From: Harlan Stenn Date: Tue, 25 Dec 2012 11:20:12 +0000 (+0000) Subject: ntp-wait, ntpd, ntpdc, ntpq, ntpsnmpd autogen documentation updates X-Git-Tag: NTP_4_2_7P339~3 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e4506cfc4fb93b4c1ebe6c7625b1efabff8fd6cb;p=thirdparty%2Fntp.git ntp-wait, ntpd, ntpdc, ntpq, ntpsnmpd autogen documentation updates bk: 50d98beccvLwGTFC5QgzLy5Hzv4kXA --- diff --git a/.point-changed-filelist b/.point-changed-filelist index fa298aff6..d64ada172 100644 --- a/.point-changed-filelist +++ b/.point-changed-filelist @@ -40,6 +40,7 @@ ntpsnmpd/ntpsnmpd-opts.c ntpsnmpd/ntpsnmpd-opts.h ntpsnmpd/ntpsnmpd.1ntpsnmpdman ntpsnmpd/ntpsnmpd.1ntpsnmpdmdoc +ntpsnmpd/ntpsnmpd.html ntpsnmpd/ntpsnmpd.man.in ntpsnmpd/ntpsnmpd.mdoc.in packageinfo.sh diff --git a/ChangeLog b/ChangeLog index 7e6790512..0b0a14dee 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,4 @@ +* ntp-wait, ntpd, ntpdc, ntpq, ntpsnmpd autogen documentation updates. * mdoc2texi fixes: Handle_ArCmFlIc, Handle_Fn, HandleQ. * ntp-keygen autogen documentation updates. * ntpq autogen docs. diff --git a/ntpd/ntpd.html b/ntpd/ntpd.html index 99501ac0f..cc43a7162 100644 --- a/ntpd/ntpd.html +++ b/ntpd/ntpd.html @@ -3,7 +3,7 @@ ntpd: Network Time Protocol (NTP) Daemon User's Manual - + @@ -14,18 +14,20 @@ pre.smallformat { font-family:inherit; font-size:smaller } pre.smallexample { font-size:smaller } pre.smalllisp { font-size:smaller } - span.sc { font-variant:small-caps } - span.roman { font-family: serif; font-weight: normal; } + span.sc { font-variant:small-caps } + span.roman { font-family:serif; font-weight:normal; } + span.sansserif { font-family:sans-serif; font-weight:normal; } -->

ntpd: Network Time Protocol (NTP) Daemon User's Manual

+

-Next: , +Next: , Previous: (dir), Up: (dir) -
+

ntpd: Network Time Protocol (NTP) Daemon User Manual

@@ -39,7 +41,7 @@ The program can operate in any of several modes, including client/server, symmetric and broadcast modes, and with both symmetric-key and public-key cryptography. -

This document applies to version {No value for `VERSION'} of ntpd. +

This document applies to version 4.2.7p337 of ntpd.

-

-
+

+ +
@@ -78,9 +81,10 @@ If nothing is heard after a few minutes' time, the daemon times out and exits without setting the clock.
-

-
+

+ +

Invoking ntpd

@@ -160,7 +164,7 @@ using the agtexi-cmd template and the option descriptions for the < This software is released under the NTP license, <http://ntp.org/license>.
+

-Next: , +Next: , Up: ntpd Invocation -
+
-

ntpd help/usage (--help)

+

ntpd help/usage (--help)

This is the automatically generated usage text for ntpd.

The text printed is the same whether selected with the help option -(--help) or the more-help option (--more-help). more-help will print +(--help) or the more-help option (--more-help). more-help will print the usage text by passing it through a pager program. more-help is disabled on platforms without a working fork(2) function. The PAGER environment variable is -used to select the program, defaulting to more. Both will exit +used to select the program, defaulting to more. Both will exit with a status code of 0. -

ntpd - NTP daemon program - Ver. 4.2.7p336
+
ntpd - NTP daemon program - Ver. 4.2.7p337
 USAGE:  ntpd [ -<flag> [<val>] | --<name>[{=| }<val>] ]... \
                 [ <server1> ... <serverN> ]
   Flg Arg Option-Name    Description
@@ -294,11 +299,12 @@ The following option preset mechanisms are supported:
 please send bug reports to:  http://bugs.ntp.org, bugs@ntp.org
 

   

+
 

-Next: ,
+Next: ,
 Previous: ntpd usage,
 Up: ntpd Invocation
-

+
 

 
 
ipv4 option (-4)

@@ -315,11 +321,12 @@ ipv6.
   
Force DNS resolution of following host names on the command line
 to the IPv4 namespace. 
 

+
 

-Next: ,
+Next: ,
 Previous: ntpd ipv4,
 Up: ntpd Invocation
-

+
 

 
 
ipv6 option (-6)

@@ -336,11 +343,12 @@ ipv4.
   
Force DNS resolution of following host names on the command line
 to the IPv6 namespace. 
 

+
 

-Next: ,
+Next: ,
 Previous: ntpd ipv6,
 Up: ntpd Invocation
-

+
 

 
 
authreq option (-a)

@@ -358,11 +366,12 @@ authnoreq.
 multicast client and symmetric passive associations. 
 This is the default. 
 

+
 

-Next: ,
+Next: ,
 Previous: ntpd authreq,
 Up: ntpd Invocation
-

+
 

 
 
authnoreq option (-A)

@@ -380,11 +389,12 @@ authreq.
 multicast client and symmetric passive associations. 
 This is almost never a good idea. 
 

+
 

-Next: ,
+Next: ,
 Previous: ntpd authnoreq,
 Up: ntpd Invocation
-

+
 

 
 
configfile option (-c)

@@ -393,14 +403,15 @@ Up: ntpd Invocation
 This is the “configuration file name” option. 
 This option takes an argument string. 
 The name and path of the configuration file,
-/etc/ntp.conf
+/etc/ntp.conf
 by default. 
 

+
 

-Next: ,
+Next: ,
 Previous: ntpd configfile,
 Up: ntpd Invocation
-

+
 

 
 
driftfile option (-f)

@@ -409,19 +420,20 @@ Up: ntpd Invocation
 This is the “frequency drift file name” option. 
 This option takes an argument string. 
 The name and path of the frequency file,
-/etc/ntp.drift
+/etc/ntp.drift
 by default. 
 This is the same operation as the
 driftfile driftfile
 configuration specification in the
-/etc/ntp.conf
+/etc/ntp.conf
 file. 
 

+
 

-Next: ,
+Next: ,
 Previous: ntpd driftfile,
 Up: ntpd Invocation
-

+
 

 
 
panicgate option (-g)

@@ -447,11 +459,12 @@ See the
 tinker
 configuration file directive for other options. 
 

+
 

-Next: ,
+Next: ,
 Previous: ntpd panicgate,
 Up: ntpd Invocation
-

+
 

 
 
jaildir option (-i)

@@ -478,18 +491,19 @@ This option is supported under NetBSD (configure with
 --enable-clockctl) and Linux (configure with
 --enable-linuxcaps). 
 

+
 

-Next: ,
+Next: ,
 Previous: ntpd jaildir,
 Up: ntpd Invocation
-

+
 

 
 
interface option (-I)

 
 

 This is the “listen on an interface name or address” option. 
-This option takes an argument string iface.
+This option takes an argument string iface.
 
