ntp-keygen.html revision 1.1.1.6
1 <html lang="en"> 2 <head> 3 <title>Ntp-keygen User's Manual</title> 4 <meta http-equiv="Content-Type" content="text/html"> 5 <meta name="description" content="Ntp-keygen User's Manual"> 6 <meta name="generator" content="makeinfo 4.8"> 7 <link title="Top" rel="top" href="#Top"> 8 <link href="http://www.gnu.org/software/texinfo/" rel="generator-home" title="Texinfo Homepage"> 9 <meta http-equiv="Content-Style-Type" content="text/css"> 10 <style type="text/css"><!-- 11 pre.display { font-family:inherit } 12 pre.format { font-family:inherit } 13 pre.smalldisplay { font-family:inherit; font-size:smaller } 14 pre.smallformat { font-family:inherit; font-size:smaller } 15 pre.smallexample { font-size:smaller } 16 pre.smalllisp { font-size:smaller } 17 span.sc { font-variant:small-caps } 18 span.roman { font-family:serif; font-weight:normal; } 19 span.sansserif { font-family:sans-serif; font-weight:normal; } 20 --></style> 21 </head> 22 <body> 23 <h1 class="settitle">Ntp-keygen User's Manual</h1> 24 <div class="shortcontents"> 25 <h2>Short Contents</h2> 26 <ul> 27 <a href="#Top">Top</a> 28 <a href="#Top">NTP Key Generation Program User Manual</a> 29 </ul> 30 </div> 31 32 33 34 <div class="node"> 35 <p><hr> 36 <a name="Top"></a> 37 Up: <a rel="up" accesskey="u" href="#dir">(dir)</a> 38 39 </div> 40 41 <h2 class="unnumbered">Top</h2> 42 43 <ul class="menu"> 44 <li><a accesskey="1" href="#Description">Description</a> 45 <li><a accesskey="2" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a>: Invoking ntp-keygen 46 <li><a accesskey="3" href="#Running-the-Program">Running the Program</a> 47 <li><a accesskey="4" href="#Random-Seed-File">Random Seed File</a> 48 <li><a accesskey="5" href="#Cryptographic-Data-Files">Cryptographic Data Files</a> 49 </ul> 50 51 <div class="node"> 52 <p><hr> 53 <a name="Top"></a> 54 Next: <a rel="next" accesskey="n" href="#Description">Description</a>, 55 Previous: <a rel="previous" accesskey="p" href="#dir">(dir)</a>, 56 Up: <a rel="up" accesskey="u" href="#dir">(dir)</a> 57 58 </div> 59 60 <h2 class="unnumbered">NTP Key Generation Program User Manual</h2> 61 62 <p>This document describes the use of the NTP Project's <code>ntp-keygen</code> 63 program, that generates cryptographic data files used by the NTPv4 64 authentication and identity schemes. 65 It can generate message digest keys used in symmetric key cryptography and, 66 if the OpenSSL software 67 library has been installed, it can generate host keys, sign keys, 68 certificates, and identity keys and parameters used by the Autokey 69 public key cryptography. 70 The message digest keys file is generated in a 71 format compatible with NTPv3. 72 All other files are in PEM-encoded 73 printable ASCII format so they can be embedded as MIME attachments in 74 mail to other sites. 75 76 <p>This document applies to version 4.2.8p5 of <code>ntp-keygen</code>. 77 78 <div class="node"> 79 <p><hr> 80 <a name="Description"></a> 81 Next: <a rel="next" accesskey="n" href="#Running-the-Program">Running the Program</a>, 82 Previous: <a rel="previous" accesskey="p" href="#Top">Top</a>, 83 Up: <a rel="up" accesskey="u" href="#Top">Top</a> 84 85 </div> 86 87 <!-- node-name, next, previous, up --> 88 <h3 class="section">Description</h3> 89 90 <p>This program generates cryptographic data files used by the NTPv4 91 authentication and identity schemes. It can generate message digest 92 keys used in symmetric key cryptography and, if the OpenSSL software 93 library has been installed, it can generate host keys, sign keys, 94 certificates, and identity keys and parameters used by the Autokey 95 public key cryptography. The message digest keys file is generated in a 96 format compatible with NTPv3. All other files are in PEM-encoded 97 printable ASCII format so they can be embedded as MIME attachments in 98 mail to other sites. 99 100 <p>When used to generate message digest keys, the program produces a file 101 containing ten pseudo-random printable ASCII strings suitable for the 102 MD5 message digest algorithm included in the distribution. 103 If the 104 OpenSSL library is installed, it produces an additional ten hex-encoded 105 random bit strings suitable for the SHA1 and other message digest 106 algorithms. 107 The message digest keys file must be distributed and stored 108 using secure means beyond the scope of NTP itself. 109 Besides the keys 110 used for ordinary NTP associations, additional keys can be defined as 111 passwords for the ntpq and ntpdc utility programs. 112 113 <p>The remaining generated files are compatible with other OpenSSL 114 applications and other Public Key Infrastructure (PKI) resources. 115 Certificates generated by this program are compatible with extant 116 industry practice, although some users might find the interpretation of 117 X509v3 extension fields somewhat liberal. 118 However, the identity keys 119 are probably not compatible with anything other than Autokey. 120 121 <p>Some files used by this program are encrypted using a private password. 122 The <code>-p</code> option specifies the password for local encrypted files and the 123 <code>-q</code> option the password for encrypted files sent to remote sites. 124 If no password is specified, the host name returned by the Unix 125 <code>gethostname()</code> function, normally the DNS name of the host, is used. 126 127 <p>The <kbd>pw</kbd> option of the <code>crypto</code> configuration command 128 specifies the read password for previously encrypted local files. 129 This must match the local password used by this program. 130 If not specified, the host name is used. 131 Thus, if files are generated by this program without password, 132 they can be read back by ntpd without password, but only on the same 133 host. 134 135 <p>Normally, encrypted files for each host are generated by that host and 136 used only by that host, although exceptions exist as noted later on 137 this page. 138 The symmetric keys file, normally called <code>ntp.keys</code>, is 139 usually installed in <code>/etc</code>. 140 Other files and links are usually installed 141 in <code>/usr/local/etc</code>, which is normally in a shared filesystem in 142 NFS-mounted networks and cannot be changed by shared clients. 143 The location of the keys directory can be changed by the keysdir 144 configuration command in such cases. 145 Normally, this is in <code>/etc</code>. 146 147 <p>This program directs commentary and error messages to the standard 148 error stream <code>stderr</code> and remote files to the standard output stream 149 <code>stdout</code> where they can be piped to other applications or redirected to 150 files. 151 The names used for generated files and links all begin with the 152 string <code>ntpkey</code> and include the file type, 153 generating host and filestamp, 154 as described in the <a href="#Cryptographic-Data-Files">Cryptographic Data Files</a> section below. 155 156 <div class="node"> 157 <p><hr> 158 <a name="Running-the-Program"></a> 159 Next: <a rel="next" accesskey="n" href="#Random-Seed-File">Random Seed File</a>, 160 Previous: <a rel="previous" accesskey="p" href="#Description">Description</a>, 161 Up: <a rel="up" accesskey="u" href="#Top">Top</a> 162 163 </div> 164 165 <!-- node-name, next, previous, up --> 166 <h3 class="section">Running the Program</h3> 167 168 <p>To test and gain experience with Autokey concepts, log in as root and 169 change to the keys directory, usually <code>/usr/local/etc</code>. 170 When run for the 171 first time, or if all files with names beginning <code>ntpkey</code>] have been 172 removed, use the <code>ntp-keygen</code> command without arguments to generate a 173 default RSA host key and matching RSA-MD5 certificate with expiration 174 date one year hence. 175 If run again without options, the program uses the 176 existing keys and parameters and generates only a new certificate with 177 new expiration date one year hence. 178 179 <p>Run the command on as many hosts as necessary. 180 Designate one of them as the trusted host (TH) using <code>ntp-keygen</code> 181 with the <code>-T</code> option and configure 182 it to synchronize from reliable Internet servers. 183 Then configure the other hosts to synchronize to the TH directly or indirectly. 184 A certificate trail is created when Autokey asks the immediately 185 ascendant host towards the TH to sign its certificate, which is then 186 provided to the immediately descendant host on request. 187 All group hosts should have acyclic certificate trails ending on the TH. 188 189 <p>The host key is used to encrypt the cookie when required and so must be 190 RSA type. 191 By default, the host key is also the sign key used to encrypt signatures. 192 A different sign key can be assigned using the <code>-S</code> option 193 and this can be either RSA or DSA type. 194 By default, the signature 195 message digest type is MD5, but any combination of sign key type and 196 message digest type supported by the OpenSSL library can be specified 197 using the <code>-c</code> option. 198 199 <p>The rules say cryptographic media should be generated with proventic 200 filestamps, which means the host should already be synchronized before 201 this program is run. 202 This of course creates a chicken-and-egg problem 203 when the host is started for the first time. 204 Accordingly, the host time 205 should be set by some other means, such as eyeball-and-wristwatch, at 206 least so that the certificate lifetime is within the current year. 207 After that and when the host is synchronized to a proventic source, the 208 certificate should be re-generated. 209 210 <p>Additional information on trusted groups and identity schemes is on the 211 Autokey Public-Key Authentication page. 212 213 <div class="node"> 214 <p><hr> 215 <a name="ntp-keygen-Invocation"></a> 216 <a name="ntp_002dkeygen-Invocation"></a> 217 218 219 </div> 220 221 <h3 class="section">Invoking ntp-keygen</h3> 222 223 <p><a name="index-ntp_002dkeygen-1"></a><a name="index-Create-a-NTP-host-key-2"></a> 224 225 <p>This program generates cryptographic data files used by the NTPv4 226 authentication and identification schemes. 227 It generates MD5 key files used in symmetric key cryptography. 228 In addition, if the OpenSSL software library has been installed, 229 it generates keys, certificate and identity files used in public key 230 cryptography. 231 These files are used for cookie encryption, 232 digital signature and challenge/response identification algorithms 233 compatible with the Internet standard security infrastructure. 