/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-keygen.xml

* network-hooks.d: New directory.
* network-hooks.d/bridge: New example hook.
* network-hooks.d/bridge.conf: Config file for bridge example hook.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-keygen.xml
1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
 
<!ENTITY VERSION "1.0">
5
4
<!ENTITY COMMANDNAME "mandos-keygen">
6
 
<!ENTITY TIMESTAMP "2008-08-29">
 
5
<!ENTITY TIMESTAMP "2011-10-03">
 
6
<!ENTITY % common SYSTEM "common.ent">
 
7
%common;
7
8
]>
8
9
 
9
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
10
11
  <refentryinfo>
11
 
    <title>&COMMANDNAME;</title>
 
12
    <title>Mandos Manual</title>
12
13
    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
13
 
    <productname>&COMMANDNAME;</productname>
14
 
    <productnumber>&VERSION;</productnumber>
 
14
    <productname>Mandos</productname>
 
15
    <productnumber>&version;</productnumber>
15
16
    <date>&TIMESTAMP;</date>
16
17
    <authorgroup>
17
18
      <author>
18
19
        <firstname>Björn</firstname>
19
20
        <surname>Påhlsson</surname>
20
21
        <address>
21
 
          <email>belorn@fukt.bsnet.se</email>
 
22
          <email>belorn@recompile.se</email>
22
23
        </address>
23
24
      </author>
24
25
      <author>
25
26
        <firstname>Teddy</firstname>
26
27
        <surname>Hogeborn</surname>
27
28
        <address>
28
 
          <email>teddy@fukt.bsnet.se</email>
 
29
          <email>teddy@recompile.se</email>
29
30
        </address>
30
31
      </author>
31
32
    </authorgroup>
32
33
    <copyright>
33
34
      <year>2008</year>
 
35
      <year>2009</year>
 
36
      <year>2011</year>
34
37
      <holder>Teddy Hogeborn</holder>
35
38
      <holder>Björn Påhlsson</holder>
36
39
    </copyright>
37
 
    <legalnotice>
38
 
      <para>
39
 
        This manual page is free software: you can redistribute it
40
 
        and/or modify it under the terms of the GNU General Public
41
 
        License as published by the Free Software Foundation,
42
 
        either version 3 of the License, or (at your option) any
43
 
        later version.
44
 
      </para>
45
 
 
46
 
      <para>
47
 
        This manual page is distributed in the hope that it will
48
 
        be useful, but WITHOUT ANY WARRANTY; without even the
49
 
        implied warranty of MERCHANTABILITY or FITNESS FOR A
50
 
        PARTICULAR PURPOSE.  See the GNU General Public License
51
 
        for more details.
52
 
      </para>
53
 
 
54
 
      <para>
55
 
        You should have received a copy of the GNU General Public
56
 
        License along with this program; If not, see
57
 
        <ulink url="http://www.gnu.org/licenses/"/>.
58
 
      </para>
59
 
    </legalnotice>
 
40
    <xi:include href="legalnotice.xml"/>
60
41
  </refentryinfo>
61
 
 
 
42
  
62
43
  <refmeta>
63
44
    <refentrytitle>&COMMANDNAME;</refentrytitle>
64
45
    <manvolnum>8</manvolnum>
67
48
  <refnamediv>
68
49
    <refname><command>&COMMANDNAME;</command></refname>
69
50
    <refpurpose>
70
 
      Generate keys for <citerefentry><refentrytitle>password-request
71
 
      </refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
 
51
      Generate key and password for Mandos client and server.
72
52
    </refpurpose>
73
53
  </refnamediv>
74
 
 
 
54
  
75
55
  <refsynopsisdiv>
76
56
    <cmdsynopsis>
77
57
      <command>&COMMANDNAME;</command>
78
 
