xref: /freebsd/contrib/ntp/util/ntp-keygen.html (revision 052d159a8b83f03d7dc5eb31cd9a9b4a6fe3d9da)
1*052d159aSCy Schubert<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
2*052d159aSCy Schubert<html>
3*052d159aSCy Schubert<!-- Created by GNU Texinfo 6.5, http://www.gnu.org/software/texinfo/ -->
42b15cb3dSCy Schubert<head>
5*052d159aSCy Schubert<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
6*052d159aSCy Schubert<title>Ntp-keygen User&rsquo;s Manual</title>
7*052d159aSCy Schubert
8*052d159aSCy Schubert<meta name="description" content="Ntp-keygen User&rsquo;s Manual">
9*052d159aSCy Schubert<meta name="keywords" content="Ntp-keygen User&rsquo;s Manual">
10*052d159aSCy Schubert<meta name="resource-type" content="document">
11*052d159aSCy Schubert<meta name="distribution" content="global">
12*052d159aSCy Schubert<meta name="Generator" content="makeinfo">
13*052d159aSCy Schubert<link href="#Top" rel="start" title="Top">
14*052d159aSCy Schubert<link href="dir.html#Top" rel="up" title="(dir)">
15*052d159aSCy Schubert<style type="text/css">
16*052d159aSCy Schubert<!--
17*052d159aSCy Schuberta.summary-letter {text-decoration: none}
18*052d159aSCy Schubertblockquote.indentedblock {margin-right: 0em}
19*052d159aSCy Schubertblockquote.smallindentedblock {margin-right: 0em; font-size: smaller}
20*052d159aSCy Schubertblockquote.smallquotation {font-size: smaller}
21*052d159aSCy Schubertdiv.display {margin-left: 3.2em}
22*052d159aSCy Schubertdiv.example {margin-left: 3.2em}
23*052d159aSCy Schubertdiv.lisp {margin-left: 3.2em}
24*052d159aSCy Schubertdiv.smalldisplay {margin-left: 3.2em}
25*052d159aSCy Schubertdiv.smallexample {margin-left: 3.2em}
26*052d159aSCy Schubertdiv.smalllisp {margin-left: 3.2em}
27*052d159aSCy Schubertkbd {font-style: oblique}
282b15cb3dSCy Schubertpre.display {font-family: inherit}
292b15cb3dSCy Schubertpre.format {font-family: inherit}
30*052d159aSCy Schubertpre.menu-comment {font-family: serif}
31*052d159aSCy Schubertpre.menu-preformatted {font-family: serif}
322b15cb3dSCy Schubertpre.smalldisplay {font-family: inherit; font-size: smaller}
332b15cb3dSCy Schubertpre.smallexample {font-size: smaller}
34*052d159aSCy Schubertpre.smallformat {font-family: inherit; font-size: smaller}
352b15cb3dSCy Schubertpre.smalllisp {font-size: smaller}
36*052d159aSCy Schubertspan.nolinebreak {white-space: nowrap}
37*052d159aSCy Schubertspan.roman {font-family: initial; font-weight: normal}
38*052d159aSCy Schubertspan.sansserif {font-family: sans-serif; font-weight: normal}
39*052d159aSCy Schubertul.no-bullet {list-style: none}
40*052d159aSCy Schubert-->
41*052d159aSCy Schubert</style>
42*052d159aSCy Schubert
43*052d159aSCy Schubert
442b15cb3dSCy Schubert</head>
45*052d159aSCy Schubert
46*052d159aSCy Schubert<body lang="en">
47*052d159aSCy Schubert<h1 class="settitle" align="center">Ntp-keygen User&rsquo;s Manual</h1>
48*052d159aSCy Schubert
49*052d159aSCy Schubert
50*052d159aSCy Schubert
51*052d159aSCy Schubert
52*052d159aSCy Schubert
53*052d159aSCy Schubert<a name="SEC_Overview"></a>
54*052d159aSCy Schubert<h2 class="shortcontents-heading">Short Table of Contents</h2>
55*052d159aSCy Schubert
562b15cb3dSCy Schubert<div class="shortcontents">
57*052d159aSCy Schubert<ul class="no-bullet">
58*052d159aSCy Schubert<li><a name="stoc-Description-1" href="#toc-Description-1">1 Description</a></li>
592b15cb3dSCy Schubert</ul>
602b15cb3dSCy Schubert</div>
612b15cb3dSCy Schubert
622b15cb3dSCy Schubert
63*052d159aSCy Schubert<table class="menu" border="0" cellspacing="0">
64*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#Description" accesskey="1">Description</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
65*052d159aSCy Schubert</td></tr>
66*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-Invocation" accesskey="2">ntp-keygen Invocation</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">Invoking ntp-keygen
67*052d159aSCy Schubert</td></tr>
68*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#Running-the-Program" accesskey="3">Running the Program</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
69*052d159aSCy Schubert</td></tr>
70*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#Random-Seed-File" accesskey="4">Random Seed File</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
71*052d159aSCy Schubert</td></tr>
72*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#Cryptographic-Data-Files" accesskey="5">Cryptographic Data Files</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
73*052d159aSCy Schubert</td></tr>
74*052d159aSCy Schubert</table>
752b15cb3dSCy Schubert
76*052d159aSCy Schubert<a name="Top"></a>
77*052d159aSCy Schubert<div class="header">
78*052d159aSCy Schubert<p>
79*052d159aSCy SchubertNext: <a href="#Description" accesskey="n" rel="next">Description</a>, Previous: <a href="dir.html#Top" accesskey="p" rel="prev">(dir)</a>, Up: <a href="dir.html#Top" accesskey="u" rel="up">(dir)</a> &nbsp; </p>
802b15cb3dSCy Schubert</div>
81*052d159aSCy Schubert<a name="NTP-Key-Generation-Program-User-Manual"></a>
82*052d159aSCy Schubert<h1 class="top">NTP Key Generation Program User Manual</h1>
832b15cb3dSCy Schubert
84*052d159aSCy Schubert<p>This document describes the use of the NTP Project&rsquo;s <code>ntp-keygen</code>
852b15cb3dSCy Schubertprogram, that generates cryptographic data files used by the NTPv4
862b15cb3dSCy Schubertauthentication and identity schemes.
872b15cb3dSCy SchubertIt can generate message digest keys used in symmetric key cryptography and,
882b15cb3dSCy Schubertif the OpenSSL software
892b15cb3dSCy Schubertlibrary has been installed, it can generate host keys, sign keys,
902b15cb3dSCy Schubertcertificates, and identity keys and parameters used by the Autokey
912b15cb3dSCy Schubertpublic key cryptography.
922b15cb3dSCy SchubertThe message digest keys file is generated in a
932b15cb3dSCy Schubertformat compatible with NTPv3.
942b15cb3dSCy SchubertAll other files are in PEM-encoded
952b15cb3dSCy Schubertprintable ASCII format so they can be embedded as MIME attachments in
962b15cb3dSCy Schubertmail to other sites.
97*052d159aSCy Schubert</p>
98*052d159aSCy Schubert<p>This document applies to version 4.2.8p13 of <code>ntp-keygen</code>.
99*052d159aSCy Schubert</p>
100*052d159aSCy Schubert<table class="menu" border="0" cellspacing="0">
101*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#Description" accesskey="1">Description</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
102*052d159aSCy Schubert</td></tr>
103*052d159aSCy Schubert</table>
1042b15cb3dSCy Schubert
105*052d159aSCy Schubert<hr>
106*052d159aSCy Schubert<a name="Description"></a>
107*052d159aSCy Schubert<div class="header">
108*052d159aSCy Schubert<p>
109*052d159aSCy SchubertNext: <a href="#Running-the-Program" accesskey="n" rel="next">Running the Program</a>, Previous: <a href="#Top" accesskey="p" rel="prev">Top</a>, Up: <a href="#Top" accesskey="u" rel="up">Top</a> &nbsp; </p>
1102b15cb3dSCy Schubert</div>
111*052d159aSCy Schubert<a name="Description-1"></a>
112*052d159aSCy Schubert<h2 class="chapter">1 Description</h2>
1132b15cb3dSCy Schubert
1142b15cb3dSCy Schubert<p>This program generates cryptographic data files used by the NTPv4
1152b15cb3dSCy Schubertauthentication and identity schemes. It can generate message digest
1162b15cb3dSCy Schubertkeys used in symmetric key cryptography and, if the OpenSSL software
1172b15cb3dSCy Schubertlibrary has been installed, it can generate host keys, sign keys,
1182b15cb3dSCy Schubertcertificates, and identity keys and parameters used by the Autokey
1192b15cb3dSCy Schubertpublic key cryptography. The message digest keys file is generated in a
1202b15cb3dSCy Schubertformat compatible with NTPv3. All other files are in PEM-encoded
1212b15cb3dSCy Schubertprintable ASCII format so they can be embedded as MIME attachments in
1222b15cb3dSCy Schubertmail to other sites.
123*052d159aSCy Schubert</p>
1242b15cb3dSCy Schubert<p>When used to generate message digest keys, the program produces a file
1252b15cb3dSCy Schubertcontaining ten pseudo-random printable ASCII strings suitable for the
1262b15cb3dSCy SchubertMD5 message digest algorithm included in the distribution.
1272b15cb3dSCy SchubertIf the
1282b15cb3dSCy SchubertOpenSSL library is installed, it produces an additional ten hex-encoded
1292b15cb3dSCy Schubertrandom bit strings suitable for the SHA1 and other message digest
1302b15cb3dSCy Schubertalgorithms.
1312b15cb3dSCy SchubertThe message digest keys file must be distributed and stored
1322b15cb3dSCy Schubertusing secure means beyond the scope of NTP itself.
1332b15cb3dSCy SchubertBesides the keys
1342b15cb3dSCy Schubertused for ordinary NTP associations, additional keys can be defined as
1352b15cb3dSCy Schubertpasswords for the ntpq and ntpdc utility programs.
136*052d159aSCy Schubert</p>
1372b15cb3dSCy Schubert<p>The remaining generated files are compatible with other OpenSSL
1382b15cb3dSCy Schubertapplications and other Public Key Infrastructure (PKI) resources.
1392b15cb3dSCy SchubertCertificates generated by this program are compatible with extant
1402b15cb3dSCy Schubertindustry practice, although some users might find the interpretation of
1412b15cb3dSCy SchubertX509v3 extension fields somewhat liberal.
1422b15cb3dSCy SchubertHowever, the identity keys
1432b15cb3dSCy Schubertare probably not compatible with anything other than Autokey.
144*052d159aSCy Schubert</p>
1452b15cb3dSCy Schubert<p>Some files used by this program are encrypted using a private password.
1462b15cb3dSCy SchubertThe <code>-p</code> option specifies the password for local encrypted files and the
1472b15cb3dSCy Schubert<code>-q</code> option the password for encrypted files sent to remote sites.
1482b15cb3dSCy SchubertIf no password is specified, the host name returned by the Unix
1492b15cb3dSCy Schubert<code>gethostname()</code> function, normally the DNS name of the host, is used.
150*052d159aSCy Schubert</p>
1512b15cb3dSCy Schubert<p>The <kbd>pw</kbd> option of the <code>crypto</code> configuration command
1522b15cb3dSCy Schubertspecifies the read password for previously encrypted local files.
1532b15cb3dSCy SchubertThis must match the local password used by this program.
1542b15cb3dSCy SchubertIf not specified, the host name is used.
1552b15cb3dSCy SchubertThus, if files are generated by this program without password,
1562b15cb3dSCy Schubertthey can be read back by ntpd without password, but only on the same
1572b15cb3dSCy Schuberthost.
158*052d159aSCy Schubert</p>
1592b15cb3dSCy Schubert<p>Normally, encrypted files for each host are generated by that host and
1602b15cb3dSCy Schubertused only by that host, although exceptions exist as noted later on
1612b15cb3dSCy Schubertthis page.
1622b15cb3dSCy SchubertThe symmetric keys file, normally called <code>ntp.keys</code>, is
1632b15cb3dSCy Schubertusually installed in <code>/etc</code>.
1642b15cb3dSCy SchubertOther files and links are usually installed
1652b15cb3dSCy Schubertin <code>/usr/local/etc</code>, which is normally in a shared filesystem in
1662b15cb3dSCy SchubertNFS-mounted networks and cannot be changed by shared clients.
1672b15cb3dSCy SchubertThe location of the keys directory can be changed by the keysdir
1682b15cb3dSCy Schubertconfiguration command in such cases.
1692b15cb3dSCy SchubertNormally, this is in <code>/etc</code>.
170*052d159aSCy Schubert</p>
1712b15cb3dSCy Schubert<p>This program directs commentary and error messages to the standard
1722b15cb3dSCy Schuberterror stream <code>stderr</code> and remote files to the standard output stream
1732b15cb3dSCy Schubert<code>stdout</code> where they can be piped to other applications or redirected to
1742b15cb3dSCy Schubertfiles.
1752b15cb3dSCy SchubertThe names used for generated files and links all begin with the
1762b15cb3dSCy Schubertstring <code>ntpkey</code> and include the file type,
1772b15cb3dSCy Schubertgenerating host and filestamp,
1782b15cb3dSCy Schubertas described in the <a href="#Cryptographic-Data-Files">Cryptographic Data Files</a> section below.
179*052d159aSCy Schubert</p>
180*052d159aSCy Schubert<table class="menu" border="0" cellspacing="0">
181*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#Running-the-Program" accesskey="1">Running the Program</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
182*052d159aSCy Schubert</td></tr>
183*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-Invocation" accesskey="2">ntp-keygen Invocation</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
184*052d159aSCy Schubert</td></tr>
185*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#Random-Seed-File" accesskey="3">Random Seed File</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
186*052d159aSCy Schubert</td></tr>
187*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#Cryptographic-Data-Files" accesskey="4">Cryptographic Data Files</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
188*052d159aSCy Schubert</td></tr>
189*052d159aSCy Schubert</table>
1902b15cb3dSCy Schubert
191*052d159aSCy Schubert<hr>
192*052d159aSCy Schubert<a name="Running-the-Program"></a>
193*052d159aSCy Schubert<div class="header">
194*052d159aSCy Schubert<p>
195*052d159aSCy SchubertNext: <a href="#Random-Seed-File" accesskey="n" rel="next">Random Seed File</a>, Previous: <a href="#Description" accesskey="p" rel="prev">Description</a>, Up: <a href="#Top" accesskey="u" rel="up">Top</a> &nbsp; </p>
1962b15cb3dSCy Schubert</div>
197*052d159aSCy Schubert<a name="Running-the-Program-1"></a>
198*052d159aSCy Schubert<h3 class="section">1.1 Running the Program</h3>
1992b15cb3dSCy Schubert
2002b15cb3dSCy Schubert<p>To test and gain experience with Autokey concepts, log in as root and
2012b15cb3dSCy Schubertchange to the keys directory, usually <code>/usr/local/etc</code>.
2022b15cb3dSCy SchubertWhen run for the
2032b15cb3dSCy Schubertfirst time, or if all files with names beginning <code>ntpkey</code>] have been
2042b15cb3dSCy Schubertremoved, use the <code>ntp-keygen</code> command without arguments to generate a
2052b15cb3dSCy Schubertdefault RSA host key and matching RSA-MD5 certificate with expiration
2062b15cb3dSCy Schubertdate one year hence.
2072b15cb3dSCy SchubertIf run again without options, the program uses the
2082b15cb3dSCy Schubertexisting keys and parameters and generates only a new certificate with
2092b15cb3dSCy Schubertnew expiration date one year hence.
210*052d159aSCy Schubert</p>
2112b15cb3dSCy Schubert<p>Run the command on as many hosts as necessary.
2122b15cb3dSCy SchubertDesignate one of them as the trusted host (TH) using <code>ntp-keygen</code>
2132b15cb3dSCy Schubertwith the <code>-T</code> option and configure
2142b15cb3dSCy Schubertit to synchronize from reliable Internet servers.
2152b15cb3dSCy SchubertThen configure the other hosts to synchronize to the TH directly or indirectly.
2162b15cb3dSCy SchubertA certificate trail is created when Autokey asks the immediately
2172b15cb3dSCy Schubertascendant host towards the TH to sign its certificate, which is then
2182b15cb3dSCy Schubertprovided to the immediately descendant host on request.
2192b15cb3dSCy SchubertAll group hosts should have acyclic certificate trails ending on the TH.
