/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-keygen.xml

merge

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-keygen.xml
1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
 
4
<!ENTITY VERSION "1.0">
4
5
<!ENTITY COMMANDNAME "mandos-keygen">
5
 
<!ENTITY TIMESTAMP "2012-01-01">
6
 
<!ENTITY % common SYSTEM "common.ent">
7
 
%common;
 
6
<!ENTITY TIMESTAMP "2008-08-29">
8
7
]>
9
8
 
10
9
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
12
11
    <title>Mandos Manual</title>
13
12
    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
14
13
    <productname>Mandos</productname>
15
 
    <productnumber>&version;</productnumber>
 
14
    <productnumber>&VERSION;</productnumber>
16
15
    <date>&TIMESTAMP;</date>
17
16
    <authorgroup>
18
17
      <author>
19
18
        <firstname>Björn</firstname>
20
19
        <surname>Påhlsson</surname>
21
20
        <address>
22
 
          <email>belorn@recompile.se</email>
 
21
          <email>belorn@fukt.bsnet.se</email>
23
22
        </address>
24
23
      </author>
25
24
      <author>
26
25
        <firstname>Teddy</firstname>
27
26
        <surname>Hogeborn</surname>
28
27
        <address>
29
 
          <email>teddy@recompile.se</email>
 
28
          <email>teddy@fukt.bsnet.se</email>
30
29
        </address>
31
30
      </author>
32
31
    </authorgroup>
33
32
    <copyright>
34
33
      <year>2008</year>
35
 
      <year>2009</year>
36
 
      <year>2011</year>
37
 
      <year>2012</year>
38
34
      <holder>Teddy Hogeborn</holder>
39
35
      <holder>Björn Påhlsson</holder>
40
36
    </copyright>
41
 
    <xi:include href="legalnotice.xml"/>
 
37
    <legalnotice>
 
38
      <para>
 
39
        This manual page is free software: you can redistribute it
 
40
        and/or modify it under the terms of the GNU General Public
 
41
        License as published by the Free Software Foundation,
 
42
        either version 3 of the License, or (at your option) any
 
43
        later version.
 
44
      </para>
 
45
 
 
46
      <para>
 
47
        This manual page is distributed in the hope that it will
 
48
        be useful, but WITHOUT ANY WARRANTY; without even the
 
49
        implied warranty of MERCHANTABILITY or FITNESS FOR A
 
50
        PARTICULAR PURPOSE.  See the GNU General Public License
 
51
        for more details.
 
52
      </para>
 
53
 
 
54
      <para>
 
55
        You should have received a copy of the GNU General Public
 
56
        License along with this program; If not, see
 
57
        <ulink url="http://www.gnu.org/licenses/"/>.
 
58
      </para>
 
59
    </legalnotice>
42
60
  </refentryinfo>
43
 
  
 
61
 
44
62
  <refmeta>
45
63
    <refentrytitle>&COMMANDNAME;</refentrytitle>
46
64
    <manvolnum>8</manvolnum>
49
67
  <refnamediv>
50
68
    <refname><command>&COMMANDNAME;</command></refname>
51
69
    <refpurpose>
52
 
      Generate key and password for Mandos client and server.
 
70
      Generate keys for <citerefentry><refentrytitle>password-request
 
71
      </refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
53
72
    </refpurpose>
54
73
  </refnamediv>
55
 
  
 
74
 
56
75
  <refsynopsisdiv>
57
76
    <cmdsynopsis>
58
77
      <command>&COMMANDNAME;</command>
59
 