234 235 <p>All files are in PEM-encoded printable ASCII format, 236 so they can be embedded as MIME attachments in mail to other sites 237 and certificate authorities. 238 By default, files are not encrypted. 239 240 <p>When used to generate message digest keys, the program produces a file 241 containing ten pseudo-random printable ASCII strings suitable for the 242 MD5 message digest algorithm included in the distribution. 243 If the OpenSSL library is installed, it produces an additional ten 244 hex-encoded random bit strings suitable for the SHA1 and other message 245 digest algorithms. 246 The message digest keys file must be distributed and stored 247 using secure means beyond the scope of NTP itself. 248 Besides the keys used for ordinary NTP associations, additional keys 249 can be defined as passwords for the 250 <code>ntpq(1ntpqmdoc)</code> 251 and 252 <code>ntpdc(1ntpdcmdoc)</code> 253 utility programs. 254 255 <p>The remaining generated files are compatible with other OpenSSL 256 applications and other Public Key Infrastructure (PKI) resources. 257 Certificates generated by this program are compatible with extant 258 industry practice, although some users might find the interpretation of 259 X509v3 extension fields somewhat liberal. 260 However, the identity keys are probably not compatible with anything 261 other than Autokey. 262 263 <p>Some files used by this program are encrypted using a private password. 264 The 265 <code>-p</code> 266 option specifies the password for local encrypted files and the 267 <code>-q</code> 268 option the password for encrypted files sent to remote sites. 269 If no password is specified, the host name returned by the Unix 270 <code>gethostname()</code> 271 function, normally the DNS name of the host is used. 272 273 <p>The 274 <kbd>pw</kbd> 275 option of the 276 <kbd>crypto</kbd> 277 configuration command specifies the read 278 password for previously encrypted local files. 279 This must match the local password used by this program. 280 If not specified, the host name is used. 281 Thus, if files are generated by this program without password, 282 they can be read back by 283 <kbd>ntpd</kbd> 284 without password but only on the same host. 285 286 <p>Normally, encrypted files for each host are generated by that host and 287 used only by that host, although exceptions exist as noted later on 288 this page. 289 The symmetric keys file, normally called 290 <kbd>ntp.keys</kbd>, 291 is usually installed in 292 <samp><span class="file">/etc</span></samp>. 293 Other files and links are usually installed in 294 <samp><span class="file">/usr/local/etc</span></samp>, 295 which is normally in a shared filesystem in 296 NFS-mounted networks and cannot be changed by shared clients. 297 The location of the keys directory can be changed by the 298 <kbd>keysdir</kbd> 299 configuration command in such cases. 300 Normally, this is in 301 <samp><span class="file">/etc</span></samp>. 302 303 <p>This program directs commentary and error messages to the standard 304 error stream 305 <kbd>stderr</kbd> 306 and remote files to the standard output stream 307 <kbd>stdout</kbd> 308 where they can be piped to other applications or redirected to files. 309 The names used for generated files and links all begin with the 310 string 311 <kbd>ntpkey</kbd> 312 and include the file type, generating host and filestamp, 313 as described in the 314 Cryptographic Data Files 315 section below. 316 317 <h5 class="subsubsection">Running the Program</h5> 318 319 <p>To test and gain experience with Autokey concepts, log in as root and 320 change to the keys directory, usually 321 <samp><span class="file">/usr/local/etc</span></samp> 322 When run for the first time, or if all files with names beginning with 323 <kbd>ntpkey</kbd> 324 have been removed, use the 325 <code>ntp-keygen</code> 326 command without arguments to generate a 327 default RSA host key and matching RSA-MD5 certificate with expiration 328 date one year hence. 329 If run again without options, the program uses the 330 existing keys and parameters and generates only a new certificate with 331 new expiration date one year hence. 332 333 <p>Run the command on as many hosts as necessary. 334 Designate one of them as the trusted host (TH) using 335 <code>ntp-keygen</code> 336 with the 337 <code>-T</code> 338 option and configure it to synchronize from reliable Internet servers. 339 Then configure the other hosts to synchronize to the TH directly or 340 indirectly. 341 A certificate trail is created when Autokey asks the immediately 342 ascendant host towards the TH to sign its certificate, which is then 343 provided to the immediately descendant host on request. 344 All group hosts should have acyclic certificate trails ending on the TH. 345 346 <p>The host key is used to encrypt the cookie when required and so must be 347 RSA type. 348 By default, the host key is also the sign key used to encrypt 349 signatures. 350 A different sign key can be assigned using the 351 <code>-S</code> 352 option and this can be either RSA or DSA type. 353 By default, the signature 354 message digest type is MD5, but any combination of sign key type and 355 message digest type supported by the OpenSSL library can be specified 356 using the 357 <code>-c</code> 358 option. 359 The rules say cryptographic media should be generated with proventic 360 filestamps, which means the host should already be synchronized before 361 this program is run. 362 This of course creates a chicken-and-egg problem 363 when the host is started for the first time. 364 Accordingly, the host time 365 should be set by some other means, such as eyeball-and-wristwatch, at 366 least so that the certificate lifetime is within the current year. 367 After that and when the host is synchronized to a proventic source, the 368 certificate should be re-generated. 369 370 <p>Additional information on trusted groups and identity schemes is on the 371 Autokey Public-Key Authentication 372 page. 373 374 <p>The 375 <code>ntpd(1ntpdmdoc)</code> 376 configuration command 377 <code>crypto</code> <code>pw</code> <kbd>password</kbd> 378 specifies the read password for previously encrypted files. 379 The daemon expires on the spot if the password is missing 380 or incorrect. 381 For convenience, if a file has been previously encrypted, 382 the default read password is the name of the host running 383 the program. 384 If the previous write password is specified as the host name, 385 these files can be read by that host with no explicit password. 386 387 <p>File names begin with the prefix 388 <code>ntpkey_</code> 389 and end with the postfix 390 <kbd>_hostname.filestamp</kbd>, 391 where 392 <kbd>hostname</kbd> 393 is the owner name, usually the string returned 394 by the Unix gethostname() routine, and 395 <kbd>filestamp</kbd> 396 is the NTP seconds when the file was generated, in decimal digits. 397 This both guarantees uniqueness and simplifies maintenance 398 procedures, since all files can be quickly removed 399 by a 400 <code>rm</code> <code>ntpkey*</code> 401 command or all files generated 402 at a specific time can be removed by a 403 <code>rm</code> 404 <kbd>*filestamp</kbd> 405 command. 406 To further reduce the risk of misconfiguration, 407 the first two lines of a file contain the file name 408 and generation date and time as comments. 409 410 <p>All files are installed by default in the keys directory 411 <samp><span class="file">/usr/local/etc</span></samp>, 412 which is normally in a shared filesystem 413 in NFS-mounted networks. 414 The actual location of the keys directory 415 and each file can be overridden by configuration commands, 416 but this is not recommended. 417 Normally, the files for each host are generated by that host 418 and used only by that host, although exceptions exist 419 as noted later on this page. 420 421 <p>Normally, files containing private values, 422 including the host key, sign key and identification parameters, 423 are permitted root read/write-only; 424 while others containing public values are permitted world readable. 425 Alternatively, files containing private values can be encrypted 426 and these files permitted world readable, 427 which simplifies maintenance in shared file systems. 428 Since uniqueness is insured by the hostname and 429 file name extensions, the files for a NFS server and 430 dependent clients can all be installed in the same shared directory. 431 432 <p>The recommended practice is to keep the file name extensions 433 when installing a file and to install a soft link 434 from the generic names specified elsewhere on this page 435 to the generated files. 436 This allows new file generations to be activated simply 437 by changing the link. 438 If a link is present, ntpd follows it to the file name 439 to extract the filestamp. 440 If a link is not present, 441 <code>ntpd(1ntpdmdoc)</code> 442 extracts the filestamp from the file itself. 443 This allows clients to verify that the file and generation times 444 are always current. 445 The 446 <code>ntp-keygen</code> 447 program uses the same timestamp extension for all files generated 448 at one time, so each generation is distinct and can be readily 449 recognized in monitoring data. 450 451 <h5 class="subsubsection">Running the program</h5> 452 453 <p>The safest way to run the 454 <code>ntp-keygen</code> 455 program is logged in directly as root. 456 The recommended procedure is change to the keys directory, 457 usually 458 <samp><span class="file">/usr/local/etc</span></samp>, 459 then run the program. 460 When run for the first time, 461 or if all 462 <code>ntpkey</code> 463 files have been removed, 464 the program generates a RSA host key file and matching RSA-MD5 certificate file, 465 which is all that is necessary in many cases. 466 The program also generates soft links from the generic names 467 to the respective files. 468 If run again, the program uses the same host key file, 469 but generates a new certificate file and link. 470 471 <p>The host key is used to encrypt the cookie when required and so must be RSA type. 472 By default, the host key is also the sign key used to encrypt signatures. 473 When necessary, a different sign key can be specified and this can be 474 either RSA or DSA type. 475 By default, the message digest type is MD5, but any combination 476 of sign key type and message digest type supported by the OpenSSL library 477 can be specified, including those using the MD2, MD5, SHA, SHA1, MDC2 478 and RIPE160 message digest algorithms. 