/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-keygen.xml

  • Committer: Teddy Hogeborn
  • Date: 2012-04-24 06:55:34 UTC
  • Revision ID: teddy@recompile.se-20120424065534-n1jqfth9odw3l1jr
* network-hooks.d/bridge: Move "start" and "stop" commands to separate
                          functions.
* network-hooks.d/openvpn: - '' -
* network-hooks.d/wireless: - '' -

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-keygen.xml
1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
 
<!ENTITY VERSION "1.0">
5
4
<!ENTITY COMMANDNAME "mandos-keygen">
 
5
<!ENTITY TIMESTAMP "2012-01-01">
 
6
<!ENTITY % common SYSTEM "common.ent">
 
7
%common;
6
8
]>
7
9
 
8
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
9
11
  <refentryinfo>
10
 
    <title>&COMMANDNAME;</title>
 
12
    <title>Mandos Manual</title>
11
13
    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
12
 
    <productname>&COMMANDNAME;</productname>
13
 
    <productnumber>&VERSION;</productnumber>
 
14
    <productname>Mandos</productname>
 
15
    <productnumber>&version;</productnumber>
 
16
    <date>&TIMESTAMP;</date>
14
17
    <authorgroup>
15
18
      <author>
16
19
        <firstname>Björn</firstname>
17
20
        <surname>Påhlsson</surname>
18
21
        <address>
19
 
          <email>belorn@fukt.bsnet.se</email>
 
22
          <email>belorn@recompile.se</email>
20
23
        </address>
21
24
      </author>
22
25
      <author>
23
26
        <firstname>Teddy</firstname>
24
27
        <surname>Hogeborn</surname>
25
28
        <address>
26
 
          <email>teddy@fukt.bsnet.se</email>
 
29
          <email>teddy@recompile.se</email>
27
30
        </address>
28
31
      </author>
29
32
    </authorgroup>
30
33
    <copyright>
31
34
      <year>2008</year>
 
35
      <year>2009</year>
 
36
      <year>2011</year>
 
37
      <year>2012</year>
32
38
      <holder>Teddy Hogeborn</holder>
33
39
      <holder>Björn Påhlsson</holder>
34
40
    </copyright>
35
 
    <legalnotice>
36
 
      <para>
37
 
        This manual page is free software: you can redistribute it
38
 
        and/or modify it under the terms of the GNU General Public
39
 
        License as published by the Free Software Foundation,
40
 
        either version 3 of the License, or (at your option) any
41
 
        later version.
42
 
      </para>
43
 
 
44
 
      <para>
45
 
        This manual page is distributed in the hope that it will
46
 
        be useful, but WITHOUT ANY WARRANTY; without even the
47
 
        implied warranty of MERCHANTABILITY or FITNESS FOR A
48
 
        PARTICULAR PURPOSE.  See the GNU General Public License
49
 
        for more details.
50
 
      </para>
51
 
 
52
 
      <para>
53
 
        You should have received a copy of the GNU General Public
54
 
        License along with this program; If not, see
55
 
        <ulink url="http://www.gnu.org/licenses/"/>.
56
 
      </para>
57
 
    </legalnotice>
 
41
    <xi:include href="legalnotice.xml"/>
58
42
  </refentryinfo>
59
 
 
 
43
  
60
44
  <refmeta>
61
45
    <refentrytitle>&COMMANDNAME;</refentrytitle>
62
46
    <manvolnum>8</manvolnum>
65
49
  <refnamediv>
66
50
    <refname><command>&COMMANDNAME;</command></refname>
67
51
    <refpurpose>
68
 
      Generate keys for <citerefentry><refentrytitle>password-request
69
 
      </refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
 
52
      Generate key and password for Mandos client and server.
70
53
    </refpurpose>
71
54
  </refnamediv>
72
 
 
 
55
  
73
56
  <refsynopsisdiv>
74
57
    <cmdsynopsis>
75
58
      <command>&COMMANDNAME;</command>
76
 