      <group>
60
 
        <arg choice="plain"><option>--dir
61
 
        <replaceable>DIRECTORY</replaceable></option></arg>
62
 
        <arg choice="plain"><option>-d
63
 
        <replaceable>DIRECTORY</replaceable></option></arg>
64
 
      </group>
65
 
      <sbr/>
66
 
      <group>
67
 
        <arg choice="plain"><option>--type
68
 
        <replaceable>KEYTYPE</replaceable></option></arg>
69
 
        <arg choice="plain"><option>-t
70
 
        <replaceable>KEYTYPE</replaceable></option></arg>
71
 
      </group>
72
 
      <sbr/>
73
 
      <group>
74
 
        <arg choice="plain"><option>--length
75
 
        <replaceable>BITS</replaceable></option></arg>
76
 
        <arg choice="plain"><option>-l
77
 
        <replaceable>BITS</replaceable></option></arg>
78
 
      </group>
79
 
      <sbr/>
80
 
      <group>
81
 
        <arg choice="plain"><option>--subtype
82
 
        <replaceable>KEYTYPE</replaceable></option></arg>
83
 
        <arg choice="plain"><option>-s
84
 
        <replaceable>KEYTYPE</replaceable></option></arg>
85
 
      </group>
86
 
      <sbr/>
87
 
      <group>
88
 
        <arg choice="plain"><option>--sublength
89
 
        <replaceable>BITS</replaceable></option></arg>
90
 
        <arg choice="plain"><option>-L
91
 
        <replaceable>BITS</replaceable></option></arg>
92
 
      </group>
93
 
      <sbr/>
94
 
      <group>
95
 
        <arg choice="plain"><option>--name
96
 
        <replaceable>NAME</replaceable></option></arg>
97
 
        <arg choice="plain"><option>-n
98
 
        <replaceable>NAME</replaceable></option></arg>
99
 
      </group>
100
 
      <sbr/>
101
 
      <group>
102
 
        <arg choice="plain"><option>--email
103
 
        <replaceable>ADDRESS</replaceable></option></arg>
104
 
        <arg choice="plain"><option>-e
105
 
        <replaceable>ADDRESS</replaceable></option></arg>
106
 
      </group>
107
 
      <sbr/>
108
 
      <group>
109
 
        <arg choice="plain"><option>--comment
110
 
        <replaceable>TEXT</replaceable></option></arg>
111
 
        <arg choice="plain"><option>-c
112
 
        <replaceable>TEXT</replaceable></option></arg>
113
 
      </group>
114
 
      <sbr/>
115
 
      <group>
116
 
        <arg choice="plain"><option>--expire
117
 
        <replaceable>TIME</replaceable></option></arg>
118
 
        <arg choice="plain"><option>-x
119
 
        <replaceable>TIME</replaceable></option></arg>
120
 
      </group>
121
 
      <sbr/>
122
 
      <arg><option>--force</option></arg>
 
78
      <group choice="opt">
 
79
        <arg choice="plain"><option>--dir</option>
 
80
        <replaceable>directory</replaceable></arg>
 
81
      </group>
 
82
      <group choice="opt">
 
83
        <arg choice="plain"><option>--type</option>
 
84
        <replaceable>type</replaceable></arg>
 
85
      </group>
 
86
      <group choice="opt">
 
87
        <arg choice="plain"><option>--length</option>
 
88
        <replaceable>bits</replaceable></arg>
 
89
      </group>
 
90
      <group choice="opt">
 
91
        <arg choice="plain"><option>--subtype</option>
 
92
        <replaceable>type</replaceable></arg>
 
93
      </group>
 
94
      <group choice="opt">
 
95
        <arg choice="plain"><option>--sublength</option>
 
96
        <replaceable>bits</replaceable></arg>
 
97
      </group>
 
98
      <group choice="opt">
 
99
        <arg choice="plain"><option>--name</option>
 
100
        <replaceable>NAME</replaceable></arg>
 
101
      </group>
 
102
      <group choice="opt">
 
103
        <arg choice="plain"><option>--email</option>
 
104
        <replaceable>EMAIL</replaceable></arg>
 
105
      </group>
 
106
      <group choice="opt">
 
107
        <arg choice="plain"><option>--comment</option>
 
108
        <replaceable>COMMENT</replaceable></arg>
 
109
      </group>
 
110
      <group choice="opt">
 
111
        <arg choice="plain"><option>--expire</option>
 
112
        <replaceable>TIME</replaceable></arg>
 
113
      </group>
 
114
      <group choice="opt">
 
115
        <arg choice="plain"><option>--force</option></arg>
 
116
      </group>
 
117
    </cmdsynopsis>
 
118
    <cmdsynopsis>
 
119
      <command>&COMMANDNAME;</command>
 
120
      <group choice="opt">
 
121
        <arg choice="plain"><option>-d</option>
 
122
        <replaceable>directory</replaceable></arg>
 
123
      </group>
 
124
      <group choice="opt">
 
125
        <arg choice="plain"><option>-t</option>
 
126
        <replaceable>type</replaceable></arg>
 
127
      </group>
 
128
      <group choice="opt">
 
129
        <arg choice="plain"><option>-l</option>
 
130
