/mandos/trunk : revision 24.1.74

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-keygen.xml

Committer: Björn Påhlsson
Date: 2008-08-30 19:59:33 UTC
mfrom: (115 mandos)
mto: (24.1.154 mandos) (237.4.3 mandos-release)
mto: This revision was merged to the branch mainline in revision 132.
Revision ID: belorn@braxen-20080830195933-mhwfz1uk9ijdda48

merge

files added:
.bzrignore

mandos-keygen.xml

mandos-options.xml

overview.xml

files removed:
network-protocol.txt

files modified:
Makefile

TODO

clients.conf

initramfs-tools-hook

mandos

mandos-clients.conf.xml

mandos-keygen

mandos.conf

mandos.conf.xml

mandos.xml

plugin-runner.c

plugin-runner.xml

plugins.d/password-prompt.c

plugins.d/password-prompt.xml

plugins.d/password-request.c

plugins.d/password-request.xml

Show diffs side-by-side

added added

removed removed

mandos-keygen.xml

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

<!ENTITY VERSION "1.0">

<!ENTITY COMMANDNAME "mandos-keygen">

<!ENTITY TIMESTAMP "2008-08-29">

<title>Mandos Manual</title>

<productname>Mandos</productname>

<productnumber>&VERSION;</productnumber>

<date>&TIMESTAMP;</date>

<firstname>Björn</firstname>

<surname>Påhlsson</surname>

<email>belorn@fukt.bsnet.se</email>

</address>

</author>

<firstname>Teddy</firstname>

<surname>Hogeborn</surname>

<email>teddy@fukt.bsnet.se</email>

</address>

</author>

</authorgroup>

<holder>Teddy Hogeborn</holder>

<holder>Björn Påhlsson</holder>

</copyright>

<para>

This manual page is free software: you can redistribute it

and/or modify it under the terms of the GNU General Public

License as published by the Free Software Foundation,

either version 3 of the License, or (at your option) any

later version.

</para>

<para>

This manual page is distributed in the hope that it will

be useful, but WITHOUT ANY WARRANTY; without even the

implied warranty of MERCHANTABILITY or FITNESS FOR A

PARTICULAR PURPOSE. See the GNU General Public License

for more details.

</para>

<para>

You should have received a copy of the GNU General Public

License along with this program; If not, see

<ulink url="http://www.gnu.org/licenses/"/>.

