/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-keygen.xml

  • Committer: Teddy Hogeborn
  • Date: 2019-02-10 03:50:20 UTC
  • Revision ID: teddy@recompile.se-20190210035020-nttr1tybgwwixueu
http://bugs.debian.org/879538
http://bugs.debian.org/916673
Show debconf note about new TLS key IDs

If mandos-client did not see TLS keys and had to create them, or if
mandos sees GnuTLS version 3.6.6 or later, show an important notice on
package installation about the importance of adding the new key_id
options to clients.conf on the Mandos server.

* debian/control (Package: mandos, Package: mandos-client): Depend on
                                                            debconf.
* debian/mandos-client.lintian-overrides: Override warnings.
* debian/mandos-client.postinst (create_keys): Show notice if new TLS
                                               key files were created.
* debian/mandos-client.templates: New.
* debian/mandos.lintian-overrides: Override warnings.
* debian/mandos.postinst (configure): If GnuTLS 3.6.6 or later is
                                      detected, show an important
                                      notice (once) about the new
                                      key_id option required in
                                      clients.conf.
* debian/mandos.templates: New.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-keygen.xml
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY COMMANDNAME "mandos-keygen">
5
 
<!ENTITY TIMESTAMP "2017-02-23">
 
5
<!ENTITY TIMESTAMP "2019-02-10">
6
6
<!ENTITY % common SYSTEM "common.ent">
7
7
%common;
8
8
]>
41
41
      <year>2015</year>
42
42
      <year>2016</year>
43
43
      <year>2017</year>
 
44
      <year>2018</year>
44
45
      <holder>Teddy Hogeborn</holder>
45
46
      <holder>Björn Påhlsson</holder>
46
47
    </copyright>
126
127
      </group>
127
128
      <sbr/>
128
129
      <group>
 
130
        <arg choice="plain"><option>--tls-keytype
 
131
        <replaceable>KEYTYPE</replaceable></option></arg>
 
132
        <arg choice="plain"><option>-T
 
133
        <replaceable>KEYTYPE</replaceable></option></arg>
 
134
      </group>
 
135
      <sbr/>
 
136
      <group>
129
137
        <arg choice="plain"><option>--force</option></arg>
130
138
        <arg choice="plain"><option>-f</option></arg>
131
139
      </group>
179
187
    <title>DESCRIPTION</title>
180
188
    <para>
181
189
      <command>&COMMANDNAME;</command> is a program to generate the
182
 
      OpenPGP key used by
 
190
      TLS and OpenPGP keys used by
183
191
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
184
 
      <manvolnum>8mandos</manvolnum></citerefentry>.  The key is
185
 
      normally written to /etc/mandos for later installation into the
186
 
      initrd image, but this, and most other things, can be changed
187
 
      with command line options.
 
192
      <manvolnum>8mandos</manvolnum></citerefentry>.  The keys are
 
193
      normally written to /etc/keys/mandos for later installation into
 
194
      the initrd image, but this, and most other things, can be
 
195
      changed with command line options.
188
196
    </para>
189
197
    <para>
190
198
      This program can also be used with the
227
235
        <replaceable>DIRECTORY</replaceable></option></term>
228
236
        <listitem>
229
237
          <para>
230
 
            Target directory for key files.  Default is
231
 
            <filename class="directory">/etc/mandos</filename>.
 
238
            Target directory for key files.  Default is <filename
 
239
            class="directory">/etc/keys/mandos</filename>.
232
240
          </para>
233
241
        </listitem>
234
242
      </varlistentry>
240
248
        <replaceable>TYPE</replaceable></option></term>
241
249
        <listitem>
242
250
          <para>
243
 
            Key type.  Default is <quote>RSA</quote>.
 
251
            OpenPGP key type.  Default is <quote>RSA</quote>.
244
252
          </para>
245
253
        </listitem>
246
254
      </varlistentry>
252
260
        <replaceable>BITS</replaceable></option></term>
253
261
        <listitem>
254
262
          <para>
255
 
            Key length in bits.  Default is 4096.
 
263
            OpenPGP key length in bits.  Default is 4096.
256
264
          </para>
257
265
        </listitem>
258
266
      </varlistentry>
264
272
        <replaceable>KEYTYPE</replaceable></option></term>
265
273
        <listitem>
266
274
          <para>
267
 
            Subkey type.  Default is <quote>RSA</quote> (Elgamal
268
 
            encryption-only).
 
275
            OpenPGP subkey type.  Default is <quote>RSA</quote>
269
276
          </para>
270
277
        </listitem>
271
278
      </varlistentry>
277
284
        <replaceable>BITS</replaceable></option></term>
278
285
        <listitem>
279
286
          <para>
280
 
            Subkey length in bits.  Default is 4096.
 