        <replaceable>bits</replaceable></arg>
 
131
      </group>
 
132
      <group choice="opt">
 
133
        <arg choice="plain"><option>-s</option>
 
134
        <replaceable>type</replaceable></arg>
 
135
      </group>
 
136
      <group choice="opt">
 
137
        <arg choice="plain"><option>-L</option>
 
138
        <replaceable>bits</replaceable></arg>
 
139
      </group>
 
140
      <group choice="opt">
 
141
        <arg choice="plain"><option>-n</option>
 
142
        <replaceable>NAME</replaceable></arg>
 
143
      </group>
 
144
      <group choice="opt">
 
145
        <arg choice="plain"><option>-e</option>
 
146
        <replaceable>EMAIL</replaceable></arg>
 
147
      </group>
 
148
      <group choice="opt">
 
149
        <arg choice="plain"><option>-c</option>
 
150
        <replaceable>COMMENT</replaceable></arg>
 
151
      </group>
 
152
      <group choice="opt">
 
153
        <arg choice="plain"><option>-x</option>
 
154
        <replaceable>TIME</replaceable></arg>
 
155
      </group>
 
156
      <group choice="opt">
 
157
        <arg choice="plain"><option>-f</option></arg>
 
158
      </group>
123
159
    </cmdsynopsis>
124
160
    <cmdsynopsis>
125
161
      <command>&COMMANDNAME;</command>
126
162
      <group choice="req">
 
163
        <arg choice="plain"><option>-p</option></arg>
127
164
        <arg choice="plain"><option>--password</option></arg>
128
 
        <arg choice="plain"><option>-p</option></arg>
129
 
        <arg choice="plain"><option>--passfile
130
 
        <replaceable>FILE</replaceable></option></arg>
131
 
        <arg choice="plain"><option>-F</option>
132
 
        <replaceable>FILE</replaceable></arg>
133
 
      </group>
134
 
      <sbr/>
135
 
      <group>
136
 
        <arg choice="plain"><option>--dir
137
 
        <replaceable>DIRECTORY</replaceable></option></arg>
138
 
        <arg choice="plain"><option>-d
139
 
        <replaceable>DIRECTORY</replaceable></option></arg>
140
 
      </group>
141
 
      <sbr/>
142
 
      <group>
143
 
        <arg choice="plain"><option>--name
144
 
        <replaceable>NAME</replaceable></option></arg>
145
 
        <arg choice="plain"><option>-n
146
 
        <replaceable>NAME</replaceable></option></arg>
 
165
      </group>
 
166
      <group choice="opt">
 
167
        <arg choice="plain"><option>--dir</option>
 
168
        <replaceable>directory</replaceable></arg>
 
169
      </group>
 
170
      <group choice="opt">
 
171
        <arg choice="plain"><option>--name</option>
 
172
        <replaceable>NAME</replaceable></arg>
147
173
      </group>
148
174
    </cmdsynopsis>
149
175
    <cmdsynopsis>
150
176
      <command>&COMMANDNAME;</command>
151
177
      <group choice="req">
 
178
        <arg choice="plain"><option>-h</option></arg>
152
179
        <arg choice="plain"><option>--help</option></arg>
153
 
        <arg choice="plain"><option>-h</option></arg>
154
180
      </group>
155
181
    </cmdsynopsis>
156
182
    <cmdsynopsis>
157
183
      <command>&COMMANDNAME;</command>
158
184
      <group choice="req">
 
185
        <arg choice="plain"><option>-v</option></arg>
159
186
        <arg choice="plain"><option>--version</option></arg>
160
 
        <arg choice="plain"><option>-v</option></arg>
161
187
      </group>
162
188
    </cmdsynopsis>
163
189
  </refsynopsisdiv>
164
 
  
 
190
 
165
191
  <refsect1 id="description">
166
192
    <title>DESCRIPTION</title>
167
193
    <para>
168
194
      <command>&COMMANDNAME;</command> is a program to generate the
169
 
      OpenPGP key used by
170
 
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
171
 
      <manvolnum>8mandos</manvolnum></citerefentry>.  The key is
 
195
      OpenPGP keys used by
 
196
      <citerefentry><refentrytitle>password-request</refentrytitle>
 
197
      <manvolnum>8mandos</manvolnum></citerefentry>.  The keys are
172
198
      normally written to /etc/mandos for later installation into the
173
 
      initrd image, but this, and most other things, can be changed
174
 
      with command line options.
 
199
      initrd image, but this, like most things, can be changed with
 
200
      command line options.
175
201
    </para>
176
202
    <para>
177
 
      This program can also be used with the
178
 
      <option>--password</option> or <option>--passfile</option>
179
 
      options to generate a ready-made section for
180
 
      <filename>clients.conf</filename> (see
 
203
      It can also be used to generate ready-made sections for
181
204
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
182
 
      <manvolnum>5</manvolnum></citerefentry>).
 