220*052d159aSCy Schubert</p>
2212b15cb3dSCy Schubert<p>The host key is used to encrypt the cookie when required and so must be
2222b15cb3dSCy SchubertRSA type.
2232b15cb3dSCy SchubertBy default, the host key is also the sign key used to encrypt signatures.
2242b15cb3dSCy SchubertA different sign key can be assigned using the <code>-S</code> option
2252b15cb3dSCy Schubertand this can be either RSA or DSA type.
2262b15cb3dSCy SchubertBy default, the signature
2272b15cb3dSCy Schubertmessage digest type is MD5, but any combination of sign key type and
2282b15cb3dSCy Schubertmessage digest type supported by the OpenSSL library can be specified
2292b15cb3dSCy Schubertusing the <code>-c</code> option.
230*052d159aSCy Schubert</p>
2312b15cb3dSCy Schubert<p>The rules say cryptographic media should be generated with proventic
2322b15cb3dSCy Schubertfilestamps, which means the host should already be synchronized before
2332b15cb3dSCy Schubertthis program is run.
2342b15cb3dSCy SchubertThis of course creates a chicken-and-egg problem
2352b15cb3dSCy Schubertwhen the host is started for the first time.
2362b15cb3dSCy SchubertAccordingly, the host time
2372b15cb3dSCy Schubertshould be set by some other means, such as eyeball-and-wristwatch, at
2382b15cb3dSCy Schubertleast so that the certificate lifetime is within the current year.
2392b15cb3dSCy SchubertAfter that and when the host is synchronized to a proventic source, the
2402b15cb3dSCy Schubertcertificate should be re-generated.
241*052d159aSCy Schubert</p>
2422b15cb3dSCy Schubert<p>Additional information on trusted groups and identity schemes is on the
2432b15cb3dSCy SchubertAutokey Public-Key Authentication page.
244*052d159aSCy Schubert</p>
245*052d159aSCy Schubert<hr>
2462b15cb3dSCy Schubert<a name="ntp_002dkeygen-Invocation"></a>
247*052d159aSCy Schubert<div class="header">
248*052d159aSCy Schubert<p>
249*052d159aSCy SchubertNext: <a href="#Random-Seed-File" accesskey="n" rel="next">Random Seed File</a>, Previous: <a href="#Running-the-Program" accesskey="p" rel="prev">Running the Program</a>, Up: <a href="#Description" accesskey="u" rel="up">Description</a> &nbsp; </p>
2502b15cb3dSCy Schubert</div>
251*052d159aSCy Schubert<a name="Invoking-ntp_002dkeygen"></a>
252*052d159aSCy Schubert<h3 class="section">1.2 Invoking ntp-keygen</h3>
253*052d159aSCy Schubert<a name="index-ntp_002dkeygen"></a>
254*052d159aSCy Schubert<a name="index-Create-a-NTP-host-key"></a>
2552b15cb3dSCy Schubert
2562b15cb3dSCy Schubert
2572b15cb3dSCy Schubert
2582b15cb3dSCy Schubert<p>This program generates cryptographic data files used by the NTPv4
2592b15cb3dSCy Schubertauthentication and identification schemes.
26009100258SXin LIIt can generate message digest keys used in symmetric key cryptography and,
26109100258SXin LIif the OpenSSL software library has been installed, it can generate host keys,
26209100258SXin LIsigning keys, certificates, and identity keys and parameters used in Autokey
26309100258SXin LIpublic key cryptography.
2642b15cb3dSCy SchubertThese files are used for cookie encryption,
26509100258SXin LIdigital signature, and challenge/response identification algorithms
2662b15cb3dSCy Schubertcompatible with the Internet standard security infrastructure.
267*052d159aSCy Schubert</p>
26809100258SXin LI<p>The message digest symmetric keys file is generated in a format
26909100258SXin LIcompatible with NTPv3.
27009100258SXin LIAll other files are in PEM-encoded printable ASCII format,
27109100258SXin LIso they can be embedded as MIME attachments in email to other sites
2722b15cb3dSCy Schubertand certificate authorities.
2732b15cb3dSCy SchubertBy default, files are not encrypted.
274*052d159aSCy Schubert</p>
27509100258SXin LI<p>When used to generate message digest symmetric keys, the program
27609100258SXin LIproduces a file containing ten pseudo-random printable ASCII strings
27709100258SXin LIsuitable for the MD5 message digest algorithm included in the
27809100258SXin LIdistribution.
2792b15cb3dSCy SchubertIf the OpenSSL library is installed, it produces an additional ten
28009100258SXin LIhex-encoded random bit strings suitable for SHA1, AES-128-CMAC, and
28109100258SXin LIother message digest algorithms.
28209100258SXin LIThe message digest symmetric keys file must be distributed and stored
2832b15cb3dSCy Schubertusing secure means beyond the scope of NTP itself.
2842b15cb3dSCy SchubertBesides the keys used for ordinary NTP associations, additional keys
2852b15cb3dSCy Schubertcan be defined as passwords for the
2862b15cb3dSCy Schubert<code>ntpq(1ntpqmdoc)</code>
2872b15cb3dSCy Schubertand
2882b15cb3dSCy Schubert<code>ntpdc(1ntpdcmdoc)</code>
2892b15cb3dSCy Schubertutility programs.
290*052d159aSCy Schubert</p>
2912b15cb3dSCy Schubert<p>The remaining generated files are compatible with other OpenSSL
2922b15cb3dSCy Schubertapplications and other Public Key Infrastructure (PKI) resources.
2932b15cb3dSCy SchubertCertificates generated by this program are compatible with extant
2942b15cb3dSCy Schubertindustry practice, although some users might find the interpretation of
2952b15cb3dSCy SchubertX509v3 extension fields somewhat liberal.
2962b15cb3dSCy SchubertHowever, the identity keys are probably not compatible with anything
2972b15cb3dSCy Schubertother than Autokey.
298*052d159aSCy Schubert</p>
2992b15cb3dSCy Schubert<p>Some files used by this program are encrypted using a private password.
3002b15cb3dSCy SchubertThe
3012b15cb3dSCy Schubert<code>-p</code>
30209100258SXin LIoption specifies the read password for local encrypted files and the
3032b15cb3dSCy Schubert<code>-q</code>
30409100258SXin LIoption the write password for encrypted files sent to remote sites.
3052b15cb3dSCy SchubertIf no password is specified, the host name returned by the Unix
30609100258SXin LI<code>hostname(1)</code>
30709100258SXin LIcommand, normally the DNS name of the host, is used as the the default read
30809100258SXin LIpassword, for convenience.
30909100258SXin LIThe
31009100258SXin LI<code>ntp-keygen</code>
31109100258SXin LIprogram prompts for the password if it reads an encrypted file
31209100258SXin LIand the password is missing or incorrect.
31309100258SXin LIIf an encrypted file is read successfully and
31409100258SXin LIno write password is specified, the read password is used
31509100258SXin LIas the write password by default.
316*052d159aSCy Schubert</p>
3172b15cb3dSCy Schubert<p>The
31809100258SXin LI<code>pw</code>
3192b15cb3dSCy Schubertoption of the
32009100258SXin LI<code>crypto</code>
32109100258SXin LI<code>ntpd(1ntpdmdoc)</code>
3222b15cb3dSCy Schubertconfiguration command specifies the read
3232b15cb3dSCy Schubertpassword for previously encrypted local files.
32409100258SXin LIThis must match the local read password used by this program.
3252b15cb3dSCy SchubertIf not specified, the host name is used.
32609100258SXin LIThus, if files are generated by this program without an explicit password,
3272b15cb3dSCy Schubertthey can be read back by
32809100258SXin LI<code>ntpd(1ntpdmdoc)</code>
32909100258SXin LIwithout specifying an explicit password but only on the same host.
33009100258SXin LIIf the write password used for encryption is specified as the host name,
33109100258SXin LIthese files can be read by that host with no explicit password.
332*052d159aSCy Schubert</p>
3332b15cb3dSCy Schubert<p>Normally, encrypted files for each host are generated by that host and
3342b15cb3dSCy Schubertused only by that host, although exceptions exist as noted later on
3352b15cb3dSCy Schubertthis page.
3362b15cb3dSCy SchubertThe symmetric keys file, normally called
337*052d159aSCy Schubert<samp>ntp.keys</samp>,
3382b15cb3dSCy Schubertis usually installed in
339*052d159aSCy Schubert<samp>/etc</samp>.
3402b15cb3dSCy SchubertOther files and links are usually installed in
341*052d159aSCy Schubert<samp>/usr/local/etc</samp>,
3422b15cb3dSCy Schubertwhich is normally in a shared filesystem in
3432b15cb3dSCy SchubertNFS-mounted networks and cannot be changed by shared clients.
34409100258SXin LIIn these cases, NFS clients can specify the files in another
34509100258SXin LIdirectory such as
346*052d159aSCy Schubert<samp>/etc</samp>
34709100258SXin LIusing the
34809100258SXin LI<code>keysdir</code>
34909100258SXin LI<code>ntpd(1ntpdmdoc)</code>
35009100258SXin LIconfiguration file command.
351*052d159aSCy Schubert</p>
3522b15cb3dSCy Schubert<p>This program directs commentary and error messages to the standard
3532b15cb3dSCy Schuberterror stream
354*052d159aSCy Schubert<samp>stderr</samp>
3552b15cb3dSCy Schubertand remote files to the standard output stream
356*052d159aSCy Schubert<samp>stdout</samp>
3572b15cb3dSCy Schubertwhere they can be piped to other applications or redirected to files.
3582b15cb3dSCy SchubertThe names used for generated files and links all begin with the
3592b15cb3dSCy Schubertstring
360*052d159aSCy Schubert<samp>ntpkey*</samp>
3612b15cb3dSCy Schubertand include the file type, generating host and filestamp,
3622b15cb3dSCy Schubertas described in the
36309100258SXin LI<a href="#Cryptographic-Data-Files">Cryptographic Data Files</a>
3642b15cb3dSCy Schubertsection below.
365*052d159aSCy Schubert</p>
366*052d159aSCy Schubert<table class="menu" border="0" cellspacing="0">
367*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-usage" accesskey="1">ntp-keygen usage</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
368*052d159aSCy Schubert</td></tr>
369*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-imbits" accesskey="2">ntp-keygen imbits</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
370*052d159aSCy Schubert</td></tr>
371*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-certificate" accesskey="3">ntp-keygen certificate</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
372*052d159aSCy Schubert</td></tr>
373*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-cipher" accesskey="4">ntp-keygen cipher</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
374*052d159aSCy Schubert</td></tr>
375*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-id_002dkey" accesskey="5">ntp-keygen id-key</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
376*052d159aSCy Schubert</td></tr>
377*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-gq_002dparams" accesskey="6">ntp-keygen gq-params</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
378*052d159aSCy Schubert</td></tr>
379*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-host_002dkey" accesskey="7">ntp-keygen host-key</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
380*052d159aSCy Schubert</td></tr>
381*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-iffkey" accesskey="8">ntp-keygen iffkey</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
382*052d159aSCy Schubert</td></tr>
383*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-ident" accesskey="9">ntp-keygen ident</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
384*052d159aSCy Schubert</td></tr>
385*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-lifetime">ntp-keygen lifetime</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
386*052d159aSCy Schubert</td></tr>
387*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-modulus">ntp-keygen modulus</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
388*052d159aSCy Schubert</td></tr>
389*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-md5key">ntp-keygen md5key</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
390*052d159aSCy Schubert</td></tr>
391*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-pvt_002dcert">ntp-keygen pvt-cert</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
392*052d159aSCy Schubert</td></tr>
393*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-password">ntp-keygen password</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
394*052d159aSCy Schubert</td></tr>
395*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-export_002dpasswd">ntp-keygen export-passwd</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
396*052d159aSCy Schubert</td></tr>
397*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-subject_002dname">ntp-keygen subject-name</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
398*052d159aSCy Schubert</td></tr>
399*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-sign_002dkey">ntp-keygen sign-key</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
400*052d159aSCy Schubert</td></tr>
401*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-trusted_002dcert">ntp-keygen trusted-cert</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
402*052d159aSCy Schubert</td></tr>
403*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-mv_002dparams">ntp-keygen mv-params</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
404*052d159aSCy Schubert</td></tr>
405*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-mv_002dkeys">ntp-keygen mv-keys</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
406*052d159aSCy Schubert</td></tr>
407*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-config">ntp-keygen config</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
408*052d159aSCy Schubert</td></tr>
409*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-exit-status">ntp-keygen exit status</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
410*052d159aSCy Schubert</td></tr>
411*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-Usage">ntp-keygen Usage</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
412*052d159aSCy Schubert</td></tr>
413*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-Notes">ntp-keygen Notes</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
414*052d159aSCy Schubert</td></tr>
415*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-Bugs">ntp-keygen Bugs</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
416*052d159aSCy Schubert</td></tr>
417*052d159aSCy Schubert</table>
4182b15cb3dSCy Schubert
419*052d159aSCy Schubert<a name="Running-the-Program-2"></a>
420*052d159aSCy Schubert<h4 class="subsection">1.2.1 Running the Program</h4>
42109100258SXin LI<p>The safest way to run the
42209100258SXin LI<code>ntp-keygen</code>
42309100258SXin LIprogram is logged in directly as root.
42409100258SXin LIThe recommended procedure is change to the
42509100258SXin LI<kbd>keys</kbd>
42609100258SXin LIdirectory, usually
427*052d159aSCy Schubert<samp>/usr/local/etc</samp>,
42809100258SXin LIthen run the program.
429*052d159aSCy Schubert</p>
4302b15cb3dSCy Schubert<p>To test and gain experience with Autokey concepts, log in as root and
43109100258SXin LIchange to the
43209100258SXin LI<kbd>keys</kbd>
43309100258SXin LIdirectory, usually
434*052d159aSCy Schubert<samp>/usr/local/etc</samp>.
4352b15cb3dSCy SchubertWhen run for the first time, or if all files with names beginning with
436*052d159aSCy Schubert<samp>ntpkey*</samp>
4372b15cb3dSCy Schuberthave been removed, use the
4382b15cb3dSCy Schubert<code>ntp-keygen</code>
43909100258SXin LIcommand without arguments to generate a default
44009100258SXin LI<code>RSA</code>
44109100258SXin LIhost key and matching
44209100258SXin LI<code>RSA-MD5</code>
44309100258SXin LIcertificate file with expiration date one year hence,
44409100258SXin LIwhich is all that is necessary in many cases.
44509100258SXin LIThe program also generates soft links from the generic names
44609100258SXin LIto the respective files.
4472b15cb3dSCy SchubertIf run again without options, the program uses the
44809100258SXin LIexisting keys and parameters and generates a new certificate file with
44909100258SXin LInew expiration date one year hence, and soft link.
450*052d159aSCy Schubert</p>
45109100258SXin LI<p>The host key is used to encrypt the cookie when required and so must be
45209100258SXin LI<code>RSA</code>
45309100258SXin LItype.
45409100258SXin LIBy default, the host key is also the sign key used to encrypt signatures.
45509100258SXin LIWhen necessary, a different sign key can be specified and this can be
45609100258SXin LIeither
45709100258SXin LI<code>RSA</code>
45809100258SXin LIor
45909100258SXin LI<code>DSA</code>
46009100258SXin LItype.
46109100258SXin LIBy default, the message digest type is
46209100258SXin LI<code>MD5</code>,
46309100258SXin LIbut any combination
46409100258SXin LIof sign key type and message digest type supported by the OpenSSL library
46509100258SXin LIcan be specified, including those using the
46609100258SXin LI<code>AES128CMAC</code>, <code>MD2</code>, <code>MD5</code>, <code>MDC2</code>, <code>SHA</code>, <code>SHA1</code>
46709100258SXin LIand
46809100258SXin LI<code>RIPE160</code>
46909100258SXin LImessage digest algorithms.
47009100258SXin LIHowever, the scheme specified in the certificate must be compatible
47109100258SXin LIwith the sign key.
47209100258SXin LICertificates using any digest algorithm are compatible with
47309100258SXin LI<code>RSA</code>
47409100258SXin LIsign keys;
47509100258SXin LIhowever, only
47609100258SXin LI<code>SHA</code>
47709100258SXin LIand
47809100258SXin LI<code>SHA1</code>
47909100258SXin LIcertificates are compatible with
48009100258SXin LI<code>DSA</code>
48109100258SXin LIsign keys.
