1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
<!ENTITY VERSION "1.0">
5
4
<!ENTITY COMMANDNAME "mandos-keygen">
6
<!ENTITY TIMESTAMP "2008-09-12">
5
<!ENTITY TIMESTAMP "2019-07-18">
6
<!ENTITY % common SYSTEM "common.ent">
9
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
11
12
<title>Mandos Manual</title>
12
13
<!-- NWalsh’s docbook scripts use this to generate the footer: -->
13
14
<productname>Mandos</productname>
14
<productnumber>&VERSION;</productnumber>
15
<productnumber>&version;</productnumber>
15
16
<date>&TIMESTAMP;</date>
18
19
<firstname>Björn</firstname>
19
20
<surname>Påhlsson</surname>
21
<email>belorn@fukt.bsnet.se</email>
22
<email>belorn@recompile.se</email>
25
26
<firstname>Teddy</firstname>
26
27
<surname>Hogeborn</surname>
28
<email>teddy@fukt.bsnet.se</email>
29
<email>teddy@recompile.se</email>
34
46
<holder>Teddy Hogeborn</holder>
35
47
<holder>Björn Påhlsson</holder>
115
127
<replaceable>TIME</replaceable></option></arg>
118
<arg><option>--force</option></arg>
131
<arg choice="plain"><option>--tls-keytype
132
<replaceable>KEYTYPE</replaceable></option></arg>
133
<arg choice="plain"><option>-T
134
<replaceable>KEYTYPE</replaceable></option></arg>
138
<arg choice="plain"><option>--force</option></arg>
139
<arg choice="plain"><option>-f</option></arg>
121
143
<command>&COMMANDNAME;</command>
122
144
<group choice="req">
123
145
<arg choice="plain"><option>--password</option></arg>
124
146
<arg choice="plain"><option>-p</option></arg>
147
<arg choice="plain"><option>--passfile
148
<replaceable>FILE</replaceable></option></arg>
149
<arg choice="plain"><option>-F</option>
150
<replaceable>FILE</replaceable></arg>
137
163
<arg choice="plain"><option>-n
138
164
<replaceable>NAME</replaceable></option></arg>
167
<arg choice="plain"><option>--no-ssh</option></arg>
168
<arg choice="plain"><option>-S</option></arg>
142
172
<command>&COMMANDNAME;</command>
158
188
<title>DESCRIPTION</title>
160
190
<command>&COMMANDNAME;</command> is a program to generate the
191
TLS and OpenPGP keys used by
162
192
<citerefentry><refentrytitle>mandos-client</refentrytitle>
163
<manvolnum>8mandos</manvolnum></citerefentry>. The key is
164
normally written to /etc/mandos for later installation into the
165
initrd image, but this, and most other things, can be changed
166
with command line options.
193
<manvolnum>8mandos</manvolnum></citerefentry>. The keys are
194
normally written to /etc/keys/mandos for later installation into
195
the initrd image, but this, and most other things, can be
196
changed with command line options.
169
199
This program can also be used with the
170
<option>--password</option> option to generate a ready-made
171
section for <filename>clients.conf</filename> (see
200
<option>--password</option> or <option>--passfile</option>
201
options to generate a ready-made section for
202
<filename>clients.conf</filename> (see
172
203
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
173
204
<manvolnum>5</manvolnum></citerefentry>).
205
236
<replaceable>DIRECTORY</replaceable></option></term>
208
Target directory for key files. Default is
209
<filename>/etc/mandos</filename>.
239
Target directory for key files. Default is <filename
240
class="directory">/etc/keys/mandos</filename>.
332
<term><option>--tls-keytype
333
<replaceable>KEYTYPE</replaceable></option></term>
335
<replaceable>KEYTYPE</replaceable></option></term>
338
TLS key type. Default is <quote>ed25519</quote>
303
344
<term><option>--force</option></term>
304
345
<term><option>-f</option></term>
316
357
Prompt for a password and encrypt it with the key already
317
present in either <filename>/etc/mandos</filename> or the
318
directory specified with the <option>--dir</option>
358
present in either <filename>/etc/keys/mandos</filename> or
359
the directory specified with the <option>--dir</option>
319
360
option. Outputs, on standard output, a section suitable
320
361
for inclusion in <citerefentry><refentrytitle
321
362
>mandos-clients.conf</refentrytitle><manvolnum
322
363
>8</manvolnum></citerefentry>. The host name or the name
323
364
specified with the <option>--name</option> option is used
324
365
for the section header. All other options are ignored,
325
and no key is created.
