/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-keygen.xml

  • Committer: Teddy Hogeborn
  • Date: 2008-10-03 09:32:30 UTC
  • Revision ID: teddy@fukt.bsnet.se-20081003093230-rshn19e0c19zz12i
* .bzrignore (plugins.d/askpass-fifo): Added.

* Makefile (FORTIFY): Added "-fstack-protector-all".
  (mandos, mandos-keygen): Use more strict regexps when updating the
                           version number.

* mandos (Client.__init__): Use os.path.expandvars() and
                            os.path.expanduser() on the "secfile"
                            config value.

* plugins.d/splashy.c: Update comments and order of #include's.
  (main): Check user and group when looking for running splashy
          process.  Do not ignore ENOENT from execl().  Use _exit()
          instead of "return" when an error happens in child
          processes.  Bug fix: Only wait for splashy_update
          completion if it was started.  Bug fix: detect failing
          waitpid().  Only kill splashy_update if it is running.  Do
          the killing of the old splashy process before the fork().
          Do setsid() and setuid(geteuid()) before starting the new
          splashy.  Report failing execl().

* plugins.d/usplash.c: Update comments and order of #include's.
  (main): Check user and group when looking for running usplash
          process.  Do not report execv() error if interrupted by a
          signal.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-keygen.xml
1
 
<?xml version='1.0' encoding='UTF-8'?>
2
 
<?xml-stylesheet type="text/xsl"
3
 
        href="http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl"?>
 
1
<?xml version="1.0" encoding="UTF-8"?>
4
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
5
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
6
 
<!ENTITY VERSION "1.0">
7
4
<!ENTITY COMMANDNAME "mandos-keygen">
 
5
<!ENTITY TIMESTAMP "2008-09-30">
 
6
<!ENTITY % common SYSTEM "common.ent">
 
7
%common;
8
8
]>
9
9
 
10
 
<refentry>
 
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
11
11
  <refentryinfo>
12
 
    <title>&COMMANDNAME;</title>
13
 
    <!-- NWalsh's docbook scripts use this to generate the footer: -->
14
 
    <productname>&COMMANDNAME;</productname>
15
 
    <productnumber>&VERSION;</productnumber>
 
12
    <title>Mandos Manual</title>
 
13
    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
 
14
    <productname>Mandos</productname>
 
15
    <productnumber>&version;</productnumber>
 
16
    <date>&TIMESTAMP;</date>
16
17
    <authorgroup>
17
18
      <author>
18
19
        <firstname>Björn</firstname>
31
32
    </authorgroup>
32
33
    <copyright>
33
34
      <year>2008</year>
34
 
      <holder>Teddy Hogeborn &amp; Björn Påhlsson</holder>
 
35
      <holder>Teddy Hogeborn</holder>
 
36
      <holder>Björn Påhlsson</holder>
35
37
    </copyright>
36
 
    <legalnotice>
37
 
      <para>
38
 
        This manual page is free software: you can redistribute it
39
 
        and/or modify it under the terms of the GNU General Public
40
 
        License as published by the Free Software Foundation,
41
 
        either version 3 of the License, or (at your option) any
42
 
        later version.
43
 
      </para>
44
 
 
45
 
      <para>
46
 
        This manual page is distributed in the hope that it will
47
 
        be useful, but WITHOUT ANY WARRANTY; without even the
48
 
        implied warranty of MERCHANTABILITY or FITNESS FOR A
49
 
        PARTICULAR PURPOSE.  See the GNU General Public License
50
 
        for more details.
51
 
      </para>
52
 
 
53
 
      <para>
54
 
        You should have received a copy of the GNU General Public
55
 
        License along with this program; If not, see
56
 
        <ulink url="http://www.gnu.org/licenses/"/>.
57
 
      </para>
58
 
    </legalnotice>
 
38
    <xi:include href="legalnotice.xml"/>
59
39
  </refentryinfo>
60
 
 
 
40
  
61
41
  <refmeta>
62
42
    <refentrytitle>&COMMANDNAME;</refentrytitle>
63
43
    <manvolnum>8</manvolnum>
66
46
  <refnamediv>
67
47
    <refname><command>&COMMANDNAME;</command></refname>
68
48
    <refpurpose>
69
 