205
      <manvolnum>5</manvolnum></citerefentry> using the
 
206
      <option>--password</option> option.
183
207
    </para>
184
208
  </refsect1>
185
209
  
186
210
  <refsect1 id="purpose">
187
211
    <title>PURPOSE</title>
 
212
 
188
213
    <para>
189
214
      The purpose of this is to enable <emphasis>remote and unattended
190
215
      rebooting</emphasis> of client host computer with an
191
216
      <emphasis>encrypted root file system</emphasis>.  See <xref
192
217
      linkend="overview"/> for details.
193
218
    </para>
 
219
 
194
220
  </refsect1>
195
221
  
196
222
  <refsect1 id="options">
197
223
    <title>OPTIONS</title>
198
 
    
 
224
 
199
225
    <variablelist>
200
226
      <varlistentry>
201
 
        <term><option>--help</option></term>
202
 
        <term><option>-h</option></term>
 
227
        <term><literal>-h</literal>, <literal>--help</literal></term>
203
228
        <listitem>
204
229
          <para>
205
230
            Show a help message and exit
206
231
          </para>
207
232
        </listitem>
208
233
      </varlistentry>
209
 
      
 
234
 
210
235
      <varlistentry>
211
 
        <term><option>--dir
212
 
        <replaceable>DIRECTORY</replaceable></option></term>
213
 
        <term><option>-d
214
 
        <replaceable>DIRECTORY</replaceable></option></term>
 
236
        <term><literal>-d</literal>, <literal>--dir
 
237
        <replaceable>directory</replaceable></literal></term>
215
238
        <listitem>
216
239
          <para>
217
240
            Target directory for key files.  Default is
218
 
            <filename class="directory">/etc/mandos</filename>.
 
241
            <filename>/etc/mandos</filename>.
219
242
          </para>
220
243
        </listitem>
221
244
      </varlistentry>
222
 
      
 
245
 
223
246
      <varlistentry>
224
 
        <term><option>--type
225
 
        <replaceable>TYPE</replaceable></option></term>
226
 
        <term><option>-t
227
 
        <replaceable>TYPE</replaceable></option></term>
 
247
        <term><literal>-t</literal>, <literal>--type
 
248
        <replaceable>type</replaceable></literal></term>
228
249
        <listitem>
229
250
          <para>
230
251
            Key type.  Default is <quote>DSA</quote>.
231
252
          </para>
232
253
        </listitem>
233
254
      </varlistentry>
234
 
      
 
255
 
235
256
      <varlistentry>
236
 
        <term><option>--length
237
 
        <replaceable>BITS</replaceable></option></term>
238
 
        <term><option>-l
239
 
        <replaceable>BITS</replaceable></option></term>
 
257
        <term><literal>-l</literal>, <literal>--length
 
258
        <replaceable>bits</replaceable></literal></term>
240
259
        <listitem>
241
260
          <para>
242
261
            Key length in bits.  Default is 2048.
243
262
          </para>
244
263
        </listitem>
245
264
      </varlistentry>
246
 
      
 
265
 
247
266
      <varlistentry>
248
 
        <term><option>--subtype
249
 
        <replaceable>KEYTYPE</replaceable></option></term>
250
 
        <term><option>-s
251
 
        <replaceable>KEYTYPE</replaceable></option></term>
 
267
        <term><literal>-s</literal>, <literal>--subtype
 
268
        <replaceable>type</replaceable></literal></term>
252
269
        <listitem>
253
270
          <para>
254
271
            Subkey type.  Default is <quote>ELG-E</quote> (Elgamal
256
273
          </para>
257
274
        </listitem>
258
275
      </varlistentry>
259
 
      
 
276
 
260
277
      <varlistentry>
261
 
        <term><option>--sublength
262
 
        <replaceable>BITS</replaceable></option></term>
263
 
        <term><option>-L
264
 
        <replaceable>BITS</replaceable></option></term>
 
278
        <term><literal>-L</literal>, <literal>--sublength
 
279
        <replaceable>bits</replaceable></literal></term>
265
280
        <listitem>
266
281
          <para>
267
282
            Subkey length in bits.  Default is 2048.
268
283
          </para>
269
284
        </listitem>
270
285
      </varlistentry>
271
 
      
 