482*052d159aSCy Schubert</p>
48309100258SXin LI<p>Private/public key files and certificates are compatible with
48409100258SXin LIother OpenSSL applications and very likely other libraries as well.
48509100258SXin LICertificates or certificate requests derived from them should be compatible
48609100258SXin LIwith extant industry practice, although some users might find
48709100258SXin LIthe interpretation of X509v3 extension fields somewhat liberal.
48809100258SXin LIHowever, the identification parameter files, although encoded
48909100258SXin LIas the other files, are probably not compatible with anything other than Autokey.
490*052d159aSCy Schubert</p>
49109100258SXin LI<p>Running the program as other than root and using the Unix
49209100258SXin LI<code>su(1)</code>
49309100258SXin LIcommand
49409100258SXin LIto assume root may not work properly, since by default the OpenSSL library
49509100258SXin LIlooks for the random seed file
496*052d159aSCy Schubert<samp>.rnd</samp>
49709100258SXin LIin the user home directory.
49809100258SXin LIHowever, there should be only one
499*052d159aSCy Schubert<samp>.rnd</samp>,
50009100258SXin LImost conveniently
50109100258SXin LIin the root directory, so it is convenient to define the
50209100258SXin LI.Ev RANDFILE
50309100258SXin LIenvironment variable used by the OpenSSL library as the path to
504*052d159aSCy Schubert<samp>.rnd</samp>.
505*052d159aSCy Schubert</p>
50609100258SXin LI<p>Installing the keys as root might not work in NFS-mounted
50709100258SXin LIshared file systems, as NFS clients may not be able to write
50809100258SXin LIto the shared keys directory, even as root.
50909100258SXin LIIn this case, NFS clients can specify the files in another
51009100258SXin LIdirectory such as
511*052d159aSCy Schubert<samp>/etc</samp>
51209100258SXin LIusing the
51309100258SXin LI<code>keysdir</code>
51409100258SXin LI<code>ntpd(1ntpdmdoc)</code>
51509100258SXin LIconfiguration file command.
51609100258SXin LIThere is no need for one client to read the keys and certificates
51709100258SXin LIof other clients or servers, as these data are obtained automatically
51809100258SXin LIby the Autokey protocol.
519*052d159aSCy Schubert</p>
52009100258SXin LI<p>Ordinarily, cryptographic files are generated by the host that uses them,
52109100258SXin LIbut it is possible for a trusted agent (TA) to generate these files
52209100258SXin LIfor other hosts; however, in such cases files should always be encrypted.
52309100258SXin LIThe subject name and trusted name default to the hostname
52409100258SXin LIof the host generating the files, but can be changed by command line options.
52509100258SXin LIIt is convenient to designate the owner name and trusted name
52609100258SXin LIas the subject and issuer fields, respectively, of the certificate.
52709100258SXin LIThe owner name is also used for the host and sign key files,
52809100258SXin LIwhile the trusted name is used for the identity files.
529*052d159aSCy Schubert</p>
53009100258SXin LI<p>All files are installed by default in the keys directory
531*052d159aSCy Schubert<samp>/usr/local/etc</samp>,
53209100258SXin LIwhich is normally in a shared filesystem
53309100258SXin LIin NFS-mounted networks.
53409100258SXin LIThe actual location of the keys directory
53509100258SXin LIand each file can be overridden by configuration commands,
53609100258SXin LIbut this is not recommended.
53709100258SXin LINormally, the files for each host are generated by that host
53809100258SXin LIand used only by that host, although exceptions exist
53909100258SXin LIas noted later on this page.
540*052d159aSCy Schubert</p>
54109100258SXin LI<p>Normally, files containing private values,
54209100258SXin LIincluding the host key, sign key and identification parameters,
54309100258SXin LIare permitted root read/write-only;
54409100258SXin LIwhile others containing public values are permitted world readable.
54509100258SXin LIAlternatively, files containing private values can be encrypted
54609100258SXin LIand these files permitted world readable,
54709100258SXin LIwhich simplifies maintenance in shared file systems.
54809100258SXin LISince uniqueness is insured by the
54909100258SXin LI<kbd>hostname</kbd>
55009100258SXin LIand
55109100258SXin LI<kbd>filestamp</kbd>
55209100258SXin LIfile name extensions, the files for an NTP server and
55309100258SXin LIdependent clients can all be installed in the same shared directory.
554*052d159aSCy Schubert</p>
55509100258SXin LI<p>The recommended practice is to keep the file name extensions
55609100258SXin LIwhen installing a file and to install a soft link
55709100258SXin LIfrom the generic names specified elsewhere on this page
55809100258SXin LIto the generated files.
55909100258SXin LIThis allows new file generations to be activated simply
56009100258SXin LIby changing the link.
56109100258SXin LIIf a link is present,
56209100258SXin LI<code>ntpd(1ntpdmdoc)</code>
56309100258SXin LIfollows it to the file name to extract the
56409100258SXin LI<kbd>filestamp</kbd>.
56509100258SXin LIIf a link is not present,
56609100258SXin LI<code>ntpd(1ntpdmdoc)</code>
56709100258SXin LIextracts the
56809100258SXin LI<kbd>filestamp</kbd>
56909100258SXin LIfrom the file itself.
57009100258SXin LIThis allows clients to verify that the file and generation times
57109100258SXin LIare always current.
57209100258SXin LIThe
57309100258SXin LI<code>ntp-keygen</code>
57409100258SXin LIprogram uses the same
57509100258SXin LI<kbd>filestamp</kbd>
57609100258SXin LIextension for all files generated
57709100258SXin LIat one time, so each generation is distinct and can be readily
57809100258SXin LIrecognized in monitoring data.
579*052d159aSCy Schubert</p>
5802b15cb3dSCy Schubert<p>Run the command on as many hosts as necessary.
5812b15cb3dSCy SchubertDesignate one of them as the trusted host (TH) using
5822b15cb3dSCy Schubert<code>ntp-keygen</code>
5832b15cb3dSCy Schubertwith the
5842b15cb3dSCy Schubert<code>-T</code>
5852b15cb3dSCy Schubertoption and configure it to synchronize from reliable Internet servers.
5862b15cb3dSCy SchubertThen configure the other hosts to synchronize to the TH directly or
5872b15cb3dSCy Schubertindirectly.
5882b15cb3dSCy SchubertA certificate trail is created when Autokey asks the immediately
5892b15cb3dSCy Schubertascendant host towards the TH to sign its certificate, which is then
5902b15cb3dSCy Schubertprovided to the immediately descendant host on request.
5912b15cb3dSCy SchubertAll group hosts should have acyclic certificate trails ending on the TH.
592*052d159aSCy Schubert</p>
5932b15cb3dSCy Schubert<p>The host key is used to encrypt the cookie when required and so must be
5942b15cb3dSCy SchubertRSA type.
5952b15cb3dSCy SchubertBy default, the host key is also the sign key used to encrypt
5962b15cb3dSCy Schubertsignatures.
5972b15cb3dSCy SchubertA different sign key can be assigned using the
5982b15cb3dSCy Schubert<code>-S</code>
59909100258SXin LIoption and this can be either
60009100258SXin LI<code>RSA</code>
60109100258SXin LIor
60209100258SXin LI<code>DSA</code>
60309100258SXin LItype.
6042b15cb3dSCy SchubertBy default, the signature
60509100258SXin LImessage digest type is
60609100258SXin LI<code>MD5</code>,
60709100258SXin LIbut any combination of sign key type and
6082b15cb3dSCy Schubertmessage digest type supported by the OpenSSL library can be specified
6092b15cb3dSCy Schubertusing the
6102b15cb3dSCy Schubert<code>-c</code>
6112b15cb3dSCy Schubertoption.
612*052d159aSCy Schubert</p>
61309100258SXin LI<p>The rules say cryptographic media should be generated with proventic
6142b15cb3dSCy Schubertfilestamps, which means the host should already be synchronized before
6152b15cb3dSCy Schubertthis program is run.
6162b15cb3dSCy SchubertThis of course creates a chicken-and-egg problem
6172b15cb3dSCy Schubertwhen the host is started for the first time.
6182b15cb3dSCy SchubertAccordingly, the host time
6192b15cb3dSCy Schubertshould be set by some other means, such as eyeball-and-wristwatch, at
6202b15cb3dSCy Schubertleast so that the certificate lifetime is within the current year.
6212b15cb3dSCy SchubertAfter that and when the host is synchronized to a proventic source, the
6222b15cb3dSCy Schubertcertificate should be re-generated.
623*052d159aSCy Schubert</p>
6242b15cb3dSCy Schubert<p>Additional information on trusted groups and identity schemes is on the
625*052d159aSCy Schubert&ldquo;Autokey Public-Key Authentication&rdquo;
6262b15cb3dSCy Schubertpage.
627*052d159aSCy Schubert</p>
6282b15cb3dSCy Schubert<p>File names begin with the prefix
629*052d159aSCy Schubert<samp>ntpkey</samp>_
63009100258SXin LIand end with the suffix
631*052d159aSCy Schubert<samp>_</samp><kbd>hostname</kbd>. <kbd>filestamp</kbd>,
6322b15cb3dSCy Schubertwhere
6332b15cb3dSCy Schubert<kbd>hostname</kbd>
6342b15cb3dSCy Schubertis the owner name, usually the string returned
63509100258SXin LIby the Unix
63609100258SXin LI<code>hostname(1)</code>
63709100258SXin LIcommand, and
6382b15cb3dSCy Schubert<kbd>filestamp</kbd>
6392b15cb3dSCy Schubertis the NTP seconds when the file was generated, in decimal digits.
6402b15cb3dSCy SchubertThis both guarantees uniqueness and simplifies maintenance
6412b15cb3dSCy Schubertprocedures, since all files can be quickly removed
6422b15cb3dSCy Schubertby a
643*052d159aSCy Schubert<code>rm</code> <samp>ntpkey*</samp>
6442b15cb3dSCy Schubertcommand or all files generated
6452b15cb3dSCy Schubertat a specific time can be removed by a
646*052d159aSCy Schubert<code>rm</code> <samp>*</samp><kbd>filestamp</kbd>
6472b15cb3dSCy Schubertcommand.
6482b15cb3dSCy SchubertTo further reduce the risk of misconfiguration,
6492b15cb3dSCy Schubertthe first two lines of a file contain the file name
6502b15cb3dSCy Schubertand generation date and time as comments.
651*052d159aSCy Schubert</p>
652*052d159aSCy Schubert<a name="Trusted-Hosts-and-Groups"></a>
653*052d159aSCy Schubert<h4 class="subsubsection">1.2.1.1 Trusted Hosts and Groups</h4>
65409100258SXin LI<p>Each cryptographic configuration involves selection of a signature scheme
6552b15cb3dSCy Schubertand identification scheme, called a cryptotype,
6562b15cb3dSCy Schubertas explained in the
657*052d159aSCy Schubert&lsquo;Authentication Options&rsquo;
6582b15cb3dSCy Schubertsection of
6592b15cb3dSCy Schubert<code>ntp.conf(5)</code>.
66009100258SXin LIThe default cryptotype uses
66109100258SXin LI<code>RSA</code>
66209100258SXin LIencryption,
66309100258SXin LI<code>MD5</code>
66409100258SXin LImessage digest
66509100258SXin LIand
66609100258SXin LI<code>TC</code>
66709100258SXin LIidentification.
6682b15cb3dSCy SchubertFirst, configure a NTP subnet including one or more low-stratum
6692b15cb3dSCy Schuberttrusted hosts from which all other hosts derive synchronization
6702b15cb3dSCy Schubertdirectly or indirectly.
6712b15cb3dSCy SchubertTrusted hosts have trusted certificates;
6722b15cb3dSCy Schubertall other hosts have nontrusted certificates.
6732b15cb3dSCy SchubertThese hosts will automatically and dynamically build authoritative
6742b15cb3dSCy Schubertcertificate trails to one or more trusted hosts.
6752b15cb3dSCy SchubertA trusted group is the set of all hosts that have, directly or indirectly,
6762b15cb3dSCy Schuberta certificate trail ending at a trusted host.
6772b15cb3dSCy SchubertThe trail is defined by static configuration file entries
6782b15cb3dSCy Schubertor dynamic means described on the
679*052d159aSCy Schubert&lsquo;Automatic NTP Configuration Options&rsquo;
6802b15cb3dSCy Schubertsection of
6812b15cb3dSCy Schubert<code>ntp.conf(5)</code>.
682*052d159aSCy Schubert</p>
6832b15cb3dSCy Schubert<p>On each trusted host as root, change to the keys directory.
6842b15cb3dSCy SchubertTo insure a fresh fileset, remove all
685*052d159aSCy Schubert<samp>ntpkey</samp>
6862b15cb3dSCy Schubertfiles.
6872b15cb3dSCy SchubertThen run
6882b15cb3dSCy Schubert<code>ntp-keygen</code>
6892b15cb3dSCy Schubert<code>-T</code>
6902b15cb3dSCy Schubertto generate keys and a trusted certificate.
6912b15cb3dSCy SchubertOn all other hosts do the same, but leave off the
6922b15cb3dSCy Schubert<code>-T</code>
6932b15cb3dSCy Schubertflag to generate keys and nontrusted certificates.
6942b15cb3dSCy SchubertWhen complete, start the NTP daemons beginning at the lowest stratum
6952b15cb3dSCy Schubertand working up the tree.
6962b15cb3dSCy SchubertIt may take some time for Autokey to instantiate the certificate trails
6972b15cb3dSCy Schubertthroughout the subnet, but setting up the environment is completely automatic.
698*052d159aSCy Schubert</p>
6992b15cb3dSCy Schubert<p>If it is necessary to use a different sign key or different digest/signature
7002b15cb3dSCy Schubertscheme than the default, run
7012b15cb3dSCy Schubert<code>ntp-keygen</code>
7022b15cb3dSCy Schubertwith the
7032b15cb3dSCy Schubert<code>-S</code> <kbd>type</kbd>
7042b15cb3dSCy Schubertoption, where
7052b15cb3dSCy Schubert<kbd>type</kbd>
7062b15cb3dSCy Schubertis either
7072b15cb3dSCy Schubert<code>RSA</code>
7082b15cb3dSCy Schubertor
7092b15cb3dSCy Schubert<code>DSA</code>.
71009100258SXin LIThe most frequent need to do this is when a
71109100258SXin LI<code>DSA</code>-signed
71209100258SXin LIcertificate is used.
7132b15cb3dSCy SchubertIf it is necessary to use a different certificate scheme than the default,
7142b15cb3dSCy Schubertrun
7152b15cb3dSCy Schubert<code>ntp-keygen</code>
7162b15cb3dSCy Schubertwith the
7172b15cb3dSCy Schubert<code>-c</code> <kbd>scheme</kbd>
7182b15cb3dSCy Schubertoption and selected
7192b15cb3dSCy Schubert<kbd>scheme</kbd>
7202b15cb3dSCy Schubertas needed.
72109100258SXin LIIf
7222b15cb3dSCy Schubert<code>ntp-keygen</code>
7232b15cb3dSCy Schubertis run again without these options, it generates a new certificate
72409100258SXin LIusing the same scheme and sign key, and soft link.
725*052d159aSCy Schubert</p>
7262b15cb3dSCy Schubert<p>After setting up the environment it is advisable to update certificates
7272b15cb3dSCy Schubertfrom time to time, if only to extend the validity interval.
7282b15cb3dSCy SchubertSimply run
7292b15cb3dSCy Schubert<code>ntp-keygen</code>
7302b15cb3dSCy Schubertwith the same flags as before to generate new certificates
73109100258SXin LIusing existing keys, and soft links.
7322b15cb3dSCy SchubertHowever, if the host or sign key is changed,
7332b15cb3dSCy Schubert<code>ntpd(1ntpdmdoc)</code>
7342b15cb3dSCy Schubertshould be restarted.
7352b15cb3dSCy SchubertWhen
7362b15cb3dSCy Schubert<code>ntpd(1ntpdmdoc)</code>
7372b15cb3dSCy Schubertis restarted, it loads any new files and restarts the protocol.
7382b15cb3dSCy SchubertOther dependent hosts will continue as usual until signatures are refreshed,
7392b15cb3dSCy Schubertat which time the protocol is restarted.