      <group choice="opt">
79
 
        <arg choice="plain"><option>--dir</option>
80
 
        <replaceable>directory</replaceable></arg>
81
 
      </group>
82
 
      <group choice="opt">
83
 
        <arg choice="plain"><option>--type</option>
84
 
        <replaceable>type</replaceable></arg>
85
 
      </group>
86
 
      <group choice="opt">
87
 
        <arg choice="plain"><option>--length</option>
88
 
        <replaceable>bits</replaceable></arg>
89
 
      </group>
90
 
      <group choice="opt">
91
 
        <arg choice="plain"><option>--subtype</option>
92
 
        <replaceable>type</replaceable></arg>
93
 
      </group>
94
 
      <group choice="opt">
95
 
        <arg choice="plain"><option>--sublength</option>
96
 
        <replaceable>bits</replaceable></arg>
97
 
      </group>
98
 
      <group choice="opt">
99
 
        <arg choice="plain"><option>--name</option>
100
 
        <replaceable>NAME</replaceable></arg>
101
 
      </group>
102
 
      <group choice="opt">
103
 
        <arg choice="plain"><option>--email</option>
104
 
        <replaceable>EMAIL</replaceable></arg>
105
 
      </group>
106
 
      <group choice="opt">
107
 
        <arg choice="plain"><option>--comment</option>
108
 
        <replaceable>COMMENT</replaceable></arg>
109
 
      </group>
110
 
      <group choice="opt">
111
 
        <arg choice="plain"><option>--expire</option>
112
 
        <replaceable>TIME</replaceable></arg>
113
 
      </group>
114
 
      <group choice="opt">
115
 
        <arg choice="plain"><option>--force</option></arg>
116
 
      </group>
117
 
    </cmdsynopsis>
118
 
    <cmdsynopsis>
119
 
      <command>&COMMANDNAME;</command>
120
 
      <group choice="opt">
121
 
        <arg choice="plain"><option>-d</option>
122
 
        <replaceable>directory</replaceable></arg>
123
 
      </group>
124
 
      <group choice="opt">
125
 
        <arg choice="plain"><option>-t</option>
126
 
        <replaceable>type</replaceable></arg>
127
 
      </group>
128
 
      <group choice="opt">
129
 
        <arg choice="plain"><option>-l</option>
130
 
        <replaceable>bits</replaceable></arg>
131
 
      </group>
132
 
      <group choice="opt">
133
 
        <arg choice="plain"><option>-s</option>
134
 
        <replaceable>type</replaceable></arg>
135
 
      </group>
136
 
      <group choice="opt">
137
 
        <arg choice="plain"><option>-L</option>
138
 
        <replaceable>bits</replaceable></arg>
139
 
      </group>
140
 
      <group choice="opt">
141
 
        <arg choice="plain"><option>-n</option>
142
 
        <replaceable>NAME</replaceable></arg>
143
 
      </group>
144
 
      <group choice="opt">
145
 
        <arg choice="plain"><option>-e</option>
146
 
        <replaceable>EMAIL</replaceable></arg>
147
 
      </group>
148
 
      <group choice="opt">
149
 
        <arg choice="plain"><option>-c</option>
150
 
        <replaceable>COMMENT</replaceable></arg>
151
 
      </group>
152
 
      <group choice="opt">
153
 
        <arg choice="plain"><option>-x</option>
154
 
        <replaceable>TIME</replaceable></arg>
155
 
      </group>
156
 
      <group choice="opt">
157
 
        <arg choice="plain"><option>-f</option></arg>
158
 
      </group>
 
58
      <group>
 
59
        <arg choice="plain"><option>--dir
 
60
        <replaceable>DIRECTORY</replaceable></option></arg>
 
61
        <arg choice="plain"><option>-d
 
62
        <replaceable>DIRECTORY</replaceable></option></arg>
 
63
      </group>
 
64
      <sbr/>
 
65
      <group>
 
66
        <arg choice="plain"><option>--type
 
67
        <replaceable>KEYTYPE</replaceable></option></arg>
 
68
        <arg choice="plain"><option>-t
 
