1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
<!ENTITY VERSION "1.0">
4
5
<!ENTITY COMMANDNAME "mandos-keygen">
5
<!ENTITY TIMESTAMP "2017-02-23">
6
<!ENTITY % common SYSTEM "common.ent">
10
8
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
12
<title>Mandos Manual</title>
10
<title>&COMMANDNAME;</title>
13
11
<!-- NWalsh’s docbook scripts use this to generate the footer: -->
14
<productname>Mandos</productname>
15
<productnumber>&version;</productnumber>
16
<date>&TIMESTAMP;</date>
12
<productname>&COMMANDNAME;</productname>
13
<productnumber>&VERSION;</productnumber>
19
16
<firstname>Björn</firstname>
20
17
<surname>Påhlsson</surname>
22
<email>belorn@recompile.se</email>
19
<email>belorn@fukt.bsnet.se</email>
26
23
<firstname>Teddy</firstname>
27
24
<surname>Hogeborn</surname>
29
<email>teddy@recompile.se</email>
26
<email>teddy@fukt.bsnet.se</email>
44
32
<holder>Teddy Hogeborn</holder>
45
33
<holder>Björn Påhlsson</holder>
47
<xi:include href="legalnotice.xml"/>
37
This manual page is free software: you can redistribute it
38
and/or modify it under the terms of the GNU General Public
39
License as published by the Free Software Foundation,
40
either version 3 of the License, or (at your option) any
45
This manual page is distributed in the hope that it will
46
be useful, but WITHOUT ANY WARRANTY; without even the
47
implied warranty of MERCHANTABILITY or FITNESS FOR A
48
PARTICULAR PURPOSE. See the GNU General Public License
53
You should have received a copy of the GNU General Public
54
License along with this program; If not, see
55
<ulink url="http://www.gnu.org/licenses/"/>.
51
61
<refentrytitle>&COMMANDNAME;</refentrytitle>
52
62
<manvolnum>8</manvolnum>
56
66
<refname><command>&COMMANDNAME;</command></refname>
58
Generate key and password for Mandos client and server.
68
Generate keys for <citerefentry><refentrytitle>password-request
69
</refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
64
75
<command>&COMMANDNAME;</command>
66
<arg choice="plain"><option>--dir
67
<replaceable>DIRECTORY</replaceable></option></arg>
68
<arg choice="plain"><option>-d
69
<replaceable>DIRECTORY</replaceable></option></arg>
73
<arg choice="plain"><option>--type
74
<replaceable>KEYTYPE</replaceable></option></arg>
75
<arg choice="plain"><option>-t
76
<replaceable>KEYTYPE</replaceable></option></arg>
80
<arg choice="plain"><option>--length
81
<replaceable>BITS</replaceable></option></arg>
82
<arg choice="plain"><option>-l
83
<replaceable>BITS</replaceable></option></arg>
87
<arg choice="plain"><option>--subtype
88
<replaceable>KEYTYPE</replaceable></option></arg>
89
<arg choice="plain"><option>-s
90
<replaceable>KEYTYPE</replaceable></option></arg>
94
<arg choice="plain"><option>--sublength
95
<replaceable>BITS</replaceable></option></arg>
96
<arg choice="plain"><option>-L
97
<replaceable>BITS</replaceable></option></arg>
101
<arg choice="plain"><option>--name
102
<replaceable>NAME</replaceable></option></arg>
103
<arg choice="plain"><option>-n
104
<replaceable>NAME</replaceable></option></arg>
108
<arg choice="plain"><option>--email
109
<replaceable>ADDRESS</replaceable></option></arg>
110
<arg choice="plain"><option>-e
111
<replaceable>ADDRESS</replaceable></option></arg>
115
<arg choice="plain"><option>--comment
116
<replaceable>TEXT</replaceable></option></arg>
117
<arg choice="plain"><option>-c
118
<replaceable>TEXT</replaceable></option></arg>
122
<arg choice="plain"><option>--expire
123
<replaceable>TIME</replaceable></option></arg>
124
<arg choice="plain"><option>-x
125
<replaceable>TIME</replaceable></option></arg>
77
<arg choice="plain"><option>--dir</option>
78
<replaceable>directory</replaceable></arg>
81
<arg choice="plain"><option>--type</option>