740*052d159aSCy Schubert</p>
741*052d159aSCy Schubert<a name="Identity-Schemes"></a>
742*052d159aSCy Schubert<h4 class="subsubsection">1.2.1.2 Identity Schemes</h4>
7432b15cb3dSCy Schubert<p>As mentioned on the Autonomous Authentication page,
74409100258SXin LIthe default
74509100258SXin LI<code>TC</code>
74609100258SXin LIidentity scheme is vulnerable to a middleman attack.
7472b15cb3dSCy SchubertHowever, there are more secure identity schemes available,
74809100258SXin LIincluding
74909100258SXin LI<code>PC</code>, <code>IFF</code>, <code>GQ</code>
75009100258SXin LIand
75109100258SXin LI<code>MV</code>
75209100258SXin LIschemes described below.
7532b15cb3dSCy SchubertThese schemes are based on a TA, one or more trusted hosts
7542b15cb3dSCy Schubertand some number of nontrusted hosts.
7552b15cb3dSCy SchubertTrusted hosts prove identity using values provided by the TA,
7562b15cb3dSCy Schubertwhile the remaining hosts prove identity using values provided
7572b15cb3dSCy Schubertby a trusted host and certificate trails that end on that host.
7582b15cb3dSCy SchubertThe name of a trusted host is also the name of its sugroup
7592b15cb3dSCy Schubertand also the subject and issuer name on its trusted certificate.
7602b15cb3dSCy SchubertThe TA is not necessarily a trusted host in this sense, but often is.
761*052d159aSCy Schubert</p>
7622b15cb3dSCy Schubert<p>In some schemes there are separate keys for servers and clients.
7632b15cb3dSCy SchubertA server can also be a client of another server,
7642b15cb3dSCy Schubertbut a client can never be a server for another client.
7652b15cb3dSCy SchubertIn general, trusted hosts and nontrusted hosts that operate
7662b15cb3dSCy Schubertas both server and client have parameter files that contain
7672b15cb3dSCy Schubertboth server and client keys.
7682b15cb3dSCy SchubertHosts that operate
7692b15cb3dSCy Schubertonly as clients have key files that contain only client keys.
770*052d159aSCy Schubert</p>
7712b15cb3dSCy Schubert<p>The PC scheme supports only one trusted host in the group.
7722b15cb3dSCy SchubertOn trusted host alice run
7732b15cb3dSCy Schubert<code>ntp-keygen</code>
7742b15cb3dSCy Schubert<code>-P</code>
7752b15cb3dSCy Schubert<code>-p</code> <kbd>password</kbd>
7762b15cb3dSCy Schubertto generate the host key file
777*052d159aSCy Schubert<samp>ntpkey</samp>_ <code>RSA</code> <samp>key_alice.</samp> <kbd>filestamp</kbd>
7782b15cb3dSCy Schubertand trusted private certificate file
779*052d159aSCy Schubert<samp>ntpkey</samp>_ <code>RSA-MD5</code> <code>_</code> <samp>cert_alice.</samp> <kbd>filestamp</kbd>,
78009100258SXin LIand soft links.
7812b15cb3dSCy SchubertCopy both files to all group hosts;
7822b15cb3dSCy Schubertthey replace the files which would be generated in other schemes.
78309100258SXin LIOn each host
78409100258SXin LI<kbd>bob</kbd>
78509100258SXin LIinstall a soft link from the generic name
786*052d159aSCy Schubert<samp>ntpkey_host_</samp><kbd>bob</kbd>
7872b15cb3dSCy Schubertto the host key file and soft link
788*052d159aSCy Schubert<samp>ntpkey_cert_</samp><kbd>bob</kbd>
7892b15cb3dSCy Schubertto the private certificate file.
7902b15cb3dSCy SchubertNote the generic links are on bob, but point to files generated
7912b15cb3dSCy Schubertby trusted host alice.
7922b15cb3dSCy SchubertIn this scheme it is not possible to refresh
7932b15cb3dSCy Schuberteither the keys or certificates without copying them
79409100258SXin LIto all other hosts in the group, and recreating the soft links.
795*052d159aSCy Schubert</p>
79609100258SXin LI<p>For the
79709100258SXin LI<code>IFF</code>
79809100258SXin LIscheme proceed as in the
79909100258SXin LI<code>TC</code>
80009100258SXin LIscheme to generate keys
8012b15cb3dSCy Schubertand certificates for all group hosts, then for every trusted host in the group,
80209100258SXin LIgenerate the
80309100258SXin LI<code>IFF</code>
80409100258SXin LIparameter file.
8052b15cb3dSCy SchubertOn trusted host alice run
8062b15cb3dSCy Schubert<code>ntp-keygen</code>
8072b15cb3dSCy Schubert<code>-T</code>
8082b15cb3dSCy Schubert<code>-I</code>
8092b15cb3dSCy Schubert<code>-p</code> <kbd>password</kbd>
8102b15cb3dSCy Schubertto produce her parameter file
811*052d159aSCy Schubert<samp>ntpkey_IFFpar_alice.</samp><kbd>filestamp</kbd>,
8122b15cb3dSCy Schubertwhich includes both server and client keys.
8132b15cb3dSCy SchubertCopy this file to all group hosts that operate as both servers
8142b15cb3dSCy Schubertand clients and install a soft link from the generic
815*052d159aSCy Schubert<samp>ntpkey_iff_alice</samp>
8162b15cb3dSCy Schubertto this file.
8172b15cb3dSCy SchubertIf there are no hosts restricted to operate only as clients,
8182b15cb3dSCy Schubertthere is nothing further to do.
81909100258SXin LIAs the
82009100258SXin LI<code>IFF</code>
82109100258SXin LIscheme is independent
8222b15cb3dSCy Schubertof keys and certificates, these files can be refreshed as needed.
823*052d159aSCy Schubert</p>
8242b15cb3dSCy Schubert<p>If a rogue client has the parameter file, it could masquerade
8252b15cb3dSCy Schubertas a legitimate server and present a middleman threat.
8262b15cb3dSCy SchubertTo eliminate this threat, the client keys can be extracted
8272b15cb3dSCy Schubertfrom the parameter file and distributed to all restricted clients.
8282b15cb3dSCy SchubertAfter generating the parameter file, on alice run
8292b15cb3dSCy Schubert<code>ntp-keygen</code>
8302b15cb3dSCy Schubert<code>-e</code>
83109100258SXin LIand pipe the output to a file or email program.
83209100258SXin LICopy or email this file to all restricted clients.
8332b15cb3dSCy SchubertOn these clients install a soft link from the generic
834*052d159aSCy Schubert<samp>ntpkey_iff_alice</samp>
8352b15cb3dSCy Schubertto this file.
8362b15cb3dSCy SchubertTo further protect the integrity of the keys,
8372b15cb3dSCy Schuberteach file can be encrypted with a secret password.
838*052d159aSCy Schubert</p>
83909100258SXin LI<p>For the
84009100258SXin LI<code>GQ</code>
84109100258SXin LIscheme proceed as in the
84209100258SXin LI<code>TC</code>
84309100258SXin LIscheme to generate keys
8442b15cb3dSCy Schubertand certificates for all group hosts, then for every trusted host
84509100258SXin LIin the group, generate the
84609100258SXin LI<code>IFF</code>
84709100258SXin LIparameter file.
8482b15cb3dSCy SchubertOn trusted host alice run
8492b15cb3dSCy Schubert<code>ntp-keygen</code>
8502b15cb3dSCy Schubert<code>-T</code>
8512b15cb3dSCy Schubert<code>-G</code>
8522b15cb3dSCy Schubert<code>-p</code> <kbd>password</kbd>
8532b15cb3dSCy Schubertto produce her parameter file
854*052d159aSCy Schubert<samp>ntpkey_GQpar_alice.</samp><kbd>filestamp</kbd>,
8552b15cb3dSCy Schubertwhich includes both server and client keys.
8562b15cb3dSCy SchubertCopy this file to all group hosts and install a soft link
8572b15cb3dSCy Schubertfrom the generic
858*052d159aSCy Schubert<samp>ntpkey_gq_alice</samp>
8592b15cb3dSCy Schubertto this file.
86009100258SXin LIIn addition, on each host
86109100258SXin LI<kbd>bob</kbd>
86209100258SXin LIinstall a soft link
8632b15cb3dSCy Schubertfrom generic
864*052d159aSCy Schubert<samp>ntpkey_gq_</samp><kbd>bob</kbd>
8652b15cb3dSCy Schubertto this file.
86609100258SXin LIAs the
86709100258SXin LI<code>GQ</code>
86809100258SXin LIscheme updates the
86909100258SXin LI<code>GQ</code>
87009100258SXin LIparameters file and certificate
8712b15cb3dSCy Schubertat the same time, keys and certificates can be regenerated as needed.
872*052d159aSCy Schubert</p>
87309100258SXin LI<p>For the
87409100258SXin LI<code>MV</code>
87509100258SXin LIscheme, proceed as in the
87609100258SXin LI<code>TC</code>
87709100258SXin LIscheme to generate keys
8782b15cb3dSCy Schubertand certificates for all group hosts.
8792b15cb3dSCy SchubertFor illustration assume trish is the TA, alice one of several trusted hosts
8802b15cb3dSCy Schubertand bob one of her clients.
8812b15cb3dSCy SchubertOn TA trish run
8822b15cb3dSCy Schubert<code>ntp-keygen</code>
8832b15cb3dSCy Schubert<code>-V</code> <kbd>n</kbd>
8842b15cb3dSCy Schubert<code>-p</code> <kbd>password</kbd>,
8852b15cb3dSCy Schubertwhere
8862b15cb3dSCy Schubert<kbd>n</kbd>
8872b15cb3dSCy Schubertis the number of revokable keys (typically 5) to produce
8882b15cb3dSCy Schubertthe parameter file
889*052d159aSCy Schubert<samp>ntpkeys_MVpar_trish.</samp><kbd>filestamp</kbd>
8902b15cb3dSCy Schubertand client key files
891*052d159aSCy Schubert<samp>ntpkeys_MVkey</samp><kbd>d</kbd> <kbd>_</kbd> <samp>trish.</samp> <kbd>filestamp</kbd>
8922b15cb3dSCy Schubertwhere
8932b15cb3dSCy Schubert<kbd>d</kbd>
8942b15cb3dSCy Schubertis the key number (0 &lt;
8952b15cb3dSCy Schubert<kbd>d</kbd>
8962b15cb3dSCy Schubert&lt;
8972b15cb3dSCy Schubert<kbd>n</kbd>).
8982b15cb3dSCy SchubertCopy the parameter file to alice and install a soft link
8992b15cb3dSCy Schubertfrom the generic
900*052d159aSCy Schubert<samp>ntpkey_mv_alice</samp>
9012b15cb3dSCy Schubertto this file.
9022b15cb3dSCy SchubertCopy one of the client key files to alice for later distribution
9032b15cb3dSCy Schubertto her clients.
90409100258SXin LIIt does not matter which client key file goes to alice,
9052b15cb3dSCy Schubertsince they all work the same way.
90609100258SXin LIAlice copies the client key file to all of her clients.
9072b15cb3dSCy SchubertOn client bob install a soft link from generic
908*052d159aSCy Schubert<samp>ntpkey_mvkey_bob</samp>
9092b15cb3dSCy Schubertto the client key file.
91009100258SXin LIAs the
91109100258SXin LI<code>MV</code>
91209100258SXin LIscheme is independent of keys and certificates,
9132b15cb3dSCy Schubertthese files can be refreshed as needed.
914*052d159aSCy Schubert</p>
915*052d159aSCy Schubert<a name="Command-Line-Options"></a>
916*052d159aSCy Schubert<h4 class="subsubsection">1.2.1.3 Command Line Options</h4>
917*052d159aSCy Schubert<dl compact="compact">
918*052d159aSCy Schubert<dt><code>-b</code> <code>--imbits</code>= <kbd>modulus</kbd></dt>
919*052d159aSCy Schubert<dd><p>Set the number of bits in the identity modulus for generating identity keys to
92009100258SXin LI<kbd>modulus</kbd>
92109100258SXin LIbits.
92209100258SXin LIThe number of bits in the identity modulus defaults to 256, but can be set to
92309100258SXin LIvalues from 256 to 2048 (32 to 256 octets).
92409100258SXin LIUse the larger moduli with caution, as this can consume considerable computing
92509100258SXin LIresources and increases the size of authenticated packets.
926*052d159aSCy Schubert</p></dd>
927*052d159aSCy Schubert<dt><code>-c</code> <code>--certificate</code>= <kbd>scheme</kbd></dt>
928*052d159aSCy Schubert<dd><p>Select certificate signature encryption/message digest scheme.
9292b15cb3dSCy SchubertThe
9302b15cb3dSCy Schubert<kbd>scheme</kbd>
9312b15cb3dSCy Schubertcan be one of the following:
93209100258SXin LI<code>RSA-MD2</code>, <code>RSA-MD5</code>, <code>RSA-MDC2</code>, <code>RSA-SHA</code>, <code>RSA-SHA1</code>, <code>RSA-RIPEMD160</code>, <code>DSA-SHA</code>,
9332b15cb3dSCy Schubertor
9342b15cb3dSCy Schubert<code>DSA-SHA1</code>.
93509100258SXin LINote that
93609100258SXin LI<code>RSA</code>
93709100258SXin LIschemes must be used with an
93809100258SXin LI<code>RSA</code>
93909100258SXin LIsign key and
94009100258SXin LI<code>DSA</code>
94109100258SXin LIschemes must be used with a
94209100258SXin LI<code>DSA</code>
94309100258SXin LIsign key.
9442b15cb3dSCy SchubertThe default without this option is
9452b15cb3dSCy Schubert<code>RSA-MD5</code>.
94609100258SXin LIIf compatibility with FIPS 140-2 is required, either the
94709100258SXin LI<code>DSA-SHA</code>
94809100258SXin LIor
94909100258SXin LI<code>DSA-SHA1</code>
95009100258SXin LIscheme must be used.
951*052d159aSCy Schubert</p></dd>
952*052d159aSCy Schubert<dt><code>-C</code> <code>--cipher</code>= <kbd>cipher</kbd></dt>
953*052d159aSCy Schubert<dd><p>Select the OpenSSL cipher to encrypt the files containing private keys.
95409100258SXin LIThe default without this option is three-key triple DES in CBC mode,
95509100258SXin LI<code>des-ede3-cbc</code>.
95609100258SXin LIThe
95709100258SXin LI<code>openssl</code> <code>-h</code>
95809100258SXin LIcommand provided with OpenSSL displays available ciphers.
959*052d159aSCy Schubert</p></dd>
960*052d159aSCy Schubert<dt><code>-d</code> <code>--debug-level</code></dt>
961*052d159aSCy Schubert<dd><p>Increase debugging verbosity level.
9622b15cb3dSCy SchubertThis option displays the cryptographic data produced in eye-friendly billboards.
963*052d159aSCy Schubert</p></dd>
964*052d159aSCy Schubert<dt><code>-D</code> <code>--set-debug-level</code>= <kbd>level</kbd></dt>
965*052d159aSCy Schubert<dd><p>Set the debugging verbosity to
96609100258SXin LI<kbd>level</kbd>.
96709100258SXin LIThis option displays the cryptographic data produced in eye-friendly billboards.
968*052d159aSCy Schubert</p></dd>
969*052d159aSCy Schubert<dt><code>-e</code> <code>--id-key</code></dt>
970*052d159aSCy Schubert<dd><p>Write the
97109100258SXin LI<code>IFF</code>
97209100258SXin LIor
97309100258SXin LI<code>GQ</code>
97409100258SXin LIpublic parameters from the
97509100258SXin LI<kbd>IFFkey</kbd> <kbd>or</kbd> <kbd>GQkey</kbd>
97609100258SXin LIclient keys file previously specified
97709100258SXin LIas unencrypted data to the standard output stream
978*052d159aSCy Schubert<samp>stdout</samp>.
97909100258SXin LIThis is intended for automatic key distribution by email.
980*052d159aSCy Schubert</p></dd>
981*052d159aSCy Schubert<dt><code>-G</code> <code>--gq-params</code></dt>
982*052d159aSCy Schubert<dd><p>Generate a new encrypted
98309100258SXin LI<code>GQ</code>
98409100258SXin LIparameters and key file for the Guillou-Quisquater (GQ) identity scheme.
98509100258SXin LIThis option is mutually exclusive with the
98609100258SXin LI<code>-I</code>
98709100258SXin LIand
98809100258SXin LI<code>-V</code>
98909100258SXin LIoptions.
