/mandos/trunk : revision 30

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-keygen.xml

Committer: Teddy Hogeborn
Date: 2008-07-31 19:51:44 UTC
mfrom: (24.1.5 mandos)
Revision ID: teddy@fukt.bsnet.se-20080731195144-yb37wz2sr1e6b3m4

Merge.

files added:
ca.pem

cert.pem

client-cert.pem

client-key.pem

crl.pem

key.pem

files removed:
.bzrignore

COPYING

initramfs-tools-hook

initramfs-tools-hook-conf

initramfs-tools-script

mandos-clients.conf.xml

mandos-keygen

mandos-keygen.xml

mandos-options.xml

mandos.conf.xml

mandos.xml

overview.xml

plugin-runner.xml

plugins.d/password-prompt.xml

plugins.d/password-request.xml

plugins.d/usplash

files renamed:
plugin-runner.c => plugbasedclient.c

plugins.d/password-request.c => plugins.d/mandosclient.c

plugins.d/password-prompt.c => plugins.d/passprompt.c

mandos.conf => server.conf

mandos => server.py

files modified:
Makefile

TODO

clients.conf

Show diffs side-by-side

added added

removed removed

mandos-keygen.xml

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"

"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [

<!ENTITY VERSION "1.0">

<!ENTITY COMMANDNAME "mandos-keygen">

<!ENTITY TIMESTAMP "2008-08-31">

<title>Mandos Manual</title>

<productname>Mandos</productname>

<productnumber>&VERSION;</productnumber>

<date>&TIMESTAMP;</date>

<firstname>Björn</firstname>

<surname>Påhlsson</surname>

<email>belorn@fukt.bsnet.se</email>

</address>

</author>

<firstname>Teddy</firstname>

<surname>Hogeborn</surname>

<email>teddy@fukt.bsnet.se</email>

</address>

</author>

</authorgroup>

<holder>Teddy Hogeborn</holder>

<holder>Björn Påhlsson</holder>

</copyright>

<para>

This manual page is free software: you can redistribute it

and/or modify it under the terms of the GNU General Public

License as published by the Free Software Foundation,

either version 3 of the License, or (at your option) any

later version.

</para>

<para>

This manual page is distributed in the hope that it will

be useful, but WITHOUT ANY WARRANTY; without even the

implied warranty of MERCHANTABILITY or FITNESS FOR A

PARTICULAR PURPOSE. See the GNU General Public License

for more details.

</para>

<para>

You should have received a copy of the GNU General Public

License along with this program; If not, see

<ulink url="http://www.gnu.org/licenses/"/>.

</para>

</legalnotice>

</refentryinfo>

<refentrytitle>&COMMANDNAME;</refentrytitle>

</refmeta>

<refname><command>&COMMANDNAME;</command></refname>

Generate key and password for Mandos client and server.

