1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
<!ENTITY VERSION "1.0">
5
4
<!ENTITY COMMANDNAME "mandos-keygen">
6
<!ENTITY TIMESTAMP "2008-08-31">
5
<!ENTITY TIMESTAMP "2019-07-18">
6
<!ENTITY % common SYSTEM "common.ent">
9
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
11
12
<title>Mandos Manual</title>
12
13
<!-- NWalsh’s docbook scripts use this to generate the footer: -->
13
14
<productname>Mandos</productname>
14
<productnumber>&VERSION;</productnumber>
15
<productnumber>&version;</productnumber>
15
16
<date>&TIMESTAMP;</date>
18
19
<firstname>Björn</firstname>
19
20
<surname>Påhlsson</surname>
21
<email>belorn@fukt.bsnet.se</email>
22
<email>belorn@recompile.se</email>
25
26
<firstname>Teddy</firstname>
26
27
<surname>Hogeborn</surname>
28
<email>teddy@fukt.bsnet.se</email>
29
<email>teddy@recompile.se</email>
34
46
<holder>Teddy Hogeborn</holder>
35
47
<holder>Björn Påhlsson</holder>
39
This manual page is free software: you can redistribute it
40
and/or modify it under the terms of the GNU General Public
41
License as published by the Free Software Foundation,
42
either version 3 of the License, or (at your option) any
47
This manual page is distributed in the hope that it will
48
be useful, but WITHOUT ANY WARRANTY; without even the
49
implied warranty of MERCHANTABILITY or FITNESS FOR A
50
PARTICULAR PURPOSE. See the GNU General Public License
55
You should have received a copy of the GNU General Public
56
License along with this program; If not, see
57
<ulink url="http://www.gnu.org/licenses/"/>.
49
<xi:include href="legalnotice.xml"/>
63
53
<refentrytitle>&COMMANDNAME;</refentrytitle>
64
54
<manvolnum>8</manvolnum>
137
127
<replaceable>TIME</replaceable></option></arg>
140
<arg><option>--force</option></arg>
131
<arg choice="plain"><option>--tls-keytype
132
<replaceable>KEYTYPE</replaceable></option></arg>
133
<arg choice="plain"><option>-T
134
<replaceable>KEYTYPE</replaceable></option></arg>
138
<arg choice="plain"><option>--force</option></arg>
139
<arg choice="plain"><option>-f</option></arg>
143
143
<command>&COMMANDNAME;</command>
144
144
<group choice="req">
145
145
<arg choice="plain"><option>--password</option></arg>
146
146
<arg choice="plain"><option>-p</option></arg>
147
<arg choice="plain"><option>--passfile
148
<replaceable>FILE</replaceable></option></arg>
149
<arg choice="plain"><option>-F</option>
150
<replaceable>FILE</replaceable></arg>
180
188
<title>DESCRIPTION</title>
182
190
<command>&COMMANDNAME;</command> is a program to generate the
184
<citerefentry><refentrytitle>password-request</refentrytitle>
185
<manvolnum>8mandos</manvolnum></citerefentry>. The key is
186
normally written to /etc/mandos for later installation into the
187
initrd image, but this, and most other things, can be changed
188
with command line options.
191
TLS and OpenPGP keys used by
192
<citerefentry><refentrytitle>mandos-client</refentrytitle>
193
<manvolnum>8mandos</manvolnum></citerefentry>. The keys are
194
normally written to /etc/keys/mandos for later installation into
195
the initrd image, but this, and most other things, can be
196
changed with command line options.
191
199
This program can also be used with the
192
<option>--password</option> option to generate a ready-made
193
section for <filename>clients.conf</filename> (see
200
<option>--password</option> or <option>--passfile</option>
201
options to generate a ready-made section for
202
<filename>clients.conf</filename> (see
194
203
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
195
204
<manvolnum>5</manvolnum></citerefentry>).
227
236
<replaceable>DIRECTORY</replaceable></option></term>
230
Target directory for key files. Default is
231
<filename>/etc/mandos</filename>.
239
Target directory for key files. Default is <filename
240
class="directory">/etc/keys/mandos</filename>.