 
This option has some usage constraints.  It:
      

 
 

+
 

-Next: ,
+Next: ,
 Previous: (dir),
 Up: (dir)
-

+
 

 
 
NTP Key Generation Program User Manual

@@ -59,8 +62,8 @@ Up: (dir)
 
This document describes the use of the NTP Project's ntp-keygen
 program, that generates cryptographic data files used by the NTPv4
 authentication and identity schemes. 
-It can generate message digest
-keys used in symmetric key cryptography and, if the OpenSSL software
+It can generate message digest keys used in symmetric key cryptography and,
+if the OpenSSL software
 library has been installed, it can generate host keys, sign keys,
 certificates, and identity keys and parameters used by the Autokey
 public key cryptography. 
@@ -73,11 +76,12 @@ mail to other sites.
   
This document applies to version 4.2.7p337 of ntp-keygen.
 
 

+
 

-Next: ,
+Next: ,
 Previous: Top,
 Up: Top
-

+
 

 
 
@@ -95,11 +99,14 @@ mail to other sites.
 
   
When used to generate message digest keys, the program produces a file
 containing ten pseudo-random printable ASCII strings suitable for the
-MD5 message digest algorithm included in the distribution. If the
+MD5 message digest algorithm included in the distribution. 
+If the
 OpenSSL library is installed, it produces an additional ten hex-encoded
 random bit strings suitable for the SHA1 and other message digest
-algorithms. The message digest keys file must be distributed and stored
-using secure means beyond the scope of NTP itself. Besides the keys
+algorithms. 
+The message digest keys file must be distributed and stored
+using secure means beyond the scope of NTP itself. 
+Besides the keys
 used for ordinary NTP associations, additional keys can be defined as
 passwords for the ntpq and ntpdc utility programs.
 
@@ -107,92 +114,108 @@ passwords for the ntpq and ntpdc utility programs.
 applications and other Public Key Infrastructure (PKI) resources. 
 Certificates generated by this program are compatible with extant
 industry practice, although some users might find the interpretation of
-X509v3 extension fields somewhat liberal. However, the identity keys
+X509v3 extension fields somewhat liberal. 
+However, the identity keys
 are probably not compatible with anything other than Autokey.
 
   
Some files used by this program are encrypted using a private password. 
-The -p option specifies the password for local encrypted files and the
--q option the password for encrypted files sent to remote sites. If no
-password is specified, the host name returned by the Unix gethostname()
-function, normally the DNS name of the host, is used.
-
-  
The pw option of the crypto configuration command specifies the read
-password for previously encrypted local files. This must match the
-local password used by this program. If not specified, the host name is
-used. Thus, if files are generated by this program without password,
+The -p option specifies the password for local encrypted files and the
+-q option the password for encrypted files sent to remote sites. 
+If no password is specified, the host name returned by the Unix
+gethostname() function, normally the DNS name of the host, is used.
+
+  
The pw option of the crypto configuration command
+specifies the read password for previously encrypted local files. 
+This must match the local password used by this program. 
+If not specified, the host name is used. 
+Thus, if files are generated by this program without password,
 they can be read back by ntpd without password, but only on the same
 host.
 
   
Normally, encrypted files for each host are generated by that host and
 used only by that host, although exceptions exist as noted later on
-this page. The symmetric keys file, normally called ntp.keys, is
-usually installed in /etc. Other files and links are usually installed
-in /usr/local/etc, which is normally in a shared filesystem in
-NFS-mounted networks and cannot be changed by shared clients. The
-location of the keys directory can be changed by the keysdir
-configuration command in such cases. Normally, this is in /etc.
+this page. 
+The symmetric keys file, normally called ntp.keys, is
+usually installed in /etc. 
+Other files and links are usually installed
+in /usr/local/etc, which is normally in a shared filesystem in
+NFS-mounted networks and cannot be changed by shared clients. 
+The location of the keys directory can be changed by the keysdir
+configuration command in such cases. 
+Normally, this is in /etc.
 
   
This program directs commentary and error messages to the standard
-error stream stderr and remote files to the standard output stream
-stdout where they can be piped to other applications or redirected to
-files. The names used for generated files and links all begin with the
-string ntpkey and include the file type, generating host and filestamp,
-as described in the Cryptographic Data Files section below.
+error stream stderr and remote files to the standard output stream
+stdout where they can be piped to other applications or redirected to
+files. 
+The names used for generated files and links all begin with the
+string ntpkey and include the file type,
+generating host and filestamp,
+as described in the Cryptographic Data Files section below.
 
 

+
 

-Next: ,
+Next: ,
 Previous: Description,
 Up: Top
-

+
 

 
 
 
Running the Program

 
 
To test and gain experience with Autokey concepts, log in as root and
-change to the keys directory, usually /usr/local/etc. When run for the
-first time, or if all files with names beginning ntpkey have been
-removed, use the ntp-keygen command without arguments to generate a
+change to the keys directory, usually /usr/local/etc. 
+When run for the
+first time, or if all files with names beginning ntpkey] have been
+removed, use the ntp-keygen command without arguments to generate a
 default RSA host key and matching RSA-MD5 certificate with expiration
-date one year hence. If run again without options, the program uses the
+date one year hence. 
+If run again without options, the program uses the
 existing keys and parameters and generates only a new certificate with
 new expiration date one year hence.
 
-  
Run the command on as many hosts as necessary. Designate one of them as
-the trusted host (TH) using ntp-keygen with the -T option and configure
-it to synchronize from reliable Internet servers. Then configure the
-other hosts to synchronize to the TH directly or indirectly. A
-certificate trail is created when Autokey asks the immediately
+  
Run the command on as many hosts as necessary. 
+Designate one of them as the trusted host (TH) using ntp-keygen
+with the -T option and configure
+it to synchronize from reliable Internet servers. 
+Then configure the other hosts to synchronize to the TH directly or indirectly. 
+A certificate trail is created when Autokey asks the immediately
 ascendant host towards the TH to sign its certificate, which is then
-provided to the immediately descendant host on request. All group hosts
-should have acyclic certificate trails ending on the TH.
+provided to the immediately descendant host on request. 
+All group hosts should have acyclic certificate trails ending on the TH.
 
   
The host key is used to encrypt the cookie when required and so must be
-RSA type. By default, the host key is also the sign key used to encrypt
-signatures. A different sign key can be assigned using the -S option
-and this can be either RSA or DSA type. By default, the signature
+RSA type. 
+By default, the host key is also the sign key used to encrypt signatures. 
+A different sign key can be assigned using the -S option
+and this can be either RSA or DSA type. 
+By default, the signature
 message digest type is MD5, but any combination of sign key type and
 message digest type supported by the OpenSSL library can be specified
-using the -c option.
+using the -c option.
 
   
The rules say cryptographic media should be generated with proventic
 filestamps, which means the host should already be synchronized before
-this program is run. This of course creates a chicken-and-egg problem
-when the host is started for the first time. Accordingly, the host time
+this program is run. 
+This of course creates a chicken-and-egg problem
+when the host is started for the first time. 
+Accordingly, the host time
 should be set by some other means, such as eyeball-and-wristwatch, at
 least so that the certificate lifetime is within the current year. 
 After that and when the host is synchronized to a proventic source, the
 certificate should be re-generated.
 
   
Additional information on trusted groups and identity schemes is on the
-Autokey Public-Key Authentication
-page.
+Autokey Public-Key Authentication page.
 
