1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
<!ENTITY VERSION "1.0">
5
4
<!ENTITY COMMANDNAME "mandos-keygen">
5
<!ENTITY TIMESTAMP "2013-10-22">
6
<!ENTITY % common SYSTEM "common.ent">
8
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
10
<title>&COMMANDNAME;</title>
12
<title>Mandos Manual</title>
11
13
<!-- NWalsh’s docbook scripts use this to generate the footer: -->
12
<productname>&COMMANDNAME;</productname>
13
<productnumber>&VERSION;</productnumber>
14
<productname>Mandos</productname>
15
<productnumber>&version;</productnumber>
16
<date>&TIMESTAMP;</date>
16
19
<firstname>Björn</firstname>
17
20
<surname>Påhlsson</surname>
19
<email>belorn@fukt.bsnet.se</email>
22
<email>belorn@recompile.se</email>
23
26
<firstname>Teddy</firstname>
24
27
<surname>Hogeborn</surname>
26
<email>teddy@fukt.bsnet.se</email>
29
<email>teddy@recompile.se</email>
32
38
<holder>Teddy Hogeborn</holder>
33
39
<holder>Björn Påhlsson</holder>
37
This manual page is free software: you can redistribute it
38
and/or modify it under the terms of the GNU General Public
39
License as published by the Free Software Foundation,
40
either version 3 of the License, or (at your option) any
45
This manual page is distributed in the hope that it will
46
be useful, but WITHOUT ANY WARRANTY; without even the
47
implied warranty of MERCHANTABILITY or FITNESS FOR A
48
PARTICULAR PURPOSE. See the GNU General Public License
53
You should have received a copy of the GNU General Public
54
License along with this program; If not, see
55
<ulink url="http://www.gnu.org/licenses/"/>.
41
<xi:include href="legalnotice.xml"/>
61
45
<refentrytitle>&COMMANDNAME;</refentrytitle>
62
46
<manvolnum>8</manvolnum>
66
50
<refname><command>&COMMANDNAME;</command></refname>
68
Generate keys for <citerefentry><refentrytitle>password-request
69
</refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
52
Generate key and password for Mandos client and server.
75
58
<command>&COMMANDNAME;</command>
77
<arg choice="plain"><option>--dir</option>
78
<replaceable>directory</replaceable></arg>
81
<arg choice="plain"><option>--type</option>
82
<replaceable>type</replaceable></arg>
85
<arg choice="plain"><option>--length</option>
86
<replaceable>bits</replaceable></arg>
89
<arg choice="plain"><option>--subtype</option>
90
<replaceable>type</replaceable></arg>
93
<arg choice="plain"><option>--sublength</option>
94
<replaceable>bits</replaceable></arg>
97
<arg choice="plain"><option>--name</option>
98
<replaceable>NAME</replaceable></arg>
101
<arg choice="plain"><option>--email</option>
102
<replaceable>EMAIL</replaceable></arg>
105
<arg choice="plain"><option>--comment</option>
106
<replaceable>COMMENT</replaceable></arg>
109
<arg choice="plain"><option>--expire</option>
110
<replaceable>TIME</replaceable></arg>
113
<arg choice="plain"><option>--force</option></arg>
117
<command>&COMMANDNAME;</command>
119
<arg choice="plain"><option>-d</option>
120
<replaceable>directory</replaceable></arg>
123
<arg choice="plain"><option>-t</option>
124
<replaceable>type</replaceable></arg>
127
<arg choice="plain"><option>-l</option>
128
<replaceable>bits</replaceable></arg>
131
<arg choice="plain"><option>-s</option>
132
<replaceable>type</replaceable></arg>
135
<arg choice="plain"><option>-L</option>
136
<replaceable>bits</replaceable></arg>
139
<arg choice="plain"><option>-n</option>
140
<replaceable>NAME</replaceable></arg>
143
<arg choice="plain"><option>-e</option>
144
<replaceable>EMAIL</replaceable></arg>
147
<arg choice="plain"><option>-c</option>
148
<replaceable>COMMENT</replaceable></arg>
151
<arg choice="plain"><option>-x</option>
152
<replaceable>TIME</replaceable></arg>
155
<arg choice="plain"><option>-f</option></arg>
60
<arg choice="plain"><option>--dir
61
<replaceable>DIRECTORY</replaceable></option></arg>
62
<arg choice="plain"><option>-d
63
<replaceable>DIRECTORY</replaceable></option></arg>
67
<arg choice="plain"><option>--type
68
<replaceable>KEYTYPE</replaceable></option></arg>
69
<arg choice="plain"><option>-t
70
<replaceable>KEYTYPE</replaceable></option></arg>
74
<arg choice="plain"><option>--length
75
<replaceable>BITS</replaceable></option></arg>
76
<arg choice="plain"><option>-l
77
<replaceable>BITS</replaceable></option></arg>
81
<arg choice="plain"><option>--subtype
82
<replaceable>KEYTYPE</replaceable></option></arg>
83
<arg choice="plain"><option>-s
84
<replaceable>KEYTYPE</replaceable></option></arg>
88
<arg choice="plain"><option>--sublength
89
<replaceable>BITS</replaceable></option></arg>
90
