To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos-keygen.xml
- browse files at revision 831
- compare with another revision
- download diff
- download tarball
- view history from revision 831
- Committer: Teddy Hogeborn
- Date: 2016-03-13 00:37:02 UTC
- Revision ID: teddy@recompile.se-20160313003702-dulwtwt8ilpojra9
Server: Fix bug where it did not exit timely on signals
Use GLib.unix_signal_add() instead of signal.signal() to catch
signals; this will allow GLib to do its internal magic with signal
file descriptors. (GLib does not handle signals properly otherwise.)
The function unix_signal_add() requires GLib 2.30 or later, which was
not required by PyGobject until version 3.7.1, so depend on this.
* INSTALL (Mandos Server): Document dependency on PyGObject 3.7.1
* mandos (main): Use GLib.unix_signal_add instead of signal.signal.
* init.d-mandos (do_stop): Remove workaround.
* mandos.service ([Service]): - '' -
Use GLib.unix_signal_add() instead of signal.signal() to catch
signals; this will allow GLib to do its internal magic with signal
file descriptors. (GLib does not handle signals properly otherwise.)
The function unix_signal_add() requires GLib 2.30 or later, which was
not required by PyGobject until version 3.7.1, so depend on this.
* INSTALL (Mandos Server): Document dependency on PyGObject 3.7.1
* mandos (main): Use GLib.unix_signal_add instead of signal.signal.
* init.d-mandos (do_stop): Remove workaround.
* mandos.service ([Service]): - '' -
- files added:
- .bzr-builddeb
- debian
- debian/po
- debian/source
- debian/upstream
- network-hooks.d
- plugin-helpers
- files removed:
- network-protocol.txt
- files renamed:
- mandos-client.c => plugin-runner.c
- mandos-client.xml => plugin-runner.xml
- plugins.d/password-request.c => plugins.d/mandos-client.c
- plugins.d/password-request.xml => plugins.d/mandos-client.xml
- files modified:
- Makefile
added
removed
mandos-keygen.xml
1
<?xml version="1.0" encoding="UTF-8"?>
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
<!ENTITY COMMANDNAME "mandos-keygen">
5
<!ENTITY TIMESTAMP "2016-03-05">
6
<!ENTITY % common SYSTEM "common.ent">
7
%common;
8
]>
9
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
11
<refentryinfo>
12
<title>Mandos Manual</title>
13
<!-- NWalsh’s docbook scripts use this to generate the footer: -->
14
<productname>Mandos</productname>
15
<productnumber>&version;</productnumber>
16
<date>&TIMESTAMP;</date>
17
<authorgroup>
18
<author>
19
<firstname>Björn</firstname>
20
<surname>Påhlsson</surname>
21
<address>
22
<email>belorn@recompile.se</email>
23
</address>
24
</author>
25
<author>
26
<firstname>Teddy</firstname>
27
<surname>Hogeborn</surname>
28
<address>
29
<email>teddy@recompile.se</email>
30
</address>
31
</author>
32
</authorgroup>
33
<copyright>
34
<year>2008</year>
35
<year>2009</year>
36
<year>2010</year>
37
<year>2011</year>
38
<year>2012</year>
39
<year>2013</year>
40
<year>2014</year>
41
<year>2015</year>
42
<year>2016</year>
43
<holder>Teddy Hogeborn</holder>
44
<holder>Björn Påhlsson</holder>
45
</copyright>
46
<xi:include href="legalnotice.xml"/>
47
</refentryinfo>
48
49
<refmeta>
50
<refentrytitle>&COMMANDNAME;</refentrytitle>
51
<manvolnum>8</manvolnum>
52
</refmeta>
53
54
<refnamediv>
55
<refname><command>&COMMANDNAME;</command></refname>
56
<refpurpose>
57
Generate key and password for Mandos client and server.