      Generate keys for <citerefentry><refentrytitle>password-request
70
 
      </refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
 
49
      Generate key and password for Mandos client and server.
71
50
    </refpurpose>
72
51
  </refnamediv>
73
 
 
 
52
  
74
53
  <refsynopsisdiv>
75
54
    <cmdsynopsis>
76
55
      <command>&COMMANDNAME;</command>
77
 
      <group choice="opt">
78
 
        <arg choice="plain"><option>--dir</option>
79
 
        <replaceable>directory</replaceable></arg>
80
 
      </group>
81
 
      <group choice="opt">
82
 
        <arg choice="plain"><option>--type</option>
83
 
        <replaceable>type</replaceable></arg>
84
 
      </group>
85
 
      <group choice="opt">
86
 
        <arg choice="plain"><option>--length</option>
87
 
        <replaceable>bits</replaceable></arg>
88
 
      </group>
89
 
      <group choice="opt">
90
 
        <arg choice="plain"><option>--name</option>
91
 
        <replaceable>NAME</replaceable></arg>
92
 
      </group>
93
 
      <group choice="opt">
94
 
        <arg choice="plain"><option>--email</option>
95
 
        <replaceable>EMAIL</replaceable></arg>
96
 
      </group>
97
 
      <group choice="opt">
98
 
        <arg choice="plain"><option>--comment</option>
99
 
        <replaceable>COMMENT</replaceable></arg>
100
 
      </group>
101
 
      <group choice="opt">
102
 
        <arg choice="plain"><option>--expire</option>
103
 
        <replaceable>TIME</replaceable></arg>
104
 
      </group>
105
 
      <group choice="opt">
106
 
        <arg choice="plain"><option>--force</option></arg>
107
 
      </group>
108
 
    </cmdsynopsis>
109
 
    <cmdsynopsis>
110
 
      <command>&COMMANDNAME;</command>
111
 
      <group choice="opt">
112
 
        <arg choice="plain"><option>-d</option>
113
 
        <replaceable>directory</replaceable></arg>
114
 
      </group>
115
 
      <group choice="opt">
116
 
        <arg choice="plain"><option>-t</option>
117
 
        <replaceable>type</replaceable></arg>
118
 
      </group>
119
 
      <group choice="opt">
120
 
        <arg choice="plain"><option>-l</option>
121
 
        <replaceable>bits</replaceable></arg>
122
 
      </group>
123
 
      <group choice="opt">
124
 
        <arg choice="plain"><option>-n</option>
125
 
        <replaceable>NAME</replaceable></arg>
126
 
      </group>
127
 
      <group choice="opt">
128
 
        <arg choice="plain"><option>-e</option>
129
 
        <replaceable>EMAIL</replaceable></arg>
130
 
      </group>
131
 
      <group choice="opt">
132
 
        <arg choice="plain"><option>-c</option>
133
 
        <replaceable>COMMENT</replaceable></arg>
134
 
      </group>
135
 
      <group choice="opt">
136
 
        <arg choice="plain"><option>-x</option>
137
 
        <replaceable>TIME</replaceable></arg>
138
 
      </group>
139
 
      <group choice="opt">
140
 
        <arg choice="plain"><option>-f</option></arg>
141
 
      </group>
142
 
    </cmdsynopsis>
143
 
    <cmdsynopsis>
144
 
      <command>&COMMANDNAME;</command>
145
 
      <group choice="req">
146
 
        <arg choice='plain'><option>-h</option></arg>
147
 
        <arg choice='plain'><option>--help</option></arg>
148
 
      </group>
149
 
    </cmdsynopsis>
150
 
    <cmdsynopsis>
151
 
      <command>&COMMANDNAME;</command>
152
 
      <group choice="req">
153
 
        <arg choice='plain'><option>-v</option></arg>
154
 
        <arg choice='plain'><option>--version</option></arg>
 
56
      <group>
 
57
        <arg choice="plain"><option>--dir
 
58
        <replaceable>DIRECTORY</replaceable></option></arg>
 
59
        <arg choice="plain"><option>-d
 
60
        <replaceable>DIRECTORY</replaceable></option></arg>
 
61
      </group>
 
62
      <sbr/>
 
63
      <group>
 
64
        <arg choice="plain"><option>--type
 
65