</refpurpose>

</refnamediv>

<command>&COMMANDNAME;</command>

<group>

<arg choice="plain"><option>--dir

<replaceable>DIRECTORY</replaceable></option></arg>

<arg choice="plain"><option>-d

<replaceable>DIRECTORY</replaceable></option></arg>

</group>

<sbr/>

<group>

<arg choice="plain"><option>--type

<replaceable>KEYTYPE</replaceable></option></arg>

<arg choice="plain"><option>-t

<replaceable>KEYTYPE</replaceable></option></arg>

</group>

<sbr/>

<group>

<arg choice="plain"><option>--length

<arg choice="plain"><option>-l

</group>

<sbr/>

<group>

<arg choice="plain"><option>--subtype

100

<replaceable>KEYTYPE</replaceable></option></arg>

101

<arg choice="plain"><option>-s

102

<replaceable>KEYTYPE</replaceable></option></arg>

103

</group>

104

<sbr/>

105

<group>

106

<arg choice="plain"><option>--sublength

107

108

<arg choice="plain"><option>-L

109

110

</group>

111

<sbr/>

112

<group>

113

<arg choice="plain"><option>--name

114

115

<arg choice="plain"><option>-n

116

117

</group>

118

<sbr/>

119

<group>

120

<arg choice="plain"><option>--email

121

<replaceable>ADDRESS</replaceable></option></arg>

122

<arg choice="plain"><option>-e

123

<replaceable>ADDRESS</replaceable></option></arg>

124

</group>

125

<sbr/>

126

<group>

127

<arg choice="plain"><option>--comment

128

129

<arg choice="plain"><option>-c

130

131

</group>

132

<sbr/>

133

<group>

134

<arg choice="plain"><option>--expire

135

136

<arg choice="plain"><option>-x

137

138

</group>

139

<sbr/>

140

<arg><option>--force</option></arg>

141

</cmdsynopsis>

142

143

<command>&COMMANDNAME;</command>

144

145

<arg choice="plain"><option>--password</option></arg>

146

147

</group>

148

<sbr/>

149

<group>

150

<arg choice="plain"><option>--dir

151

<replaceable>DIRECTORY</replaceable></option></arg>

152

<arg choice="plain"><option>-d

153

<replaceable>DIRECTORY</replaceable></option></arg>

154

</group>

155

<sbr/>

156

<group>

157

<arg choice="plain"><option>--name

158

159

<arg choice="plain"><option>-n

160

161

</group>

162

</cmdsynopsis>

163

164

<command>&COMMANDNAME;</command>

165

166

167

168

</group>

169

</cmdsynopsis>

170

171

<command>&COMMANDNAME;</command>

172

173

<arg choice="plain"><option>--version</option></arg>

174

175

</group>

176

</cmdsynopsis>

177

</refsynopsisdiv>

178

179

180

<title>DESCRIPTION</title>

181

<para>

182

<command>&COMMANDNAME;</command> is a program to generate the

183

OpenPGP key used by

184

<citerefentry><refentrytitle>password-request</refentrytitle>

185

<manvolnum>8mandos</manvolnum></citerefentry>. The key is

186

normally written to /etc/mandos for later installation into the

187

initrd image, but this, and most other things, can be changed

188

with command line options.

189

</para>

190

<para>

191

This program can also be used with the

192

<option>--password</option> option to generate a ready-made

193

section for <filename>clients.conf</filename> (see

194

<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>

195

<manvolnum>5</manvolnum></citerefentry>).

196

</para>

197

</refsect1>

198

199

200

<title>PURPOSE</title>

201

<para>

202

The purpose of this is to enable <emphasis>remote and unattended

203

rebooting</emphasis> of client host computer with an

204

<emphasis>encrypted root file system</emphasis>. See <xref

205

linkend="overview"/> for details.

206

</para>

207

</refsect1>

208

209

210

<title>OPTIONS</title>

211

212

213

214

215

216

217

<para>

218

Show a help message and exit

219

</para>

220

</listitem>

221

</varlistentry>

222

223

224

<term><option>--dir

225

<replaceable>DIRECTORY</replaceable></option></term>

226

<term><option>-d

227

<replaceable>DIRECTORY</replaceable></option></term>

228

229

<para>

230

Target directory for key files. Default is

231

<filename>/etc/mandos</filename>.

232

</para>

233

</listitem>

234

</varlistentry>

235

236

237

<term><option>--type

238

239

<term><option>-t

240

241

242

<para>

243

Key type. Default is <quote>DSA</quote>.

244

</para>

245

</listitem>

246

</varlistentry>

247

248

249

<term><option>--length

250

251

<term><option>-l

252

253

254

<para>

255

Key length in bits. Default is 2048.

256

</para>

257

</listitem>

258

</varlistentry>

259

260

261

<term><option>--subtype

262

<replaceable>KEYTYPE</replaceable></option></term>

263

<term><option>-s

264

<replaceable>KEYTYPE</replaceable></option></term>

265

266

<para>

267

Subkey type. Default is <quote>ELG-E</quote> (Elgamal

268

encryption-only).

269

</para>

270

</listitem>

271

</varlistentry>

272

273

274

<term><option>--sublength

275

276

<term><option>-L

277

278

279

<para>

280

Subkey length in bits. Default is 2048.

281

</para>

282

</listitem>

283

</varlistentry>

284

285

286

<term><option>--email

287

<replaceable>ADDRESS</replaceable></option></term>

288

<term><option>-e

289

<replaceable>ADDRESS</replaceable></option></term>

290

291

<para>

292

Email address of key. Default is empty.

293

</para>

294

</listitem>

295

</varlistentry>

296

297

298

<term><option>--comment

299

300

<term><option>-c

301

302

303

<para>

304

Comment field for key. The default value is

305

<quote><literal>Mandos client key</literal></quote>.

306

</para>

307

</listitem>

308

</varlistentry>

309

310

311

<term><option>--expire

312

313

<term><option>-x

314

315

316

<para>

317

Key expire time. Default is no expiration. See

318

319

<manvolnum>1</manvolnum></citerefentry> for syntax.

320

</para>

321

</listitem>

322

</varlistentry>

323

324

325

<term><option>--force</option></term>

326

327

328

<para>

329

Force overwriting old key.

