19c2daa00SOllivier Robert<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> 29c2daa00SOllivier Robert<html> 39c2daa00SOllivier Robert<head> 4ea906c41SOllivier Robert<meta http-equiv="content-type" content="text/html;charset=iso-8859-1"> 59c2daa00SOllivier Robert<meta name="generator" content="HTML Tidy, see www.w3.org"> 62b15cb3dSCy Schubert<title>Authentication Commands and Options</title> 7*4e1ef62aSXin LI<!-- Changed by: stenn, 25-May-2018 --> 89c2daa00SOllivier Robert<link href="scripts/style.css" type="text/css" rel="stylesheet"> 92b15cb3dSCy Schubert<style type="text/css"> 102b15cb3dSCy Schubert.style1 { 112b15cb3dSCy Schubert color: #FF0000; 122b15cb3dSCy Schubert font-weight: bold; 132b15cb3dSCy Schubert} 142b15cb3dSCy Schubert</style> 159c2daa00SOllivier Robert</head> 169c2daa00SOllivier Robert<body> 172b15cb3dSCy Schubert<h3>Authentication Commands and Options</h3> 18ea906c41SOllivier Robert<img src="pic/alice44.gif" alt="gif" align="left"><a href="http://www.eecis.udel.edu/%7emills/pictures.html">from <i>Alice's Adventures in Wonderland</i>, Lewis Carroll</a> 199c2daa00SOllivier Robert<p>Our resident cryptographer; now you see him, now you don't.</p> 202b15cb3dSCy Schubert<p>Last update: 21*4e1ef62aSXin LI <!-- #BeginDate format:En2m -->24-Jul-2018 07:27<!-- #EndDate --> 222b15cb3dSCy Schubert UTC</p> 239c2daa00SOllivier Robert<br clear="left"> 249c2daa00SOllivier Robert<h4>Related Links</h4> 252b15cb3dSCy Schubert<script type="text/javascript" language="javascript" src="scripts/command.txt"></script> 262b15cb3dSCy Schubert<script type="text/javascript" language="javascript" src="scripts/authopt.txt"></script> 279c2daa00SOllivier Robert<hr> 282b15cb3dSCy Schubert<h4>Commands and Options</h4> 292b15cb3dSCy Schubert<p>Unless noted otherwise, further information about these commands is on the <a href="authentic.html">Authentication Support</a> page.</p> 309c2daa00SOllivier Robert<dl> 312b15cb3dSCy Schubert <dt id=automax><tt>automax [<i>logsec</i>]</tt></dt> 322b15cb3dSCy Schubert <dd>Specifies the interval between regenerations of the session key list used with the Autokey protocol, as a power of 2 in seconds. Note that the size of the key list for each association depends on this interval and the current poll interval. The default interval is 12 (about 1.1 hr). For poll intervals above the specified interval, a session key list with a single entry will be regenerated for every message sent. See the <a href="autokey.html">Autokey Public Key Authentication</a> page for further information.</dd> 332b15cb3dSCy Schubert <dt id="controlkey"><tt>controlkey <i>keyid</i></tt></dt> 342b15cb3dSCy Schubert <dd>Specifies the key ID for the <a 352b15cb3dSCy Schubert href="ntpq.html"><tt>ntpq</tt></a> utility, which uses the 362b15cb3dSCy Schubert standard protocol defined in RFC-1305. The <tt><i>keyid</i></tt> argument is the key ID for a <a href="#trustedkey">trusted 37*4e1ef62aSXin LI key</a>, where the value can be in the range 1 to 65535, 382b15cb3dSCy Schubert inclusive.</dd> 39*4e1ef62aSXin LI <dt id="crypto"><tt>crypto [digest <i>digest</i>] [host <i>name</i>] [ident <i>name</i>] [pw <i>password</i>] [randfile <i>file</i>]</tt></dt> 402b15cb3dSCy Schubert <dd>This command activates the Autokey public key cryptography 412b15cb3dSCy Schubert and loads the required host keys and certificate. If one or more files 422b15cb3dSCy Schubert are unspecified, the default names are used. Unless 432b15cb3dSCy Schubert the complete path and name of the file are specified, the location of a file 442b15cb3dSCy Schubert is relative to the keys directory specified in the <tt>keysdir</tt> configuration 452b15cb3dSCy Schubert command with default <tt>/usr/local/etc</tt>. See the <a href="autokey.html">Autokey Public Key Authentication</a> page for further information. Following are the options.</dd> 462b15cb3dSCy Schubert <dd> 47ea906c41SOllivier Robert <dl> 48*4e1ef62aSXin LI <dt><tt>digest</tt> <i>digest</i></dt> 492b15cb3dSCy Schubert <dd> </dd> 502b15cb3dSCy Schubert <dd>Specify the message digest algorithm, with default MD5. If the OpenSSL library 512b15cb3dSCy Schubert is installed, <tt><i>digest</i></tt> can be be any message digest algorithm supported 522b15cb3dSCy Schubert by the library. The current selections are: <tt>MD2</tt>, <tt>MD4</tt>, <tt>MD5,</tt> <tt>MDC2</tt>, <tt>RIPEMD160</tt>, <tt>SHA</tt> and <tt>SHA1</tt>. All 532b15cb3dSCy Schubert participants in an Autokey subnet must use the same algorithm. The Autokey message digest algorithm is separate and distinct from the symmetric 542b15cb3dSCy Schubert key message digest algorithm. Note: If compliance with FIPS 140-2 is required, 552b15cb3dSCy Schubert the algorithm must be ether <tt>SHA</tt> or <tt>SHA1</tt>.