<arg choice="plain"><option>-L
91
<replaceable>BITS</replaceable></option></arg>
95
<arg choice="plain"><option>--name
96
<replaceable>NAME</replaceable></option></arg>
97
<arg choice="plain"><option>-n
98
<replaceable>NAME</replaceable></option></arg>
102
<arg choice="plain"><option>--email
103
<replaceable>ADDRESS</replaceable></option></arg>
104
<arg choice="plain"><option>-e
105
<replaceable>ADDRESS</replaceable></option></arg>
109
<arg choice="plain"><option>--comment
110
<replaceable>TEXT</replaceable></option></arg>
111
<arg choice="plain"><option>-c
112
<replaceable>TEXT</replaceable></option></arg>
116
<arg choice="plain"><option>--expire
117
<replaceable>TIME</replaceable></option></arg>
118
<arg choice="plain"><option>-x
119
<replaceable>TIME</replaceable></option></arg>
122
<arg><option>--force</option></arg>
159
125
<command>&COMMANDNAME;</command>
160
126
<group choice="req">
127
<arg choice="plain"><option>--password</option></arg>
161
128
<arg choice="plain"><option>-p</option></arg>
162
<arg choice="plain"><option>--password</option></arg>
165
<arg choice="plain"><option>--dir</option>
166
<replaceable>directory</replaceable></arg>
169
<arg choice="plain"><option>--name</option>
170
<replaceable>NAME</replaceable></arg>
129
<arg choice="plain"><option>--passfile
130
<replaceable>FILE</replaceable></option></arg>
131
<arg choice="plain"><option>-F</option>
132
<replaceable>FILE</replaceable></arg>
136
<arg choice="plain"><option>--dir
137
<replaceable>DIRECTORY</replaceable></option></arg>
138
<arg choice="plain"><option>-d
139
<replaceable>DIRECTORY</replaceable></option></arg>
143
<arg choice="plain"><option>--name
144
<replaceable>NAME</replaceable></option></arg>
145
<arg choice="plain"><option>-n
146
<replaceable>NAME</replaceable></option></arg>
174
150
<command>&COMMANDNAME;</command>
175
151
<group choice="req">
152
<arg choice="plain"><option>--help</option></arg>
176
153
<arg choice="plain"><option>-h</option></arg>
177
<arg choice="plain"><option>--help</option></arg>
181
157
<command>&COMMANDNAME;</command>
182
158
<group choice="req">
159
<arg choice="plain"><option>--version</option></arg>
183
160
<arg choice="plain"><option>-v</option></arg>
184
<arg choice="plain"><option>--version</option></arg>
187
163
</refsynopsisdiv>
189
165
<refsect1 id="description">
190
166
<title>DESCRIPTION</title>
192
168
<command>&COMMANDNAME;</command> is a program to generate the
194
<citerefentry><refentrytitle>password-request</refentrytitle>
195
<manvolnum>8mandos</manvolnum></citerefentry>. The keys are
170
<citerefentry><refentrytitle>mandos-client</refentrytitle>
171
<manvolnum>8mandos</manvolnum></citerefentry>. The key is
196
172
normally written to /etc/mandos for later installation into the
197
initrd image, but this, like most things, can be changed with
198
command line options.
173
initrd image, but this, and most other things, can be changed
174
with command line options.
201
It can also be used to generate ready-made sections for
177
This program can also be used with the
178
<option>--password</option> or <option>--passfile</option>
179
options to generate a ready-made section for
180
<filename>clients.conf</filename> (see
202
181
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
203
<manvolnum>5</manvolnum></citerefentry> using the
204
<option>--password</option> option.
182
<manvolnum>5</manvolnum></citerefentry>).
208
186
<refsect1 id="purpose">
209
187
<title>PURPOSE</title>
212
189
The purpose of this is to enable <emphasis>remote and unattended
213
190
rebooting</emphasis> of client host computer with an
214
191
<emphasis>encrypted root file system</emphasis>. See <xref
215
192
linkend="overview"/> for details.
220
196
<refsect1 id="options">
221
197
<title>OPTIONS</title>
225
<term><literal>-h</literal>, <literal>--help</literal></term>
201
<term><option>--help</option></term>
202
<term><option>-h</option></term>
228
205
Show a help message and exit
234
<term><literal>-d</literal>, <literal>--dir
235
<replaceable>directory</replaceable></literal></term>
212
<replaceable>DIRECTORY</replaceable></option></term>
214
<replaceable>DIRECTORY</replaceable></option></term>
238
217
Target directory for key files. Default is
239
<filename>/etc/mandos</filename>.
245
<term><literal>-t</literal>, <literal>--type
246
<replaceable>type</replaceable></literal></term>
249
Key type. Default is <quote>DSA</quote>.
255
<term><literal>-l</literal>, <literal>--length
256
<replaceable>bits</replaceable></literal></term>
259
Key length in bits. Default is 1024.