287
            OpenPGP subkey length in bits.  Default is 4096.
281
288
          </para>
282
289
        </listitem>
283
290
      </varlistentry>
321
328
      </varlistentry>
322
329
      
323
330
      <varlistentry>
 
331
        <term><option>--tls-keytype
 
332
        <replaceable>KEYTYPE</replaceable></option></term>
 
333
        <term><option>-T
 
334
        <replaceable>KEYTYPE</replaceable></option></term>
 
335
        <listitem>
 
336
          <para>
 
337
            TLS key type.  Default is <quote>ed25519</quote>
 
338
          </para>
 
339
        </listitem>
 
340
      </varlistentry>
 
341
      
 
342
      <varlistentry>
324
343
        <term><option>--force</option></term>
325
344
        <term><option>-f</option></term>
326
345
        <listitem>
335
354
        <listitem>
336
355
          <para>
337
356
            Prompt for a password and encrypt it with the key already
338
 
            present in either <filename>/etc/mandos</filename> or the
339
 
            directory specified with the <option>--dir</option>
 
357
            present in either <filename>/etc/keys/mandos</filename> or
 
358
            the directory specified with the <option>--dir</option>
340
359
            option.  Outputs, on standard output, a section suitable
341
360
            for inclusion in <citerefentry><refentrytitle
342
361
            >mandos-clients.conf</refentrytitle><manvolnum
382
401
    <title>OVERVIEW</title>
383
402
    <xi:include href="overview.xml"/>
384
403
    <para>
385
 
      This program is a small utility to generate new OpenPGP keys for
386
 
      new Mandos clients, and to generate sections for inclusion in
387
 
      <filename>clients.conf</filename> on the server.
 
404
      This program is a small utility to generate new TLS and OpenPGP
 
405
      keys for new Mandos clients, and to generate sections for
 
406
      inclusion in <filename>clients.conf</filename> on the server.
388
407
    </para>
389
408
  </refsect1>
390
409
  
422
441
    </para>
423
442
    <variablelist>
424
443
      <varlistentry>
425
 
        <term><filename>/etc/mandos/seckey.txt</filename></term>
 
444
        <term><filename>/etc/keys/mandos/seckey.txt</filename></term>
426
445
        <listitem>
427
446
          <para>
428
447
            OpenPGP secret key file which will be created or
431
450
        </listitem>
432
451
      </varlistentry>
433
452
      <varlistentry>
434
 
        <term><filename>/etc/mandos/pubkey.txt</filename></term>
 
453
        <term><filename>/etc/keys/mandos/pubkey.txt</filename></term>
435
454
        <listitem>
436
455
          <para>
437
456
            OpenPGP public key file which will be created or
440
459
        </listitem>
441
460
      </varlistentry>
442
461
      <varlistentry>
 
462
        <term><filename>/etc/keys/mandos/tls-privkey.pem</filename></term>
 
463
        <listitem>
 
464
          <para>
 
465
            Private key file which will be created or overwritten.
 
466
          </para>
 
467
        </listitem>
 
468
      </varlistentry>
 
469
      <varlistentry>
 
470
        <term><filename>/etc/keys/mandos/tls-pubkey.pem</filename></term>
 
471
        <listitem>
 
472
          <para>
 
473
            Public key file which will be created or overwritten.
 
474
          </para>
 
475
        </listitem>
 
476
      </varlistentry>
 
477
      <varlistentry>
443
478
        <term><filename class="directory">/tmp</filename></term>
444
479
        <listitem>
445
480
          <para>
480
515
    </informalexample>
481
516
    <informalexample>
482
517
      <para>
483
 
        Prompt for a password, encrypt it with the key in <filename
484
 
        class="directory">/etc/mandos</filename> and output a section
485
 
        suitable for <filename>clients.conf</filename>.
 
518
        Prompt for a password, encrypt it with the keys in <filename
 
519
        class="directory">/etc/keys/mandos</filename> and output a
 
520
        section suitable for <filename>clients.conf</filename>.
486
521
      </para>
487
522
      <para>
488
523
        <userinput>&COMMANDNAME; --password</userinput>
490
525
    </informalexample>
491
526
    <informalexample>
492
527
      <para>
493
 
        Prompt for a password, encrypt it with the key in the
 
528
        Prompt for a password, encrypt it with the keys in the
494
529
        <filename>client-key</filename> directory and output a section
495
530
        suitable for <filename>clients.conf</filename>.
496
531
      </para>