990*052d159aSCy Schubert</p></dd>
991*052d159aSCy Schubert<dt><code>-H</code> <code>--host-key</code></dt>
992*052d159aSCy Schubert<dd><p>Generate a new encrypted
99309100258SXin LI<code>RSA</code>
99409100258SXin LIpublic/private host key file.
995*052d159aSCy Schubert</p></dd>
996*052d159aSCy Schubert<dt><code>-I</code> <code>--iffkey</code></dt>
997*052d159aSCy Schubert<dd><p>Generate a new encrypted
99809100258SXin LI<code>IFF</code>
99909100258SXin LIkey file for the Schnorr (IFF) identity scheme.
100009100258SXin LIThis option is mutually exclusive with the
100109100258SXin LI<code>-G</code>
100209100258SXin LIand
100309100258SXin LIFl V
100409100258SXin LIoptions.
1005*052d159aSCy Schubert</p></dd>
1006*052d159aSCy Schubert<dt><code>-i</code> <code>--ident</code>= <kbd>group</kbd></dt>
1007*052d159aSCy Schubert<dd><p>Set the optional Autokey group name to
100809100258SXin LI<kbd>group</kbd>.
100909100258SXin LIThis is used in the identity scheme parameter file names of
101009100258SXin LI<code>IFF</code>, <code>GQ</code>,
101109100258SXin LIand
101209100258SXin LI<code>MV</code>
101309100258SXin LIclient parameters files.
101409100258SXin LIIn that role, the default is the host name if no group is provided.
101509100258SXin LIThe group name, if specified using
101609100258SXin LI<code>-i</code>
101709100258SXin LIor
101809100258SXin LI<code>-s</code>
101909100258SXin LIfollowing an
1020*052d159aSCy Schubert&lsquo;@&rsquo;
102109100258SXin LIcharacter, is also used in certificate subject and issuer names in the form
102209100258SXin LI<kbd>host</kbd> <kbd>@</kbd> <kbd>group</kbd>
102309100258SXin LIand should match the group specified via
102409100258SXin LI<code>crypto</code> <code>ident</code>
102509100258SXin LIor
102609100258SXin LI<code>server</code> <code>ident</code>
102709100258SXin LIin the ntpd configuration file.
1028*052d159aSCy Schubert</p></dd>
1029*052d159aSCy Schubert<dt><code>-l</code> <code>--lifetime</code>= <kbd>days</kbd></dt>
1030*052d159aSCy Schubert<dd><p>Set the lifetime for certificate expiration to
103109100258SXin LI<kbd>days</kbd>.
103209100258SXin LIThe default lifetime is one year (365 days).
1033*052d159aSCy Schubert</p></dd>
1034*052d159aSCy Schubert<dt><code>-m</code> <code>--modulus</code>= <kbd>bits</kbd></dt>
1035*052d159aSCy Schubert<dd><p>Set the number of bits in the prime modulus for generating files to
103609100258SXin LI<kbd>bits</kbd>.
103709100258SXin LIThe modulus defaults to 512, but can be set from 256 to 2048 (32 to 256 octets).
103809100258SXin LIUse the larger moduli with caution, as this can consume considerable computing
103909100258SXin LIresources and increases the size of authenticated packets.
1040*052d159aSCy Schubert</p></dd>
1041*052d159aSCy Schubert<dt><code>-M</code> <code>--md5key</code></dt>
1042*052d159aSCy Schubert<dd><p>Generate a new symmetric keys file containing 10
104309100258SXin LI<code>MD5</code>
104409100258SXin LIkeys, and if OpenSSL is available, 10
104509100258SXin LI<code>SHA</code>
104609100258SXin LIkeys.
104709100258SXin LIAn
104809100258SXin LI<code>MD5</code>
104909100258SXin LIkey is a string of 20 random printable ASCII characters, while a
105009100258SXin LI<code>SHA</code>
105109100258SXin LIkey is a string of 40 random hex digits.
105209100258SXin LIThe file can be edited using a text editor to change the key type or key content.
105309100258SXin LIThis option is mutually exclusive with all other options.
1054*052d159aSCy Schubert</p></dd>
1055*052d159aSCy Schubert<dt><code>-p</code> <code>--password</code>= <kbd>passwd</kbd></dt>
1056*052d159aSCy Schubert<dd><p>Set the password for reading and writing encrypted files to
105709100258SXin LI<kbd>passwd</kbd>.
105809100258SXin LIThese include the host, sign and identify key files.
105909100258SXin LIBy default, the password is the string returned by the Unix
106009100258SXin LI<code>hostname</code>
106109100258SXin LIcommand.
1062*052d159aSCy Schubert</p></dd>
1063*052d159aSCy Schubert<dt><code>-P</code> <code>--pvt-cert</code></dt>
1064*052d159aSCy Schubert<dd><p>Generate a new private certificate used by the
106509100258SXin LI<code>PC</code>
106609100258SXin LIidentity scheme.
10672b15cb3dSCy SchubertBy default, the program generates public certificates.
106809100258SXin LINote: the PC identity scheme is not recommended for new installations.
1069*052d159aSCy Schubert</p></dd>
1070*052d159aSCy Schubert<dt><code>-q</code> <code>--export-passwd</code>= <kbd>passwd</kbd></dt>
1071*052d159aSCy Schubert<dd><p>Set the password for writing encrypted
107209100258SXin LI<code>IFF</code>, <code>GQ</code> <code>and</code> <code>MV</code>
107309100258SXin LIidentity files redirected to
1074*052d159aSCy Schubert<samp>stdout</samp>
107509100258SXin LIto
107609100258SXin LI<kbd>passwd</kbd>.
107709100258SXin LIIn effect, these files are decrypted with the
107809100258SXin LI<code>-p</code>
107909100258SXin LIpassword, then encrypted with the
108009100258SXin LI<code>-q</code>
108109100258SXin LIpassword.
108209100258SXin LIBy default, the password is the string returned by the Unix
108309100258SXin LI<code>hostname</code>
108409100258SXin LIcommand.
1085*052d159aSCy Schubert</p></dd>
1086*052d159aSCy Schubert<dt><code>-s</code> <code>--subject-key</code>= <code>[host]</code> <code>[@ <kbd>group</kbd>]</code></dt>
1087*052d159aSCy Schubert<dd><p>Specify the Autokey host name, where
108809100258SXin LI<kbd>host</kbd>
108909100258SXin LIis the optional host name and
109009100258SXin LI<kbd>group</kbd>
109109100258SXin LIis the optional group name.
109209100258SXin LIThe host name, and if provided, group name are used in
109309100258SXin LI<kbd>host</kbd> <kbd>@</kbd> <kbd>group</kbd>
109409100258SXin LIform as certificate subject and issuer.
109509100258SXin LISpecifying
109609100258SXin LI<code>-s</code> <code>-@</code> <kbd>group</kbd>
109709100258SXin LIis allowed, and results in leaving the host name unchanged, as with
109809100258SXin LI<code>-i</code> <kbd>group</kbd>.
109909100258SXin LIThe group name, or if no group is provided, the host name are also used in the
110009100258SXin LIfile names of
110109100258SXin LI<code>IFF</code>, <code>GQ</code>,
110209100258SXin LIand
110309100258SXin LI<code>MV</code>
110409100258SXin LIidentity scheme client parameter files.
110509100258SXin LIIf
110609100258SXin LI<kbd>host</kbd>
110709100258SXin LIis not specified, the default host name is the string returned by the Unix
110809100258SXin LI<code>hostname</code>
110909100258SXin LIcommand.
1110*052d159aSCy Schubert</p></dd>
1111*052d159aSCy Schubert<dt><code>-S</code> <code>--sign-key</code>= <code>[<code>RSA</code> | <code>DSA</code>]</code></dt>
1112*052d159aSCy Schubert<dd><p>Generate a new encrypted public/private sign key file of the specified type.
111309100258SXin LIBy default, the sign key is the host key and has the same type.
111409100258SXin LIIf compatibility with FIPS 140-2 is required, the sign key type must be
111509100258SXin LI<code>DSA</code>.
1116*052d159aSCy Schubert</p></dd>
1117*052d159aSCy Schubert<dt><code>-T</code> <code>--trusted-cert</code></dt>
1118*052d159aSCy Schubert<dd><p>Generate a trusted certificate.
11192b15cb3dSCy SchubertBy default, the program generates a non-trusted certificate.
1120*052d159aSCy Schubert</p></dd>
1121*052d159aSCy Schubert<dt><code>-V</code> <code>--mv-params</code> <kbd>nkeys</kbd></dt>
1122*052d159aSCy Schubert<dd><p>Generate
112309100258SXin LI<kbd>nkeys</kbd>
112409100258SXin LIencrypted server keys and parameters for the Mu-Varadharajan (MV)
112509100258SXin LIidentity scheme.
112609100258SXin LIThis option is mutually exclusive with the
112709100258SXin LI<code>-I</code>
112809100258SXin LIand
112909100258SXin LI<code>-G</code>
113009100258SXin LIoptions.
113109100258SXin LINote: support for this option should be considered a work in progress.
1132*052d159aSCy Schubert</p></dd>
11332b15cb3dSCy Schubert</dl>
11342b15cb3dSCy Schubert
1135*052d159aSCy Schubert<a name="Random-Seed-File-1"></a>
1136*052d159aSCy Schubert<h4 class="subsubsection">1.2.1.4 Random Seed File</h4>
11372b15cb3dSCy Schubert<p>All cryptographically sound key generation schemes must have means
11382b15cb3dSCy Schubertto randomize the entropy seed used to initialize
11392b15cb3dSCy Schubertthe internal pseudo-random number generator used
11402b15cb3dSCy Schubertby the library routines.
11412b15cb3dSCy SchubertThe OpenSSL library uses a designated random seed file for this purpose.
11422b15cb3dSCy SchubertThe file must be available when starting the NTP daemon and
11432b15cb3dSCy Schubert<code>ntp-keygen</code>
11442b15cb3dSCy Schubertprogram.
11452b15cb3dSCy SchubertIf a site supports OpenSSL or its companion OpenSSH,
11462b15cb3dSCy Schubertit is very likely that means to do this are already available.
1147*052d159aSCy Schubert</p>
11482b15cb3dSCy Schubert<p>It is important to understand that entropy must be evolved
11492b15cb3dSCy Schubertfor each generation, for otherwise the random number sequence
11502b15cb3dSCy Schubertwould be predictable.
11512b15cb3dSCy SchubertVarious means dependent on external events, such as keystroke intervals,
11522b15cb3dSCy Schubertcan be used to do this and some systems have built-in entropy sources.
11532b15cb3dSCy SchubertSuitable means are described in the OpenSSL software documentation,
11542b15cb3dSCy Schubertbut are outside the scope of this page.
1155*052d159aSCy Schubert</p>
11562b15cb3dSCy Schubert<p>The entropy seed used by the OpenSSL library is contained in a file,
11572b15cb3dSCy Schubertusually called
1158*052d159aSCy Schubert<samp>.rnd</samp>,
11592b15cb3dSCy Schubertwhich must be available when starting the NTP daemon
11602b15cb3dSCy Schubertor the
11612b15cb3dSCy Schubert<code>ntp-keygen</code>
11622b15cb3dSCy Schubertprogram.
11632b15cb3dSCy SchubertThe NTP daemon will first look for the file
11642b15cb3dSCy Schubertusing the path specified by the
11652b15cb3dSCy Schubert<code>randfile</code>
11662b15cb3dSCy Schubertsubcommand of the
11672b15cb3dSCy Schubert<code>crypto</code>
11682b15cb3dSCy Schubertconfiguration command.
11692b15cb3dSCy SchubertIf not specified in this way, or when starting the
11702b15cb3dSCy Schubert<code>ntp-keygen</code>
11712b15cb3dSCy Schubertprogram,
11722b15cb3dSCy Schubertthe OpenSSL library will look for the file using the path specified
11732b15cb3dSCy Schubertby the
11742b15cb3dSCy Schubert.Ev RANDFILE
11752b15cb3dSCy Schubertenvironment variable in the user home directory,
11762b15cb3dSCy Schubertwhether root or some other user.
11772b15cb3dSCy SchubertIf the
11782b15cb3dSCy Schubert.Ev RANDFILE
11792b15cb3dSCy Schubertenvironment variable is not present,
11802b15cb3dSCy Schubertthe library will look for the
1181*052d159aSCy Schubert<samp>.rnd</samp>
11822b15cb3dSCy Schubertfile in the user home directory.
118309100258SXin LISince both the
118409100258SXin LI<code>ntp-keygen</code>
118509100258SXin LIprogram and
118609100258SXin LI<code>ntpd(1ntpdmdoc)</code>
118709100258SXin LIdaemon must run as root, the logical place to put this file is in
1188*052d159aSCy Schubert<samp>/.rnd</samp>
118909100258SXin LIor
1190*052d159aSCy Schubert<samp>/root/.rnd</samp>.
11912b15cb3dSCy SchubertIf the file is not available or cannot be written,
11922b15cb3dSCy Schubertthe daemon exits with a message to the system log and the program
11932b15cb3dSCy Schubertexits with a suitable error message.
1194*052d159aSCy Schubert</p>
1195*052d159aSCy Schubert<a name="Cryptographic-Data-Files-1"></a>
1196*052d159aSCy Schubert<h4 class="subsubsection">1.2.1.5 Cryptographic Data Files</h4>
119709100258SXin LI<p>All file formats begin with two nonencrypted lines.
119809100258SXin LIThe first line contains the file name, including the generated host name
119909100258SXin LIand filestamp, in the format
1200*052d159aSCy Schubert<samp>ntpkey_</samp><kbd>key</kbd> <kbd>_</kbd> <kbd>name</kbd>. <kbd>filestamp</kbd>,
120109100258SXin LIwhere
120209100258SXin LI<kbd>key</kbd>
120309100258SXin LIis the key or parameter type,
120409100258SXin LI<kbd>name</kbd>
120509100258SXin LIis the host or group name and
120609100258SXin LI<kbd>filestamp</kbd>
120709100258SXin LIis the filestamp (NTP seconds) when the file was created.
120809100258SXin LIBy convention,
120909100258SXin LI<kbd>key</kbd>
121009100258SXin LInames in generated file names include both upper and lower case
121109100258SXin LIcharacters, while
121209100258SXin LI<kbd>key</kbd>
121309100258SXin LInames in generated link names include only lower case characters.
121409100258SXin LIThe filestamp is not used in generated link names.
121509100258SXin LIThe second line contains the datestamp in conventional Unix
1216*052d159aSCy Schubert<samp>date</samp>
121709100258SXin LIformat.
121809100258SXin LILines beginning with
1219*052d159aSCy Schubert&lsquo;#&rsquo;
122009100258SXin LIare considered comments and ignored by the
12212b15cb3dSCy Schubert<code>ntp-keygen</code>
12222b15cb3dSCy Schubertprogram and
12232b15cb3dSCy Schubert<code>ntpd(1ntpdmdoc)</code>
12242b15cb3dSCy Schubertdaemon.
1225*052d159aSCy Schubert</p>
122609100258SXin LI<p>The remainder of the file contains cryptographic data, encoded first using ASN.1
122709100258SXin LIrules, then encrypted if necessary, and finally written in PEM-encoded
122809100258SXin LIprintable ASCII text, preceded and followed by MIME content identifier lines.
1229*052d159aSCy Schubert</p>
123009100258SXin LI<p>The format of the symmetric keys file, ordinarily named
1231*052d159aSCy Schubert<samp>ntp.keys</samp>,
123209100258SXin LIis somewhat different than the other files in the interest of backward compatibility.
123309100258SXin LIOrdinarily, the file is generated by this program, but it can be constructed
123409100258SXin LIand edited using an ordinary text editor.
