1052d159aSCy Schubert<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> 2052d159aSCy Schubert<html> 3a466cc55SCy Schubert<!-- Created by GNU Texinfo 6.6, http://www.gnu.org/software/texinfo/ --> 42b15cb3dSCy Schubert<head> 5052d159aSCy Schubert<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> 6052d159aSCy Schubert<title>Ntp-keygen User’s Manual</title> 7052d159aSCy Schubert 8052d159aSCy Schubert<meta name="description" content="Ntp-keygen User’s Manual"> 9052d159aSCy Schubert<meta name="keywords" content="Ntp-keygen User’s Manual"> 10052d159aSCy Schubert<meta name="resource-type" content="document"> 11052d159aSCy Schubert<meta name="distribution" content="global"> 12052d159aSCy Schubert<meta name="Generator" content="makeinfo"> 13052d159aSCy Schubert<link href="#Top" rel="start" title="Top"> 14052d159aSCy Schubert<link href="dir.html#Top" rel="up" title="(dir)"> 15052d159aSCy Schubert<style type="text/css"> 16052d159aSCy Schubert<!-- 17052d159aSCy Schuberta.summary-letter {text-decoration: none} 18052d159aSCy Schubertblockquote.indentedblock {margin-right: 0em} 19052d159aSCy Schubertdiv.display {margin-left: 3.2em} 20052d159aSCy Schubertdiv.example {margin-left: 3.2em} 21052d159aSCy Schubertdiv.lisp {margin-left: 3.2em} 22052d159aSCy Schubertkbd {font-style: oblique} 232b15cb3dSCy Schubertpre.display {font-family: inherit} 242b15cb3dSCy Schubertpre.format {font-family: inherit} 25052d159aSCy Schubertpre.menu-comment {font-family: serif} 26052d159aSCy Schubertpre.menu-preformatted {font-family: serif} 27052d159aSCy Schubertspan.nolinebreak {white-space: nowrap} 28052d159aSCy Schubertspan.roman {font-family: initial; font-weight: normal} 29052d159aSCy Schubertspan.sansserif {font-family: sans-serif; font-weight: normal} 30052d159aSCy Schubertul.no-bullet {list-style: none} 31052d159aSCy Schubert--> 32052d159aSCy Schubert</style> 33052d159aSCy Schubert 34052d159aSCy Schubert 352b15cb3dSCy Schubert</head> 36052d159aSCy Schubert 37052d159aSCy Schubert<body lang="en"> 38052d159aSCy Schubert<h1 class="settitle" align="center">Ntp-keygen User’s Manual</h1> 39052d159aSCy Schubert 40052d159aSCy Schubert 41052d159aSCy Schubert 42052d159aSCy Schubert 43052d159aSCy Schubert 44a466cc55SCy Schubert<span id="SEC_Overview"></span> 45052d159aSCy Schubert<h2 class="shortcontents-heading">Short Table of Contents</h2> 46052d159aSCy Schubert 472b15cb3dSCy Schubert<div class="shortcontents"> 48052d159aSCy Schubert<ul class="no-bullet"> 49a466cc55SCy Schubert<li><a id="stoc-Description-1" href="#toc-Description-1">1 Description</a></li> 502b15cb3dSCy Schubert</ul> 512b15cb3dSCy Schubert</div> 522b15cb3dSCy Schubert 532b15cb3dSCy Schubert 54052d159aSCy Schubert<table class="menu" border="0" cellspacing="0"> 55a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#Description" accesskey="1">Description</a></td><td> </td><td align="left" valign="top"> 56052d159aSCy Schubert</td></tr> 57a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-Invocation" accesskey="2">ntp-keygen Invocation</a></td><td> </td><td align="left" valign="top">Invoking ntp-keygen 58052d159aSCy Schubert</td></tr> 59a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#Running-the-Program" accesskey="3">Running the Program</a></td><td> </td><td align="left" valign="top"> 60052d159aSCy Schubert</td></tr> 61a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#Random-Seed-File" accesskey="4">Random Seed File</a></td><td> </td><td align="left" valign="top"> 62052d159aSCy Schubert</td></tr> 63a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#Cryptographic-Data-Files" accesskey="5">Cryptographic Data Files</a></td><td> </td><td align="left" valign="top"> 64052d159aSCy Schubert</td></tr> 65052d159aSCy Schubert</table> 662b15cb3dSCy Schubert 67a466cc55SCy Schubert<span id="Top"></span><div class="header"> 68052d159aSCy Schubert<p> 69052d159aSCy SchubertNext: <a href="#Description" accesskey="n" rel="next">Description</a>, Previous: <a href="dir.html#Top" accesskey="p" rel="prev">(dir)</a>, Up: <a href="dir.html#Top" accesskey="u" rel="up">(dir)</a> </p> 702b15cb3dSCy Schubert</div> 71a466cc55SCy Schubert<span id="NTP-Key-Generation-Program-User-Manual"></span><h1 class="top">NTP Key Generation Program User Manual</h1> 722b15cb3dSCy Schubert 73052d159aSCy Schubert<p>This document describes the use of the NTP Project’s <code>ntp-keygen</code> 742b15cb3dSCy Schubertprogram, that generates cryptographic data files used by the NTPv4 752b15cb3dSCy Schubertauthentication and identity schemes. 762b15cb3dSCy SchubertIt can generate message digest keys used in symmetric key cryptography and, 772b15cb3dSCy Schubertif the OpenSSL software 782b15cb3dSCy Schubertlibrary has been installed, it can generate host keys, sign keys, 792b15cb3dSCy Schubertcertificates, and identity keys and parameters used by the Autokey 802b15cb3dSCy Schubertpublic key cryptography. 812b15cb3dSCy SchubertThe message digest keys file is generated in a 822b15cb3dSCy Schubertformat compatible with NTPv3. 832b15cb3dSCy SchubertAll other files are in PEM-encoded 842b15cb3dSCy Schubertprintable ASCII format so they can be embedded as MIME attachments in 852b15cb3dSCy Schubertmail to other sites. 86052d159aSCy Schubert</p> 87*f5f40dd6SCy Schubert<p>This document applies to version 4.2.8p18 of <code>ntp-keygen</code>. 88052d159aSCy Schubert</p> 89052d159aSCy Schubert<table class="menu" border="0" cellspacing="0"> 90a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#Description" accesskey="1">Description</a></td><td> </td><td align="left" valign="top"> 91052d159aSCy Schubert</td></tr> 92052d159aSCy Schubert</table> 932b15cb3dSCy Schubert 94052d159aSCy Schubert<hr> 95a466cc55SCy Schubert<span id="Description"></span><div class="header"> 96052d159aSCy Schubert<p> 97052d159aSCy SchubertNext: <a href="#Running-the-Program" accesskey="n" rel="next">Running the Program</a>, Previous: <a href="#Top" accesskey="p" rel="prev">Top</a>, Up: <a href="#Top" accesskey="u" rel="up">Top</a> </p> 982b15cb3dSCy Schubert</div> 99a466cc55SCy Schubert<span id="Description-1"></span><h2 class="chapter">1 Description</h2> 1002b15cb3dSCy Schubert 1012b15cb3dSCy Schubert<p>This program generates cryptographic data files used by the NTPv4 1022b15cb3dSCy Schubertauthentication and identity schemes. It can generate message digest 1032b15cb3dSCy Schubertkeys used in symmetric key cryptography and, if the OpenSSL software 1042b15cb3dSCy Schubertlibrary has been installed, it can generate host keys, sign keys, 1052b15cb3dSCy Schubertcertificates, and identity keys and parameters used by the Autokey 1062b15cb3dSCy Schubertpublic key cryptography. The message digest keys file is generated in a 1072b15cb3dSCy Schubertformat compatible with NTPv3. All other files are in PEM-encoded 1082b15cb3dSCy Schubertprintable ASCII format so they can be embedded as MIME attachments in 1092b15cb3dSCy Schubertmail to other sites. 110052d159aSCy Schubert</p> 1112b15cb3dSCy Schubert<p>When used to generate message digest keys, the program produces a file 1122b15cb3dSCy Schubertcontaining ten pseudo-random printable ASCII strings suitable for the 1132b15cb3dSCy SchubertMD5 message digest algorithm included in the distribution. 1142b15cb3dSCy SchubertIf the 1152b15cb3dSCy SchubertOpenSSL library is installed, it produces an additional ten hex-encoded 1162b15cb3dSCy Schubertrandom bit strings suitable for the SHA1 and other message digest 1172b15cb3dSCy Schubertalgorithms. 1182b15cb3dSCy SchubertThe message digest keys file must be distributed and stored 1192b15cb3dSCy Schubertusing secure means beyond the scope of NTP itself. 1202b15cb3dSCy SchubertBesides the keys 1212b15cb3dSCy Schubertused for ordinary NTP associations, additional keys can be defined as 1222b15cb3dSCy Schubertpasswords for the ntpq and ntpdc utility programs. 123052d159aSCy Schubert</p> 1242b15cb3dSCy Schubert<p>The remaining generated files are compatible with other OpenSSL 1252b15cb3dSCy Schubertapplications and other Public Key Infrastructure (PKI) resources. 1262b15cb3dSCy SchubertCertificates generated by this program are compatible with extant 1272b15cb3dSCy Schubertindustry practice, although some users might find the interpretation of 1282b15cb3dSCy SchubertX509v3 extension fields somewhat liberal. 1292b15cb3dSCy SchubertHowever, the identity keys 1302b15cb3dSCy Schubertare probably not compatible with anything other than Autokey. 131052d159aSCy Schubert</p> 1322b15cb3dSCy Schubert<p>Some files used by this program are encrypted using a private password. 1332b15cb3dSCy SchubertThe <code>-p</code> option specifies the password for local encrypted files and the 1342b15cb3dSCy Schubert<code>-q</code> option the password for encrypted files sent to remote sites. 1352b15cb3dSCy SchubertIf no password is specified, the host name returned by the Unix 1362b15cb3dSCy Schubert<code>gethostname()</code> function, normally the DNS name of the host, is used. 137052d159aSCy Schubert</p> 1382b15cb3dSCy Schubert<p>The <kbd>pw</kbd> option of the <code>crypto</code> configuration command 1392b15cb3dSCy Schubertspecifies the read password for previously encrypted local files. 1402b15cb3dSCy SchubertThis must match the local password used by this program. 1412b15cb3dSCy SchubertIf not specified, the host name is used. 1422b15cb3dSCy SchubertThus, if files are generated by this program without password, 1432b15cb3dSCy Schubertthey can be read back by ntpd without password, but only on the same 1442b15cb3dSCy Schuberthost. 145052d159aSCy Schubert</p> 1462b15cb3dSCy Schubert<p>Normally, encrypted files for each host are generated by that host and 1472b15cb3dSCy Schubertused only by that host, although exceptions exist as noted later on 1482b15cb3dSCy Schubertthis page. 1492b15cb3dSCy SchubertThe symmetric keys file, normally called <code>ntp.keys</code>, is 1502b15cb3dSCy Schubertusually installed in <code>/etc</code>. 1512b15cb3dSCy SchubertOther files and links are usually installed 1522b15cb3dSCy Schubertin <code>/usr/local/etc</code>, which is normally in a shared filesystem in 1532b15cb3dSCy SchubertNFS-mounted networks and cannot be changed by shared clients. 1542b15cb3dSCy SchubertThe location of the keys directory can be changed by the keysdir 1552b15cb3dSCy Schubertconfiguration command in such cases. 1562b15cb3dSCy SchubertNormally, this is in <code>/etc</code>. 157052d159aSCy Schubert</p> 1582b15cb3dSCy Schubert<p>This program directs commentary and error messages to the standard 1592b15cb3dSCy Schuberterror stream <code>stderr</code> and remote files to the standard output stream 1602b15cb3dSCy Schubert<code>stdout</code> where they can be piped to other applications or redirected to 1612b15cb3dSCy Schubertfiles. 1622b15cb3dSCy SchubertThe names used for generated files and links all begin with the 1632b15cb3dSCy Schubertstring <code>ntpkey</code> and include the file type, 1642b15cb3dSCy Schubertgenerating host and filestamp, 1652b15cb3dSCy Schubertas described in the <a href="#Cryptographic-Data-Files">Cryptographic Data Files</a> section below. 166052d159aSCy Schubert</p> 167052d159aSCy Schubert<table class="menu" border="0" cellspacing="0"> 168a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#Running-the-Program" accesskey="1">Running the Program</a></td><td> </td><td align="left" valign="top"> 169052d159aSCy Schubert</td></tr> 170a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-Invocation" accesskey="2">Invoking ntp-keygen</a></td><td> </td><td align="left" valign="top"> 171052d159aSCy Schubert</td></tr> 172a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#Random-Seed-File" accesskey="3">Random Seed File</a></td><td> </td><td align="left" valign="top"> 173052d159aSCy Schubert</td></tr> 174a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#Cryptographic-Data-Files" accesskey="4">Cryptographic Data Files</a></td><td> </td><td align="left" valign="top"> 175052d159aSCy Schubert</td></tr> 176052d159aSCy Schubert</table> 1772b15cb3dSCy Schubert 178052d159aSCy Schubert<hr> 179a466cc55SCy Schubert<span id="Running-the-Program"></span><div class="header"> 180052d159aSCy Schubert<p> 181052d159aSCy SchubertNext: <a href="#Random-Seed-File" accesskey="n" rel="next">Random Seed File</a>, Previous: <a href="#Description" accesskey="p" rel="prev">Description</a>, Up: <a href="#Top" accesskey="u" rel="up">Top</a> </p> 1822b15cb3dSCy Schubert</div> 183a466cc55SCy Schubert<span id="Running-the-Program-1"></span><h3 class="section">1.1 Running the Program</h3> 1842b15cb3dSCy Schubert 1852b15cb3dSCy Schubert<p>To test and gain experience with Autokey concepts, log in as root and 1862b15cb3dSCy Schubertchange to the keys directory, usually <code>/usr/local/etc</code>. 1872b15cb3dSCy SchubertWhen run for the 1882b15cb3dSCy Schubertfirst time, or if all files with names beginning <code>ntpkey</code>] have been 1892b15cb3dSCy Schubertremoved, use the <code>ntp-keygen</code> command without arguments to generate a 1902b15cb3dSCy Schubertdefault RSA host key and matching RSA-MD5 certificate with expiration 1912b15cb3dSCy Schubertdate one year hence. 1922b15cb3dSCy SchubertIf run again without options, the program uses the 1932b15cb3dSCy Schubertexisting keys and parameters and generates only a new certificate with 1942b15cb3dSCy Schubertnew expiration date one year hence. 195052d159aSCy Schubert</p> 1962b15cb3dSCy Schubert<p>Run the command on as many hosts as necessary. 1972b15cb3dSCy SchubertDesignate one of them as the trusted host (TH) using <code>ntp-keygen</code> 1982b15cb3dSCy Schubertwith the <code>-T</code> option and configure 1992b15cb3dSCy Schubertit to synchronize from reliable Internet servers. 2002b15cb3dSCy SchubertThen configure the other hosts to synchronize to the TH directly or indirectly. 2012b15cb3dSCy SchubertA certificate trail is created when Autokey asks the immediately 2022b15cb3dSCy Schubertascendant host towards the TH to sign its certificate, which is then 2032b15cb3dSCy Schubertprovided to the immediately descendant host on request. 2042b15cb3dSCy SchubertAll group hosts should have acyclic certificate trails ending on the TH. 205052d159aSCy Schubert</p> 2062b15cb3dSCy Schubert<p>The host key is used to encrypt the cookie when required and so must be 2072b15cb3dSCy SchubertRSA type. 2082b15cb3dSCy SchubertBy default, the host key is also the sign key used to encrypt signatures. 2092b15cb3dSCy SchubertA different sign key can be assigned using the <code>-S</code> option 2102b15cb3dSCy Schubertand this can be either RSA or DSA type. 2112b15cb3dSCy SchubertBy default, the signature 2122b15cb3dSCy Schubertmessage digest type is MD5, but any combination of sign key type and 2132b15cb3dSCy Schubertmessage digest type supported by the OpenSSL library can be specified 2142b15cb3dSCy Schubertusing the <code>-c</code> option. 215052d159aSCy Schubert</p> 2162b15cb3dSCy Schubert<p>The rules say cryptographic media should be generated with proventic 2172b15cb3dSCy Schubertfilestamps, which means the host should already be synchronized before 2182b15cb3dSCy Schubertthis program is run. 2192b15cb3dSCy SchubertThis of course creates a chicken-and-egg problem 2202b15cb3dSCy Schubertwhen the host is started for the first time. 2212b15cb3dSCy SchubertAccordingly, the host time 2222b15cb3dSCy Schubertshould be set by some other means, such as eyeball-and-wristwatch, at 2232b15cb3dSCy Schubertleast so that the certificate lifetime is within the current year. 2242b15cb3dSCy SchubertAfter that and when the host is synchronized to a proventic source, the 2252b15cb3dSCy Schubertcertificate should be re-generated. 226052d159aSCy Schubert</p> 2272b15cb3dSCy Schubert<p>Additional information on trusted groups and identity schemes is on the 2282b15cb3dSCy SchubertAutokey Public-Key Authentication page. 229052d159aSCy Schubert</p> 230052d159aSCy Schubert<hr> 231a466cc55SCy Schubert<span id="ntp_002dkeygen-Invocation"></span><div class="header"> 232052d159aSCy Schubert<p> 233052d159aSCy SchubertNext: <a href="#Random-Seed-File" accesskey="n" rel="next">Random Seed File</a>, Previous: <a href="#Running-the-Program" accesskey="p" rel="prev">Running the Program</a>, Up: <a href="#Description" accesskey="u" rel="up">Description</a> </p> 2342b15cb3dSCy Schubert</div> 235a466cc55SCy Schubert<span id="Invoking-ntp_002dkeygen"></span><h3 class="section">1.2 Invoking ntp-keygen</h3> 236a466cc55SCy Schubert<span id="index-ntp_002dkeygen"></span> 237a466cc55SCy Schubert<span id="index-Create-a-NTP-host-key"></span> 2382b15cb3dSCy Schubert 2392b15cb3dSCy Schubert 2402b15cb3dSCy Schubert 2412b15cb3dSCy Schubert<p>This program generates cryptographic data files used by the NTPv4 2422b15cb3dSCy Schubertauthentication and identification schemes. 