/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-keygen.xml

  • Committer: Teddy Hogeborn
  • Date: 2019-02-10 03:50:20 UTC
  • Revision ID: teddy@recompile.se-20190210035020-nttr1tybgwwixueu
http://bugs.debian.org/879538
http://bugs.debian.org/916673
Show debconf note about new TLS key IDs

If mandos-client did not see TLS keys and had to create them, or if
mandos sees GnuTLS version 3.6.6 or later, show an important notice on
package installation about the importance of adding the new key_id
options to clients.conf on the Mandos server.

* debian/control (Package: mandos, Package: mandos-client): Depend on
                                                            debconf.
* debian/mandos-client.lintian-overrides: Override warnings.
* debian/mandos-client.postinst (create_keys): Show notice if new TLS
                                               key files were created.
* debian/mandos-client.templates: New.
* debian/mandos.lintian-overrides: Override warnings.
* debian/mandos.postinst (configure): If GnuTLS 3.6.6 or later is
                                      detected, show an important
                                      notice (once) about the new
                                      key_id option required in
                                      clients.conf.
* debian/mandos.templates: New.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-keygen.xml
1
 
<?xml version='1.0' encoding='UTF-8'?>
 
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
 
<!ENTITY VERSION "1.0">
5
4
<!ENTITY COMMANDNAME "mandos-keygen">
 
5
<!ENTITY TIMESTAMP "2019-02-10">
 
6
<!ENTITY % common SYSTEM "common.ent">
 
7
%common;
6
8
]>
7
9
 
8
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
9
11
  <refentryinfo>
10
 
    <title>&COMMANDNAME;</title>
11
 
    <!-- NWalsh's docbook scripts use this to generate the footer: -->
12
 
    <productname>&COMMANDNAME;</productname>
13
 
    <productnumber>&VERSION;</productnumber>
 
12
    <title>Mandos Manual</title>
 
13
    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
 
14
    <productname>Mandos</productname>
 
15
    <productnumber>&version;</productnumber>
 
16
    <date>&TIMESTAMP;</date>
14
17
    <authorgroup>
15
18
      <author>
16
19
        <firstname>Björn</firstname>
17
20
        <surname>Påhlsson</surname>
18
21
        <address>
19
 
          <email>belorn@fukt.bsnet.se</email>
 
22
          <email>belorn@recompile.se</email>
20
23
        </address>
21
24
      </author>
22
25
      <author>
23
26
        <firstname>Teddy</firstname>
24
27
        <surname>Hogeborn</surname>
25
28
        <address>
26
 
          <email>teddy@fukt.bsnet.se</email>
 
29
          <email>teddy@recompile.se</email>
27
30
        </address>
28
31
      </author>
29
32
    </authorgroup>
30
33
    <copyright>
31
34
      <year>2008</year>
32
 
      <holder>Teddy Hogeborn &amp; Björn Påhlsson</holder>
 
35
      <year>2009</year>
 
36
      <year>2010</year>
 
37
      <year>2011</year>
 
38
      <year>2012</year>
 
39
      <year>2013</year>
 
40
      <year>2014</year>
 
41
      <year>2015</year>
 
42
      <year>2016</year>
 
43
      <year>2017</year>
 
44
      <year>2018</year>
 
45
      <holder>Teddy Hogeborn</holder>
 
46
      <holder>Björn Påhlsson</holder>
33
47
    </copyright>
34
 
    <legalnotice>
35
 
      <para>
36
 
        This manual page is free software: you can redistribute it
37
 
        and/or modify it under the terms of the GNU General Public
38
 
        License as published by the Free Software Foundation,
39
 
        either version 3 of the License, or (at your option) any
40
 
        later version.
41
 
      </para>
42
 
 
43
 
      <para>
44
 
        This manual page is distributed in the hope that it will
45
 
        be useful, but WITHOUT ANY WARRANTY; without even the
46
 
        implied warranty of MERCHANTABILITY or FITNESS FOR A
47
 
        PARTICULAR PURPOSE.  See the GNU General Public License
48
 
        for more details.
49
 
      </para>
50
 
 
51
 
      <para>
52
 
        You should have received a copy of the GNU General Public
53
 
        License along with this program; If not, see
54
 
        <ulink url="http://www.gnu.org/licenses/"/>.
55
 
      </para>
56
 
    </legalnotice>
 
48
    <xi:include href="legalnotice.xml"/>
57
49
  </refentryinfo>
58
 
 
 