1235*052d159aSCy Schubert</p><pre class="verbatim"># ntpkey_MD5key_bk.ntp.org.3595864945
123609100258SXin LI# Thu Dec 12 19:22:25 2013
123709100258SXin LI
1238*052d159aSCy Schubert1  MD5 L&quot;;Nw&lt;\`.I&lt;f4U0)247&quot;i  # MD5 key
1239*052d159aSCy Schubert2  MD5 &amp;&gt;l0%XXK9O'51VwV&lt;xq~  # MD5 key
124009100258SXin LI3  MD5 lb4zLW~d^!K:]RsD'qb6  # MD5 key
124109100258SXin LI4  MD5 Yue:tL[+vR)M\`n~bY,'?  # MD5 key
124209100258SXin LI5  MD5 B;fx'Kgr/&amp;4ZTbL6=RxA  # MD5 key
124309100258SXin LI6  MD5 4eYwa\`o@}3i@@@@V@@..R9!l  # MD5 key
124409100258SXin LI7  MD5 \`A.([h+;wTQ|xfi%Sn_!  # MD5 key
1245*052d159aSCy Schubert8  MD5 45:V,r4]l6y^JH6&quot;Sh?F  # MD5 key
124609100258SXin LI9  MD5 3-5vcn*6l29DS?Xdsg)*  # MD5 key
124709100258SXin LI10 MD5 2late4Me              # MD5 key
124809100258SXin LI11 SHA1 a27872d3030a9025b8446c751b4551a7629af65c  # SHA1 key
124909100258SXin LI12 SHA1 21bc3b4865dbb9e920902abdccb3e04ff97a5e74  # SHA1 key
125009100258SXin LI13 SHA1 2b7736fe24fef5ba85ae11594132ab5d6f6daba9  # SHA1 key
125109100258SXin LI14 SHA  a5332809c8878dd3a5b918819108a111509aeceb  # SHA  key
125209100258SXin LI15 MD2  2fe16c88c760ff2f16d4267e36c1aa6c926e6964  # MD2  key
125309100258SXin LI16 MD4  b2691811dc19cfc0e2f9bcacd74213f29812183d  # MD4  key
125409100258SXin LI17 MD5  e4d6735b8bdad58ec5ffcb087300a17f7fef1f7c  # MD5  key
125509100258SXin LI18 MDC2 a8d5e2315c025bf3a79174c87fbd10477de2eabc  # MDC2 key
125609100258SXin LI19 RIPEMD160 77ca332cafb30e3cafb174dcd5b80ded7ba9b3d2  # RIPEMD160 key
125709100258SXin LI20 AES128CMAC f92ff73eee86c1e7dc638d6489a04e4e555af878  # AES128CMAC key
1258*052d159aSCy Schubert</pre><div class="example">
125909100258SXin LI<pre class="example">Figure 1. Typical Symmetric Key File
1260*052d159aSCy Schubert</pre></div>
1261*052d159aSCy Schubert
126209100258SXin LI<p>Figure 1 shows a typical symmetric keys file used by the reference
126309100258SXin LIimplementation.
126409100258SXin LIFollowing the header the keys are entered one per line in the format
1265*052d159aSCy Schubert</p><div class="example">
12662b15cb3dSCy Schubert<pre class="example"><kbd>keyno</kbd> <kbd>type</kbd> <kbd>key</kbd>
1267*052d159aSCy Schubert</pre></div>
12682b15cb3dSCy Schubert<p>where
12692b15cb3dSCy Schubert<kbd>keyno</kbd>
12704e1ef62aSXin LIis a positive integer in the range 1-65535;
12712b15cb3dSCy Schubert<kbd>type</kbd>
127209100258SXin LIis the key type for the message digest algorithm, which in the absence of the
127309100258SXin LIOpenSSL library must be
127409100258SXin LI<code>MD5</code>
127509100258SXin LIto designate the MD5 message digest algorithm;
127609100258SXin LIif the OpenSSL library is installed, the key type can be any
127709100258SXin LImessage digest algorithm supported by that library;
127809100258SXin LIhowever, if compatibility with FIPS 140-2 is required,
127909100258SXin LIthe key type must be either
128009100258SXin LI<code>SHA</code>
128109100258SXin LIor
128209100258SXin LI<code>SHA1</code>;
12832b15cb3dSCy Schubert<kbd>key</kbd>
12842b15cb3dSCy Schubertis the key itself,
128509100258SXin LIwhich is a printable ASCII string 20 characters or less in length:
128609100258SXin LIeach character is chosen from the 93 printable characters
128709100258SXin LIin the range 0x21 through 0x7e (
1288*052d159aSCy Schubert&lsquo;&rsquo;!
128909100258SXin LIthrough
1290*052d159aSCy Schubert&lsquo;~&rsquo;
129109100258SXin LI) excluding space and the
1292*052d159aSCy Schubert&lsquo;#&rsquo;
129309100258SXin LIcharacter, and terminated by whitespace or a
1294*052d159aSCy Schubert&lsquo;#&rsquo;
12952b15cb3dSCy Schubertcharacter.
129609100258SXin LIAn OpenSSL key consists of a hex-encoded ASCII string of 40 characters, which
129709100258SXin LIis truncated as necessary.
1298*052d159aSCy Schubert</p>
12992b15cb3dSCy Schubert<p>Note that the keys used by the
13002b15cb3dSCy Schubert<code>ntpq(1ntpqmdoc)</code>
13012b15cb3dSCy Schubertand
13022b15cb3dSCy Schubert<code>ntpdc(1ntpdcmdoc)</code>
13032b15cb3dSCy Schubertprograms
13042b15cb3dSCy Schubertare checked against passwords requested by the programs
13052b15cb3dSCy Schubertand entered by hand, so it is generally appropriate to specify these keys
13062b15cb3dSCy Schubertin human readable ASCII format.
1307*052d159aSCy Schubert</p>
13082b15cb3dSCy Schubert<p>The
13092b15cb3dSCy Schubert<code>ntp-keygen</code>
131009100258SXin LIprogram generates a symmetric keys file
1311*052d159aSCy Schubert<samp>ntpkey_MD5key_</samp><kbd>hostname</kbd>. <kbd>filestamp</kbd>.
13122b15cb3dSCy SchubertSince the file contains private shared keys,
13132b15cb3dSCy Schubertit should be visible only to root and distributed by secure means
13142b15cb3dSCy Schubertto other subnet hosts.
13152b15cb3dSCy SchubertThe NTP daemon loads the file
1316*052d159aSCy Schubert<samp>ntp.keys</samp>,
13172b15cb3dSCy Schubertso
13182b15cb3dSCy Schubert<code>ntp-keygen</code>
13192b15cb3dSCy Schubertinstalls a soft link from this name to the generated file.
13202b15cb3dSCy SchubertSubsequently, similar soft links must be installed by manual
13212b15cb3dSCy Schubertor automated means on the other subnet hosts.
13222b15cb3dSCy SchubertWhile this file is not used with the Autokey Version 2 protocol,
13232b15cb3dSCy Schubertit is needed to authenticate some remote configuration commands
13242b15cb3dSCy Schubertused by the
13252b15cb3dSCy Schubert<code>ntpq(1ntpqmdoc)</code>
13262b15cb3dSCy Schubertand
13272b15cb3dSCy Schubert<code>ntpdc(1ntpdcmdoc)</code>
13282b15cb3dSCy Schubertutilities.
1329*052d159aSCy Schubert</p>
13302b15cb3dSCy Schubert<p>This section was generated by <strong>AutoGen</strong>,
13312b15cb3dSCy Schubertusing the <code>agtexi-cmd</code> template and the option descriptions for the <code>ntp-keygen</code> program.
13322b15cb3dSCy SchubertThis software is released under the NTP license, &lt;http://ntp.org/license&gt;.
1333*052d159aSCy Schubert</p>
1334*052d159aSCy Schubert<table class="menu" border="0" cellspacing="0">
1335*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-usage" accesskey="1">ntp-keygen usage</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">ntp-keygen help/usage (<samp>--help</samp>)
1336*052d159aSCy Schubert</td></tr>
1337*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-imbits" accesskey="2">ntp-keygen imbits</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">imbits option (-b)
1338*052d159aSCy Schubert</td></tr>
1339*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-certificate" accesskey="3">ntp-keygen certificate</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">certificate option (-c)
1340*052d159aSCy Schubert</td></tr>
1341*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-cipher" accesskey="4">ntp-keygen cipher</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">cipher option (-C)
1342*052d159aSCy Schubert</td></tr>
1343*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-id_002dkey" accesskey="5">ntp-keygen id-key</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">id-key option (-e)
1344*052d159aSCy Schubert</td></tr>
1345*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-gq_002dparams" accesskey="6">ntp-keygen gq-params</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">gq-params option (-G)
1346*052d159aSCy Schubert</td></tr>
1347*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-host_002dkey" accesskey="7">ntp-keygen host-key</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">host-key option (-H)
1348*052d159aSCy Schubert</td></tr>
1349*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-iffkey" accesskey="8">ntp-keygen iffkey</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">iffkey option (-I)
1350*052d159aSCy Schubert</td></tr>
1351*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-ident" accesskey="9">ntp-keygen ident</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">ident option (-i)
1352*052d159aSCy Schubert</td></tr>
1353*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-lifetime">ntp-keygen lifetime</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">lifetime option (-l)
1354*052d159aSCy Schubert</td></tr>
1355*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-modulus">ntp-keygen modulus</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">modulus option (-m)
1356*052d159aSCy Schubert</td></tr>
1357*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-md5key">ntp-keygen md5key</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">md5key option (-M)
1358*052d159aSCy Schubert</td></tr>
1359*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-pvt_002dcert">ntp-keygen pvt-cert</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">pvt-cert option (-P)
1360*052d159aSCy Schubert</td></tr>
1361*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-password">ntp-keygen password</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">password option (-p)
1362*052d159aSCy Schubert</td></tr>
1363*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-export_002dpasswd">ntp-keygen export-passwd</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">export-passwd option (-q)
1364*052d159aSCy Schubert</td></tr>
1365*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-subject_002dname">ntp-keygen subject-name</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">subject-name option (-s)
1366*052d159aSCy Schubert</td></tr>
1367*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-sign_002dkey">ntp-keygen sign-key</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">sign-key option (-S)
1368*052d159aSCy Schubert</td></tr>
1369*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-trusted_002dcert">ntp-keygen trusted-cert</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">trusted-cert option (-T)
1370*052d159aSCy Schubert</td></tr>
1371*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-mv_002dparams">ntp-keygen mv-params</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">mv-params option (-V)
1372*052d159aSCy Schubert</td></tr>
1373*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-mv_002dkeys">ntp-keygen mv-keys</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">mv-keys option (-v)
1374*052d159aSCy Schubert</td></tr>
1375*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-config">ntp-keygen config</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">presetting/configuring ntp-keygen
1376*052d159aSCy Schubert</td></tr>
1377*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-exit-status">ntp-keygen exit status</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">exit status
1378*052d159aSCy Schubert</td></tr>
1379*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-Usage">ntp-keygen Usage</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">Usage
1380*052d159aSCy Schubert</td></tr>
1381*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-Notes">ntp-keygen Notes</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">Notes
1382*052d159aSCy Schubert</td></tr>
1383*052d159aSCy Schubert<tr><td align="left" valign="top">&bull; <a href="#ntp_002dkeygen-Bugs">ntp-keygen Bugs</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">Bugs
1384*052d159aSCy Schubert</td></tr>
1385*052d159aSCy Schubert</table>
13862b15cb3dSCy Schubert
1387*052d159aSCy Schubert<hr>
1388*052d159aSCy Schubert<a name="ntp_002dkeygen-usage"></a>
1389*052d159aSCy Schubert<div class="header">
1390*052d159aSCy Schubert<p>
1391*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-imbits" accesskey="n" rel="next">ntp-keygen imbits</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> &nbsp; </p>
13922b15cb3dSCy Schubert</div>
1393*052d159aSCy Schubert<a name="ntp_002dkeygen-help_002fusage-_0028_002d_002dhelp_0029"></a>
1394*052d159aSCy Schubert<h4 class="subsection">1.2.2 ntp-keygen help/usage (<samp>--help</samp>)</h4>
1395*052d159aSCy Schubert<a name="index-ntp_002dkeygen-help"></a>
13962b15cb3dSCy Schubert
1397*052d159aSCy Schubert<p>This is the automatically generated usage text for ntp-keygen.
1398*052d159aSCy Schubert</p>
13992b15cb3dSCy Schubert<p>The text printed is the same whether selected with the <code>help</code> option
1400*052d159aSCy Schubert(<samp>--help</samp>) or the <code>more-help</code> option (<samp>--more-help</samp>).  <code>more-help</code> will print
14012b15cb3dSCy Schubertthe usage text by passing it through a pager program.
14022b15cb3dSCy Schubert<code>more-help</code> is disabled on platforms without a working
14032b15cb3dSCy Schubert<code>fork(2)</code> function.  The <code>PAGER</code> environment variable is
1404*052d159aSCy Schubertused to select the program, defaulting to <samp>more</samp>.  Both will exit
14052b15cb3dSCy Schubertwith a status code of 0.
1406*052d159aSCy Schubert</p>
1407*052d159aSCy Schubert<div class="example">
1408*052d159aSCy Schubert<pre class="example">ntp-keygen (ntp) - Create a NTP host key - Ver. 4.2.8p12
14092b15cb3dSCy SchubertUsage:  ntp-keygen [ -&lt;flag&gt; [&lt;val&gt;] | --&lt;name&gt;[{=| }&lt;val&gt;] ]...
14102b15cb3dSCy Schubert  Flg Arg Option-Name    Description
14112b15cb3dSCy Schubert   -b Num imbits         identity modulus bits
14122b15cb3dSCy Schubert                                - it must be in the range:
14132b15cb3dSCy Schubert                                  256 to 2048
14142b15cb3dSCy Schubert   -c Str certificate    certificate scheme
14152b15cb3dSCy Schubert   -C Str cipher         privatekey cipher
14162b15cb3dSCy Schubert   -d no  debug-level    Increase debug verbosity level
14172b15cb3dSCy Schubert                                - may appear multiple times
14182b15cb3dSCy Schubert   -D Num set-debug-level Set the debug verbosity level
14192b15cb3dSCy Schubert                                - may appear multiple times
14202b15cb3dSCy Schubert   -e no  id-key         Write IFF or GQ identity keys
14212b15cb3dSCy Schubert   -G no  gq-params      Generate GQ parameters and keys
14222b15cb3dSCy Schubert   -H no  host-key       generate RSA host key
14232b15cb3dSCy Schubert   -I no  iffkey         generate IFF parameters
14242b15cb3dSCy Schubert   -i Str ident          set Autokey group name
14252b15cb3dSCy Schubert   -l Num lifetime       set certificate lifetime
142609100258SXin LI   -m Num modulus        prime modulus
14272b15cb3dSCy Schubert                                - it must be in the range:
14282b15cb3dSCy Schubert                                  256 to 2048
142909100258SXin LI   -M no  md5key         generate symmetric keys
14302b15cb3dSCy Schubert   -P no  pvt-cert       generate PC private certificate
14312b15cb3dSCy Schubert   -p Str password       local private password
14322b15cb3dSCy Schubert   -q Str export-passwd  export IFF or GQ group keys with password
14332b15cb3dSCy Schubert   -s Str subject-name   set host and optionally group name
143409100258SXin LI   -S Str sign-key       generate sign key (RSA or DSA)
14352b15cb3dSCy Schubert   -T no  trusted-cert   trusted certificate (TC scheme)
14362b15cb3dSCy Schubert   -V Num mv-params      generate &lt;num&gt; MV parameters
14372b15cb3dSCy Schubert   -v Num mv-keys        update &lt;num&gt; MV keys
14382b15cb3dSCy Schubert      opt version        output version information and exit
14392b15cb3dSCy Schubert   -? no  help           display extended usage information and exit
14402b15cb3dSCy Schubert   -! no  more-help      extended usage information passed thru pager
14412b15cb3dSCy Schubert   -&gt; opt save-opts      save the option state to a config file
14422b15cb3dSCy Schubert   -&lt; Str load-opts      load options from a config file
14432b15cb3dSCy Schubert                                - disabled as '--no-load-opts'
14442b15cb3dSCy Schubert                                - may appear multiple times
14452b15cb3dSCy Schubert
14462b15cb3dSCy SchubertOptions are specified by doubled hyphens and their name or by a single
14472b15cb3dSCy Schuberthyphen and the flag character.
