316
 
          <para>
317
 
            Key expire time.  Default is no expiration.  See
318
 
            <citerefentry><refentrytitle>gpg</refentrytitle>
319
 
            <manvolnum>1</manvolnum></citerefentry> for syntax.
320
 
          </para>
321
 
        </listitem>
322
 
      </varlistentry>
323
 
      
324
 
      <varlistentry>
325
 
        <term><option>--force</option></term>
326
 
        <term><option>-f</option></term>
327
 
        <listitem>
328
 
          <para>
329
 
            Force overwriting old key.
330
 
          </para>
331
 
        </listitem>
332
 
      </varlistentry>
333
 
      <varlistentry>
334
 
        <term><option>--password</option></term>
335
 
        <term><option>-p</option></term>
336
 
        <listitem>
337
 
          <para>
338
 
            Prompt for a password and encrypt it with the key already
339
 
            present in either <filename>/etc/mandos</filename> or the
340
 
            directory specified with the <option>--dir</option>
341
 
            option.  Outputs, on standard output, a section suitable
342
 
            for inclusion in <citerefentry><refentrytitle
343
 
            >mandos-clients.conf</refentrytitle><manvolnum
344
 
            >8</manvolnum></citerefentry>.  The host name or the name
345
 
            specified with the <option>--name</option> option is used
346
 
            for the section header.  All other options are ignored,
347
 
            and no key is created.
348
 
          </para>
349
 
        </listitem>
350
 
      </varlistentry>
351
 
      <varlistentry>
352
 
        <term><option>--passfile
353
 
        <replaceable>FILE</replaceable></option></term>
354
 
        <term><option>-F
355
 
        <replaceable>FILE</replaceable></option></term>
356
 
        <listitem>
357
 
          <para>
358
 
            The same as <option>--password</option>, but read from
359
 
            <replaceable>FILE</replaceable>, not the terminal.
360
 
          </para>
361
 
        </listitem>
362
 
      </varlistentry>
363
 
      <varlistentry>
364
 
        <term><option>--no-ssh</option></term>
365
 
        <term><option>-S</option></term>
366
 
        <listitem>
367
 
          <para>
368
 
            When <option>--password</option> or
369
 
            <option>--passfile</option> is given, this option will
370
 
            prevent <command>&COMMANDNAME;</command> from calling
371
 
            <command>ssh-keyscan</command> to get an SSH fingerprint
372
 
            for this host and, if successful, output suitable config
373
 
            options to use this fingerprint as a
374
 
            <option>checker</option> option in the output.  This is
375
 
            otherwise the default behavior.
376
 
          </para>
377
 
        </listitem>
378
 
      </varlistentry>
379
 
    </variablelist>
380
 
  </refsect1>
381
 
  
382
 
  <refsect1 id="overview">
383
 
    <title>OVERVIEW</title>
384
 
    <xi:include href="overview.xml"/>
385
 
    <para>
386
 
      This program is a small utility to generate new OpenPGP keys for
387
 
      new Mandos clients, and to generate sections for inclusion in
388
 
      <filename>clients.conf</filename> on the server.
389
 
    </para>
390
 
  </refsect1>
391
 
  
392
 
  <refsect1 id="exit_status">
393
 
    <title>EXIT STATUS</title>
394
 
    <para>
395
 
      The exit status will be 0 if a new key (or password, if the
396
 
      <option>--password</option> option was used) was successfully
397
 
      created, otherwise not.
398
 
    </para>
399
 
  </refsect1>
400
 
  
401
 
  <refsect1 id="environment">
402
 
    <title>ENVIRONMENT</title>
403
 
    <variablelist>
404
 
      <varlistentry>
405
 
        <term><envar>TMPDIR</envar></term>
406
 
        <listitem>
407
 
          <para>
408
 
            If set, temporary files will be created here. See
409
 
            <citerefentry><refentrytitle>mktemp</refentrytitle>
410
 
            <manvolnum>1</manvolnum></citerefentry>.
411
 
          </para>
412
 
        </listitem>
413
 
      </varlistentry>
414
 
    </variablelist>
415
 
  </refsect1>
416
 
  
417
 
  <refsect1 id="files">
418
 
    <title>FILES</title>
419
 
    <para>
420
 
      Use the <option>--dir</option> option to change where
421
 
      <command>&COMMANDNAME;</command> will write the key files.  The
422
 
      default file names are shown here.
423
 
    </para>
424
 