        <replaceable>KEYTYPE</replaceable></option></arg>
 
66
        <arg choice="plain"><option>-t
 
67
        <replaceable>KEYTYPE</replaceable></option></arg>
 
68
      </group>
 
69
      <sbr/>
 
70
      <group>
 
71
        <arg choice="plain"><option>--length
 
72
        <replaceable>BITS</replaceable></option></arg>
 
73
        <arg choice="plain"><option>-l
 
74
        <replaceable>BITS</replaceable></option></arg>
 
75
      </group>
 
76
      <sbr/>
 
77
      <group>
 
78
        <arg choice="plain"><option>--subtype
 
79
        <replaceable>KEYTYPE</replaceable></option></arg>
 
80
        <arg choice="plain"><option>-s
 
81
        <replaceable>KEYTYPE</replaceable></option></arg>
 
82
      </group>
 
83
      <sbr/>
 
84
      <group>
 
85
        <arg choice="plain"><option>--sublength
 
86
        <replaceable>BITS</replaceable></option></arg>
 
87
        <arg choice="plain"><option>-L
 
88
        <replaceable>BITS</replaceable></option></arg>
 
89
      </group>
 
90
      <sbr/>
 
91
      <group>
 
92
        <arg choice="plain"><option>--name
 
93
        <replaceable>NAME</replaceable></option></arg>
 
94
        <arg choice="plain"><option>-n
 
95
        <replaceable>NAME</replaceable></option></arg>
 
96
      </group>
 
97
      <sbr/>
 
98
      <group>
 
99
        <arg choice="plain"><option>--email
 
100
        <replaceable>ADDRESS</replaceable></option></arg>
 
101
        <arg choice="plain"><option>-e
 
102
        <replaceable>ADDRESS</replaceable></option></arg>
 
103
      </group>
 
104
      <sbr/>
 
105
      <group>
 
106
        <arg choice="plain"><option>--comment
 
107
        <replaceable>TEXT</replaceable></option></arg>
 
108
        <arg choice="plain"><option>-c
 
109
        <replaceable>TEXT</replaceable></option></arg>
 
110
      </group>
 
111
      <sbr/>
 
112
      <group>
 
113
        <arg choice="plain"><option>--expire
 
114
        <replaceable>TIME</replaceable></option></arg>
 
115
        <arg choice="plain"><option>-x
 
116
        <replaceable>TIME</replaceable></option></arg>
 
117
      </group>
 
118
      <sbr/>
 
119
      <arg><option>--force</option></arg>
 
120
    </cmdsynopsis>
 
121
    <cmdsynopsis>
 
122
      <command>&COMMANDNAME;</command>
 
123
      <group choice="req">
 
124
        <arg choice="plain"><option>--password</option></arg>
 
125
        <arg choice="plain"><option>-p</option></arg>
 
126
        <arg choice="plain"><option>--passfile
 
127
        <replaceable>FILE</replaceable></option></arg>
 
128
        <arg choice="plain"><option>-F</option>
 
129
        <replaceable>FILE</replaceable></arg>
 
130
      </group>
 
131
      <sbr/>
 
132
      <group>
 
133
        <arg choice="plain"><option>--dir
 
134
        <replaceable>DIRECTORY</replaceable></option></arg>
 
135
        <arg choice="plain"><option>-d
 
136
        <replaceable>DIRECTORY</replaceable></option></arg>
 
137
      </group>
 
138
      <sbr/>
 
139
      <group>
 
140
        <arg choice="plain"><option>--name
 
141
        <replaceable>NAME</replaceable></option></arg>
 
142
        <arg choice="plain"><option>-n
 
143
        <replaceable>NAME</replaceable></option></arg>
 
144
      </group>
 
145
    </cmdsynopsis>
 
146
    <cmdsynopsis>
 
147
      <command>&COMMANDNAME;</command>
 
148
      <group choice="req">
 
149
        <arg choice="plain"><option>--help</option></arg>
 
150
        <arg choice="plain"><option>-h</option></arg>
 
151
      </group>
 
152
    </cmdsynopsis>
 
153
    <cmdsynopsis>
 
154
      <command>&COMMANDNAME;</command>
 
155
      <group choice="req">
 
156
        <arg choice="plain"><option>--version</option></arg>
 
157
        <arg choice="plain"><option>-v</option></arg>
155
158
      </group>
156
159
    </cmdsynopsis>
157
160
  </refsynopsisdiv>
158
 