24309100258SXin LIIt can generate message digest keys used in symmetric key cryptography and, 24409100258SXin LIif the OpenSSL software library has been installed, it can generate host keys, 24509100258SXin LIsigning keys, certificates, and identity keys and parameters used in Autokey 24609100258SXin LIpublic key cryptography. 2472b15cb3dSCy SchubertThese files are used for cookie encryption, 24809100258SXin LIdigital signature, and challenge/response identification algorithms 2492b15cb3dSCy Schubertcompatible with the Internet standard security infrastructure. 250052d159aSCy Schubert</p> 25109100258SXin LI<p>The message digest symmetric keys file is generated in a format 25209100258SXin LIcompatible with NTPv3. 25309100258SXin LIAll other files are in PEM-encoded printable ASCII format, 25409100258SXin LIso they can be embedded as MIME attachments in email to other sites 2552b15cb3dSCy Schubertand certificate authorities. 2562b15cb3dSCy SchubertBy default, files are not encrypted. 257052d159aSCy Schubert</p> 25809100258SXin LI<p>When used to generate message digest symmetric keys, the program 25909100258SXin LIproduces a file containing ten pseudo-random printable ASCII strings 26009100258SXin LIsuitable for the MD5 message digest algorithm included in the 26109100258SXin LIdistribution. 2622b15cb3dSCy SchubertIf the OpenSSL library is installed, it produces an additional ten 26309100258SXin LIhex-encoded random bit strings suitable for SHA1, AES-128-CMAC, and 26409100258SXin LIother message digest algorithms. 26509100258SXin LIThe message digest symmetric keys file must be distributed and stored 2662b15cb3dSCy Schubertusing secure means beyond the scope of NTP itself. 2672b15cb3dSCy SchubertBesides the keys used for ordinary NTP associations, additional keys 2682b15cb3dSCy Schubertcan be defined as passwords for the 2692b15cb3dSCy Schubert<code>ntpq(1ntpqmdoc)</code> 2702b15cb3dSCy Schubertand 2712b15cb3dSCy Schubert<code>ntpdc(1ntpdcmdoc)</code> 2722b15cb3dSCy Schubertutility programs. 273052d159aSCy Schubert</p> 2742b15cb3dSCy Schubert<p>The remaining generated files are compatible with other OpenSSL 2752b15cb3dSCy Schubertapplications and other Public Key Infrastructure (PKI) resources. 2762b15cb3dSCy SchubertCertificates generated by this program are compatible with extant 2772b15cb3dSCy Schubertindustry practice, although some users might find the interpretation of 2782b15cb3dSCy SchubertX509v3 extension fields somewhat liberal. 2792b15cb3dSCy SchubertHowever, the identity keys are probably not compatible with anything 2802b15cb3dSCy Schubertother than Autokey. 281052d159aSCy Schubert</p> 2822b15cb3dSCy Schubert<p>Some files used by this program are encrypted using a private password. 2832b15cb3dSCy SchubertThe 2842b15cb3dSCy Schubert<code>-p</code> 28509100258SXin LIoption specifies the read password for local encrypted files and the 2862b15cb3dSCy Schubert<code>-q</code> 28709100258SXin LIoption the write password for encrypted files sent to remote sites. 2882b15cb3dSCy SchubertIf no password is specified, the host name returned by the Unix 28909100258SXin LI<code>hostname(1)</code> 29009100258SXin LIcommand, normally the DNS name of the host, is used as the the default read 29109100258SXin LIpassword, for convenience. 29209100258SXin LIThe 29309100258SXin LI<code>ntp-keygen</code> 29409100258SXin LIprogram prompts for the password if it reads an encrypted file 29509100258SXin LIand the password is missing or incorrect. 29609100258SXin LIIf an encrypted file is read successfully and 29709100258SXin LIno write password is specified, the read password is used 29809100258SXin LIas the write password by default. 299052d159aSCy Schubert</p> 3002b15cb3dSCy Schubert<p>The 30109100258SXin LI<code>pw</code> 3022b15cb3dSCy Schubertoption of the 30309100258SXin LI<code>crypto</code> 30409100258SXin LI<code>ntpd(1ntpdmdoc)</code> 3052b15cb3dSCy Schubertconfiguration command specifies the read 3062b15cb3dSCy Schubertpassword for previously encrypted local files. 30709100258SXin LIThis must match the local read password used by this program. 3082b15cb3dSCy SchubertIf not specified, the host name is used. 30909100258SXin LIThus, if files are generated by this program without an explicit password, 3102b15cb3dSCy Schubertthey can be read back by 31109100258SXin LI<code>ntpd(1ntpdmdoc)</code> 31209100258SXin LIwithout specifying an explicit password but only on the same host. 31309100258SXin LIIf the write password used for encryption is specified as the host name, 31409100258SXin LIthese files can be read by that host with no explicit password. 315052d159aSCy Schubert</p> 3162b15cb3dSCy Schubert<p>Normally, encrypted files for each host are generated by that host and 3172b15cb3dSCy Schubertused only by that host, although exceptions exist as noted later on 3182b15cb3dSCy Schubertthis page. 3192b15cb3dSCy SchubertThe symmetric keys file, normally called 320052d159aSCy Schubert<samp>ntp.keys</samp>, 3212b15cb3dSCy Schubertis usually installed in 322052d159aSCy Schubert<samp>/etc</samp>. 3232b15cb3dSCy SchubertOther files and links are usually installed in 324052d159aSCy Schubert<samp>/usr/local/etc</samp>, 3252b15cb3dSCy Schubertwhich is normally in a shared filesystem in 3262b15cb3dSCy SchubertNFS-mounted networks and cannot be changed by shared clients. 32709100258SXin LIIn these cases, NFS clients can specify the files in another 32809100258SXin LIdirectory such as 329052d159aSCy Schubert<samp>/etc</samp> 33009100258SXin LIusing the 33109100258SXin LI<code>keysdir</code> 33209100258SXin LI<code>ntpd(1ntpdmdoc)</code> 33309100258SXin LIconfiguration file command. 334052d159aSCy Schubert</p> 3352b15cb3dSCy Schubert<p>This program directs commentary and error messages to the standard 3362b15cb3dSCy Schuberterror stream 337052d159aSCy Schubert<samp>stderr</samp> 3382b15cb3dSCy Schubertand remote files to the standard output stream 339052d159aSCy Schubert<samp>stdout</samp> 3402b15cb3dSCy Schubertwhere they can be piped to other applications or redirected to files. 3412b15cb3dSCy SchubertThe names used for generated files and links all begin with the 3422b15cb3dSCy Schubertstring 343052d159aSCy Schubert<samp>ntpkey*</samp> 3442b15cb3dSCy Schubertand include the file type, generating host and filestamp, 3452b15cb3dSCy Schubertas described in the 34609100258SXin LI<a href="#Cryptographic-Data-Files">Cryptographic Data Files</a> 3472b15cb3dSCy Schubertsection below. 348052d159aSCy Schubert</p> 349052d159aSCy Schubert<table class="menu" border="0" cellspacing="0"> 350a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-usage" accesskey="1">ntp-keygen help/usage (<samp>--help</samp>)</a></td><td> </td><td align="left" valign="top"> 351052d159aSCy Schubert</td></tr> 352a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-imbits" accesskey="2">imbits option (-b)</a></td><td> </td><td align="left" valign="top"> 353052d159aSCy Schubert</td></tr> 354a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-certificate" accesskey="3">certificate option (-c)</a></td><td> </td><td align="left" valign="top"> 355052d159aSCy Schubert</td></tr> 356a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-cipher" accesskey="4">cipher option (-C)</a></td><td> </td><td align="left" valign="top"> 357052d159aSCy Schubert</td></tr> 358a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-id_002dkey" accesskey="5">id-key option (-e)</a></td><td> </td><td align="left" valign="top"> 359052d159aSCy Schubert</td></tr> 360a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-gq_002dparams" accesskey="6">gq-params option (-G)</a></td><td> </td><td align="left" valign="top"> 361052d159aSCy Schubert</td></tr> 362a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-host_002dkey" accesskey="7">host-key option (-H)</a></td><td> </td><td align="left" valign="top"> 363052d159aSCy Schubert</td></tr> 364a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-iffkey" accesskey="8">iffkey option (-I)</a></td><td> </td><td align="left" valign="top"> 365052d159aSCy Schubert</td></tr> 366a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-ident" accesskey="9">ident option (-i)</a></td><td> </td><td align="left" valign="top"> 367052d159aSCy Schubert</td></tr> 368a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-lifetime">lifetime option (-l)</a></td><td> </td><td align="left" valign="top"> 369052d159aSCy Schubert</td></tr> 370a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-modulus">modulus option (-m)</a></td><td> </td><td align="left" valign="top"> 371052d159aSCy Schubert</td></tr> 372a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-md5key">md5key option (-M)</a></td><td> </td><td align="left" valign="top"> 373052d159aSCy Schubert</td></tr> 374a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-pvt_002dcert">pvt-cert option (-P)</a></td><td> </td><td align="left" valign="top"> 375052d159aSCy Schubert</td></tr> 376a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-password">password option (-p)</a></td><td> </td><td align="left" valign="top"> 377052d159aSCy Schubert</td></tr> 378a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-export_002dpasswd">export-passwd option (-q)</a></td><td> </td><td align="left" valign="top"> 379052d159aSCy Schubert</td></tr> 380a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-subject_002dname">subject-name option (-s)</a></td><td> </td><td align="left" valign="top"> 381052d159aSCy Schubert</td></tr> 382a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-sign_002dkey">sign-key option (-S)</a></td><td> </td><td align="left" valign="top"> 383052d159aSCy Schubert</td></tr> 384a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-trusted_002dcert">trusted-cert option (-T)</a></td><td> </td><td align="left" valign="top"> 385052d159aSCy Schubert</td></tr> 386a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-mv_002dparams">mv-params option (-V)</a></td><td> </td><td align="left" valign="top"> 387052d159aSCy Schubert</td></tr> 388a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-mv_002dkeys">mv-keys option (-v)</a></td><td> </td><td align="left" valign="top"> 389052d159aSCy Schubert</td></tr> 390a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-config">presetting/configuring ntp-keygen</a></td><td> </td><td align="left" valign="top"> 391052d159aSCy Schubert</td></tr> 392a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-exit-status">ntp-keygen exit status</a></td><td> </td><td align="left" valign="top"> 393052d159aSCy Schubert</td></tr> 394a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-Usage">ntp-keygen Usage</a></td><td> </td><td align="left" valign="top"> 395052d159aSCy Schubert</td></tr> 396a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-Notes">ntp-keygen Notes</a></td><td> </td><td align="left" valign="top"> 397052d159aSCy Schubert</td></tr> 398a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-Bugs">ntp-keygen Bugs</a></td><td> </td><td align="left" valign="top"> 399052d159aSCy Schubert</td></tr> 400052d159aSCy Schubert</table> 4012b15cb3dSCy Schubert 402a466cc55SCy Schubert<span id="Running-the-Program-2"></span><h4 class="subsection">1.2.1 Running the Program</h4> 40309100258SXin LI<p>The safest way to run the 40409100258SXin LI<code>ntp-keygen</code> 40509100258SXin LIprogram is logged in directly as root. 40609100258SXin LIThe recommended procedure is change to the 40709100258SXin LI<kbd>keys</kbd> 40809100258SXin LIdirectory, usually 409052d159aSCy Schubert<samp>/usr/local/etc</samp>, 41009100258SXin LIthen run the program. 411052d159aSCy Schubert</p> 4122b15cb3dSCy Schubert<p>To test and gain experience with Autokey concepts, log in as root and 41309100258SXin LIchange to the 41409100258SXin LI<kbd>keys</kbd> 41509100258SXin LIdirectory, usually 416052d159aSCy Schubert<samp>/usr/local/etc</samp>. 4172b15cb3dSCy SchubertWhen run for the first time, or if all files with names beginning with 418052d159aSCy Schubert<samp>ntpkey*</samp> 4192b15cb3dSCy Schuberthave been removed, use the 4202b15cb3dSCy Schubert<code>ntp-keygen</code> 42109100258SXin LIcommand without arguments to generate a default 42209100258SXin LI<code>RSA</code> 42309100258SXin LIhost key and matching 42409100258SXin LI<code>RSA-MD5</code> 42509100258SXin LIcertificate file with expiration date one year hence, 42609100258SXin LIwhich is all that is necessary in many cases. 42709100258SXin LIThe program also generates soft links from the generic names 42809100258SXin LIto the respective files. 4292b15cb3dSCy SchubertIf run again without options, the program uses the 43009100258SXin LIexisting keys and parameters and generates a new certificate file with 43109100258SXin LInew expiration date one year hence, and soft link. 432052d159aSCy Schubert</p> 43309100258SXin LI<p>The host key is used to encrypt the cookie when required and so must be 43409100258SXin LI<code>RSA</code> 43509100258SXin LItype. 43609100258SXin LIBy default, the host key is also the sign key used to encrypt signatures. 43709100258SXin LIWhen necessary, a different sign key can be specified and this can be 43809100258SXin LIeither 43909100258SXin LI<code>RSA</code> 44009100258SXin LIor 44109100258SXin LI<code>DSA</code> 44209100258SXin LItype. 44309100258SXin LIBy default, the message digest type is 44409100258SXin LI<code>MD5</code>, 44509100258SXin LIbut any combination 44609100258SXin LIof sign key type and message digest type supported by the OpenSSL library 44709100258SXin LIcan be specified, including those using the 44809100258SXin LI<code>AES128CMAC</code>, <code>MD2</code>, <code>MD5</code>, <code>MDC2</code>, <code>SHA</code>, <code>SHA1</code> 44909100258SXin LIand 45009100258SXin LI<code>RIPE160</code> 45109100258SXin LImessage digest algorithms. 45209100258SXin LIHowever, the scheme specified in the certificate must be compatible 45309100258SXin LIwith the sign key. 45409100258SXin LICertificates using any digest algorithm are compatible with 45509100258SXin LI<code>RSA</code> 45609100258SXin LIsign keys; 45709100258SXin LIhowever, only 45809100258SXin LI<code>SHA</code> 45909100258SXin LIand 46009100258SXin LI<code>SHA1</code> 46109100258SXin LIcertificates are compatible with 46209100258SXin LI<code>DSA</code> 46309100258SXin LIsign keys. 464052d159aSCy Schubert</p> 46509100258SXin LI<p>Private/public key files and certificates are compatible with 46609100258SXin LIother OpenSSL applications and very likely other libraries as well. 46709100258SXin LICertificates or certificate requests derived from them should be compatible 46809100258SXin LIwith extant industry practice, although some users might find 46909100258SXin LIthe interpretation of X509v3 extension fields somewhat liberal. 47009100258SXin LIHowever, the identification parameter files, although encoded 47109100258SXin LIas the other files, are probably not compatible with anything other than Autokey. 472052d159aSCy Schubert</p> 47309100258SXin LI<p>Running the program as other than root and using the Unix 47409100258SXin LI<code>su(1)</code> 47509100258SXin LIcommand 47609100258SXin LIto assume root may not work properly, since by default the OpenSSL library 47709100258SXin LIlooks for the random seed file 478052d159aSCy Schubert<samp>.rnd</samp> 47909100258SXin LIin the user home directory. 48009100258SXin LIHowever, there should be only one 481052d159aSCy Schubert<samp>.rnd</samp>, 48209100258SXin LImost conveniently 48309100258SXin LIin the root directory, so it is convenient to define the 48409100258SXin LI.Ev RANDFILE 48509100258SXin LIenvironment variable used by the OpenSSL library as the path to 486052d159aSCy Schubert<samp>.rnd</samp>. 487052d159aSCy Schubert</p> 48809100258SXin LI<p>Installing the keys as root might not work in NFS-mounted 48909100258SXin LIshared file systems, as NFS clients may not be able to write 49009100258SXin LIto the shared keys directory, even as root. 49109100258SXin LIIn this case, NFS clients can specify the files in another 49209100258SXin LIdirectory such as 493052d159aSCy Schubert<samp>/etc</samp> 49409100258SXin LIusing the 49509100258SXin LI<code>keysdir</code> 49609100258SXin LI<code>ntpd(1ntpdmdoc)</code> 49709100258SXin LIconfiguration file command. 