479 However, the scheme specified in the certificate must be compatible 480 with the sign key. 481 Certificates using any digest algorithm are compatible with RSA sign keys; 482 however, only SHA and SHA1 certificates are compatible with DSA sign keys. 483 484 <p>Private/public key files and certificates are compatible with 485 other OpenSSL applications and very likely other libraries as well. 486 Certificates or certificate requests derived from them should be compatible 487 with extant industry practice, although some users might find 488 the interpretation of X509v3 extension fields somewhat liberal. 489 However, the identification parameter files, although encoded 490 as the other files, are probably not compatible with anything other than Autokey. 491 492 <p>Running the program as other than root and using the Unix 493 <code>su</code> 494 command 495 to assume root may not work properly, since by default the OpenSSL library 496 looks for the random seed file 497 <code>.rnd</code> 498 in the user home directory. 499 However, there should be only one 500 <code>.rnd</code>, 501 most conveniently 502 in the root directory, so it is convenient to define the 503 <code>$RANDFILE</code> 504 environment variable used by the OpenSSL library as the path to 505 <code>/.rnd</code>. 506 507 <p>Installing the keys as root might not work in NFS-mounted 508 shared file systems, as NFS clients may not be able to write 509 to the shared keys directory, even as root. 510 In this case, NFS clients can specify the files in another 511 directory such as 512 <samp><span class="file">/etc</span></samp> 513 using the 514 <code>keysdir</code> 515 command. 516 There is no need for one client to read the keys and certificates 517 of other clients or servers, as these data are obtained automatically 518 by the Autokey protocol. 519 520 <p>Ordinarily, cryptographic files are generated by the host that uses them, 521 but it is possible for a trusted agent (TA) to generate these files 522 for other hosts; however, in such cases files should always be encrypted. 523 The subject name and trusted name default to the hostname 524 of the host generating the files, but can be changed by command line options. 525 It is convenient to designate the owner name and trusted name 526 as the subject and issuer fields, respectively, of the certificate. 527 The owner name is also used for the host and sign key files, 528 while the trusted name is used for the identity files. 529 530 <p>All files are installed by default in the keys directory 531 <samp><span class="file">/usr/local/etc</span></samp>, 532 which is normally in a shared filesystem 533 in NFS-mounted networks. 534 The actual location of the keys directory 535 and each file can be overridden by configuration commands, 536 but this is not recommended. 537 Normally, the files for each host are generated by that host 538 and used only by that host, although exceptions exist 539 as noted later on this page. 540 541 <p>Normally, files containing private values, 542 including the host key, sign key and identification parameters, 543 are permitted root read/write-only; 544 while others containing public values are permitted world readable. 545 Alternatively, files containing private values can be encrypted 546 and these files permitted world readable, 547 which simplifies maintenance in shared file systems. 548 Since uniqueness is insured by the hostname and 549 file name extensions, the files for a NFS server and 550 dependent clients can all be installed in the same shared directory. 551 552 <p>The recommended practice is to keep the file name extensions 553 when installing a file and to install a soft link 554 from the generic names specified elsewhere on this page 555 to the generated files. 556 This allows new file generations to be activated simply 557 by changing the link. 558 If a link is present, ntpd follows it to the file name 559 to extract the filestamp. 560 If a link is not present, 561 <code>ntpd(1ntpdmdoc)</code> 562 extracts the filestamp from the file itself. 563 This allows clients to verify that the file and generation times 564 are always current. 565 The 566 <code>ntp-keygen</code> 567 program uses the same timestamp extension for all files generated 568 at one time, so each generation is distinct and can be readily 569 recognized in monitoring data. 570 571 <h5 class="subsubsection">Running the program</h5> 572 573 <p>The safest way to run the 574 <code>ntp-keygen</code> 575 program is logged in directly as root. 576 The recommended procedure is change to the keys directory, 577 usually 578 <samp><span class="file">/usr/local/etc</span></samp>, 579 then run the program. 580 When run for the first time, 581 or if all 582 <code>ntpkey</code> 583 files have been removed, 584 the program generates a RSA host key file and matching RSA-MD5 certificate file, 585 which is all that is necessary in many cases. 586 The program also generates soft links from the generic names 587 to the respective files. 588 If run again, the program uses the same host key file, 589 but generates a new certificate file and link. 590 591 <p>The host key is used to encrypt the cookie when required and so must be RSA type. 592 By default, the host key is also the sign key used to encrypt signatures. 593 When necessary, a different sign key can be specified and this can be 594 either RSA or DSA type. 595 By default, the message digest type is MD5, but any combination 596 of sign key type and message digest type supported by the OpenSSL library 597 can be specified, including those using the MD2, MD5, SHA, SHA1, MDC2 598 and RIPE160 message digest algorithms. 599 However, the scheme specified in the certificate must be compatible 600 with the sign key. 601 Certificates using any digest algorithm are compatible with RSA sign keys; 602 however, only SHA and SHA1 certificates are compatible with DSA sign keys. 603 604 <p>Private/public key files and certificates are compatible with 605 other OpenSSL applications and very likely other libraries as well. 606 Certificates or certificate requests derived from them should be compatible 607 with extant industry practice, although some users might find 608 the interpretation of X509v3 extension fields somewhat liberal. 609 However, the identification parameter files, although encoded 610 as the other files, are probably not compatible with anything other than Autokey. 611 612 <p>Running the program as other than root and using the Unix 613 <code>su</code> 614 command 615 to assume root may not work properly, since by default the OpenSSL library 616 looks for the random seed file 617 <code>.rnd</code> 618 in the user home directory. 619 However, there should be only one 620 <code>.rnd</code>, 621 most conveniently 622 in the root directory, so it is convenient to define the 623 <code>$RANDFILE</code> 624 environment variable used by the OpenSSL library as the path to 625 <code>/.rnd</code>. 626 627 <p>Installing the keys as root might not work in NFS-mounted 628 shared file systems, as NFS clients may not be able to write 629 to the shared keys directory, even as root. 630 In this case, NFS clients can specify the files in another 631 directory such as 632 <samp><span class="file">/etc</span></samp> 633 using the 634 <code>keysdir</code> 635 command. 636 There is no need for one client to read the keys and certificates 637 of other clients or servers, as these data are obtained automatically 638 by the Autokey protocol. 639 640 <p>Ordinarily, cryptographic files are generated by the host that uses them, 641 but it is possible for a trusted agent (TA) to generate these files 642 for other hosts; however, in such cases files should always be encrypted. 643 The subject name and trusted name default to the hostname 644 of the host generating the files, but can be changed by command line options. 645 It is convenient to designate the owner name and trusted name 646 as the subject and issuer fields, respectively, of the certificate. 647 The owner name is also used for the host and sign key files, 648 while the trusted name is used for the identity files. 649 seconds. 650 seconds. 651 652 <p>s Trusted Hosts and Groups 653 Each cryptographic configuration involves selection of a signature scheme 654 and identification scheme, called a cryptotype, 655 as explained in the 656 <a href="#Authentication-Options">Authentication Options</a> 657 section of 658 <code>ntp.conf(5)</code>. 659 The default cryptotype uses RSA encryption, MD5 message digest 660 and TC identification. 661 First, configure a NTP subnet including one or more low-stratum 662 trusted hosts from which all other hosts derive synchronization 663 directly or indirectly. 664 Trusted hosts have trusted certificates; 665 all other hosts have nontrusted certificates. 666 These hosts will automatically and dynamically build authoritative 667 certificate trails to one or more trusted hosts. 668 A trusted group is the set of all hosts that have, directly or indirectly, 669 a certificate trail ending at a trusted host. 670 The trail is defined by static configuration file entries 671 or dynamic means described on the 672 <a href="#Automatic-NTP-Configuration-Options">Automatic NTP Configuration Options</a> 673 section of 674 <code>ntp.conf(5)</code>. 675 676 <p>On each trusted host as root, change to the keys directory. 677 To insure a fresh fileset, remove all 678 <code>ntpkey</code> 679 files. 680 Then run 681 <code>ntp-keygen</code> 682 <code>-T</code> 683 to generate keys and a trusted certificate. 684 On all other hosts do the same, but leave off the 685 <code>-T</code> 686 flag to generate keys and nontrusted certificates. 687 When complete, start the NTP daemons beginning at the lowest stratum 688 and working up the tree. 689 It may take some time for Autokey to instantiate the certificate trails 690 throughout the subnet, but setting up the environment is completely automatic. 691 692 <p>If it is necessary to use a different sign key or different digest/signature 693 scheme than the default, run 694 <code>ntp-keygen</code> 695 with the 696 <code>-S</code> <kbd>type</kbd> 697 option, where 698 <kbd>type</kbd> 699 is either 700 <code>RSA</code> 701 or 702 <code>DSA</code>. 