1
<?xml version="1.0" encoding="UTF-8"?>
1
<?xml version='1.0' encoding='UTF-8'?>
2
<?xml-stylesheet type="text/xsl"
3
href="http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl"?>
2
4
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
5
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
6
<!ENTITY VERSION "1.0">
4
7
<!ENTITY COMMANDNAME "mandos-keygen">
5
<!ENTITY TIMESTAMP "2018-02-08">
6
<!ENTITY % common SYSTEM "common.ent">
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
12
<title>Mandos Manual</title>
13
<!-- NWalsh’s docbook scripts use this to generate the footer: -->
14
<productname>Mandos</productname>
15
<productnumber>&version;</productnumber>
16
<date>&TIMESTAMP;</date>
12
<title>&COMMANDNAME;</title>
13
<!-- NWalsh's docbook scripts use this to generate the footer: -->
14
<productname>&COMMANDNAME;</productname>
15
<productnumber>&VERSION;</productnumber>
19
18
<firstname>Björn</firstname>
20
19
<surname>Påhlsson</surname>
22
<email>belorn@recompile.se</email>
21
<email>belorn@fukt.bsnet.se</email>
26
25
<firstname>Teddy</firstname>
27
26
<surname>Hogeborn</surname>
29
<email>teddy@recompile.se</email>
28
<email>teddy@fukt.bsnet.se</email>
45
<holder>Teddy Hogeborn</holder>
46
<holder>Björn Påhlsson</holder>
34
<holder>Teddy Hogeborn & Björn Påhlsson</holder>
48
<xi:include href="legalnotice.xml"/>
38
This manual page is free software: you can redistribute it
39
and/or modify it under the terms of the GNU General Public
40
License as published by the Free Software Foundation,
41
either version 3 of the License, or (at your option) any
46
This manual page is distributed in the hope that it will
47
be useful, but WITHOUT ANY WARRANTY; without even the
48
implied warranty of MERCHANTABILITY or FITNESS FOR A
49
PARTICULAR PURPOSE. See the GNU General Public License
54
You should have received a copy of the GNU General Public
55
License along with this program; If not, see
56
<ulink url="http://www.gnu.org/licenses/"/>.
52
62
<refentrytitle>&COMMANDNAME;</refentrytitle>
53
63
<manvolnum>8</manvolnum>
57
67
<refname><command>&COMMANDNAME;</command></refname>
59
Generate key and password for Mandos client and server.
69
Generate keys for <citerefentry><refentrytitle>password-request
70
</refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
65
76
<command>&COMMANDNAME;</command>
67
<arg choice="plain"><option>--dir
68
<replaceable>DIRECTORY</replaceable></option></arg>
69
<arg choice="plain"><option>-d
70
<replaceable>DIRECTORY</replaceable></option></arg>
74
<arg choice="plain"><option>--type
75
<replaceable>KEYTYPE</replaceable></option></arg>
76
<arg choice="plain"><option>-t
77
<replaceable>KEYTYPE</replaceable></option></arg>
81
<arg choice="plain"><option>--length
82
<replaceable>BITS</replaceable></option></arg>
83
<arg choice="plain"><option>-l
84
<replaceable>BITS</replaceable></option></arg>
88
<arg choice="plain"><option>--subtype
89
<replaceable>KEYTYPE</replaceable></option></arg>
90
<arg choice="plain"><option>-s
91
<replaceable>KEYTYPE</replaceable></option></arg>
95
<arg choice="plain"><option>--sublength
96
<replaceable>BITS</replaceable></option></arg>
97
<arg choice="plain"><option>-L
98
<replaceable>BITS</replaceable></option></arg>
102
<arg choice="plain"><option>--name
103
<replaceable>NAME</replaceable></option></arg>
104
<arg choice="plain"><option>-n
105
<replaceable>NAME</replaceable></option></arg>
109
<arg choice="plain"><option>--email
110
<replaceable>ADDRESS</replaceable></option></arg>
111
<arg choice="plain"><option>-e
112
<replaceable>ADDRESS</replaceable></option></arg>
116
<arg choice="plain"><option>--comment
117
<replaceable>TEXT</replaceable></option></arg>
118
<arg choice="plain"><option>-c
119
<replaceable>TEXT</replaceable></option></arg>
123
<arg choice="plain"><option>--expire