</dd> 562b15cb3dSCy Schubert <dt><tt>host <i>name</i></tt></dt> 572b15cb3dSCy Schubert <dd>Specify the cryptographic media names for the host, sign and certificate files. If this option is not specified, the default name is the string returned by the Unix <tt>gethostname()</tt> routine.</dd> 582b15cb3dSCy Schubert <dd><span class="style1">Note: In the latest Autokey version, this option has no effect other than to change the cryptographic media file names.</span></dd> 592b15cb3dSCy Schubert <dt><tt>ident <i>group</i></tt></dt> 602b15cb3dSCy Schubert <dd>Specify the cryptographic media names for the identity scheme files. If this option is not specified, the default name is the string returned by the Unix <tt>gethostname()</tt> routine.</dd> 612b15cb3dSCy Schubert <dd><span class="style1">Note: In the latest Autokey version, this option has no effect other than to change the cryptographic media file names.</span></dd> 622b15cb3dSCy Schubert <dt><tt>pw <i>password</i></tt></dt> 632b15cb3dSCy Schubert <dd>Specifies the password to decrypt files previously encrypted by the <tt>ntp-keygen</tt> program with the <tt>-p</tt> option. If this option is not specified, the default password is the string returned by the Unix <tt>gethostname()</tt> routine.</dd> 642b15cb3dSCy Schubert <dt><tt>randfile <i>file</i></tt></dt> 652b15cb3dSCy Schubert <dd>Specifies the location of the random seed file used by the OpenSSL library. The defaults are described on the <a href="keygen.html"><tt>ntp-keygen</tt> page</a>.</dd> 669c2daa00SOllivier Robert </dl> 672b15cb3dSCy Schubert </dd> 682b15cb3dSCy Schubert <dt id="ident"><tt>ident <i>group</i></tt></dt> 692b15cb3dSCy Schubert <dd>Specifies the group name for ephemeral associations mobilized by broadcast and symmetric passive modes. See the <a href="autokey.html">Autokey Public-Key Authentication</a> page for further information.</dd> 702b15cb3dSCy Schubert <dt id="keys"><tt>keys <i>path</i></tt></dt> 712b15cb3dSCy Schubert <dd>Specifies the complete directory path for the key file containing the key IDs, key types and keys used by <tt>ntpd</tt>, <tt>ntpq</tt> and <tt>ntpdc</tt> when operating with symmetric key cryptography. The format of the keyfile is described on the <a href="keygen.html"><tt>ntp-keygen</tt> page</a>. This is the same operation as the <tt>-k</tt> command line option. Note that the directory path for Autokey cryptographic media is specified by the <tt>keysdir</tt> command.</dd> 722b15cb3dSCy Schubert <dt id="keysdir"><tt>keysdir <i>path</i></tt></dt> 732b15cb3dSCy Schubert <dd>Specifies the complete directory path for the Autokey cryptographic keys, parameters and certificates. The default is <tt>/usr/local/etc/</tt>. Note that the path for the symmetric keys file is specified by the <tt>keys</tt> command.</dd> 742b15cb3dSCy Schubert <dt id="requestkey"><tt>requestkey <i>keyid</i></tt></dt> 752b15cb3dSCy Schubert <dd>Specifies the key ID for the <a href="ntpdc.html"><tt>ntpdc</tt></a> utility program, which 762b15cb3dSCy Schubert uses a proprietary protocol specific to this implementation of <tt>ntpd</tt>. The <tt><i>keyid</i></tt> argument is a key ID 772b15cb3dSCy Schubert for a <a href="#trustedkey">trusted key</a>, in the range 1 to 78*4e1ef62aSXin LI 65535, inclusive.</dd> 792b15cb3dSCy Schubert <dt id="revoke"><tt>revoke [<i>logsec</i>]</tt></dt> 802b15cb3dSCy Schubert <dd>Specifies the interval between re-randomization of certain cryptographic values used by the Autokey scheme, as a power of 2 in seconds, with default 17 (36 hr). See the <a href="autokey.html">Autokey Public-Key Authentication</a> page for further information.</dd> 812b15cb3dSCy Schubert <dt id="trustedkey"><tt>trustedkey [<i>keyid</i> | (<i>lowid</i> ... <i>highid</i>)] [...]</tt></dt> 822b15cb3dSCy Schubert <dd>Specifies the key ID(s) which are trusted for the purposes of 832b15cb3dSCy Schubert authenticating peers with symmetric key cryptography. Key IDs 842b15cb3dSCy Schubert used to authenticate <tt>ntpq</tt> and <tt>ntpdc</tt> operations 852b15cb3dSCy Schubert must be listed here and additionally be enabled with <a href="#controlkey">controlkey</a> and/or <a href="#requestkey">requestkey</a>. The authentication 862b15cb3dSCy Schubert procedure for time transfer requires that both the local and 872b15cb3dSCy Schubert remote NTP servers employ the same key ID and secret for this 882b15cb3dSCy Schubert purpose, although different keys IDs may be used with different 892b15cb3dSCy Schubert servers. Ranges of trusted key IDs may be specified: <tt>trustedkey (1 ... 19) 1000 (100 ... 199)</tt> enables the 902b15cb3dSCy Schubert lowest 120 key IDs which start with the digit 1. The spaces 912b15cb3dSCy Schubert surrounding the ellipsis are required when specifying a range.</dd> 929c2daa00SOllivier Robert</dl> 939c2daa00SOllivier Robert<hr> 949c2daa00SOllivier Robert<script type="text/javascript" language="javascript" src="scripts/footer.txt"></script> 959c2daa00SOllivier Robert</body> 969c2daa00SOllivier Robert</html> 97