 

-

+
 
-

+

+
+
 

 
 
Invoking ntp-keygen

@@ -223,7 +246,11 @@ digest algorithms.
 The message digest keys file must be distributed and stored
 using secure means beyond the scope of NTP itself. 
 Besides the keys used for ordinary NTP associations, additional keys
-can be defined as passwords for the ntpq and ntpdc utility programs.
+can be defined as passwords for the
+ntpq(1ntpqmdoc)
+and
+ntpdc(1ntpdcmdoc)
+utility programs.
 
   
The remaining generated files are compatible with other OpenSSL
 applications and other Public Key Infrastructure (PKI) resources. 
@@ -235,55 +262,52 @@ other than Autokey.
 
   
Some files used by this program are encrypted using a private password. 
 The
---p option specifies the password for local encrypted files and the
---q option the password for encrypted files sent to remote sites. 
+-p option specifies the password for local encrypted files and the
+-q option the password for encrypted files sent to remote sites. 
 If no password is specified, the host name returned by the Unix
-.Fn
-gethostname
+gethostname()
 function, normally the DNS name of the host is used.
 
   
The
-pw option of the
-crypto configuration command specifies the read
+pw option of the
+crypto configuration command specifies the read
 password for previously encrypted local files. 
 This must match the local password used by this program. 
 If not specified, the host name is used. 
 Thus, if files are generated by this program without password,
 they can be read back by
-ntpd without password but only on the same host.
+ntpd without password but only on the same host.
 
   
Normally, encrypted files for each host are generated by that host and
 used only by that host, although exceptions exist as noted later on
 this page. 
 The symmetric keys file, normally called
-ntp.keys, is usually installed in
-/etc. 
-. 
+ntp.keys, is usually installed in
+/etc. 
 Other files and links are usually installed in
-/usr/local/etc,
-,
+/usr/local/etc,
 which is normally in a shared filesystem in
 NFS-mounted networks and cannot be changed by shared clients. 
 The location of the keys directory can be changed by the
-keysdir configuration command in such cases. 
+keysdir configuration command in such cases. 
 Normally, this is in
-/etc. 
-.
+/etc.
 
   
This program directs commentary and error messages to the standard
 error stream
-stderr and remote files to the standard output stream
-stdout where they can be piped to other applications or redirected to files. 
+stderr and remote files to the standard output stream
+stdout where they can be piped to other applications or redirected to files. 
 The names used for generated files and links all begin with the
 string
-ntpkey and include the file type, generating host and filestamp,
+ntpkey and include the file type, generating host and filestamp,
 as described in the
-CryptographicDataFiles
+“Cryptographic Data Files”
 section below. 
 

-

 
-

+

+
+
 

 
 
Running

@@ -293,9 +317,9 @@ the
 Program
 To test and gain experience with Autokey concepts, log in as root and
 change to the keys directory, usually
-/usr/local/etc
+/usr/local/etc
 When run for the first time, or if all files with names beginning with
-ntpkey have been removed, use the
+ntpkey have been removed, use the
 ntp-keygen
 command without arguments to generate a
 default RSA host key and matching RSA-MD5 certificate with expiration
@@ -339,13 +363,13 @@ After that and when the host is synchronized to a proventic source, the
 certificate should be re-generated.
 
   
Additional information on trusted groups and identity schemes is on the
-AutokeyPublic-KeyAuthentication
+“Autokey Public-Key Authentication”
 page.
 
   
The
-ntpd(8)
+ntpd(1ntpdmdoc)
 configuration command
-crypto pw Ar password specifies the read password for previously encrypted files. 
+crypto pw password specifies the read password for previously encrypted files. 
 The daemon expires on the spot if the password is missing
 or incorrect. 
 For convenience, if a file has been previously encrypted,
@@ -356,23 +380,22 @@ these files can be read by that host with no explicit password.
 
   
File names begin with the prefix
 ntpkey_ and end with the postfix
-_hostname.filestamp, where
-hostname is the owner name, usually the string returned
+_hostname.filestamp, where
+hostname is the owner name, usually the string returned
 by the Unix gethostname() routine, and
-filestamp is the NTP seconds when the file was generated, in decimal digits. 
+filestamp is the NTP seconds when the file was generated, in decimal digits. 
 This both guarantees uniqueness and simplifies maintenance
 procedures, since all files can be quickly removed
 by a
-rmntpkey\&* command or all files generated
+rm ntpkey\&* command or all files generated
 at a specific time can be removed by a
-rm \&*filestamp command. 
+rm \&*filestamp command. 
 To further reduce the risk of misconfiguration,
 the first two lines of a file contain the file name
 and generation date and time as comments.
 
   
All files are installed by default in the keys directory
-/usr/local/etc,
-,
+/usr/local/etc,
 which is normally in a shared filesystem
 in NFS-mounted networks. 
 The actual location of the keys directory
@@ -402,7 +425,7 @@ by changing the link.
 If a link is present, ntpd follows it to the file name
 to extract the filestamp. 
 If a link is not present,
-ntpd(8)
+ntpd(1ntpdmdoc)
 extracts the filestamp from the file itself. 
 This allows clients to verify that the file and generation times
 are always current. 
@@ -412,9 +435,10 @@ program uses the same timestamp extension for all files generated
 at one time, so each generation is distinct and can be readily
 recognized in monitoring data. 
 

-

 
-

+

+
+
 

 
 
Running

@@ -427,8 +451,7 @@ The safest way to run the
 program is logged in directly as root. 
 The recommended procedure is change to the keys directory,
 usually
-/usr/local/etc,
-,
+/usr/local/etc,
 then run the program. 
 When run for the first time,
 or if all
@@ -465,18 +488,18 @@ as the other files, are probably not compatible with anything other than Autokey
 su command
 to assume root may not work properly, since by default the OpenSSL library
 looks for the random seed file
-.rnd in the user home directory. 
+.rnd in the user home directory. 
 However, there should be only one
-.rnd, most conveniently
+.rnd, most conveniently
 in the root directory, so it is convenient to define the
-$RANDFILE environment variable used by the OpenSSL library as the path to
-/.rnd. 
+$RANDFILE environment variable used by the OpenSSL library as the path to
+/.rnd. 
 Installing the keys as root might not work in NFS-mounted
 shared file systems, as NFS clients may not be able to write
 to the shared keys directory, even as root. 
 In this case, NFS clients can specify the files in another
 directory such as
-/etc
+/etc
 using the
 keysdir command. 
 There is no need for one client to read the keys and certificates
@@ -494,8 +517,7 @@ The owner name is also used for the host and sign key files,
 while the trusted name is used for the identity files.
 
   
All files are installed by default in the keys directory
-/usr/local/etc,
-,
+/usr/local/etc,
 which is normally in a shared filesystem
 in NFS-mounted networks. 
 The actual location of the keys directory
@@ -525,7 +547,7 @@ by changing the link.
 If a link is present, ntpd follows it to the file name
 to extract the filestamp. 
 If a link is not present,
-ntpd(8)
+ntpd(1ntpdmdoc)
 extracts the filestamp from the file itself. 
 This allows clients to verify that the file and generation times
 are always current. 
@@ -535,9 +557,10 @@ program uses the same timestamp extension for all files generated
 at one time, so each generation is distinct and can be readily
 recognized in monitoring data. 
 