82
<replaceable>type</replaceable></arg>
85
<arg choice="plain"><option>--length</option>
86
<replaceable>bits</replaceable></arg>
89
<arg choice="plain"><option>--subtype</option>
90
<replaceable>type</replaceable></arg>
93
<arg choice="plain"><option>--sublength</option>
94
<replaceable>bits</replaceable></arg>
97
<arg choice="plain"><option>--name</option>
98
<replaceable>NAME</replaceable></arg>
101
<arg choice="plain"><option>--email</option>
102
<replaceable>EMAIL</replaceable></arg>
105
<arg choice="plain"><option>--comment</option>
106
<replaceable>COMMENT</replaceable></arg>
109
<arg choice="plain"><option>--expire</option>
110
<replaceable>TIME</replaceable></arg>
129
113
<arg choice="plain"><option>--force</option></arg>
117
<command>&COMMANDNAME;</command>
119
<arg choice="plain"><option>-d</option>
120
<replaceable>directory</replaceable></arg>
123
<arg choice="plain"><option>-t</option>
124
<replaceable>type</replaceable></arg>
127
<arg choice="plain"><option>-l</option>
128
<replaceable>bits</replaceable></arg>
131
<arg choice="plain"><option>-s</option>
132
<replaceable>type</replaceable></arg>
135
<arg choice="plain"><option>-L</option>
136
<replaceable>bits</replaceable></arg>
139
<arg choice="plain"><option>-n</option>
140
<replaceable>NAME</replaceable></arg>
143
<arg choice="plain"><option>-e</option>
144
<replaceable>EMAIL</replaceable></arg>
147
<arg choice="plain"><option>-c</option>
148
<replaceable>COMMENT</replaceable></arg>
151
<arg choice="plain"><option>-x</option>
152
<replaceable>TIME</replaceable></arg>
130
155
<arg choice="plain"><option>-f</option></arg>
134
159
<command>&COMMANDNAME;</command>
135
160
<group choice="req">
161
<arg choice="plain"><option>-p</option></arg>
136
162
<arg choice="plain"><option>--password</option></arg>
137
<arg choice="plain"><option>-p</option></arg>
138
<arg choice="plain"><option>--passfile
139
<replaceable>FILE</replaceable></option></arg>
140
<arg choice="plain"><option>-F</option>
141
<replaceable>FILE</replaceable></arg>
145
<arg choice="plain"><option>--dir
146
<replaceable>DIRECTORY</replaceable></option></arg>
147
<arg choice="plain"><option>-d
148
<replaceable>DIRECTORY</replaceable></option></arg>
152
<arg choice="plain"><option>--name
153
<replaceable>NAME</replaceable></option></arg>
154
<arg choice="plain"><option>-n
155
<replaceable>NAME</replaceable></option></arg>
158
<arg choice="plain"><option>--no-ssh</option></arg>
159
<arg choice="plain"><option>-S</option></arg>
165
<arg choice="plain"><option>--dir</option>
166
<replaceable>directory</replaceable></arg>
169
<arg choice="plain"><option>--name</option>
170
<replaceable>NAME</replaceable></arg>
163
174
<command>&COMMANDNAME;</command>
164
175
<group choice="req">
176
<arg choice="plain"><option>-h</option></arg>
165
177
<arg choice="plain"><option>--help</option></arg>
166
<arg choice="plain"><option>-h</option></arg>
170
181
<command>&COMMANDNAME;</command>
171
182
<group choice="req">
183
<arg choice="plain"><option>-v</option></arg>
172
184
<arg choice="plain"><option>--version</option></arg>
173
<arg choice="plain"><option>-v</option></arg>
176
187
</refsynopsisdiv>
178
189
<refsect1 id="description">
179
190
<title>DESCRIPTION</title>
181
192
<command>&COMMANDNAME;</command> is a program to generate the
183
<citerefentry><refentrytitle>mandos-client</refentrytitle>
184
<manvolnum>8mandos</manvolnum></citerefentry>. The key is
194
<citerefentry><refentrytitle>password-request</refentrytitle>
195
<manvolnum>8mandos</manvolnum></citerefentry>. The keys are
185
196
normally written to /etc/mandos for later installation into the
186
initrd image, but this, and most other things, can be changed
187
with command line options.
