68
50
<refname><command>&COMMANDNAME;</command></refname>
70
Generate keys for <citerefentry><refentrytitle>password-request
71
</refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
52
Generate key and password for Mandos client and server.
77
58
<command>&COMMANDNAME;</command>
79
<arg choice="plain"><option>--dir</option>
80
<replaceable>directory</replaceable></arg>
83
<arg choice="plain"><option>--type</option>
84
<replaceable>type</replaceable></arg>
87
<arg choice="plain"><option>--length</option>
88
<replaceable>bits</replaceable></arg>
91
<arg choice="plain"><option>--subtype</option>
92
<replaceable>type</replaceable></arg>
95
<arg choice="plain"><option>--sublength</option>
96
<replaceable>bits</replaceable></arg>
99
<arg choice="plain"><option>--name</option>
100
<replaceable>NAME</replaceable></arg>
103
<arg choice="plain"><option>--email</option>
104
<replaceable>EMAIL</replaceable></arg>
107
<arg choice="plain"><option>--comment</option>
108
<replaceable>COMMENT</replaceable></arg>
111
<arg choice="plain"><option>--expire</option>
112
<replaceable>TIME</replaceable></arg>
115
<arg choice="plain"><option>--force</option></arg>
119
<command>&COMMANDNAME;</command>
121
<arg choice="plain"><option>-d</option>
122
<replaceable>directory</replaceable></arg>
125
<arg choice="plain"><option>-t</option>
126
<replaceable>type</replaceable></arg>
129
<arg choice="plain"><option>-l</option>
130
<replaceable>bits</replaceable></arg>
133
<arg choice="plain"><option>-s</option>
134
<replaceable>type</replaceable></arg>
137
<arg choice="plain"><option>-L</option>
138
<replaceable>bits</replaceable></arg>
141
<arg choice="plain"><option>-n</option>
142
<replaceable>NAME</replaceable></arg>
145
<arg choice="plain"><option>-e</option>
146
<replaceable>EMAIL</replaceable></arg>
149
<arg choice="plain"><option>-c</option>
150
<replaceable>COMMENT</replaceable></arg>
153
<arg choice="plain"><option>-x</option>
154
<replaceable>TIME</replaceable></arg>
157
<arg choice="plain"><option>-f</option></arg>
60
<arg choice="plain"><option>--dir
61
<replaceable>DIRECTORY</replaceable></option></arg>
62
<arg choice="plain"><option>-d
63
<replaceable>DIRECTORY</replaceable></option></arg>
67
<arg choice="plain"><option>--type
68
<replaceable>KEYTYPE</replaceable></option></arg>
69
<arg choice="plain"><option>-t
70
<replaceable>KEYTYPE</replaceable></option></arg>
74
<arg choice="plain"><option>--length
75
<replaceable>BITS</replaceable></option></arg>
76
<arg choice="plain"><option>-l
77
<replaceable>BITS</replaceable></option></arg>
81
<arg choice="plain"><option>--subtype
82
<replaceable>KEYTYPE</replaceable></option></arg>
83
<arg choice="plain"><option>-s
84
<replaceable>KEYTYPE</replaceable></option></arg>
88
<arg choice="plain"><option>--sublength
89
<replaceable>BITS</replaceable></option></arg>
90
<arg choice="plain"><option>-L
91
<replaceable>BITS</replaceable></option></arg>
95
<arg choice="plain"><option>--name
96
<replaceable>NAME</replaceable></option></arg>
97
<arg choice="plain"><option>-n
98
<replaceable>NAME</replaceable></option></arg>
102
<arg choice="plain"><option>--email
103
<replaceable>ADDRESS</replaceable></option></arg>
104
<arg choice="plain"><option>-e
105
<replaceable>ADDRESS</replaceable></option></arg>
109
<arg choice="plain"><option>--comment
110
<replaceable>TEXT</replaceable></option></arg>
111
<arg choice="plain"><option>-c
112
<replaceable>TEXT</replaceable></option></arg>
116
<arg choice="plain"><option>--expire
117
<replaceable>TIME</replaceable></option></arg>
118
<arg choice="plain"><option>-x
119
<replaceable>TIME</replaceable></option></arg>
