doc/manpage.d/ipsec_showhostkey.8.html

   1 Content-type: text/html
   2
   3 <HTML><HEAD><TITLE>Manpage of IPSEC_SHOWHOSTKEY</TITLE>
   4 </HEAD><BODY>
   5 <H1>IPSEC_SHOWHOSTKEY</H1>
   6 Section: Maintenance Commands (8)<BR>Updated: 5 March 2002<BR><A HREF="#index">Index</A>
   7 <A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
   8
   9
  10 <A NAME="lbAB">&nbsp;</A>
  11 <H2>NAME</H2>
  12
  13 ipsec showhostkey - show host's authentication key
  14 <A NAME="lbAC">&nbsp;</A>
  15 <H2>SYNOPSIS</H2>
  16
  17 <B>ipsec</B>
  18
  19 <B>showhostkey</B>
  20
  21 [
  22 <B>--key</B>
  23
  24 ] [
  25 <B>--left</B>
  26
  27 ] [
  28 <B>--right</B>
  29
  30 ] [
  31 <B>--txt</B>
  32
  33 gateway
  34 ] [
  35 <B>--dhclient</B>
  36
  37 ] [
  38 <B>--file</B>
  39
  40 secretfile
  41 ] [
  42 <B>--id</B>
  43
  44 identity
  45 ]
  46 <A NAME="lbAD">&nbsp;</A>
  47 <H2>DESCRIPTION</H2>
  48
  49 <I>Showhostkey</I>
  50
  51 outputs (on standard output) a public key suitable for this host,
  52 in the format specified,
  53 using the host key information stored in
  54 <I>/etc/ipsec.secrets</I>.
  55
  56 In general only the super-user can run this command,
  57 since only he can read
  58 <I>ipsec.secrets</I>.
  59
  60 <P>
  61
  62 The
  63 <B>--txt</B>
  64
  65 option causes the output to be in opportunistic-encryption DNS TXT record
  66 format,
  67 with the specified
  68 <I>gateway</I>
  69
  70 value.
  71 If information about how the key was generated is available,
  72 that is provided as a DNS-file comment.
  73 For example,
  74 <B>--txt 10.11.12.13</B>
  75
  76 might give (with the key data trimmed for clarity):
  77 <P>
  78
  79 <PRE>
  80   ; RSA 2048 bits   xy.example.com   Sat Apr 15 13:53:22 2000
  81       IN TXT  &quot;X-IPsec-Server(10)=10.11.12.13 AQOF8tZ2...+buFuFn/&quot;
  82 </PRE>
  83
  84 <P>
  85
  86 No name is supplied in the TXT record
  87 because there are too many possibilities,
  88 depending on how it will be used.
  89 If the text string is longer than 255 bytes,
  90 it is split up into multiple strings (matching the restrictions of
  91 the DNS TXT binary format).
  92 If any split is needed, the first split will be at the start of the key:
  93 this increases the chances that later hand editing will work.
  94 <P>
  95
  96 The
  97 <B>--left</B>
  98
  99 and
 100 <B>--right</B>
 101
 102 options cause the output to be in
 103 <I><A HREF="ipsec.conf.5.html">ipsec.conf</A></I>(5)
 104
 105 format, as a
 106 <B>leftrsasigkey</B>
 107
 108 or
 109 <B>rightrsasigkey</B>
 110
 111 parameter respectively.
 112 Again, generation information is included if available.
 113 For example,
 114 <B>--left</B>
 115
 116 might give (with the key data trimmed down for clarity):
 117 <P>
 118
 119 <PRE>
 120   # RSA 2048 bits   xy.example.com   Sat Apr 15 13:53:22 2000
 121   leftrsasigkey=0sAQOF8tZ2...+buFuFn/
 122 </PRE>
 123
 124 <P>
 125
 126 The
 127 <B>--dhclient</B>
 128
 129 option cause the output to be suitable for inclusion in
 130 <I><A HREF="dhclient.conf.5.html">dhclient.conf</A></I>(5)
 131
 132 as part of configuring WAVEsec.
 133 See &lt;<A HREF="http://www.wavesec.org">http://www.wavesec.org</A>&gt;.
 134 <P>
 135
 136 If
 137 <B>--key</B>
 138
 139 is specified,
 140 the output format is the text form of a DNS KEY record;
 141 the host name is the one included in the key information
 142 (or, if that is not available,
 143 the output of
 144 <B>hostname&nbsp;--fqdn</B>),
 145
 146 with a
 147 <B>.</B>
 148
 149 appended.
