/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-keygen.xml

merge

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-keygen.xml
1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
 
4
<!ENTITY VERSION "1.0">
4
5
<!ENTITY COMMANDNAME "mandos-keygen">
5
 
<!ENTITY TIMESTAMP "2016-03-05">
6
 
<!ENTITY % common SYSTEM "common.ent">
7
 
%common;
8
6
]>
9
7
 
10
8
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
11
9
  <refentryinfo>
12
 
    <title>Mandos Manual</title>
 
10
    <title>&COMMANDNAME;</title>
13
11
    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
14
 
    <productname>Mandos</productname>
15
 
    <productnumber>&version;</productnumber>
16
 
    <date>&TIMESTAMP;</date>
 
12
    <productname>&COMMANDNAME;</productname>
 
13
    <productnumber>&VERSION;</productnumber>
17
14
    <authorgroup>
18
15
      <author>
19
16
        <firstname>Björn</firstname>
20
17
        <surname>Påhlsson</surname>
21
18
        <address>
22
 
          <email>belorn@recompile.se</email>
 
19
          <email>belorn@fukt.bsnet.se</email>
23
20
        </address>
24
21
      </author>
25
22
      <author>
26
23
        <firstname>Teddy</firstname>
27
24
        <surname>Hogeborn</surname>
28
25
        <address>
29
 
          <email>teddy@recompile.se</email>
 
26
          <email>teddy@fukt.bsnet.se</email>
30
27
        </address>
31
28
      </author>
32
29
    </authorgroup>
33
30
    <copyright>
34
31
      <year>2008</year>
35
 
      <year>2009</year>
36
 
      <year>2010</year>
37
 
      <year>2011</year>
38
 
      <year>2012</year>
39
 
      <year>2013</year>
40
 
      <year>2014</year>
41
 
      <year>2015</year>
42
 
      <year>2016</year>
43
32
      <holder>Teddy Hogeborn</holder>
44
33
      <holder>Björn Påhlsson</holder>
45
34
    </copyright>
46
 
    <xi:include href="legalnotice.xml"/>
 
35
    <legalnotice>
 
36
      <para>
 
37
        This manual page is free software: you can redistribute it
 
38
        and/or modify it under the terms of the GNU General Public
 
39
        License as published by the Free Software Foundation,
 
40
        either version 3 of the License, or (at your option) any
 
41
        later version.
 
42
      </para>
 
43
 
 
44
      <para>
 
45
        This manual page is distributed in the hope that it will
 
46
        be useful, but WITHOUT ANY WARRANTY; without even the
 
47
        implied warranty of MERCHANTABILITY or FITNESS FOR A
 
48
        PARTICULAR PURPOSE.  See the GNU General Public License
 
49
        for more details.
 
50
      </para>
 
51
 
 
52
      <para>
 
53
        You should have received a copy of the GNU General Public
 
54
        License along with this program; If not, see
 
55
        <ulink url="http://www.gnu.org/licenses/"/>.
 
56
      </para>
 
57
    </legalnotice>
47
58
  </refentryinfo>
48
 
  
 
59
 
49
60
  <refmeta>
50
61
    <refentrytitle>&COMMANDNAME;</refentrytitle>
51
62
    <manvolnum>8</manvolnum>
54
65
  <refnamediv>
55
66
    <refname><command>&COMMANDNAME;</command></refname>
56
67
    <refpurpose>
57
 
      Generate key and password for Mandos client and server.
 
68
      Generate keys for <citerefentry><refentrytitle>password-request
 
69
      </refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
58
70
    </refpurpose>
59
71
  </refnamediv>
60
 
  
 
72
 
61
73
  <refsynopsisdiv>
62
74
    <cmdsynopsis>
63
75
      <command>&COMMANDNAME;</command>
64
 