69
        <replaceable>KEYTYPE</replaceable></option></arg>
 
70
      </group>
 
71
      <sbr/>
 
72
      <group>
 
73
        <arg choice="plain"><option>--length
 
74
        <replaceable>BITS</replaceable></option></arg>
 
75
        <arg choice="plain"><option>-l
 
76
        <replaceable>BITS</replaceable></option></arg>
 
77
      </group>
 
78
      <sbr/>
 
79
      <group>
 
80
        <arg choice="plain"><option>--subtype
 
81
        <replaceable>KEYTYPE</replaceable></option></arg>
 
82
        <arg choice="plain"><option>-s
 
83
        <replaceable>KEYTYPE</replaceable></option></arg>
 
84
      </group>
 
85
      <sbr/>
 
86
      <group>
 
87
        <arg choice="plain"><option>--sublength
 
88
        <replaceable>BITS</replaceable></option></arg>
 
89
        <arg choice="plain"><option>-L
 
90
        <replaceable>BITS</replaceable></option></arg>
 
91
      </group>
 
92
      <sbr/>
 
93
      <group>
 
94
        <arg choice="plain"><option>--name
 
95
        <replaceable>NAME</replaceable></option></arg>
 
96
        <arg choice="plain"><option>-n
 
97
        <replaceable>NAME</replaceable></option></arg>
 
98
      </group>
 
99
      <sbr/>
 
100
      <group>
 
101
        <arg choice="plain"><option>--email
 
102
        <replaceable>ADDRESS</replaceable></option></arg>
 
103
        <arg choice="plain"><option>-e
 
104
        <replaceable>ADDRESS</replaceable></option></arg>
 
105
      </group>
 
106
      <sbr/>
 
107
      <group>
 
108
        <arg choice="plain"><option>--comment
 
109
        <replaceable>TEXT</replaceable></option></arg>
 
110
        <arg choice="plain"><option>-c
 
111
        <replaceable>TEXT</replaceable></option></arg>
 
112
      </group>
 
113
      <sbr/>
 
114
      <group>
 
115
        <arg choice="plain"><option>--expire
 
116
        <replaceable>TIME</replaceable></option></arg>
 
117
        <arg choice="plain"><option>-x
 
118
        <replaceable>TIME</replaceable></option></arg>
 
119
      </group>
 
120
      <sbr/>
 
121
      <arg><option>--force</option></arg>
159
122
    </cmdsynopsis>
160
123
    <cmdsynopsis>
161
124
      <command>&COMMANDNAME;</command>
162
125
      <group choice="req">
 
126
        <arg choice="plain"><option>--password</option></arg>
163
127
        <arg choice="plain"><option>-p</option></arg>
164
 
        <arg choice="plain"><option>--password</option></arg>
165
 
      </group>
166
 
      <group choice="opt">
167
 
        <arg choice="plain"><option>--dir</option>
168
 
        <replaceable>directory</replaceable></arg>
169
 
      </group>
170
 
      <group choice="opt">
171
 
        <arg choice="plain"><option>--name</option>
172
 
        <replaceable>NAME</replaceable></arg>
 
128
        <arg choice="plain"><option>--passfile
 
129
        <replaceable>FILE</replaceable></option></arg>
 
130
        <arg choice="plain"><option>-F</option>
 
131
        <replaceable>FILE</replaceable></arg>
 
132
      </group>
 
133
      <sbr/>
 
134
      <group>
 
135
        <arg choice="plain"><option>--dir
 
136
        <replaceable>DIRECTORY</replaceable></option></arg>
 
137
        <arg choice="plain"><option>-d
 
138
        <replaceable>DIRECTORY</replaceable></option></arg>
 
139
      </group>
 
140
      <sbr/>
 
141
      <group>
 
142
        <arg choice="plain"><option>--name
 
143
        <replaceable>NAME</replaceable></option></arg>
 
144
        <arg choice="plain"><option>-n
 
145
        <replaceable>NAME</replaceable></option></arg>
173
146
      </group>
174
147
    </cmdsynopsis>
175
148
    <cmdsynopsis>
176
149
      <command>&COMMANDNAME;</command>
177
150
      <group choice="req">
 