237
246
<term><option>--type
238
247
<replaceable>TYPE</replaceable></option></term>
332
<term><option>--tls-keytype
333
<replaceable>KEYTYPE</replaceable></option></term>
335
<replaceable>KEYTYPE</replaceable></option></term>
338
TLS key type. Default is <quote>ed25519</quote>
325
344
<term><option>--force</option></term>
326
345
<term><option>-f</option></term>
338
357
Prompt for a password and encrypt it with the key already
339
present in either <filename>/etc/mandos</filename> or the
340
directory specified with the <option>--dir</option>
358
present in either <filename>/etc/keys/mandos</filename> or
359
the directory specified with the <option>--dir</option>
341
360
option. Outputs, on standard output, a section suitable
342
361
for inclusion in <citerefentry><refentrytitle
343
362
>mandos-clients.conf</refentrytitle><manvolnum
344
363
>8</manvolnum></citerefentry>. The host name or the name
345
364
specified with the <option>--name</option> option is used
346
365
for the section header. All other options are ignored,
347
and no key is created.
366
and no key is created. Note: white space is stripped from
367
the beginning and from the end of the password; See <xref
373
<term><option>--passfile
374
<replaceable>FILE</replaceable></option></term>
376
<replaceable>FILE</replaceable></option></term>
379
The same as <option>--password</option>, but read from
380
<replaceable>FILE</replaceable>, not the terminal, and
381
white space is not stripped from the password in any way.
386
<term><option>--no-ssh</option></term>
387
<term><option>-S</option></term>
390
When <option>--password</option> or
391
<option>--passfile</option> is given, this option will
392
prevent <command>&COMMANDNAME;</command> from calling
393
<command>ssh-keyscan</command> to get an SSH fingerprint
394
for this host and, if successful, output suitable config
395
options to use this fingerprint as a
396
<option>checker</option> option in the output. This is
397
otherwise the default behavior.
354
404
<refsect1 id="overview">
355
405
<title>OVERVIEW</title>
356
406
<xi:include href="overview.xml"/>
358
This program is a small utility to generate new OpenPGP keys for
359
new Mandos clients, and to generate sections for inclusion in
360
<filename>clients.conf</filename> on the server.
408
This program is a small utility to generate new TLS and OpenPGP
409
keys for new Mandos clients, and to generate sections for
410
inclusion in <filename>clients.conf</filename> on the server.
364
414
<refsect1 id="exit_status">
365
415
<title>EXIT STATUS</title>
416
<term><filename>/tmp</filename></term>
466
<term><filename>/etc/keys/mandos/tls-privkey.pem</filename></term>
469
Private key file which will be created or overwritten.
474
<term><filename>/etc/keys/mandos/tls-pubkey.pem</filename></term>
477
Public key file which will be created or overwritten.
482
<term><filename class="directory">/tmp</filename></term>
419
485
Temporary files will be written here if
427
493
<refsect1 id="bugs">
428
494
<title>BUGS</title>
430
None are known at this time.
496
The <option>--password</option>/<option>-p</option> option
497
strips white space from the start and from the end of the
498
password before using it. If this is a problem, use the
499
<option>--passfile</option> option instead, which does not do
502
<xi:include href="bugs.xml"/>
434
505
<refsect1 id="example">
435
506
<title>EXAMPLE</title>
436
507
<informalexample>
455
526
</informalexample>
456
527
<informalexample>
458
Prompt for a password, encrypt it with the key in
459
<filename>/etc/mandos</filename> and output a section suitable
460
for <filename>clients.conf</filename>.
529
Prompt for a password, encrypt it with the keys in <filename
530
class="directory">/etc/keys/mandos</filename> and output a
531
section suitable for <filename>clients.conf</filename>.
463
534
<userinput>&COMMANDNAME; --password</userinput>
492
563
<manvolnum>8</manvolnum></citerefentry>.
496
567
<refsect1 id="see_also">
497
568
<title>SEE ALSO</title>
570
<citerefentry><refentrytitle>intro</refentrytitle>
571
<manvolnum>8mandos</manvolnum></citerefentry>,
499
572
<citerefentry><refentrytitle>gpg</refentrytitle>
500
573
<manvolnum>1</manvolnum></citerefentry>,
501
574
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
502
575
<manvolnum>5</manvolnum></citerefentry>,
503
576
<citerefentry><refentrytitle>mandos</refentrytitle>
504
577
<manvolnum>8</manvolnum></citerefentry>,
505
<citerefentry><refentrytitle>password-request</refentrytitle>
506
<manvolnum>8mandos</manvolnum></citerefentry>
578
<citerefentry><refentrytitle>mandos-client</refentrytitle>
579
<manvolnum>8mandos</manvolnum></citerefentry>,
580
<citerefentry><refentrytitle>ssh-keyscan</refentrytitle>
581
<manvolnum>1</manvolnum></citerefentry>
added
removed
mandos-keygen.xml