703 The most often need to do this is when a DSA-signed certificate is used. 704 If it is necessary to use a different certificate scheme than the default, 705 run 706 <code>ntp-keygen</code> 707 with the 708 <code>-c</code> <kbd>scheme</kbd> 709 option and selected 710 <kbd>scheme</kbd> 711 as needed. 712 f 713 <code>ntp-keygen</code> 714 is run again without these options, it generates a new certificate 715 using the same scheme and sign key. 716 717 <p>After setting up the environment it is advisable to update certificates 718 from time to time, if only to extend the validity interval. 719 Simply run 720 <code>ntp-keygen</code> 721 with the same flags as before to generate new certificates 722 using existing keys. 723 However, if the host or sign key is changed, 724 <code>ntpd(1ntpdmdoc)</code> 725 should be restarted. 726 When 727 <code>ntpd(1ntpdmdoc)</code> 728 is restarted, it loads any new files and restarts the protocol. 729 Other dependent hosts will continue as usual until signatures are refreshed, 730 at which time the protocol is restarted. 731 732 <h5 class="subsubsection">Identity Schemes</h5> 733 734 <p>As mentioned on the Autonomous Authentication page, 735 the default TC identity scheme is vulnerable to a middleman attack. 736 However, there are more secure identity schemes available, 737 including PC, IFF, GQ and MV described on the 738 "Identification Schemes" 739 page 740 (maybe available at 741 <code>http://www.eecis.udel.edu/%7emills/keygen.html</code>). 742 These schemes are based on a TA, one or more trusted hosts 743 and some number of nontrusted hosts. 744 Trusted hosts prove identity using values provided by the TA, 745 while the remaining hosts prove identity using values provided 746 by a trusted host and certificate trails that end on that host. 747 The name of a trusted host is also the name of its sugroup 748 and also the subject and issuer name on its trusted certificate. 749 The TA is not necessarily a trusted host in this sense, but often is. 750 751 <p>In some schemes there are separate keys for servers and clients. 752 A server can also be a client of another server, 753 but a client can never be a server for another client. 754 In general, trusted hosts and nontrusted hosts that operate 755 as both server and client have parameter files that contain 756 both server and client keys. 757 Hosts that operate 758 only as clients have key files that contain only client keys. 759 760 <p>The PC scheme supports only one trusted host in the group. 761 On trusted host alice run 762 <code>ntp-keygen</code> 763 <code>-P</code> 764 <code>-p</code> <kbd>password</kbd> 765 to generate the host key file 766 <samp><span class="file">ntpkey_RSAkey_</span></samp><kbd>alice.filestamp</kbd> 767 and trusted private certificate file 768 <samp><span class="file">ntpkey_RSA-MD5_cert_</span></samp><kbd>alice.filestamp</kbd>. 769 Copy both files to all group hosts; 770 they replace the files which would be generated in other schemes. 771 On each host bob install a soft link from the generic name 772 <samp><span class="file">ntpkey_host_</span></samp><kbd>bob</kbd> 773 to the host key file and soft link 774 <samp><span class="file">ntpkey_cert_</span></samp><kbd>bob</kbd> 775 to the private certificate file. 776 Note the generic links are on bob, but point to files generated 777 by trusted host alice. 778 In this scheme it is not possible to refresh 779 either the keys or certificates without copying them 780 to all other hosts in the group. 781 782 <p>For the IFF scheme proceed as in the TC scheme to generate keys 783 and certificates for all group hosts, then for every trusted host in the group, 784 generate the IFF parameter file. 785 On trusted host alice run 786 <code>ntp-keygen</code> 787 <code>-T</code> 788 <code>-I</code> 789 <code>-p</code> <kbd>password</kbd> 790 to produce her parameter file 791 <samp><span class="file">ntpkey_IFFpar_</span></samp><kbd>alice.filestamp</kbd>, 792 which includes both server and client keys. 793 Copy this file to all group hosts that operate as both servers 794 and clients and install a soft link from the generic 795 <samp><span class="file">ntpkey_iff_</span></samp><kbd>alice</kbd> 796 to this file. 797 If there are no hosts restricted to operate only as clients, 798 there is nothing further to do. 799 As the IFF scheme is independent 800 of keys and certificates, these files can be refreshed as needed. 801 802 <p>If a rogue client has the parameter file, it could masquerade 803 as a legitimate server and present a middleman threat. 804 To eliminate this threat, the client keys can be extracted 805 from the parameter file and distributed to all restricted clients. 806 After generating the parameter file, on alice run 807 <code>ntp-keygen</code> 808 <code>-e</code> 809 and pipe the output to a file or mail program. 810 Copy or mail this file to all restricted clients. 811 On these clients install a soft link from the generic 812 <samp><span class="file">ntpkey_iff_</span></samp><kbd>alice</kbd> 813 to this file. 814 To further protect the integrity of the keys, 815 each file can be encrypted with a secret password. 816 817 <p>For the GQ scheme proceed as in the TC scheme to generate keys 818 and certificates for all group hosts, then for every trusted host 819 in the group, generate the IFF parameter file. 820 On trusted host alice run 821 <code>ntp-keygen</code> 822 <code>-T</code> 823 <code>-G</code> 824 <code>-p</code> <kbd>password</kbd> 825 to produce her parameter file 826 <samp><span class="file">ntpkey_GQpar_</span></samp><kbd>alice.filestamp</kbd>, 827 which includes both server and client keys. 828 Copy this file to all group hosts and install a soft link 829 from the generic 830 <samp><span class="file">ntpkey_gq_</span></samp><kbd>alice</kbd> 831 to this file. 832 In addition, on each host bob install a soft link 833 from generic 834 <samp><span class="file">ntpkey_gq_</span></samp><kbd>bob</kbd> 835 to this file. 836 As the GQ scheme updates the GQ parameters file and certificate 837 at the same time, keys and certificates can be regenerated as needed. 838 839 <p>For the MV scheme, proceed as in the TC scheme to generate keys 840 and certificates for all group hosts. 841 For illustration assume trish is the TA, alice one of several trusted hosts 842 and bob one of her clients. 843 On TA trish run 844 <code>ntp-keygen</code> 845 <code>-V</code> <kbd>n</kbd> 846 <code>-p</code> <kbd>password</kbd>, 847 where 848 <kbd>n</kbd> 849 is the number of revokable keys (typically 5) to produce 850 the parameter file 851 <samp><span class="file">ntpkeys_MVpar_</span></samp><kbd>trish.filestamp</kbd> 852 and client key files 853 <samp><span class="file">ntpkeys_MVkeyd_</span></samp><kbd>trish.filestamp</kbd> 854 where 855 <kbd>d</kbd> 856 is the key number (0 < 857 <kbd>d</kbd> 858 < 859 <kbd>n</kbd>). 860 Copy the parameter file to alice and install a soft link 861 from the generic 862 <samp><span class="file">ntpkey_mv_</span></samp><kbd>alice</kbd> 863 to this file. 864 Copy one of the client key files to alice for later distribution 865 to her clients. 866 It doesn't matter which client key file goes to alice, 867 since they all work the same way. 868 Alice copies the client key file to all of her cliens. 869 On client bob install a soft link from generic 870 <samp><span class="file">ntpkey_mvkey_</span></samp><kbd>bob</kbd> 871 to the client key file. 872 As the MV scheme is independent of keys and certificates, 873 these files can be refreshed as needed. 874 875 <h5 class="subsubsection">Command Line Options</h5> 876 877 <dl> 878 <dt><code>-c</code> <kbd>scheme</kbd><dd>Select certificate message digest/signature encryption scheme. 879 The 880 <kbd>scheme</kbd> 881 can be one of the following: 882 . Cm RSA-MD2 , RSA-MD5 , RSA-SHA , RSA-SHA1 , RSA-MDC2 , RSA-RIPEMD160 , DSA-SHA , 883 or 884 <code>DSA-SHA1</code>. 885 Note that RSA schemes must be used with a RSA sign key and DSA 886 schemes must be used with a DSA sign key. 887 The default without this option is 888 <code>RSA-MD5</code>. 889 <br><dt><code>-d</code><dd>Enable debugging. 890 This option displays the cryptographic data produced in eye-friendly billboards. 891 <br><dt><code>-e</code><dd>Write the IFF client keys to the standard output. 892 This is intended for automatic key distribution by mail. 893 <br><dt><code>-G</code><dd>Generate parameters and keys for the GQ identification scheme, 894 obsoleting any that may exist. 895 <br><dt><code>-g</code><dd>Generate keys for the GQ identification scheme 896 using the existing GQ parameters. 897 If the GQ parameters do not yet exist, create them first. 898 <br><dt><code>-H</code><dd>Generate new host keys, obsoleting any that may exist. 899 <br><dt><code>-I</code><dd>Generate parameters for the IFF identification scheme, 900 obsoleting any that may exist. 901 <br><dt><code>-i</code> <kbd>name</kbd><dd>Set the suject name to 902 <kbd>name</kbd>. 903 This is used as the subject field in certificates 904 and in the file name for host and sign keys. 905 <br><dt><code>-M</code><dd>Generate MD5 keys, obsoleting any that may exist. 906 <br><dt><code>-P</code><dd>Generate a private certificate. 907 By default, the program generates public certificates. 908 <br><dt><code>-p</code> <kbd>password</kbd><dd>Encrypt generated files containing private data with 909 <kbd>password</kbd> 910 and the DES-CBC algorithm. 911 <br><dt><code>-q</code><dd>Set the password for reading files to password. 912 <br><dt><code>-S</code> <code>[RSA | DSA]</code><dd>Generate a new sign key of the designated type, 913 obsoleting any that may exist. 914 By default, the program uses the host key as the sign key. 915 <br><dt><code>-s</code> <kbd>name</kbd><dd>Set the issuer name to 916 <kbd>name</kbd>. 917 This is used for the issuer field in certificates 918 and in the file name for identity files. 919 <br><dt><code>-T</code><dd>Generate a trusted certificate. 920 By default, the program generates a non-trusted certificate. 921 <br><dt><code>-V</code> <kbd>nkeys</kbd><dd>Generate parameters and keys for the Mu-Varadharajan (MV) identification scheme. 922 </dl> 923 924 <h5 class="subsubsection">Random Seed File</h5> 925 926 <p>All cryptographically sound key generation schemes must have means 927 to randomize the entropy seed used to initialize 928 the internal pseudo-random number generator used 929 by the library routines. 930 The OpenSSL library uses a designated random seed file for this purpose. 931 The file must be available when starting the NTP daemon and 932 <code>ntp-keygen</code> 933 program. 