58
</refpurpose>
59
</refnamediv>
60
61
<refsynopsisdiv>
62
<cmdsynopsis>
63
<command>&COMMANDNAME;</command>
64
<group>
65
<arg choice="plain"><option>--dir
66
<replaceable>DIRECTORY</replaceable></option></arg>
67
<arg choice="plain"><option>-d
68
<replaceable>DIRECTORY</replaceable></option></arg>
69
</group>
70
<sbr/>
71
<group>
72
<arg choice="plain"><option>--type
73
<replaceable>KEYTYPE</replaceable></option></arg>
74
<arg choice="plain"><option>-t
75
<replaceable>KEYTYPE</replaceable></option></arg>
76
</group>
77
<sbr/>
78
<group>
79
<arg choice="plain"><option>--length
80
<replaceable>BITS</replaceable></option></arg>
81
<arg choice="plain"><option>-l
82
<replaceable>BITS</replaceable></option></arg>
83
</group>
84
<sbr/>
85
<group>
86
<arg choice="plain"><option>--subtype
87
<replaceable>KEYTYPE</replaceable></option></arg>
88
<arg choice="plain"><option>-s
89
<replaceable>KEYTYPE</replaceable></option></arg>
90
</group>
91
<sbr/>
92
<group>
93
<arg choice="plain"><option>--sublength
94
<replaceable>BITS</replaceable></option></arg>
95
<arg choice="plain"><option>-L
96
<replaceable>BITS</replaceable></option></arg>
97
</group>
98
<sbr/>
99
<group>
100
<arg choice="plain"><option>--name
101
<replaceable>NAME</replaceable></option></arg>
102
<arg choice="plain"><option>-n
103
<replaceable>NAME</replaceable></option></arg>
104
</group>
105
<sbr/>
106
<group>
107
<arg choice="plain"><option>--email
108
<replaceable>ADDRESS</replaceable></option></arg>
109
<arg choice="plain"><option>-e
110
<replaceable>ADDRESS</replaceable></option></arg>
111
</group>
112
<sbr/>
113
<group>
114
<arg choice="plain"><option>--comment
115
<replaceable>TEXT</replaceable></option></arg>
116
<arg choice="plain"><option>-c
117
<replaceable>TEXT</replaceable></option></arg>
118
</group>
119
<sbr/>
120
<group>
121
<arg choice="plain"><option>--expire
122
<replaceable>TIME</replaceable></option></arg>
123
<arg choice="plain"><option>-x
124
<replaceable>TIME</replaceable></option></arg>
125
</group>
126
<sbr/>
127
<group>
128
<arg choice="plain"><option>--force</option></arg>
129
<arg choice="plain"><option>-f</option></arg>
130
</group>
131
</cmdsynopsis>
132
<cmdsynopsis>
133
<command>&COMMANDNAME;</command>
134
<group choice="req">
135
<arg choice="plain"><option>--password</option></arg>
136
<arg choice="plain"><option>-p</option></arg>
137
<arg choice="plain"><option>--passfile
138
<replaceable>FILE</replaceable></option></arg>
139
<arg choice="plain"><option>-F</option>
140
<replaceable>FILE</replaceable></arg>
141
</group>
142
<sbr/>
143
<group>
144
<arg choice="plain"><option>--dir
145
<replaceable>DIRECTORY</replaceable></option></arg>
146
<arg choice="plain"><option>-d
147
<replaceable>DIRECTORY</replaceable></option></arg>
148
</group>
149
<sbr/>
150
<group>
151
<arg choice="plain"><option>--name
152
<replaceable>NAME</replaceable></option></arg>
153
<arg choice="plain"><option>-n
154
<replaceable>NAME</replaceable></option></arg>
155
</group>
156
<group>
157
<arg choice="plain"><option>--no-ssh</option></arg>
158
<arg choice="plain"><option>-S</option></arg>
159
</group>
160
</cmdsynopsis>
161
<cmdsynopsis>
162
<command>&COMMANDNAME;</command>
163
<group choice="req">
164
<arg choice="plain"><option>--help</option></arg>
165
<arg choice="plain"><option>-h</option></arg>
166
</group>
167
</cmdsynopsis>
168
<cmdsynopsis>
169
<command>&COMMANDNAME;</command>
170
<group choice="req">
171
<arg choice="plain"><option>--version</option></arg>
172
<arg choice="plain"><option>-v</option></arg>
173
</group>
174
</cmdsynopsis>
175
</refsynopsisdiv>
176
177
<refsect1 id="description">
178
<title>DESCRIPTION</title>
179
<para>
180
<command>&COMMANDNAME;</command> is a program to generate the
181
OpenPGP key used by
182
<citerefentry><refentrytitle>mandos-client</refentrytitle>
183
<manvolnum>8mandos</manvolnum></citerefentry>. The key is
184
normally written to /etc/mandos for later installation into the
185
initrd image, but this, and most other things, can be changed
186
with command line options.