151
        <arg choice="plain"><option>--help</option></arg>
178
152
        <arg choice="plain"><option>-h</option></arg>
179
 
        <arg choice="plain"><option>--help</option></arg>
180
153
      </group>
181
154
    </cmdsynopsis>
182
155
    <cmdsynopsis>
183
156
      <command>&COMMANDNAME;</command>
184
157
      <group choice="req">
 
158
        <arg choice="plain"><option>--version</option></arg>
185
159
        <arg choice="plain"><option>-v</option></arg>
186
 
        <arg choice="plain"><option>--version</option></arg>
187
160
      </group>
188
161
    </cmdsynopsis>
189
162
  </refsynopsisdiv>
190
 
 
 
163
  
191
164
  <refsect1 id="description">
192
165
    <title>DESCRIPTION</title>
193
166
    <para>
194
167
      <command>&COMMANDNAME;</command> is a program to generate the
195
 
      OpenPGP keys used by
196
 
      <citerefentry><refentrytitle>password-request</refentrytitle>
197
 
      <manvolnum>8mandos</manvolnum></citerefentry>.  The keys are
 
168
      OpenPGP key used by
 
169
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
 
170
      <manvolnum>8mandos</manvolnum></citerefentry>.  The key is
198
171
      normally written to /etc/mandos for later installation into the
199
 
      initrd image, but this, like most things, can be changed with
200
 
      command line options.
 
172
      initrd image, but this, and most other things, can be changed
 
173
      with command line options.
201
174
    </para>
202
175
    <para>
203
 
      It can also be used to generate ready-made sections for
 
176
      This program can also be used with the
 
177
      <option>--password</option> or <option>--passfile</option>
 
178
      options to generate a ready-made section for
 
179
      <filename>clients.conf</filename> (see
204
180
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
205
 
      <manvolnum>5</manvolnum></citerefentry> using the
206
 
      <option>--password</option> option.
 
181
      <manvolnum>5</manvolnum></citerefentry>).
207
182
    </para>
208
183
  </refsect1>
209
184
  
210
185
  <refsect1 id="purpose">
211
186
    <title>PURPOSE</title>
212
 
 
213
187
    <para>
214
188
      The purpose of this is to enable <emphasis>remote and unattended
215
189
      rebooting</emphasis> of client host computer with an
216
190
      <emphasis>encrypted root file system</emphasis>.  See <xref
217
191
      linkend="overview"/> for details.
218
192
    </para>
219
 
 
220
193
  </refsect1>
221
194
  
222
195
  <refsect1 id="options">
223
196
    <title>OPTIONS</title>
224
 
 
 
197
    
225
198
    <variablelist>
226
199
      <varlistentry>
227
 
        <term><literal>-h</literal>, <literal>--help</literal></term>
 
200
        <term><option>--help</option></term>
 
201
        <term><option>-h</option></term>
228
202
        <listitem>
229
203
          <para>
230
204
            Show a help message and exit
231
205
          </para>
232
206
        </listitem>
233
207
      </varlistentry>
234
 
 
 
208
      
235
209
      <varlistentry>
236
 
        <term><literal>-d</literal>, <literal>--dir
237
 
        <replaceable>directory</replaceable></literal></term>
 
210
        <term><option>--dir
 
211
        <replaceable>DIRECTORY</replaceable></option></term>
 
212
        <term><option>-d
 
213
        <replaceable>DIRECTORY</replaceable></option></term>
238
214
        <listitem>
239
215
          <para>
240
216
            Target directory for key files.  Default is
242
218
          </para>
243
219
        </listitem>
244
220
      </varlistentry>
245
 