197
initrd image, but this, like most things, can be changed with
198
command line options.
190
This program can also be used with the
191
<option>--password</option> or <option>--passfile</option>
192
options to generate a ready-made section for
193
<filename>clients.conf</filename> (see
201
It can also be used to generate ready-made sections for
194
202
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
195
<manvolnum>5</manvolnum></citerefentry>).
203
<manvolnum>5</manvolnum></citerefentry> using the
204
<option>--password</option> option.
199
208
<refsect1 id="purpose">
200
209
<title>PURPOSE</title>
202
212
The purpose of this is to enable <emphasis>remote and unattended
203
213
rebooting</emphasis> of client host computer with an
204
214
<emphasis>encrypted root file system</emphasis>. See <xref
205
215
linkend="overview"/> for details.
209
220
<refsect1 id="options">
210
221
<title>OPTIONS</title>
214
<term><option>--help</option></term>
215
<term><option>-h</option></term>
225
<term><literal>-h</literal>, <literal>--help</literal></term>
218
228
Show a help message and exit
225
<replaceable>DIRECTORY</replaceable></option></term>
227
<replaceable>DIRECTORY</replaceable></option></term>
234
<term><literal>-d</literal>, <literal>--dir
235
<replaceable>directory</replaceable></literal></term>
230
238
Target directory for key files. Default is
231
<filename class="directory">/etc/mandos</filename>.
238
<replaceable>TYPE</replaceable></option></term>
240
<replaceable>TYPE</replaceable></option></term>
243
Key type. Default is <quote>RSA</quote>.
249
<term><option>--length
250
<replaceable>BITS</replaceable></option></term>
252
<replaceable>BITS</replaceable></option></term>
255
Key length in bits. Default is 4096.
261
<term><option>--subtype
262
<replaceable>KEYTYPE</replaceable></option></term>
264
<replaceable>KEYTYPE</replaceable></option></term>
267
Subkey type. Default is <quote>RSA</quote> (Elgamal
239
<filename>/etc/mandos</filename>.
245
<term><literal>-t</literal>, <literal>--type
246
<replaceable>type</replaceable></literal></term>
249
Key type. Default is <quote>DSA</quote>.
255
<term><literal>-l</literal>, <literal>--length
256
<replaceable>bits</replaceable></literal></term>
259
Key length in bits. Default is 1024.
265
<term><literal>-s</literal>, <literal>--subtype
266
<replaceable>type</replaceable></literal></term>
269
Subkey type. Default is <quote>ELG-E</quote> (Elgamal
268
270
encryption-only).
274
<term><option>--sublength
275
<replaceable>BITS</replaceable></option></term>
277
<replaceable>BITS</replaceable></option></term>
276
<term><literal>-L</literal>, <literal>--sublength
277
<replaceable>bits</replaceable></literal></term>
280
Subkey length in bits. Default is 4096.
280
Subkey length in bits. Default is 2048.
286
<term><option>--email
287
<replaceable>ADDRESS</replaceable></option></term>
289
<replaceable>ADDRESS</replaceable></option></term>
286
<term><literal>-e</literal>, <literal>--email</literal>
287
<replaceable>address</replaceable></term>
292
290
Email address of key. Default is empty.