 
 
161
  
159
162
  <refsect1 id="description">
160
163
    <title>DESCRIPTION</title>
161
164
    <para>
162
165
      <command>&COMMANDNAME;</command> is a program to generate the
163
 
      OpenPGP keys used by
164
 
      <citerefentry><refentrytitle>password-request</refentrytitle>
165
 
      <manvolnum>8mandos</manvolnum></citerefentry>.  The keys are
 
166
      OpenPGP key used by
 
167
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
 
168
      <manvolnum>8mandos</manvolnum></citerefentry>.  The key is
166
169
      normally written to /etc/mandos for later installation into the
167
 
      initrd image, but this, like most things, can be changed with
168
 
      command line options.
 
170
      initrd image, but this, and most other things, can be changed
 
171
      with command line options.
 
172
    </para>
 
173
    <para>
 
174
      This program can also be used with the
 
175
      <option>--password</option> or <option>--passfile</option>
 
176
      options to generate a ready-made section for
 
177
      <filename>clients.conf</filename> (see
 
178
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
 
179
      <manvolnum>5</manvolnum></citerefentry>).
 
180
    </para>
 
181
  </refsect1>
 
182
  
 
183
  <refsect1 id="purpose">
 
184
    <title>PURPOSE</title>
 
185
    <para>
 
186
      The purpose of this is to enable <emphasis>remote and unattended
 
187
      rebooting</emphasis> of client host computer with an
 
188
      <emphasis>encrypted root file system</emphasis>.  See <xref
 
189
      linkend="overview"/> for details.
169
190
    </para>
170
191
  </refsect1>
171
192
  
172
193
  <refsect1 id="options">
173
194
    <title>OPTIONS</title>
174
 
 
 
195
    
175
196
    <variablelist>
176
197
      <varlistentry>
177
 
        <term><literal>-h</literal>, <literal>--help</literal></term>
 
198
        <term><option>--help</option></term>
 
199
        <term><option>-h</option></term>
178
200
        <listitem>
179
201
          <para>
180
202
            Show a help message and exit
181
203
          </para>
182
204
        </listitem>
183
205
      </varlistentry>
184
 
 
185
 
      <varlistentry>
186
 
        <term><literal>-d</literal>, <literal>--dir
187
 
        <replaceable>directory</replaceable></literal></term>
188
 
        <listitem>
189
 
          <para>
190
 
            Target directory for key files.
191
 
          </para>
192
 
        </listitem>
193
 
      </varlistentry>
194
 
 
195
 
      <varlistentry>
196
 
        <term><literal>-t</literal>, <literal>--type
197
 
        <replaceable>type</replaceable></literal></term>
198
 
        <listitem>
199
 
          <para>
200
 
            Key type.  Default is DSA.
201
 
          </para>
202
 
        </listitem>
203
 
      </varlistentry>
204
 
 
205
 
      <varlistentry>
206
 
        <term><literal>-l</literal>, <literal>--length
207
 
        <replaceable>bits</replaceable></literal></term>
208
 
        <listitem>
209
 
          <para>
210
 
            Key length in bits.  Default is 1024.
211
 
          </para>
212
 
        </listitem>
213
 
      </varlistentry>
214
 
 
215
 
      <varlistentry>
216
 
        <term><literal>-e</literal>, <literal>--email</literal>
217
 
        <replaceable>address</replaceable></term>
 
206
      
 
207
      <varlistentry>
 
208
        <term><option>--dir
 
209
        <replaceable>DIRECTORY</replaceable></option></term>
 
210
        <term><option>-d
 
211
        <replaceable>DIRECTORY</replaceable></option></term>
 
212
        <listitem>
 
213
          <para>
 
214
            Target directory for key files.  Default is
 
215
            <filename>/etc/mandos</filename>.
 