187
</para>
188
<para>
189
This program can also be used with the
190
<option>--password</option> or <option>--passfile</option>
191
options to generate a ready-made section for
192
<filename>clients.conf</filename> (see
193
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
194
<manvolnum>5</manvolnum></citerefentry>).
195
</para>
196
</refsect1>
197
198
<refsect1 id="purpose">
199
<title>PURPOSE</title>
200
<para>
201
The purpose of this is to enable <emphasis>remote and unattended
202
rebooting</emphasis> of client host computer with an
203
<emphasis>encrypted root file system</emphasis>. See <xref
204
linkend="overview"/> for details.
205
</para>
206
</refsect1>
207
208
<refsect1 id="options">
209
<title>OPTIONS</title>
210
211
<variablelist>
212
<varlistentry>
213
<term><option>--help</option></term>
214
<term><option>-h</option></term>
215
<listitem>
216
<para>
217
Show a help message and exit
218
</para>
219
</listitem>
220
</varlistentry>
221
222
<varlistentry>
223
<term><option>--dir
224
<replaceable>DIRECTORY</replaceable></option></term>
225
<term><option>-d
226
<replaceable>DIRECTORY</replaceable></option></term>
227
<listitem>
228
<para>
229
Target directory for key files. Default is
230
<filename class="directory">/etc/mandos</filename>.
231
</para>
232
</listitem>
233
</varlistentry>
234
235
<varlistentry>
236
<term><option>--type
237
<replaceable>TYPE</replaceable></option></term>
238
<term><option>-t
239
<replaceable>TYPE</replaceable></option></term>
240
<listitem>
241
<para>
242
Key type. Default is <quote>RSA</quote>.
243
</para>
244
</listitem>
245
</varlistentry>
246
247
<varlistentry>
248
<term><option>--length
249
<replaceable>BITS</replaceable></option></term>
250
<term><option>-l
251
<replaceable>BITS</replaceable></option></term>
252
<listitem>
253
<para>
254
Key length in bits. Default is 4096.
255
</para>
256
</listitem>
257
</varlistentry>
258
259
<varlistentry>
260
<term><option>--subtype
261
<replaceable>KEYTYPE</replaceable></option></term>
262
<term><option>-s
263
<replaceable>KEYTYPE</replaceable></option></term>
264
<listitem>
265
<para>
266
Subkey type. Default is <quote>RSA</quote> (Elgamal
267
encryption-only).
268
</para>
269
</listitem>
270
</varlistentry>
271
272
<varlistentry>
273
<term><option>--sublength
274
<replaceable>BITS</replaceable></option></term>
275
<term><option>-L
276
<replaceable>BITS</replaceable></option></term>
277
<listitem>
278
<para>
279
Subkey length in bits. Default is 4096.
280
</para>
281
</listitem>
282
</varlistentry>
283
284
<varlistentry>
285
<term><option>--email
286
<replaceable>ADDRESS</replaceable></option></term>
287
<term><option>-e
288
<replaceable>ADDRESS</replaceable></option></term>
289
<listitem>
290
<para>
291
Email address of key. Default is empty.