298
<term><option>--comment
299
<replaceable>TEXT</replaceable></option></term>
301
<replaceable>TEXT</replaceable></option></term>
296
<term><literal>-c</literal>, <literal>--comment</literal>
297
<replaceable>comment</replaceable></term>
304
Comment field for key. Default is empty.
300
Comment field for key. The default value is
301
<quote><literal>Mandos client key</literal></quote>.
310
<term><option>--expire
311
<replaceable>TIME</replaceable></option></term>
313
<replaceable>TIME</replaceable></option></term>
307
<term><literal>-x</literal>, <literal>--expire</literal>
308
<replaceable>time</replaceable></term>
316
311
Key expire time. Default is no expiration. See
463
429
Normal invocation needs no options:
466
<userinput>&COMMANDNAME;</userinput>
432
<userinput>mandos-keygen</userinput>
468
434
</informalexample>
469
435
<informalexample>
471
Create key in another directory and of another type. Force
437
Create keys in another directory and of another type. Force
472
438
overwriting old key files:
476
442
<!-- do not wrap this line -->
477
<userinput>&COMMANDNAME; --dir ~/keydir --type RSA --force</userinput>
483
Prompt for a password, encrypt it with the key in <filename
484
class="directory">/etc/mandos</filename> and output a section
485
suitable for <filename>clients.conf</filename>.
488
<userinput>&COMMANDNAME; --password</userinput>
493
Prompt for a password, encrypt it with the key in the
494
<filename>client-key</filename> directory and output a section
495
suitable for <filename>clients.conf</filename>.
499
<!-- do not wrap this line -->
500
<userinput>&COMMANDNAME; --password --dir client-key</userinput>
443
<userinput>mandos-keygen --dir ~/keydir --type RSA --force</userinput>
503
446
</informalexample>
506
449
<refsect1 id="security">
507
450
<title>SECURITY</title>
509
452
The <option>--type</option>, <option>--length</option>,
510
453
<option>--subtype</option>, and <option>--sublength</option>
511
options can be used to create keys of low security. If in
512
doubt, leave them to the default values.
454
options can be used to create keys of insufficient security. If
455
in doubt, leave them to the default values.
515
The key expire time is <emphasis>not</emphasis> guaranteed to be
516
honored by <citerefentry><refentrytitle>mandos</refentrytitle>
458
The key expire time is not guaranteed to be honored by
459
<citerefentry><refentrytitle>mandos</refentrytitle>
517
460
<manvolnum>8</manvolnum></citerefentry>.
521
464
<refsect1 id="see_also">
522
465
<title>SEE ALSO</title>
524
<citerefentry><refentrytitle>intro</refentrytitle>
467
<citerefentry><refentrytitle>password-request</refentrytitle>
525
468
<manvolnum>8mandos</manvolnum></citerefentry>,
469
<citerefentry><refentrytitle>mandos</refentrytitle>
470
<manvolnum>8</manvolnum></citerefentry>,
526
471
<citerefentry><refentrytitle>gpg</refentrytitle>
527
<manvolnum>1</manvolnum></citerefentry>,
528
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
529
<manvolnum>5</manvolnum></citerefentry>,
530
<citerefentry><refentrytitle>mandos</refentrytitle>
531
<manvolnum>8</manvolnum></citerefentry>,
532
<citerefentry><refentrytitle>mandos-client</refentrytitle>
533
<manvolnum>8mandos</manvolnum></citerefentry>,
534
<citerefentry><refentrytitle>ssh-keyscan</refentrytitle>
535
472
<manvolnum>1</manvolnum></citerefentry>
540
<!-- Local Variables: -->
541
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
542
<!-- time-stamp-end: "[\"']>" -->
543
<!-- time-stamp-format: "%:y-%02m-%02d" -->