216
          </para>
 
217
        </listitem>
 
218
      </varlistentry>
 
219
      
 
220
      <varlistentry>
 
221
        <term><option>--type
 
222
        <replaceable>TYPE</replaceable></option></term>
 
223
        <term><option>-t
 
224
        <replaceable>TYPE</replaceable></option></term>
 
225
        <listitem>
 
226
          <para>
 
227
            Key type.  Default is <quote>DSA</quote>.
 
228
          </para>
 
229
        </listitem>
 
230
      </varlistentry>
 
231
      
 
232
      <varlistentry>
 
233
        <term><option>--length
 
234
        <replaceable>BITS</replaceable></option></term>
 
235
        <term><option>-l
 
236
        <replaceable>BITS</replaceable></option></term>
 
237
        <listitem>
 
238
          <para>
 
239
            Key length in bits.  Default is 2048.
 
240
          </para>
 
241
        </listitem>
 
242
      </varlistentry>
 
243
      
 
244
      <varlistentry>
 
245
        <term><option>--subtype
 
246
        <replaceable>KEYTYPE</replaceable></option></term>
 
247
        <term><option>-s
 
248
        <replaceable>KEYTYPE</replaceable></option></term>
 
249
        <listitem>
 
250
          <para>
 
251
            Subkey type.  Default is <quote>ELG-E</quote> (Elgamal
 
252
            encryption-only).
 
253
          </para>
 
254
        </listitem>
 
255
      </varlistentry>
 
256
      
 
257
      <varlistentry>
 
258
        <term><option>--sublength
 
259
        <replaceable>BITS</replaceable></option></term>
 
260
        <term><option>-L
 
261
        <replaceable>BITS</replaceable></option></term>
 
262
        <listitem>
 
263
          <para>
 
264
            Subkey length in bits.  Default is 2048.
 
265
          </para>
 
266
        </listitem>
 
267
      </varlistentry>
 
268
      
 
269
      <varlistentry>
 
270
        <term><option>--email
 
271
        <replaceable>ADDRESS</replaceable></option></term>
 
272
        <term><option>-e
 
273
        <replaceable>ADDRESS</replaceable></option></term>
218
274
        <listitem>
219
275
          <para>
220
276
            Email address of key.  Default is empty.
221
277
          </para>
222
278
        </listitem>
223
279
      </varlistentry>
224
 
 
 
280
      
225
281
      <varlistentry>
226
 
        <term><literal>-c</literal>, <literal>--comment</literal>
227
 
        <replaceable>comment</replaceable></term>
 
282
        <term><option>--comment
 
283
        <replaceable>TEXT</replaceable></option></term>
 
284
        <term><option>-c
 
285
        <replaceable>TEXT</replaceable></option></term>
228
286
        <listitem>
229
287
          <para>
230
288
            Comment field for key.  The default value is
231
 
            "<literal>Mandos client key</literal>".
 
289
            <quote><literal>Mandos client key</literal></quote>.
232
290
          </para>
233
291
        </listitem>
234
292
      </varlistentry>
235
 
 
 
293
      
236
294
      <varlistentry>
237
 
        <term><literal>-x</literal>, <literal>--expire</literal>
238
 
        <replaceable>time</replaceable></term>
 
295
        <term><option>--expire
 
296
        <replaceable>TIME</replaceable></option></term>
 
297
        <term><option>-x
 
298
        <replaceable>TIME</replaceable></option></term>
239
299
        <listitem>
240
300
          <para>
241
301
            Key expire time.  Default is no expiration.  See
244
304
          </para>
245
305
        </listitem>
246
306
      </varlistentry>
247
 
 
248
 
      <varlistentry>
249
 
        <term><literal>-f</literal>, <literal>--force</literal></term>
250
 
        <listitem>
251
 
          <para>
252
 
            Force overwriting old keys.
 