      <group choice="opt">
77
 
        <arg choice="plain"><option>--dir</option>
78
 
        <replaceable>directory</replaceable></arg>
79
 
      </group>
80
 
      <group choice="opt">
81
 
        <arg choice="plain"><option>--type</option>
82
 
        <replaceable>type</replaceable></arg>
83
 
      </group>
84
 
      <group choice="opt">
85
 
        <arg choice="plain"><option>--length</option>
86
 
        <replaceable>bits</replaceable></arg>
87
 
      </group>
88
 
      <group choice="opt">
89
 
        <arg choice="plain"><option>--subtype</option>
90
 
        <replaceable>type</replaceable></arg>
91
 
      </group>
92
 
      <group choice="opt">
93
 
        <arg choice="plain"><option>--sublength</option>
94
 
        <replaceable>bits</replaceable></arg>
95
 
      </group>
96
 
      <group choice="opt">
97
 
        <arg choice="plain"><option>--name</option>
98
 
        <replaceable>NAME</replaceable></arg>
99
 
      </group>
100
 
      <group choice="opt">
101
 
        <arg choice="plain"><option>--email</option>
102
 
        <replaceable>EMAIL</replaceable></arg>
103
 
      </group>
104
 
      <group choice="opt">
105
 
        <arg choice="plain"><option>--comment</option>
106
 
        <replaceable>COMMENT</replaceable></arg>
107
 
      </group>
108
 
      <group choice="opt">
109
 
        <arg choice="plain"><option>--expire</option>
110
 
        <replaceable>TIME</replaceable></arg>
111
 
      </group>
112
 
      <group choice="opt">
113
 
        <arg choice="plain"><option>--force</option></arg>
114
 
      </group>
115
 
    </cmdsynopsis>
116
 
    <cmdsynopsis>
117
 
      <command>&COMMANDNAME;</command>
118
 
      <group choice="opt">
119
 
        <arg choice="plain"><option>-d</option>
120
 
        <replaceable>directory</replaceable></arg>
121
 
      </group>
122
 
      <group choice="opt">
123
 
        <arg choice="plain"><option>-t</option>
124
 
        <replaceable>type</replaceable></arg>
125
 
      </group>
126
 
      <group choice="opt">
127
 
        <arg choice="plain"><option>-l</option>
128
 
        <replaceable>bits</replaceable></arg>
129
 
      </group>
130
 
      <group choice="opt">
131
 
        <arg choice="plain"><option>-s</option>
132
 
        <replaceable>type</replaceable></arg>
133
 
      </group>
134
 
      <group choice="opt">
135
 
        <arg choice="plain"><option>-L</option>
136
 
        <replaceable>bits</replaceable></arg>
137
 
      </group>
138
 
      <group choice="opt">
139
 
        <arg choice="plain"><option>-n</option>
140
 
        <replaceable>NAME</replaceable></arg>
141
 
      </group>
142
 
      <group choice="opt">
143
 
        <arg choice="plain"><option>-e</option>
144
 
        <replaceable>EMAIL</replaceable></arg>
145
 
      </group>
146
 
      <group choice="opt">
147
 
        <arg choice="plain"><option>-c</option>
148
 
        <replaceable>COMMENT</replaceable></arg>
149
 
      </group>
150
 
      <group choice="opt">
151
 
        <arg choice="plain"><option>-x</option>
152
 
        <replaceable>TIME</replaceable></arg>
153
 
      </group>
154
 
      <group choice="opt">
155
 
        <arg choice="plain"><option>-f</option></arg>
156
 
      </group>
157
 
    </cmdsynopsis>
158
 
    <cmdsynopsis>
159
 
      <command>&COMMANDNAME;</command>
160
 
      <group choice="req">
 
59
      <group>
 
60
        <arg choice="plain"><option>--dir
 
61
        <replaceable>DIRECTORY</replaceable></option></arg>
 
62
        <arg choice="plain"><option>-d
 
63
        <replaceable>DIRECTORY</replaceable></option></arg>
 