50
  
59
51
  <refmeta>
60
52
    <refentrytitle>&COMMANDNAME;</refentrytitle>
61
53
    <manvolnum>8</manvolnum>
64
56
  <refnamediv>
65
57
    <refname><command>&COMMANDNAME;</command></refname>
66
58
    <refpurpose>
67
 
      Generate keys for <citerefentry><refentrytitle>password-request
68
 
      </refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
 
59
      Generate key and password for Mandos client and server.
69
60
    </refpurpose>
70
61
  </refnamediv>
71
 
 
 
62
  
72
63
  <refsynopsisdiv>
73
64
    <cmdsynopsis>
74
65
      <command>&COMMANDNAME;</command>
75
 
      <group choice="opt">
76
 
        <arg choice="plain"><option>--dir</option>
77
 
        <replaceable>directory</replaceable></arg>
78
 
      </group>
79
 
      <group choice="opt">
80
 
        <arg choice="plain"><option>--type</option>
81
 
        <replaceable>type</replaceable></arg>
82
 
      </group>
83
 
      <group choice="opt">
84
 
        <arg choice="plain"><option>--length</option>
85
 
        <replaceable>bits</replaceable></arg>
86
 
      </group>
87
 
      <group choice="opt">
88
 
        <arg choice="plain"><option>--name</option>
89
 
        <replaceable>NAME</replaceable></arg>
90
 
      </group>
91
 
      <group choice="opt">
92
 
        <arg choice="plain"><option>--email</option>
93
 
        <replaceable>EMAIL</replaceable></arg>
94
 
      </group>
95
 
      <group choice="opt">
96
 
        <arg choice="plain"><option>--comment</option>
97
 
        <replaceable>COMMENT</replaceable></arg>
98
 
      </group>
99
 
      <group choice="opt">
100
 
        <arg choice="plain"><option>--expire</option>
101
 
        <replaceable>TIME</replaceable></arg>
102
 
      </group>
103
 
      <group choice="opt">
 
66
      <group>
 
67
        <arg choice="plain"><option>--dir
 
68
        <replaceable>DIRECTORY</replaceable></option></arg>
 
69
        <arg choice="plain"><option>-d
 
70
        <replaceable>DIRECTORY</replaceable></option></arg>
 
71
      </group>
 
72
      <sbr/>
 
73
      <group>
 
74
        <arg choice="plain"><option>--type
 
75
        <replaceable>KEYTYPE</replaceable></option></arg>
 
76
        <arg choice="plain"><option>-t
 
77
        <replaceable>KEYTYPE</replaceable></option></arg>
 
78
      </group>
 
79
      <sbr/>
 
80
      <group>
 
81
        <arg choice="plain"><option>--length
 
82
        <replaceable>BITS</replaceable></option></arg>
 
83
        <arg choice="plain"><option>-l
 
84
        <replaceable>BITS</replaceable></option></arg>
 
85
      </group>
 
86
      <sbr/>
 
87
      <group>
 
88
        <arg choice="plain"><option>--subtype
 
89
        <replaceable>KEYTYPE</replaceable></option></arg>
 
90
        <arg choice="plain"><option>-s
 
91
        <replaceable>KEYTYPE</replaceable></option></arg>
 
92
      </group>
 
93
      <sbr/>
 
94
      <group>
 
95
        <arg choice="plain"><option>--sublength
 
96
        <replaceable>BITS</replaceable></option></arg>
 
97
        <arg choice="plain"><option>-L
 
98