124
<replaceable>TIME</replaceable></option></arg>
125
<arg choice="plain"><option>-x
126
<replaceable>TIME</replaceable></option></arg>
78
<arg choice="plain"><option>--dir</option>
79
<replaceable>directory</replaceable></arg>
82
<arg choice="plain"><option>--type</option>
83
<replaceable>type</replaceable></arg>
86
<arg choice="plain"><option>--length</option>
87
<replaceable>bits</replaceable></arg>
90
<arg choice="plain"><option>--name</option>
91
<replaceable>NAME</replaceable></arg>
94
<arg choice="plain"><option>--email</option>
95
<replaceable>EMAIL</replaceable></arg>
98
<arg choice="plain"><option>--comment</option>
99
<replaceable>COMMENT</replaceable></arg>
102
<arg choice="plain"><option>--expire</option>
103
<replaceable>TIME</replaceable></arg>
130
106
<arg choice="plain"><option>--force</option></arg>
110
<command>&COMMANDNAME;</command>
112
<arg choice="plain"><option>-d</option>
113
<replaceable>directory</replaceable></arg>
116
<arg choice="plain"><option>-t</option>
117
<replaceable>type</replaceable></arg>
120
<arg choice="plain"><option>-l</option>
121
<replaceable>bits</replaceable></arg>
124
<arg choice="plain"><option>-n</option>
125
<replaceable>NAME</replaceable></arg>
128
<arg choice="plain"><option>-e</option>
129
<replaceable>EMAIL</replaceable></arg>
132
<arg choice="plain"><option>-c</option>
133
<replaceable>COMMENT</replaceable></arg>
136
<arg choice="plain"><option>-x</option>
137
<replaceable>TIME</replaceable></arg>
131
140
<arg choice="plain"><option>-f</option></arg>
135
144
<command>&COMMANDNAME;</command>
136
145
<group choice="req">
137
<arg choice="plain"><option>--password</option></arg>
138
<arg choice="plain"><option>-p</option></arg>
139
<arg choice="plain"><option>--passfile
140
<replaceable>FILE</replaceable></option></arg>
141
<arg choice="plain"><option>-F</option>
142
<replaceable>FILE</replaceable></arg>
146
<arg choice="plain"><option>--dir
147
<replaceable>DIRECTORY</replaceable></option></arg>
148
<arg choice="plain"><option>-d
149
<replaceable>DIRECTORY</replaceable></option></arg>
153
<arg choice="plain"><option>--name
154
<replaceable>NAME</replaceable></option></arg>
155
<arg choice="plain"><option>-n
156
<replaceable>NAME</replaceable></option></arg>
159
<arg choice="plain"><option>--no-ssh</option></arg>
160
<arg choice="plain"><option>-S</option></arg>
164
<command>&COMMANDNAME;</command>
166
<arg choice="plain"><option>--help</option></arg>
167
<arg choice="plain"><option>-h</option></arg>
171
<command>&COMMANDNAME;</command>
173
<arg choice="plain"><option>--version</option></arg>
174
<arg choice="plain"><option>-v</option></arg>
146
<arg choice='plain'><option>-h</option></arg>
147
<arg choice='plain'><option>--help</option></arg>
151
<command>&COMMANDNAME;</command>
153
<arg choice='plain'><option>-v</option></arg>
154
<arg choice='plain'><option>--version</option></arg>
177
157
</refsynopsisdiv>
179
159
<refsect1 id="description">
180
160
<title>DESCRIPTION</title>
182
162
<command>&COMMANDNAME;</command> is a program to generate the
184
<citerefentry><refentrytitle>mandos-client</refentrytitle>
185
<manvolnum>8mandos</manvolnum></citerefentry>. The key is
164
<citerefentry><refentrytitle>password-request</refentrytitle>
165
<manvolnum>8mandos</manvolnum></citerefentry>. The keys are
186
166
normally written to /etc/mandos for later installation into the
187
initrd image, but this, and most other things, can be changed
188
with command line options.
191
This program can also be used with the
192
<option>--password</option> or <option>--passfile</option>
193
options to generate a ready-made section for
194
<filename>clients.conf</filename> (see
195
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
196
<manvolnum>5</manvolnum></citerefentry>).