49809100258SXin LIThere is no need for one client to read the keys and certificates 49909100258SXin LIof other clients or servers, as these data are obtained automatically 50009100258SXin LIby the Autokey protocol. 501052d159aSCy Schubert</p> 50209100258SXin LI<p>Ordinarily, cryptographic files are generated by the host that uses them, 50309100258SXin LIbut it is possible for a trusted agent (TA) to generate these files 50409100258SXin LIfor other hosts; however, in such cases files should always be encrypted. 50509100258SXin LIThe subject name and trusted name default to the hostname 50609100258SXin LIof the host generating the files, but can be changed by command line options. 50709100258SXin LIIt is convenient to designate the owner name and trusted name 50809100258SXin LIas the subject and issuer fields, respectively, of the certificate. 50909100258SXin LIThe owner name is also used for the host and sign key files, 51009100258SXin LIwhile the trusted name is used for the identity files. 511052d159aSCy Schubert</p> 51209100258SXin LI<p>All files are installed by default in the keys directory 513052d159aSCy Schubert<samp>/usr/local/etc</samp>, 51409100258SXin LIwhich is normally in a shared filesystem 51509100258SXin LIin NFS-mounted networks. 51609100258SXin LIThe actual location of the keys directory 51709100258SXin LIand each file can be overridden by configuration commands, 51809100258SXin LIbut this is not recommended. 51909100258SXin LINormally, the files for each host are generated by that host 52009100258SXin LIand used only by that host, although exceptions exist 52109100258SXin LIas noted later on this page. 522052d159aSCy Schubert</p> 52309100258SXin LI<p>Normally, files containing private values, 52409100258SXin LIincluding the host key, sign key and identification parameters, 52509100258SXin LIare permitted root read/write-only; 52609100258SXin LIwhile others containing public values are permitted world readable. 52709100258SXin LIAlternatively, files containing private values can be encrypted 52809100258SXin LIand these files permitted world readable, 52909100258SXin LIwhich simplifies maintenance in shared file systems. 53009100258SXin LISince uniqueness is insured by the 53109100258SXin LI<kbd>hostname</kbd> 53209100258SXin LIand 53309100258SXin LI<kbd>filestamp</kbd> 53409100258SXin LIfile name extensions, the files for an NTP server and 53509100258SXin LIdependent clients can all be installed in the same shared directory. 536052d159aSCy Schubert</p> 53709100258SXin LI<p>The recommended practice is to keep the file name extensions 53809100258SXin LIwhen installing a file and to install a soft link 53909100258SXin LIfrom the generic names specified elsewhere on this page 54009100258SXin LIto the generated files. 54109100258SXin LIThis allows new file generations to be activated simply 54209100258SXin LIby changing the link. 54309100258SXin LIIf a link is present, 54409100258SXin LI<code>ntpd(1ntpdmdoc)</code> 54509100258SXin LIfollows it to the file name to extract the 54609100258SXin LI<kbd>filestamp</kbd>. 54709100258SXin LIIf a link is not present, 54809100258SXin LI<code>ntpd(1ntpdmdoc)</code> 54909100258SXin LIextracts the 55009100258SXin LI<kbd>filestamp</kbd> 55109100258SXin LIfrom the file itself. 55209100258SXin LIThis allows clients to verify that the file and generation times 55309100258SXin LIare always current. 55409100258SXin LIThe 55509100258SXin LI<code>ntp-keygen</code> 55609100258SXin LIprogram uses the same 55709100258SXin LI<kbd>filestamp</kbd> 55809100258SXin LIextension for all files generated 55909100258SXin LIat one time, so each generation is distinct and can be readily 56009100258SXin LIrecognized in monitoring data. 561052d159aSCy Schubert</p> 5622b15cb3dSCy Schubert<p>Run the command on as many hosts as necessary. 5632b15cb3dSCy SchubertDesignate one of them as the trusted host (TH) using 5642b15cb3dSCy Schubert<code>ntp-keygen</code> 5652b15cb3dSCy Schubertwith the 5662b15cb3dSCy Schubert<code>-T</code> 5672b15cb3dSCy Schubertoption and configure it to synchronize from reliable Internet servers. 5682b15cb3dSCy SchubertThen configure the other hosts to synchronize to the TH directly or 5692b15cb3dSCy Schubertindirectly. 5702b15cb3dSCy SchubertA certificate trail is created when Autokey asks the immediately 5712b15cb3dSCy Schubertascendant host towards the TH to sign its certificate, which is then 5722b15cb3dSCy Schubertprovided to the immediately descendant host on request. 5732b15cb3dSCy SchubertAll group hosts should have acyclic certificate trails ending on the TH. 574052d159aSCy Schubert</p> 5752b15cb3dSCy Schubert<p>The host key is used to encrypt the cookie when required and so must be 5762b15cb3dSCy SchubertRSA type. 5772b15cb3dSCy SchubertBy default, the host key is also the sign key used to encrypt 5782b15cb3dSCy Schubertsignatures. 5792b15cb3dSCy SchubertA different sign key can be assigned using the 5802b15cb3dSCy Schubert<code>-S</code> 58109100258SXin LIoption and this can be either 58209100258SXin LI<code>RSA</code> 58309100258SXin LIor 58409100258SXin LI<code>DSA</code> 58509100258SXin LItype. 5862b15cb3dSCy SchubertBy default, the signature 58709100258SXin LImessage digest type is 58809100258SXin LI<code>MD5</code>, 58909100258SXin LIbut any combination of sign key type and 5902b15cb3dSCy Schubertmessage digest type supported by the OpenSSL library can be specified 5912b15cb3dSCy Schubertusing the 5922b15cb3dSCy Schubert<code>-c</code> 5932b15cb3dSCy Schubertoption. 594052d159aSCy Schubert</p> 59509100258SXin LI<p>The rules say cryptographic media should be generated with proventic 5962b15cb3dSCy Schubertfilestamps, which means the host should already be synchronized before 5972b15cb3dSCy Schubertthis program is run. 5982b15cb3dSCy SchubertThis of course creates a chicken-and-egg problem 5992b15cb3dSCy Schubertwhen the host is started for the first time. 6002b15cb3dSCy SchubertAccordingly, the host time 6012b15cb3dSCy Schubertshould be set by some other means, such as eyeball-and-wristwatch, at 6022b15cb3dSCy Schubertleast so that the certificate lifetime is within the current year. 6032b15cb3dSCy SchubertAfter that and when the host is synchronized to a proventic source, the 6042b15cb3dSCy Schubertcertificate should be re-generated. 605052d159aSCy Schubert</p> 6062b15cb3dSCy Schubert<p>Additional information on trusted groups and identity schemes is on the 607052d159aSCy Schubert“Autokey Public-Key Authentication” 6082b15cb3dSCy Schubertpage. 609052d159aSCy Schubert</p> 6102b15cb3dSCy Schubert<p>File names begin with the prefix 611052d159aSCy Schubert<samp>ntpkey</samp>_ 61209100258SXin LIand end with the suffix 613052d159aSCy Schubert<samp>_</samp><kbd>hostname</kbd>. <kbd>filestamp</kbd>, 6142b15cb3dSCy Schubertwhere 6152b15cb3dSCy Schubert<kbd>hostname</kbd> 6162b15cb3dSCy Schubertis the owner name, usually the string returned 61709100258SXin LIby the Unix 61809100258SXin LI<code>hostname(1)</code> 61909100258SXin LIcommand, and 6202b15cb3dSCy Schubert<kbd>filestamp</kbd> 6212b15cb3dSCy Schubertis the NTP seconds when the file was generated, in decimal digits. 6222b15cb3dSCy SchubertThis both guarantees uniqueness and simplifies maintenance 6232b15cb3dSCy Schubertprocedures, since all files can be quickly removed 6242b15cb3dSCy Schubertby a 625052d159aSCy Schubert<code>rm</code> <samp>ntpkey*</samp> 6262b15cb3dSCy Schubertcommand or all files generated 6272b15cb3dSCy Schubertat a specific time can be removed by a 628052d159aSCy Schubert<code>rm</code> <samp>*</samp><kbd>filestamp</kbd> 6292b15cb3dSCy Schubertcommand. 6302b15cb3dSCy SchubertTo further reduce the risk of misconfiguration, 6312b15cb3dSCy Schubertthe first two lines of a file contain the file name 6322b15cb3dSCy Schubertand generation date and time as comments. 633052d159aSCy Schubert</p> 634a466cc55SCy Schubert<span id="Trusted-Hosts-and-Groups"></span><h4 class="subsubsection">1.2.1.1 Trusted Hosts and Groups</h4> 63509100258SXin LI<p>Each cryptographic configuration involves selection of a signature scheme 6362b15cb3dSCy Schubertand identification scheme, called a cryptotype, 6372b15cb3dSCy Schubertas explained in the 638052d159aSCy Schubert‘Authentication Options’ 6392b15cb3dSCy Schubertsection of 6402b15cb3dSCy Schubert<code>ntp.conf(5)</code>. 64109100258SXin LIThe default cryptotype uses 64209100258SXin LI<code>RSA</code> 64309100258SXin LIencryption, 64409100258SXin LI<code>MD5</code> 64509100258SXin LImessage digest 64609100258SXin LIand 64709100258SXin LI<code>TC</code> 64809100258SXin LIidentification. 6492b15cb3dSCy SchubertFirst, configure a NTP subnet including one or more low-stratum 6502b15cb3dSCy Schuberttrusted hosts from which all other hosts derive synchronization 6512b15cb3dSCy Schubertdirectly or indirectly. 6522b15cb3dSCy SchubertTrusted hosts have trusted certificates; 6532b15cb3dSCy Schubertall other hosts have nontrusted certificates. 6542b15cb3dSCy SchubertThese hosts will automatically and dynamically build authoritative 6552b15cb3dSCy Schubertcertificate trails to one or more trusted hosts. 6562b15cb3dSCy SchubertA trusted group is the set of all hosts that have, directly or indirectly, 6572b15cb3dSCy Schuberta certificate trail ending at a trusted host. 6582b15cb3dSCy SchubertThe trail is defined by static configuration file entries 6592b15cb3dSCy Schubertor dynamic means described on the 660052d159aSCy Schubert‘Automatic NTP Configuration Options’ 6612b15cb3dSCy Schubertsection of 6622b15cb3dSCy Schubert<code>ntp.conf(5)</code>. 663052d159aSCy Schubert</p> 6642b15cb3dSCy Schubert<p>On each trusted host as root, change to the keys directory. 6652b15cb3dSCy SchubertTo insure a fresh fileset, remove all 666052d159aSCy Schubert<samp>ntpkey</samp> 6672b15cb3dSCy Schubertfiles. 6682b15cb3dSCy SchubertThen run 6692b15cb3dSCy Schubert<code>ntp-keygen</code> 6702b15cb3dSCy Schubert<code>-T</code> 6712b15cb3dSCy Schubertto generate keys and a trusted certificate. 6722b15cb3dSCy SchubertOn all other hosts do the same, but leave off the 6732b15cb3dSCy Schubert<code>-T</code> 6742b15cb3dSCy Schubertflag to generate keys and nontrusted certificates. 6752b15cb3dSCy SchubertWhen complete, start the NTP daemons beginning at the lowest stratum 6762b15cb3dSCy Schubertand working up the tree. 6772b15cb3dSCy SchubertIt may take some time for Autokey to instantiate the certificate trails 6782b15cb3dSCy Schubertthroughout the subnet, but setting up the environment is completely automatic. 679052d159aSCy Schubert</p> 6802b15cb3dSCy Schubert<p>If it is necessary to use a different sign key or different digest/signature 6812b15cb3dSCy Schubertscheme than the default, run 6822b15cb3dSCy Schubert<code>ntp-keygen</code> 6832b15cb3dSCy Schubertwith the 6842b15cb3dSCy Schubert<code>-S</code> <kbd>type</kbd> 6852b15cb3dSCy Schubertoption, where 6862b15cb3dSCy Schubert<kbd>type</kbd> 6872b15cb3dSCy Schubertis either 6882b15cb3dSCy Schubert<code>RSA</code> 6892b15cb3dSCy Schubertor 6902b15cb3dSCy Schubert<code>DSA</code>. 69109100258SXin LIThe most frequent need to do this is when a 69209100258SXin LI<code>DSA</code>-signed 69309100258SXin LIcertificate is used. 6942b15cb3dSCy SchubertIf it is necessary to use a different certificate scheme than the default, 6952b15cb3dSCy Schubertrun 6962b15cb3dSCy Schubert<code>ntp-keygen</code> 6972b15cb3dSCy Schubertwith the 6982b15cb3dSCy Schubert<code>-c</code> <kbd>scheme</kbd> 6992b15cb3dSCy Schubertoption and selected 7002b15cb3dSCy Schubert<kbd>scheme</kbd> 7012b15cb3dSCy Schubertas needed. 70209100258SXin LIIf 7032b15cb3dSCy Schubert<code>ntp-keygen</code> 7042b15cb3dSCy Schubertis run again without these options, it generates a new certificate 70509100258SXin LIusing the same scheme and sign key, and soft link. 706052d159aSCy Schubert</p> 7072b15cb3dSCy Schubert<p>After setting up the environment it is advisable to update certificates 7082b15cb3dSCy Schubertfrom time to time, if only to extend the validity interval. 7092b15cb3dSCy SchubertSimply run 7102b15cb3dSCy Schubert<code>ntp-keygen</code> 7112b15cb3dSCy Schubertwith the same flags as before to generate new certificates 71209100258SXin LIusing existing keys, and soft links. 7132b15cb3dSCy SchubertHowever, if the host or sign key is changed, 7142b15cb3dSCy Schubert<code>ntpd(1ntpdmdoc)</code> 7152b15cb3dSCy Schubertshould be restarted. 7162b15cb3dSCy SchubertWhen 7172b15cb3dSCy Schubert<code>ntpd(1ntpdmdoc)</code> 7182b15cb3dSCy Schubertis restarted, it loads any new files and restarts the protocol. 7192b15cb3dSCy SchubertOther dependent hosts will continue as usual until signatures are refreshed, 7202b15cb3dSCy Schubertat which time the protocol is restarted. 721052d159aSCy Schubert</p> 722a466cc55SCy Schubert<span id="Identity-Schemes"></span><h4 class="subsubsection">1.2.1.2 Identity Schemes</h4> 7232b15cb3dSCy Schubert<p>As mentioned on the Autonomous Authentication page, 72409100258SXin LIthe default 72509100258SXin LI<code>TC</code> 72609100258SXin LIidentity scheme is vulnerable to a middleman attack. 7272b15cb3dSCy SchubertHowever, there are more secure identity schemes available, 72809100258SXin LIincluding 72909100258SXin LI<code>PC</code>, <code>IFF</code>, <code>GQ</code> 73009100258SXin LIand 73109100258SXin LI<code>MV</code> 73209100258SXin LIschemes described below. 7332b15cb3dSCy SchubertThese schemes are based on a TA, one or more trusted hosts 7342b15cb3dSCy Schubertand some number of nontrusted hosts. 7352b15cb3dSCy SchubertTrusted hosts prove identity using values provided by the TA, 7362b15cb3dSCy Schubertwhile the remaining hosts prove identity using values provided 7372b15cb3dSCy Schubertby a trusted host and certificate trails that end on that host. 7382b15cb3dSCy SchubertThe name of a trusted host is also the name of its sugroup 7392b15cb3dSCy Schubertand also the subject and issuer name on its trusted certificate. 7402b15cb3dSCy SchubertThe TA is not necessarily a trusted host in this sense, but often is. 741052d159aSCy Schubert</p> 7422b15cb3dSCy Schubert<p>In some schemes there are separate keys for servers and clients. 7432b15cb3dSCy SchubertA server can also be a client of another server, 7442b15cb3dSCy Schubertbut a client can never be a server for another client. 7452b15cb3dSCy SchubertIn general, trusted hosts and nontrusted hosts that operate 7462b15cb3dSCy Schubertas both server and client have parameter files that contain 7472b15cb3dSCy Schubertboth server and client keys. 7482b15cb3dSCy SchubertHosts that operate 7492b15cb3dSCy Schubertonly as clients have key files that contain only client keys. 750052d159aSCy Schubert</p> 7512b15cb3dSCy Schubert<p>The PC scheme supports only one trusted host in the group. 7522b15cb3dSCy SchubertOn trusted host alice run 7532b15cb3dSCy Schubert<code>ntp-keygen</code> 7542b15cb3dSCy Schubert<code>-P</code> 7552b15cb3dSCy Schubert<code>-p</code> <kbd>password</kbd> 7562b15cb3dSCy Schubertto generate the host key file 757052d159aSCy Schubert<samp>ntpkey</samp>_ <code>RSA</code> <samp>key_alice.</samp> <kbd>filestamp</kbd> 7582b15cb3dSCy Schubertand trusted private certificate file 759052d159aSCy Schubert<samp>ntpkey</samp>_ <code>RSA-MD5</code> <code>_</code> <samp>cert_alice.</samp> <kbd>filestamp</kbd>, 76009100258SXin LIand soft links. 7612b15cb3dSCy SchubertCopy both files to all group hosts; 7622b15cb3dSCy Schubertthey replace the files which would be generated in other schemes. 76309100258SXin LIOn each host 76409100258SXin LI<kbd>bob</kbd> 76509100258SXin LIinstall a soft link from the generic name 766052d159aSCy Schubert<samp>ntpkey_host_</samp><kbd>bob</kbd> 7672b15cb3dSCy Schubertto the host key file and soft link 768052d159aSCy Schubert<samp>ntpkey_cert_</samp><kbd>bob</kbd> 7692b15cb3dSCy Schubertto the private certificate file. 7702b15cb3dSCy SchubertNote the generic links are on bob, but point to files generated 7712b15cb3dSCy Schubertby trusted host alice. 7722b15cb3dSCy SchubertIn this scheme it is not possible to refresh 7732b15cb3dSCy Schuberteither the keys or certificates without copying them 77409100258SXin LIto all other hosts in the group, and recreating the soft links. 