      <group>
65
 
        <arg choice="plain"><option>--dir
66
 
        <replaceable>DIRECTORY</replaceable></option></arg>
67
 
        <arg choice="plain"><option>-d
68
 
        <replaceable>DIRECTORY</replaceable></option></arg>
69
 
      </group>
70
 
      <sbr/>
71
 
      <group>
72
 
        <arg choice="plain"><option>--type
73
 
        <replaceable>KEYTYPE</replaceable></option></arg>
74
 
        <arg choice="plain"><option>-t
75
 
        <replaceable>KEYTYPE</replaceable></option></arg>
76
 
      </group>
77
 
      <sbr/>
78
 
      <group>
79
 
        <arg choice="plain"><option>--length
80
 
        <replaceable>BITS</replaceable></option></arg>
81
 
        <arg choice="plain"><option>-l
82
 
        <replaceable>BITS</replaceable></option></arg>
83
 
      </group>
84
 
      <sbr/>
85
 
      <group>
86
 
        <arg choice="plain"><option>--subtype
87
 
        <replaceable>KEYTYPE</replaceable></option></arg>
88
 
        <arg choice="plain"><option>-s
89
 
        <replaceable>KEYTYPE</replaceable></option></arg>
90
 
      </group>
91
 
      <sbr/>
92
 
      <group>
93
 
        <arg choice="plain"><option>--sublength
94
 
        <replaceable>BITS</replaceable></option></arg>
95
 
        <arg choice="plain"><option>-L
96
 
        <replaceable>BITS</replaceable></option></arg>
97
 
      </group>
98
 
      <sbr/>
99
 
      <group>
100
 
        <arg choice="plain"><option>--name
101
 
        <replaceable>NAME</replaceable></option></arg>
102
 
        <arg choice="plain"><option>-n
103
 
        <replaceable>NAME</replaceable></option></arg>
104
 
      </group>
105
 
      <sbr/>
106
 
      <group>
107
 
        <arg choice="plain"><option>--email
108
 
        <replaceable>ADDRESS</replaceable></option></arg>
109
 
        <arg choice="plain"><option>-e
110
 
        <replaceable>ADDRESS</replaceable></option></arg>
111
 
      </group>
112
 
      <sbr/>
113
 
      <group>
114
 
        <arg choice="plain"><option>--comment
115
 
        <replaceable>TEXT</replaceable></option></arg>
116
 
        <arg choice="plain"><option>-c
117
 
        <replaceable>TEXT</replaceable></option></arg>
118
 
      </group>
119
 
      <sbr/>
120
 
      <group>
121
 
        <arg choice="plain"><option>--expire
122
 
        <replaceable>TIME</replaceable></option></arg>
123
 
        <arg choice="plain"><option>-x
124
 
        <replaceable>TIME</replaceable></option></arg>
125
 
      </group>
126
 
      <sbr/>
127
 
      <group>
 
76
      <group choice="opt">
 
77
        <arg choice="plain"><option>--dir</option>
 
78
        <replaceable>directory</replaceable></arg>
 
79
      </group>
 
80
      <group choice="opt">
 
81
        <arg choice="plain"><option>--type</option>
 
82
        <replaceable>type</replaceable></arg>
 
83
      </group>
 
84
      <group choice="opt">
 
85
        <arg choice="plain"><option>--length</option>
 
86
        <replaceable>bits</replaceable></arg>
 
87
      </group>
 
88
      <group choice="opt">
 
89
        <arg choice="plain"><option>--subtype</option>
 
90
        <replaceable>type</replaceable></arg>
 
91
      </group>
 
92
      <group choice="opt">
 
93
        <arg choice="plain"><option>--sublength</option>
 
94
        <replaceable>bits</replaceable></arg>
 
95
      </group>
 
96
      <group choice="opt">
 
97
        <arg choice="plain"><option>--name</option>
 
98
        <replaceable>NAME</replaceable></arg>
 
99
      </group>
 
100
      <group choice="opt">
 
101
        <arg choice="plain"><option>--email</option>
 
102
        <replaceable>EMAIL</replaceable></arg>
 
103
      </group>
 
104
      <group choice="opt">
 
105
        <arg choice="plain"><option>--comment</option>
 
106
        <replaceable>COMMENT</replaceable></arg>
 
107
      </group>
 
108
      <group choice="opt">
 
109
        <arg choice="plain"><option>--expire</option>
 
110
        <replaceable>TIME</replaceable></arg>
 
111
      </group>
 
112
      <group choice="opt">
128
113
        <arg choice="plain"><option>--force</option></arg>
 