64
      </group>
 
65
      <sbr/>
 
66
      <group>
 
67
        <arg choice="plain"><option>--type
 
68
        <replaceable>KEYTYPE</replaceable></option></arg>
 
69
        <arg choice="plain"><option>-t
 
70
        <replaceable>KEYTYPE</replaceable></option></arg>
 
71
      </group>
 
72
      <sbr/>
 
73
      <group>
 
74
        <arg choice="plain"><option>--length
 
75
        <replaceable>BITS</replaceable></option></arg>
 
76
        <arg choice="plain"><option>-l
 
77
        <replaceable>BITS</replaceable></option></arg>
 
78
      </group>
 
79
      <sbr/>
 
80
      <group>
 
81
        <arg choice="plain"><option>--subtype
 
82
        <replaceable>KEYTYPE</replaceable></option></arg>
 
83
        <arg choice="plain"><option>-s
 
84
        <replaceable>KEYTYPE</replaceable></option></arg>
 
85
      </group>
 
86
      <sbr/>
 
87
      <group>
 
88
        <arg choice="plain"><option>--sublength
 
89
        <replaceable>BITS</replaceable></option></arg>
 
90
        <arg choice="plain"><option>-L
 
91
        <replaceable>BITS</replaceable></option></arg>
 
92
      </group>
 
93
      <sbr/>
 
94
      <group>
 
95
        <arg choice="plain"><option>--name
 
96
        <replaceable>NAME</replaceable></option></arg>
 
97
        <arg choice="plain"><option>-n
 
98
        <replaceable>NAME</replaceable></option></arg>
 
99
      </group>
 
100
      <sbr/>
 
101
      <group>
 
102
        <arg choice="plain"><option>--email
 
103
        <replaceable>ADDRESS</replaceable></option></arg>
 
104
        <arg choice="plain"><option>-e
 
105
        <replaceable>ADDRESS</replaceable></option></arg>
 
106
      </group>
 
107
      <sbr/>
 
108
      <group>
 
109
        <arg choice="plain"><option>--comment
 
110
        <replaceable>TEXT</replaceable></option></arg>
 
111
        <arg choice="plain"><option>-c
 
112
        <replaceable>TEXT</replaceable></option></arg>
 
113
      </group>
 
114
      <sbr/>
 
115
      <group>
 
116
        <arg choice="plain"><option>--expire
 
117
        <replaceable>TIME</replaceable></option></arg>
 
118
        <arg choice="plain"><option>-x
 
119
        <replaceable>TIME</replaceable></option></arg>
 
120
      </group>
 
121
      <sbr/>
 
122
      <arg><option>--force</option></arg>
 
123
    </cmdsynopsis>
 
124
    <cmdsynopsis>
 
125
      <command>&COMMANDNAME;</command>
 
126
      <group choice="req">
 
127
        <arg choice="plain"><option>--password</option></arg>
 
128
        <arg choice="plain"><option>-p</option></arg>
 
129
        <arg choice="plain"><option>--passfile
 
130
        <replaceable>FILE</replaceable></option></arg>
 
131
        <arg choice="plain"><option>-F</option>
 
132
        <replaceable>FILE</replaceable></arg>
 
133
      </group>
 
134
      <sbr/>
 
135
      <group>
 
136
        <arg choice="plain"><option>--dir
 
137
        <replaceable>DIRECTORY</replaceable></option></arg>
 
138
        <arg choice="plain"><option>-d
 
139
        <replaceable>DIRECTORY</replaceable></option></arg>
 
140
      </group>
 
141
      <sbr/>
 
142
      <group>
 
143
        <arg choice="plain"><option>--name
 
144
        <replaceable>NAME</replaceable></option></arg>
 
145
        <arg choice="plain"><option>-n
 
146
        <replaceable>NAME</replaceable></option></arg>
 
147
      </group>
 
148
    </cmdsynopsis>
 
149
    <cmdsynopsis>
 
150
      <command>&COMMANDNAME;</command>
 
151
      <group choice="req">
 
152
        <arg choice="plain"><option>--help</option></arg>
161
153
        <arg choice="plain"><option>-h</option></arg>
162
 