775052d159aSCy Schubert</p> 77609100258SXin LI<p>For the 77709100258SXin LI<code>IFF</code> 77809100258SXin LIscheme proceed as in the 77909100258SXin LI<code>TC</code> 78009100258SXin LIscheme to generate keys 7812b15cb3dSCy Schubertand certificates for all group hosts, then for every trusted host in the group, 78209100258SXin LIgenerate the 78309100258SXin LI<code>IFF</code> 78409100258SXin LIparameter file. 7852b15cb3dSCy SchubertOn trusted host alice run 7862b15cb3dSCy Schubert<code>ntp-keygen</code> 7872b15cb3dSCy Schubert<code>-T</code> 7882b15cb3dSCy Schubert<code>-I</code> 7892b15cb3dSCy Schubert<code>-p</code> <kbd>password</kbd> 7902b15cb3dSCy Schubertto produce her parameter file 791052d159aSCy Schubert<samp>ntpkey_IFFpar_alice.</samp><kbd>filestamp</kbd>, 7922b15cb3dSCy Schubertwhich includes both server and client keys. 7932b15cb3dSCy SchubertCopy this file to all group hosts that operate as both servers 7942b15cb3dSCy Schubertand clients and install a soft link from the generic 795052d159aSCy Schubert<samp>ntpkey_iff_alice</samp> 7962b15cb3dSCy Schubertto this file. 7972b15cb3dSCy SchubertIf there are no hosts restricted to operate only as clients, 7982b15cb3dSCy Schubertthere is nothing further to do. 79909100258SXin LIAs the 80009100258SXin LI<code>IFF</code> 80109100258SXin LIscheme is independent 8022b15cb3dSCy Schubertof keys and certificates, these files can be refreshed as needed. 803052d159aSCy Schubert</p> 8042b15cb3dSCy Schubert<p>If a rogue client has the parameter file, it could masquerade 8052b15cb3dSCy Schubertas a legitimate server and present a middleman threat. 8062b15cb3dSCy SchubertTo eliminate this threat, the client keys can be extracted 8072b15cb3dSCy Schubertfrom the parameter file and distributed to all restricted clients. 8082b15cb3dSCy SchubertAfter generating the parameter file, on alice run 8092b15cb3dSCy Schubert<code>ntp-keygen</code> 8102b15cb3dSCy Schubert<code>-e</code> 81109100258SXin LIand pipe the output to a file or email program. 81209100258SXin LICopy or email this file to all restricted clients. 8132b15cb3dSCy SchubertOn these clients install a soft link from the generic 814052d159aSCy Schubert<samp>ntpkey_iff_alice</samp> 8152b15cb3dSCy Schubertto this file. 8162b15cb3dSCy SchubertTo further protect the integrity of the keys, 8172b15cb3dSCy Schuberteach file can be encrypted with a secret password. 818052d159aSCy Schubert</p> 81909100258SXin LI<p>For the 82009100258SXin LI<code>GQ</code> 82109100258SXin LIscheme proceed as in the 82209100258SXin LI<code>TC</code> 82309100258SXin LIscheme to generate keys 8242b15cb3dSCy Schubertand certificates for all group hosts, then for every trusted host 82509100258SXin LIin the group, generate the 82609100258SXin LI<code>IFF</code> 82709100258SXin LIparameter file. 8282b15cb3dSCy SchubertOn trusted host alice run 8292b15cb3dSCy Schubert<code>ntp-keygen</code> 8302b15cb3dSCy Schubert<code>-T</code> 8312b15cb3dSCy Schubert<code>-G</code> 8322b15cb3dSCy Schubert<code>-p</code> <kbd>password</kbd> 8332b15cb3dSCy Schubertto produce her parameter file 834052d159aSCy Schubert<samp>ntpkey_GQpar_alice.</samp><kbd>filestamp</kbd>, 8352b15cb3dSCy Schubertwhich includes both server and client keys. 8362b15cb3dSCy SchubertCopy this file to all group hosts and install a soft link 8372b15cb3dSCy Schubertfrom the generic 838052d159aSCy Schubert<samp>ntpkey_gq_alice</samp> 8392b15cb3dSCy Schubertto this file. 84009100258SXin LIIn addition, on each host 84109100258SXin LI<kbd>bob</kbd> 84209100258SXin LIinstall a soft link 8432b15cb3dSCy Schubertfrom generic 844052d159aSCy Schubert<samp>ntpkey_gq_</samp><kbd>bob</kbd> 8452b15cb3dSCy Schubertto this file. 84609100258SXin LIAs the 84709100258SXin LI<code>GQ</code> 84809100258SXin LIscheme updates the 84909100258SXin LI<code>GQ</code> 85009100258SXin LIparameters file and certificate 8512b15cb3dSCy Schubertat the same time, keys and certificates can be regenerated as needed. 852052d159aSCy Schubert</p> 85309100258SXin LI<p>For the 85409100258SXin LI<code>MV</code> 85509100258SXin LIscheme, proceed as in the 85609100258SXin LI<code>TC</code> 85709100258SXin LIscheme to generate keys 8582b15cb3dSCy Schubertand certificates for all group hosts. 8592b15cb3dSCy SchubertFor illustration assume trish is the TA, alice one of several trusted hosts 8602b15cb3dSCy Schubertand bob one of her clients. 8612b15cb3dSCy SchubertOn TA trish run 8622b15cb3dSCy Schubert<code>ntp-keygen</code> 8632b15cb3dSCy Schubert<code>-V</code> <kbd>n</kbd> 8642b15cb3dSCy Schubert<code>-p</code> <kbd>password</kbd>, 8652b15cb3dSCy Schubertwhere 8662b15cb3dSCy Schubert<kbd>n</kbd> 8672b15cb3dSCy Schubertis the number of revokable keys (typically 5) to produce 8682b15cb3dSCy Schubertthe parameter file 869052d159aSCy Schubert<samp>ntpkeys_MVpar_trish.</samp><kbd>filestamp</kbd> 8702b15cb3dSCy Schubertand client key files 871052d159aSCy Schubert<samp>ntpkeys_MVkey</samp><kbd>d</kbd> <kbd>_</kbd> <samp>trish.</samp> <kbd>filestamp</kbd> 8722b15cb3dSCy Schubertwhere 8732b15cb3dSCy Schubert<kbd>d</kbd> 8742b15cb3dSCy Schubertis the key number (0 < 8752b15cb3dSCy Schubert<kbd>d</kbd> 8762b15cb3dSCy Schubert< 8772b15cb3dSCy Schubert<kbd>n</kbd>). 8782b15cb3dSCy SchubertCopy the parameter file to alice and install a soft link 8792b15cb3dSCy Schubertfrom the generic 880052d159aSCy Schubert<samp>ntpkey_mv_alice</samp> 8812b15cb3dSCy Schubertto this file. 8822b15cb3dSCy SchubertCopy one of the client key files to alice for later distribution 8832b15cb3dSCy Schubertto her clients. 88409100258SXin LIIt does not matter which client key file goes to alice, 8852b15cb3dSCy Schubertsince they all work the same way. 88609100258SXin LIAlice copies the client key file to all of her clients. 8872b15cb3dSCy SchubertOn client bob install a soft link from generic 888052d159aSCy Schubert<samp>ntpkey_mvkey_bob</samp> 8892b15cb3dSCy Schubertto the client key file. 89009100258SXin LIAs the 89109100258SXin LI<code>MV</code> 89209100258SXin LIscheme is independent of keys and certificates, 8932b15cb3dSCy Schubertthese files can be refreshed as needed. 894052d159aSCy Schubert</p> 895a466cc55SCy Schubert<span id="Command-Line-Options"></span><h4 class="subsubsection">1.2.1.3 Command Line Options</h4> 896052d159aSCy Schubert<dl compact="compact"> 897052d159aSCy Schubert<dt><code>-b</code> <code>--imbits</code>= <kbd>modulus</kbd></dt> 898052d159aSCy Schubert<dd><p>Set the number of bits in the identity modulus for generating identity keys to 89909100258SXin LI<kbd>modulus</kbd> 90009100258SXin LIbits. 90109100258SXin LIThe number of bits in the identity modulus defaults to 256, but can be set to 90209100258SXin LIvalues from 256 to 2048 (32 to 256 octets). 90309100258SXin LIUse the larger moduli with caution, as this can consume considerable computing 90409100258SXin LIresources and increases the size of authenticated packets. 905052d159aSCy Schubert</p></dd> 906052d159aSCy Schubert<dt><code>-c</code> <code>--certificate</code>= <kbd>scheme</kbd></dt> 907052d159aSCy Schubert<dd><p>Select certificate signature encryption/message digest scheme. 9082b15cb3dSCy SchubertThe 9092b15cb3dSCy Schubert<kbd>scheme</kbd> 9102b15cb3dSCy Schubertcan be one of the following: 91109100258SXin LI<code>RSA-MD2</code>, <code>RSA-MD5</code>, <code>RSA-MDC2</code>, <code>RSA-SHA</code>, <code>RSA-SHA1</code>, <code>RSA-RIPEMD160</code>, <code>DSA-SHA</code>, 9122b15cb3dSCy Schubertor 9132b15cb3dSCy Schubert<code>DSA-SHA1</code>. 91409100258SXin LINote that 91509100258SXin LI<code>RSA</code> 91609100258SXin LIschemes must be used with an 91709100258SXin LI<code>RSA</code> 91809100258SXin LIsign key and 91909100258SXin LI<code>DSA</code> 92009100258SXin LIschemes must be used with a 92109100258SXin LI<code>DSA</code> 92209100258SXin LIsign key. 9232b15cb3dSCy SchubertThe default without this option is 9242b15cb3dSCy Schubert<code>RSA-MD5</code>. 92509100258SXin LIIf compatibility with FIPS 140-2 is required, either the 92609100258SXin LI<code>DSA-SHA</code> 92709100258SXin LIor 92809100258SXin LI<code>DSA-SHA1</code> 92909100258SXin LIscheme must be used. 930052d159aSCy Schubert</p></dd> 931052d159aSCy Schubert<dt><code>-C</code> <code>--cipher</code>= <kbd>cipher</kbd></dt> 932052d159aSCy Schubert<dd><p>Select the OpenSSL cipher to encrypt the files containing private keys. 93309100258SXin LIThe default without this option is three-key triple DES in CBC mode, 93409100258SXin LI<code>des-ede3-cbc</code>. 93509100258SXin LIThe 93609100258SXin LI<code>openssl</code> <code>-h</code> 93709100258SXin LIcommand provided with OpenSSL displays available ciphers. 938052d159aSCy Schubert</p></dd> 939052d159aSCy Schubert<dt><code>-d</code> <code>--debug-level</code></dt> 940052d159aSCy Schubert<dd><p>Increase debugging verbosity level. 9412b15cb3dSCy SchubertThis option displays the cryptographic data produced in eye-friendly billboards. 942052d159aSCy Schubert</p></dd> 943052d159aSCy Schubert<dt><code>-D</code> <code>--set-debug-level</code>= <kbd>level</kbd></dt> 944052d159aSCy Schubert<dd><p>Set the debugging verbosity to 94509100258SXin LI<kbd>level</kbd>. 94609100258SXin LIThis option displays the cryptographic data produced in eye-friendly billboards. 947052d159aSCy Schubert</p></dd> 948052d159aSCy Schubert<dt><code>-e</code> <code>--id-key</code></dt> 949052d159aSCy Schubert<dd><p>Write the 95009100258SXin LI<code>IFF</code> 95109100258SXin LIor 95209100258SXin LI<code>GQ</code> 95309100258SXin LIpublic parameters from the 95409100258SXin LI<kbd>IFFkey</kbd> <kbd>or</kbd> <kbd>GQkey</kbd> 95509100258SXin LIclient keys file previously specified 95609100258SXin LIas unencrypted data to the standard output stream 957052d159aSCy Schubert<samp>stdout</samp>. 95809100258SXin LIThis is intended for automatic key distribution by email. 959052d159aSCy Schubert</p></dd> 960052d159aSCy Schubert<dt><code>-G</code> <code>--gq-params</code></dt> 961052d159aSCy Schubert<dd><p>Generate a new encrypted 96209100258SXin LI<code>GQ</code> 96309100258SXin LIparameters and key file for the Guillou-Quisquater (GQ) identity scheme. 96409100258SXin LIThis option is mutually exclusive with the 96509100258SXin LI<code>-I</code> 96609100258SXin LIand 96709100258SXin LI<code>-V</code> 96809100258SXin LIoptions. 969052d159aSCy Schubert</p></dd> 970052d159aSCy Schubert<dt><code>-H</code> <code>--host-key</code></dt> 971052d159aSCy Schubert<dd><p>Generate a new encrypted 97209100258SXin LI<code>RSA</code> 97309100258SXin LIpublic/private host key file. 974052d159aSCy Schubert</p></dd> 975052d159aSCy Schubert<dt><code>-I</code> <code>--iffkey</code></dt> 976052d159aSCy Schubert<dd><p>Generate a new encrypted 97709100258SXin LI<code>IFF</code> 97809100258SXin LIkey file for the Schnorr (IFF) identity scheme. 97909100258SXin LIThis option is mutually exclusive with the 98009100258SXin LI<code>-G</code> 98109100258SXin LIand 98209100258SXin LIFl V 98309100258SXin LIoptions. 984052d159aSCy Schubert</p></dd> 985052d159aSCy Schubert<dt><code>-i</code> <code>--ident</code>= <kbd>group</kbd></dt> 986052d159aSCy Schubert<dd><p>Set the optional Autokey group name to 98709100258SXin LI<kbd>group</kbd>. 98809100258SXin LIThis is used in the identity scheme parameter file names of 98909100258SXin LI<code>IFF</code>, <code>GQ</code>, 99009100258SXin LIand 99109100258SXin LI<code>MV</code> 99209100258SXin LIclient parameters files. 99309100258SXin LIIn that role, the default is the host name if no group is provided. 99409100258SXin LIThe group name, if specified using 99509100258SXin LI<code>-i</code> 99609100258SXin LIor 99709100258SXin LI<code>-s</code> 99809100258SXin LIfollowing an 999052d159aSCy Schubert‘@’ 100009100258SXin LIcharacter, is also used in certificate subject and issuer names in the form 100109100258SXin LI<kbd>host</kbd> <kbd>@</kbd> <kbd>group</kbd> 100209100258SXin LIand should match the group specified via 100309100258SXin LI<code>crypto</code> <code>ident</code> 100409100258SXin LIor 100509100258SXin LI<code>server</code> <code>ident</code> 100609100258SXin LIin the ntpd configuration file. 1007052d159aSCy Schubert</p></dd> 1008052d159aSCy Schubert<dt><code>-l</code> <code>--lifetime</code>= <kbd>days</kbd></dt> 1009052d159aSCy Schubert<dd><p>Set the lifetime for certificate expiration to 101009100258SXin LI<kbd>days</kbd>. 101109100258SXin LIThe default lifetime is one year (365 days). 1012052d159aSCy Schubert</p></dd> 1013052d159aSCy Schubert<dt><code>-m</code> <code>--modulus</code>= <kbd>bits</kbd></dt> 1014052d159aSCy Schubert<dd><p>Set the number of bits in the prime modulus for generating files to 101509100258SXin LI<kbd>bits</kbd>. 101609100258SXin LIThe modulus defaults to 512, but can be set from 256 to 2048 (32 to 256 octets). 101709100258SXin LIUse the larger moduli with caution, as this can consume considerable computing 101809100258SXin LIresources and increases the size of authenticated packets. 1019052d159aSCy Schubert</p></dd> 1020052d159aSCy Schubert<dt><code>-M</code> <code>--md5key</code></dt> 1021052d159aSCy Schubert<dd><p>Generate a new symmetric keys file containing 10 102209100258SXin LI<code>MD5</code> 102309100258SXin LIkeys, and if OpenSSL is available, 10 102409100258SXin LI<code>SHA</code> 102509100258SXin LIkeys. 102609100258SXin LIAn 102709100258SXin LI<code>MD5</code> 102809100258SXin LIkey is a string of 20 random printable ASCII characters, while a 102909100258SXin LI<code>SHA</code> 103009100258SXin LIkey is a string of 40 random hex digits. 103109100258SXin LIThe file can be edited using a text editor to change the key type or key content. 103209100258SXin LIThis option is mutually exclusive with all other options. 1033052d159aSCy Schubert</p></dd> 1034052d159aSCy Schubert<dt><code>-p</code> <code>--password</code>= <kbd>passwd</kbd></dt> 1035052d159aSCy Schubert<dd><p>Set the password for reading and writing encrypted files to 103609100258SXin LI<kbd>passwd</kbd>. 103709100258SXin LIThese include the host, sign and identify key files. 103809100258SXin LIBy default, the password is the string returned by the Unix 103909100258SXin LI<code>hostname</code> 104009100258SXin LIcommand. 1041052d159aSCy Schubert</p></dd> 1042052d159aSCy Schubert<dt><code>-P</code> <code>--pvt-cert</code></dt> 1043052d159aSCy Schubert<dd><p>Generate a new private certificate used by the 104409100258SXin LI<code>PC</code> 104509100258SXin LIidentity scheme. 10462b15cb3dSCy SchubertBy default, the program generates public certificates. 104709100258SXin LINote: the PC identity scheme is not recommended for new installations. 1048052d159aSCy Schubert</p></dd> 1049052d159aSCy Schubert<dt><code>-q</code> <code>--export-passwd</code>= <kbd>passwd</kbd></dt> 1050052d159aSCy Schubert<dd><p>Set the password for writing encrypted 105109100258SXin LI<code>IFF</code>, <code>GQ</code> <code>and</code> <code>MV</code> 105209100258SXin LIidentity files redirected to 1053052d159aSCy Schubert<samp>stdout</samp> 105409100258SXin LIto 105509100258SXin LI<kbd>passwd</kbd>. 105609100258SXin LIIn effect, these files are decrypted with the 105709100258SXin LI<code>-p</code> 105809100258SXin LIpassword, then encrypted with the 105909100258SXin LI<code>-q</code> 106009100258SXin LIpassword. 106109100258SXin LIBy default, the password is the string returned by the Unix 106209100258SXin LI<code>hostname</code> 106309100258SXin LIcommand. 1064052d159aSCy Schubert</p></dd> 1065052d159aSCy Schubert<dt><code>-s</code> <code>--subject-key</code>= <code>[host]</code> <code>[@ <kbd>group</kbd>]</code></dt> 1066052d159aSCy Schubert<dd><p>Specify the Autokey host name, where 106709100258SXin LI<kbd>host</kbd> 106809100258SXin LIis the optional host name and 106909100258SXin LI<kbd>group</kbd> 107009100258SXin LIis the optional group name. 107109100258SXin LIThe host name, and if provided, group name are used in 107209100258SXin LI<kbd>host</kbd> <kbd>@</kbd> <kbd>group</kbd> 107309100258SXin LIform as certificate subject and issuer. 107409100258SXin LISpecifying 107509100258SXin LI<code>-s</code> <code>-@</code> <kbd>group</kbd> 107609100258SXin LIis allowed, and results in leaving the host name unchanged, as with 107709100258SXin LI<code>-i</code> <kbd>group</kbd>. 107809100258SXin LIThe group name, or if no group is provided, the host name are also used in the 107909100258SXin LIfile names of 108009100258SXin LI<code>IFF</code>, <code>GQ</code>, 108109100258SXin LIand 108209100258SXin LI<code>MV</code> 108309100258SXin LIidentity scheme client parameter files. 108409100258SXin LIIf 108509100258SXin LI<kbd>host</kbd> 108609100258SXin LIis not specified, the default host name is the string returned by the Unix 108709100258SXin LI<code>hostname</code> 108809100258SXin LIcommand. 