330

</para>

331

</listitem>

332

</varlistentry>

333

334

<term><option>--password</option></term>

335

336

337

<para>

338

Prompt for a password and encrypt it with the key already

339

present in either <filename>/etc/mandos</filename> or the

340

directory specified with the <option>--dir</option>

341

option. Outputs, on standard output, a section suitable

342

for inclusion in <citerefentry><refentrytitle

343

>mandos-clients.conf</refentrytitle><manvolnum

344

>8</manvolnum></citerefentry>. The host name or the name

345

specified with the <option>--name</option> option is used

346

for the section header. All other options are ignored,

347

and no key is created.

348

</para>

349

</listitem>

350

</varlistentry>

351

</variablelist>

352

</refsect1>

353

354

355

<title>OVERVIEW</title>

356

<xi:include href="overview.xml"/>

357

<para>

358

This program is a small utility to generate new OpenPGP keys for

359

new Mandos clients, and to generate sections for inclusion in

360

<filename>clients.conf</filename> on the server.

361

</para>

362

</refsect1>

363

364

365

<title>EXIT STATUS</title>

366

<para>

367

The exit status will be 0 if a new key (or password, if the

368

<option>--password</option> option was used) was successfully

369

created, otherwise not.

370

</para>

371

</refsect1>

372

373

374

<title>ENVIRONMENT</title>

375

376

377

<term><envar>TMPDIR</envar></term>

378

379

<para>

380

If set, temporary files will be created here. See

381

<citerefentry><refentrytitle>mktemp</refentrytitle>

382

<manvolnum>1</manvolnum></citerefentry>.

383

</para>

384

</listitem>

385

</varlistentry>

386

</variablelist>

387

</refsect1>

388

389

390

<title>FILES</title>

391

<para>

392

Use the <option>--dir</option> option to change where

393

<command>&COMMANDNAME;</command> will write the key files. The

394

default file names are shown here.

395

</para>

396

397

398

<term><filename>/etc/mandos/seckey.txt</filename></term>

399

400

<para>

401

OpenPGP secret key file which will be created or

402

overwritten.

403

</para>

404

</listitem>

405

</varlistentry>

406

407

<term><filename>/etc/mandos/pubkey.txt</filename></term>

408

409

<para>

410

OpenPGP public key file which will be created or

411

overwritten.

412

</para>

413

</listitem>

414

</varlistentry>

415

416

417

418

<para>

419

Temporary files will be written here if

420

<varname>TMPDIR</varname> is not set.

421

</para>

422

</listitem>

423

</varlistentry>

424

</variablelist>

425

</refsect1>

426

427

428

429

<para>

430

None are known at this time.

431

</para>

432

</refsect1>

433

434

435

<title>EXAMPLE</title>

436

437

<para>

438

Normal invocation needs no options:

439

</para>

440

<para>

441

<userinput>&COMMANDNAME;</userinput>

442

</para>

443

</informalexample>

444

445

<para>

446

Create key in another directory and of another type. Force

447

overwriting old key files:

448

</para>

449

<para>

450

451

452

<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>

453

454

</para>

455

</informalexample>

456

457

<para>

458

Prompt for a password, encrypt it with the key in

459

<filename>/etc/mandos</filename> and output a section suitable

460

for <filename>clients.conf</filename>.

461

</para>

462

<para>

463

<userinput>&COMMANDNAME; --password</userinput>

464

</para>

465

</informalexample>

466

467

<para>

468

Prompt for a password, encrypt it with the key in the

469

<filename>client-key</filename> directory and output a section

470

suitable for <filename>clients.conf</filename>.

471

</para>

472

<para>

473

474

475

<userinput>&COMMANDNAME; --password --dir client-key</userinput>

476

477

</para>

478

</informalexample>

479

</refsect1>

480

481

482

<title>SECURITY</title>

483

<para>

484

The <option>--type</option>, <option>--length</option>,

485

<option>--subtype</option>, and <option>--sublength</option>

486

options can be used to create keys of low security. If in

487

doubt, leave them to the default values.

488

</para>

489

<para>

490

The key expire time is <emphasis>not</emphasis> guaranteed to be

491

honored by <citerefentry><refentrytitle>mandos</refentrytitle>

492

<manvolnum>8</manvolnum></citerefentry>.

493

</para>

494

</refsect1>

495

496

497

498

<para>

499

500

<manvolnum>1</manvolnum></citerefentry>,

501

<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>

502

<manvolnum>5</manvolnum></citerefentry>,

503

<citerefentry><refentrytitle>mandos</refentrytitle>

504

<manvolnum>8</manvolnum></citerefentry>,

505

<citerefentry><refentrytitle>password-request</refentrytitle>

506

<manvolnum>8mandos</manvolnum></citerefentry>

507

</para>

508

</refsect1>

509

510

</refentry>

511

512

513

514

515

Older »