/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-keygen.xml

  • Committer: Teddy Hogeborn
  • Date: 2019-02-10 03:50:20 UTC
  • Revision ID: teddy@recompile.se-20190210035020-nttr1tybgwwixueu
http://bugs.debian.org/879538
http://bugs.debian.org/916673
Show debconf note about new TLS key IDs

If mandos-client did not see TLS keys and had to create them, or if
mandos sees GnuTLS version 3.6.6 or later, show an important notice on
package installation about the importance of adding the new key_id
options to clients.conf on the Mandos server.

* debian/control (Package: mandos, Package: mandos-client): Depend on
                                                            debconf.
* debian/mandos-client.lintian-overrides: Override warnings.
* debian/mandos-client.postinst (create_keys): Show notice if new TLS
                                               key files were created.
* debian/mandos-client.templates: New.
* debian/mandos.lintian-overrides: Override warnings.
* debian/mandos.postinst (configure): If GnuTLS 3.6.6 or later is
                                      detected, show an important
                                      notice (once) about the new
                                      key_id option required in
                                      clients.conf.
* debian/mandos.templates: New.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-keygen.xml
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY COMMANDNAME "mandos-keygen">
5
 
<!ENTITY TIMESTAMP "2016-03-05">
 
5
<!ENTITY TIMESTAMP "2019-02-10">
6
6
<!ENTITY % common SYSTEM "common.ent">
7
7
%common;
8
8
]>
40
40
      <year>2014</year>
41
41
      <year>2015</year>
42
42
      <year>2016</year>
 
43
      <year>2017</year>
 
44
      <year>2018</year>
43
45
      <holder>Teddy Hogeborn</holder>
44
46
      <holder>Björn Påhlsson</holder>
45
47
    </copyright>
125
127
      </group>
126
128
      <sbr/>
127
129
      <group>
 
130
        <arg choice="plain"><option>--tls-keytype
 
131
        <replaceable>KEYTYPE</replaceable></option></arg>
 
132
        <arg choice="plain"><option>-T
 
133
        <replaceable>KEYTYPE</replaceable></option></arg>
 
134
      </group>
 
135
      <sbr/>
 
136
      <group>
128
137
        <arg choice="plain"><option>--force</option></arg>
129
138
        <arg choice="plain"><option>-f</option></arg>
130
139
      </group>
178
187
    <title>DESCRIPTION</title>
179
188
    <para>
180
189
      <command>&COMMANDNAME;</command> is a program to generate the
181
 
      OpenPGP key used by
 
190
      TLS and OpenPGP keys used by
182
191
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
183
 
      <manvolnum>8mandos</manvolnum></citerefentry>.  The key is
184
 
      normally written to /etc/mandos for later installation into the
185
 
      initrd image, but this, and most other things, can be changed
186
 
      with command line options.
 
192
      <manvolnum>8mandos</manvolnum></citerefentry>.  The keys are
 
193
      normally written to /etc/keys/mandos for later installation into
 
194
      the initrd image, but this, and most other things, can be
 
195
      changed with command line options.
187
196
    </para>
188
197
    <para>
189
198
      This program can also be used with the
226
235
        <replaceable>DIRECTORY</replaceable></option></term>
227
236
        <listitem>
228
237
          <para>
229
 
            Target directory for key files.  Default is
230
 
            <filename class="directory">/etc/mandos</filename>.
 
238
            Target directory for key files.  Default is <filename
 
239
            class="directory">/etc/keys/mandos</filename>.
231
240
          </para>
232
241
        </listitem>
233
242
      </varlistentry>
239
248
        <replaceable>TYPE</replaceable></option></term>
240
249
        <listitem>
241
250
          <para>
242
 
            Key type.  Default is <quote>RSA</quote>.
 
251
            OpenPGP key type.  Default is <quote>RSA</quote>.
243
252
          </para>
244
253
        </listitem>
245
254
      </varlistentry>
251
260
        <replaceable>BITS</replaceable></option></term>
252
261
        <listitem>
253
262
          <para>
254
 
            Key length in bits.  Default is 4096.
 
263
            OpenPGP key length in bits.  Default is 4096.
255
264
          </para>
256
265
        </listitem>
257
266
      </varlistentry>
263
272
        <replaceable>KEYTYPE</replaceable></option></term>
264
273
        <listitem>
265
274
          <para>
266
 
            Subkey type.  Default is <quote>RSA</quote> (Elgamal
267
 
            encryption-only).
 