1089052d159aSCy Schubert</p></dd> 1090052d159aSCy Schubert<dt><code>-S</code> <code>--sign-key</code>= <code>[<code>RSA</code> | <code>DSA</code>]</code></dt> 1091052d159aSCy Schubert<dd><p>Generate a new encrypted public/private sign key file of the specified type. 109209100258SXin LIBy default, the sign key is the host key and has the same type. 109309100258SXin LIIf compatibility with FIPS 140-2 is required, the sign key type must be 109409100258SXin LI<code>DSA</code>. 1095052d159aSCy Schubert</p></dd> 1096052d159aSCy Schubert<dt><code>-T</code> <code>--trusted-cert</code></dt> 1097052d159aSCy Schubert<dd><p>Generate a trusted certificate. 10982b15cb3dSCy SchubertBy default, the program generates a non-trusted certificate. 1099052d159aSCy Schubert</p></dd> 1100052d159aSCy Schubert<dt><code>-V</code> <code>--mv-params</code> <kbd>nkeys</kbd></dt> 1101052d159aSCy Schubert<dd><p>Generate 110209100258SXin LI<kbd>nkeys</kbd> 110309100258SXin LIencrypted server keys and parameters for the Mu-Varadharajan (MV) 110409100258SXin LIidentity scheme. 110509100258SXin LIThis option is mutually exclusive with the 110609100258SXin LI<code>-I</code> 110709100258SXin LIand 110809100258SXin LI<code>-G</code> 110909100258SXin LIoptions. 111009100258SXin LINote: support for this option should be considered a work in progress. 1111052d159aSCy Schubert</p></dd> 11122b15cb3dSCy Schubert</dl> 11132b15cb3dSCy Schubert 1114a466cc55SCy Schubert<span id="Random-Seed-File-1"></span><h4 class="subsubsection">1.2.1.4 Random Seed File</h4> 11152b15cb3dSCy Schubert<p>All cryptographically sound key generation schemes must have means 11162b15cb3dSCy Schubertto randomize the entropy seed used to initialize 11172b15cb3dSCy Schubertthe internal pseudo-random number generator used 11182b15cb3dSCy Schubertby the library routines. 11192b15cb3dSCy SchubertThe OpenSSL library uses a designated random seed file for this purpose. 11202b15cb3dSCy SchubertThe file must be available when starting the NTP daemon and 11212b15cb3dSCy Schubert<code>ntp-keygen</code> 11222b15cb3dSCy Schubertprogram. 11232b15cb3dSCy SchubertIf a site supports OpenSSL or its companion OpenSSH, 11242b15cb3dSCy Schubertit is very likely that means to do this are already available. 1125052d159aSCy Schubert</p> 11262b15cb3dSCy Schubert<p>It is important to understand that entropy must be evolved 11272b15cb3dSCy Schubertfor each generation, for otherwise the random number sequence 11282b15cb3dSCy Schubertwould be predictable. 11292b15cb3dSCy SchubertVarious means dependent on external events, such as keystroke intervals, 11302b15cb3dSCy Schubertcan be used to do this and some systems have built-in entropy sources. 11312b15cb3dSCy SchubertSuitable means are described in the OpenSSL software documentation, 11322b15cb3dSCy Schubertbut are outside the scope of this page. 1133052d159aSCy Schubert</p> 11342b15cb3dSCy Schubert<p>The entropy seed used by the OpenSSL library is contained in a file, 11352b15cb3dSCy Schubertusually called 1136052d159aSCy Schubert<samp>.rnd</samp>, 11372b15cb3dSCy Schubertwhich must be available when starting the NTP daemon 11382b15cb3dSCy Schubertor the 11392b15cb3dSCy Schubert<code>ntp-keygen</code> 11402b15cb3dSCy Schubertprogram. 11412b15cb3dSCy SchubertThe NTP daemon will first look for the file 11422b15cb3dSCy Schubertusing the path specified by the 11432b15cb3dSCy Schubert<code>randfile</code> 11442b15cb3dSCy Schubertsubcommand of the 11452b15cb3dSCy Schubert<code>crypto</code> 11462b15cb3dSCy Schubertconfiguration command. 11472b15cb3dSCy SchubertIf not specified in this way, or when starting the 11482b15cb3dSCy Schubert<code>ntp-keygen</code> 11492b15cb3dSCy Schubertprogram, 11502b15cb3dSCy Schubertthe OpenSSL library will look for the file using the path specified 11512b15cb3dSCy Schubertby the 11522b15cb3dSCy Schubert.Ev RANDFILE 11532b15cb3dSCy Schubertenvironment variable in the user home directory, 11542b15cb3dSCy Schubertwhether root or some other user. 11552b15cb3dSCy SchubertIf the 11562b15cb3dSCy Schubert.Ev RANDFILE 11572b15cb3dSCy Schubertenvironment variable is not present, 11582b15cb3dSCy Schubertthe library will look for the 1159052d159aSCy Schubert<samp>.rnd</samp> 11602b15cb3dSCy Schubertfile in the user home directory. 116109100258SXin LISince both the 116209100258SXin LI<code>ntp-keygen</code> 116309100258SXin LIprogram and 116409100258SXin LI<code>ntpd(1ntpdmdoc)</code> 116509100258SXin LIdaemon must run as root, the logical place to put this file is in 1166052d159aSCy Schubert<samp>/.rnd</samp> 116709100258SXin LIor 1168052d159aSCy Schubert<samp>/root/.rnd</samp>. 11692b15cb3dSCy SchubertIf the file is not available or cannot be written, 11702b15cb3dSCy Schubertthe daemon exits with a message to the system log and the program 11712b15cb3dSCy Schubertexits with a suitable error message. 1172052d159aSCy Schubert</p> 1173a466cc55SCy Schubert<span id="Cryptographic-Data-Files-1"></span><h4 class="subsubsection">1.2.1.5 Cryptographic Data Files</h4> 117409100258SXin LI<p>All file formats begin with two nonencrypted lines. 117509100258SXin LIThe first line contains the file name, including the generated host name 117609100258SXin LIand filestamp, in the format 1177052d159aSCy Schubert<samp>ntpkey_</samp><kbd>key</kbd> <kbd>_</kbd> <kbd>name</kbd>. <kbd>filestamp</kbd>, 117809100258SXin LIwhere 117909100258SXin LI<kbd>key</kbd> 118009100258SXin LIis the key or parameter type, 118109100258SXin LI<kbd>name</kbd> 118209100258SXin LIis the host or group name and 118309100258SXin LI<kbd>filestamp</kbd> 118409100258SXin LIis the filestamp (NTP seconds) when the file was created. 118509100258SXin LIBy convention, 118609100258SXin LI<kbd>key</kbd> 118709100258SXin LInames in generated file names include both upper and lower case 118809100258SXin LIcharacters, while 118909100258SXin LI<kbd>key</kbd> 119009100258SXin LInames in generated link names include only lower case characters. 119109100258SXin LIThe filestamp is not used in generated link names. 119209100258SXin LIThe second line contains the datestamp in conventional Unix 1193052d159aSCy Schubert<samp>date</samp> 119409100258SXin LIformat. 119509100258SXin LILines beginning with 1196052d159aSCy Schubert‘#’ 119709100258SXin LIare considered comments and ignored by the 11982b15cb3dSCy Schubert<code>ntp-keygen</code> 11992b15cb3dSCy Schubertprogram and 12002b15cb3dSCy Schubert<code>ntpd(1ntpdmdoc)</code> 12012b15cb3dSCy Schubertdaemon. 1202052d159aSCy Schubert</p> 120309100258SXin LI<p>The remainder of the file contains cryptographic data, encoded first using ASN.1 120409100258SXin LIrules, then encrypted if necessary, and finally written in PEM-encoded 120509100258SXin LIprintable ASCII text, preceded and followed by MIME content identifier lines. 1206052d159aSCy Schubert</p> 120709100258SXin LI<p>The format of the symmetric keys file, ordinarily named 1208052d159aSCy Schubert<samp>ntp.keys</samp>, 120909100258SXin LIis somewhat different than the other files in the interest of backward compatibility. 121009100258SXin LIOrdinarily, the file is generated by this program, but it can be constructed 121109100258SXin LIand edited using an ordinary text editor. 1212052d159aSCy Schubert</p><pre class="verbatim"># ntpkey_MD5key_bk.ntp.org.3595864945 121309100258SXin LI# Thu Dec 12 19:22:25 2013 121409100258SXin LI 1215052d159aSCy Schubert1 MD5 L";Nw<\`.I<f4U0)247"i # MD5 key 1216052d159aSCy Schubert2 MD5 &>l0%XXK9O'51VwV<xq~ # MD5 key 121709100258SXin LI3 MD5 lb4zLW~d^!K:]RsD'qb6 # MD5 key 121809100258SXin LI4 MD5 Yue:tL[+vR)M\`n~bY,'? # MD5 key 121909100258SXin LI5 MD5 B;fx'Kgr/&4ZTbL6=RxA # MD5 key 122009100258SXin LI6 MD5 4eYwa\`o@}3i@@@@V@@..R9!l # MD5 key 122109100258SXin LI7 MD5 \`A.([h+;wTQ|xfi%Sn_! # MD5 key 1222052d159aSCy Schubert8 MD5 45:V,r4]l6y^JH6"Sh?F # MD5 key 122309100258SXin LI9 MD5 3-5vcn*6l29DS?Xdsg)* # MD5 key 122409100258SXin LI10 MD5 2late4Me # MD5 key 122509100258SXin LI11 SHA1 a27872d3030a9025b8446c751b4551a7629af65c # SHA1 key 122609100258SXin LI12 SHA1 21bc3b4865dbb9e920902abdccb3e04ff97a5e74 # SHA1 key 122709100258SXin LI13 SHA1 2b7736fe24fef5ba85ae11594132ab5d6f6daba9 # SHA1 key 122809100258SXin LI14 SHA a5332809c8878dd3a5b918819108a111509aeceb # SHA key 122909100258SXin LI15 MD2 2fe16c88c760ff2f16d4267e36c1aa6c926e6964 # MD2 key 123009100258SXin LI16 MD4 b2691811dc19cfc0e2f9bcacd74213f29812183d # MD4 key 123109100258SXin LI17 MD5 e4d6735b8bdad58ec5ffcb087300a17f7fef1f7c # MD5 key 123209100258SXin LI18 MDC2 a8d5e2315c025bf3a79174c87fbd10477de2eabc # MDC2 key 123309100258SXin LI19 RIPEMD160 77ca332cafb30e3cafb174dcd5b80ded7ba9b3d2 # RIPEMD160 key 123409100258SXin LI20 AES128CMAC f92ff73eee86c1e7dc638d6489a04e4e555af878 # AES128CMAC key 1235052d159aSCy Schubert</pre><div class="example"> 123609100258SXin LI<pre class="example">Figure 1. Typical Symmetric Key File 1237052d159aSCy Schubert</pre></div> 1238052d159aSCy Schubert 123909100258SXin LI<p>Figure 1 shows a typical symmetric keys file used by the reference 124009100258SXin LIimplementation. 124109100258SXin LIFollowing the header the keys are entered one per line in the format 1242052d159aSCy Schubert</p><div class="example"> 12432b15cb3dSCy Schubert<pre class="example"><kbd>keyno</kbd> <kbd>type</kbd> <kbd>key</kbd> 1244052d159aSCy Schubert</pre></div> 12452b15cb3dSCy Schubert<p>where 12462b15cb3dSCy Schubert<kbd>keyno</kbd> 12474e1ef62aSXin LIis a positive integer in the range 1-65535; 12482b15cb3dSCy Schubert<kbd>type</kbd> 124909100258SXin LIis the key type for the message digest algorithm, which in the absence of the 125009100258SXin LIOpenSSL library must be 125109100258SXin LI<code>MD5</code> 125209100258SXin LIto designate the MD5 message digest algorithm; 125309100258SXin LIif the OpenSSL library is installed, the key type can be any 125409100258SXin LImessage digest algorithm supported by that library; 125509100258SXin LIhowever, if compatibility with FIPS 140-2 is required, 125609100258SXin LIthe key type must be either 125709100258SXin LI<code>SHA</code> 125809100258SXin LIor 125909100258SXin LI<code>SHA1</code>; 12602b15cb3dSCy Schubert<kbd>key</kbd> 12612b15cb3dSCy Schubertis the key itself, 126209100258SXin LIwhich is a printable ASCII string 20 characters or less in length: 126309100258SXin LIeach character is chosen from the 93 printable characters 126409100258SXin LIin the range 0x21 through 0x7e ( 1265052d159aSCy Schubert‘’! 126609100258SXin LIthrough 1267052d159aSCy Schubert‘~’ 126809100258SXin LI) excluding space and the 1269052d159aSCy Schubert‘#’ 127009100258SXin LIcharacter, and terminated by whitespace or a 1271052d159aSCy Schubert‘#’ 12722b15cb3dSCy Schubertcharacter. 127309100258SXin LIAn OpenSSL key consists of a hex-encoded ASCII string of 40 characters, which 127409100258SXin LIis truncated as necessary. 1275052d159aSCy Schubert</p> 12762b15cb3dSCy Schubert<p>Note that the keys used by the 12772b15cb3dSCy Schubert<code>ntpq(1ntpqmdoc)</code> 12782b15cb3dSCy Schubertand 12792b15cb3dSCy Schubert<code>ntpdc(1ntpdcmdoc)</code> 12802b15cb3dSCy Schubertprograms 12812b15cb3dSCy Schubertare checked against passwords requested by the programs 12822b15cb3dSCy Schubertand entered by hand, so it is generally appropriate to specify these keys 12832b15cb3dSCy Schubertin human readable ASCII format. 1284052d159aSCy Schubert</p> 12852b15cb3dSCy Schubert<p>The 12862b15cb3dSCy Schubert<code>ntp-keygen</code> 128709100258SXin LIprogram generates a symmetric keys file 1288052d159aSCy Schubert<samp>ntpkey_MD5key_</samp><kbd>hostname</kbd>. <kbd>filestamp</kbd>. 12892b15cb3dSCy SchubertSince the file contains private shared keys, 12902b15cb3dSCy Schubertit should be visible only to root and distributed by secure means 12912b15cb3dSCy Schubertto other subnet hosts. 12922b15cb3dSCy SchubertThe NTP daemon loads the file 1293052d159aSCy Schubert<samp>ntp.keys</samp>, 12942b15cb3dSCy Schubertso 12952b15cb3dSCy Schubert<code>ntp-keygen</code> 12962b15cb3dSCy Schubertinstalls a soft link from this name to the generated file. 12972b15cb3dSCy SchubertSubsequently, similar soft links must be installed by manual 12982b15cb3dSCy Schubertor automated means on the other subnet hosts. 12992b15cb3dSCy SchubertWhile this file is not used with the Autokey Version 2 protocol, 13002b15cb3dSCy Schubertit is needed to authenticate some remote configuration commands 13012b15cb3dSCy Schubertused by the 13022b15cb3dSCy Schubert<code>ntpq(1ntpqmdoc)</code> 13032b15cb3dSCy Schubertand 13042b15cb3dSCy Schubert<code>ntpdc(1ntpdcmdoc)</code> 13052b15cb3dSCy Schubertutilities. 1306052d159aSCy Schubert</p> 13072b15cb3dSCy Schubert<p>This section was generated by <strong>AutoGen</strong>, 13082b15cb3dSCy Schubertusing the <code>agtexi-cmd</code> template and the option descriptions for the <code>ntp-keygen</code> program. 13092b15cb3dSCy SchubertThis software is released under the NTP license, <http://ntp.org/license>. 1310052d159aSCy Schubert</p> 1311052d159aSCy Schubert<table class="menu" border="0" cellspacing="0"> 1312a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-usage" accesskey="1">ntp-keygen usage</a></td><td> </td><td align="left" valign="top">ntp-keygen help/usage (<samp>--help</samp>) 1313052d159aSCy Schubert</td></tr> 1314a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-imbits" accesskey="2">ntp-keygen imbits</a></td><td> </td><td align="left" valign="top">imbits option (-b) 1315052d159aSCy Schubert</td></tr> 1316a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-certificate" accesskey="3">ntp-keygen certificate</a></td><td> </td><td align="left" valign="top">certificate option (-c) 1317052d159aSCy Schubert</td></tr> 1318a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-cipher" accesskey="4">ntp-keygen cipher</a></td><td> </td><td align="left" valign="top">cipher option (-C) 1319052d159aSCy Schubert</td></tr> 1320a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-id_002dkey" accesskey="5">ntp-keygen id-key</a></td><td> </td><td align="left" valign="top">id-key option (-e) 1321052d159aSCy Schubert</td></tr> 1322a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-gq_002dparams" accesskey="6">ntp-keygen gq-params</a></td><td> </td><td align="left" valign="top">gq-params option (-G) 1323052d159aSCy Schubert</td></tr> 1324a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-host_002dkey" accesskey="7">ntp-keygen host-key</a></td><td> </td><td align="left" valign="top">host-key option (-H) 1325052d159aSCy Schubert</td></tr> 1326a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-iffkey" accesskey="8">ntp-keygen iffkey</a></td><td> </td><td align="left" valign="top">iffkey option (-I) 1327052d159aSCy Schubert</td></tr> 1328a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-ident" accesskey="9">ntp-keygen ident</a></td><td> </td><td align="left" valign="top">ident option (-i) 1329052d159aSCy Schubert</td></tr> 1330a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-lifetime">ntp-keygen lifetime</a></td><td> </td><td align="left" valign="top">lifetime option (-l) 1331052d159aSCy Schubert</td></tr> 1332a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-modulus">ntp-keygen modulus</a></td><td> </td><td align="left" valign="top">modulus option (-m) 1333052d159aSCy Schubert</td></tr> 1334a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-md5key">ntp-keygen md5key</a></td><td> </td><td align="left" valign="top">md5key option (-M) 1335052d159aSCy Schubert</td></tr> 1336a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-pvt_002dcert">ntp-keygen pvt-cert</a></td><td> </td><td align="left" valign="top">pvt-cert option (-P) 1337052d159aSCy Schubert</td></tr> 1338a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-password">ntp-keygen password</a></td><td> </td><td align="left" valign="top">password option (-p) 1339052d159aSCy Schubert</td></tr> 1340a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-export_002dpasswd">ntp-keygen export-passwd</a></td><td> </td><td align="left" valign="top">export-passwd option (-q) 1341052d159aSCy Schubert</td></tr> 1342a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-subject_002dname">ntp-keygen subject-name</a></td><td> </td><td align="left" valign="top">subject-name option (-s) 1343052d159aSCy Schubert</td></tr> 1344a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-sign_002dkey">ntp-keygen sign-key</a></td><td> </td><td align="left" valign="top">sign-key option (-S) 1345052d159aSCy Schubert</td></tr> 1346a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-trusted_002dcert">ntp-keygen trusted-cert</a></td><td> </td><td align="left" valign="top">trusted-cert option (-T) 1347052d159aSCy Schubert</td></tr> 1348a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-mv_002dparams">ntp-keygen mv-params</a></td><td> </td><td align="left" valign="top">mv-params option (-V) 1349052d159aSCy Schubert</td></tr> 1350a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-mv_002dkeys">ntp-keygen mv-keys</a></td><td> </td><td align="left" valign="top">mv-keys option (-v) 1351052d159aSCy Schubert</td></tr> 1352a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-config">ntp-keygen config</a></td><td> </td><td align="left" valign="top">presetting/configuring ntp-keygen 1353052d159aSCy Schubert</td></tr> 1354a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-exit-status">ntp-keygen exit status</a></td><td> </td><td align="left" valign="top">exit status 1355052d159aSCy Schubert</td></tr> 1356a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-Usage">ntp-keygen Usage</a></td><td> </td><td align="left" valign="top">Usage 1357052d159aSCy Schubert</td></tr> 1358a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-Notes">ntp-keygen Notes</a></td><td> </td><td align="left" valign="top">Notes 1359052d159aSCy Schubert</td></tr> 1360a466cc55SCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-Bugs">ntp-keygen Bugs</a></td><td> </td><td align="left" valign="top">Bugs 1361052d159aSCy Schubert</td></tr> 1362052d159aSCy Schubert</table> 13632b15cb3dSCy Schubert 1364052d159aSCy Schubert<hr> 1365a466cc55SCy Schubert<span id="ntp_002dkeygen-usage"></span><div class="header"> 1366052d159aSCy Schubert<p> 1367052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-imbits" accesskey="n" rel="next">ntp-keygen imbits</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 13682b15cb3dSCy Schubert</div> 1369a466cc55SCy Schubert<span id="ntp_002dkeygen-help_002fusage-_0028_002d_002dhelp_0029"></span><h4 class="subsection">1.2.2 ntp-keygen help/usage (<samp>--help</samp>)</h4> 1370a466cc55SCy Schubert<span id="index-ntp_002dkeygen-help"></span> 13712b15cb3dSCy Schubert 1372052d159aSCy Schubert<p>This is the automatically generated usage text for ntp-keygen. 