        <replaceable>BITS</replaceable></option></arg>
 
99
      </group>
 
100
      <sbr/>
 
101
      <group>
 
102
        <arg choice="plain"><option>--name
 
103
        <replaceable>NAME</replaceable></option></arg>
 
104
        <arg choice="plain"><option>-n
 
105
        <replaceable>NAME</replaceable></option></arg>
 
106
      </group>
 
107
      <sbr/>
 
108
      <group>
 
109
        <arg choice="plain"><option>--email
 
110
        <replaceable>ADDRESS</replaceable></option></arg>
 
111
        <arg choice="plain"><option>-e
 
112
        <replaceable>ADDRESS</replaceable></option></arg>
 
113
      </group>
 
114
      <sbr/>
 
115
      <group>
 
116
        <arg choice="plain"><option>--comment
 
117
        <replaceable>TEXT</replaceable></option></arg>
 
118
        <arg choice="plain"><option>-c
 
119
        <replaceable>TEXT</replaceable></option></arg>
 
120
      </group>
 
121
      <sbr/>
 
122
      <group>
 
123
        <arg choice="plain"><option>--expire
 
124
        <replaceable>TIME</replaceable></option></arg>
 
125
        <arg choice="plain"><option>-x
 
126
        <replaceable>TIME</replaceable></option></arg>
 
127
      </group>
 
128
      <sbr/>
 
129
      <group>
 
130
        <arg choice="plain"><option>--tls-keytype
 
131
        <replaceable>KEYTYPE</replaceable></option></arg>
 
132
        <arg choice="plain"><option>-T
 
133
        <replaceable>KEYTYPE</replaceable></option></arg>
 
134
      </group>
 
135
      <sbr/>
 
136
      <group>
104
137
        <arg choice="plain"><option>--force</option></arg>
105
 
      </group>
106
 
    </cmdsynopsis>
107
 
    <cmdsynopsis>
108
 
      <command>&COMMANDNAME;</command>
109
 
      <group choice="opt">
110
 
        <arg choice="plain"><option>-d</option>
111
 
        <replaceable>directory</replaceable></arg>
112
 
      </group>
113
 
      <group choice="opt">
114
 
        <arg choice="plain"><option>-t</option>
115
 
        <replaceable>type</replaceable></arg>
116
 
      </group>
117
 
      <group choice="opt">
118
 
        <arg choice="plain"><option>-l</option>
119
 
        <replaceable>bits</replaceable></arg>
120
 
      </group>
121
 
      <group choice="opt">
122
 
        <arg choice="plain"><option>-n</option>
123
 
        <replaceable>NAME</replaceable></arg>
124
 
      </group>
125
 
      <group choice="opt">
126
 
        <arg choice="plain"><option>-e</option>
127
 
        <replaceable>EMAIL</replaceable></arg>
128
 
      </group>
129
 
      <group choice="opt">
130
 
        <arg choice="plain"><option>-c</option>
131
 
        <replaceable>COMMENT</replaceable></arg>
132
 
      </group>
133
 
      <group choice="opt">
134
 
        <arg choice="plain"><option>-x</option>
135
 
        <replaceable>TIME</replaceable></arg>
136
 
      </group>
137
 
      <group choice="opt">
138
138
        <arg choice="plain"><option>-f</option></arg>
139
139
      </group>
140
140
    </cmdsynopsis>
141
141
    <cmdsynopsis>
142
142
      <command>&COMMANDNAME;</command>
143
143
      <group choice="req">
144
 