 150 Again, generation information is included if available.
 151 For example (with the key data trimmed down for clarity):
 152 <P>
 153
 154 <PRE>
 155   ; RSA 2048 bits   xy.example.com   Sat Apr 15 13:53:22 2000
 156   xy.example.com.   IN   KEY   0x4200 4 1 AQOF8tZ2...+buFuFn/
 157 </PRE>
 158
 159 <P>
 160
 161 Normally, the default key for this host
 162 (the one with no host identities specified for it) is the one extracted.
 163 The
 164 <B>--id</B>
 165
 166 option overrides this,
 167 causing extraction of the key labeled with the specified
 168 <I>identity</I>,
 169
 170 if any.
 171 The specified
 172 <I>identity</I>
 173
 174 must
 175 <I>exactly</I>
 176
 177 match the identity in the file;
 178 in particular, the comparison is case-sensitive.
 179 <P>
 180
 181 The
 182 <B>--file</B>
 183
 184 option overrides the default for where the key information should be
 185 found, and takes it from the specified
 186 <I>secretfile</I>.
 187
 188 <A NAME="lbAE">&nbsp;</A>
 189 <H2>DIAGNOSTICS</H2>
 190
 191 A complaint about ``no pubkey line found'' indicates that the
 192 host has a key but it was generated with an old version of FreeS/WAN
 193 and does not contain the information that
 194 <I>showhostkey</I>
 195
 196 needs.
 197 <A NAME="lbAF">&nbsp;</A>
 198 <H2>FILES</H2>
 199
 200 /etc/ipsec.secrets
 201 <A NAME="lbAG">&nbsp;</A>
 202 <H2>SEE ALSO</H2>
 203
 204 <A HREF="ipsec.secrets.5.html">ipsec.secrets</A>(5), <A HREF="ipsec.conf.5.html">ipsec.conf</A>(5), <A HREF="ipsec_rsasigkey.8.html">ipsec_rsasigkey</A>(8)
 205 <A NAME="lbAH">&nbsp;</A>
 206 <H2>HISTORY</H2>
 207
 208 Written for the Linux FreeS/WAN project
 209 &lt;<A HREF="http://www.freeswan.org">http://www.freeswan.org</A>&gt;
 210 by Henry Spencer.
 211 <A NAME="lbAI">&nbsp;</A>
 212 <H2>BUGS</H2>
 213
 214 Arguably,
 215 rather than just reporting the no-IN-KEY-line-found problem,
 216 <I>showhostkey</I>
 217
 218 should be smart enough to run the existing key through
 219 <I>rsasigkey</I>
 220
 221 with the
 222 <B>--oldkey</B>
 223
 224 option, to generate a suitable output line.
 225 <P>
 226
 227 The need to specify the gateway address (etc.) for
 228 <B>--txt</B>
 229
 230 is annoying, but there is no good way to determine it automatically.
 231 <P>
 232
 233 There should be a way to specify the priority value for TXT records;
 234 currently it is hardwired to
 235 <B>10</B>.
 236
 237 <P>
 238
 239 The
 240 <B>--id</B>
 241
 242 option assumes that the
 243 <I>identity</I>
 244
 245 appears on the same line as the
 246 <B>:&nbsp;RSA&nbsp;{</B>
 247
 248 that begins the key proper.
 249 <P>
 250
 251 <HR>
 252 <A NAME="index">&nbsp;</A><H2>Index</H2>
 253 <DL>
 254 <DT><A HREF="#lbAB">NAME</A><DD>
 255 <DT><A HREF="#lbAC">SYNOPSIS</A><DD>
 256 <DT><A HREF="#lbAD">DESCRIPTION</A><DD>
 257 <DT><A HREF="#lbAE">DIAGNOSTICS</A><DD>
 258 <DT><A HREF="#lbAF">FILES</A><DD>
 259 <DT><A HREF="#lbAG">SEE ALSO</A><DD>
 260 <DT><A HREF="#lbAH">HISTORY</A><DD>
 261 <DT><A HREF="#lbAI">BUGS</A><DD>
 262 </DL>
 263 <HR>
 264 This document was created by
 265 <A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
 266 using the manual pages.<BR>
 267 Time: 21:40:18 GMT, November 11, 2003
 268 </BODY>
 269 </HTML>