292
</para>
293
</listitem>
294
</varlistentry>
295
296
<varlistentry>
297
<term><option>--comment
298
<replaceable>TEXT</replaceable></option></term>
299
<term><option>-c
300
<replaceable>TEXT</replaceable></option></term>
301
<listitem>
302
<para>
303
Comment field for key. Default is empty.
304
</para>
305
</listitem>
306
</varlistentry>
307
308
<varlistentry>
309
<term><option>--expire
310
<replaceable>TIME</replaceable></option></term>
311
<term><option>-x
312
<replaceable>TIME</replaceable></option></term>
313
<listitem>
314
<para>
315
Key expire time. Default is no expiration. See
316
<citerefentry><refentrytitle>gpg</refentrytitle>
317
<manvolnum>1</manvolnum></citerefentry> for syntax.
318
</para>
319
</listitem>
320
</varlistentry>
321
322
<varlistentry>
323
<term><option>--force</option></term>
324
<term><option>-f</option></term>
325
<listitem>
326
<para>
327
Force overwriting old key.
328
</para>
329
</listitem>
330
</varlistentry>
331
<varlistentry>
332
<term><option>--password</option></term>
333
<term><option>-p</option></term>
334
<listitem>
335
<para>
336
Prompt for a password and encrypt it with the key already
337
present in either <filename>/etc/mandos</filename> or the
338
directory specified with the <option>--dir</option>
339
option. Outputs, on standard output, a section suitable
340
for inclusion in <citerefentry><refentrytitle
341
>mandos-clients.conf</refentrytitle><manvolnum
342
>8</manvolnum></citerefentry>. The host name or the name
343
specified with the <option>--name</option> option is used
344
for the section header. All other options are ignored,
345
and no key is created.
346
</para>
347
</listitem>
348
</varlistentry>
349
<varlistentry>
350
<term><option>--passfile
351
<replaceable>FILE</replaceable></option></term>
352
<term><option>-F
353
<replaceable>FILE</replaceable></option></term>
354
<listitem>
355
<para>
356
The same as <option>--password</option>, but read from
357
<replaceable>FILE</replaceable>, not the terminal.
358
</para>
359
</listitem>
360
</varlistentry>
361
<varlistentry>
362
<term><option>--no-ssh</option></term>
363
<term><option>-S</option></term>
364
<listitem>
365
<para>
366
When <option>--password</option> or
367
<option>--passfile</option> is given, this option will
368
prevent <command>&COMMANDNAME;</command> from calling
369
<command>ssh-keyscan</command> to get an SSH fingerprint
370
for this host and, if successful, output suitable config
371
options to use this fingerprint as a
372
<option>checker</option> option in the output. This is
373
otherwise the default behavior.
374
</para>
375
</listitem>
376
</varlistentry>
377
</variablelist>
378
</refsect1>
379
380
<refsect1 id="overview">
381
<title>OVERVIEW</title>
382
<xi:include href="overview.xml"/>
383
<para>
384
This program is a small utility to generate new OpenPGP keys for
385
new Mandos clients, and to generate sections for inclusion in
386
<filename>clients.conf</filename> on the server.
387
</para>
388
</refsect1>
389
390
<refsect1 id="exit_status">
391
<title>EXIT STATUS</title>
392
<para>
393
The exit status will be 0 if a new key (or password, if the
394
<option>--password</option> option was used) was successfully
395
created, otherwise not.
396
</para>
397
</refsect1>
398
399
<refsect1 id="environment">
400
<title>ENVIRONMENT</title>
401
<variablelist>
402
<varlistentry>
403
<term><envar>TMPDIR</envar></term>
404
<listitem>
405
<para>
406
If set, temporary files will be created here. See
407
<citerefentry><refentrytitle>mktemp</refentrytitle>
408
<manvolnum>1</manvolnum></citerefentry>.
409
</para>
410
</listitem>
411
</varlistentry>
412
</variablelist>
413
</refsect1>
414
415
<refsect1 id="files">
416
<title>FILES</title>
417
<para>
418
Use the <option>--dir</option> option to change where
419
<command>&COMMANDNAME;</command> will write the key files. The
420
default file names are shown here.