 
 
221
      
246
222
      <varlistentry>
247
 
        <term><literal>-t</literal>, <literal>--type
248
 
        <replaceable>type</replaceable></literal></term>
 
223
        <term><option>--type
 
224
        <replaceable>TYPE</replaceable></option></term>
 
225
        <term><option>-t
 
226
        <replaceable>TYPE</replaceable></option></term>
249
227
        <listitem>
250
228
          <para>
251
229
            Key type.  Default is <quote>DSA</quote>.
252
230
          </para>
253
231
        </listitem>
254
232
      </varlistentry>
255
 
 
 
233
      
256
234
      <varlistentry>
257
 
        <term><literal>-l</literal>, <literal>--length
258
 
        <replaceable>bits</replaceable></literal></term>
 
235
        <term><option>--length
 
236
        <replaceable>BITS</replaceable></option></term>
 
237
        <term><option>-l
 
238
        <replaceable>BITS</replaceable></option></term>
259
239
        <listitem>
260
240
          <para>
261
241
            Key length in bits.  Default is 2048.
262
242
          </para>
263
243
        </listitem>
264
244
      </varlistentry>
265
 
 
 
245
      
266
246
      <varlistentry>
267
 
        <term><literal>-s</literal>, <literal>--subtype
268
 
        <replaceable>type</replaceable></literal></term>
 
247
        <term><option>--subtype
 
248
        <replaceable>KEYTYPE</replaceable></option></term>
 
249
        <term><option>-s
 
250
        <replaceable>KEYTYPE</replaceable></option></term>
269
251
        <listitem>
270
252
          <para>
271
253
            Subkey type.  Default is <quote>ELG-E</quote> (Elgamal
273
255
          </para>
274
256
        </listitem>
275
257
      </varlistentry>
276
 
 
 
258
      
277
259
      <varlistentry>
278
 
        <term><literal>-L</literal>, <literal>--sublength
279
 
        <replaceable>bits</replaceable></literal></term>
 
260
        <term><option>--sublength
 
261
        <replaceable>BITS</replaceable></option></term>
 
262
        <term><option>-L
 
263
        <replaceable>BITS</replaceable></option></term>
280
264
        <listitem>
281
265
          <para>
282
266
            Subkey length in bits.  Default is 2048.
283
267
          </para>
284
268
        </listitem>
285
269
      </varlistentry>
286
 
 
 
270
      
287
271
      <varlistentry>
288
 
        <term><literal>-e</literal>, <literal>--email</literal>
289
 
        <replaceable>address</replaceable></term>
 
272
        <term><option>--email
 
273
        <replaceable>ADDRESS</replaceable></option></term>
 
274
        <term><option>-e
 
275
        <replaceable>ADDRESS</replaceable></option></term>
290
276
        <listitem>
291
277
          <para>
292
278
            Email address of key.  Default is empty.
293
279
          </para>
294
280
        </listitem>
295
281
      </varlistentry>
296
 
 
 
282
      
297
283
      <varlistentry>
298
 
        <term><literal>-c</literal>, <literal>--comment</literal>
299
 
        <replaceable>comment</replaceable></term>
 
284
        <term><option>--comment
 
285
        <replaceable>TEXT</replaceable></option></term>
 
286
        <term><option>-c
 
287
        <replaceable>TEXT</replaceable></option></term>
300
288
        <listitem>
301
289
          <para>
302
290
            Comment field for key.  The default value is
304
292
          </para>
305
293
        </listitem>
306
294
      </varlistentry>
307
 
 
 