934 If a site supports OpenSSL or its companion OpenSSH, 935 it is very likely that means to do this are already available. 936 937 <p>It is important to understand that entropy must be evolved 938 for each generation, for otherwise the random number sequence 939 would be predictable. 940 Various means dependent on external events, such as keystroke intervals, 941 can be used to do this and some systems have built-in entropy sources. 942 Suitable means are described in the OpenSSL software documentation, 943 but are outside the scope of this page. 944 945 <p>The entropy seed used by the OpenSSL library is contained in a file, 946 usually called 947 <code>.rnd</code>, 948 which must be available when starting the NTP daemon 949 or the 950 <code>ntp-keygen</code> 951 program. 952 The NTP daemon will first look for the file 953 using the path specified by the 954 <code>randfile</code> 955 subcommand of the 956 <code>crypto</code> 957 configuration command. 958 If not specified in this way, or when starting the 959 <code>ntp-keygen</code> 960 program, 961 the OpenSSL library will look for the file using the path specified 962 by the 963 .Ev RANDFILE 964 environment variable in the user home directory, 965 whether root or some other user. 966 If the 967 .Ev RANDFILE 968 environment variable is not present, 969 the library will look for the 970 <code>.rnd</code> 971 file in the user home directory. 972 If the file is not available or cannot be written, 973 the daemon exits with a message to the system log and the program 974 exits with a suitable error message. 975 976 <h5 class="subsubsection">Cryptographic Data Files</h5> 977 978 <p>All other file formats begin with two lines. 979 The first contains the file name, including the generated host name 980 and filestamp. 981 The second contains the datestamp in conventional Unix date format. 982 Lines beginning with # are considered comments and ignored by the 983 <code>ntp-keygen</code> 984 program and 985 <code>ntpd(1ntpdmdoc)</code> 986 daemon. 987 Cryptographic values are encoded first using ASN.1 rules, 988 then encrypted if necessary, and finally written PEM-encoded 989 printable ASCII format preceded and followed by MIME content identifier lines. 990 991 <p>The format of the symmetric keys file is somewhat different 992 than the other files in the interest of backward compatibility. 993 Since DES-CBC is deprecated in NTPv4, the only key format of interest 994 is MD5 alphanumeric strings. 995 Following hte heard the keys are 996 entered one per line in the format 997 <pre class="example"> <kbd>keyno</kbd> <kbd>type</kbd> <kbd>key</kbd> 998 </pre> 999 <p>where 1000 <kbd>keyno</kbd> 1001 is a positive integer in the range 1-65,535, 1002 <kbd>type</kbd> 1003 is the string MD5 defining the key format and 1004 <kbd>key</kbd> 1005 is the key itself, 1006 which is a printable ASCII string 16 characters or less in length. 1007 Each character is chosen from the 93 printable characters 1008 in the range 0x21 through 0x7f excluding space and the 1009 # 1010 character. 1011 1012 <p>Note that the keys used by the 1013 <code>ntpq(1ntpqmdoc)</code> 1014 and 1015 <code>ntpdc(1ntpdcmdoc)</code> 1016 programs 1017 are checked against passwords requested by the programs 1018 and entered by hand, so it is generally appropriate to specify these keys 1019 in human readable ASCII format. 1020 1021 <p>The 1022 <code>ntp-keygen</code> 1023 program generates a MD5 symmetric keys file 1024 <samp><span class="file">ntpkey_MD5key_</span></samp><kbd>hostname.filestamp</kbd>. 1025 Since the file contains private shared keys, 1026 it should be visible only to root and distributed by secure means 1027 to other subnet hosts. 1028 The NTP daemon loads the file 1029 <samp><span class="file">ntp.keys</span></samp>, 1030 so 1031 <code>ntp-keygen</code> 1032 installs a soft link from this name to the generated file. 1033 Subsequently, similar soft links must be installed by manual 1034 or automated means on the other subnet hosts. 1035 While this file is not used with the Autokey Version 2 protocol, 1036 it is needed to authenticate some remote configuration commands 1037 used by the 1038 <code>ntpq(1ntpqmdoc)</code> 1039 and 1040 <code>ntpdc(1ntpdcmdoc)</code> 1041 utilities. 1042 1043 <p>This section was generated by <strong>AutoGen</strong>, 1044 using the <code>agtexi-cmd</code> template and the option descriptions for the <code>ntp-keygen</code> program. 1045 This software is released under the NTP license, <http://ntp.org/license>;. 1046 1047 <ul class="menu"> 1048 <li><a accesskey="1" href="#ntp_002dkeygen-usage">ntp-keygen usage</a>: ntp-keygen help/usage (<samp><span class="option">--help</span></samp>) 1049 <li><a accesskey="2" href="#ntp_002dkeygen-imbits">ntp-keygen imbits</a>: imbits option (-b) 1050 <li><a accesskey="3" href="#ntp_002dkeygen-certificate">ntp-keygen certificate</a>: certificate option (-c) 1051 <li><a accesskey="4" href="#ntp_002dkeygen-cipher">ntp-keygen cipher</a>: cipher option (-C) 1052 <li><a accesskey="5" href="#ntp_002dkeygen-id_002dkey">ntp-keygen id-key</a>: id-key option (-e) 1053 <li><a accesskey="6" href="#ntp_002dkeygen-gq_002dparams">ntp-keygen gq-params</a>: gq-params option (-G) 1054 <li><a accesskey="7" href="#ntp_002dkeygen-host_002dkey">ntp-keygen host-key</a>: host-key option (-H) 1055 <li><a accesskey="8" href="#ntp_002dkeygen-iffkey">ntp-keygen iffkey</a>: iffkey option (-I) 1056 <li><a accesskey="9" href="#ntp_002dkeygen-ident">ntp-keygen ident</a>: ident option (-i) 1057 <li><a href="#ntp_002dkeygen-lifetime">ntp-keygen lifetime</a>: lifetime option (-l) 1058 <li><a href="#ntp_002dkeygen-md5key">ntp-keygen md5key</a>: md5key option (-M) 1059 <li><a href="#ntp_002dkeygen-modulus">ntp-keygen modulus</a>: modulus option (-m) 1060 <li><a href="#ntp_002dkeygen-pvt_002dcert">ntp-keygen pvt-cert</a>: pvt-cert option (-P) 1061 <li><a href="#ntp_002dkeygen-password">ntp-keygen password</a>: password option (-p) 1062 <li><a href="#ntp_002dkeygen-export_002dpasswd">ntp-keygen export-passwd</a>: export-passwd option (-q) 1063 <li><a href="#ntp_002dkeygen-sign_002dkey">ntp-keygen sign-key</a>: sign-key option (-S) 1064 <li><a href="#ntp_002dkeygen-subject_002dname">ntp-keygen subject-name</a>: subject-name option (-s) 1065 <li><a href="#ntp_002dkeygen-trusted_002dcert">ntp-keygen trusted-cert</a>: trusted-cert option (-T) 1066 <li><a href="#ntp_002dkeygen-mv_002dparams">ntp-keygen mv-params</a>: mv-params option (-V) 1067 <li><a href="#ntp_002dkeygen-mv_002dkeys">ntp-keygen mv-keys</a>: mv-keys option (-v) 1068 <li><a href="#ntp_002dkeygen-config">ntp-keygen config</a>: presetting/configuring ntp-keygen 1069 <li><a href="#ntp_002dkeygen-exit-status">ntp-keygen exit status</a>: exit status 1070 <li><a href="#ntp_002dkeygen-Usage">ntp-keygen Usage</a>: Usage 1071 <li><a href="#ntp_002dkeygen-Notes">ntp-keygen Notes</a>: Notes 1072 <li><a href="#ntp_002dkeygen-Bugs">ntp-keygen Bugs</a>: Bugs 1073 </ul> 1074 1075 <div class="node"> 1076 <p><hr> 1077 <a name="ntp-keygen-usage"></a> 1078 <a name="ntp_002dkeygen-usage"></a> 1079 Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-imbits">ntp-keygen imbits</a>, 1080 Up: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 1081 1082 </div> 1083 1084 <h4 class="subsection">ntp-keygen help/usage (<samp><span class="option">--help</span></samp>)</h4> 1085 1086 <p><a name="index-ntp_002dkeygen-help-3"></a> 1087 This is the automatically generated usage text for ntp-keygen. 1088 1089 <p>The text printed is the same whether selected with the <code>help</code> option 1090 (<samp><span class="option">--help</span></samp>) or the <code>more-help</code> option (<samp><span class="option">--more-help</span></samp>). <code>more-help</code> will print 1091 the usage text by passing it through a pager program. 1092 <code>more-help</code> is disabled on platforms without a working 1093 <code>fork(2)</code> function. The <code>PAGER</code> environment variable is 1094 used to select the program, defaulting to <samp><span class="file">more</span></samp>. Both will exit 1095 with a status code of 0. 1096 1097 <pre class="example">ntp-keygen (ntp) - Create a NTP host key - Ver. 4.2.8p4 1098 Usage: ntp-keygen [ -<flag> [<val>] | --<name>[{=| }<val>] ]... 1099 Flg Arg Option-Name Description 1100 -b Num imbits identity modulus bits 1101 - it must be in the range: 1102 256 to 2048 1103 -c Str certificate certificate scheme 1104 -C Str cipher privatekey cipher 1105 -d no debug-level Increase debug verbosity level 1106 - may appear multiple times 1107 -D Num set-debug-level Set the debug verbosity level 1108 - may appear multiple times 1109 -e no id-key Write IFF or GQ identity keys 1110 -G no gq-params Generate GQ parameters and keys 1111 -H no host-key generate RSA host key 1112 -I no iffkey generate IFF parameters 1113 -i Str ident set Autokey group name 1114 -l Num lifetime set certificate lifetime 1115 -M no md5key generate MD5 keys 1116 -m Num modulus modulus 1117 - it must be in the range: 1118 256 to 2048 1119 -P no pvt-cert generate PC private certificate 1120 -p Str password local private password 1121 -q Str export-passwd export IFF or GQ group keys with password 1122 -S Str sign-key generate sign key (RSA or DSA) 1123 -s Str subject-name set host and optionally group name 1124 -T no trusted-cert trusted certificate (TC scheme) 1125 -V Num mv-params generate <num> MV parameters 1126 -v Num mv-keys update <num> MV keys 1127 opt version output version information and exit 1128 -? no help display extended usage information and exit 1129 -! no more-help extended usage information passed thru pager 1130 -> opt save-opts save the option state to a config file 1131 -< Str load-opts load options from a config file 1132 - disabled as '--no-load-opts' 1133 - may appear multiple times 1134 1135 Options are specified by doubled hyphens and their name or by a single 1136 hyphen and the flag character. 1137 1138 1139 The following option preset mechanisms are supported: 1140 - reading file $HOME/.ntprc 1141 - reading file ./.ntprc 1142 - examining environment variables named NTP_KEYGEN_* 1143 1144 Please send bug reports to: <http://bugs.ntp.org, bugs (a] ntp.org> 1145 </pre> 1146 <div class="node"> 1147 <p><hr> 1148 <a name="ntp-keygen-imbits"></a> 1149 <a name="ntp_002dkeygen-imbits"></a> 1150 Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-certificate">ntp-keygen certificate</a>, 1151 Previous: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-usage">ntp-keygen usage</a>, 1152 Up: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 1153 1154 </div> 1155 1156 <h4 class="subsection">imbits option (-b)</h4> 1157 1158 <p><a name="index-ntp_002dkeygen_002dimbits-4"></a> 1159 This is the “identity modulus bits” option. 