122
<arg><option>--force</option></arg>
161
125
<command>&COMMANDNAME;</command>
162
126
<group choice="req">
127
<arg choice="plain"><option>--password</option></arg>
163
128
<arg choice="plain"><option>-p</option></arg>
164
<arg choice="plain"><option>--password</option></arg>
167
<arg choice="plain"><option>--dir</option>
168
<replaceable>directory</replaceable></arg>
171
<arg choice="plain"><option>--name</option>
172
<replaceable>NAME</replaceable></arg>
129
<arg choice="plain"><option>--passfile
130
<replaceable>FILE</replaceable></option></arg>
131
<arg choice="plain"><option>-F</option>
132
<replaceable>FILE</replaceable></arg>
136
<arg choice="plain"><option>--dir
137
<replaceable>DIRECTORY</replaceable></option></arg>
138
<arg choice="plain"><option>-d
139
<replaceable>DIRECTORY</replaceable></option></arg>
143
<arg choice="plain"><option>--name
144
<replaceable>NAME</replaceable></option></arg>
145
<arg choice="plain"><option>-n
146
<replaceable>NAME</replaceable></option></arg>
176
150
<command>&COMMANDNAME;</command>
177
151
<group choice="req">
152
<arg choice="plain"><option>--help</option></arg>
178
153
<arg choice="plain"><option>-h</option></arg>
179
<arg choice="plain"><option>--help</option></arg>
183
157
<command>&COMMANDNAME;</command>
184
158
<group choice="req">
159
<arg choice="plain"><option>--version</option></arg>
185
160
<arg choice="plain"><option>-v</option></arg>
186
<arg choice="plain"><option>--version</option></arg>
189
163
</refsynopsisdiv>
191
165
<refsect1 id="description">
192
166
<title>DESCRIPTION</title>
194
168
<command>&COMMANDNAME;</command> is a program to generate the
196
<citerefentry><refentrytitle>password-request</refentrytitle>
197
<manvolnum>8mandos</manvolnum></citerefentry>. The keys are
170
<citerefentry><refentrytitle>mandos-client</refentrytitle>
171
<manvolnum>8mandos</manvolnum></citerefentry>. The key is
198
172
normally written to /etc/mandos for later installation into the
199
initrd image, but this, like most things, can be changed with
200
command line options.
173
initrd image, but this, and most other things, can be changed
174
with command line options.
203
It can also be used to generate ready-made sections for
177
This program can also be used with the
178
<option>--password</option> or <option>--passfile</option>
179
options to generate a ready-made section for
180
<filename>clients.conf</filename> (see
204
181
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
205
<manvolnum>5</manvolnum></citerefentry> using the
206
<option>--password</option> option.
182
<manvolnum>5</manvolnum></citerefentry>).
210
186
<refsect1 id="purpose">
211
187
<title>PURPOSE</title>
214
189
The purpose of this is to enable <emphasis>remote and unattended
215
190
rebooting</emphasis> of client host computer with an
216
191
<emphasis>encrypted root file system</emphasis>. See <xref
217
192
linkend="overview"/> for details.
222
196
<refsect1 id="options">
223
197
<title>OPTIONS</title>
227
<term><literal>-h</literal>, <literal>--help</literal></term>
201
<term><option>--help</option></term>
202
<term><option>-h</option></term>
230
205
Show a help message and exit
236
<term><literal>-d</literal>, <literal>--dir
237
<replaceable>directory</replaceable></literal></term>
212
<replaceable>DIRECTORY</replaceable></option></term>
214
<replaceable>DIRECTORY</replaceable></option></term>
240
217
Target directory for key files. Default is
241
<filename>/etc/mandos</filename>.
247
<term><literal>-t</literal>, <literal>--type
248
<replaceable>type</replaceable></literal></term>
251
Key type. Default is <quote>DSA</quote>.
