/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-keygen.xml

  • Committer: Teddy Hogeborn
  • Date: 2015-07-20 03:03:33 UTC
  • Revision ID: teddy@recompile.se-20150720030333-203m2aeblypcsfte
Bug fix for GnuTLS 3: be compatible with old 2048-bit DSA keys.

The mandos-keygen program in Mandos version 1.6.0 and older generated
2048-bit DSA keys, and when GnuTLS uses these it has trouble
connecting using the Mandos default priority string.  This was
previously fixed in Mandos 1.6.2, but the bug reappeared when using
GnuTLS 3, so the default priority string has to change again; this
time also the Mandos client has to change its default, so now the
server and the client should use the same default priority string:

SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA:+SIGN-DSA-SHA256

* mandos (main/server_defaults): Changed default priority string.
* mandos-options.xml (/section/para[id="priority_compat"]): Removed.
  (/section/para[id="priority"]): Changed default priority string.
* mandos.conf ([DEFAULT]/priority): - '' -
* mandos.conf.xml (OPTIONS/priority): Refer to the id "priority"
                                      instead of "priority_compat".
* mandos.xml (OPTIONS/--priority): - '' -
* plugins.d/mandos-client.c (main): Changed default priority string.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-keygen.xml
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY COMMANDNAME "mandos-keygen">
5
 
<!ENTITY TIMESTAMP "2012-01-01">
 
5
<!ENTITY TIMESTAMP "2014-06-22">
6
6
<!ENTITY % common SYSTEM "common.ent">
7
7
%common;
8
8
]>
119
119
        <replaceable>TIME</replaceable></option></arg>
120
120
      </group>
121
121
      <sbr/>
122
 
      <arg><option>--force</option></arg>
 
122
      <group>
 
123
        <arg choice="plain"><option>--force</option></arg>
 
124
        <arg choice="plain"><option>-f</option></arg>
 
125
      </group>
123
126
    </cmdsynopsis>
124
127
    <cmdsynopsis>
125
128
      <command>&COMMANDNAME;</command>
145
148
        <arg choice="plain"><option>-n
146
149
        <replaceable>NAME</replaceable></option></arg>
147
150
      </group>
 
151
      <group>
 
152
        <arg choice="plain"><option>--no-ssh</option></arg>
 
153
        <arg choice="plain"><option>-S</option></arg>
 
154
      </group>
148
155
    </cmdsynopsis>
149
156
    <cmdsynopsis>
150
157
      <command>&COMMANDNAME;</command>
227
234
        <replaceable>TYPE</replaceable></option></term>
228
235
        <listitem>
229
236
          <para>
230
 
            Key type.  Default is <quote>DSA</quote>.
 
237
            Key type.  Default is <quote>RSA</quote>.
231
238
          </para>
232
239
        </listitem>
233
240
      </varlistentry>
239
246
        <replaceable>BITS</replaceable></option></term>
240
247
        <listitem>
241
248
          <para>
242
 
            Key length in bits.  Default is 2048.
 
249
            Key length in bits.  Default is 4096.
243
250
          </para>
244
251
        </listitem>
245
252
      </varlistentry>
251
258
        <replaceable>KEYTYPE</replaceable></option></term>
252
259
        <listitem>
253
260
          <para>
254
 
            Subkey type.  Default is <quote>ELG-E</quote> (Elgamal
 
261
            Subkey type.  Default is <quote>RSA</quote> (Elgamal
255
262
            encryption-only).
256
263
          </para>
257
264
        </listitem>
264
271
        <replaceable>BITS</replaceable></option></term>
265
272
        <listitem>
266
273
          <para>
267
 
            Subkey length in bits.  Default is 2048.
 
274
            Subkey length in bits.  Default is 4096.
268
275
          </para>
269
276
        </listitem>
270
277
      </varlistentry>
288
295
        <replaceable>TEXT</replaceable></option></term>
289
296
        <listitem>
290
297
          <para>
291
 
            Comment field for key.  The default value is
292
 
            <quote><literal>Mandos client key</literal></quote>.
 
298
            Comment field for key.  Default is empty.
293
299
          </para>
294
300
        </listitem>
295
301
      </varlistentry>
347
353
          </para>
348
354
        </listitem>
349
355
      </varlistentry>
 
356
      <varlistentry>
 
357
        <term><option>--no-ssh</option></term>
 
358
        <term><option>-S</option></term>
 
359
        <listitem>
 
360
          <para>
 
361
            When <option>--password</option> or
 
362
            <option>--passfile</option> is given, this option will
 
363
            prevent <command>&COMMANDNAME;</command> from calling
 
364
            <command>ssh-keyscan</command> to get an SSH fingerprint
 
365
            for this host and, if successful, output suitable config
 
366
            options to use this fingerprint as a
 
367
            <option>checker</option> option in the output.  This is
 
368
            otherwise the default behavior.
 
369
          </para>
 
370
        </listitem>
 
371
      </varlistentry>
350
372
    </variablelist>
351
373
  </refsect1>
352
374
  
503
525
      <citerefentry><refentrytitle>mandos</refentrytitle>
504
526
      <manvolnum>8</manvolnum></citerefentry>,
505
527
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
506
 
      <manvolnum>8mandos</manvolnum></citerefentry>
 
528
      <manvolnum>8mandos</manvolnum></citerefentry>,
 
529
      <citerefentry><refentrytitle>ssh-keyscan</refentrytitle>
 
530
      <manvolnum>1</manvolnum></citerefentry>
507
531
    </para>
508
532
  </refsect1>
509
533