114
      </group>
 
115
    </cmdsynopsis>
 
116
    <cmdsynopsis>
 
117
      <command>&COMMANDNAME;</command>
 
118
      <group choice="opt">
 
119
        <arg choice="plain"><option>-d</option>
 
120
        <replaceable>directory</replaceable></arg>
 
121
      </group>
 
122
      <group choice="opt">
 
123
        <arg choice="plain"><option>-t</option>
 
124
        <replaceable>type</replaceable></arg>
 
125
      </group>
 
126
      <group choice="opt">
 
127
        <arg choice="plain"><option>-l</option>
 
128
        <replaceable>bits</replaceable></arg>
 
129
      </group>
 
130
      <group choice="opt">
 
131
        <arg choice="plain"><option>-s</option>
 
132
        <replaceable>type</replaceable></arg>
 
133
      </group>
 
134
      <group choice="opt">
 
135
        <arg choice="plain"><option>-L</option>
 
136
        <replaceable>bits</replaceable></arg>
 
137
      </group>
 
138
      <group choice="opt">
 
139
        <arg choice="plain"><option>-n</option>
 
140
        <replaceable>NAME</replaceable></arg>
 
141
      </group>
 
142
      <group choice="opt">
 
143
        <arg choice="plain"><option>-e</option>
 
144
        <replaceable>EMAIL</replaceable></arg>
 
145
      </group>
 
146
      <group choice="opt">
 
147
        <arg choice="plain"><option>-c</option>
 
148
        <replaceable>COMMENT</replaceable></arg>
 
149
      </group>
 
150
      <group choice="opt">
 
151
        <arg choice="plain"><option>-x</option>
 
152
        <replaceable>TIME</replaceable></arg>
 
153
      </group>
 
154
      <group choice="opt">
129
155
        <arg choice="plain"><option>-f</option></arg>
130
156
      </group>
131
157
    </cmdsynopsis>
132
158
    <cmdsynopsis>
133
159
      <command>&COMMANDNAME;</command>
134
160
      <group choice="req">
135
 
        <arg choice="plain"><option>--password</option></arg>
136
 
        <arg choice="plain"><option>-p</option></arg>
137
 
        <arg choice="plain"><option>--passfile
138
 
        <replaceable>FILE</replaceable></option></arg>
139
 
        <arg choice="plain"><option>-F</option>
140
 
        <replaceable>FILE</replaceable></arg>
141
 
      </group>
142
 
      <sbr/>
143
 
      <group>
144
 
        <arg choice="plain"><option>--dir
145
 
        <replaceable>DIRECTORY</replaceable></option></arg>
146
 
        <arg choice="plain"><option>-d
147
 
        <replaceable>DIRECTORY</replaceable></option></arg>
148
 
      </group>
149
 
      <sbr/>
150
 
      <group>
151
 
        <arg choice="plain"><option>--name
152
 
        <replaceable>NAME</replaceable></option></arg>
153
 
        <arg choice="plain"><option>-n
154
 
        <replaceable>NAME</replaceable></option></arg>
155
 
      </group>
156
 
      <group>
157
 
        <arg choice="plain"><option>--no-ssh</option></arg>
158
 
        <arg choice="plain"><option>-S</option></arg>
159
 
      </group>
160
 
    </cmdsynopsis>
161
 
    <cmdsynopsis>
162
 
      <command>&COMMANDNAME;</command>
163
 
      <group choice="req">
 
161
        <arg choice="plain"><option>-h</option></arg>
164
162
        <arg choice="plain"><option>--help</option></arg>
165
 
        <arg choice="plain"><option>-h</option></arg>
166
163
      </group>
167
164
    </cmdsynopsis>
168
165
    <cmdsynopsis>
169
166
      <command>&COMMANDNAME;</command>
170
167
      <group choice="req">
 
168
        <arg choice="plain"><option>-v</option></arg>
171
169
        <arg choice="plain"><option>--version</option></arg>
172
 
        <arg choice="plain"><option>-v</option></arg>
173
170
      </group>
174
171
    </cmdsynopsis>
175
172
  </refsynopsisdiv>
176
 
  
 
173
 
177
174
  <refsect1 id="description">
178
175
    <title>DESCRIPTION</title>
179
176
    <para>
180
177
      <command>&COMMANDNAME;</command> is a program to generate the
181
 