421
</para>
422
<variablelist>
423
<varlistentry>
424
<term><filename>/etc/mandos/seckey.txt</filename></term>
425
<listitem>
426
<para>
427
OpenPGP secret key file which will be created or
428
overwritten.
429
</para>
430
</listitem>
431
</varlistentry>
432
<varlistentry>
433
<term><filename>/etc/mandos/pubkey.txt</filename></term>
434
<listitem>
435
<para>
436
OpenPGP public key file which will be created or
437
overwritten.
438
</para>
439
</listitem>
440
</varlistentry>
441
<varlistentry>
442
<term><filename class="directory">/tmp</filename></term>
443
<listitem>
444
<para>
445
Temporary files will be written here if
446
<varname>TMPDIR</varname> is not set.
447
</para>
448
</listitem>
449
</varlistentry>
450
</variablelist>
451
</refsect1>
452
453
<refsect1 id="bugs">
454
<title>BUGS</title>
455
<xi:include href="bugs.xml"/>
456
</refsect1>
457
458
<refsect1 id="example">
459
<title>EXAMPLE</title>
460
<informalexample>
461
<para>
462
Normal invocation needs no options:
463
</para>
464
<para>
465
<userinput>&COMMANDNAME;</userinput>
466
</para>
467
</informalexample>
468
<informalexample>
469
<para>
470
Create key in another directory and of another type. Force
471
overwriting old key files:
472
</para>
473
<para>
474
475
<!-- do not wrap this line -->
476
<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>
477
478
</para>
479
</informalexample>
480
<informalexample>
481
<para>
482
Prompt for a password, encrypt it with the key in <filename
483
class="directory">/etc/mandos</filename> and output a section
484
suitable for <filename>clients.conf</filename>.
485
</para>
486
<para>
487
<userinput>&COMMANDNAME; --password</userinput>
488
</para>
489
</informalexample>
490
<informalexample>
491
<para>
492
Prompt for a password, encrypt it with the key in the
493
<filename>client-key</filename> directory and output a section
494
suitable for <filename>clients.conf</filename>.
495
</para>
496
<para>
497
498
<!-- do not wrap this line -->
499
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
500
501
</para>
502
</informalexample>
503
</refsect1>
504
505
<refsect1 id="security">
506
<title>SECURITY</title>
507
<para>
508
The <option>--type</option>, <option>--length</option>,
509
<option>--subtype</option>, and <option>--sublength</option>
510
options can be used to create keys of low security. If in
511
doubt, leave them to the default values.
512
</para>
513
<para>
514
The key expire time is <emphasis>not</emphasis> guaranteed to be
515
honored by <citerefentry><refentrytitle>mandos</refentrytitle>
516
<manvolnum>8</manvolnum></citerefentry>.
517
</para>
518
</refsect1>
519
520
<refsect1 id="see_also">
521
<title>SEE ALSO</title>
522
<para>
523
<citerefentry><refentrytitle>intro</refentrytitle>
524
<manvolnum>8mandos</manvolnum></citerefentry>,
525
<citerefentry><refentrytitle>gpg</refentrytitle>
526
<manvolnum>1</manvolnum></citerefentry>,
527
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
528
<manvolnum>5</manvolnum></citerefentry>,
529
<citerefentry><refentrytitle>mandos</refentrytitle>
530
<manvolnum>8</manvolnum></citerefentry>,
531
<citerefentry><refentrytitle>mandos-client</refentrytitle>
532
<manvolnum>8mandos</manvolnum></citerefentry>,
533
<citerefentry><refentrytitle>ssh-keyscan</refentrytitle>
534
<manvolnum>1</manvolnum></citerefentry>
535
</para>
536
</refsect1>
537
538
</refentry>
539
<!-- Local Variables: -->
540
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
541
<!-- time-stamp-end: "[\"']>" -->
542
<!-- time-stamp-format: "%:y-%02m-%02d" -->
543
<!-- End: -->
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0