1373052d159aSCy Schubert</p> 13742b15cb3dSCy Schubert<p>The text printed is the same whether selected with the <code>help</code> option 1375052d159aSCy Schubert(<samp>--help</samp>) or the <code>more-help</code> option (<samp>--more-help</samp>). <code>more-help</code> will print 13762b15cb3dSCy Schubertthe usage text by passing it through a pager program. 13772b15cb3dSCy Schubert<code>more-help</code> is disabled on platforms without a working 13782b15cb3dSCy Schubert<code>fork(2)</code> function. The <code>PAGER</code> environment variable is 1379052d159aSCy Schubertused to select the program, defaulting to <samp>more</samp>. Both will exit 13802b15cb3dSCy Schubertwith a status code of 0. 1381052d159aSCy Schubert</p> 1382052d159aSCy Schubert<div class="example"> 1383*f5f40dd6SCy Schubert<pre class="example">ntp-keygen (ntp) - Create a NTP host key - Ver. 4.2.8p18 13842b15cb3dSCy SchubertUsage: ntp-keygen [ -<flag> [<val>] | --<name>[{=| }<val>] ]... 13852b15cb3dSCy Schubert Flg Arg Option-Name Description 13862b15cb3dSCy Schubert -b Num imbits identity modulus bits 13872b15cb3dSCy Schubert - it must be in the range: 13882b15cb3dSCy Schubert 256 to 2048 13892b15cb3dSCy Schubert -c Str certificate certificate scheme 13902b15cb3dSCy Schubert -C Str cipher privatekey cipher 13912b15cb3dSCy Schubert -d no debug-level Increase debug verbosity level 13922b15cb3dSCy Schubert - may appear multiple times 13932b15cb3dSCy Schubert -D Num set-debug-level Set the debug verbosity level 13942b15cb3dSCy Schubert - may appear multiple times 13952b15cb3dSCy Schubert -e no id-key Write IFF or GQ identity keys 13962b15cb3dSCy Schubert -G no gq-params Generate GQ parameters and keys 13972b15cb3dSCy Schubert -H no host-key generate RSA host key 13982b15cb3dSCy Schubert -I no iffkey generate IFF parameters 13992b15cb3dSCy Schubert -i Str ident set Autokey group name 14002b15cb3dSCy Schubert -l Num lifetime set certificate lifetime 140109100258SXin LI -m Num modulus prime modulus 14022b15cb3dSCy Schubert - it must be in the range: 14032b15cb3dSCy Schubert 256 to 2048 140409100258SXin LI -M no md5key generate symmetric keys 14052b15cb3dSCy Schubert -P no pvt-cert generate PC private certificate 14062b15cb3dSCy Schubert -p Str password local private password 14072b15cb3dSCy Schubert -q Str export-passwd export IFF or GQ group keys with password 14082b15cb3dSCy Schubert -s Str subject-name set host and optionally group name 140909100258SXin LI -S Str sign-key generate sign key (RSA or DSA) 14102b15cb3dSCy Schubert -T no trusted-cert trusted certificate (TC scheme) 14112b15cb3dSCy Schubert -V Num mv-params generate <num> MV parameters 14122b15cb3dSCy Schubert -v Num mv-keys update <num> MV keys 14132b15cb3dSCy Schubert opt version output version information and exit 14142b15cb3dSCy Schubert -? no help display extended usage information and exit 14152b15cb3dSCy Schubert -! no more-help extended usage information passed thru pager 14162b15cb3dSCy Schubert -> opt save-opts save the option state to a config file 14172b15cb3dSCy Schubert -< Str load-opts load options from a config file 14182b15cb3dSCy Schubert - disabled as '--no-load-opts' 14192b15cb3dSCy Schubert - may appear multiple times 14202b15cb3dSCy Schubert 14212b15cb3dSCy SchubertOptions are specified by doubled hyphens and their name or by a single 14222b15cb3dSCy Schuberthyphen and the flag character. 14232b15cb3dSCy Schubert 14242b15cb3dSCy Schubert 14252b15cb3dSCy SchubertThe following option preset mechanisms are supported: 14262b15cb3dSCy Schubert - reading file $HOME/.ntprc 14272b15cb3dSCy Schubert - reading file ./.ntprc 14282b15cb3dSCy Schubert - examining environment variables named NTP_KEYGEN_* 14292b15cb3dSCy Schubert 1430a466cc55SCy SchubertPlease send bug reports to: <https://bugs.ntp.org, bugs@ntp.org> 1431052d159aSCy Schubert</pre></div> 1432052d159aSCy Schubert 1433052d159aSCy Schubert<hr> 1434a466cc55SCy Schubert<span id="ntp_002dkeygen-imbits"></span><div class="header"> 1435052d159aSCy Schubert<p> 1436052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-certificate" accesskey="n" rel="next">ntp-keygen certificate</a>, Previous: <a href="#ntp_002dkeygen-usage" accesskey="p" rel="prev">ntp-keygen usage</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 14372b15cb3dSCy Schubert</div> 1438a466cc55SCy Schubert<span id="imbits-option-_0028_002db_0029"></span><h4 class="subsection">1.2.3 imbits option (-b)</h4> 1439a466cc55SCy Schubert<span id="index-ntp_002dkeygen_002dimbits"></span> 14402b15cb3dSCy Schubert 1441052d159aSCy Schubert<p>This is the “identity modulus bits” option. 1442052d159aSCy SchubertThis option takes a number argument <samp>imbits</samp>. 1443052d159aSCy Schubert</p> 1444052d159aSCy Schubert<p>This option has some usage constraints. It: 1445052d159aSCy Schubert</p><ul> 14462b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1447052d159aSCy Schubert</li></ul> 14482b15cb3dSCy Schubert 1449a466cc55SCy Schubert<p>The number of bits in the identity modulus. The default is 512. 1450052d159aSCy Schubert</p><hr> 1451a466cc55SCy Schubert<span id="ntp_002dkeygen-certificate"></span><div class="header"> 1452052d159aSCy Schubert<p> 1453052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-cipher" accesskey="n" rel="next">ntp-keygen cipher</a>, Previous: <a href="#ntp_002dkeygen-imbits" accesskey="p" rel="prev">ntp-keygen imbits</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 14542b15cb3dSCy Schubert</div> 1455a466cc55SCy Schubert<span id="certificate-option-_0028_002dc_0029"></span><h4 class="subsection">1.2.4 certificate option (-c)</h4> 1456a466cc55SCy Schubert<span id="index-ntp_002dkeygen_002dcertificate"></span> 14572b15cb3dSCy Schubert 1458052d159aSCy Schubert<p>This is the “certificate scheme” option. 1459052d159aSCy SchubertThis option takes a string argument <samp>scheme</samp>. 1460052d159aSCy Schubert</p> 1461052d159aSCy Schubert<p>This option has some usage constraints. It: 1462052d159aSCy Schubert</p><ul> 14632b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1464052d159aSCy Schubert</li></ul> 14652b15cb3dSCy Schubert 14662b15cb3dSCy Schubert<p>scheme is one of 146709100258SXin LIRSA-MD2, RSA-MD5, RSA-MDC2, RSA-SHA, RSA-SHA1, RSA-RIPEMD160, 14682b15cb3dSCy SchubertDSA-SHA, or DSA-SHA1. 1469052d159aSCy Schubert</p> 147009100258SXin LI<p>Select the certificate signature encryption/message digest scheme. 14712b15cb3dSCy SchubertNote that RSA schemes must be used with a RSA sign key and DSA 14722b15cb3dSCy Schubertschemes must be used with a DSA sign key. The default without 14732b15cb3dSCy Schubertthis option is RSA-MD5. 1474052d159aSCy Schubert</p><hr> 1475a466cc55SCy Schubert<span id="ntp_002dkeygen-cipher"></span><div class="header"> 1476052d159aSCy Schubert<p> 1477052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-id_002dkey" accesskey="n" rel="next">ntp-keygen id-key</a>, Previous: <a href="#ntp_002dkeygen-certificate" accesskey="p" rel="prev">ntp-keygen certificate</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 14782b15cb3dSCy Schubert</div> 1479a466cc55SCy Schubert<span id="cipher-option-_0028_002dC_0029"></span><h4 class="subsection">1.2.5 cipher option (-C)</h4> 1480a466cc55SCy Schubert<span id="index-ntp_002dkeygen_002dcipher"></span> 14812b15cb3dSCy Schubert 1482052d159aSCy Schubert<p>This is the “privatekey cipher” option. 1483052d159aSCy SchubertThis option takes a string argument <samp>cipher</samp>. 1484052d159aSCy Schubert</p> 1485052d159aSCy Schubert<p>This option has some usage constraints. It: 1486052d159aSCy Schubert</p><ul> 14872b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1488052d159aSCy Schubert</li></ul> 14892b15cb3dSCy Schubert 14902b15cb3dSCy Schubert<p>Select the cipher which is used to encrypt the files containing 14912b15cb3dSCy Schubertprivate keys. The default is three-key triple DES in CBC mode, 1492052d159aSCy Schubertequivalent to "<code>-C des-ede3-cbc</code>". The openssl tool lists ciphers 1493052d159aSCy Schubertavailable in "<code>openssl -h</code>" output. 1494052d159aSCy Schubert</p><hr> 1495a466cc55SCy Schubert<span id="ntp_002dkeygen-id_002dkey"></span><div class="header"> 1496052d159aSCy Schubert<p> 1497052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-gq_002dparams" accesskey="n" rel="next">ntp-keygen gq-params</a>, Previous: <a href="#ntp_002dkeygen-cipher" accesskey="p" rel="prev">ntp-keygen cipher</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 14982b15cb3dSCy Schubert</div> 1499a466cc55SCy Schubert<span id="id_002dkey-option-_0028_002de_0029"></span><h4 class="subsection">1.2.6 id-key option (-e)</h4> 1500a466cc55SCy Schubert<span id="index-ntp_002dkeygen_002did_002dkey"></span> 15012b15cb3dSCy Schubert 1502052d159aSCy Schubert<p>This is the “write iff or gq identity keys” option. 1503052d159aSCy Schubert</p> 1504052d159aSCy Schubert<p>This option has some usage constraints. It: 1505052d159aSCy Schubert</p><ul> 15062b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1507052d159aSCy Schubert</li></ul> 15082b15cb3dSCy Schubert 150909100258SXin LI<p>Write the public parameters from the IFF or GQ client keys to 151009100258SXin LIthe standard output. 151109100258SXin LIThis is intended for automatic key distribution by email. 1512052d159aSCy Schubert</p><hr> 1513a466cc55SCy Schubert<span id="ntp_002dkeygen-gq_002dparams"></span><div class="header"> 1514052d159aSCy Schubert<p> 1515052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-host_002dkey" accesskey="n" rel="next">ntp-keygen host-key</a>, Previous: <a href="#ntp_002dkeygen-id_002dkey" accesskey="p" rel="prev">ntp-keygen id-key</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 15162b15cb3dSCy Schubert</div> 1517a466cc55SCy Schubert<span id="gq_002dparams-option-_0028_002dG_0029"></span><h4 class="subsection">1.2.7 gq-params option (-G)</h4> 1518a466cc55SCy Schubert<span id="index-ntp_002dkeygen_002dgq_002dparams"></span> 15192b15cb3dSCy Schubert 1520052d159aSCy Schubert<p>This is the “generate gq parameters and keys” option. 1521052d159aSCy Schubert</p> 1522052d159aSCy Schubert<p>This option has some usage constraints. It: 1523052d159aSCy Schubert</p><ul> 15242b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1525052d159aSCy Schubert</li></ul> 15262b15cb3dSCy Schubert 15272b15cb3dSCy Schubert<p>Generate parameters and keys for the GQ identification scheme, 15282b15cb3dSCy Schubertobsoleting any that may exist. 1529052d159aSCy Schubert</p><hr> 1530a466cc55SCy Schubert<span id="ntp_002dkeygen-host_002dkey"></span><div class="header"> 1531052d159aSCy Schubert<p> 1532052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-iffkey" accesskey="n" rel="next">ntp-keygen iffkey</a>, Previous: <a href="#ntp_002dkeygen-gq_002dparams" accesskey="p" rel="prev">ntp-keygen gq-params</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 15332b15cb3dSCy Schubert</div> 1534a466cc55SCy Schubert<span id="host_002dkey-option-_0028_002dH_0029"></span><h4 class="subsection">1.2.8 host-key option (-H)</h4> 1535a466cc55SCy Schubert<span id="index-ntp_002dkeygen_002dhost_002dkey"></span> 15362b15cb3dSCy Schubert 1537052d159aSCy Schubert<p>This is the “generate rsa host key” option. 1538052d159aSCy Schubert</p> 1539052d159aSCy Schubert<p>This option has some usage constraints. It: 1540052d159aSCy Schubert</p><ul> 15412b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1542052d159aSCy Schubert</li></ul> 15432b15cb3dSCy Schubert 15442b15cb3dSCy Schubert<p>Generate new host keys, obsoleting any that may exist. 1545052d159aSCy Schubert</p><hr> 1546a466cc55SCy Schubert<span id="ntp_002dkeygen-iffkey"></span><div class="header"> 1547052d159aSCy Schubert<p> 1548052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-ident" accesskey="n" rel="next">ntp-keygen ident</a>, Previous: <a href="#ntp_002dkeygen-host_002dkey" accesskey="p" rel="prev">ntp-keygen host-key</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 15492b15cb3dSCy Schubert</div> 1550a466cc55SCy Schubert<span id="iffkey-option-_0028_002dI_0029"></span><h4 class="subsection">1.2.9 iffkey option (-I)</h4> 1551a466cc55SCy Schubert<span id="index-ntp_002dkeygen_002diffkey"></span> 15522b15cb3dSCy Schubert 1553052d159aSCy Schubert<p>This is the “generate iff parameters” option. 1554052d159aSCy Schubert</p> 1555052d159aSCy Schubert<p>This option has some usage constraints. It: 1556052d159aSCy Schubert</p><ul> 15572b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1558052d159aSCy Schubert</li></ul> 15592b15cb3dSCy Schubert 15602b15cb3dSCy Schubert<p>Generate parameters for the IFF identification scheme, obsoleting 15612b15cb3dSCy Schubertany that may exist. 1562052d159aSCy Schubert</p><hr> 1563a466cc55SCy Schubert<span id="ntp_002dkeygen-ident"></span><div class="header"> 1564052d159aSCy Schubert<p> 1565052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-lifetime" accesskey="n" rel="next">ntp-keygen lifetime</a>, Previous: <a href="#ntp_002dkeygen-iffkey" accesskey="p" rel="prev">ntp-keygen iffkey</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 15662b15cb3dSCy Schubert</div> 1567a466cc55SCy Schubert<span id="ident-option-_0028_002di_0029"></span><h4 class="subsection">1.2.10 ident option (-i)</h4> 1568a466cc55SCy Schubert<span id="index-ntp_002dkeygen_002dident"></span> 15692b15cb3dSCy Schubert 1570052d159aSCy Schubert<p>This is the “set autokey group name” option. 1571052d159aSCy SchubertThis option takes a string argument <samp>group</samp>. 1572052d159aSCy Schubert</p> 1573052d159aSCy Schubert<p>This option has some usage constraints. It: 1574052d159aSCy Schubert</p><ul> 15752b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1576052d159aSCy Schubert</li></ul> 15772b15cb3dSCy Schubert 15782b15cb3dSCy Schubert<p>Set the optional Autokey group name to name. This is used in 15792b15cb3dSCy Schubertthe file name of IFF, GQ, and MV client parameters files. In 15802b15cb3dSCy Schubertthat role, the default is the host name if this option is not 15812b15cb3dSCy Schubertprovided. The group name, if specified using <code>-i/--ident</code> or 1582052d159aSCy Schubertusing <code>-s/--subject-name</code> following an ’<code>@</code>’ character, 158309100258SXin LIis also a part of the self-signed host certificate subject and 158409100258SXin LIissuer names in the form <code>host@group</code> and should match the 1585052d159aSCy Schubert’<code>crypto ident</code>’ or ’<code>server ident</code>’ configuration in the 158609100258SXin LI<code>ntpd</code> configuration file. 1587052d159aSCy Schubert</p><hr> 1588a466cc55SCy Schubert<span id="ntp_002dkeygen-lifetime"></span><div class="header"> 1589052d159aSCy Schubert<p> 1590052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-modulus" accesskey="n" rel="next">ntp-keygen modulus</a>, Previous: <a href="#ntp_002dkeygen-ident" accesskey="p" rel="prev">ntp-keygen ident</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 15912b15cb3dSCy Schubert</div> 1592a466cc55SCy Schubert<span id="lifetime-option-_0028_002dl_0029"></span><h4 class="subsection">1.2.11 lifetime option (-l)</h4> 1593a466cc55SCy Schubert<span id="index-ntp_002dkeygen_002dlifetime"></span> 15942b15cb3dSCy Schubert 1595052d159aSCy Schubert<p>This is the “set certificate lifetime” option. 