      OpenPGP key used by
182
 
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
183
 
      <manvolnum>8mandos</manvolnum></citerefentry>.  The key is
 
178
      OpenPGP keys used by
 
179
      <citerefentry><refentrytitle>password-request</refentrytitle>
 
180
      <manvolnum>8mandos</manvolnum></citerefentry>.  The keys are
184
181
      normally written to /etc/mandos for later installation into the
185
 
      initrd image, but this, and most other things, can be changed
186
 
      with command line options.
187
 
    </para>
188
 
    <para>
189
 
      This program can also be used with the
190
 
      <option>--password</option> or <option>--passfile</option>
191
 
      options to generate a ready-made section for
192
 
      <filename>clients.conf</filename> (see
193
 
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
194
 
      <manvolnum>5</manvolnum></citerefentry>).
 
182
      initrd image, but this, like most things, can be changed with
 
183
      command line options.
195
184
    </para>
196
185
  </refsect1>
197
186
  
198
187
  <refsect1 id="purpose">
199
188
    <title>PURPOSE</title>
 
189
 
200
190
    <para>
201
191
      The purpose of this is to enable <emphasis>remote and unattended
202
192
      rebooting</emphasis> of client host computer with an
203
193
      <emphasis>encrypted root file system</emphasis>.  See <xref
204
194
      linkend="overview"/> for details.
205
195
    </para>
 
196
 
206
197
  </refsect1>
207
198
  
208
199
  <refsect1 id="options">
209
200
    <title>OPTIONS</title>
210
 
    
 
201
 
211
202
    <variablelist>
212
203
      <varlistentry>
213
 
        <term><option>--help</option></term>
214
 
        <term><option>-h</option></term>
 
204
        <term><literal>-h</literal>, <literal>--help</literal></term>
215
205
        <listitem>
216
206
          <para>
217
207
            Show a help message and exit
218
208
          </para>
219
209
        </listitem>
220
210
      </varlistentry>
221
 