307
      
 
308
      <varlistentry>
 
309
        <term><option>--force</option></term>
 
310
        <term><option>-f</option></term>
 
311
        <listitem>
 
312
          <para>
 
313
            Force overwriting old key.
 
314
          </para>
 
315
        </listitem>
 
316
      </varlistentry>
 
317
      <varlistentry>
 
318
        <term><option>--password</option></term>
 
319
        <term><option>-p</option></term>
 
320
        <listitem>
 
321
          <para>
 
322
            Prompt for a password and encrypt it with the key already
 
323
            present in either <filename>/etc/mandos</filename> or the
 
324
            directory specified with the <option>--dir</option>
 
325
            option.  Outputs, on standard output, a section suitable
 
326
            for inclusion in <citerefentry><refentrytitle
 
327
            >mandos-clients.conf</refentrytitle><manvolnum
 
328
            >8</manvolnum></citerefentry>.  The host name or the name
 
329
            specified with the <option>--name</option> option is used
 
330
            for the section header.  All other options are ignored,
 
331
            and no key is created.
 
332
          </para>
 
333
        </listitem>
 
334
      </varlistentry>
 
335
      <varlistentry>
 
336
        <term><option>--passfile
 
337
        <replaceable>FILE</replaceable></option></term>
 
338
        <term><option>-F
 
339
        <replaceable>FILE</replaceable></option></term>
 
340
        <listitem>
 
341
          <para>
 
342
            The same as <option>--password</option>, but read from
 
343
            <replaceable>FILE</replaceable>, not the terminal.
253
344
          </para>
254
345
        </listitem>
255
346
      </varlistentry>
256
347
    </variablelist>
257
348
  </refsect1>
258
 
 
 
349
  
 
350
  <refsect1 id="overview">
 
351
    <title>OVERVIEW</title>
 
352
    <xi:include href="overview.xml"/>
 
353
    <para>
 
354
      This program is a small utility to generate new OpenPGP keys for
 
355
      new Mandos clients, and to generate sections for inclusion in
 
356
      <filename>clients.conf</filename> on the server.
 
357
    </para>
 
358
  </refsect1>
 
359
  
259
360
  <refsect1 id="exit_status">
260
361
    <title>EXIT STATUS</title>
261
362
    <para>
 
363
      The exit status will be 0 if a new key (or password, if the
 
364
      <option>--password</option> option was used) was successfully
 
365
      created, otherwise not.
262
366
    </para>
263
367
  </refsect1>
264
368
  
 
369
  <refsect1 id="environment">
 
370
    <title>ENVIRONMENT</title>
 
371
    <variablelist>
 
372
      <varlistentry>
 
373
        <term><envar>TMPDIR</envar></term>
 
374
        <listitem>
 
375
          <para>
 
376
            If set, temporary files will be created here. See
 
377
            <citerefentry><refentrytitle>mktemp</refentrytitle>
 
378
            <manvolnum>1</manvolnum></citerefentry>.
 
379
          </para>
 
380
        </listitem>
 
381
      </varlistentry>
 
382
    </variablelist>
 
383
  </refsect1>
 
384
  
265
385
  <refsect1 id="file">
266
386
    <title>FILES</title>
267
387
    <para>
268
 
    </para>
269
 
  </refsect1>
270
 
 
271
 
  <refsect1 id="bugs">
272
 
    <title>BUGS</title>
273
 
    <para>
274
 
    </para>
275
 
  </refsect1>
276
 
 
277
 
  <refsect1 id="examples">
278
 
    <title>EXAMPLES</title>
279
 
    <para>
280
 
    </para>
281
 
  </refsect1>
282
 
 
 
388
      Use the <option>--dir</option> option to change where
 
389
      <command>&COMMANDNAME;</command> will write the key files.  The
 
390
      default file names are shown here.
 
391
    </para>
 
392
    <variablelist>
 
393
      <varlistentry>
 
394
        <term><filename>/etc/mandos/seckey.txt</filename></term>
 
395
        <listitem>
 
396
          <para>
 
397
            OpenPGP secret key file which will be created or
 
398
            overwritten.
 
399
          </para>
 
400
        </listitem>
 
401
      </varlistentry>
 
402
      <varlistentry>
 
403
        <term><filename>/etc/mandos/pubkey.txt</filename></term>
 
404
        <listitem>
 
405
          <para>
 
406
            OpenPGP public key file which will be created or
 
407
            overwritten.
 
