/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-keygen.xml

  • Committer: Teddy Hogeborn
  • Date: 2015-07-20 03:03:33 UTC
  • Revision ID: teddy@recompile.se-20150720030333-203m2aeblypcsfte
Bug fix for GnuTLS 3: be compatible with old 2048-bit DSA keys.

The mandos-keygen program in Mandos version 1.6.0 and older generated
2048-bit DSA keys, and when GnuTLS uses these it has trouble
connecting using the Mandos default priority string.  This was
previously fixed in Mandos 1.6.2, but the bug reappeared when using
GnuTLS 3, so the default priority string has to change again; this
time also the Mandos client has to change its default, so now the
server and the client should use the same default priority string:

SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA:+SIGN-DSA-SHA256

* mandos (main/server_defaults): Changed default priority string.
* mandos-options.xml (/section/para[id="priority_compat"]): Removed.
  (/section/para[id="priority"]): Changed default priority string.
* mandos.conf ([DEFAULT]/priority): - '' -
* mandos.conf.xml (OPTIONS/priority): Refer to the id "priority"
                                      instead of "priority_compat".
* mandos.xml (OPTIONS/--priority): - '' -
* plugins.d/mandos-client.c (main): Changed default priority string.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-keygen.xml
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY COMMANDNAME "mandos-keygen">
5
 
<!ENTITY TIMESTAMP "2019-02-10">
 
5
<!ENTITY TIMESTAMP "2014-06-22">
6
6
<!ENTITY % common SYSTEM "common.ent">
7
7
%common;
8
8
]>
33
33
    <copyright>
34
34
      <year>2008</year>
35
35
      <year>2009</year>
36
 
      <year>2010</year>
37
36
      <year>2011</year>
38
37
      <year>2012</year>
39
 
      <year>2013</year>
40
 
      <year>2014</year>
41
 
      <year>2015</year>
42
 
      <year>2016</year>
43
 
      <year>2017</year>
44
 
      <year>2018</year>
45
38
      <holder>Teddy Hogeborn</holder>
46
39
      <holder>Björn Påhlsson</holder>
47
40
    </copyright>
127
120
      </group>
128
121
      <sbr/>
129
122
      <group>
130
 
        <arg choice="plain"><option>--tls-keytype
131
 
        <replaceable>KEYTYPE</replaceable></option></arg>
132
 
        <arg choice="plain"><option>-T
133
 
        <replaceable>KEYTYPE</replaceable></option></arg>
134
 
      </group>
135
 
      <sbr/>
136
 
      <group>
137
123
        <arg choice="plain"><option>--force</option></arg>
138
124
        <arg choice="plain"><option>-f</option></arg>
139
125
      </group>
187
173
    <title>DESCRIPTION</title>
188
174
    <para>
189
175
      <command>&COMMANDNAME;</command> is a program to generate the
190
 
      TLS and OpenPGP keys used by
 
176
      OpenPGP key used by
191
177
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
192
 
      <manvolnum>8mandos</manvolnum></citerefentry>.  The keys are
 
178
      <manvolnum>8mandos</manvolnum></citerefentry>.  The key is
193
179
      normally written to /etc/mandos for later installation into the
194
180
      initrd image, but this, and most other things, can be changed
195
181
      with command line options.
248
234
        <replaceable>TYPE</replaceable></option></term>
249
235
        <listitem>
250
236
          <para>
251
 
            OpenPGP key type.  Default is <quote>RSA</quote>.
 
237
            Key type.  Default is <quote>RSA</quote>.
252
238
          </para>
253
239
        </listitem>
254
240
      </varlistentry>
260
246
        <replaceable>BITS</replaceable></option></term>
261
247
        <listitem>
262
248
          <para>
263
 
            OpenPGP key length in bits.  Default is 4096.
 
249
            Key length in bits.  Default is 4096.
264
250
          </para>
265
251
        </listitem>
266
252
      </varlistentry>
272
258
        <replaceable>KEYTYPE</replaceable></option></term>
273
259
        <listitem>
274
260
          <para>
275
 
            OpenPGP subkey type.  Default is <quote>RSA</quote>
 
261
            Subkey type.  Default is <quote>RSA</quote> (Elgamal
 
262
            encryption-only).
276
263
          </para>
277
264
        </listitem>
278
265
      </varlistentry>
284
271
        <replaceable>BITS</replaceable></option></term>
285
272
        <listitem>
286
273
          <para>
287
 
            OpenPGP subkey length in bits.  Default is 4096.
 
274
            Subkey length in bits.  Default is 4096.
288
275
          </para>
289
276
        </listitem>
290
277
      </varlistentry>
328
315
      </varlistentry>
329
316
      
330
317
      <varlistentry>
331
 
        <term><option>--tls-keytype
332
 
        <replaceable>KEYTYPE</replaceable></option></term>
333
 
        <term><option>-T
334
 
        <replaceable>KEYTYPE</replaceable></option></term>
335
 
        <listitem>
336
 
          <para>
337
 
            TLS key type.  Default is <quote>ed25519</quote>
338
 
          </para>
339
 
        </listitem>
340
 
      </varlistentry>
341
 
      
342
 
      <varlistentry>
343
318
        <term><option>--force</option></term>
344
319
        <term><option>-f</option></term>
345
320
        <listitem>
401
376
    <title>OVERVIEW</title>
402
377
    <xi:include href="overview.xml"/>
403
378
    <para>
404
 
      This program is a small utility to generate new TLS and OpenPGP
405
 
      keys for new Mandos clients, and to generate sections for
406
 
      inclusion in <filename>clients.conf</filename> on the server.
 
379
      This program is a small utility to generate new OpenPGP keys for
 
380
      new Mandos clients, and to generate sections for inclusion in
 
381
      <filename>clients.conf</filename> on the server.
407
382
    </para>
408
383
  </refsect1>
409
384
  
459
434
        </listitem>
460
435
      </varlistentry>
461
436
      <varlistentry>
462
 
        <term><filename>/etc/keys/mandos/tls-privkey.pem</filename></term>
463
 
        <listitem>
464
 
          <para>
465
 
            Private key file which will be created or overwritten.
466
 
          </para>
467
 
        </listitem>
468
 
      </varlistentry>
469
 
      <varlistentry>
470
 
        <term><filename>/etc/keys/mandos/tls-pubkey.pem</filename></term>
471
 
        <listitem>
472
 
          <para>
473
 
            Public key file which will be created or overwritten.
474
 
          </para>
475
 
        </listitem>
476
 
      </varlistentry>
477
 
      <varlistentry>
478
437
        <term><filename class="directory">/tmp</filename></term>
479
438
        <listitem>
480
439
          <para>
486
445
    </variablelist>
487
446
  </refsect1>
488
447
  
489
 
  <refsect1 id="bugs">
490
 
    <title>BUGS</title>
491
 
    <xi:include href="bugs.xml"/>
492
 
  </refsect1>
 
448
<!--   <refsect1 id="bugs"> -->
 
449
<!--     <title>BUGS</title> -->
 
450
<!--     <para> -->
 
451
<!--     </para> -->
 
452
<!--   </refsect1> -->
493
453
  
494
454
  <refsect1 id="example">
495
455
    <title>EXAMPLE</title>