      
222
 
      <varlistentry>
223
 
        <term><option>--dir
224
 
        <replaceable>DIRECTORY</replaceable></option></term>
225
 
        <term><option>-d
226
 
        <replaceable>DIRECTORY</replaceable></option></term>
227
 
        <listitem>
228
 
          <para>
229
 
            Target directory for key files.  Default is
230
 
            <filename class="directory">/etc/mandos</filename>.
231
 
          </para>
232
 
        </listitem>
233
 
      </varlistentry>
234
 
      
235
 
      <varlistentry>
236
 
        <term><option>--type
237
 
        <replaceable>TYPE</replaceable></option></term>
238
 
        <term><option>-t
239
 
        <replaceable>TYPE</replaceable></option></term>
240
 
        <listitem>
241
 
          <para>
242
 
            Key type.  Default is <quote>RSA</quote>.
243
 
          </para>
244
 
        </listitem>
245
 
      </varlistentry>
246
 
      
247
 
      <varlistentry>
248
 
        <term><option>--length
249
 
        <replaceable>BITS</replaceable></option></term>
250
 
        <term><option>-l
251
 
        <replaceable>BITS</replaceable></option></term>
252
 
        <listitem>
253
 
          <para>
254
 
            Key length in bits.  Default is 4096.
255
 
          </para>
256
 
        </listitem>
257
 
      </varlistentry>
258
 
      
259
 
      <varlistentry>
260
 
        <term><option>--subtype
261
 
        <replaceable>KEYTYPE</replaceable></option></term>
262
 
        <term><option>-s
263
 
        <replaceable>KEYTYPE</replaceable></option></term>
264
 
        <listitem>
265
 
          <para>
266
 
            Subkey type.  Default is <quote>RSA</quote> (Elgamal
 
211
 
 
212
      <varlistentry>
 
213
        <term><literal>-d</literal>, <literal>--dir
 
214
        <replaceable>directory</replaceable></literal></term>
 
215
        <listitem>
 
216
          <para>
 
217
            Target directory for key files.
 
218
          </para>
 
219
        </listitem>
 
220
      </varlistentry>
 
221
 
 
222
      <varlistentry>
 
223
        <term><literal>-t</literal>, <literal>--type
 
224
        <replaceable>type</replaceable></literal></term>
 
225
        <listitem>
 
226
          <para>
 
227
            Key type.  Default is <quote>DSA</quote>.
 
228
          </para>
 
229
        </listitem>
 
230
      </varlistentry>
 
231
 
 
232
      <varlistentry>
 
233
        <term><literal>-l</literal>, <literal>--length
 
234
        <replaceable>bits</replaceable></literal></term>
 
235
        <listitem>
 
236
          <para>
 
237
            Key length in bits.  Default is 1024.
 
238
          </para>
 
239
        </listitem>
 
240
      </varlistentry>
 
241
 
 
242
      <varlistentry>
 
243
        <term><literal>-s</literal>, <literal>--subtype
 
244
        <replaceable>type</replaceable></literal></term>
 
245
        <listitem>
 
246
          <para>
 
247
            Subkey type.  Default is <quote>ELG-E</quote> (Elgamal
267
248
            encryption-only).
268
249
          </para>
269
250
        </listitem>
270
251
      </varlistentry>
271
 
      
 
252
 
272
253
      <varlistentry>
273
 
        <term><option>--sublength
274
 
        <replaceable>BITS</replaceable></option></term>
275
 
        <term><option>-L
276
 
        <replaceable>BITS</replaceable></option></term>
 
254
        <term><literal>-L</literal>, <literal>--sublength
 
255
        <replaceable>bits</replaceable></literal></term>
277
256
        <listitem>
278
257
          <para>
279
 
            Subkey length in bits.  Default is 4096.
 
258
            Subkey length in bits.  Default is 2048.
280
259
          </para>
281
260
        </listitem>
282
261
      </varlistentry>
283
 
      
 
262
 
284
263
      <varlistentry>
285
 
        <term><option>--email
286
 
        <replaceable>ADDRESS</replaceable></option></term>
287
 
        <term><option>-e
288
 
        <replaceable>ADDRESS</replaceable></option></term>
 
264
        <term><literal>-e</literal>, <literal>--email</literal>
 
265
        <replaceable>address</replaceable></term>
289
266
        <listitem>
290
267
          <para>
291
268
            Email address of key.  Default is empty.
292
269
          </para>
293
270
        </listitem>
294
271
      </varlistentry>
295
 
      
 
272
 
296
273
      <varlistentry>
297
 
        <term><option>--comment
298
 
        <replaceable>TEXT</replaceable></option></term>
299
 
        <term><option>-c
300
 
        <replaceable>TEXT</replaceable></option></term>
 
274
        <term><literal>-c</literal>, <literal>--comment</literal>
 
275
        <replaceable>comment</replaceable></term>
301
276
        <listitem>
302
277
          <para>
303
 
            Comment field for key.  Default is empty.
 
278
            Comment field for key.  The default value is
 
279
            <quote><literal>Mandos client key</literal></quote>.
304
280
          </para>
305
281
        </listitem>
306
282
      </varlistentry>
307
 
      
 
283
 
308
284
      <varlistentry>
309
 
        <term><option>--expire
310
 
        <replaceable>TIME</replaceable></option></term>
311
 
        <term><option>-x
312
 
        <replaceable>TIME</replaceable></option></term>
 
285
        <term><literal>-x</literal>, <literal>--expire</literal>
 
286
        <replaceable>time</replaceable></term>
313
287
        <listitem>
314
288
          <para>
315
289
            Key expire time.  Default is no expiration.  See
318
292
          </para>
319
293
        </listitem>
320
294
      </varlistentry>
321
 