        <arg choice="plain"><option>--help</option></arg>
163
154
      </group>
164
155
    </cmdsynopsis>
165
156
    <cmdsynopsis>
166
157
      <command>&COMMANDNAME;</command>
167
158
      <group choice="req">
 
159
        <arg choice="plain"><option>--version</option></arg>
168
160
        <arg choice="plain"><option>-v</option></arg>
169
 
        <arg choice="plain"><option>--version</option></arg>
170
161
      </group>
171
162
    </cmdsynopsis>
172
163
  </refsynopsisdiv>
173
 
 
 
164
  
174
165
  <refsect1 id="description">
175
166
    <title>DESCRIPTION</title>
176
167
    <para>
177
168
      <command>&COMMANDNAME;</command> is a program to generate the
178
 
      OpenPGP keys used by
179
 
      <citerefentry><refentrytitle>password-request</refentrytitle>
180
 
      <manvolnum>8mandos</manvolnum></citerefentry>.  The keys are
 
169
      OpenPGP key used by
 
170
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
 
171
      <manvolnum>8mandos</manvolnum></citerefentry>.  The key is
181
172
      normally written to /etc/mandos for later installation into the
182
 
      initrd image, but this, like most things, can be changed with
183
 
      command line options.
 
173
      initrd image, but this, and most other things, can be changed
 
174
      with command line options.
 
175
    </para>
 
176
    <para>
 
177
      This program can also be used with the
 
178
      <option>--password</option> or <option>--passfile</option>
 
179
      options to generate a ready-made section for
 
180
      <filename>clients.conf</filename> (see
 
181
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
 
182
      <manvolnum>5</manvolnum></citerefentry>).
184
183
    </para>
185
184
  </refsect1>
186
185
  
187
186
  <refsect1 id="purpose">
188
187
    <title>PURPOSE</title>
189
 
 
190
188
    <para>
191
189
      The purpose of this is to enable <emphasis>remote and unattended
192
190
      rebooting</emphasis> of client host computer with an
193
191
      <emphasis>encrypted root file system</emphasis>.  See <xref
194
192
      linkend="overview"/> for details.
195
193
    </para>
196
 
 
197
194
  </refsect1>
198
195
  
199
196
  <refsect1 id="options">
200
197
    <title>OPTIONS</title>
201
 
 
 
198
    
202
199
    <variablelist>
203
200
      <varlistentry>
204
 
        <term><literal>-h</literal>, <literal>--help</literal></term>
 
201
        <term><option>--help</option></term>
 
202
        <term><option>-h</option></term>
205
203
        <listitem>
206
204
          <para>
207
205
            Show a help message and exit
208
206
          </para>
209
207
        </listitem>
210
208
      </varlistentry>
211
 
 
 
209
      
212
210
      <varlistentry>
213
 
        <term><literal>-d</literal>, <literal>--dir
214
 
        <replaceable>directory</replaceable></literal></term>
 
211
        <term><option>--dir
 
212
        <replaceable>DIRECTORY</replaceable></option></term>
 
213
        <term><option>-d
 
214
        <replaceable>DIRECTORY</replaceable></option></term>
215
215
        <listitem>
216
216
          <para>
217
 
            Target directory for key files.
 
217
            Target directory for key files.  Default is
 
218
            <filename class="directory">/etc/mandos</filename>.
218
219
          </para>
219
220
        </listitem>
220
221
      </varlistentry>
221
 
 
 
222
      
222
223
      <varlistentry>
223
 
        <term><literal>-t</literal>, <literal>--type
224
 
        <replaceable>type</replaceable></literal></term>
 
224
        <term><option>--type
 
225
        <replaceable>TYPE</replaceable></option></term>
 
226
        <term><option>-t
 
227
        <replaceable>TYPE</replaceable></option></term>
225
228
        <listitem>
226
229
          <para>
227
230
            Key type.  Default is <quote>DSA</quote>.
228
231
          </para>
229
232
        </listitem>
230
233
      </varlistentry>
231
 
 
 
234
      
232
235
      <varlistentry>
233
 
        <term><literal>-l</literal>, <literal>--length
234
 
        <replaceable>bits</replaceable></literal></term>
 
236
        <term><option>--length
 
237
        <replaceable>BITS</replaceable></option></term>
 
238
        <term><option>-l
 
239
        <replaceable>BITS</replaceable></option></term>
235
240
        <listitem>
236
241
          <para>
237
 
            Key length in bits.  Default is 1024.
 