        <arg choice='plain'><option>-h</option></arg>
145
 
        <arg choice='plain'><option>--help</option></arg>
146
 
      </group>
147
 
    </cmdsynopsis>
148
 
    <cmdsynopsis>
149
 
      <command>&COMMANDNAME;</command>
150
 
      <group choice="req">
151
 
        <arg choice='plain'><option>-v</option></arg>
152
 
        <arg choice='plain'><option>--version</option></arg>
 
144
        <arg choice="plain"><option>--password</option></arg>
 
145
        <arg choice="plain"><option>-p</option></arg>
 
146
        <arg choice="plain"><option>--passfile
 
147
        <replaceable>FILE</replaceable></option></arg>
 
148
        <arg choice="plain"><option>-F</option>
 
149
        <replaceable>FILE</replaceable></arg>
 
150
      </group>
 
151
      <sbr/>
 
152
      <group>
 
153
        <arg choice="plain"><option>--dir
 
154
        <replaceable>DIRECTORY</replaceable></option></arg>
 
155
        <arg choice="plain"><option>-d
 
156
        <replaceable>DIRECTORY</replaceable></option></arg>
 
157
      </group>
 
158
      <sbr/>
 
159
      <group>
 
160
        <arg choice="plain"><option>--name
 
161
        <replaceable>NAME</replaceable></option></arg>
 
162
        <arg choice="plain"><option>-n
 
163
        <replaceable>NAME</replaceable></option></arg>
 
164
      </group>
 
165
      <group>
 
166
        <arg choice="plain"><option>--no-ssh</option></arg>
 
167
        <arg choice="plain"><option>-S</option></arg>
 
168
      </group>
 
169
    </cmdsynopsis>
 
170
    <cmdsynopsis>
 
171
      <command>&COMMANDNAME;</command>
 
172
      <group choice="req">
 
173
        <arg choice="plain"><option>--help</option></arg>
 
174
        <arg choice="plain"><option>-h</option></arg>
 
175
      </group>
 
176
    </cmdsynopsis>
 
177
    <cmdsynopsis>
 
178
      <command>&COMMANDNAME;</command>
 
179
      <group choice="req">
 
180
        <arg choice="plain"><option>--version</option></arg>
 
181
        <arg choice="plain"><option>-v</option></arg>
153
182
      </group>
154
183
    </cmdsynopsis>
155
184
  </refsynopsisdiv>
156
 
 
 
185
  
157
186
  <refsect1 id="description">
158
187
    <title>DESCRIPTION</title>
159
188
    <para>
160
189
      <command>&COMMANDNAME;</command> is a program to generate the
161
 
      OpenPGP keys used by
162
 
      <citerefentry><refentrytitle>password-request</refentrytitle>
 
190
      TLS and OpenPGP keys used by
 
191
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
163
192
      <manvolnum>8mandos</manvolnum></citerefentry>.  The keys are
164
 
      normally written to /etc/mandos for later installation into the
165
 
      initrd image, but this, like most things, can be changed with
166
 
      command line options.
 
193
      normally written to /etc/keys/mandos for later installation into
 
194
      the initrd image, but this, and most other things, can be
 
195
      changed with command line options.
 
196
    </para>
 
197
    <para>
 
198
      This program can also be used with the
 
199
      <option>--password</option> or <option>--passfile</option>
 
200
      options to generate a ready-made section for
 
201
      <filename>clients.conf</filename> (see
 
202
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
 
203
      <manvolnum>5</manvolnum></citerefentry>).
167
204
    </para>
168
205
  </refsect1>
169
206
  
170
207
  <refsect1 id="purpose">
171
208
    <title>PURPOSE</title>
172
 
 
173
209
    <para>
174
210
      The purpose of this is to enable <emphasis>remote and unattended
175
211
      rebooting</emphasis> of client host computer with an
176
212
      <emphasis>encrypted root file system</emphasis>.  See <xref
177
213
      linkend="overview"/> for details.
178
214
    </para>
179
 
 
180
215
  </refsect1>
181
216
  
182
217
  <refsect1 id="options">
183
218
    <title>OPTIONS</title>
184
 
 
 
219
    
185
220
    <variablelist>
186
221
      <varlistentry>
187
 
        <term><literal>-h</literal>, <literal>--help</literal></term>
 
222
        <term><option>--help</option></term>
 
223
        <term><option>-h</option></term>
188
224
        <listitem>
189
225
          <para>
190
226
            Show a help message and exit
191
227
          </para>
192
228
        </listitem>
193
229
      </varlistentry>
194
 