1160 This option takes a number argument <samp><span class="file">imbits</span></samp>. 1161 1162 <p class="noindent">This option has some usage constraints. It: 1163 <ul> 1164 <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1165 </ul> 1166 1167 <p>The number of bits in the identity modulus. The default is 256. 1168 <div class="node"> 1169 <p><hr> 1170 <a name="ntp-keygen-certificate"></a> 1171 <a name="ntp_002dkeygen-certificate"></a> 1172 Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-cipher">ntp-keygen cipher</a>, 1173 Previous: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-imbits">ntp-keygen imbits</a>, 1174 Up: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 1175 1176 </div> 1177 1178 <h4 class="subsection">certificate option (-c)</h4> 1179 1180 <p><a name="index-ntp_002dkeygen_002dcertificate-5"></a> 1181 This is the “certificate scheme” option. 1182 This option takes a string argument <samp><span class="file">scheme</span></samp>. 1183 1184 <p class="noindent">This option has some usage constraints. It: 1185 <ul> 1186 <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1187 </ul> 1188 1189 <p>scheme is one of 1190 RSA-MD2, RSA-MD5, RSA-SHA, RSA-SHA1, RSA-MDC2, RSA-RIPEMD160, 1191 DSA-SHA, or DSA-SHA1. 1192 1193 <p>Select the certificate message digest/signature encryption scheme. 1194 Note that RSA schemes must be used with a RSA sign key and DSA 1195 schemes must be used with a DSA sign key. The default without 1196 this option is RSA-MD5. 1197 <div class="node"> 1198 <p><hr> 1199 <a name="ntp-keygen-cipher"></a> 1200 <a name="ntp_002dkeygen-cipher"></a> 1201 Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-id_002dkey">ntp-keygen id-key</a>, 1202 Previous: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-certificate">ntp-keygen certificate</a>, 1203 Up: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 1204 1205 </div> 1206 1207 <h4 class="subsection">cipher option (-C)</h4> 1208 1209 <p><a name="index-ntp_002dkeygen_002dcipher-6"></a> 1210 This is the “privatekey cipher” option. 1211 This option takes a string argument <samp><span class="file">cipher</span></samp>. 1212 1213 <p class="noindent">This option has some usage constraints. It: 1214 <ul> 1215 <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1216 </ul> 1217 1218 <p>Select the cipher which is used to encrypt the files containing 1219 private keys. The default is three-key triple DES in CBC mode, 1220 equivalent to "<code>-C des-ede3-cbc". The openssl tool lists ciphers 1221 available in "openssl -h" output. 1222 </code><div class="node"> 1223 <p><hr> 1224 <a name="ntp-keygen-id-key"></a> 1225 <a name="ntp_002dkeygen-id_002dkey"></a> 1226 Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-gq_002dparams">ntp-keygen gq-params</a>, 1227 Previous: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-cipher">ntp-keygen cipher</a>, 1228 Up: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 1229 1230 </div> 1231 1232 <h4 class="subsection">id-key option (-e)</h4> 1233 1234 <p><a name="index-ntp_002dkeygen_002did_002dkey-7"></a> 1235 This is the “write iff or gq identity keys” option. 1236 1237 <p class="noindent">This option has some usage constraints. It: 1238 <ul> 1239 <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1240 </ul> 1241 1242 <p>Write the IFF or GQ client keys to the standard output. This is 1243 intended for automatic key distribution by mail. 1244 <div class="node"> 1245 <p><hr> 1246 <a name="ntp-keygen-gq-params"></a> 1247 <a name="ntp_002dkeygen-gq_002dparams"></a> 1248 Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-host_002dkey">ntp-keygen host-key</a>, 1249 Previous: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-id_002dkey">ntp-keygen id-key</a>, 1250 Up: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 1251 1252 </div> 1253 1254 <h4 class="subsection">gq-params option (-G)</h4> 1255 1256 <p><a name="index-ntp_002dkeygen_002dgq_002dparams-8"></a> 1257 This is the “generate gq parameters and keys” option. 1258 1259 <p class="noindent">This option has some usage constraints. It: 1260 <ul> 1261 <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1262 </ul> 1263 1264 <p>Generate parameters and keys for the GQ identification scheme, 1265 obsoleting any that may exist. 1266 <div class="node"> 1267 <p><hr> 1268 <a name="ntp-keygen-host-key"></a> 1269 <a name="ntp_002dkeygen-host_002dkey"></a> 1270 Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-iffkey">ntp-keygen iffkey</a>, 1271 Previous: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-gq_002dparams">ntp-keygen gq-params</a>, 1272 Up: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 1273 1274 </div> 1275 1276 <h4 class="subsection">host-key option (-H)</h4> 1277 1278 <p><a name="index-ntp_002dkeygen_002dhost_002dkey-9"></a> 1279 This is the “generate rsa host key” option. 1280 1281 <p class="noindent">This option has some usage constraints. It: 1282 <ul> 1283 <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1284 </ul> 1285 1286 <p>Generate new host keys, obsoleting any that may exist. 1287 <div class="node"> 1288 <p><hr> 1289 <a name="ntp-keygen-iffkey"></a> 1290 <a name="ntp_002dkeygen-iffkey"></a> 1291 Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-ident">ntp-keygen ident</a>, 1292 Previous: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-host_002dkey">ntp-keygen host-key</a>, 1293 Up: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 1294 1295 </div> 1296 1297 <h4 class="subsection">iffkey option (-I)</h4> 1298 1299 <p><a name="index-ntp_002dkeygen_002diffkey-10"></a> 1300 This is the “generate iff parameters” option. 1301 1302 <p class="noindent">This option has some usage constraints. It: 1303 <ul> 1304 <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1305 </ul> 1306 1307 <p>Generate parameters for the IFF identification scheme, obsoleting 1308 any that may exist. 1309 <div class="node"> 1310 <p><hr> 1311 <a name="ntp-keygen-ident"></a> 1312 <a name="ntp_002dkeygen-ident"></a> 1313 Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-lifetime">ntp-keygen lifetime</a>, 1314 Previous: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-iffkey">ntp-keygen iffkey</a>, 1315 Up: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 1316 1317 </div> 1318 1319 <h4 class="subsection">ident option (-i)</h4> 1320 1321 <p><a name="index-ntp_002dkeygen_002dident-11"></a> 1322 This is the “set autokey group name” option. 1323 This option takes a string argument <samp><span class="file">group</span></samp>. 1324 1325 <p class="noindent">This option has some usage constraints. It: 1326 <ul> 1327 <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1328 </ul> 1329 1330 <p>Set the optional Autokey group name to name. This is used in 1331 the file name of IFF, GQ, and MV client parameters files. In 1332 that role, the default is the host name if this option is not 1333 provided. The group name, if specified using <code>-i/--ident</code> or 1334 using <code>-s/--subject-name</code> following an '<code>}' character, 1335 is also a part of the self-signed host certificate's subject and 1336 issuer names in the form host 1337 <p>'crypto ident' or 'server ident' configuration in 1338 ntpd's configuration file. 1339 </code><div class="node"> 1340 <p><hr> 1341 <a name="ntp-keygen-lifetime"></a> 1342 <a name="ntp_002dkeygen-lifetime"></a> 1343 Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-md5key">ntp-keygen md5key</a>, 1344 Previous: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-ident">ntp-keygen ident</a>, 1345 Up: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 1346 1347 </div> 1348 1349 <h4 class="subsection">lifetime option (-l)</h4> 1350 1351 <p><a name="index-ntp_002dkeygen_002dlifetime-12"></a> 1352 This is the ``set certificate lifetime'' option. 1353 This option takes a number argument <samp><span class="file">lifetime</span></samp>. 1354 1355 <p class="noindent">This option has some usage constraints. It: 1356 <ul> 1357 <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1358 </ul> 1359 1360 <p>Set the certificate expiration to lifetime days from now. 1361 <div class="node"> 1362 <p><hr> 1363 <a name="ntp-keygen-md5key"></a> 1364 <a name="ntp_002dkeygen-md5key"></a> 1365 Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-modulus">ntp-keygen modulus</a>, 1366 Previous: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-lifetime">ntp-keygen lifetime</a>, 1367 Up: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 1368 1369 </div> 1370 1371 <h4 class="subsection">md5key option (-M)</h4> 1372 1373 <p><a name="index-ntp_002dkeygen_002dmd5key-13"></a> 1374 This is the ``generate md5 keys'' option. 1375 Generate MD5 keys, obsoleting any that may exist. 1376 <div class="node"> 1377 <p><hr> 1378 <a name="ntp-keygen-modulus"></a> 1379 <a name="ntp_002dkeygen-modulus"></a> 1380 Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-pvt_002dcert">ntp-keygen pvt-cert</a>, 1381 Previous: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-md5key">ntp-keygen md5key</a>, 1382 Up: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 1383 1384 </div> 1385 1386 <h4 class="subsection">modulus option (-m)</h4> 1387 1388 <p><a name="index-ntp_002dkeygen_002dmodulus-14"></a> 1389 This is the ``modulus'' option. 1390 This option takes a number argument <samp><span class="file">modulus</span></samp>. 1391 1392 <p class="noindent">This option has some usage constraints. It: 1393 <ul> 1394 <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1395 </ul> 1396 1397 <p>The number of bits in the prime modulus. The default is 512. 1398 <div class="node"> 1399 <p><hr> 1400 <a name="ntp-keygen-pvt-cert"></a> 1401 <a name="ntp_002dkeygen-pvt_002dcert"></a> 1402 Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-password">ntp-keygen password</a>, 1403 Previous: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-modulus">ntp-keygen modulus</a>, 1404 Up: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 1405 1406 </div> 1407 1408 <h4 class="subsection">pvt-cert option (-P)</h4> 1409 1410 <p><a name="index-ntp_002dkeygen_002dpvt_002dcert-15"></a> 1411 This is the ``generate pc private certificate'' option. 