366
and no key is created. Note: white space is stripped from
367
the beginning and from the end of the password; See <xref
373
<term><option>--passfile
374
<replaceable>FILE</replaceable></option></term>
376
<replaceable>FILE</replaceable></option></term>
379
The same as <option>--password</option>, but read from
380
<replaceable>FILE</replaceable>, not the terminal, and
381
white space is not stripped from the password in any way.
386
<term><option>--no-ssh</option></term>
387
<term><option>-S</option></term>
390
When <option>--password</option> or
391
<option>--passfile</option> is given, this option will
392
prevent <command>&COMMANDNAME;</command> from calling
393
<command>ssh-keyscan</command> to get an SSH fingerprint
394
for this host and, if successful, output suitable config
395
options to use this fingerprint as a
396
<option>checker</option> option in the output. This is
397
otherwise the default behavior.
333
405
<title>OVERVIEW</title>
334
406
<xi:include href="overview.xml"/>
336
This program is a small utility to generate new OpenPGP keys for
337
new Mandos clients, and to generate sections for inclusion in
338
<filename>clients.conf</filename> on the server.
408
This program is a small utility to generate new TLS and OpenPGP
409
keys for new Mandos clients, and to generate sections for
410
inclusion in <filename>clients.conf</filename> on the server.
394
<term><filename>/tmp</filename></term>
466
<term><filename>/etc/keys/mandos/tls-privkey.pem</filename></term>
469
Private key file which will be created or overwritten.
474
<term><filename>/etc/keys/mandos/tls-pubkey.pem</filename></term>
477
Public key file which will be created or overwritten.
482
<term><filename class="directory">/tmp</filename></term>
397
485
Temporary files will be written here if
405
<!-- <refsect1 id="bugs"> -->
406
<!-- <title>BUGS</title> -->
496
The <option>--password</option>/<option>-p</option> option
497
strips white space from the start and from the end of the
498
password before using it. If this is a problem, use the
499
<option>--passfile</option> option instead, which does not do
502
<xi:include href="bugs.xml"/>
411
505
<refsect1 id="example">
412
506
<title>EXAMPLE</title>
432
526
</informalexample>
433
527
<informalexample>
435
Prompt for a password, encrypt it with the key in
436
<filename>/etc/mandos</filename> and output a section suitable
437
for <filename>clients.conf</filename>.
529
Prompt for a password, encrypt it with the keys in <filename
530
class="directory">/etc/keys/mandos</filename> and output a
531
section suitable for <filename>clients.conf</filename>.
440
534
<userinput>&COMMANDNAME; --password</userinput>
442
536
</informalexample>
443
537
<informalexample>
445
Prompt for a password, encrypt it with the key in the
539
Prompt for a password, encrypt it with the keys in the
446
540
<filename>client-key</filename> directory and output a section
447
541
suitable for <filename>clients.conf</filename>.
473
567
<refsect1 id="see_also">
474
568
<title>SEE ALSO</title>
570
<citerefentry><refentrytitle>intro</refentrytitle>
571
<manvolnum>8mandos</manvolnum></citerefentry>,
476
572
<citerefentry><refentrytitle>gpg</refentrytitle>
477
573
<manvolnum>1</manvolnum></citerefentry>,
478
574
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
480
576
<citerefentry><refentrytitle>mandos</refentrytitle>
481
577
<manvolnum>8</manvolnum></citerefentry>,
482
578
<citerefentry><refentrytitle>mandos-client</refentrytitle>
483
<manvolnum>8mandos</manvolnum></citerefentry>
579
<manvolnum>8mandos</manvolnum></citerefentry>,
580
<citerefentry><refentrytitle>ssh-keyscan</refentrytitle>
581
<manvolnum>1</manvolnum></citerefentry>
added
removed
mandos-keygen.xml