286
 
272
287
      <varlistentry>
273
 
        <term><option>--email
274
 
        <replaceable>ADDRESS</replaceable></option></term>
275
 
        <term><option>-e
276
 
        <replaceable>ADDRESS</replaceable></option></term>
 
288
        <term><literal>-e</literal>, <literal>--email</literal>
 
289
        <replaceable>address</replaceable></term>
277
290
        <listitem>
278
291
          <para>
279
292
            Email address of key.  Default is empty.
280
293
          </para>
281
294
        </listitem>
282
295
      </varlistentry>
283
 
      
 
296
 
284
297
      <varlistentry>
285
 
        <term><option>--comment
286
 
        <replaceable>TEXT</replaceable></option></term>
287
 
        <term><option>-c
288
 
        <replaceable>TEXT</replaceable></option></term>
 
298
        <term><literal>-c</literal>, <literal>--comment</literal>
 
299
        <replaceable>comment</replaceable></term>
289
300
        <listitem>
290
301
          <para>
291
302
            Comment field for key.  The default value is
293
304
          </para>
294
305
        </listitem>
295
306
      </varlistentry>
296
 
      
 
307
 
297
308
      <varlistentry>
298
 
        <term><option>--expire
299
 
        <replaceable>TIME</replaceable></option></term>
300
 
        <term><option>-x
301
 
        <replaceable>TIME</replaceable></option></term>
 
309
        <term><literal>-x</literal>, <literal>--expire</literal>
 
310
        <replaceable>time</replaceable></term>
302
311
        <listitem>
303
312
          <para>
304
313
            Key expire time.  Default is no expiration.  See
307
316
          </para>
308
317
        </listitem>
309
318
      </varlistentry>
310
 
      
 
319
 
311
320
      <varlistentry>
312
 
        <term><option>--force</option></term>
313
 
        <term><option>-f</option></term>
 
321
        <term><literal>-f</literal>, <literal>--force</literal></term>
314
322
        <listitem>
315
323
          <para>
316
 
            Force overwriting old key.
 
324
            Force overwriting old keys.
317
325
          </para>
318
326
        </listitem>
319
327
      </varlistentry>
320
328
      <varlistentry>
321
 
        <term><option>--password</option></term>
322
 
        <term><option>-p</option></term>
 
329
        <term><literal>-p</literal>, <literal>--password</literal
 
330
        ></term>
323
331
        <listitem>
324
332
          <para>
325
333
            Prompt for a password and encrypt it with the key already
331
339
            >8</manvolnum></citerefentry>.  The host name or the name
332
340
            specified with the <option>--name</option> option is used
333
341
            for the section header.  All other options are ignored,
334
 
            and no key is created.
335
 
          </para>
336
 
        </listitem>
337
 
      </varlistentry>
338
 
      <varlistentry>
339
 
        <term><option>--passfile
340
 
        <replaceable>FILE</replaceable></option></term>
341
 
        <term><option>-F
342
 
        <replaceable>FILE</replaceable></option></term>
343
 
        <listitem>
344
 
          <para>
345
 
            The same as <option>--password</option>, but read from
346
 
            <replaceable>FILE</replaceable>, not the terminal.
 
342
            and no keys are created.
347
343
          </para>
348
344
        </listitem>
349
345
      </varlistentry>
350
346
    </variablelist>
351
347
  </refsect1>
352
 
  
 
348
 
353
349
  <refsect1 id="overview">
354
350
    <title>OVERVIEW</title>
355
351
    <xi:include href="overview.xml"/>
356
352
    <para>
357
353
      This program is a small utility to generate new OpenPGP keys for
358
 
      new Mandos clients, and to generate sections for inclusion in
359
 
      <filename>clients.conf</filename> on the server.
 
354
      new Mandos clients.
360
355
    </para>
361
356
  </refsect1>
362
 
  
 
357
 
363
358
  <refsect1 id="exit_status">
364
359
    <title>EXIT STATUS</title>
365
360
    <para>
366
 
      The exit status will be 0 if a new key (or password, if the
367
 
      <option>--password</option> option was used) was successfully
368
 
      created, otherwise not.
 