200
<refsect1 id="purpose">
201
<title>PURPOSE</title>
203
The purpose of this is to enable <emphasis>remote and unattended
204
rebooting</emphasis> of client host computer with an
205
<emphasis>encrypted root file system</emphasis>. See <xref
206
linkend="overview"/> for details.
167
initrd image, but this, like most things, can be changed with
168
command line options.
210
172
<refsect1 id="options">
211
173
<title>OPTIONS</title>
215
<term><option>--help</option></term>
216
<term><option>-h</option></term>
177
<term><literal>-h</literal>, <literal>--help</literal></term>
219
180
Show a help message and exit
226
<replaceable>DIRECTORY</replaceable></option></term>
228
<replaceable>DIRECTORY</replaceable></option></term>
231
Target directory for key files. Default is
232
<filename class="directory">/etc/mandos</filename>.
239
<replaceable>TYPE</replaceable></option></term>
241
<replaceable>TYPE</replaceable></option></term>
244
Key type. Default is <quote>RSA</quote>.
250
<term><option>--length
251
<replaceable>BITS</replaceable></option></term>
253
<replaceable>BITS</replaceable></option></term>
256
Key length in bits. Default is 4096.
262
<term><option>--subtype
263
<replaceable>KEYTYPE</replaceable></option></term>
265
<replaceable>KEYTYPE</replaceable></option></term>
268
Subkey type. Default is <quote>RSA</quote> (Elgamal
275
<term><option>--sublength
276
<replaceable>BITS</replaceable></option></term>
278
<replaceable>BITS</replaceable></option></term>
281
Subkey length in bits. Default is 4096.
287
<term><option>--email
288
<replaceable>ADDRESS</replaceable></option></term>
290
<replaceable>ADDRESS</replaceable></option></term>
186
<term><literal>-d</literal>, <literal>--dir
187
<replaceable>directory</replaceable></literal></term>
190
Target directory for key files.
196
<term><literal>-t</literal>, <literal>--type
197
<replaceable>type</replaceable></literal></term>
200
Key type. Default is DSA.
206
<term><literal>-l</literal>, <literal>--length
207
<replaceable>bits</replaceable></literal></term>
210
Key length in bits. Default is 1024.
216
<term><literal>-e</literal>, <literal>--email</literal>
217
<replaceable>address</replaceable></term>
293
220
Email address of key. Default is empty.
299
<term><option>--comment
300
<replaceable>TEXT</replaceable></option></term>
302
<replaceable>TEXT</replaceable></option></term>
226
<term><literal>-c</literal>, <literal>--comment</literal>
227
<replaceable>comment</replaceable></term>
305
Comment field for key. Default is empty.
230
Comment field for key. The default value is
231
"<literal>Mandos client key</literal>".
311
<term><option>--expire
312
<replaceable>TIME</replaceable></option></term>
314
<replaceable>TIME</replaceable></option></term>
237
<term><literal>-x</literal>, <literal>--expire</literal>
238
<replaceable>time</replaceable></term>
317
241
Key expire time. Default is no expiration. See
325
<term><option>--force</option></term>
326
<term><option>-f</option></term>
329
Force overwriting old key.
334
<term><option>--password</option></term>
335
<term><option>-p</option></term>
338
Prompt for a password and encrypt it with the key already
339
present in either <filename>/etc/mandos</filename> or the
340
directory specified with the <option>--dir</option>
341
option. Outputs, on standard output, a section suitable
342
for inclusion in <citerefentry><refentrytitle
343
>mandos-clients.conf</refentrytitle><manvolnum
344
>8</manvolnum></citerefentry>. The host name or the name
345
specified with the <option>--name</option> option is used
346
for the section header. All other options are ignored,
347
and no key is created.
352
<term><option>--passfile
353
<replaceable>FILE</replaceable></option></term>
355
<replaceable>FILE</replaceable></option></term>
358
The same as <option>--password</option>, but read from
359
<replaceable>FILE</replaceable>, not the terminal.
364
<term><option>--no-ssh</option></term>
365
<term><option>-S</option></term>
368
When <option>--password</option> or
369
<option>--passfile</option> is given, this option will
370
prevent <command>&COMMANDNAME;</command> from calling
371
<command>ssh-keyscan</command> to get an SSH fingerprint
372
for this host and, if successful, output suitable config
373
options to use this fingerprint as a
374
<option>checker</option> option in the output. This is
375
otherwise the default behavior.