 
195
 
      <varlistentry>
196
 
        <term><literal>-d</literal>, <literal>--dir
197
 
        <replaceable>directory</replaceable></literal></term>
198
 
        <listitem>
199
 
          <para>
200
 
            Target directory for key files.
201
 
          </para>
202
 
        </listitem>
203
 
      </varlistentry>
204
 
 
205
 
      <varlistentry>
206
 
        <term><literal>-t</literal>, <literal>--type
207
 
        <replaceable>type</replaceable></literal></term>
208
 
        <listitem>
209
 
          <para>
210
 
            Key type.  Default is DSA.
211
 
          </para>
212
 
        </listitem>
213
 
      </varlistentry>
214
 
 
215
 
      <varlistentry>
216
 
        <term><literal>-l</literal>, <literal>--length
217
 
        <replaceable>bits</replaceable></literal></term>
218
 
        <listitem>
219
 
          <para>
220
 
            Key length in bits.  Default is 1024.
221
 
          </para>
222
 
        </listitem>
223
 
      </varlistentry>
224
 
 
225
 
      <varlistentry>
226
 
        <term><literal>-e</literal>, <literal>--email</literal>
227
 
        <replaceable>address</replaceable></term>
 
230
      
 
231
      <varlistentry>
 
232
        <term><option>--dir
 
233
        <replaceable>DIRECTORY</replaceable></option></term>
 
234
        <term><option>-d
 
235
        <replaceable>DIRECTORY</replaceable></option></term>
 
236
        <listitem>
 
237
          <para>
 
238
            Target directory for key files.  Default is <filename
 
239
            class="directory">/etc/keys/mandos</filename>.
 
240
          </para>
 
241
        </listitem>
 
242
      </varlistentry>
 
243
      
 
244
      <varlistentry>
 
245
        <term><option>--type
 
246
        <replaceable>TYPE</replaceable></option></term>
 
247
        <term><option>-t
 
248
        <replaceable>TYPE</replaceable></option></term>
 
249
        <listitem>
 
250
          <para>
 
251
            OpenPGP key type.  Default is <quote>RSA</quote>.
 
252
          </para>
 
253
        </listitem>
 
254
      </varlistentry>
 
255
      
 
256
      <varlistentry>
 
257
        <term><option>--length
 
258
        <replaceable>BITS</replaceable></option></term>
 
259
        <term><option>-l
 
260
        <replaceable>BITS</replaceable></option></term>
 
261
        <listitem>
 
262
          <para>
 
263
            OpenPGP key length in bits.  Default is 4096.
 
264
          </para>
 
265
        </listitem>
 
266
      </varlistentry>
 
267
      
 
268
      <varlistentry>
 
269
        <term><option>--subtype
 
270
        <replaceable>KEYTYPE</replaceable></option></term>
 
271
        <term><option>-s
 
272
        <replaceable>KEYTYPE</replaceable></option></term>
 
273
        <listitem>
 
274
          <para>
 
275
            OpenPGP subkey type.  Default is <quote>RSA</quote>
 
276
          </para>
 
277
        </listitem>
 
278
      </varlistentry>
 
279
      
 
280
      <varlistentry>
 
281
        <term><option>--sublength
 
282
        <replaceable>BITS</replaceable></option></term>
 
283
        <term><option>-L
 
284
        <replaceable>BITS</replaceable></option></term>
 
285
        <listitem>
 
286
          <para>
 
287
            OpenPGP subkey length in bits.  Default is 4096.
 
288
          </para>
 
289
        </listitem>
 
290
      </varlistentry>
 
291
      
 
292
      <varlistentry>
 
293
        <term><option>--email
 
294
        <replaceable>ADDRESS</replaceable></option></term>
 
295
        <term><option>-e
 
296
        <replaceable>ADDRESS</replaceable></option></term>
228
297
        <listitem>
229
298
          <para>
230
299
            Email address of key.  Default is empty.
231
300
          </para>
232
301
        </listitem>
233
302
      </varlistentry>
234
 
 
 
303
      
235
304
      <varlistentry>
236
 
        <term><literal>-c</literal>, <literal>--comment</literal>
237
 
        <replaceable>comment</replaceable></term>
 
305
        <term><option>--comment
 
306
        <replaceable>TEXT</replaceable></option></term>
 
307
        <term><option>-c
 
308
        <replaceable>TEXT</replaceable></option></term>
238
309
        <listitem>
239
310
          <para>
240
 
            Comment field for key.  The default value is
241
 
            "<literal>Mandos client key</literal>".
 