361
      The exit status will be 0 if new keys were successfully created,
 
362
      otherwise not.
369
363
    </para>
370
364
  </refsect1>
371
365
  
373
367
    <title>ENVIRONMENT</title>
374
368
    <variablelist>
375
369
      <varlistentry>
376
 
        <term><envar>TMPDIR</envar></term>
 
370
        <term><varname>TMPDIR</varname></term>
377
371
        <listitem>
378
372
          <para>
379
373
            If set, temporary files will be created here. See
385
379
    </variablelist>
386
380
  </refsect1>
387
381
  
388
 
  <refsect1 id="files">
 
382
  <refsect1 id="file">
389
383
    <title>FILES</title>
390
384
    <para>
391
385
      Use the <option>--dir</option> option to change where
412
406
        </listitem>
413
407
      </varlistentry>
414
408
      <varlistentry>
415
 
        <term><filename class="directory">/tmp</filename></term>
 
409
        <term><filename>/tmp</filename></term>
416
410
        <listitem>
417
411
          <para>
418
412
            Temporary files will be written here if
422
416
      </varlistentry>
423
417
    </variablelist>
424
418
  </refsect1>
425
 
  
426
 
<!--   <refsect1 id="bugs"> -->
427
 
<!--     <title>BUGS</title> -->
428
 
<!--     <para> -->
429
 
<!--     </para> -->
430
 
<!--   </refsect1> -->
431
 
  
 
419
 
 
420
  <refsect1 id="bugs">
 
421
    <title>BUGS</title>
 
422
    <para>
 
423
      None are known at this time.
 
424
    </para>
 
425
  </refsect1>
 
426
 
432
427
  <refsect1 id="example">
433
428
    <title>EXAMPLE</title>
434
429
    <informalexample>
441
436
    </informalexample>
442
437
    <informalexample>
443
438
      <para>
444
 
        Create key in another directory and of another type.  Force
 
439
        Create keys in another directory and of another type.  Force
445
440
        overwriting old key files:
446
441
      </para>
447
442
      <para>
451
446
 
452
447
      </para>
453
448
    </informalexample>
454
 
    <informalexample>
455
 
      <para>
456
 
        Prompt for a password, encrypt it with the key in <filename
457
 
        class="directory">/etc/mandos</filename> and output a section
458
 
        suitable for <filename>clients.conf</filename>.
459
 
      </para>
460
 
      <para>
461
 
        <userinput>&COMMANDNAME; --password</userinput>
462
 
      </para>
463
 
    </informalexample>
464
 
    <informalexample>
465
 
      <para>
466
 
        Prompt for a password, encrypt it with the key in the
467
 
        <filename>client-key</filename> directory and output a section
468
 
        suitable for <filename>clients.conf</filename>.
469
 
      </para>
470
 
      <para>
471
 
 
472
 
<!-- do not wrap this line -->
473
 
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
474
 
 
475
 
      </para>
476
 
    </informalexample>
477
449
  </refsect1>
478
 
  
 
450
 
479
451
  <refsect1 id="security">
480
452
    <title>SECURITY</title>
481
453
    <para>
482
454
      The <option>--type</option>, <option>--length</option>,
483
455
      <option>--subtype</option>, and <option>--sublength</option>
484
 
      options can be used to create keys of low security.  If in
485
 
      doubt, leave them to the default values.
 
456
      options can be used to create keys of insufficient security.  If
 
457
      in doubt, leave them to the default values.
486
458
    </para>
487
459
    <para>
488
 
      The key expire time is <emphasis>not</emphasis> guaranteed to be
489
 
      honored by <citerefentry><refentrytitle>mandos</refentrytitle>
 
460
      The key expire time is not guaranteed to be honored by
 
461
      <citerefentry><refentrytitle>mandos</refentrytitle>
490
462
      <manvolnum>8</manvolnum></citerefentry>.
491
463
    </para>
492
464
  </refsect1>
493
 
  
 
465
 
494
466
  <refsect1 id="see_also">
495
467
    <title>SEE ALSO</title>
496
468
    <para>
497
 
      <citerefentry><refentrytitle>intro</refentrytitle>
498
 
      <manvolnum>8mandos</manvolnum></citerefentry>,
499
469
      <citerefentry><refentrytitle>gpg</refentrytitle>
500
470
      <manvolnum>1</manvolnum></citerefentry>,
501
 
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
502
 
      <manvolnum>5</manvolnum></citerefentry>,
503
471
      <citerefentry><refentrytitle>mandos</refentrytitle>
504
472
      <manvolnum>8</manvolnum></citerefentry>,
505
 
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
 
473
      <citerefentry><refentrytitle>password-request</refentrytitle>
506
474
      <manvolnum>8mandos</manvolnum></citerefentry>
507
475
    </para>
508
476
  </refsect1>