14482b15cb3dSCy Schubert
14492b15cb3dSCy Schubert
14502b15cb3dSCy SchubertThe following option preset mechanisms are supported:
14512b15cb3dSCy Schubert - reading file $HOME/.ntprc
14522b15cb3dSCy Schubert - reading file ./.ntprc
14532b15cb3dSCy Schubert - examining environment variables named NTP_KEYGEN_*
14542b15cb3dSCy Schubert
14552b15cb3dSCy SchubertPlease send bug reports to:  &lt;http://bugs.ntp.org, bugs@ntp.org&gt;
1456*052d159aSCy Schubert</pre></div>
1457*052d159aSCy Schubert
1458*052d159aSCy Schubert<hr>
1459*052d159aSCy Schubert<a name="ntp_002dkeygen-imbits"></a>
1460*052d159aSCy Schubert<div class="header">
1461*052d159aSCy Schubert<p>
1462*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-certificate" accesskey="n" rel="next">ntp-keygen certificate</a>, Previous: <a href="#ntp_002dkeygen-usage" accesskey="p" rel="prev">ntp-keygen usage</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> &nbsp; </p>
14632b15cb3dSCy Schubert</div>
1464*052d159aSCy Schubert<a name="imbits-option-_0028_002db_0029"></a>
1465*052d159aSCy Schubert<h4 class="subsection">1.2.3 imbits option (-b)</h4>
1466*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dimbits"></a>
14672b15cb3dSCy Schubert
1468*052d159aSCy Schubert<p>This is the &ldquo;identity modulus bits&rdquo; option.
1469*052d159aSCy SchubertThis option takes a number argument <samp>imbits</samp>.
1470*052d159aSCy Schubert</p>
1471*052d159aSCy Schubert<p>This option has some usage constraints.  It:
1472*052d159aSCy Schubert</p><ul>
14732b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation.
1474*052d159aSCy Schubert</li></ul>
14752b15cb3dSCy Schubert
14762b15cb3dSCy Schubert<p>The number of bits in the identity modulus.  The default is 256.
1477*052d159aSCy Schubert</p><hr>
1478*052d159aSCy Schubert<a name="ntp_002dkeygen-certificate"></a>
1479*052d159aSCy Schubert<div class="header">
1480*052d159aSCy Schubert<p>
1481*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-cipher" accesskey="n" rel="next">ntp-keygen cipher</a>, Previous: <a href="#ntp_002dkeygen-imbits" accesskey="p" rel="prev">ntp-keygen imbits</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> &nbsp; </p>
14822b15cb3dSCy Schubert</div>
1483*052d159aSCy Schubert<a name="certificate-option-_0028_002dc_0029"></a>
1484*052d159aSCy Schubert<h4 class="subsection">1.2.4 certificate option (-c)</h4>
1485*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dcertificate"></a>
14862b15cb3dSCy Schubert
1487*052d159aSCy Schubert<p>This is the &ldquo;certificate scheme&rdquo; option.
1488*052d159aSCy SchubertThis option takes a string argument <samp>scheme</samp>.
1489*052d159aSCy Schubert</p>
1490*052d159aSCy Schubert<p>This option has some usage constraints.  It:
1491*052d159aSCy Schubert</p><ul>
14922b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation.
1493*052d159aSCy Schubert</li></ul>
14942b15cb3dSCy Schubert
14952b15cb3dSCy Schubert<p>scheme is one of
149609100258SXin LIRSA-MD2, RSA-MD5, RSA-MDC2, RSA-SHA, RSA-SHA1, RSA-RIPEMD160,
14972b15cb3dSCy SchubertDSA-SHA, or DSA-SHA1.
1498*052d159aSCy Schubert</p>
149909100258SXin LI<p>Select the certificate signature encryption/message digest scheme.
15002b15cb3dSCy SchubertNote that RSA schemes must be used with a RSA sign key and DSA
15012b15cb3dSCy Schubertschemes must be used with a DSA sign key.  The default without
15022b15cb3dSCy Schubertthis option is RSA-MD5.
1503*052d159aSCy Schubert</p><hr>
1504*052d159aSCy Schubert<a name="ntp_002dkeygen-cipher"></a>
1505*052d159aSCy Schubert<div class="header">
1506*052d159aSCy Schubert<p>
1507*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-id_002dkey" accesskey="n" rel="next">ntp-keygen id-key</a>, Previous: <a href="#ntp_002dkeygen-certificate" accesskey="p" rel="prev">ntp-keygen certificate</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> &nbsp; </p>
15082b15cb3dSCy Schubert</div>
1509*052d159aSCy Schubert<a name="cipher-option-_0028_002dC_0029"></a>
1510*052d159aSCy Schubert<h4 class="subsection">1.2.5 cipher option (-C)</h4>
1511*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dcipher"></a>
15122b15cb3dSCy Schubert
1513*052d159aSCy Schubert<p>This is the &ldquo;privatekey cipher&rdquo; option.
1514*052d159aSCy SchubertThis option takes a string argument <samp>cipher</samp>.
1515*052d159aSCy Schubert</p>
1516*052d159aSCy Schubert<p>This option has some usage constraints.  It:
1517*052d159aSCy Schubert</p><ul>
15182b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation.
1519*052d159aSCy Schubert</li></ul>
15202b15cb3dSCy Schubert
15212b15cb3dSCy Schubert<p>Select the cipher which is used to encrypt the files containing
15222b15cb3dSCy Schubertprivate keys.  The default is three-key triple DES in CBC mode,
1523*052d159aSCy Schubertequivalent to &quot;<code>-C des-ede3-cbc</code>&quot;.  The openssl tool lists ciphers
1524*052d159aSCy Schubertavailable in &quot;<code>openssl -h</code>&quot; output.
1525*052d159aSCy Schubert</p><hr>
1526*052d159aSCy Schubert<a name="ntp_002dkeygen-id_002dkey"></a>
1527*052d159aSCy Schubert<div class="header">
1528*052d159aSCy Schubert<p>
1529*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-gq_002dparams" accesskey="n" rel="next">ntp-keygen gq-params</a>, Previous: <a href="#ntp_002dkeygen-cipher" accesskey="p" rel="prev">ntp-keygen cipher</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> &nbsp; </p>
15302b15cb3dSCy Schubert</div>
1531*052d159aSCy Schubert<a name="id_002dkey-option-_0028_002de_0029"></a>
1532*052d159aSCy Schubert<h4 class="subsection">1.2.6 id-key option (-e)</h4>
1533*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002did_002dkey"></a>
15342b15cb3dSCy Schubert
1535*052d159aSCy Schubert<p>This is the &ldquo;write iff or gq identity keys&rdquo; option.
1536*052d159aSCy Schubert</p>
1537*052d159aSCy Schubert<p>This option has some usage constraints.  It:
1538*052d159aSCy Schubert</p><ul>
15392b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation.
1540*052d159aSCy Schubert</li></ul>
15412b15cb3dSCy Schubert
154209100258SXin LI<p>Write the public parameters from the IFF or GQ client keys to
154309100258SXin LIthe standard output.
154409100258SXin LIThis is intended for automatic key distribution by email.
1545*052d159aSCy Schubert</p><hr>
1546*052d159aSCy Schubert<a name="ntp_002dkeygen-gq_002dparams"></a>
1547*052d159aSCy Schubert<div class="header">
1548*052d159aSCy Schubert<p>
1549*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-host_002dkey" accesskey="n" rel="next">ntp-keygen host-key</a>, Previous: <a href="#ntp_002dkeygen-id_002dkey" accesskey="p" rel="prev">ntp-keygen id-key</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> &nbsp; </p>
15502b15cb3dSCy Schubert</div>
1551*052d159aSCy Schubert<a name="gq_002dparams-option-_0028_002dG_0029"></a>
1552*052d159aSCy Schubert<h4 class="subsection">1.2.7 gq-params option (-G)</h4>
1553*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dgq_002dparams"></a>
15542b15cb3dSCy Schubert
1555*052d159aSCy Schubert<p>This is the &ldquo;generate gq parameters and keys&rdquo; option.
1556*052d159aSCy Schubert</p>
1557*052d159aSCy Schubert<p>This option has some usage constraints.  It:
1558*052d159aSCy Schubert</p><ul>
15592b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation.
1560*052d159aSCy Schubert</li></ul>
15612b15cb3dSCy Schubert
15622b15cb3dSCy Schubert<p>Generate parameters and keys for the GQ identification scheme,
15632b15cb3dSCy Schubertobsoleting any that may exist.
1564*052d159aSCy Schubert</p><hr>
1565*052d159aSCy Schubert<a name="ntp_002dkeygen-host_002dkey"></a>
1566*052d159aSCy Schubert<div class="header">
1567*052d159aSCy Schubert<p>
1568*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-iffkey" accesskey="n" rel="next">ntp-keygen iffkey</a>, Previous: <a href="#ntp_002dkeygen-gq_002dparams" accesskey="p" rel="prev">ntp-keygen gq-params</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> &nbsp; </p>
15692b15cb3dSCy Schubert</div>
1570*052d159aSCy Schubert<a name="host_002dkey-option-_0028_002dH_0029"></a>
1571*052d159aSCy Schubert<h4 class="subsection">1.2.8 host-key option (-H)</h4>
1572*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dhost_002dkey"></a>
15732b15cb3dSCy Schubert
1574*052d159aSCy Schubert<p>This is the &ldquo;generate rsa host key&rdquo; option.
1575*052d159aSCy Schubert</p>
1576*052d159aSCy Schubert<p>This option has some usage constraints.  It:
1577*052d159aSCy Schubert</p><ul>
15782b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation.
1579*052d159aSCy Schubert</li></ul>
15802b15cb3dSCy Schubert
15812b15cb3dSCy Schubert<p>Generate new host keys, obsoleting any that may exist.
1582*052d159aSCy Schubert</p><hr>
1583*052d159aSCy Schubert<a name="ntp_002dkeygen-iffkey"></a>
1584*052d159aSCy Schubert<div class="header">
1585*052d159aSCy Schubert<p>
1586*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-ident" accesskey="n" rel="next">ntp-keygen ident</a>, Previous: <a href="#ntp_002dkeygen-host_002dkey" accesskey="p" rel="prev">ntp-keygen host-key</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> &nbsp; </p>
15872b15cb3dSCy Schubert</div>
1588*052d159aSCy Schubert<a name="iffkey-option-_0028_002dI_0029"></a>
1589*052d159aSCy Schubert<h4 class="subsection">1.2.9 iffkey option (-I)</h4>
1590*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002diffkey"></a>
15912b15cb3dSCy Schubert
1592*052d159aSCy Schubert<p>This is the &ldquo;generate iff parameters&rdquo; option.
1593*052d159aSCy Schubert</p>
1594*052d159aSCy Schubert<p>This option has some usage constraints.  It:
1595*052d159aSCy Schubert</p><ul>
15962b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation.
1597*052d159aSCy Schubert</li></ul>
15982b15cb3dSCy Schubert
15992b15cb3dSCy Schubert<p>Generate parameters for the IFF identification scheme, obsoleting
16002b15cb3dSCy Schubertany that may exist.
1601*052d159aSCy Schubert</p><hr>
1602*052d159aSCy Schubert<a name="ntp_002dkeygen-ident"></a>
1603*052d159aSCy Schubert<div class="header">
1604*052d159aSCy Schubert<p>
1605*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-lifetime" accesskey="n" rel="next">ntp-keygen lifetime</a>, Previous: <a href="#ntp_002dkeygen-iffkey" accesskey="p" rel="prev">ntp-keygen iffkey</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> &nbsp; </p>
16062b15cb3dSCy Schubert</div>
1607*052d159aSCy Schubert<a name="ident-option-_0028_002di_0029"></a>
1608*052d159aSCy Schubert<h4 class="subsection">1.2.10 ident option (-i)</h4>
1609*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dident"></a>
16102b15cb3dSCy Schubert
1611*052d159aSCy Schubert<p>This is the &ldquo;set autokey group name&rdquo; option.
1612*052d159aSCy SchubertThis option takes a string argument <samp>group</samp>.
1613*052d159aSCy Schubert</p>
1614*052d159aSCy Schubert<p>This option has some usage constraints.  It:
1615*052d159aSCy Schubert</p><ul>
16162b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation.
1617*052d159aSCy Schubert</li></ul>
16182b15cb3dSCy Schubert
16192b15cb3dSCy Schubert<p>Set the optional Autokey group name to name.  This is used in
16202b15cb3dSCy Schubertthe file name of IFF, GQ, and MV client parameters files.  In
16212b15cb3dSCy Schubertthat role, the default is the host name if this option is not
16222b15cb3dSCy Schubertprovided.  The group name, if specified using <code>-i/--ident</code> or
1623*052d159aSCy Schubertusing <code>-s/--subject-name</code> following an &rsquo;<code>@</code>&rsquo; character,
162409100258SXin LIis also a part of the self-signed host certificate subject and
162509100258SXin LIissuer names in the form <code>host@group</code> and should match the
1626*052d159aSCy Schubert&rsquo;<code>crypto ident</code>&rsquo; or &rsquo;<code>server ident</code>&rsquo; configuration in the
162709100258SXin LI<code>ntpd</code> configuration file.
1628*052d159aSCy Schubert</p><hr>
1629*052d159aSCy Schubert<a name="ntp_002dkeygen-lifetime"></a>
1630*052d159aSCy Schubert<div class="header">
1631*052d159aSCy Schubert<p>
1632*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-modulus" accesskey="n" rel="next">ntp-keygen modulus</a>, Previous: <a href="#ntp_002dkeygen-ident" accesskey="p" rel="prev">ntp-keygen ident</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> &nbsp; </p>
16332b15cb3dSCy Schubert</div>
1634*052d159aSCy Schubert<a name="lifetime-option-_0028_002dl_0029"></a>
1635*052d159aSCy Schubert<h4 class="subsection">1.2.11 lifetime option (-l)</h4>
1636*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dlifetime"></a>
16372b15cb3dSCy Schubert
1638*052d159aSCy Schubert<p>This is the &ldquo;set certificate lifetime&rdquo; option.
1639*052d159aSCy SchubertThis option takes a number argument <samp>lifetime</samp>.
1640*052d159aSCy Schubert</p>
1641*052d159aSCy Schubert<p>This option has some usage constraints.  It:
1642*052d159aSCy Schubert</p><ul>
16432b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation.
1644*052d159aSCy Schubert</li></ul>
16452b15cb3dSCy Schubert
16462b15cb3dSCy Schubert<p>Set the certificate expiration to lifetime days from now.
1647*052d159aSCy Schubert</p><hr>
1648*052d159aSCy Schubert<a name="ntp_002dkeygen-modulus"></a>
1649*052d159aSCy Schubert<div class="header">
1650*052d159aSCy Schubert<p>
1651*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-md5key" accesskey="n" rel="next">ntp-keygen md5key</a>, Previous: <a href="#ntp_002dkeygen-lifetime" accesskey="p" rel="prev">ntp-keygen lifetime</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> &nbsp; </p>
16522b15cb3dSCy Schubert</div>
1653*052d159aSCy Schubert<a name="modulus-option-_0028_002dm_0029"></a>
1654*052d159aSCy Schubert<h4 class="subsection">1.2.12 modulus option (-m)</h4>
1655*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dmodulus"></a>
16562b15cb3dSCy Schubert
1657*052d159aSCy Schubert<p>This is the &ldquo;prime modulus&rdquo; option.
1658*052d159aSCy SchubertThis option takes a number argument <samp>modulus</samp>.
1659*052d159aSCy Schubert</p>
1660*052d159aSCy Schubert<p>This option has some usage constraints.  It:
1661*052d159aSCy Schubert</p><ul>
16622b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation.
1663*052d159aSCy Schubert</li></ul>
16642b15cb3dSCy Schubert
16652b15cb3dSCy Schubert<p>The number of bits in the prime modulus.  The default is 512.
1666*052d159aSCy Schubert</p><hr>
1667*052d159aSCy Schubert<a name="ntp_002dkeygen-md5key"></a>
1668*052d159aSCy Schubert<div class="header">
1669*052d159aSCy Schubert<p>
1670*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-pvt_002dcert" accesskey="n" rel="next">ntp-keygen pvt-cert</a>, Previous: <a href="#ntp_002dkeygen-modulus" accesskey="p" rel="prev">ntp-keygen modulus</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> &nbsp; </p>
16712b15cb3dSCy Schubert</div>
1672*052d159aSCy Schubert<a name="md5key-option-_0028_002dM_0029"></a>
1673*052d159aSCy Schubert<h4 class="subsection">1.2.13 md5key option (-M)</h4>
1674*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dmd5key"></a>
16752b15cb3dSCy Schubert
1676*052d159aSCy Schubert<p>This is the &ldquo;generate symmetric keys&rdquo; option.