408
          </para>
 
409
        </listitem>
 
410
      </varlistentry>
 
411
      <varlistentry>
 
412
        <term><filename>/tmp</filename></term>
 
413
        <listitem>
 
414
          <para>
 
415
            Temporary files will be written here if
 
416
            <varname>TMPDIR</varname> is not set.
 
417
          </para>
 
418
        </listitem>
 
419
      </varlistentry>
 
420
    </variablelist>
 
421
  </refsect1>
 
422
  
 
423
<!--   <refsect1 id="bugs"> -->
 
424
<!--     <title>BUGS</title> -->
 
425
<!--     <para> -->
 
426
<!--     </para> -->
 
427
<!--   </refsect1> -->
 
428
  
 
429
  <refsect1 id="example">
 
430
    <title>EXAMPLE</title>
 
431
    <informalexample>
 
432
      <para>
 
433
        Normal invocation needs no options:
 
434
      </para>
 
435
      <para>
 
436
        <userinput>&COMMANDNAME;</userinput>
 
437
      </para>
 
438
    </informalexample>
 
439
    <informalexample>
 
440
      <para>
 
441
        Create key in another directory and of another type.  Force
 
442
        overwriting old key files:
 
443
      </para>
 
444
      <para>
 
445
 
 
446
<!-- do not wrap this line -->
 
447
<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>
 
448
 
 
449
      </para>
 
450
    </informalexample>
 
451
    <informalexample>
 
452
      <para>
 
453
        Prompt for a password, encrypt it with the key in
 
454
        <filename>/etc/mandos</filename> and output a section suitable
 
455
        for <filename>clients.conf</filename>.
 
456
      </para>
 
457
      <para>
 
458
        <userinput>&COMMANDNAME; --password</userinput>
 
459
      </para>
 
460
    </informalexample>
 
461
    <informalexample>
 
462
      <para>
 
463
        Prompt for a password, encrypt it with the key in the
 
464
        <filename>client-key</filename> directory and output a section
 
465
        suitable for <filename>clients.conf</filename>.
 
466
      </para>
 
467
      <para>
 
468
 
 
469
<!-- do not wrap this line -->
 
470
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
 
471
 
 
472
      </para>
 
473
    </informalexample>
 
474
  </refsect1>
 
475
  
283
476
  <refsect1 id="security">
284
477
    <title>SECURITY</title>
285
478
    <para>
 
479
      The <option>--type</option>, <option>--length</option>,
 
480
      <option>--subtype</option>, and <option>--sublength</option>
 
481
      options can be used to create keys of low security.  If in
 
482
      doubt, leave them to the default values.
 
483
    </para>
 
484
    <para>
 
485
      The key expire time is <emphasis>not</emphasis> guaranteed to be
 
486
      honored by <citerefentry><refentrytitle>mandos</refentrytitle>
 
487
      <manvolnum>8</manvolnum></citerefentry>.
286
488
    </para>
287
489
  </refsect1>
288
 
 
 
490
  
289
491
  <refsect1 id="see_also">
290
492
    <title>SEE ALSO</title>
291
493
    <para>
292
 
      <citerefentry><refentrytitle>password-request</refentrytitle>
293
 
      <manvolnum>8mandos</manvolnum></citerefentry>,
 
494
      <citerefentry><refentrytitle>gpg</refentrytitle>
 
495
      <manvolnum>1</manvolnum></citerefentry>,
 
496
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
 
497
      <manvolnum>5</manvolnum></citerefentry>,
294
498
      <citerefentry><refentrytitle>mandos</refentrytitle>
295
 
      <manvolnum>8</manvolnum></citerefentry>, and
296
 
      <citerefentry><refentrytitle>gpg</refentrytitle>
297
 
      <manvolnum>1</manvolnum></citerefentry>
 
499
      <manvolnum>8</manvolnum></citerefentry>,
 
500
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
 
501
      <manvolnum>8mandos</manvolnum></citerefentry>
298
502
    </para>
299
503
  </refsect1>
300
504
  
301
505
</refentry>
 
506
<!-- Local Variables: -->
 
507
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
 
508
<!-- time-stamp-end: "[\"']>" -->
 
509
<!-- time-stamp-format: "%:y-%02m-%02d" -->
 
510
<!-- End: -->