-

 
-

+

+
+
 

 
 
Running

@@ -550,8 +573,7 @@ The safest way to run the
 program is logged in directly as root. 
 The recommended procedure is change to the keys directory,
 usually
-/usr/local/etc,
-,
+/usr/local/etc,
 then run the program. 
 When run for the first time,
 or if all
@@ -588,18 +610,18 @@ as the other files, are probably not compatible with anything other than Autokey
 su command
 to assume root may not work properly, since by default the OpenSSL library
 looks for the random seed file
-.rnd in the user home directory. 
+.rnd in the user home directory. 
 However, there should be only one
-.rnd, most conveniently
+.rnd, most conveniently
 in the root directory, so it is convenient to define the
-$RANDFILE environment variable used by the OpenSSL library as the path to
-/.rnd. 
+$RANDFILE environment variable used by the OpenSSL library as the path to
+/.rnd. 
 Installing the keys as root might not work in NFS-mounted
 shared file systems, as NFS clients may not be able to write
 to the shared keys directory, even as root. 
 In this case, NFS clients can specify the files in another
 directory such as
-/etc
+/etc
 using the
 keysdir command. 
 There is no need for one client to read the keys and certificates
@@ -663,16 +685,16 @@ throughout the subnet, but setting up the environment is completely automatic.
 scheme than the default, run
 ntp-keygen
 with the
--S -Ar -type option, where
-type is either
+-S -type option, where
+type is either
 RSA or
 DSA. The most often need to do this is when a DSA-signed certificate is used. 
 If it is necessary to use a different certificate scheme than the default,
 run
 ntp-keygen
 with the
--c -Ar -scheme option and selected
-scheme as needed. 
+-c -scheme option and selected
+scheme as needed. 
 f
 ntp-keygen
 is run again without these options, it generates a new certificate
@@ -685,17 +707,18 @@ Simply run
 with the same flags as before to generate new certificates
 using existing keys. 
 However, if the host or sign key is changed,
-ntpd(8)
+ntpd(1ntpdmdoc)
 should be restarted. 
 When
-ntpd(8)
+ntpd(1ntpdmdoc)
 is restarted, it loads any new files and restarts the protocol. 
 Other dependent hosts will continue as usual until signatures are refreshed,
 at which time the protocol is restarted. 
 

-

 
-

+

+
+
 

 
 
Identity

@@ -706,7 +729,7 @@ As mentioned on the Autonomous Authentication page,
 the default TC identity scheme is vulnerable to a middleman attack. 
 However, there are more secure identity schemes available,
 including PC, IFF, GQ and MV described on the
-"IdentificationSchemes"
+"Identification Schemes"
 page
 (maybe available at
 .Li
@@ -734,29 +757,16 @@ only as clients have key files that contain only client keys.
   
The PC scheme supports only one trusted host in the group. 
 On trusted host alice run
 ntp-keygen
--P -p -Ar -password to generate the host key file
-ntpkey_RSAkey_NsAralice.filestamp
-Ns
-Ar
-alice.filestamp
+-P -p -password to generate the host key file
+ntpkey_RSAkey_NsAralice.filestamp
 and trusted private certificate file
-ntpkey_RSA-MD5_cert_NsAralice.filestamp. 
-Ns
-Ar
-alice.filestamp
-. 
+ntpkey_RSA-MD5_cert_NsAralice.filestamp. 
 Copy both files to all group hosts;
 they replace the files which would be generated in other schemes. 
 On each host bob install a soft link from the generic name
-ntpkey_host_NsArbob
-Ns
-Ar
-bob
+ntpkey_host_NsArbob
 to the host key file and soft link
-ntpkey_cert_NsArbob
-Ns
-Ar
-bob
+ntpkey_cert_NsArbob
 to the private certificate file. 
 Note the generic links are on bob, but point to files generated
 by trusted host alice. 
@@ -769,19 +779,12 @@ and certificates for all group hosts, then for every trusted host in the group,
 generate the IFF parameter file. 
 On trusted host alice run
 ntp-keygen
--T -I -p -Ar -password to produce her parameter file
-ntpkey_IFFpar_NsAralice.filestamp,
-Ns
-Ar
-alice.filestamp
-,
+-T -I -p -password to produce her parameter file
+ntpkey_IFFpar_NsAralice.filestamp,
 which includes both server and client keys. 
 Copy this file to all group hosts that operate as both servers
 and clients and install a soft link from the generic
-ntpkey_iff_NsAralice
-Ns
-Ar
-alice
+ntpkey_iff_NsAralice
 to this file. 
 If there are no hosts restricted to operate only as clients,
 there is nothing further to do. 
@@ -797,10 +800,7 @@ After generating the parameter file, on alice run
 -e and pipe the output to a file or mail program. 
 Copy or mail this file to all restricted clients. 
 On these clients install a soft link from the generic
-ntpkey_iff_NsAralice
-Ns
-Ar
-alice
+ntpkey_iff_NsAralice
 to this file. 
 To further protect the integrity of the keys,
 each file can be encrypted with a secret password.
@@ -810,26 +810,16 @@ and certificates for all group hosts, then for every trusted host
 in the group, generate the IFF parameter file. 
 On trusted host alice run
 ntp-keygen
--T -G -p -Ar -password to produce her parameter file
-ntpkey_GQpar_NsAralice.filestamp,
-Ns
-Ar
-alice.filestamp
-,
+-T -G -p -password to produce her parameter file
+ntpkey_GQpar_NsAralice.filestamp,
 which includes both server and client keys. 
 Copy this file to all group hosts and install a soft link
 from the generic
-ntpkey_gq_NsAralice
-Ns
-Ar
-alice
+ntpkey_gq_NsAralice
 to this file. 
 In addition, on each host bob install a soft link
 from generic
-ntpkey_gq_NsArbob
-Ns
-Ar
-bob
+ntpkey_gq_NsArbob
 to this file. 
 As the GQ scheme updates the GQ parameters file and certificate
 at the same time, keys and certificates can be regenerated as needed.
@@ -840,27 +830,18 @@ For illustration assume trish is the TA, alice one of several trusted hosts
 and bob one of her clients. 
 On TA trish run
 ntp-keygen
--V -Ar -n -p -Ar -password, where
-n is the number of revokable keys (typically 5) to produce
+-V -n -p -password, where
+n is the number of revokable keys (typically 5) to produce
 the parameter file
-ntpkeys_MVpar_NsArtrish.filestamp
-Ns
-Ar
-trish.filestamp
+ntpkeys_MVpar_NsArtrish.filestamp
 and client key files
-ntpkeys_MVkeyd_NsArtrish.filestamp
-Ns
-Ar
-trish.filestamp
+ntpkeys_MVkeyd_NsArtrish.filestamp
 where
-d is the key number (0 \&<
-d \&<
-n). Copy the parameter file to alice and install a soft link
+d is the key number (0 \&<
+d \&<
+n). Copy the parameter file to alice and install a soft link
 from the generic
-ntpkey_mv_NsAralice
-Ns
-Ar
-alice
+ntpkey_mv_NsAralice
 to this file. 
 Copy one of the client key files to alice for later distribution
 to her clients. 
@@ -868,17 +849,15 @@ It doesn't matter which client key file goes to alice,
 since they all work the same way. 
 Alice copies the client key file to all of her cliens. 
 On client bob install a soft link from generic
-ntpkey_mvkey_NsArbob
-Ns
-Ar
-bob
+ntpkey_mvkey_NsArbob
 to the client key file. 
 As the MV scheme is independent of keys and certificates,
 these files can be refreshed as needed. 
 