275
            OpenPGP subkey type.  Default is <quote>RSA</quote>
268
276
          </para>
269
277
        </listitem>
270
278
      </varlistentry>
276
284
        <replaceable>BITS</replaceable></option></term>
277
285
        <listitem>
278
286
          <para>
279
 
            Subkey length in bits.  Default is 4096.
 
287
            OpenPGP subkey length in bits.  Default is 4096.
280
288
          </para>
281
289
        </listitem>
282
290
      </varlistentry>
320
328
      </varlistentry>
321
329
      
322
330
      <varlistentry>
 
331
        <term><option>--tls-keytype
 
332
        <replaceable>KEYTYPE</replaceable></option></term>
 
333
        <term><option>-T
 
334
        <replaceable>KEYTYPE</replaceable></option></term>
 
335
        <listitem>
 
336
          <para>
 
337
            TLS key type.  Default is <quote>ed25519</quote>
 
338
          </para>
 
339
        </listitem>
 
340
      </varlistentry>
 
341
      
 
342
      <varlistentry>
323
343
        <term><option>--force</option></term>
324
344
        <term><option>-f</option></term>
325
345
        <listitem>
334
354
        <listitem>
335
355
          <para>
336
356
            Prompt for a password and encrypt it with the key already
337
 
            present in either <filename>/etc/mandos</filename> or the
338
 
            directory specified with the <option>--dir</option>
 
357
            present in either <filename>/etc/keys/mandos</filename> or
 
358
            the directory specified with the <option>--dir</option>
339
359
            option.  Outputs, on standard output, a section suitable
340
360
            for inclusion in <citerefentry><refentrytitle
341
361
            >mandos-clients.conf</refentrytitle><manvolnum
381
401
    <title>OVERVIEW</title>
382
402
    <xi:include href="overview.xml"/>
383
403
    <para>
384
 
      This program is a small utility to generate new OpenPGP keys for
385
 
      new Mandos clients, and to generate sections for inclusion in
386
 
      <filename>clients.conf</filename> on the server.
 
404
      This program is a small utility to generate new TLS and OpenPGP
 
405
      keys for new Mandos clients, and to generate sections for
 
406
      inclusion in <filename>clients.conf</filename> on the server.
387
407
    </para>
388
408
  </refsect1>
389
409
  
421
441
    </para>
422
442
    <variablelist>
423
443
      <varlistentry>
424
 
        <term><filename>/etc/mandos/seckey.txt</filename></term>
 
444
        <term><filename>/etc/keys/mandos/seckey.txt</filename></term>
425
445
        <listitem>
426
446
          <para>
427
447
            OpenPGP secret key file which will be created or
430
450
        </listitem>
431
451
      </varlistentry>
432
452
      <varlistentry>
433
 
        <term><filename>/etc/mandos/pubkey.txt</filename></term>
 
453
        <term><filename>/etc/keys/mandos/pubkey.txt</filename></term>
434
454
        <listitem>
435
455
          <para>
436
456
            OpenPGP public key file which will be created or
439
459
        </listitem>
440
460
      </varlistentry>
441
461
      <varlistentry>
 
462
        <term><filename>/etc/keys/mandos/tls-privkey.pem</filename></term>
 
463
        <listitem>
 
464
          <para>
 
465
            Private key file which will be created or overwritten.
 
466
          </para>
 
467
        </listitem>
 
468
      </varlistentry>
 
469
      <varlistentry>
 
470
        <term><filename>/etc/keys/mandos/tls-pubkey.pem</filename></term>
 
471
        <listitem>
 
472
          <para>
 
473
            Public key file which will be created or overwritten.
 
474
          </para>
 
475
        </listitem>
 
476
      </varlistentry>
 
477
      <varlistentry>
442
478
        <term><filename class="directory">/tmp</filename></term>
443
479
        <listitem>
444
480
          <para>
479
515
    </informalexample>
480
516
    <informalexample>
481
517
      <para>
482
 
        Prompt for a password, encrypt it with the key in <filename
483
 
        class="directory">/etc/mandos</filename> and output a section
484
 
        suitable for <filename>clients.conf</filename>.
 
518
        Prompt for a password, encrypt it with the keys in <filename
 
519
        class="directory">/etc/keys/mandos</filename> and output a
 
520
        section suitable for <filename>clients.conf</filename>.
485
521
      </para>
486
522
      <para>
487
523
        <userinput>&COMMANDNAME; --password</userinput>
489
525
    </informalexample>
490
526
    <informalexample>
491
527
      <para>
492
 
        Prompt for a password, encrypt it with the key in the
 
528
        Prompt for a password, encrypt it with the keys in the
493
529
        <filename>client-key</filename> directory and output a section
494
530
        suitable for <filename>clients.conf</filename>.
495
531
      </para>