1596052d159aSCy SchubertThis option takes a number argument <samp>lifetime</samp>. 1597052d159aSCy Schubert</p> 1598052d159aSCy Schubert<p>This option has some usage constraints. It: 1599052d159aSCy Schubert</p><ul> 16002b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1601052d159aSCy Schubert</li></ul> 16022b15cb3dSCy Schubert 16032b15cb3dSCy Schubert<p>Set the certificate expiration to lifetime days from now. 1604052d159aSCy Schubert</p><hr> 1605a466cc55SCy Schubert<span id="ntp_002dkeygen-modulus"></span><div class="header"> 1606052d159aSCy Schubert<p> 1607052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-md5key" accesskey="n" rel="next">ntp-keygen md5key</a>, Previous: <a href="#ntp_002dkeygen-lifetime" accesskey="p" rel="prev">ntp-keygen lifetime</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 16082b15cb3dSCy Schubert</div> 1609a466cc55SCy Schubert<span id="modulus-option-_0028_002dm_0029"></span><h4 class="subsection">1.2.12 modulus option (-m)</h4> 1610a466cc55SCy Schubert<span id="index-ntp_002dkeygen_002dmodulus"></span> 16112b15cb3dSCy Schubert 1612052d159aSCy Schubert<p>This is the “prime modulus” option. 1613052d159aSCy SchubertThis option takes a number argument <samp>modulus</samp>. 1614052d159aSCy Schubert</p> 1615052d159aSCy Schubert<p>This option has some usage constraints. It: 1616052d159aSCy Schubert</p><ul> 16172b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1618052d159aSCy Schubert</li></ul> 16192b15cb3dSCy Schubert 16202b15cb3dSCy Schubert<p>The number of bits in the prime modulus. The default is 512. 1621052d159aSCy Schubert</p><hr> 1622a466cc55SCy Schubert<span id="ntp_002dkeygen-md5key"></span><div class="header"> 1623052d159aSCy Schubert<p> 1624052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-pvt_002dcert" accesskey="n" rel="next">ntp-keygen pvt-cert</a>, Previous: <a href="#ntp_002dkeygen-modulus" accesskey="p" rel="prev">ntp-keygen modulus</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 16252b15cb3dSCy Schubert</div> 1626a466cc55SCy Schubert<span id="md5key-option-_0028_002dM_0029"></span><h4 class="subsection">1.2.13 md5key option (-M)</h4> 1627a466cc55SCy Schubert<span id="index-ntp_002dkeygen_002dmd5key"></span> 16282b15cb3dSCy Schubert 1629052d159aSCy Schubert<p>This is the “generate symmetric keys” option. 163009100258SXin LIGenerate symmetric keys, obsoleting any that may exist. 1631052d159aSCy Schubert</p><hr> 1632a466cc55SCy Schubert<span id="ntp_002dkeygen-pvt_002dcert"></span><div class="header"> 1633052d159aSCy Schubert<p> 1634052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-password" accesskey="n" rel="next">ntp-keygen password</a>, Previous: <a href="#ntp_002dkeygen-md5key" accesskey="p" rel="prev">ntp-keygen md5key</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 163509100258SXin LI</div> 1636a466cc55SCy Schubert<span id="pvt_002dcert-option-_0028_002dP_0029"></span><h4 class="subsection">1.2.14 pvt-cert option (-P)</h4> 1637a466cc55SCy Schubert<span id="index-ntp_002dkeygen_002dpvt_002dcert"></span> 163809100258SXin LI 1639052d159aSCy Schubert<p>This is the “generate pc private certificate” option. 1640052d159aSCy Schubert</p> 1641052d159aSCy Schubert<p>This option has some usage constraints. It: 1642052d159aSCy Schubert</p><ul> 16432b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1644052d159aSCy Schubert</li></ul> 16452b15cb3dSCy Schubert 16462b15cb3dSCy Schubert<p>Generate a private certificate. By default, the program generates 16472b15cb3dSCy Schubertpublic certificates. 1648052d159aSCy Schubert</p><hr> 1649a466cc55SCy Schubert<span id="ntp_002dkeygen-password"></span><div class="header"> 1650052d159aSCy Schubert<p> 1651052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-export_002dpasswd" accesskey="n" rel="next">ntp-keygen export-passwd</a>, Previous: <a href="#ntp_002dkeygen-pvt_002dcert" accesskey="p" rel="prev">ntp-keygen pvt-cert</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 16522b15cb3dSCy Schubert</div> 1653a466cc55SCy Schubert<span id="password-option-_0028_002dp_0029"></span><h4 class="subsection">1.2.15 password option (-p)</h4> 1654a466cc55SCy Schubert<span id="index-ntp_002dkeygen_002dpassword"></span> 16552b15cb3dSCy Schubert 1656052d159aSCy Schubert<p>This is the “local private password” option. 1657052d159aSCy SchubertThis option takes a string argument <samp>passwd</samp>. 1658052d159aSCy Schubert</p> 1659052d159aSCy Schubert<p>This option has some usage constraints. It: 1660052d159aSCy Schubert</p><ul> 16612b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1662052d159aSCy Schubert</li></ul> 16632b15cb3dSCy Schubert 16642b15cb3dSCy Schubert<p>Local files containing private data are encrypted with the 16652b15cb3dSCy SchubertDES-CBC algorithm and the specified password. The same password 1666052d159aSCy Schubertmust be specified to the local ntpd via the "crypto pw password" 16672b15cb3dSCy Schubertconfiguration command. The default password is the local 16682b15cb3dSCy Schuberthostname. 1669052d159aSCy Schubert</p><hr> 1670a466cc55SCy Schubert<span id="ntp_002dkeygen-export_002dpasswd"></span><div class="header"> 1671052d159aSCy Schubert<p> 1672052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-subject_002dname" accesskey="n" rel="next">ntp-keygen subject-name</a>, Previous: <a href="#ntp_002dkeygen-password" accesskey="p" rel="prev">ntp-keygen password</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 16732b15cb3dSCy Schubert</div> 1674a466cc55SCy Schubert<span id="export_002dpasswd-option-_0028_002dq_0029"></span><h4 class="subsection">1.2.16 export-passwd option (-q)</h4> 1675a466cc55SCy Schubert<span id="index-ntp_002dkeygen_002dexport_002dpasswd"></span> 16762b15cb3dSCy Schubert 1677052d159aSCy Schubert<p>This is the “export iff or gq group keys with password” option. 1678052d159aSCy SchubertThis option takes a string argument <samp>passwd</samp>. 1679052d159aSCy Schubert</p> 1680052d159aSCy Schubert<p>This option has some usage constraints. It: 1681052d159aSCy Schubert</p><ul> 16822b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1683052d159aSCy Schubert</li></ul> 16842b15cb3dSCy Schubert 16852b15cb3dSCy Schubert<p>Export IFF or GQ identity group keys to the standard output, 16862b15cb3dSCy Schubertencrypted with the DES-CBC algorithm and the specified password. 16872b15cb3dSCy SchubertThe same password must be specified to the remote ntpd via the 1688052d159aSCy Schubert"crypto pw password" configuration command. See also the option 168909100258SXin LI–id-key (-e) for unencrypted exports. 1690052d159aSCy Schubert</p><hr> 1691a466cc55SCy Schubert<span id="ntp_002dkeygen-subject_002dname"></span><div class="header"> 1692052d159aSCy Schubert<p> 1693052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-sign_002dkey" accesskey="n" rel="next">ntp-keygen sign-key</a>, Previous: <a href="#ntp_002dkeygen-export_002dpasswd" accesskey="p" rel="prev">ntp-keygen export-passwd</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 16942b15cb3dSCy Schubert</div> 1695a466cc55SCy Schubert<span id="subject_002dname-option-_0028_002ds_0029"></span><h4 class="subsection">1.2.17 subject-name option (-s)</h4> 1696a466cc55SCy Schubert<span id="index-ntp_002dkeygen_002dsubject_002dname"></span> 16972b15cb3dSCy Schubert 1698052d159aSCy Schubert<p>This is the “set host and optionally group name” option. 1699052d159aSCy SchubertThis option takes a string argument <samp>host@group</samp>. 1700052d159aSCy Schubert</p> 1701052d159aSCy Schubert<p>This option has some usage constraints. It: 1702052d159aSCy Schubert</p><ul> 170309100258SXin LI<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1704052d159aSCy Schubert</li></ul> 170509100258SXin LI 170609100258SXin LI<p>Set the Autokey host name, and optionally, group name specified 1707052d159aSCy Schubertfollowing an ’<code>@</code>’ character. The host name is used in the file 170809100258SXin LIname of generated host and signing certificates, without the 170909100258SXin LIgroup name. The host name, and if provided, group name are used 171009100258SXin LIin <code>host@group</code> form for the host certificate subject and issuer 1711052d159aSCy Schubertfields. Specifying ’<code>-s @group</code>’ is allowed, and results in 171209100258SXin LIleaving the host name unchanged while appending <code>@group</code> to the 171309100258SXin LIsubject and issuer fields, as with <code>-i group</code>. The group name, or 171409100258SXin LIif not provided, the host name are also used in the file names 171509100258SXin LIof IFF, GQ, and MV client parameter files. 1716052d159aSCy Schubert</p><hr> 1717a466cc55SCy Schubert<span id="ntp_002dkeygen-sign_002dkey"></span><div class="header"> 1718052d159aSCy Schubert<p> 1719052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-trusted_002dcert" accesskey="n" rel="next">ntp-keygen trusted-cert</a>, Previous: <a href="#ntp_002dkeygen-subject_002dname" accesskey="p" rel="prev">ntp-keygen subject-name</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 172009100258SXin LI</div> 1721a466cc55SCy Schubert<span id="sign_002dkey-option-_0028_002dS_0029"></span><h4 class="subsection">1.2.18 sign-key option (-S)</h4> 1722a466cc55SCy Schubert<span id="index-ntp_002dkeygen_002dsign_002dkey"></span> 172309100258SXin LI 1724052d159aSCy Schubert<p>This is the “generate sign key (rsa or dsa)” option. 1725052d159aSCy SchubertThis option takes a string argument <samp>sign</samp>. 1726052d159aSCy Schubert</p> 1727052d159aSCy Schubert<p>This option has some usage constraints. It: 1728052d159aSCy Schubert</p><ul> 17292b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1730052d159aSCy Schubert</li></ul> 17312b15cb3dSCy Schubert 17322b15cb3dSCy Schubert<p>Generate a new sign key of the designated type, obsoleting any 17332b15cb3dSCy Schubertthat may exist. By default, the program uses the host key as the 17342b15cb3dSCy Schubertsign key. 1735052d159aSCy Schubert</p><hr> 1736a466cc55SCy Schubert<span id="ntp_002dkeygen-trusted_002dcert"></span><div class="header"> 1737052d159aSCy Schubert<p> 1738052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-mv_002dparams" accesskey="n" rel="next">ntp-keygen mv-params</a>, Previous: <a href="#ntp_002dkeygen-sign_002dkey" accesskey="p" rel="prev">ntp-keygen sign-key</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 17392b15cb3dSCy Schubert</div> 1740a466cc55SCy Schubert<span id="trusted_002dcert-option-_0028_002dT_0029"></span><h4 class="subsection">1.2.19 trusted-cert option (-T)</h4> 1741a466cc55SCy Schubert<span id="index-ntp_002dkeygen_002dtrusted_002dcert"></span> 17422b15cb3dSCy Schubert 1743052d159aSCy Schubert<p>This is the “trusted certificate (tc scheme)” option. 1744052d159aSCy Schubert</p> 1745052d159aSCy Schubert<p>This option has some usage constraints. It: 1746052d159aSCy Schubert</p><ul> 17472b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1748052d159aSCy Schubert</li></ul> 17492b15cb3dSCy Schubert 17502b15cb3dSCy Schubert<p>Generate a trusted certificate. By default, the program generates 17512b15cb3dSCy Schuberta non-trusted certificate. 1752052d159aSCy Schubert</p><hr> 1753a466cc55SCy Schubert<span id="ntp_002dkeygen-mv_002dparams"></span><div class="header"> 1754052d159aSCy Schubert<p> 1755052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-mv_002dkeys" accesskey="n" rel="next">ntp-keygen mv-keys</a>, Previous: <a href="#ntp_002dkeygen-trusted_002dcert" accesskey="p" rel="prev">ntp-keygen trusted-cert</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 17562b15cb3dSCy Schubert</div> 1757a466cc55SCy Schubert<span id="mv_002dparams-option-_0028_002dV_0029"></span><h4 class="subsection">1.2.20 mv-params option (-V)</h4> 1758a466cc55SCy Schubert<span id="index-ntp_002dkeygen_002dmv_002dparams"></span> 17592b15cb3dSCy Schubert 1760052d159aSCy Schubert<p>This is the “generate <num> mv parameters” option. 1761052d159aSCy SchubertThis option takes a number argument <samp>num</samp>. 1762052d159aSCy Schubert</p> 1763052d159aSCy Schubert<p>This option has some usage constraints. It: 1764052d159aSCy Schubert</p><ul> 17652b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1766052d159aSCy Schubert</li></ul> 17672b15cb3dSCy Schubert 17682b15cb3dSCy Schubert<p>Generate parameters and keys for the Mu-Varadharajan (MV) 17692b15cb3dSCy Schubertidentification scheme. 1770052d159aSCy Schubert</p><hr> 1771a466cc55SCy Schubert<span id="ntp_002dkeygen-mv_002dkeys"></span><div class="header"> 1772052d159aSCy Schubert<p> 1773052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-config" accesskey="n" rel="next">ntp-keygen config</a>, Previous: <a href="#ntp_002dkeygen-mv_002dparams" accesskey="p" rel="prev">ntp-keygen mv-params</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 17742b15cb3dSCy Schubert</div> 1775a466cc55SCy Schubert<span id="mv_002dkeys-option-_0028_002dv_0029"></span><h4 class="subsection">1.2.21 mv-keys option (-v)</h4> 1776a466cc55SCy Schubert<span id="index-ntp_002dkeygen_002dmv_002dkeys"></span> 17772b15cb3dSCy Schubert 1778052d159aSCy Schubert<p>This is the “update <num> mv keys” option. 1779052d159aSCy SchubertThis option takes a number argument <samp>num</samp>. 1780052d159aSCy Schubert</p> 1781052d159aSCy Schubert<p>This option has some usage constraints. It: 1782052d159aSCy Schubert</p><ul> 17832b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1784052d159aSCy Schubert</li></ul> 17852b15cb3dSCy Schubert 1786052d159aSCy Schubert<p>This option has no ‘<samp>doc</samp>’ documentation. 1787052d159aSCy Schubert</p> 17882b15cb3dSCy Schubert 1789052d159aSCy Schubert<hr> 1790a466cc55SCy Schubert<span id="ntp_002dkeygen-config"></span><div class="header"> 1791052d159aSCy Schubert<p> 1792052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-exit-status" accesskey="n" rel="next">ntp-keygen exit status</a>, Previous: <a href="#ntp_002dkeygen-mv_002dkeys" accesskey="p" rel="prev">ntp-keygen mv-keys</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 17932b15cb3dSCy Schubert</div> 1794a466cc55SCy Schubert<span id="presetting_002fconfiguring-ntp_002dkeygen"></span><h4 class="subsection">1.2.22 presetting/configuring ntp-keygen</h4> 17952b15cb3dSCy Schubert 17962b15cb3dSCy Schubert<p>Any option that is not marked as <i>not presettable</i> may be preset by 1797052d159aSCy Schubertloading values from configuration ("rc" or "ini") files, and values from environment variables named <code>NTP-KEYGEN</code> and <code>NTP-KEYGEN_<OPTION_NAME></code>. <code><OPTION_NAME></code> must be one of 17982b15cb3dSCy Schubertthe options listed above in upper case and segmented with underscores. 17992b15cb3dSCy SchubertThe <code>NTP-KEYGEN</code> variable will be tokenized and parsed like 18002b15cb3dSCy Schubertthe command line. The remaining variables are tested for existence and their 18012b15cb3dSCy Schubertvalues are treated like option arguments. 1802052d159aSCy Schubert</p> 18032b15cb3dSCy Schubert 1804052d159aSCy Schubert<p><code>libopts</code> will search in 2 places for configuration files: 1805052d159aSCy Schubert</p><ul> 18062b15cb3dSCy Schubert<li> $HOME 1807052d159aSCy Schubert</li><li> $PWD 1808052d159aSCy Schubert</li></ul> 1809052d159aSCy Schubert<p>The environment variables <code>HOME</code>, and <code>PWD</code> 1810052d159aSCy Schubertare expanded and replaced when <samp>ntp-keygen</samp> runs. 18112b15cb3dSCy SchubertFor any of these that are plain files, they are simply processed. 1812052d159aSCy SchubertFor any that are directories, then a file named <samp>.ntprc</samp> is searched for 18132b15cb3dSCy Schubertwithin that directory and processed. 