-

 
-

+

+
+
 

 
 
Command

@@ -887,9 +866,9 @@ these files can be refreshed as needed.
 Line
 Options
      

-
Fl
Select certificate message digest/signature encryption scheme. 
+
‘Fl’
Select certificate message digest/signature encryption scheme. 
 The
-scheme can be one of the following:
+scheme can be one of the following:
 . 
 Cm
 RSA-MD2
@@ -910,41 +889,42 @@ or
 DSA-SHA1. Note that RSA schemes must be used with a RSA sign key and DSA
 schemes must be used with a DSA sign key. 
 The default without this option is
-RSA-MD5. 
Fl
Enable debugging. 
+RSA-MD5. 
‘Fl’
Enable debugging. 
 This option displays the cryptographic data produced in eye-friendly billboards. 
-
Fl
Write the IFF client keys to the standard output. 
+
‘Fl’
Write the IFF client keys to the standard output. 
 This is intended for automatic key distribution by mail. 
-
Fl
Generate parameters and keys for the GQ identification scheme,
+
‘Fl’
Generate parameters and keys for the GQ identification scheme,
 obsoleting any that may exist. 
-
Fl
Generate keys for the GQ identification scheme
+
‘Fl’
Generate keys for the GQ identification scheme
 using the existing GQ parameters. 
 If the GQ parameters do not yet exist, create them first. 
-
Fl
Generate new host keys, obsoleting any that may exist. 
-
Fl
Generate parameters for the IFF identification scheme,
+
‘Fl’
Generate new host keys, obsoleting any that may exist. 
+
‘Fl’
Generate parameters for the IFF identification scheme,
 obsoleting any that may exist. 
-
Fl
Set the suject name to
-name. This is used as the subject field in certificates
+
‘Fl’
Set the suject name to
+name. This is used as the subject field in certificates
 and in the file name for host and sign keys. 
-
Fl
Generate MD5 keys, obsoleting any that may exist. 
-
Fl
Generate a private certificate. 
+
‘Fl’
Generate MD5 keys, obsoleting any that may exist. 
+
‘Fl’
Generate a private certificate. 
 By default, the program generates public certificates. 
-
Fl
Encrypt generated files containing private data with
-password and the DES-CBC algorithm. 
-
Fl
Set the password for reading files to password. 
-
Fl
Generate a new sign key of the designated type,
+
‘Fl’
Encrypt generated files containing private data with
+password and the DES-CBC algorithm. 
+
‘Fl’
Set the password for reading files to password. 
+
‘Fl’
Generate a new sign key of the designated type,
 obsoleting any that may exist. 
 By default, the program uses the host key as the sign key. 
-
Fl
Set the issuer name to
-name. This is used for the issuer field in certificates
+
‘Fl’
Set the issuer name to
+name. This is used for the issuer field in certificates
 and in the file name for identity files. 
-
Fl
Generate a trusted certificate. 
+
‘Fl’
Generate a trusted certificate. 
 By default, the program generates a non-trusted certificate. 
-
Fl
Generate parameters and keys for the Mu-Varadharajan (MV) identification scheme.
+
‘Fl’
Generate parameters and keys for the Mu-Varadharajan (MV) identification scheme.
 
 

-

 
-

+

+
+
 

 
 
Random

@@ -973,7 +953,7 @@ but are outside the scope of this page.
 
        
The entropy seed used by the OpenSSL library is contained in a file,
 usually called
-.rnd, which must be available when starting the NTP daemon
+.rnd, which must be available when starting the NTP daemon
 or the
 ntp-keygen
 program. 
@@ -995,14 +975,15 @@ If the
 RANDFILE
 environment variable is not present,
 the library will look for the
-.rnd file in the user home directory. 
+.rnd file in the user home directory. 
 If the file is not available or cannot be written,
 the daemon exits with a message to the system log and the program
 exits with a suitable error message. 
 

-

 
-

+

+
+
 

 
 
Cryptographic

@@ -1017,7 +998,7 @@ The second contains the datestamp in conventional Unix date format.
 Lines beginning with # are considered comments and ignored by the
 ntp-keygen
 program and
-ntpd(8)
+ntpd(1ntpdmdoc)
 daemon. 
 Cryptographic values are encoded first using ASN.1 rules,
 then encrypted if necessary, and finally written PEM-encoded
@@ -1035,19 +1016,19 @@ keyno
 type
 key
 where
-keyno is a positive integer in the range 1-65,535,
-type is the string MD5 defining the key format and
-key is the key itself,
+keyno is a positive integer in the range 1-65,535,
+type is the string MD5 defining the key format and
+key is the key itself,
 which is a printable ASCII string 16 characters or less in length. 
 Each character is chosen from the 93 printable characters
 in the range 0x21 through 0x7f excluding space and the
-#
+‘#’
 character.
 
        
Note that the keys used by the
-ntpq(8)
+ntpq(1ntpqmdoc)
 and
-ntpdc(8)
+ntpdc(1ntpdcmdoc)
 programs
 are checked against passwords requested by the programs
 and entered by hand, so it is generally appropriate to specify these keys
@@ -1056,17 +1037,12 @@ in human readable ASCII format.
        
The
 ntp-keygen
 program generates a MD5 symmetric keys file
-ntpkey_MD5key_NsArhostname.filestamp. 
-Ns
-Ar
-hostname.filestamp
-. 
+ntpkey_MD5key_NsArhostname.filestamp. 
 Since the file contains private shared keys,
 it should be visible only to root and distributed by secure means
 to other subnet hosts. 
 The NTP daemon loads the file
-ntp.keys,
-,
+ntp.keys,
 so
 ntp-keygen
 installs a soft link from this name to the generated file. 
@@ -1075,9 +1051,9 @@ or automated means on the other subnet hosts.
 While this file is not used with the Autokey Version 2 protocol,
 it is needed to authenticate some remote configuration commands
 used by the
-ntpq(8)
+ntpq(1ntpqmdoc)
 and
-ntpdc(8)
+ntpdc(1ntpdcmdoc)
 utilities.
 
        
This section was generated by AutoGen,
@@ -1085,7 +1061,7 @@ using the agtexi-cmd template and the option descriptions for the <
 This software is released under the NTP license, <http://ntp.org/license>.
 
      

 
 

+
+
 

-Next: ,
+Next: ,
 Up: Cryptographic
-

+
 

 
-
ntp-keygen help/usage (--help)

+
ntp-keygen help/usage (--help)

 
      

 This is the automatically generated usage text for ntp-keygen.
 
        
The text printed is the same whether selected with the help option
-(--help) or the more-help option (--more-help).  more-help will print
+(--help) or the more-help option (--more-help).  more-help will print
 the usage text by passing it through a pager program. 
 more-help is disabled on platforms without a working
 fork(2) function.  The PAGER environment variable is
-used to select the program, defaulting to more.  Both will exit
+used to select the program, defaulting to more.  Both will exit
 with a status code of 0.
 