295
      
308
296
      <varlistentry>
309
 
        <term><literal>-x</literal>, <literal>--expire</literal>
310
 
        <replaceable>time</replaceable></term>
 
297
        <term><option>--expire
 
298
        <replaceable>TIME</replaceable></option></term>
 
299
        <term><option>-x
 
300
        <replaceable>TIME</replaceable></option></term>
311
301
        <listitem>
312
302
          <para>
313
303
            Key expire time.  Default is no expiration.  See
316
306
          </para>
317
307
        </listitem>
318
308
      </varlistentry>
319
 
 
 
309
      
320
310
      <varlistentry>
321
 
        <term><literal>-f</literal>, <literal>--force</literal></term>
 
311
        <term><option>--force</option></term>
 
312
        <term><option>-f</option></term>
322
313
        <listitem>
323
314
          <para>
324
 
            Force overwriting old keys.
 
315
            Force overwriting old key.
325
316
          </para>
326
317
        </listitem>
327
318
      </varlistentry>
328
319
      <varlistentry>
329
 
        <term><literal>-p</literal>, <literal>--password</literal
330
 
        ></term>
 
320
        <term><option>--password</option></term>
 
321
        <term><option>-p</option></term>
331
322
        <listitem>
332
323
          <para>
333
324
            Prompt for a password and encrypt it with the key already
339
330
            >8</manvolnum></citerefentry>.  The host name or the name
340
331
            specified with the <option>--name</option> option is used
341
332
            for the section header.  All other options are ignored,
342
 
            and no keys are created.
 
333
            and no key is created.
 
334
          </para>
 
335
        </listitem>
 
336
      </varlistentry>
 
337
      <varlistentry>
 
338
        <term><option>--passfile
 
339
        <replaceable>FILE</replaceable></option></term>
 
340
        <term><option>-F
 
341
        <replaceable>FILE</replaceable></option></term>
 
342
        <listitem>
 
343
          <para>
 
344
            The same as <option>--password</option>, but read from
 
345
            <replaceable>FILE</replaceable>, not the terminal.
343
346
          </para>
344
347
        </listitem>
345
348
      </varlistentry>
346
349
    </variablelist>
347
350
  </refsect1>
348
 
 
 
351
  
349
352
  <refsect1 id="overview">
350
353
    <title>OVERVIEW</title>
351
354
    <xi:include href="overview.xml"/>
352
355
    <para>
353
356
      This program is a small utility to generate new OpenPGP keys for
354
 
      new Mandos clients.
 
357
      new Mandos clients, and to generate sections for inclusion in
 
358
      <filename>clients.conf</filename> on the server.
355
359
    </para>
356
360
  </refsect1>
357
 
 
 
361
  
358
362
  <refsect1 id="exit_status">
359
363
    <title>EXIT STATUS</title>
360
364
    <para>
361
 
      The exit status will be 0 if new keys were successfully created,
362
 
      otherwise not.
 
365
      The exit status will be 0 if a new key (or password, if the
 
366
      <option>--password</option> option was used) was successfully
 
367
      created, otherwise not.
363
368
    </para>
364
369
  </refsect1>
365
370
  
367
372
    <title>ENVIRONMENT</title>
368
373
    <variablelist>
369
374
      <varlistentry>
370
 
        <term><varname>TMPDIR</varname></term>
 
375
        <term><envar>TMPDIR</envar></term>
371
376
        <listitem>
372
377
          <para>
373
378
            If set, temporary files will be created here. See
379
384
    </variablelist>
380
385
  </refsect1>
381
386
  
382
 
  <refsect1 id="file">
 
387
  <refsect1 id="files">
383
388
    <title>FILES</title>
384
389
    <para>
385
390
      Use the <option>--dir</option> option to change where
416
421
      </varlistentry>
417
422
    </variablelist>
418
423
  </refsect1>
419
 
 
420
 
  <refsect1 id="bugs">
421
 
    <title>BUGS</title>
422
 
    <para>
423
 
      None are known at this time.
424
 
    </para>
425
 
  </refsect1>
426
 
 
 