311
            Comment field for key.  Default is empty.
242
312
          </para>
243
313
        </listitem>
244
314
      </varlistentry>
245
 
 
 
315
      
246
316
      <varlistentry>
247
 
        <term><literal>-x</literal>, <literal>--expire</literal>
248
 
        <replaceable>time</replaceable></term>
 
317
        <term><option>--expire
 
318
        <replaceable>TIME</replaceable></option></term>
 
319
        <term><option>-x
 
320
        <replaceable>TIME</replaceable></option></term>
249
321
        <listitem>
250
322
          <para>
251
323
            Key expire time.  Default is no expiration.  See
254
326
          </para>
255
327
        </listitem>
256
328
      </varlistentry>
257
 
 
258
 
      <varlistentry>
259
 
        <term><literal>-f</literal>, <literal>--force</literal></term>
260
 
        <listitem>
261
 
          <para>
262
 
            Force overwriting old keys.
 
329
      
 
330
      <varlistentry>
 
331
        <term><option>--tls-keytype
 
332
        <replaceable>KEYTYPE</replaceable></option></term>
 
333
        <term><option>-T
 
334
        <replaceable>KEYTYPE</replaceable></option></term>
 
335
        <listitem>
 
336
          <para>
 
337
            TLS key type.  Default is <quote>ed25519</quote>
 
338
          </para>
 
339
        </listitem>
 
340
      </varlistentry>
 
341
      
 
342
      <varlistentry>
 
343
        <term><option>--force</option></term>
 
344
        <term><option>-f</option></term>
 
345
        <listitem>
 
346
          <para>
 
347
            Force overwriting old key.
 
348
          </para>
 
349
        </listitem>
 
350
      </varlistentry>
 
351
      <varlistentry>
 
352
        <term><option>--password</option></term>
 
353
        <term><option>-p</option></term>
 
354
        <listitem>
 
355
          <para>
 
356
            Prompt for a password and encrypt it with the key already
 
357
            present in either <filename>/etc/keys/mandos</filename> or
 
358
            the directory specified with the <option>--dir</option>
 
359
            option.  Outputs, on standard output, a section suitable
 
360
            for inclusion in <citerefentry><refentrytitle
 
361
            >mandos-clients.conf</refentrytitle><manvolnum
 
362
            >8</manvolnum></citerefentry>.  The host name or the name
 
363
            specified with the <option>--name</option> option is used
 
364
            for the section header.  All other options are ignored,
 
365
            and no key is created.
 
366
          </para>
 
367
        </listitem>
 
368
      </varlistentry>
 
369
      <varlistentry>
 
370
        <term><option>--passfile
 
371
        <replaceable>FILE</replaceable></option></term>
 
372
        <term><option>-F
 
373
        <replaceable>FILE</replaceable></option></term>
 
374
        <listitem>
 
375
          <para>
 
376
            The same as <option>--password</option>, but read from
 
377
            <replaceable>FILE</replaceable>, not the terminal.
 
378
          </para>
 
379
        </listitem>
 
380
      </varlistentry>
 
381
      <varlistentry>
 
382
        <term><option>--no-ssh</option></term>
 
383
        <term><option>-S</option></term>
 
384
        <listitem>
 
385
          <para>
 
386
            When <option>--password</option> or
 
387
            <option>--passfile</option> is given, this option will
 
388
            prevent <command>&COMMANDNAME;</command> from calling
 
389
            <command>ssh-keyscan</command> to get an SSH fingerprint
 
390
            for this host and, if successful, output suitable config
 
391
            options to use this fingerprint as a
 
392
            <option>checker</option> option in the output.  This is
 
393
            otherwise the default behavior.
263
394
          </para>
264
395
        </listitem>
265
396
      </varlistentry>
266
397
    </variablelist>
267
398
  </refsect1>
268
 
 
 
399
  
269
400
  <refsect1 id="overview">
270
401
    <title>OVERVIEW</title>
271
402
    <xi:include href="overview.xml"/>
272
403
    <para>
273
 
      This program is a small program to generate new OpenPGP keys for
274
 
      new Mandos clients.
 