-     
     ntp-keygen (ntp) - Create a NTP host key - Ver. 4.2.7p336
+     
     ntp-keygen (ntp) - Create a NTP host key - Ver. 4.2.7p337
      USAGE:  ntp-keygen [ -<flag> [<val>] | --<name>[{=| }<val>] ]...
        Flg Arg Option-Name    Description
         -b Num imbits         identity modulus bits
@@ -1183,18 +1161,20 @@ with a status code of 0.
      please send bug reports to:  http://bugs.ntp.org, bugs@ntp.org
 

        

+
+
 

-Next: ,
+Next: ,
 Previous: ntp-keygen usage,
 Up: Cryptographic
-

+
 

 
 
imbits option (-b)

 
      

 This is the “identity modulus bits” option. 
-This option takes an argument number imbits.
+This option takes an argument number imbits.
 
      
This option has some usage constraints.  It:
           
    
@@ -1203,18 +1183,20 @@ This option takes an argument number imbits.
 
        
    The number of bits in the identity modulus.  The default is 256. 
 
    
+
+
 
    
-Next: ,
+Next: ,
 Previous: ntp-keygen imbits,
 Up: Cryptographic
-
    
+
 
    
 
 
    certificate option (-c)
    
 
      
    
 This is the “certificate scheme” option. 
-This option takes an argument string scheme.
+This option takes an argument string scheme.
 
      
    This option has some usage constraints.  It:
           
      
@@ -1230,18 +1212,20 @@ Note that RSA schemes must be used with a RSA sign key and DSA
 schemes must be used with a DSA sign key.  The default without
 this option is RSA-MD5. 
 
      
+
+
 
      
-Next: ,
+Next: ,
 Previous: ntp-keygen certificate,
 Up: Cryptographic
-
      
+
 
      
 
 
      cipher option (-C)
      
 
      
      
 This is the “privatekey cipher” option. 
-This option takes an argument string cipher.
+This option takes an argument string cipher.
 
      
      This option has some usage constraints.  It:
           
        
@@ -1250,14 +1234,16 @@ This option takes an argument string cipher.
 
        
        Select the cipher which is used to encrypt the files containing
 private keys.  The default is three-key triple DES in CBC mode,
-equivalent to "-C des-ede3-cbc".  The openssl tool lists ciphers
+equivalent to "-C des-ede3-cbc".  The openssl tool lists ciphers
 available in "openssl -h" output. 
-
        
+
        
+
+
 
        
-Next: ,
+Next: ,
 Previous: ntp-keygen cipher,
 Up: Cryptographic
-
        
+
 
        
 
 
        id-key option (-e)
        
@@ -1273,11 +1259,13 @@ This is the “write iff or gq identity keys” option.
        
        Write the IFF or GQ client keys to the standard output.  This is
 intended for automatic key distribution by mail. 
 
        
+
+
 
        
-Next: ,
+Next: ,
 Previous: ntp-keygen id-key,
 Up: Cryptographic
-
        
+
 
        
 
 
        gq-params option (-G)
        
@@ -1293,11 +1281,13 @@ This is the “generate gq parameters and keys” option.
        
        Generate parameters and keys for the GQ identification scheme,
 obsoleting any that may exist. 
 
        
+
+
 
        
-Next: ,
+Next: ,
 Previous: ntp-keygen gq-params,
 Up: Cryptographic
-
        
+
 
        
 
 
        host-key option (-H)
        
@@ -1312,11 +1302,13 @@ This is the “generate rsa host key” option.
 
        
        Generate new host keys, obsoleting any that may exist. 
 
        
+
+
 
        
-Next: ,
+Next: ,
 Previous: ntp-keygen host-key,
 Up: Cryptographic
-
        
+
 
        
 
 
        iffkey option (-I)
        
@@ -1332,18 +1324,20 @@ This is the “generate iff parameters” option.
        
        Generate parameters for the IFF identification scheme, obsoleting
 any that may exist. 
 
        
+
+
 
        
-Next: ,
+Next: ,
 Previous: ntp-keygen iffkey,
 Up: Cryptographic
-
        
+
 
        
 
 
        ident option (-i)
        
 
      
        
 This is the “set autokey group name” option. 
-This option takes an argument string group.
+This option takes an argument string group.
 
      
        This option has some usage constraints.  It:
           
          
@@ -1353,24 +1347,27 @@ This option takes an argument string group.
        
          Set the optional Autokey group name to name.  This is used in
 the file name of IFF, GQ, and MV client parameters files.  In
 that role, the default is the host name if this option is not
-provided.  The group name, if specified using -i/–ident or
-using -s/–subject-name following an '´character, is also a
-part of the self-signed host certificate's subject and issuer
-names in the form host
-       
          or 'server ident' configuration in ntpd's configuration file. 
-
          
+provided.  The group name, if specified using -i/--ident or
+using -s/--subject-name following an '}' character,
+is also a part of the self-signed host certificate's subject and
+issuer names in the form host
+       
          'crypto ident' or 'server ident' configuration in
+ntpd's configuration file. 
+
          
+
+
 
          
-Next: ,
+Next: ,
 Previous: ntp-keygen ident,
 Up: Cryptographic
-
          
+
 
          
 
 
          lifetime option (-l)
          
 
      
          
-This is the “set certificate lifetime” option. 
-This option takes an argument number lifetime.
+This is the ``set certificate lifetime'' option. 
+This option takes an argument number lifetime.
 
      
          This option has some usage constraints.  It:
           
            
@@ -1379,31 +1376,35 @@ This option takes an argument number lifetime.
 
        
            Set the certificate expiration to lifetime days from now. 
 
            
+
+
 
            
-Next: ,
+Next: ,
 Previous: ntp-keygen lifetime,
 Up: Cryptographic
-
            
+
 
            
 
 
            md5key option (-M)
            
 
      
            
-This is the “generate md5 keys” option. 
+This is the ``generate md5 keys'' option. 
 Generate MD5 keys, obsoleting any that may exist. 
 
            
+
+
 
            
-Next: ,
+Next: ,
 Previous: ntp-keygen md5key,
 Up: Cryptographic
-
            
+
 
            
 
 
            modulus option (-m)
            
 
      
            
-This is the “modulus” option. 
-This option takes an argument number modulus.
+This is the ``modulus'' option. 
+This option takes an argument number modulus.
 
      
            This option has some usage constraints.  It:
           
              
@@ -1412,17 +1413,19 @@ This option takes an argument number modulus.
 
        
              The number of bits in the prime modulus.  The default is 512. 
 
              
+
+
 
              
-Next: ,
+Next: ,
 Previous: ntp-keygen modulus,
 Up: Cryptographic
-
              
+
 
              
 
 
              pvt-cert option (-P)
              
 
      
              
-This is the “generate pc private certificate” option.
+This is the ``generate pc private certificate'' option.
 
      
              This option has some usage constraints.  It:
           
                
@@ -1432,18 +1435,20 @@ This is the “generate pc private certificate” option.
        
                Generate a private certificate.  By default, the program generates
 public certificates. 
 
                
+
+
 
                
-Next: ,
+Next: ,
 Previous: ntp-keygen pvt-cert,
 Up: Cryptographic
-
                
+
 
                
 
 
                pvt-passwd option (-p)
                
 
      
                
-This is the “output private password” option. 
-This option takes an argument string passwd.
+This is the ``output private password'' option. 
+This option takes an argument string passwd.
 