1814052d159aSCy Schubert</p> 18152b15cb3dSCy Schubert<p>Configuration files may be in a wide variety of formats. 18162b15cb3dSCy SchubertThe basic format is an option name followed by a value (argument) on the 18172b15cb3dSCy Schubertsame line. Values may be separated from the option name with a colon, 18182b15cb3dSCy Schubertequal sign or simply white space. Values may be continued across multiple 18192b15cb3dSCy Schubertlines by escaping the newline with a backslash. 1820052d159aSCy Schubert</p> 18212b15cb3dSCy Schubert<p>Multiple programs may also share the same initialization file. 18222b15cb3dSCy SchubertCommon options are collected at the top, followed by program specific 18232b15cb3dSCy Schubertsegments. The segments are separated by lines like: 1824052d159aSCy Schubert</p><div class="example"> 18252b15cb3dSCy Schubert<pre class="example">[NTP-KEYGEN] 1826052d159aSCy Schubert</pre></div> 1827052d159aSCy Schubert<p>or by 1828052d159aSCy Schubert</p><div class="example"> 18292b15cb3dSCy Schubert<pre class="example"><?program ntp-keygen> 1830052d159aSCy Schubert</pre></div> 1831052d159aSCy Schubert<p>Do not mix these styles within one configuration file. 1832052d159aSCy Schubert</p> 18332b15cb3dSCy Schubert<p>Compound values and carefully constructed string values may also be 18342b15cb3dSCy Schubertspecified using XML syntax: 1835052d159aSCy Schubert</p><div class="example"> 18362b15cb3dSCy Schubert<pre class="example"><option-name> 18372b15cb3dSCy Schubert <sub-opt>...&lt;...&gt;...</sub-opt> 18382b15cb3dSCy Schubert</option-name> 1839052d159aSCy Schubert</pre></div> 1840052d159aSCy Schubert<p>yielding an <code>option-name.sub-opt</code> string value of 1841052d159aSCy Schubert</p><div class="example"> 1842052d159aSCy Schubert<pre class="example">"...<...>..." 1843052d159aSCy Schubert</pre></div> 18442b15cb3dSCy Schubert<p><code>AutoOpts</code> does not track suboptions. You simply note that it is a 18452b15cb3dSCy Schuberthierarchicly valued option. <code>AutoOpts</code> does provide a means for searching 18462b15cb3dSCy Schubertthe associated name/value pair list (see: optionFindValue). 1847052d159aSCy Schubert</p> 18482b15cb3dSCy Schubert<p>The command line options relating to configuration and/or usage help are: 1849052d159aSCy Schubert</p> 1850a466cc55SCy Schubert<span id="version-_0028_002d_0029"></span><h4 class="subsubheading">version (-)</h4> 18512b15cb3dSCy Schubert 18522b15cb3dSCy Schubert<p>Print the program version to standard out, optionally with licensing 18532b15cb3dSCy Schubertinformation, then exit 0. The optional argument specifies how much licensing 1854a466cc55SCy Schubertdetail to provide. The default is to print just the version. The licensing information may be selected with an option argument. 18552b15cb3dSCy SchubertOnly the first letter of the argument is examined: 1856052d159aSCy Schubert</p> 1857052d159aSCy Schubert<dl compact="compact"> 1858052d159aSCy Schubert<dt>‘<samp>version</samp>’</dt> 1859052d159aSCy Schubert<dd><p>Only print the version. This is the default. 1860052d159aSCy Schubert</p></dd> 1861052d159aSCy Schubert<dt>‘<samp>copyright</samp>’</dt> 1862052d159aSCy Schubert<dd><p>Name the copyright usage licensing terms. 1863052d159aSCy Schubert</p></dd> 1864052d159aSCy Schubert<dt>‘<samp>verbose</samp>’</dt> 1865052d159aSCy Schubert<dd><p>Print the full copyright usage licensing terms. 1866052d159aSCy Schubert</p></dd> 18672b15cb3dSCy Schubert</dl> 18682b15cb3dSCy Schubert 1869052d159aSCy Schubert<hr> 1870a466cc55SCy Schubert<span id="ntp_002dkeygen-exit-status"></span><div class="header"> 1871052d159aSCy Schubert<p> 1872052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-Usage" accesskey="n" rel="next">ntp-keygen Usage</a>, Previous: <a href="#ntp_002dkeygen-config" accesskey="p" rel="prev">ntp-keygen config</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 18732b15cb3dSCy Schubert</div> 1874a466cc55SCy Schubert<span id="ntp_002dkeygen-exit-status-1"></span><h4 class="subsection">1.2.23 ntp-keygen exit status</h4> 18752b15cb3dSCy Schubert 18762b15cb3dSCy Schubert<p>One of the following exit values will be returned: 1877052d159aSCy Schubert</p><dl compact="compact"> 1878052d159aSCy Schubert<dt>‘<samp>0 (EXIT_SUCCESS)</samp>’</dt> 1879052d159aSCy Schubert<dd><p>Successful program execution. 1880052d159aSCy Schubert</p></dd> 1881052d159aSCy Schubert<dt>‘<samp>1 (EXIT_FAILURE)</samp>’</dt> 1882052d159aSCy Schubert<dd><p>The operation failed or the command syntax was not valid. 1883052d159aSCy Schubert</p></dd> 1884052d159aSCy Schubert<dt>‘<samp>66 (EX_NOINPUT)</samp>’</dt> 1885052d159aSCy Schubert<dd><p>A specified configuration file could not be loaded. 1886052d159aSCy Schubert</p></dd> 1887052d159aSCy Schubert<dt>‘<samp>70 (EX_SOFTWARE)</samp>’</dt> 1888052d159aSCy Schubert<dd><p>libopts had an internal operational error. Please report 18892b15cb3dSCy Schubertit to autogen-users@lists.sourceforge.net. Thank you. 1890052d159aSCy Schubert</p></dd> 18912b15cb3dSCy Schubert</dl> 1892052d159aSCy Schubert<hr> 1893a466cc55SCy Schubert<span id="ntp_002dkeygen-Usage"></span><div class="header"> 1894052d159aSCy Schubert<p> 1895052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-Notes" accesskey="n" rel="next">ntp-keygen Notes</a>, Previous: <a href="#ntp_002dkeygen-exit-status" accesskey="p" rel="prev">ntp-keygen exit status</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 18962b15cb3dSCy Schubert</div> 1897a466cc55SCy Schubert<span id="ntp_002dkeygen-Usage-1"></span><h4 class="subsection">1.2.24 ntp-keygen Usage</h4> 1898052d159aSCy Schubert<hr> 1899a466cc55SCy Schubert<span id="ntp_002dkeygen-Notes"></span><div class="header"> 1900052d159aSCy Schubert<p> 1901052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-Bugs" accesskey="n" rel="next">ntp-keygen Bugs</a>, Previous: <a href="#ntp_002dkeygen-Usage" accesskey="p" rel="prev">ntp-keygen Usage</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 19022b15cb3dSCy Schubert</div> 1903a466cc55SCy Schubert<span id="ntp_002dkeygen-Notes-1"></span><h4 class="subsection">1.2.25 ntp-keygen Notes</h4> 1904052d159aSCy Schubert<hr> 1905a466cc55SCy Schubert<span id="ntp_002dkeygen-Bugs"></span><div class="header"> 1906052d159aSCy Schubert<p> 1907052d159aSCy SchubertPrevious: <a href="#ntp_002dkeygen-Notes" accesskey="p" rel="prev">ntp-keygen Notes</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 19082b15cb3dSCy Schubert</div> 1909a466cc55SCy Schubert<span id="ntp_002dkeygen-Bugs-1"></span><h4 class="subsection">1.2.26 ntp-keygen Bugs</h4> 19102b15cb3dSCy Schubert 1911052d159aSCy Schubert<hr> 1912a466cc55SCy Schubert<span id="Random-Seed-File"></span><div class="header"> 1913052d159aSCy Schubert<p> 1914052d159aSCy SchubertNext: <a href="#Cryptographic-Data-Files" accesskey="n" rel="next">Cryptographic Data Files</a>, Previous: <a href="#Running-the-Program" accesskey="p" rel="prev">Running the Program</a>, Up: <a href="#Top" accesskey="u" rel="up">Top</a> </p> 19152b15cb3dSCy Schubert</div> 1916a466cc55SCy Schubert<span id="Random-Seed-File-2"></span><h3 class="section">1.3 Random Seed File</h3> 19172b15cb3dSCy Schubert 19182b15cb3dSCy Schubert<p>All cryptographically sound key generation schemes must have means to 19192b15cb3dSCy Schubertrandomize the entropy seed used to initialize the internal 19202b15cb3dSCy Schubertpseudo-random number generator used by the OpenSSL library routines. 19212b15cb3dSCy SchubertIf a site supports ssh, it is very likely that means to do this are 19222b15cb3dSCy Schubertalready available. 19232b15cb3dSCy SchubertThe entropy seed used by the OpenSSL library is contained in a file, 19242b15cb3dSCy Schubertusually called <code>.rnd</code>, which must be available when 19252b15cb3dSCy Schubertstarting the <code>ntp-keygen</code> program or <code>ntpd</code> daemon. 1926052d159aSCy Schubert</p> 19272b15cb3dSCy Schubert<p>The OpenSSL library looks for the file using the path specified by the 19282b15cb3dSCy Schubert<code>RANDFILE</code> environment variable in the user home directory, whether root 19292b15cb3dSCy Schubertor some other user. 19302b15cb3dSCy SchubertIf the <code>RANDFILE</code> environment variable is not 19312b15cb3dSCy Schubertpresent, the library looks for the <code>.rnd</code> file in the user home 19322b15cb3dSCy Schubertdirectory. 19332b15cb3dSCy SchubertSince both the <code>ntp-keygen</code> program and <code>ntpd</code> daemon must run 19342b15cb3dSCy Schubertas root, the logical place to put this file is in <code>/.rnd</code> or 19352b15cb3dSCy Schubert<code>/root/.rnd</code>. 19362b15cb3dSCy SchubertIf the file is not available or cannot be written, the program exits 19372b15cb3dSCy Schubertwith a message to the system log. 1938052d159aSCy Schubert</p> 1939052d159aSCy Schubert<hr> 1940a466cc55SCy Schubert<span id="Cryptographic-Data-Files"></span><div class="header"> 1941052d159aSCy Schubert<p> 1942052d159aSCy SchubertPrevious: <a href="#Random-Seed-File" accesskey="p" rel="prev">Random Seed File</a>, Up: <a href="#Top" accesskey="u" rel="up">Top</a> </p> 19432b15cb3dSCy Schubert</div> 1944a466cc55SCy Schubert<span id="Cryptographic-Data-Files-2"></span><h3 class="section">1.4 Cryptographic Data Files</h3> 19452b15cb3dSCy Schubert 19462b15cb3dSCy Schubert<p>File and link names are in the <code>form ntpkey_key_name.fstamp</code>, 19472b15cb3dSCy Schubertwhere <code>key</code> is the key or parameter type, 19482b15cb3dSCy Schubert<code>name</code> is the host or group name and 19492b15cb3dSCy Schubert<code>fstamp</code> is the filestamp (NTP seconds) when the file was created). 19502b15cb3dSCy SchubertBy convention, key names in generated file names include both upper and 19512b15cb3dSCy Schubertlower case characters, while key names in generated link names include 19522b15cb3dSCy Schubertonly lower case characters. The filestamp is not used in generated link 19532b15cb3dSCy Schubertnames. 1954052d159aSCy Schubert</p> 19552b15cb3dSCy Schubert<p>The key name is a string defining the cryptographic key type. 19562b15cb3dSCy SchubertKey types include public/private keys host and sign, certificate cert 19572b15cb3dSCy Schubertand several challenge/response key types. 19582b15cb3dSCy SchubertBy convention, client files used for 19592b15cb3dSCy Schubertchallenges have a par subtype, as in the IFF challenge IFFpar, while 19602b15cb3dSCy Schubertserver files for responses have a key subtype, as in the GQ response 19612b15cb3dSCy SchubertGQkey. 1962052d159aSCy Schubert</p> 19632b15cb3dSCy Schubert<p>All files begin with two nonencrypted lines. The first line contains 19642b15cb3dSCy Schubertthe file name in the format <code>ntpkey_key_host.fstamp</code>. 19652b15cb3dSCy SchubertThe second line contains the datestamp in conventional Unix date format. 19662b15cb3dSCy SchubertLines beginning with <code>#</code> are ignored. 1967052d159aSCy Schubert</p> 19682b15cb3dSCy Schubert<p>The remainder of the file contains cryptographic data encoded first 19692b15cb3dSCy Schubertusing ASN.1 rules, then encrypted using the DES-CBC algorithm with 19702b15cb3dSCy Schubertgiven password and finally written in PEM-encoded printable ASCII text 19712b15cb3dSCy Schubertpreceded and followed by MIME content identifier lines. 1972052d159aSCy Schubert</p> 19732b15cb3dSCy Schubert<p>The format of the symmetric keys file, ordinarily named <code>ntp.keys</code>, 19742b15cb3dSCy Schubertis somewhat different than the other files in the interest of backward 19752b15cb3dSCy Schubertcompatibility. 19762b15cb3dSCy SchubertOrdinarily, the file is generated by this program, but 19772b15cb3dSCy Schubertit can be constructed and edited using an ordinary text editor. 1978052d159aSCy Schubert</p> 1979052d159aSCy Schubert<div class="example"> 19802b15cb3dSCy Schubert<pre class="example"># ntpkey_MD5key_hms.local.3564038757 19812b15cb3dSCy Schubert# Sun Dec 9 02:45:57 2012 19822b15cb3dSCy Schubert 1983052d159aSCy Schubert 1 MD5 "]!ghT%O;3)WJ,/Nc:>I # MD5 key 19842b15cb3dSCy Schubert 2 MD5 lu+H^tF46BKR-6~pV_5 # MD5 key 19852b15cb3dSCy Schubert 3 MD5 :lnoVsE%Yz*avh%EtNC # MD5 key 1986052d159aSCy Schubert 4 MD5 |fdZrf0sF~;w-i^V # MD5 key 1987052d159aSCy Schubert 5 MD5 IyAG>O"y"LmCRS!*bHC # MD5 key 1988052d159aSCy Schubert 6 MD5 ">e\A>hT/661ri52,,H # MD5 key 19892b15cb3dSCy Schubert 7 MD5 c9x=M'CfLxax9v)PV-si # MD5 key 19902b15cb3dSCy Schubert 8 MD5 E|=jvFVov?Bn|Ev=&aK\ # MD5 key 19912b15cb3dSCy Schubert 9 MD5 T!c4UT&`(m$+m+B6,`Q0 # MD5 key 19922b15cb3dSCy Schubert10 MD5 JVF/1=)=IFbHbJQz..Cd # MD5 key 19932b15cb3dSCy Schubert11 SHA1 6dea311109529e436c2b4fccae9bc753c16d1b48 # SHA1 key 19942b15cb3dSCy Schubert12 SHA1 7076f373d86c4848c59ff8046e49cb7d614ec394 # SHA1 key 19952b15cb3dSCy Schubert13 SHA1 5f48b1b60591eb01b7cf1d33b7774f08d20262d3 # SHA1 key 19962b15cb3dSCy Schubert14 SHA1 eed5ab9d9497319ec60cf3781d52607e76720178 # SHA1 key 19972b15cb3dSCy Schubert15 SHA1 f283562611a04c964da8126296f5f8e58c3f85de # SHA1 key 19982b15cb3dSCy Schubert16 SHA1 1930da171297dd63549af50b29449de17dcf341f # SHA1 key 19992b15cb3dSCy Schubert17 SHA1 fee892110358cd4382322b889869e750db8e8a8f # SHA1 key 20002b15cb3dSCy Schubert18 SHA1 b5520c9fadd7ad3fd8bfa061c8821b65d029bb37 # SHA1 key 20012b15cb3dSCy Schubert19 SHA1 8c74fb440ec80f453ec6aaa62b9baed0ab723b92 # SHA1 key 20022b15cb3dSCy Schubert20 SHA1 6bc05f734306a189326000970c19b3910f403795 # SHA1 key 2003052d159aSCy Schubert</pre></div> 20042b15cb3dSCy Schubert 2005052d159aSCy Schubert<p>Figure 1. Typical Symmetric Key File 2006052d159aSCy Schubert</p> 20072b15cb3dSCy Schubert<p>Figure 1 shows a typical symmetric keys file used by the reference 20082b15cb3dSCy Schubertimplementation. 20092b15cb3dSCy SchubertEach line of the file contains three fields, first an 20104e1ef62aSXin LIinteger between 1 and 65535, inclusive, representing the key identifier 20112b15cb3dSCy Schubertused in the server and peer configuration commands. 20122b15cb3dSCy SchubertNext is the key type for the message digest algorithm, 20132b15cb3dSCy Schubertwhich in the absence of the 20142b15cb3dSCy SchubertOpenSSL library must be MD5 to designate the MD5 message digest 20152b15cb3dSCy Schubertalgorithm. 20162b15cb3dSCy SchubertIf the OpenSSL library is installed, the key type can be any 20172b15cb3dSCy Schubertmessage digest algorithm supported by that library. 20182b15cb3dSCy SchubertHowever, if 20192b15cb3dSCy Schubertcompatibility with FIPS 140-2 is required, the key type must be either 20202b15cb3dSCy SchubertSHA or SHA1. 20212b15cb3dSCy SchubertThe key type can be changed using an ASCII text editor. 2022052d159aSCy Schubert</p> 20232b15cb3dSCy Schubert<p>An MD5 key consists of a printable ASCII string less than or equal to 20242b15cb3dSCy Schubert16 characters and terminated by whitespace or a # character. 20252b15cb3dSCy SchubertAn OpenSSL 20262b15cb3dSCy Schubertkey consists of a hex-encoded ASCII string of 40 characters, which is 20272b15cb3dSCy Schuberttruncated as necessary. 2028052d159aSCy Schubert</p> 20292b15cb3dSCy Schubert<p>Note that the keys used by the <code>ntpq</code> and <code>ntpdc</code> programs are 20302b15cb3dSCy Schubertchecked against passwords requested by the programs and entered by hand, 20312b15cb3dSCy Schubertso it 20322b15cb3dSCy Schubertis generally appropriate to specify these keys in human readable ASCII 20332b15cb3dSCy Schubertformat. 2034052d159aSCy Schubert</p> 20352b15cb3dSCy Schubert<p>The <code>ntp-keygen</code> program generates a MD5 symmetric keys file 20362b15cb3dSCy Schubert<code>ntpkey_MD5key_hostname.filestamp</code>. 20372b15cb3dSCy SchubertSince the file contains private 20382b15cb3dSCy Schubertshared keys, it should be visible only to root and distributed by 20392b15cb3dSCy Schubertsecure means to other subnet hosts. 20402b15cb3dSCy SchubertThe NTP daemon loads the file <code>ntp.keys</code>, so <code>ntp-keygen</code> 20412b15cb3dSCy Schubertinstalls a soft link from this name to the generated file. 20422b15cb3dSCy SchubertSubsequently, similar soft links must be installed by 20432b15cb3dSCy Schubertmanual or automated means on the other subnet hosts. 20442b15cb3dSCy SchubertWhile this file is 20452b15cb3dSCy Schubertnot used with the Autokey Version 2 protocol, it is needed to 20462b15cb3dSCy Schubertauthenticate some remote configuration commands used by the <code>ntpq</code> and 20472b15cb3dSCy Schubert<code>ntpdc</code> utilities. 2048052d159aSCy Schubert</p><hr> 20492b15cb3dSCy Schubert 20502b15cb3dSCy Schubert 2051052d159aSCy Schubert 2052052d159aSCy Schubert</body> 2053052d159aSCy Schubert</html> 2054