249
<term><literal>-f</literal>, <literal>--force</literal></term>
252
Force overwriting old keys.
382
<refsect1 id="overview">
383
<title>OVERVIEW</title>
384
<xi:include href="overview.xml"/>
386
This program is a small utility to generate new OpenPGP keys for
387
new Mandos clients, and to generate sections for inclusion in
388
<filename>clients.conf</filename> on the server.
392
259
<refsect1 id="exit_status">
393
260
<title>EXIT STATUS</title>
395
The exit status will be 0 if a new key (or password, if the
396
<option>--password</option> option was used) was successfully
397
created, otherwise not.
401
<refsect1 id="environment">
402
<title>ENVIRONMENT</title>
405
<term><envar>TMPDIR</envar></term>
408
If set, temporary files will be created here. See
409
<citerefentry><refentrytitle>mktemp</refentrytitle>
410
<manvolnum>1</manvolnum></citerefentry>.
417
<refsect1 id="files">
418
266
<title>FILES</title>
420
Use the <option>--dir</option> option to change where
421
<command>&COMMANDNAME;</command> will write the key files. The
422
default file names are shown here.
426
<term><filename>/etc/mandos/seckey.txt</filename></term>
429
OpenPGP secret key file which will be created or
435
<term><filename>/etc/mandos/pubkey.txt</filename></term>
438
OpenPGP public key file which will be created or
444
<term><filename class="directory">/tmp</filename></term>
447
Temporary files will be written here if
448
<varname>TMPDIR</varname> is not set.
271
<refsect1 id="notes">
455
277
<refsect1 id="bugs">
456
278
<title>BUGS</title>
457
<xi:include href="bugs.xml"/>
460
<refsect1 id="example">
461
<title>EXAMPLE</title>
464
Normal invocation needs no options:
467
<userinput>&COMMANDNAME;</userinput>
472
Create key in another directory and of another type. Force
473
overwriting old key files:
477
<!-- do not wrap this line -->
478
<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>
484
Prompt for a password, encrypt it with the key in <filename
485
class="directory">/etc/mandos</filename> and output a section
486
suitable for <filename>clients.conf</filename>.
489
<userinput>&COMMANDNAME; --password</userinput>
494
Prompt for a password, encrypt it with the key in the
495
<filename>client-key</filename> directory and output a section
496
suitable for <filename>clients.conf</filename>.
500
<!-- do not wrap this line -->
501
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
283
<refsect1 id="examples">
284
<title>EXAMPLES</title>
507
289
<refsect1 id="security">
508
290
<title>SECURITY</title>
510
The <option>--type</option>, <option>--length</option>,
511
<option>--subtype</option>, and <option>--sublength</option>
512
options can be used to create keys of low security. If in
513
doubt, leave them to the default values.
516
The key expire time is <emphasis>not</emphasis> guaranteed to be
517
honored by <citerefentry><refentrytitle>mandos</refentrytitle>
518
<manvolnum>8</manvolnum></citerefentry>.
522
295
<refsect1 id="see_also">
523
296
<title>SEE ALSO</title>
525
<citerefentry><refentrytitle>intro</refentrytitle>
298
<citerefentry><refentrytitle>password-request</refentrytitle>
526
299
<manvolnum>8mandos</manvolnum></citerefentry>,
300
<citerefentry><refentrytitle>mandos</refentrytitle>
301
<manvolnum>8</manvolnum></citerefentry>, and
527
302
<citerefentry><refentrytitle>gpg</refentrytitle>
528
<manvolnum>1</manvolnum></citerefentry>,
529
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
530
<manvolnum>5</manvolnum></citerefentry>,
531
<citerefentry><refentrytitle>mandos</refentrytitle>
532
<manvolnum>8</manvolnum></citerefentry>,
533
<citerefentry><refentrytitle>mandos-client</refentrytitle>
534
<manvolnum>8mandos</manvolnum></citerefentry>,
535
<citerefentry><refentrytitle>ssh-keyscan</refentrytitle>
536
303
<manvolnum>1</manvolnum></citerefentry>
541
<!-- Local Variables: -->
542
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
543
<!-- time-stamp-end: "[\"']>" -->
544
<!-- time-stamp-format: "%:y-%02m-%02d" -->