242
            Key length in bits.  Default is 2048.
238
243
          </para>
239
244
        </listitem>
240
245
      </varlistentry>
241
 
 
 
246
      
242
247
      <varlistentry>
243
 
        <term><literal>-s</literal>, <literal>--subtype
244
 
        <replaceable>type</replaceable></literal></term>
 
248
        <term><option>--subtype
 
249
        <replaceable>KEYTYPE</replaceable></option></term>
 
250
        <term><option>-s
 
251
        <replaceable>KEYTYPE</replaceable></option></term>
245
252
        <listitem>
246
253
          <para>
247
254
            Subkey type.  Default is <quote>ELG-E</quote> (Elgamal
249
256
          </para>
250
257
        </listitem>
251
258
      </varlistentry>
252
 
 
 
259
      
253
260
      <varlistentry>
254
 
        <term><literal>-L</literal>, <literal>--sublength
255
 
        <replaceable>bits</replaceable></literal></term>
 
261
        <term><option>--sublength
 
262
        <replaceable>BITS</replaceable></option></term>
 
263
        <term><option>-L
 
264
        <replaceable>BITS</replaceable></option></term>
256
265
        <listitem>
257
266
          <para>
258
267
            Subkey length in bits.  Default is 2048.
259
268
          </para>
260
269
        </listitem>
261
270
      </varlistentry>
262
 
 
 
271
      
263
272
      <varlistentry>
264
 
        <term><literal>-e</literal>, <literal>--email</literal>
265
 
        <replaceable>address</replaceable></term>
 
273
        <term><option>--email
 
274
        <replaceable>ADDRESS</replaceable></option></term>
 
275
        <term><option>-e
 
276
        <replaceable>ADDRESS</replaceable></option></term>
266
277
        <listitem>
267
278
          <para>
268
279
            Email address of key.  Default is empty.
269
280
          </para>
270
281
        </listitem>
271
282
      </varlistentry>
272
 
 
 
283
      
273
284
      <varlistentry>
274
 
        <term><literal>-c</literal>, <literal>--comment</literal>
275
 
        <replaceable>comment</replaceable></term>
 
285
        <term><option>--comment
 
286
        <replaceable>TEXT</replaceable></option></term>
 
287
        <term><option>-c
 
288
        <replaceable>TEXT</replaceable></option></term>
276
289
        <listitem>
277
290
          <para>
278
291
            Comment field for key.  The default value is
280
293
          </para>
281
294
        </listitem>
282
295
      </varlistentry>
283
 
 
 
296
      
284
297
      <varlistentry>
285
 
        <term><literal>-x</literal>, <literal>--expire</literal>
286
 
        <replaceable>time</replaceable></term>
 
298
        <term><option>--expire
 
299
        <replaceable>TIME</replaceable></option></term>
 
300
        <term><option>-x
 
301
        <replaceable>TIME</replaceable></option></term>
287
302
        <listitem>
288
303
          <para>
289
304
            Key expire time.  Default is no expiration.  See
292
307
          </para>
293
308
        </listitem>
294
309
      </varlistentry>
295
 
 
296
 
      <varlistentry>
297
 
        <term><literal>-f</literal>, <literal>--force</literal></term>
298
 
        <listitem>
299
 
          <para>
300
 
            Force overwriting old keys.
 