    <variablelist>
425
 
      <varlistentry>
426
 
        <term><filename>/etc/mandos/seckey.txt</filename></term>
427
 
        <listitem>
428
 
          <para>
429
 
            OpenPGP secret key file which will be created or
430
 
            overwritten.
431
 
          </para>
432
 
        </listitem>
433
 
      </varlistentry>
434
 
      <varlistentry>
435
 
        <term><filename>/etc/mandos/pubkey.txt</filename></term>
436
 
        <listitem>
437
 
          <para>
438
 
            OpenPGP public key file which will be created or
439
 
            overwritten.
440
 
          </para>
441
 
        </listitem>
442
 
      </varlistentry>
443
 
      <varlistentry>
444
 
        <term><filename class="directory">/tmp</filename></term>
445
 
        <listitem>
446
 
          <para>
447
 
            Temporary files will be written here if
448
 
            <varname>TMPDIR</varname> is not set.
449
 
          </para>
450
 
        </listitem>
451
 
      </varlistentry>
452
 
    </variablelist>
453
 
  </refsect1>
454
 
  
455
 
  <refsect1 id="bugs">
456
 
    <title>BUGS</title>
457
 
    <xi:include href="bugs.xml"/>
458
 
  </refsect1>
459
 
  
460
 
  <refsect1 id="example">
461
 
    <title>EXAMPLE</title>
462
 
    <informalexample>
463
 
      <para>
464
 
        Normal invocation needs no options:
465
 
      </para>
466
 
      <para>
467
 
        <userinput>&COMMANDNAME;</userinput>
468
 
      </para>
469
 
    </informalexample>
470
 
    <informalexample>
471
 
      <para>
472
 
        Create key in another directory and of another type.  Force
473
 
        overwriting old key files:
474
 
      </para>
475
 
      <para>
476
 
 
477
 
<!-- do not wrap this line -->
478
 
<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>
479
 
 
480
 
      </para>
481
 
    </informalexample>
482
 
    <informalexample>
483
 
      <para>
484
 
        Prompt for a password, encrypt it with the key in <filename
485
 
        class="directory">/etc/mandos</filename> and output a section
486
 
        suitable for <filename>clients.conf</filename>.
487
 
      </para>
488
 
      <para>
489
 
        <userinput>&COMMANDNAME; --password</userinput>
490
 
      </para>
491
 
    </informalexample>
492
 
    <informalexample>
493
 
      <para>
494
 
        Prompt for a password, encrypt it with the key in the
495
 
        <filename>client-key</filename> directory and output a section
496
 
        suitable for <filename>clients.conf</filename>.
497
 
      </para>
498
 
      <para>
499
 
 
500
 
<!-- do not wrap this line -->
501
 
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
502
 
 
503
 
      </para>
504
 
    </informalexample>
505
 
  </refsect1>
506
 
  
507
 
  <refsect1 id="security">
508
 
    <title>SECURITY</title>
509
 
    <para>
510
 
      The <option>--type</option>, <option>--length</option>,
511
 
      <option>--subtype</option>, and <option>--sublength</option>
512
 
      options can be used to create keys of low security.  If in
513
 
      doubt, leave them to the default values.
514
 
    </para>
515
 
    <para>
516
 
      The key expire time is <emphasis>not</emphasis> guaranteed to be
517
 
      honored by <citerefentry><refentrytitle>mandos</refentrytitle>
518
 
      <manvolnum>8</manvolnum></citerefentry>.
519
 
    </para>
520
 
  </refsect1>
521
 
  
522
 
  <refsect1 id="see_also">
523
 
    <title>SEE ALSO</title>
524
 
    <para>
525
 
      <citerefentry><refentrytitle>intro</refentrytitle>
526
 
      <manvolnum>8mandos</manvolnum></citerefentry>,
527
 
      <citerefentry><refentrytitle>gpg</refentrytitle>
528
 
      <manvolnum>1</manvolnum></citerefentry>,
529
 
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
530
 
      <manvolnum>5</manvolnum></citerefentry>,
531
 
      <citerefentry><refentrytitle>mandos</refentrytitle>
532
 
      <manvolnum>8</manvolnum></citerefentry>,
533
 
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
534
 
      <manvolnum>8mandos</manvolnum></citerefentry>,
535
 
      <citerefentry><refentrytitle>ssh-keyscan</refentrytitle>
536
 
      <manvolnum>1</manvolnum></citerefentry>
537
 
    </para>
538
 
  </refsect1>
539
 
  
540
 
</refentry>
541
 
<!-- Local Variables: -->
542
 
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
543
 
<!-- time-stamp-end: "[\"']>" -->
544
 
<!-- time-stamp-format: "%:y-%02m-%02d" -->
545
 
<!-- End: -->