      
322
 
      <varlistentry>
323
 
        <term><option>--force</option></term>
324
 
        <term><option>-f</option></term>
325
 
        <listitem>
326
 
          <para>
327
 
            Force overwriting old key.
328
 
          </para>
329
 
        </listitem>
330
 
      </varlistentry>
331
 
      <varlistentry>
332
 
        <term><option>--password</option></term>
333
 
        <term><option>-p</option></term>
334
 
        <listitem>
335
 
          <para>
336
 
            Prompt for a password and encrypt it with the key already
337
 
            present in either <filename>/etc/mandos</filename> or the
338
 
            directory specified with the <option>--dir</option>
339
 
            option.  Outputs, on standard output, a section suitable
340
 
            for inclusion in <citerefentry><refentrytitle
341
 
            >mandos-clients.conf</refentrytitle><manvolnum
342
 
            >8</manvolnum></citerefentry>.  The host name or the name
343
 
            specified with the <option>--name</option> option is used
344
 
            for the section header.  All other options are ignored,
345
 
            and no key is created.
346
 
          </para>
347
 
        </listitem>
348
 
      </varlistentry>
349
 
      <varlistentry>
350
 
        <term><option>--passfile
351
 
        <replaceable>FILE</replaceable></option></term>
352
 
        <term><option>-F
353
 
        <replaceable>FILE</replaceable></option></term>
354
 
        <listitem>
355
 
          <para>
356
 
            The same as <option>--password</option>, but read from
357
 
            <replaceable>FILE</replaceable>, not the terminal.
358
 
          </para>
359
 
        </listitem>
360
 
      </varlistentry>
361
 
      <varlistentry>
362
 
        <term><option>--no-ssh</option></term>
363
 
        <term><option>-S</option></term>
364
 
        <listitem>
365
 
          <para>
366
 
            When <option>--password</option> or
367
 
            <option>--passfile</option> is given, this option will
368
 
            prevent <command>&COMMANDNAME;</command> from calling
369
 
            <command>ssh-keyscan</command> to get an SSH fingerprint
370
 
            for this host and, if successful, output suitable config
371
 
            options to use this fingerprint as a
372
 
            <option>checker</option> option in the output.  This is
373
 
            otherwise the default behavior.
 
295
 
 
296
      <varlistentry>
 
297
        <term><literal>-f</literal>, <literal>--force</literal></term>
 
298
        <listitem>
 
299
          <para>
 
300
            Force overwriting old keys.
374
301
          </para>
375
302
        </listitem>
376
303
      </varlistentry>
377
304
    </variablelist>
378
305
  </refsect1>
379
 
  
 
306
 
380
307
  <refsect1 id="overview">
381
308
    <title>OVERVIEW</title>
382
309
    <xi:include href="overview.xml"/>
383
310
    <para>
384
311
      This program is a small utility to generate new OpenPGP keys for
385
 
      new Mandos clients, and to generate sections for inclusion in
386
 
      <filename>clients.conf</filename> on the server.
 
312
      new Mandos clients.
387
313
    </para>
388
314
  </refsect1>
389
 
  
 
315
 
390
316
  <refsect1 id="exit_status">
391
317
    <title>EXIT STATUS</title>
392
318
    <para>
393
 
      The exit status will be 0 if a new key (or password, if the
394
 
      <option>--password</option> option was used) was successfully
395
 
      created, otherwise not.
 
319
      The exit status will be 0 if new keys were successfully created,
 
320
      otherwise not.
396
321
    </para>
397
322
  </refsect1>
398
323
  
400
325
    <title>ENVIRONMENT</title>
401
326
    <variablelist>
402
327
      <varlistentry>
403
 
        <term><envar>TMPDIR</envar></term>
 
328
        <term><varname>TMPDIR</varname></term>
404
329
        <listitem>
405
330
          <para>
406
331
            If set, temporary files will be created here. See
412
337
    </variablelist>
413
338
  </refsect1>
414
339
  
415
 
  <refsect1 id="files">
 
340
  <refsect1 id="file">
416
341
    <title>FILES</title>
417
342
    <para>
418
343
      Use the <option>--dir</option> option to change where
439
364
        </listitem>
440
365
      </varlistentry>
441
366
      <varlistentry>
442
 
        <term><filename class="directory">/tmp</filename></term>
 
367
        <term><filename>/tmp</filename></term>
443
368
        <listitem>
444
369
          <para>
445
370
            Temporary files will be written here if
449
374
      </varlistentry>
450
375
    </variablelist>
451
376
  </refsect1>
452
 
  
 
377
 
453
378
  <refsect1 id="bugs">
454
379
    <title>BUGS</title>
455
 
    <xi:include href="bugs.xml"/>
 
380
    <para>
 
381
      None are known at this time.
 
382
    </para>
456
383
  </refsect1>
457
 
  
 