310
      
 
311
      <varlistentry>
 
312
        <term><option>--force</option></term>
 
313
        <term><option>-f</option></term>
 
314
        <listitem>
 
315
          <para>
 
316
            Force overwriting old key.
 
317
          </para>
 
318
        </listitem>
 
319
      </varlistentry>
 
320
      <varlistentry>
 
321
        <term><option>--password</option></term>
 
322
        <term><option>-p</option></term>
 
323
        <listitem>
 
324
          <para>
 
325
            Prompt for a password and encrypt it with the key already
 
326
            present in either <filename>/etc/mandos</filename> or the
 
327
            directory specified with the <option>--dir</option>
 
328
            option.  Outputs, on standard output, a section suitable
 
329
            for inclusion in <citerefentry><refentrytitle
 
330
            >mandos-clients.conf</refentrytitle><manvolnum
 
331
            >8</manvolnum></citerefentry>.  The host name or the name
 
332
            specified with the <option>--name</option> option is used
 
333
            for the section header.  All other options are ignored,
 
334
            and no key is created.
 
335
          </para>
 
336
        </listitem>
 
337
      </varlistentry>
 
338
      <varlistentry>
 
339
        <term><option>--passfile
 
340
        <replaceable>FILE</replaceable></option></term>
 
341
        <term><option>-F
 
342
        <replaceable>FILE</replaceable></option></term>
 
343
        <listitem>
 
344
          <para>
 
345
            The same as <option>--password</option>, but read from
 
346
            <replaceable>FILE</replaceable>, not the terminal.
301
347
          </para>
302
348
        </listitem>
303
349
      </varlistentry>
304
350
    </variablelist>
305
351
  </refsect1>
306
 
 
 
352
  
307
353
  <refsect1 id="overview">
308
354
    <title>OVERVIEW</title>
309
355
    <xi:include href="overview.xml"/>
310
356
    <para>
311
357
      This program is a small utility to generate new OpenPGP keys for
312
 
      new Mandos clients.
 
358
      new Mandos clients, and to generate sections for inclusion in
 
359
      <filename>clients.conf</filename> on the server.
313
360
    </para>
314
361
  </refsect1>
315
 
 
 
362
  
316
363
  <refsect1 id="exit_status">
317
364
    <title>EXIT STATUS</title>
318
365
    <para>
319
 
      The exit status will be 0 if new keys were successfully created,
320
 
      otherwise not.
 
366
      The exit status will be 0 if a new key (or password, if the
 
367
      <option>--password</option> option was used) was successfully
 
368
      created, otherwise not.
321
369
    </para>
322
370
  </refsect1>
323
371
  
325
373
    <title>ENVIRONMENT</title>
326
374
    <variablelist>
327
375
      <varlistentry>
328
 
        <term><varname>TMPDIR</varname></term>
 
376
        <term><envar>TMPDIR</envar></term>
329
377
        <listitem>
330
378
          <para>
331
379
            If set, temporary files will be created here. See
337
385
    </variablelist>
338
386
  </refsect1>
339
387
  
340
 
  <refsect1 id="file">
 
388
  <refsect1 id="files">
341
389
    <title>FILES</title>
342
390
    <para>
343
391
      Use the <option>--dir</option> option to change where
364
412
        </listitem>
365
413
      </varlistentry>
366
414
      <varlistentry>
367
 
        <term><filename>/tmp</filename></term>
 
415
        <term><filename class="directory">/tmp</filename></term>
368
416
        <listitem>
369
417
          <para>
370
418
            Temporary files will be written here if
374
422
      </varlistentry>
375
423
    </variablelist>
376
424
  </refsect1>
377
 
 
378
 
  <refsect1 id="bugs">
379
 
    <title>BUGS</title>
380
 
    <para>
381
 
      None are known at this time.
382
 
    </para>
383
 
  </refsect1>
384
 
 
 
425
  
 
426
<!--   <refsect1 id="bugs"> -->
 
427
<!--     <title>BUGS</title> -->
 
428
<!--     <para> -->
 
429
<!--     </para> -->
 
430
<!--   </refsect1> -->
 
431
  
385
432
  <refsect1 id="example">
386
433
    <title>EXAMPLE</title>
387
434
    <informalexample>
389
436
        Normal invocation needs no options:
390
437
      </para>
391
438
      <para>
392
 