424
  
 
425
<!--   <refsect1 id="bugs"> -->
 
426
<!--     <title>BUGS</title> -->
 
427
<!--     <para> -->
 
428
<!--     </para> -->
 
429
<!--   </refsect1> -->
 
430
  
427
431
  <refsect1 id="example">
428
432
    <title>EXAMPLE</title>
429
433
    <informalexample>
431
435
        Normal invocation needs no options:
432
436
      </para>
433
437
      <para>
434
 
        <userinput>mandos-keygen</userinput>
 
438
        <userinput>&COMMANDNAME;</userinput>
435
439
      </para>
436
440
    </informalexample>
437
441
    <informalexample>
438
442
      <para>
439
 
        Create keys in another directory and of another type.  Force
 
443
        Create key in another directory and of another type.  Force
440
444
        overwriting old key files:
441
445
      </para>
442
446
      <para>
443
447
 
444
448
<!-- do not wrap this line -->
445
 
<userinput>mandos-keygen --dir ~/keydir --type RSA --force</userinput>
 
449
<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>
 
450
 
 
451
      </para>
 
452
    </informalexample>
 
453
    <informalexample>
 
454
      <para>
 
455
        Prompt for a password, encrypt it with the key in
 
456
        <filename>/etc/mandos</filename> and output a section suitable
 
457
        for <filename>clients.conf</filename>.
 
458
      </para>
 
459
      <para>
 
460
        <userinput>&COMMANDNAME; --password</userinput>
 
461
      </para>
 
462
    </informalexample>
 
463
    <informalexample>
 
464
      <para>
 
465
        Prompt for a password, encrypt it with the key in the
 
466
        <filename>client-key</filename> directory and output a section
 
467
        suitable for <filename>clients.conf</filename>.
 
468
      </para>
 
469
      <para>
 
470
 
 
471
<!-- do not wrap this line -->
 
472
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
446
473
 
447
474
      </para>
448
475
    </informalexample>
449
476
  </refsect1>
450
 
 
 
477
  
451
478
  <refsect1 id="security">
452
479
    <title>SECURITY</title>
453
480
    <para>
454
481
      The <option>--type</option>, <option>--length</option>,
455
482
      <option>--subtype</option>, and <option>--sublength</option>
456
 
      options can be used to create keys of insufficient security.  If
457
 
      in doubt, leave them to the default values.
 
483
      options can be used to create keys of low security.  If in
 
484
      doubt, leave them to the default values.
458
485
    </para>
459
486
    <para>
460
 
      The key expire time is not guaranteed to be honored by
461
 
      <citerefentry><refentrytitle>mandos</refentrytitle>
 
487
      The key expire time is <emphasis>not</emphasis> guaranteed to be
 
488
      honored by <citerefentry><refentrytitle>mandos</refentrytitle>
462
489
      <manvolnum>8</manvolnum></citerefentry>.
463
490
    </para>
464
491
  </refsect1>
465
 
 
 
492
  
466
493
  <refsect1 id="see_also">
467
494
    <title>SEE ALSO</title>
468
495
    <para>
469
 
      <citerefentry><refentrytitle>password-request</refentrytitle>
 
496
      <citerefentry><refentrytitle>intro</refentrytitle>
470
497
      <manvolnum>8mandos</manvolnum></citerefentry>,
 
498
      <citerefentry><refentrytitle>gpg</refentrytitle>
 
499
      <manvolnum>1</manvolnum></citerefentry>,
 
500
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
 
501
      <manvolnum>5</manvolnum></citerefentry>,
471
502
      <citerefentry><refentrytitle>mandos</refentrytitle>
472
503
      <manvolnum>8</manvolnum></citerefentry>,
473
 
      <citerefentry><refentrytitle>gpg</refentrytitle>
474
 
      <manvolnum>1</manvolnum></citerefentry>
 
504
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
 
505
      <manvolnum>8mandos</manvolnum></citerefentry>
475
506
    </para>
476
507
  </refsect1>
477
508