1412 1413 <p class="noindent">This option has some usage constraints. It: 1414 <ul> 1415 <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1416 </ul> 1417 1418 <p>Generate a private certificate. By default, the program generates 1419 public certificates. 1420 <div class="node"> 1421 <p><hr> 1422 <a name="ntp-keygen-password"></a> 1423 <a name="ntp_002dkeygen-password"></a> 1424 Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-export_002dpasswd">ntp-keygen export-passwd</a>, 1425 Previous: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-pvt_002dcert">ntp-keygen pvt-cert</a>, 1426 Up: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 1427 1428 </div> 1429 1430 <h4 class="subsection">password option (-p)</h4> 1431 1432 <p><a name="index-ntp_002dkeygen_002dpassword-16"></a> 1433 This is the ``local private password'' option. 1434 This option takes a string argument <samp><span class="file">passwd</span></samp>. 1435 1436 <p class="noindent">This option has some usage constraints. It: 1437 <ul> 1438 <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1439 </ul> 1440 1441 <p>Local files containing private data are encrypted with the 1442 DES-CBC algorithm and the specified password. The same password 1443 must be specified to the local ntpd via the "crypto pw password" 1444 configuration command. The default password is the local 1445 hostname. 1446 <div class="node"> 1447 <p><hr> 1448 <a name="ntp-keygen-export-passwd"></a> 1449 <a name="ntp_002dkeygen-export_002dpasswd"></a> 1450 Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-sign_002dkey">ntp-keygen sign-key</a>, 1451 Previous: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-password">ntp-keygen password</a>, 1452 Up: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 1453 1454 </div> 1455 1456 <h4 class="subsection">export-passwd option (-q)</h4> 1457 1458 <p><a name="index-ntp_002dkeygen_002dexport_002dpasswd-17"></a> 1459 This is the ``export iff or gq group keys with password'' option. 1460 This option takes a string argument <samp><span class="file">passwd</span></samp>. 1461 1462 <p class="noindent">This option has some usage constraints. It: 1463 <ul> 1464 <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1465 </ul> 1466 1467 <p>Export IFF or GQ identity group keys to the standard output, 1468 encrypted with the DES-CBC algorithm and the specified password. 1469 The same password must be specified to the remote ntpd via the 1470 "crypto pw password" configuration command. See also the option 1471 --id-key (-e) for unencrypted exports. 1472 <div class="node"> 1473 <p><hr> 1474 <a name="ntp-keygen-sign-key"></a> 1475 <a name="ntp_002dkeygen-sign_002dkey"></a> 1476 Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-subject_002dname">ntp-keygen subject-name</a>, 1477 Previous: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-export_002dpasswd">ntp-keygen export-passwd</a>, 1478 Up: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 1479 1480 </div> 1481 1482 <h4 class="subsection">sign-key option (-S)</h4> 1483 1484 <p><a name="index-ntp_002dkeygen_002dsign_002dkey-18"></a> 1485 This is the ``generate sign key (rsa or dsa)'' option. 1486 This option takes a string argument <samp><span class="file">sign</span></samp>. 1487 1488 <p class="noindent">This option has some usage constraints. It: 1489 <ul> 1490 <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1491 </ul> 1492 1493 <p>Generate a new sign key of the designated type, obsoleting any 1494 that may exist. By default, the program uses the host key as the 1495 sign key. 1496 <div class="node"> 1497 <p><hr> 1498 <a name="ntp-keygen-subject-name"></a> 1499 <a name="ntp_002dkeygen-subject_002dname"></a> 1500 Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-trusted_002dcert">ntp-keygen trusted-cert</a>, 1501 Previous: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-sign_002dkey">ntp-keygen sign-key</a>, 1502 Up: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 1503 1504 </div> 1505 1506 <h4 class="subsection">subject-name option (-s)</h4> 1507 1508 <p><a name="index-ntp_002dkeygen_002dsubject_002dname-19"></a> 1509 This is the ``set host and optionally group name'' option. 1510 This option takes a string argument <samp><span class="file">host@group</span></samp>. 1511 1512 <p class="noindent">This option has some usage constraints. It: 1513 <ul> 1514 <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1515 </ul> 1516 1517 <p>Set the Autokey host name, and optionally, group name specified 1518 following an '<code>}' character. The host name is used in the file 1519 name of generated host and signing certificates, without the 1520 group name. The host name, and if provided, group name are used 1521 in host 1522 <p>fields. Specifying '-s 1523 <p>leaving the host name unchanged while appending 1524 <p>subject and issuer fields, as with -i group. The group name, or 1525 if not provided, the host name are also used in the file names 1526 of IFF, GQ, and MV client parameter files. 1527 </code><div class="node"> 1528 <p><hr> 1529 <a name="ntp-keygen-trusted-cert"></a> 1530 <a name="ntp_002dkeygen-trusted_002dcert"></a> 1531 Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-mv_002dparams">ntp-keygen mv-params</a>, 1532 Previous: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-subject_002dname">ntp-keygen subject-name</a>, 1533 Up: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 1534 1535 </div> 1536 1537 <h4 class="subsection">trusted-cert option (-T)</h4> 1538 1539 <p><a name="index-ntp_002dkeygen_002dtrusted_002dcert-20"></a> 1540 This is the ``trusted certificate (tc scheme)'' option. 1541 1542 <p class="noindent">This option has some usage constraints. It: 1543 <ul> 1544 <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1545 </ul> 1546 1547 <p>Generate a trusted certificate. By default, the program generates 1548 a non-trusted certificate. 1549 <div class="node"> 1550 <p><hr> 1551 <a name="ntp-keygen-mv-params"></a> 1552 <a name="ntp_002dkeygen-mv_002dparams"></a> 1553 Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-mv_002dkeys">ntp-keygen mv-keys</a>, 1554 Previous: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-trusted_002dcert">ntp-keygen trusted-cert</a>, 1555 Up: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 1556 1557 </div> 1558 1559 <h4 class="subsection">mv-params option (-V)</h4> 1560 1561 <p><a name="index-ntp_002dkeygen_002dmv_002dparams-21"></a> 1562 This is the ``generate <num> mv parameters'' option. 1563 This option takes a number argument <samp><span class="file">num</span></samp>. 1564 1565 <p class="noindent">This option has some usage constraints. It: 1566 <ul> 1567 <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1568 </ul> 1569 1570 <p>Generate parameters and keys for the Mu-Varadharajan (MV) 1571 identification scheme. 1572 <div class="node"> 1573 <p><hr> 1574 <a name="ntp-keygen-mv-keys"></a> 1575 <a name="ntp_002dkeygen-mv_002dkeys"></a> 1576 Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-config">ntp-keygen config</a>, 1577 Previous: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-mv_002dparams">ntp-keygen mv-params</a>, 1578 Up: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 1579 1580 </div> 1581 1582 <h4 class="subsection">mv-keys option (-v)</h4> 1583 1584 <p><a name="index-ntp_002dkeygen_002dmv_002dkeys-22"></a> 1585 This is the ``update <num> mv keys'' option. 1586 This option takes a number argument <samp><span class="file">num</span></samp>. 1587 1588 <p class="noindent">This option has some usage constraints. It: 1589 <ul> 1590 <li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1591 </ul> 1592 1593 <p>This option has no `<samp><span class="samp">doc</span></samp>' documentation. 1594 1595 <div class="node"> 1596 <p><hr> 1597 <a name="ntp-keygen-config"></a> 1598 <a name="ntp_002dkeygen-config"></a> 1599 Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-exit-status">ntp-keygen exit status</a>, 1600 Previous: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-mv_002dkeys">ntp-keygen mv-keys</a>, 1601 Up: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 1602 1603 </div> 1604 1605 <h4 class="subsection">presetting/configuring ntp-keygen</h4> 1606 1607 <p>Any option that is not marked as <i>not presettable</i> may be preset by 1608 loading values from configuration ("rc" or "ini") files, and values from environment variables named <code>NTP-KEYGEN</code> and <code>NTP-KEYGEN_<OPTION_NAME></code>. <code><OPTION_NAME></code> must be one of 1609 the options listed above in upper case and segmented with underscores. 1610 The <code>NTP-KEYGEN</code> variable will be tokenized and parsed like 1611 the command line. The remaining variables are tested for existence and their 1612 values are treated like option arguments. 1613 1614 <p class="noindent"><code>libopts</code> will search in 2 places for configuration files: 1615 <ul> 1616 <li>$HOME 1617 <li>$PWD 1618 </ul> 1619 The environment variables <code>HOME</code>, and <code>PWD</code> 1620 are expanded and replaced when <samp><span class="file">ntp-keygen</span></samp> runs. 1621 For any of these that are plain files, they are simply processed. 1622 For any that are directories, then a file named <samp><span class="file">.ntprc</span></samp> is searched for 1623 within that directory and processed. 1624 1625 <p>Configuration files may be in a wide variety of formats. 1626 The basic format is an option name followed by a value (argument) on the 1627 same line. Values may be separated from the option name with a colon, 1628 equal sign or simply white space. Values may be continued across multiple 1629 lines by escaping the newline with a backslash. 1630 1631 <p>Multiple programs may also share the same initialization file. 1632 Common options are collected at the top, followed by program specific 1633 segments. The segments are separated by lines like: 1634 <pre class="example"> [NTP-KEYGEN] 1635 </pre> 1636 <p class="noindent">or by 1637 <pre class="example"> <?program ntp-keygen> 1638 </pre> 1639 <p class="noindent">Do not mix these styles within one configuration file. 1640 1641 <p>Compound values and carefully constructed string values may also be 1642 specified using XML syntax: 1643 <pre class="example"> <option-name> 1644 <sub-opt>...&lt;...&gt;...</sub-opt> 1645 </option-name> 1646 </pre> 1647 <p class="noindent">yielding an <code>option-name.sub-opt</code> string value of 1648 <pre class="example"> "...<...>..." 