      
                This option has some usage constraints.  It:
           
                  
@@ -1451,20 +1456,22 @@ This option takes an argument string passwd.
 
                
 
        
                Encrypt generated files containing private data with the specified
-password and the cipher selected with -C/–cipher. 
+password and the cipher selected with -C/--cipher. 
 
                
+
+
 
                
-Next: ,
+Next: ,
 Previous: ntp-keygen pvt-passwd,
 Up: Cryptographic
-
                
+
 
                
 
 
                get-pvt-passwd option (-q)
                
 
      
                
-This is the “input private password” option. 
-This option takes an argument string passwd.
+This is the ``input private password'' option. 
+This option takes an argument string passwd.
 
      
                This option has some usage constraints.  It:
           
                  
@@ -1473,18 +1480,20 @@ This option takes an argument string passwd.
 
        
                  Set the password for reading files to the specified password. 
 
                  
+
+
 
                  
-Next: ,
+Next: ,
 Previous: ntp-keygen get-pvt-passwd,
 Up: Cryptographic
-
                  
+
 
                  
 
 
                  sign-key option (-S)
                  
 
      
                  
-This is the “generate sign key (rsa or dsa)” option. 
-This option takes an argument string sign.
+This is the ``generate sign key (rsa or dsa)'' option. 
+This option takes an argument string sign.
 
      
                  This option has some usage constraints.  It:
           
                    
@@ -1495,18 +1504,20 @@ This option takes an argument string sign.
 that may exist.  By default, the program uses the host key as the
 sign key. 
 
                    
+
+
 
                    
-Next: ,
+Next: ,
 Previous: ntp-keygen sign-key,
 Up: Cryptographic
-
                    
+
 
                    
 
 
                    subject-name option (-s)
                    
 
      
                    
-This is the “set host and optionally group name” option. 
-This option takes an argument string host@group.
+This is the ``set host and optionally group name'' option. 
+This option takes an argument string host@group.
 
      
                    This option has some usage constraints.  It:
           
                      
@@ -1514,27 +1525,29 @@ This option takes an argument string host@group.
 
                    
 
        
                    Set the Autokey host name, and optionally, group name specified
-following an '´character.  The host name is used in the file
+following an '}' character.  The host name is used in the file
 name of generated host and signing certificates, without the
 group name.  The host name, and if provided, group name are used
 in host
-       
                    fields.  Specifying '-s  is allowed, and results in
-leaving the host name unchanged while appending
+       
                    fields.  Specifying '-s
+       
                    leaving the host name unchanged while appending
        
                    subject and issuer fields, as with -i group.  The group name, or
 if not provided, the host name are also used in the file names
 of IFF, GQ, and MV client parameter files. 
-
                    
+
                    
+
+
 
                    
-Next: ,
+Next: ,
 Previous: ntp-keygen subject-name,
 Up: Cryptographic
-
                    
+
 
                    
 
 
                    trusted-cert option (-T)
                    
 
      
                    
-This is the “trusted certificate (tc scheme)” option.
+This is the ``trusted certificate (tc scheme)'' option.
 
      
                    This option has some usage constraints.  It:
           
                      
@@ -1544,18 +1557,20 @@ This is the “trusted certificate (tc scheme)” option.
        
                      Generate a trusted certificate.  By default, the program generates
 a non-trusted certificate. 
 
                      
+
+
 
                      
-Next: ,
+Next: ,
 Previous: ntp-keygen trusted-cert,
 Up: Cryptographic
-
                      
+
 
                      
 
 
                      mv-params option (-V)
                      
 
      
                      
-This is the “generate <num> mv parameters” option. 
-This option takes an argument number num.
+This is the ``generate <num> mv parameters'' option. 
+This option takes an argument number num.
 
      
                      This option has some usage constraints.  It:
           
                        
@@ -1565,32 +1580,36 @@ This option takes an argument number num.
        
                        Generate parameters and keys for the Mu-Varadharajan (MV)
 identification scheme. 
 
                        
+
+
 
                        
-Next: ,
+Next: ,
 Previous: ntp-keygen mv-params,
 Up: Cryptographic
-
                        
+
 
                        
 
 
                        mv-keys option (-v)
                        
 
      
                        
-This is the “update <num> mv keys” option. 
-This option takes an argument number num.
+This is the ``update <num> mv keys'' option. 
+This option takes an argument number num.
 
      
                        This option has some usage constraints.  It:
           
                          
 
                        • must be compiled in by defining AUTOKEY during the compilation. 
 
                        
 
-       
                        This option has no doc documentation.
+       
                        This option has no ‘doc’ documentation.
 
 
                        
+
+
 
                        
-Next: ,
+Next: ,
 Previous: ntp-keygen mv-keys,
 Up: Cryptographic
-
                        
+
 
                        
 
 
                        presetting/configuring ntp-keygen
                        
@@ -1608,9 +1627,9 @@ values are treated like option arguments.
 
                      • $PWD
 
                      
        The environment variables HOME, and PWD
-are expanded and replaced when ntp-keygen runs. 
+are expanded and replaced when ntp-keygen runs. 
 For any of these that are plain files, they are simply processed. 
-For any that are directories, then a file named .ntprc is searched for
+For any that are directories, then a file named .ntprc is searched for
 within that directory and processed.
 
        
                      Configuration files may be in a wide variety of formats. 
@@ -1623,10 +1642,10 @@ lines by escaping the newline with a backslash.
 Common options are collected at the top, followed by program specific
 segments.  The segments are separated by lines like:
      
                               [NTP-KEYGEN]
-    
                      
+

        
or by
      
         <?program ntp-keygen>
-    

+

Do not mix these styles within one configuration file.

Compound values and carefully constructed string values may also be @@ -1634,10 +1653,10 @@ specified using XML syntax: 

         <option-name>
             <sub-opt>...&lt;...&gt;...</sub-opt>
          </option-name>
-
+

yielding an option-name.sub-opt string value of 

         "...<...>..."
-
+

AutoOpts does not track suboptions. You simply note that it is a hierarchicly valued option. AutoOpts does provide a means for searching the associated name/value pair list (see: optionFindValue). @@ -1652,42 +1671,46 @@ detail to provide. The default is to print just the version. The licensing inf first letter of the argument is examined:

-
version
Only print the version. This is the default. -
copyright
Name the copyright usage licensing terms. -
verbose
Print the full copyright usage licensing terms. +
‘version’
Only print the version. This is the default. +
‘copyright’
Name the copyright usage licensing terms. +
‘verbose’
Print the full copyright usage licensing terms.
+ +

-Next: , +Next: , Previous: ntp-keygen config, Up: Cryptographic -
+

ntp-keygen exit status

One of the following exit values will be returned:

-
0 (EXIT_SUCCESS)
Successful program execution. -
1 (EXIT_FAILURE)
The operation failed or the command syntax was not valid. -
66 (EX_NOINPUT)
A specified configuration file could not be loaded. -
70 (EX_SOFTWARE)
libopts had an internal operational error. Please report +
‘0 (EXIT_SUCCESS)’
Successful program execution. +
‘1 (EXIT_FAILURE)’
The operation failed or the command syntax was not valid. +
‘66 (EX_NOINPUT)’
A specified configuration file could not be loaded. +
‘70 (EX_SOFTWARE)’
libopts had an internal operational error. Please report it to autogen-users@lists.sourceforge.net. Thank you.
+ +

-Next: , +Next: , Previous: ntp-keygen exit status, Up: Cryptographic -
+

ntp-keygen Usage

The --p -Ar -password option specifies the write password and --q -Ar -password option the read password for previously encrypted files. +-p -password option specifies the write password and +-q -password option the read password for previously encrypted files. The ntp-keygen program prompts for the password if it reads an encrypted file @@ -1696,11 +1719,13 @@ If an encrypted file is read successfully and no write password is specified, the read password is used as the write password by default.