</para>

</legalnotice>

</refentryinfo>

<refentrytitle>&COMMANDNAME;</refentrytitle>

</refmeta>

<refname><command>&COMMANDNAME;</command></refname>

Generate keys for <citerefentry><refentrytitle>password-request

</refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>

</refpurpose>

</refnamediv>

<command>&COMMANDNAME;</command>

<replaceable>directory</replaceable></arg>

</group>

</group>

<arg choice="plain"><option>--length</option>

</group>

<arg choice="plain"><option>--subtype</option>

</group>

<arg choice="plain"><option>--sublength</option>

</group>

100

101

</group>

102

103

<arg choice="plain"><option>--email</option>

104

<replaceable>EMAIL</replaceable></arg>

105

</group>

106

107

<arg choice="plain"><option>--comment</option>

108

<replaceable>COMMENT</replaceable></arg>

109

</group>

110

111

<arg choice="plain"><option>--expire</option>

112

113

</group>

114

115

<arg choice="plain"><option>--force</option></arg>

116

</group>

117

</cmdsynopsis>

118

119

<command>&COMMANDNAME;</command>

120

121

122

<replaceable>directory</replaceable></arg>

123

</group>

124

125

126

127

</group>

128

129

130

131

</group>

132

133

134

135

</group>

136

137

138

139

</group>

140

141

142

143

</group>

144

145

146

<replaceable>EMAIL</replaceable></arg>

147

</group>

148

149

150

<replaceable>COMMENT</replaceable></arg>

151

</group>

152

153

154

155

</group>

156

157

158

</group>

159

</cmdsynopsis>

160

161

<command>&COMMANDNAME;</command>

162

163

164

<arg choice="plain"><option>--password</option></arg>

165

</group>

166

167

168

<replaceable>directory</replaceable></arg>

169

</group>

170

171

172

173

</group>

174

</cmdsynopsis>

175

176

<command>&COMMANDNAME;</command>

177

178

179

180

</group>

181

</cmdsynopsis>

182

183

<command>&COMMANDNAME;</command>

184

185

186

<arg choice="plain"><option>--version</option></arg>

187

</group>

188

</cmdsynopsis>

189

</refsynopsisdiv>

190

191

192

<title>DESCRIPTION</title>

193

<para>

194

<command>&COMMANDNAME;</command> is a program to generate the

195

OpenPGP keys used by

196

<citerefentry><refentrytitle>password-request</refentrytitle>

197

<manvolnum>8mandos</manvolnum></citerefentry>. The keys are

198

normally written to /etc/mandos for later installation into the

199

initrd image, but this, like most things, can be changed with

200

command line options.

201

</para>

202

<para>

203

It can also be used to generate ready-made sections for

204

<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>

205

<manvolnum>5</manvolnum></citerefentry> using the

206

<option>--password</option> option.

207

</para>

208

</refsect1>

209

210

211

<title>PURPOSE</title>

212

213

<para>

214

The purpose of this is to enable <emphasis>remote and unattended

215

rebooting</emphasis> of client host computer with an

216

<emphasis>encrypted root file system</emphasis>. See <xref

217

linkend="overview"/> for details.

218

</para>

219

220

</refsect1>

221

222

223

<title>OPTIONS</title>

224

225

226

227

228

229

<para>

230

Show a help message and exit

231

</para>

232

</listitem>

233

</varlistentry>

234

235

236

<term><literal>-d</literal>, <literal>--dir

237

<replaceable>directory</replaceable></literal></term>

238

239

<para>

240

Target directory for key files. Default is

241

<filename>/etc/mandos</filename>.

242

</para>

243

</listitem>

244

</varlistentry>

245

246

247

<term><literal>-t</literal>, <literal>--type

248

249

250

<para>

251

Key type. Default is <quote>DSA</quote>.

252

</para>

253

</listitem>

254

</varlistentry>

255

256

257

<term><literal>-l</literal>, <literal>--length

258

259

260

<para>

261

Key length in bits. Default is 2048.

262

</para>

263

</listitem>

264

</varlistentry>

265

266

267

<term><literal>-s</literal>, <literal>--subtype

268

269

270

<para>

271

Subkey type. Default is <quote>ELG-E</quote> (Elgamal

272

encryption-only).

273

</para>

274

</listitem>

275

</varlistentry>

276

277

278

<term><literal>-L</literal>, <literal>--sublength

279

280

281

<para>

282

Subkey length in bits. Default is 2048.

283

</para>

284

</listitem>

285

</varlistentry>

286

287

288

<term><literal>-e</literal>, <literal>--email</literal>

289

<replaceable>address</replaceable></term>

290

291

<para>

292

Email address of key. Default is empty.

293

</para>

294

</listitem>

295

</varlistentry>

296

297

298

<term><literal>-c</literal>, <literal>--comment</literal>

299

<replaceable>comment</replaceable></term>

300

301

<para>

302

Comment field for key. The default value is

303

<quote><literal>Mandos client key</literal></quote>.

304

</para>

305

</listitem>

306

</varlistentry>

307

308

309

<term><literal>-x</literal>, <literal>--expire</literal>

310

311

312

<para>

313

Key expire time. Default is no expiration. See

314

315

<manvolnum>1</manvolnum></citerefentry> for syntax.

316

</para>

317

</listitem>

318

</varlistentry>

319

320

321

<term><literal>-f</literal>, <literal>--force</literal></term>

322

323

<para>

324

Force overwriting old keys.

