doc/manpage.d/ipsec_newhostkey.8.html

   1 Content-type: text/html
   2
   3 <HTML><HEAD><TITLE>Manpage of IPSEC_NEWHOSTKEY</TITLE>
   4 </HEAD><BODY>
   5 <H1>IPSEC_NEWHOSTKEY</H1>
   6 Section: Maintenance Commands (8)<BR>Updated: 4 March 2002<BR><A HREF="#index">Index</A>
   7 <A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
   8
   9
  10 <A NAME="lbAB">&nbsp;</A>
  11 <H2>NAME</H2>
  12
  13 ipsec newhostkey - generate a new host authentication key
  14 <A NAME="lbAC">&nbsp;</A>
  15 <H2>SYNOPSIS</H2>
  16
  17 <B>ipsec</B>
  18
  19 <B>newhostkey</B>
  20
  21 <B>--output</B>
  22
  23 filename
  24 [
  25 <B>--quiet</B>
  26
  27 ]
  28 <B>\</B>
  29
  30 <BR>
  31
  32
  33 [
  34 <B>--bits</B>
  35
  36 n
  37 ]
  38 [
  39 <B>--hostname</B>
  40
  41 host
  42 ]
  43 <A NAME="lbAD">&nbsp;</A>
  44 <H2>DESCRIPTION</H2>
  45
  46 <I>Newhostkey</I>
  47
  48 outputs (into
  49 <I>filename</I>,
  50
  51 which can be `<B>-</B>' for standard output)
  52 an RSA private key suitable for this host,
  53 in
  54 <I>/etc/ipsec.secrets</I>
  55
  56 format
  57 (see
  58 <I><A HREF="ipsec.secrets.5.html">ipsec.secrets</A></I>(5)).
  59
  60 Normally,
  61 <I>newhostkey</I>
  62
  63 invokes
  64 <I>rsasigkey</I>
  65
  66 (see
  67 <I><A HREF="ipsec_rsasigkey.8.html">ipsec_rsasigkey</A></I>(8))
  68
  69 with the
  70 <B>--verbose</B>
  71
  72 option, so a narrative of what is being done appears on standard error.
  73 <P>
  74
  75 The
  76 <B>--output</B>
  77
  78 specifier, although it is syntactically an option and can appear at
  79 any point among the options (it doesn't have to be first),
  80 is not optional.
  81 The specified
  82 <I>filename</I>
  83
  84 is created under umask
  85 <B>077</B>
  86
  87 if nonexistent;
  88 if it already exists and is non-empty,
  89 a warning message about that is sent to standard error,
  90 and the output is appended to the file.
  91 <P>
  92
  93 The
  94 <B>--quiet</B>
  95
  96 option suppresses both the
  97 <I>rsasigkey</I>
  98
  99 narrative and the existing-file warning message.
 100 <P>
 101
 102 The
 103 <B>--bits</B>
 104
 105 option specifies the number of bits in the key;
 106 the current default is 2192 and we do not recommend use of anything
 107 shorter unless unusual constraints demand it.
 108 <P>
 109
 110 The
 111 <B>--hostname</B>
 112
 113 option is passed through to
 114 <I>rsasigkey</I>
 115
 116 to tell it what host name to label the output with
 117 (via its
 118 <B>--hostname</B>
 119
 120 option).
 121 <P>
 122
 123 The output format is that of
 124 <I>rsasigkey</I>,
 125
 126 with bracketing added to complete the
 127 <I>ipsec.secrets</I>
 128
 129 format.
 130 In the usual case, where
 131 <I>ipsec.secrets</I>
 132
 133 contains only the host's own private key,
 134 the output of
 135 <I>newhostkey</I>
 136
 137 is sufficient as a complete
 138 <I>ipsec.secrets</I>
 139
 140 file.
 141 <A NAME="lbAE">&nbsp;</A>
 142 <H2>SEE ALSO</H2>
 143
 144 <A HREF="ipsec.secrets.5.html">ipsec.secrets</A>(5), <A HREF="ipsec_rsasigkey.8.html">ipsec_rsasigkey</A>(8)
 145 <A NAME="lbAF">&nbsp;</A>
 146 <H2>HISTORY</H2>
 147
 148 Written for the Linux FreeS/WAN project
 149 &lt;<A HREF="http://www.freeswan.org">http://www.freeswan.org</A>&gt;
 150 by Henry Spencer.
 151 <A NAME="lbAG">&nbsp;</A>
 152 <H2>BUGS</H2>
 153
 154 As with
 155 <I>rsasigkey</I>,
 156
 157 the run time is difficult to predict,
 158 since depletion of the system's randomness pool can cause
 159 arbitrarily long waits for random bits,
 160 and the prime-number searches can also take unpredictable
 161 (and potentially large) amounts of CPU time.
 162 See
 163 <I><A HREF="ipsec_rsasigkey.8.html">ipsec_rsasigkey</A></I>(8)
 164
 165 for some typical performance numbers.
 166 <P>
 167
 168 A higher-level tool which could handle the clerical details
 169 of changing to a new key would be helpful.
 170 <P>
 171
 172 The requirement for
 173 <B>--output</B>
 174
 175 is a blemish,
 176 but private keys are extremely sensitive information
 177 and unusual precautions seem justified.
 178 <P>
 179
 180 <HR>
 181 <A NAME="index">&nbsp;</A><H2>Index</H2>
 182 <DL>
 183 <DT><A HREF="#lbAB">NAME</A><DD>
 184 <DT><A HREF="#lbAC">SYNOPSIS</A><DD>
 185 <DT><A HREF="#lbAD">DESCRIPTION</A><DD>
 186 <DT><A HREF="#lbAE">SEE ALSO</A><DD>
 187 <DT><A HREF="#lbAF">HISTORY</A><DD>
 188 <DT><A HREF="#lbAG">BUGS</A><DD>
 189 </DL>
 190 <HR>
 191 This document was created by
 192 <A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
 193 using the manual pages.<BR>
 194 Time: 21:40:18 GMT, November 11, 2003
 195 </BODY>
 196 </HTML>