        <userinput>mandos-keygen</userinput>
 
439
        <userinput>&COMMANDNAME;</userinput>
393
440
      </para>
394
441
    </informalexample>
395
442
    <informalexample>
396
443
      <para>
397
 
        Create keys in another directory and of another type.  Force
 
444
        Create key in another directory and of another type.  Force
398
445
        overwriting old key files:
399
446
      </para>
400
447
      <para>
401
448
 
402
449
<!-- do not wrap this line -->
403
 
<userinput>mandos-keygen --dir ~/keydir --type RSA --force</userinput>
 
450
<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>
 
451
 
 
452
      </para>
 
453
    </informalexample>
 
454
    <informalexample>
 
455
      <para>
 
456
        Prompt for a password, encrypt it with the key in <filename
 
457
        class="directory">/etc/mandos</filename> and output a section
 
458
        suitable for <filename>clients.conf</filename>.
 
459
      </para>
 
460
      <para>
 
461
        <userinput>&COMMANDNAME; --password</userinput>
 
462
      </para>
 
463
    </informalexample>
 
464
    <informalexample>
 
465
      <para>
 
466
        Prompt for a password, encrypt it with the key in the
 
467
        <filename>client-key</filename> directory and output a section
 
468
        suitable for <filename>clients.conf</filename>.
 
469
      </para>
 
470
      <para>
 
471
 
 
472
<!-- do not wrap this line -->
 
473
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
404
474
 
405
475
      </para>
406
476
    </informalexample>
407
477
  </refsect1>
408
 
 
 
478
  
409
479
  <refsect1 id="security">
410
480
    <title>SECURITY</title>
411
481
    <para>
412
482
      The <option>--type</option>, <option>--length</option>,
413
483
      <option>--subtype</option>, and <option>--sublength</option>
414
 
      options can be used to create keys of insufficient security.  If
415
 
      in doubt, leave them to the default values.
 
484
      options can be used to create keys of low security.  If in
 
485
      doubt, leave them to the default values.
416
486
    </para>
417
487
    <para>
418
 
      The key expire time is not guaranteed to be honored by
419
 
      <citerefentry><refentrytitle>mandos</refentrytitle>
 
488
      The key expire time is <emphasis>not</emphasis> guaranteed to be
 
489
      honored by <citerefentry><refentrytitle>mandos</refentrytitle>
420
490
      <manvolnum>8</manvolnum></citerefentry>.
421
491
    </para>
422
492
  </refsect1>
423
 
 
 
493
  
424
494
  <refsect1 id="see_also">
425
495
    <title>SEE ALSO</title>
426
496
    <para>
427
 
      <citerefentry><refentrytitle>password-request</refentrytitle>
 
497
      <citerefentry><refentrytitle>intro</refentrytitle>
428
498
      <manvolnum>8mandos</manvolnum></citerefentry>,
 
499
      <citerefentry><refentrytitle>gpg</refentrytitle>
 
500
      <manvolnum>1</manvolnum></citerefentry>,
 
501
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
 
502
      <manvolnum>5</manvolnum></citerefentry>,
429
503
      <citerefentry><refentrytitle>mandos</refentrytitle>
430
504
      <manvolnum>8</manvolnum></citerefentry>,
431
 
      <citerefentry><refentrytitle>gpg</refentrytitle>
432
 
      <manvolnum>1</manvolnum></citerefentry>
 
505
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
 
506
      <manvolnum>8mandos</manvolnum></citerefentry>
433
507
    </para>
434
508
  </refsect1>
435
509
  
436
510
</refentry>
 
511
<!-- Local Variables: -->
 
512
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
 
513
<!-- time-stamp-end: "[\"']>" -->
 
514
<!-- time-stamp-format: "%:y-%02m-%02d" -->
 
515
<!-- End: -->