257
<term><literal>-l</literal>, <literal>--length
258
<replaceable>bits</replaceable></literal></term>
261
Key length in bits. Default is 2048.
267
<term><literal>-s</literal>, <literal>--subtype
268
<replaceable>type</replaceable></literal></term>
271
Subkey type. Default is <quote>ELG-E</quote> (Elgamal
218
<filename class="directory">/etc/mandos</filename>.
225
<replaceable>TYPE</replaceable></option></term>
227
<replaceable>TYPE</replaceable></option></term>
230
Key type. Default is <quote>RSA</quote>.
236
<term><option>--length
237
<replaceable>BITS</replaceable></option></term>
239
<replaceable>BITS</replaceable></option></term>
242
Key length in bits. Default is 4096.
248
<term><option>--subtype
249
<replaceable>KEYTYPE</replaceable></option></term>
251
<replaceable>KEYTYPE</replaceable></option></term>
254
Subkey type. Default is <quote>RSA</quote> (Elgamal
272
255
encryption-only).
278
<term><literal>-L</literal>, <literal>--sublength
279
<replaceable>bits</replaceable></literal></term>
261
<term><option>--sublength
262
<replaceable>BITS</replaceable></option></term>
264
<replaceable>BITS</replaceable></option></term>
282
Subkey length in bits. Default is 2048.
267
Subkey length in bits. Default is 4096.
288
<term><literal>-e</literal>, <literal>--email</literal>
289
<replaceable>address</replaceable></term>
273
<term><option>--email
274
<replaceable>ADDRESS</replaceable></option></term>
276
<replaceable>ADDRESS</replaceable></option></term>
292
279
Email address of key. Default is empty.
298
<term><literal>-c</literal>, <literal>--comment</literal>
299
<replaceable>comment</replaceable></term>
285
<term><option>--comment
286
<replaceable>TEXT</replaceable></option></term>
288
<replaceable>TEXT</replaceable></option></term>
302
291
Comment field for key. The default value is
448
453
</informalexample>
456
Prompt for a password, encrypt it with the key in <filename
457
class="directory">/etc/mandos</filename> and output a section
458
suitable for <filename>clients.conf</filename>.
461
<userinput>&COMMANDNAME; --password</userinput>
466
Prompt for a password, encrypt it with the key in the
467
<filename>client-key</filename> directory and output a section
468
suitable for <filename>clients.conf</filename>.
472
<!-- do not wrap this line -->
473
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
451
479
<refsect1 id="security">
452
480
<title>SECURITY</title>
454
482
The <option>--type</option>, <option>--length</option>,
455
483
<option>--subtype</option>, and <option>--sublength</option>
456
options can be used to create keys of insufficient security. If
457
in doubt, leave them to the default values.
484
options can be used to create keys of low security. If in
485
doubt, leave them to the default values.
460
The key expire time is not guaranteed to be honored by
461
<citerefentry><refentrytitle>mandos</refentrytitle>
488
The key expire time is <emphasis>not</emphasis> guaranteed to be
489
honored by <citerefentry><refentrytitle>mandos</refentrytitle>
462
490
<manvolnum>8</manvolnum></citerefentry>.
466
494
<refsect1 id="see_also">
467
495
<title>SEE ALSO</title>
469
<citerefentry><refentrytitle>password-request</refentrytitle>
497
<citerefentry><refentrytitle>intro</refentrytitle>
470
498
<manvolnum>8mandos</manvolnum></citerefentry>,
499
<citerefentry><refentrytitle>gpg</refentrytitle>
500
<manvolnum>1</manvolnum></citerefentry>,
501
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
502
<manvolnum>5</manvolnum></citerefentry>,
471
503
<citerefentry><refentrytitle>mandos</refentrytitle>
472
504
<manvolnum>8</manvolnum></citerefentry>,
473
<citerefentry><refentrytitle>gpg</refentrytitle>
474
<manvolnum>1</manvolnum></citerefentry>
505
<citerefentry><refentrytitle>mandos-client</refentrytitle>
506
<manvolnum>8mandos</manvolnum></citerefentry>