1649 </pre> 1650 <p><code>AutoOpts</code> does not track suboptions. You simply note that it is a 1651 hierarchicly valued option. <code>AutoOpts</code> does provide a means for searching 1652 the associated name/value pair list (see: optionFindValue). 1653 1654 <p>The command line options relating to configuration and/or usage help are: 1655 1656 <h5 class="subsubheading">version (-)</h5> 1657 1658 <p>Print the program version to standard out, optionally with licensing 1659 information, then exit 0. The optional argument specifies how much licensing 1660 detail to provide. The default is to print just the version. The licensing infomation may be selected with an option argument. 1661 Only the first letter of the argument is examined: 1662 1663 <dl> 1664 <dt>`<samp><span class="samp">version</span></samp>'<dd>Only print the version. This is the default. 1665 <br><dt>`<samp><span class="samp">copyright</span></samp>'<dd>Name the copyright usage licensing terms. 1666 <br><dt>`<samp><span class="samp">verbose</span></samp>'<dd>Print the full copyright usage licensing terms. 1667 </dl> 1668 1669 <div class="node"> 1670 <p><hr> 1671 <a name="ntp-keygen-exit-status"></a> 1672 <a name="ntp_002dkeygen-exit-status"></a> 1673 Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-Usage">ntp-keygen Usage</a>, 1674 Previous: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-config">ntp-keygen config</a>, 1675 Up: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 1676 1677 </div> 1678 1679 <h4 class="subsection">ntp-keygen exit status</h4> 1680 1681 <p>One of the following exit values will be returned: 1682 <dl> 1683 <dt>`<samp><span class="samp">0 (EXIT_SUCCESS)</span></samp>'<dd>Successful program execution. 1684 <br><dt>`<samp><span class="samp">1 (EXIT_FAILURE)</span></samp>'<dd>The operation failed or the command syntax was not valid. 1685 <br><dt>`<samp><span class="samp">66 (EX_NOINPUT)</span></samp>'<dd>A specified configuration file could not be loaded. 1686 <br><dt>`<samp><span class="samp">70 (EX_SOFTWARE)</span></samp>'<dd>libopts had an internal operational error. Please report 1687 it to autogen-users (a] lists.sourceforge.net. Thank you. 1688 </dl> 1689 <div class="node"> 1690 <p><hr> 1691 <a name="ntp-keygen-Usage"></a> 1692 <a name="ntp_002dkeygen-Usage"></a> 1693 Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-Notes">ntp-keygen Notes</a>, 1694 Previous: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-exit-status">ntp-keygen exit status</a>, 1695 Up: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 1696 1697 </div> 1698 1699 <h4 class="subsection">ntp-keygen Usage</h4> 1700 1701 <div class="node"> 1702 <p><hr> 1703 <a name="ntp-keygen-Notes"></a> 1704 <a name="ntp_002dkeygen-Notes"></a> 1705 Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-Bugs">ntp-keygen Bugs</a>, 1706 Previous: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-Usage">ntp-keygen Usage</a>, 1707 Up: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 1708 1709 </div> 1710 1711 <h4 class="subsection">ntp-keygen Notes</h4> 1712 1713 <div class="node"> 1714 <p><hr> 1715 <a name="ntp-keygen-Bugs"></a> 1716 <a name="ntp_002dkeygen-Bugs"></a> 1717 Previous: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-Notes">ntp-keygen Notes</a>, 1718 Up: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 1719 1720 </div> 1721 1722 <h4 class="subsection">ntp-keygen Bugs</h4> 1723 1724 <div class="node"> 1725 <p><hr> 1726 <a name="Random-Seed-File"></a> 1727 Next: <a rel="next" accesskey="n" href="#Cryptographic-Data-Files">Cryptographic Data Files</a>, 1728 Previous: <a rel="previous" accesskey="p" href="#Running-the-Program">Running the Program</a>, 1729 Up: <a rel="up" accesskey="u" href="#Top">Top</a> 1730 1731 </div> 1732 1733 <!-- node-name, next, previous, up --> 1734 <h3 class="section">Random Seed File</h3> 1735 1736 <p>All cryptographically sound key generation schemes must have means to 1737 randomize the entropy seed used to initialize the internal 1738 pseudo-random number generator used by the OpenSSL library routines. 1739 If a site supports ssh, it is very likely that means to do this are 1740 already available. 1741 The entropy seed used by the OpenSSL library is contained in a file, 1742 usually called <code>.rnd</code>, which must be available when 1743 starting the <code>ntp-keygen</code> program or <code>ntpd</code> daemon. 1744 1745 <p>The OpenSSL library looks for the file using the path specified by the 1746 <code>RANDFILE</code> environment variable in the user home directory, whether root 1747 or some other user. 1748 If the <code>RANDFILE</code> environment variable is not 1749 present, the library looks for the <code>.rnd</code> file in the user home 1750 directory. 1751 Since both the <code>ntp-keygen</code> program and <code>ntpd</code> daemon must run 1752 as root, the logical place to put this file is in <code>/.rnd</code> or 1753 <code>/root/.rnd</code>. 1754 If the file is not available or cannot be written, the program exits 1755 with a message to the system log. 1756 1757 <div class="node"> 1758 <p><hr> 1759 <a name="Cryptographic-Data-Files"></a> 1760 Previous: <a rel="previous" accesskey="p" href="#Random-Seed-File">Random Seed File</a>, 1761 Up: <a rel="up" accesskey="u" href="#Top">Top</a> 1762 1763 </div> 1764 1765 <!-- node-name, next, previous, up --> 1766 <h3 class="section">Cryptographic Data Files</h3> 1767 1768 <p>File and link names are in the <code>form ntpkey_key_name.fstamp</code>, 1769 where <code>key</code> is the key or parameter type, 1770 <code>name</code> is the host or group name and 1771 <code>fstamp</code> is the filestamp (NTP seconds) when the file was created). 1772 By convention, key names in generated file names include both upper and 1773 lower case characters, while key names in generated link names include 1774 only lower case characters. The filestamp is not used in generated link 1775 names. 1776 1777 <p>The key name is a string defining the cryptographic key type. 1778 Key types include public/private keys host and sign, certificate cert 1779 and several challenge/response key types. 1780 By convention, client files used for 1781 challenges have a par subtype, as in the IFF challenge IFFpar, while 1782 server files for responses have a key subtype, as in the GQ response 1783 GQkey. 1784 1785 <p>All files begin with two nonencrypted lines. The first line contains 1786 the file name in the format <code>ntpkey_key_host.fstamp</code>. 1787 The second line contains the datestamp in conventional Unix date format. 1788 Lines beginning with <code>#</code> are ignored. 1789 1790 <p>The remainder of the file contains cryptographic data encoded first 1791 using ASN.1 rules, then encrypted using the DES-CBC algorithm with 1792 given password and finally written in PEM-encoded printable ASCII text 1793 preceded and followed by MIME content identifier lines. 1794 1795 <p>The format of the symmetric keys file, ordinarily named <code>ntp.keys</code>, 1796 is somewhat different than the other files in the interest of backward 1797 compatibility. 1798 Ordinarily, the file is generated by this program, but 1799 it can be constructed and edited using an ordinary text editor. 1800 1801 <pre class="example"> # ntpkey_MD5key_hms.local.3564038757 1802 # Sun Dec 9 02:45:57 2012 1803 1804 1 MD5 "]!ghT%O;3)WJ,/Nc:>I # MD5 key 1805 2 MD5 lu+H^tF46BKR-6~pV_5 # MD5 key 1806 3 MD5 :lnoVsE%Yz*avh%EtNC # MD5 key 1807 4 MD5 |fdZrf0sF~^V # MD5 key 1808 5 MD5 IyAG>O"y"LmCRS!*bHC # MD5 key 1809 6 MD5 ">e\A # MD5 key 1810 7 MD5 c9x=M'CfLxax9v)PV-si # MD5 key 1811 8 MD5 E|=jvFVov?Bn|Ev=&aK\ # MD5 key 1812 9 MD5 T!c4UT&`(m$+m+B6,`Q0 # MD5 key 1813 10 MD5 JVF/1=)=IFbHbJQz..Cd # MD5 key 1814 11 SHA1 6dea311109529e436c2b4fccae9bc753c16d1b48 # SHA1 key 1815 12 SHA1 7076f373d86c4848c59ff8046e49cb7d614ec394 # SHA1 key 1816 13 SHA1 5f48b1b60591eb01b7cf1d33b7774f08d20262d3 # SHA1 key 1817 14 SHA1 eed5ab9d9497319ec60cf3781d52607e76720178 # SHA1 key 1818 15 SHA1 f283562611a04c964da8126296f5f8e58c3f85de # SHA1 key 1819 16 SHA1 1930da171297dd63549af50b29449de17dcf341f # SHA1 key 1820 17 SHA1 fee892110358cd4382322b889869e750db8e8a8f # SHA1 key 1821 18 SHA1 b5520c9fadd7ad3fd8bfa061c8821b65d029bb37 # SHA1 key 1822 19 SHA1 8c74fb440ec80f453ec6aaa62b9baed0ab723b92 # SHA1 key 1823 20 SHA1 6bc05f734306a189326000970c19b3910f403795 # SHA1 key 1824 </pre> 1825 <p>Figure 1. Typical Symmetric Key File 1826 1827 <p>Figure 1 shows a typical symmetric keys file used by the reference 1828 implementation. 1829 Each line of the file contains three fields, first an 1830 integer between 1 and 65534, inclusive, representing the key identifier 1831 used in the server and peer configuration commands. 1832 Next is the key type for the message digest algorithm, 1833 which in the absence of the 1834 OpenSSL library must be MD5 to designate the MD5 message digest 1835 algorithm. 1836 If the OpenSSL library is installed, the key type can be any 1837 message digest algorithm supported by that library. 1838 However, if 1839 compatibility with FIPS 140-2 is required, the key type must be either 1840 SHA or SHA1. 1841 The key type can be changed using an ASCII text editor. 1842 1843 <p>An MD5 key consists of a printable ASCII string less than or equal to 1844 16 characters and terminated by whitespace or a # character. 1845 An OpenSSL 1846 key consists of a hex-encoded ASCII string of 40 characters, which is 1847 truncated as necessary. 1848 1849 <p>Note that the keys used by the <code>ntpq</code> and <code>ntpdc</code> programs are 1850 checked against passwords requested by the programs and entered by hand, 1851 so it 1852 is generally appropriate to specify these keys in human readable ASCII 1853 format. 1854 1855 <p>The <code>ntp-keygen</code> program generates a MD5 symmetric keys file 1856 <code>ntpkey_MD5key_hostname.filestamp</code>. 1857 Since the file contains private 1858 shared keys, it should be visible only to root and distributed by 1859 secure means to other subnet hosts. 1860 The NTP daemon loads the file <code>ntp.keys</code>, so <code>ntp-keygen</code> 1861 installs a soft link from this name to the generated file. 1862 Subsequently, similar soft links must be installed by 1863 manual or automated means on the other subnet hosts. 1864 While this file is 1865 not used with the Autokey Version 2 protocol, it is needed to 1866 authenticate some remote configuration commands used by the <code>ntpq</code> and 1867 <code>ntpdc</code> utilities. 1868 1869 </body></html> 1870 1871
Indexes created Wed Aug 26 00:26:28 UTC 2026