265
<term><literal>-s</literal>, <literal>--subtype
266
<replaceable>type</replaceable></literal></term>
269
Subkey type. Default is <quote>ELG-E</quote> (Elgamal
218
<filename class="directory">/etc/mandos</filename>.
225
<replaceable>TYPE</replaceable></option></term>
227
<replaceable>TYPE</replaceable></option></term>
230
Key type. Default is <quote>RSA</quote>.
236
<term><option>--length
237
<replaceable>BITS</replaceable></option></term>
239
<replaceable>BITS</replaceable></option></term>
242
Key length in bits. Default is 4096.
248
<term><option>--subtype
249
<replaceable>KEYTYPE</replaceable></option></term>
251
<replaceable>KEYTYPE</replaceable></option></term>
254
Subkey type. Default is <quote>RSA</quote> (Elgamal
270
255
encryption-only).
276
<term><literal>-L</literal>, <literal>--sublength
277
<replaceable>bits</replaceable></literal></term>
261
<term><option>--sublength
262
<replaceable>BITS</replaceable></option></term>
264
<replaceable>BITS</replaceable></option></term>
280
Subkey length in bits. Default is 2048.
267
Subkey length in bits. Default is 4096.
286
<term><literal>-e</literal>, <literal>--email</literal>
287
<replaceable>address</replaceable></term>
273
<term><option>--email
274
<replaceable>ADDRESS</replaceable></option></term>
276
<replaceable>ADDRESS</replaceable></option></term>
290
279
Email address of key. Default is empty.
296
<term><literal>-c</literal>, <literal>--comment</literal>
297
<replaceable>comment</replaceable></term>
285
<term><option>--comment
286
<replaceable>TEXT</replaceable></option></term>
288
<replaceable>TEXT</replaceable></option></term>
300
Comment field for key. The default value is
301
<quote><literal>Mandos client key</literal></quote>.
291
Comment field for key. Default is empty.
307
<term><literal>-x</literal>, <literal>--expire</literal>
308
<replaceable>time</replaceable></term>
297
<term><option>--expire
298
<replaceable>TIME</replaceable></option></term>
300
<replaceable>TIME</replaceable></option></term>
311
303
Key expire time. Default is no expiration. See
429
435
Normal invocation needs no options:
432
<userinput>mandos-keygen</userinput>
438
<userinput>&COMMANDNAME;</userinput>
434
440
</informalexample>
435
441
<informalexample>
437
Create keys in another directory and of another type. Force
443
Create key in another directory and of another type. Force
438
444
overwriting old key files:
442
448
<!-- do not wrap this line -->
443
<userinput>mandos-keygen --dir ~/keydir --type RSA --force</userinput>
449
<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>
455
Prompt for a password, encrypt it with the key in <filename
456
class="directory">/etc/mandos</filename> and output a section
457
suitable for <filename>clients.conf</filename>.
460
<userinput>&COMMANDNAME; --password</userinput>
465
Prompt for a password, encrypt it with the key in the
466
<filename>client-key</filename> directory and output a section
467
suitable for <filename>clients.conf</filename>.
471
<!-- do not wrap this line -->
472
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
446
475
</informalexample>
449
478
<refsect1 id="security">
450
479
<title>SECURITY</title>
452
481
The <option>--type</option>, <option>--length</option>,
453
482
<option>--subtype</option>, and <option>--sublength</option>
454
options can be used to create keys of insufficient security. If
455
in doubt, leave them to the default values.
483
options can be used to create keys of low security. If in
484
doubt, leave them to the default values.
458
The key expire time is not guaranteed to be honored by
459
<citerefentry><refentrytitle>mandos</refentrytitle>
487
The key expire time is <emphasis>not</emphasis> guaranteed to be
488
honored by <citerefentry><refentrytitle>mandos</refentrytitle>
460
489
<manvolnum>8</manvolnum></citerefentry>.
464
493
<refsect1 id="see_also">
465
494
<title>SEE ALSO</title>
467
<citerefentry><refentrytitle>password-request</refentrytitle>
496
<citerefentry><refentrytitle>intro</refentrytitle>
468
497
<manvolnum>8mandos</manvolnum></citerefentry>,
498
<citerefentry><refentrytitle>gpg</refentrytitle>
499
<manvolnum>1</manvolnum></citerefentry>,
500
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
501
<manvolnum>5</manvolnum></citerefentry>,
469
502
<citerefentry><refentrytitle>mandos</refentrytitle>
470
503
<manvolnum>8</manvolnum></citerefentry>,
471
<citerefentry><refentrytitle>gpg</refentrytitle>
472
<manvolnum>1</manvolnum></citerefentry>
504
<citerefentry><refentrytitle>mandos-client</refentrytitle>
505
<manvolnum>8mandos</manvolnum></citerefentry>
510
<!-- Local Variables: -->
511
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
512
<!-- time-stamp-end: "[\"']>" -->
513
<!-- time-stamp-format: "%:y-%02m-%02d" -->