384
 
458
385
  <refsect1 id="example">
459
386
    <title>EXAMPLE</title>
460
387
    <informalexample>
462
389
        Normal invocation needs no options:
463
390
      </para>
464
391
      <para>
465
 
        <userinput>&COMMANDNAME;</userinput>
 
392
        <userinput>mandos-keygen</userinput>
466
393
      </para>
467
394
    </informalexample>
468
395
    <informalexample>
469
396
      <para>
470
 
        Create key in another directory and of another type.  Force
 
397
        Create keys in another directory and of another type.  Force
471
398
        overwriting old key files:
472
399
      </para>
473
400
      <para>
474
401
 
475
402
<!-- do not wrap this line -->
476
 
<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>
477
 
 
478
 
      </para>
479
 
    </informalexample>
480
 
    <informalexample>
481
 
      <para>
482
 
        Prompt for a password, encrypt it with the key in <filename
483
 
        class="directory">/etc/mandos</filename> and output a section
484
 
        suitable for <filename>clients.conf</filename>.
485
 
      </para>
486
 
      <para>
487
 
        <userinput>&COMMANDNAME; --password</userinput>
488
 
      </para>
489
 
    </informalexample>
490
 
    <informalexample>
491
 
      <para>
492
 
        Prompt for a password, encrypt it with the key in the
493
 
        <filename>client-key</filename> directory and output a section
494
 
        suitable for <filename>clients.conf</filename>.
495
 
      </para>
496
 
      <para>
497
 
 
498
 
<!-- do not wrap this line -->
499
 
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
 
403
<userinput>mandos-keygen --dir ~/keydir --type RSA --force</userinput>
500
404
 
501
405
      </para>
502
406
    </informalexample>
503
407
  </refsect1>
504
 
  
 
408
 
505
409
  <refsect1 id="security">
506
410
    <title>SECURITY</title>
507
411
    <para>
508
412
      The <option>--type</option>, <option>--length</option>,
509
413
      <option>--subtype</option>, and <option>--sublength</option>
510
 
      options can be used to create keys of low security.  If in
511
 
      doubt, leave them to the default values.
 
414
      options can be used to create keys of insufficient security.  If
 
415
      in doubt, leave them to the default values.
512
416
    </para>
513
417
    <para>
514
 
      The key expire time is <emphasis>not</emphasis> guaranteed to be
515
 
      honored by <citerefentry><refentrytitle>mandos</refentrytitle>
 
418
      The key expire time is not guaranteed to be honored by
 
419
      <citerefentry><refentrytitle>mandos</refentrytitle>
516
420
      <manvolnum>8</manvolnum></citerefentry>.
517
421
    </para>
518
422
  </refsect1>
519
 
  
 
423
 
520
424
  <refsect1 id="see_also">
521
425
    <title>SEE ALSO</title>
522
426
    <para>
523
 
      <citerefentry><refentrytitle>intro</refentrytitle>
 
427
      <citerefentry><refentrytitle>password-request</refentrytitle>
524
428
      <manvolnum>8mandos</manvolnum></citerefentry>,
 
429
      <citerefentry><refentrytitle>mandos</refentrytitle>
 
430
      <manvolnum>8</manvolnum></citerefentry>,
525
431
      <citerefentry><refentrytitle>gpg</refentrytitle>
526
 
      <manvolnum>1</manvolnum></citerefentry>,
527
 
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
528
 
      <manvolnum>5</manvolnum></citerefentry>,
529
 
      <citerefentry><refentrytitle>mandos</refentrytitle>
530
 
      <manvolnum>8</manvolnum></citerefentry>,
531
 
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
532
 
      <manvolnum>8mandos</manvolnum></citerefentry>,
533
 
      <citerefentry><refentrytitle>ssh-keyscan</refentrytitle>
534
432
      <manvolnum>1</manvolnum></citerefentry>
535
433
    </para>
536
434
  </refsect1>
537
435
  
538
436
</refentry>
539
 
<!-- Local Variables: -->
540
 
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
541
 
<!-- time-stamp-end: "[\"']>" -->
542
 
<!-- time-stamp-format: "%:y-%02m-%02d" -->
543
 
<!-- End: -->