325

</para>

326

</listitem>

327

</varlistentry>

328

329

<term><literal>-p</literal>, <literal>--password</literal

330

></term>

331

332

<para>

333

Prompt for a password and encrypt it with the key already

334

present in either <filename>/etc/mandos</filename> or the

335

directory specified with the <option>--dir</option>

336

option. Outputs, on standard output, a section suitable

337

for inclusion in <citerefentry><refentrytitle

338

>mandos-clients.conf</refentrytitle><manvolnum

339

>8</manvolnum></citerefentry>. The host name or the name

340

specified with the <option>--name</option> option is used

341

for the section header. All other options are ignored,

342

and no keys are created.

343

</para>

344

</listitem>

345

</varlistentry>

346

</variablelist>

347

</refsect1>

348

349

350

<title>OVERVIEW</title>

351

<xi:include href="overview.xml"/>

352

<para>

353

This program is a small utility to generate new OpenPGP keys for

354

new Mandos clients.

355

</para>

356

</refsect1>

357

358

359

<title>EXIT STATUS</title>

360

<para>

361

The exit status will be 0 if new keys were successfully created,

362

otherwise not.

363

</para>

364

</refsect1>

365

366

367

<title>ENVIRONMENT</title>

368

369

370

<term><varname>TMPDIR</varname></term>

371

372

<para>

373

If set, temporary files will be created here. See

374

<citerefentry><refentrytitle>mktemp</refentrytitle>

375

<manvolnum>1</manvolnum></citerefentry>.

376

</para>

377

</listitem>

378

</varlistentry>

379

</variablelist>

380

</refsect1>

381

382

383

<title>FILES</title>

384

<para>

385

Use the <option>--dir</option> option to change where

386

<command>&COMMANDNAME;</command> will write the key files. The

387

default file names are shown here.

388

</para>

389

390

391

<term><filename>/etc/mandos/seckey.txt</filename></term>

392

393

<para>

394

OpenPGP secret key file which will be created or

395

overwritten.

396

</para>

397

</listitem>

398

</varlistentry>

399

400

<term><filename>/etc/mandos/pubkey.txt</filename></term>

401

402

<para>

403

OpenPGP public key file which will be created or

404

overwritten.

405

</para>

406

</listitem>

407

</varlistentry>

408

409

410

411

<para>

412

Temporary files will be written here if

413

<varname>TMPDIR</varname> is not set.

414

</para>

415

</listitem>

416

</varlistentry>

417

</variablelist>

418

</refsect1>

419

420

421

422

<para>

423

None are known at this time.

424

</para>

425

</refsect1>

426

427

428

<title>EXAMPLE</title>

429

430

<para>

431

Normal invocation needs no options:

432

</para>

433

<para>

434

<userinput>&COMMANDNAME;</userinput>

435

</para>

436

</informalexample>

437

438

<para>

439

Create keys in another directory and of another type. Force

440

overwriting old key files:

441

</para>

442

<para>

443

444

445

<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>

446

447

</para>

448

</informalexample>

449

</refsect1>

450

451

452

<title>SECURITY</title>

453

<para>

454

The <option>--type</option>, <option>--length</option>,

455

<option>--subtype</option>, and <option>--sublength</option>

456

options can be used to create keys of insufficient security. If

457

in doubt, leave them to the default values.

458

</para>

459

<para>

460

The key expire time is not guaranteed to be honored by

461

<citerefentry><refentrytitle>mandos</refentrytitle>

462

<manvolnum>8</manvolnum></citerefentry>.

463

</para>

464

</refsect1>

465

466

467

468

<para>

469

470

<manvolnum>1</manvolnum></citerefentry>,

471

<citerefentry><refentrytitle>mandos</refentrytitle>

472

<manvolnum>8</manvolnum></citerefentry>,

473

<citerefentry><refentrytitle>password-request</refentrytitle>

474

<manvolnum>8mandos</manvolnum></citerefentry>

475

</para>

476

</refsect1>

477

478

</refentry>

479

480

481

482

483

Older »