404
      This program is a small utility to generate new TLS and OpenPGP
 
405
      keys for new Mandos clients, and to generate sections for
 
406
      inclusion in <filename>clients.conf</filename> on the server.
275
407
    </para>
276
408
  </refsect1>
277
 
 
 
409
  
278
410
  <refsect1 id="exit_status">
279
411
    <title>EXIT STATUS</title>
280
412
    <para>
281
 
      The exit status will be 0 if new keys were successfully created,
282
 
      otherwise not.
 
413
      The exit status will be 0 if a new key (or password, if the
 
414
      <option>--password</option> option was used) was successfully
 
415
      created, otherwise not.
283
416
    </para>
284
417
  </refsect1>
285
418
  
287
420
    <title>ENVIRONMENT</title>
288
421
    <variablelist>
289
422
      <varlistentry>
290
 
        <term><varname>TMPDIR</varname></term>
 
423
        <term><envar>TMPDIR</envar></term>
291
424
        <listitem>
292
425
          <para>
293
426
            If set, temporary files will be created here. See
299
432
    </variablelist>
300
433
  </refsect1>
301
434
  
302
 
  <refsect1 id="file">
 
435
  <refsect1 id="files">
303
436
    <title>FILES</title>
304
437
    <para>
305
438
      Use the <option>--dir</option> option to change where
308
441
    </para>
309
442
    <variablelist>
310
443
      <varlistentry>
311
 
        <term><filename>/etc/mandos/seckey.txt</filename></term>
 
444
        <term><filename>/etc/keys/mandos/seckey.txt</filename></term>
312
445
        <listitem>
313
446
          <para>
314
447
            OpenPGP secret key file which will be created or
317
450
        </listitem>
318
451
      </varlistentry>
319
452
      <varlistentry>
320
 
        <term><filename>/etc/mandos/pubkey.txt</filename></term>
 
453
        <term><filename>/etc/keys/mandos/pubkey.txt</filename></term>
321
454
        <listitem>
322
455
          <para>
323
456
            OpenPGP public key file which will be created or
326
459
        </listitem>
327
460
      </varlistentry>
328
461
      <varlistentry>
329
 
        <term><filename>/tmp</filename></term>
 
462
        <term><filename>/etc/keys/mandos/tls-privkey.pem</filename></term>
 
463
        <listitem>
 
464
          <para>
 
465
            Private key file which will be created or overwritten.
 
466
          </para>
 
467
        </listitem>
 
468
      </varlistentry>
 
469
      <varlistentry>
 
470
        <term><filename>/etc/keys/mandos/tls-pubkey.pem</filename></term>
 
471
        <listitem>
 
472
          <para>
 
473
            Public key file which will be created or overwritten.
 
474
          </para>
 
475
        </listitem>
 
476
      </varlistentry>
 
477
      <varlistentry>
 
478
        <term><filename class="directory">/tmp</filename></term>
330
479
        <listitem>
331
480
          <para>
332
481
            Temporary files will be written here if
336
485
      </varlistentry>
337
486
    </variablelist>
338
487
  </refsect1>
339
 
 
 
488
  
340
489
  <refsect1 id="bugs">
341
490
    <title>BUGS</title>
342
 
    <para>
343
 
      None are known at this time.
344
 
    </para>
 
491
    <xi:include href="bugs.xml"/>
345
492
  </refsect1>
346
 
 
 
493
  
347
494
  <refsect1 id="example">
348
495
    <title>EXAMPLE</title>
349
496
    <informalexample>
351
498
        Normal invocation needs no options:
352
499
      </para>
353
500
      <para>
354
 