+ +

-Next: , +Next: , Previous: ntp-keygen Usage, Up: Cryptographic -
+

ntp-keygen Notes

@@ -1708,10 +1733,12 @@ Up: Cryptographic

This document corresponds to version of NTP. Portions of this document came from FreeBSD.

+ +

-Previous: ntp-keygen Notes, +Previous: ntp-keygen Notes, Up: Cryptographic -
+

ntp-keygen Bugs

@@ -1724,11 +1751,12 @@ with older architectures such as SPARC IPC.

Please report bugs to http://bugs.ntp.org .

+

-Next: , +Next: , Previous: Running the Program, Up: Top -
+
@@ -1736,59 +1764,67 @@ Up: Top

All cryptographically sound key generation schemes must have means to randomize the entropy seed used to initialize the internal -pseudo-random number generator used by the OpenSSL library routines. If -a site supports ssh, it is very likely that means to do this are -already available. The entropy seed used by the OpenSSL library is -contained in a file, usually called .rnd, which must be available when -starting the ntp-keygen program or ntpd daemon. +pseudo-random number generator used by the OpenSSL library routines. +If a site supports ssh, it is very likely that means to do this are +already available. +The entropy seed used by the OpenSSL library is contained in a file, +usually called .rnd, which must be available when +starting the ntp-keygen program or ntpd daemon.

The OpenSSL library looks for the file using the path specified by the -RANDFILE environment variable in the user home directory, whether root -or some other user. If the RANDFILE environment variable is not -present, the library looks for the .rnd file in the user home -directory. Since both the ntp-keygen program and ntpd daemon must run -as root, the logical place to put this file is in /.rnd or /root/.rnd. +RANDFILE environment variable in the user home directory, whether root +or some other user. +If the RANDFILE environment variable is not +present, the library looks for the .rnd file in the user home +directory. +Since both the ntp-keygen program and ntpd daemon must run +as root, the logical place to put this file is in /.rnd or +/root/.rnd. If the file is not available or cannot be written, the program exits with a message to the system log.

+

-Previous: Random Seed File, +Previous: Random Seed File, Up: Top -
+

Cryptographic Data Files

-

File and link names are in the form ntpkey_key_name.fstamp, where key -is the key or parameter type, name is the host or group name and fstamp -is the filestamp (NTP seconds) when the file was created). By -convention, key names in generated file names include both upper and +

File and link names are in the form ntpkey_key_name.fstamp, +where key is the key or parameter type, +name is the host or group name and +fstamp is the filestamp (NTP seconds) when the file was created). +By convention, key names in generated file names include both upper and lower case characters, while key names in generated link names include only lower case characters. The filestamp is not used in generated link names. -

The key name is a string defining the cryptographic key type. Key types -include public/private keys host and sign, certificate cert and several -challenge/response key types. By convention, client files used for +

The key name is a string defining the cryptographic key type. +Key types include public/private keys host and sign, certificate cert +and several challenge/response key types. +By convention, client files used for challenges have a par subtype, as in the IFF challenge IFFpar, while server files for responses have a key subtype, as in the GQ response GQkey.

All files begin with two nonencrypted lines. The first line contains -the file name in the format ntpkey_key_host.fstamp. The second line -contains the datestamp in conventional Unix date format. Lines -beginning with # are ignored. +the file name in the format ntpkey_key_host.fstamp. +The second line contains the datestamp in conventional Unix date format. +Lines beginning with # are ignored.

The remainder of the file contains cryptographic data encoded first using ASN.1 rules, then encrypted using the DES-CBC algorithm with given password and finally written in PEM-encoded printable ASCII text preceded and followed by MIME content identifier lines. -

The format of the symmetric keys file, ordinarily named ntp.keys, is -somewhat different than the other files in the interest of backward -compatibility. Ordinarily, the file is generated by this program, but +

The format of the symmetric keys file, ordinarily named ntp.keys, +is somewhat different than the other files in the interest of backward +compatibility. +Ordinarily, the file is generated by this program, but it can be constructed and edited using an ordinary text editor. 

         # ntpkey_MD5key_hms.local.3564038757
@@ -1814,37 +1850,47 @@ it can be constructed and edited using an ordinary text editor.
          18 SHA1 b5520c9fadd7ad3fd8bfa061c8821b65d029bb37  # SHA1 key
          19 SHA1 8c74fb440ec80f453ec6aaa62b9baed0ab723b92  # SHA1 key
          20 SHA1 6bc05f734306a189326000970c19b3910f403795  # SHA1 key
-
+

Figure 1. Typical Symmetric Key File

Figure 1 shows a typical symmetric keys file used by the reference -implementation. Each line of the file contains three fields, first an +implementation. +Each line of the file contains three fields, first an integer between 1 and 65534, inclusive, representing the key identifier -used in the server and peer configuration commands. Next is the key -type for the message digest algorithm, which in the absence of the +used in the server and peer configuration commands. +Next is the key type for the message digest algorithm, +which in the absence of the OpenSSL library must be MD5 to designate the MD5 message digest -algorithm. If the OpenSSL library is installed, the key type can be any -message digest algorithm supported by that library. However, if +algorithm. +If the OpenSSL library is installed, the key type can be any +message digest algorithm supported by that library. +However, if compatibility with FIPS 140-2 is required, the key type must be either -SHA or SHA1. The key type can be changed using an ASCII text editor. +SHA or SHA1. +The key type can be changed using an ASCII text editor.

An MD5 key consists of a printable ASCII string less than or equal to -16 characters and terminated by whitespace or a # character. An OpenSSL +16 characters and terminated by whitespace or a # character. +An OpenSSL key consists of a hex-encoded ASCII string of 40 characters, which is truncated as necessary. -

Note that the keys used by the ntpq and ntpdc programs are checked -against passwords requested by the programs and entered by hand, so it +

Note that the keys used by the ntpq and ntpdc programs are +checked against passwords requested by the programs and entered by hand, +so it is generally appropriate to specify these keys in human readable ASCII format.

The ntp-keygen program generates a MD5 symmetric keys file -ntpkey_MD5key_hostname.filestamp. Since the file contains private +ntpkey_MD5key_hostname.filestamp. +Since the file contains private shared keys, it should be visible only to root and distributed by -secure means to other subnet hosts. The NTP daemon loads the file -ntp.keys, so ntp-keygen installs a soft link from this name to the -generated file. Subsequently, similar soft links must be installed by -manual or automated means on the other subnet hosts. While this file is +secure means to other subnet hosts. +The NTP daemon loads the file ntp.keys, so ntp-keygen +installs a soft link from this name to the generated file. +Subsequently, similar soft links must be installed by +manual or automated means on the other subnet hosts. +While this file is not used with the Autokey Version 2 protocol, it is needed to authenticate some remote configuration commands used by the ntpq and ntpdc utilities.