        <userinput>mandos-keygen</userinput>
 
501
        <userinput>&COMMANDNAME;</userinput>
355
502
      </para>
356
503
    </informalexample>
357
504
    <informalexample>
358
505
      <para>
359
 
        Create keys in another directory and of another type.  Force
 
506
        Create key in another directory and of another type.  Force
360
507
        overwriting old key files:
361
508
      </para>
362
509
      <para>
363
510
 
364
511
<!-- do not wrap this line -->
365
 
<userinput>mandos-keygen --dir ~/keydir --type RSA --force</userinput>
 
512
<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>
 
513
 
 
514
      </para>
 
515
    </informalexample>
 
516
    <informalexample>
 
517
      <para>
 
518
        Prompt for a password, encrypt it with the keys in <filename
 
519
        class="directory">/etc/keys/mandos</filename> and output a
 
520
        section suitable for <filename>clients.conf</filename>.
 
521
      </para>
 
522
      <para>
 
523
        <userinput>&COMMANDNAME; --password</userinput>
 
524
      </para>
 
525
    </informalexample>
 
526
    <informalexample>
 
527
      <para>
 
528
        Prompt for a password, encrypt it with the keys in the
 
529
        <filename>client-key</filename> directory and output a section
 
530
        suitable for <filename>clients.conf</filename>.
 
531
      </para>
 
532
      <para>
 
533
 
 
534
<!-- do not wrap this line -->
 
535
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
366
536
 
367
537
      </para>
368
538
    </informalexample>
369
539
  </refsect1>
370
 
 
 
540
  
371
541
  <refsect1 id="security">
372
542
    <title>SECURITY</title>
373
543
    <para>
374
 
      The <option>--type</option> and <option>--length</option>
375
 
      options can be used to create keys of insufficient security.  If
376
 
      in doubt, leave them to the default values.
 
544
      The <option>--type</option>, <option>--length</option>,
 
545
      <option>--subtype</option>, and <option>--sublength</option>
 
546
      options can be used to create keys of low security.  If in
 
547
      doubt, leave them to the default values.
377
548
    </para>
378
549
    <para>
379
 
      The key expire time is not guaranteed to be honored by
380
 
      <citerefentry><refentrytitle>mandos</refentrytitle>
 
550
      The key expire time is <emphasis>not</emphasis> guaranteed to be
 
551
      honored by <citerefentry><refentrytitle>mandos</refentrytitle>
381
552
      <manvolnum>8</manvolnum></citerefentry>.
382
553
    </para>
383
554
  </refsect1>
384
 
 
 
555
  
385
556
  <refsect1 id="see_also">
386
557
    <title>SEE ALSO</title>
387
558
    <para>
388
 
      <citerefentry><refentrytitle>password-request</refentrytitle>
 
559
      <citerefentry><refentrytitle>intro</refentrytitle>
389
560
      <manvolnum>8mandos</manvolnum></citerefentry>,
 
561
      <citerefentry><refentrytitle>gpg</refentrytitle>
 
562
      <manvolnum>1</manvolnum></citerefentry>,
 
563
      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
 
564
      <manvolnum>5</manvolnum></citerefentry>,
390
565
      <citerefentry><refentrytitle>mandos</refentrytitle>
391
566
      <manvolnum>8</manvolnum></citerefentry>,
392
 
      <citerefentry><refentrytitle>gpg</refentrytitle>
 
567
      <citerefentry><refentrytitle>mandos-client</refentrytitle>
 
568
      <manvolnum>8mandos</manvolnum></citerefentry>,
 
569
      <citerefentry><refentrytitle>ssh-keyscan</refentrytitle>
393
570
      <manvolnum>1</manvolnum></citerefentry>
394
571
    </para>
395
572
  </refsect1>
396
573
  
397
574
</refentry>
 
575
<!-- Local Variables: -->
 
576
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
 
577
<!-- time-stamp-end: "[\"']>" -->
 
578
<!-- time-stamp-format: "%:y-%02m-%02d" -->
 
579
<!-- End: -->