167709100258SXin LIGenerate symmetric keys, obsoleting any that may exist.
1678*052d159aSCy Schubert</p><hr>
1679*052d159aSCy Schubert<a name="ntp_002dkeygen-pvt_002dcert"></a>
1680*052d159aSCy Schubert<div class="header">
1681*052d159aSCy Schubert<p>
1682*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-password" accesskey="n" rel="next">ntp-keygen password</a>, Previous: <a href="#ntp_002dkeygen-md5key" accesskey="p" rel="prev">ntp-keygen md5key</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> &nbsp; </p>
168309100258SXin LI</div>
1684*052d159aSCy Schubert<a name="pvt_002dcert-option-_0028_002dP_0029"></a>
1685*052d159aSCy Schubert<h4 class="subsection">1.2.14 pvt-cert option (-P)</h4>
1686*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dpvt_002dcert"></a>
168709100258SXin LI
1688*052d159aSCy Schubert<p>This is the &ldquo;generate pc private certificate&rdquo; option.
1689*052d159aSCy Schubert</p>
1690*052d159aSCy Schubert<p>This option has some usage constraints.  It:
1691*052d159aSCy Schubert</p><ul>
16922b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation.
1693*052d159aSCy Schubert</li></ul>
16942b15cb3dSCy Schubert
16952b15cb3dSCy Schubert<p>Generate a private certificate.  By default, the program generates
16962b15cb3dSCy Schubertpublic certificates.
1697*052d159aSCy Schubert</p><hr>
1698*052d159aSCy Schubert<a name="ntp_002dkeygen-password"></a>
1699*052d159aSCy Schubert<div class="header">
1700*052d159aSCy Schubert<p>
1701*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-export_002dpasswd" accesskey="n" rel="next">ntp-keygen export-passwd</a>, Previous: <a href="#ntp_002dkeygen-pvt_002dcert" accesskey="p" rel="prev">ntp-keygen pvt-cert</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> &nbsp; </p>
17022b15cb3dSCy Schubert</div>
1703*052d159aSCy Schubert<a name="password-option-_0028_002dp_0029"></a>
1704*052d159aSCy Schubert<h4 class="subsection">1.2.15 password option (-p)</h4>
1705*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dpassword"></a>
17062b15cb3dSCy Schubert
1707*052d159aSCy Schubert<p>This is the &ldquo;local private password&rdquo; option.
1708*052d159aSCy SchubertThis option takes a string argument <samp>passwd</samp>.
1709*052d159aSCy Schubert</p>
1710*052d159aSCy Schubert<p>This option has some usage constraints.  It:
1711*052d159aSCy Schubert</p><ul>
17122b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation.
1713*052d159aSCy Schubert</li></ul>
17142b15cb3dSCy Schubert
17152b15cb3dSCy Schubert<p>Local files containing private data are encrypted with the
17162b15cb3dSCy SchubertDES-CBC algorithm and the specified password.  The same password
1717*052d159aSCy Schubertmust be specified to the local ntpd via the &quot;crypto pw password&quot;
17182b15cb3dSCy Schubertconfiguration command.  The default password is the local
17192b15cb3dSCy Schuberthostname.
1720*052d159aSCy Schubert</p><hr>
1721*052d159aSCy Schubert<a name="ntp_002dkeygen-export_002dpasswd"></a>
1722*052d159aSCy Schubert<div class="header">
1723*052d159aSCy Schubert<p>
1724*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-subject_002dname" accesskey="n" rel="next">ntp-keygen subject-name</a>, Previous: <a href="#ntp_002dkeygen-password" accesskey="p" rel="prev">ntp-keygen password</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> &nbsp; </p>
17252b15cb3dSCy Schubert</div>
1726*052d159aSCy Schubert<a name="export_002dpasswd-option-_0028_002dq_0029"></a>
1727*052d159aSCy Schubert<h4 class="subsection">1.2.16 export-passwd option (-q)</h4>
1728*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dexport_002dpasswd"></a>
17292b15cb3dSCy Schubert
1730*052d159aSCy Schubert<p>This is the &ldquo;export iff or gq group keys with password&rdquo; option.
1731*052d159aSCy SchubertThis option takes a string argument <samp>passwd</samp>.
1732*052d159aSCy Schubert</p>
1733*052d159aSCy Schubert<p>This option has some usage constraints.  It:
1734*052d159aSCy Schubert</p><ul>
17352b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation.
1736*052d159aSCy Schubert</li></ul>
17372b15cb3dSCy Schubert
17382b15cb3dSCy Schubert<p>Export IFF or GQ identity group keys to the standard output,
17392b15cb3dSCy Schubertencrypted with the DES-CBC algorithm and the specified password.
17402b15cb3dSCy SchubertThe same password must be specified to the remote ntpd via the
1741*052d159aSCy Schubert&quot;crypto pw password&quot; configuration command.  See also the option
174209100258SXin LI&ndash;id-key (-e) for unencrypted exports.
1743*052d159aSCy Schubert</p><hr>
1744*052d159aSCy Schubert<a name="ntp_002dkeygen-subject_002dname"></a>
1745*052d159aSCy Schubert<div class="header">
1746*052d159aSCy Schubert<p>
1747*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-sign_002dkey" accesskey="n" rel="next">ntp-keygen sign-key</a>, Previous: <a href="#ntp_002dkeygen-export_002dpasswd" accesskey="p" rel="prev">ntp-keygen export-passwd</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> &nbsp; </p>
17482b15cb3dSCy Schubert</div>
1749*052d159aSCy Schubert<a name="subject_002dname-option-_0028_002ds_0029"></a>
1750*052d159aSCy Schubert<h4 class="subsection">1.2.17 subject-name option (-s)</h4>
1751*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dsubject_002dname"></a>
17522b15cb3dSCy Schubert
1753*052d159aSCy Schubert<p>This is the &ldquo;set host and optionally group name&rdquo; option.
1754*052d159aSCy SchubertThis option takes a string argument <samp>host@group</samp>.
1755*052d159aSCy Schubert</p>
1756*052d159aSCy Schubert<p>This option has some usage constraints.  It:
1757*052d159aSCy Schubert</p><ul>
175809100258SXin LI<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation.
1759*052d159aSCy Schubert</li></ul>
176009100258SXin LI
176109100258SXin LI<p>Set the Autokey host name, and optionally, group name specified
1762*052d159aSCy Schubertfollowing an &rsquo;<code>@</code>&rsquo; character.  The host name is used in the file
176309100258SXin LIname of generated host and signing certificates, without the
176409100258SXin LIgroup name.  The host name, and if provided, group name are used
176509100258SXin LIin <code>host@group</code> form for the host certificate subject and issuer
1766*052d159aSCy Schubertfields.  Specifying &rsquo;<code>-s @group</code>&rsquo; is allowed, and results in
176709100258SXin LIleaving the host name unchanged while appending <code>@group</code> to the
176809100258SXin LIsubject and issuer fields, as with <code>-i group</code>.  The group name, or
176909100258SXin LIif not provided, the host name are also used in the file names
177009100258SXin LIof IFF, GQ, and MV client parameter files.
1771*052d159aSCy Schubert</p><hr>
1772*052d159aSCy Schubert<a name="ntp_002dkeygen-sign_002dkey"></a>
1773*052d159aSCy Schubert<div class="header">
1774*052d159aSCy Schubert<p>
1775*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-trusted_002dcert" accesskey="n" rel="next">ntp-keygen trusted-cert</a>, Previous: <a href="#ntp_002dkeygen-subject_002dname" accesskey="p" rel="prev">ntp-keygen subject-name</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> &nbsp; </p>
177609100258SXin LI</div>
1777*052d159aSCy Schubert<a name="sign_002dkey-option-_0028_002dS_0029"></a>
1778*052d159aSCy Schubert<h4 class="subsection">1.2.18 sign-key option (-S)</h4>
1779*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dsign_002dkey"></a>
178009100258SXin LI
1781*052d159aSCy Schubert<p>This is the &ldquo;generate sign key (rsa or dsa)&rdquo; option.
1782*052d159aSCy SchubertThis option takes a string argument <samp>sign</samp>.
1783*052d159aSCy Schubert</p>
1784*052d159aSCy Schubert<p>This option has some usage constraints.  It:
1785*052d159aSCy Schubert</p><ul>
17862b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation.
1787*052d159aSCy Schubert</li></ul>
17882b15cb3dSCy Schubert
17892b15cb3dSCy Schubert<p>Generate a new sign key of the designated type, obsoleting any
17902b15cb3dSCy Schubertthat may exist.  By default, the program uses the host key as the
17912b15cb3dSCy Schubertsign key.
1792*052d159aSCy Schubert</p><hr>
1793*052d159aSCy Schubert<a name="ntp_002dkeygen-trusted_002dcert"></a>
1794*052d159aSCy Schubert<div class="header">
1795*052d159aSCy Schubert<p>
1796*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-mv_002dparams" accesskey="n" rel="next">ntp-keygen mv-params</a>, Previous: <a href="#ntp_002dkeygen-sign_002dkey" accesskey="p" rel="prev">ntp-keygen sign-key</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> &nbsp; </p>
17972b15cb3dSCy Schubert</div>
1798*052d159aSCy Schubert<a name="trusted_002dcert-option-_0028_002dT_0029"></a>
1799*052d159aSCy Schubert<h4 class="subsection">1.2.19 trusted-cert option (-T)</h4>
1800*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dtrusted_002dcert"></a>
18012b15cb3dSCy Schubert
1802*052d159aSCy Schubert<p>This is the &ldquo;trusted certificate (tc scheme)&rdquo; option.
1803*052d159aSCy Schubert</p>
1804*052d159aSCy Schubert<p>This option has some usage constraints.  It:
1805*052d159aSCy Schubert</p><ul>
18062b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation.
1807*052d159aSCy Schubert</li></ul>
18082b15cb3dSCy Schubert
18092b15cb3dSCy Schubert<p>Generate a trusted certificate.  By default, the program generates
18102b15cb3dSCy Schuberta non-trusted certificate.
1811*052d159aSCy Schubert</p><hr>
1812*052d159aSCy Schubert<a name="ntp_002dkeygen-mv_002dparams"></a>
1813*052d159aSCy Schubert<div class="header">
1814*052d159aSCy Schubert<p>
1815*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-mv_002dkeys" accesskey="n" rel="next">ntp-keygen mv-keys</a>, Previous: <a href="#ntp_002dkeygen-trusted_002dcert" accesskey="p" rel="prev">ntp-keygen trusted-cert</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> &nbsp; </p>
18162b15cb3dSCy Schubert</div>
1817*052d159aSCy Schubert<a name="mv_002dparams-option-_0028_002dV_0029"></a>
1818*052d159aSCy Schubert<h4 class="subsection">1.2.20 mv-params option (-V)</h4>
1819*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dmv_002dparams"></a>
18202b15cb3dSCy Schubert
1821*052d159aSCy Schubert<p>This is the &ldquo;generate &lt;num&gt; mv parameters&rdquo; option.
1822*052d159aSCy SchubertThis option takes a number argument <samp>num</samp>.
1823*052d159aSCy Schubert</p>
1824*052d159aSCy Schubert<p>This option has some usage constraints.  It:
1825*052d159aSCy Schubert</p><ul>
18262b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation.
1827*052d159aSCy Schubert</li></ul>
18282b15cb3dSCy Schubert
18292b15cb3dSCy Schubert<p>Generate parameters and keys for the Mu-Varadharajan (MV)
18302b15cb3dSCy Schubertidentification scheme.
1831*052d159aSCy Schubert</p><hr>
1832*052d159aSCy Schubert<a name="ntp_002dkeygen-mv_002dkeys"></a>
1833*052d159aSCy Schubert<div class="header">
1834*052d159aSCy Schubert<p>
1835*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-config" accesskey="n" rel="next">ntp-keygen config</a>, Previous: <a href="#ntp_002dkeygen-mv_002dparams" accesskey="p" rel="prev">ntp-keygen mv-params</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> &nbsp; </p>
18362b15cb3dSCy Schubert</div>
1837*052d159aSCy Schubert<a name="mv_002dkeys-option-_0028_002dv_0029"></a>
1838*052d159aSCy Schubert<h4 class="subsection">1.2.21 mv-keys option (-v)</h4>
1839*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dmv_002dkeys"></a>
18402b15cb3dSCy Schubert
1841*052d159aSCy Schubert<p>This is the &ldquo;update &lt;num&gt; mv keys&rdquo; option.
1842*052d159aSCy SchubertThis option takes a number argument <samp>num</samp>.
1843*052d159aSCy Schubert</p>
1844*052d159aSCy Schubert<p>This option has some usage constraints.  It:
1845*052d159aSCy Schubert</p><ul>
18462b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation.
1847*052d159aSCy Schubert</li></ul>
18482b15cb3dSCy Schubert
1849*052d159aSCy Schubert<p>This option has no &lsquo;<samp>doc</samp>&rsquo; documentation.
1850*052d159aSCy Schubert</p>
18512b15cb3dSCy Schubert
1852*052d159aSCy Schubert<hr>
1853*052d159aSCy Schubert<a name="ntp_002dkeygen-config"></a>
1854*052d159aSCy Schubert<div class="header">
1855*052d159aSCy Schubert<p>
1856*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-exit-status" accesskey="n" rel="next">ntp-keygen exit status</a>, Previous: <a href="#ntp_002dkeygen-mv_002dkeys" accesskey="p" rel="prev">ntp-keygen mv-keys</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> &nbsp; </p>
18572b15cb3dSCy Schubert</div>
1858*052d159aSCy Schubert<a name="presetting_002fconfiguring-ntp_002dkeygen"></a>
1859*052d159aSCy Schubert<h4 class="subsection">1.2.22 presetting/configuring ntp-keygen</h4>
18602b15cb3dSCy Schubert
18612b15cb3dSCy Schubert<p>Any option that is not marked as <i>not presettable</i> may be preset by
1862*052d159aSCy Schubertloading values from configuration (&quot;rc&quot; or &quot;ini&quot;) files, and values from environment variables named <code>NTP-KEYGEN</code> and <code>NTP-KEYGEN_&lt;OPTION_NAME&gt;</code>.  <code>&lt;OPTION_NAME&gt;</code> must be one of
18632b15cb3dSCy Schubertthe options listed above in upper case and segmented with underscores.
18642b15cb3dSCy SchubertThe <code>NTP-KEYGEN</code> variable will be tokenized and parsed like
18652b15cb3dSCy Schubertthe command line.  The remaining variables are tested for existence and their
18662b15cb3dSCy Schubertvalues are treated like option arguments.
1867*052d159aSCy Schubert</p>
18682b15cb3dSCy Schubert
1869*052d159aSCy Schubert<p><code>libopts</code> will search in 2 places for configuration files:
1870*052d159aSCy Schubert</p><ul>
18712b15cb3dSCy Schubert<li> $HOME
1872*052d159aSCy Schubert</li><li> $PWD
1873*052d159aSCy Schubert</li></ul>
1874*052d159aSCy Schubert<p>The environment variables <code>HOME</code>, and <code>PWD</code>
1875*052d159aSCy Schubertare expanded and replaced when <samp>ntp-keygen</samp> runs.
18762b15cb3dSCy SchubertFor any of these that are plain files, they are simply processed.
1877*052d159aSCy SchubertFor any that are directories, then a file named <samp>.ntprc</samp> is searched for
18782b15cb3dSCy Schubertwithin that directory and processed.
1879*052d159aSCy Schubert</p>
18802b15cb3dSCy Schubert<p>Configuration files may be in a wide variety of formats.
18812b15cb3dSCy SchubertThe basic format is an option name followed by a value (argument) on the
18822b15cb3dSCy Schubertsame line.  Values may be separated from the option name with a colon,
18832b15cb3dSCy Schubertequal sign or simply white space.  Values may be continued across multiple
18842b15cb3dSCy Schubertlines by escaping the newline with a backslash.
1885*052d159aSCy Schubert</p>
18862b15cb3dSCy Schubert<p>Multiple programs may also share the same initialization file.
18872b15cb3dSCy SchubertCommon options are collected at the top, followed by program specific
18882b15cb3dSCy Schubertsegments.  The segments are separated by lines like:
1889*052d159aSCy Schubert</p><div class="example">
18902b15cb3dSCy Schubert<pre class="example">[NTP-KEYGEN]
1891*052d159aSCy Schubert</pre></div>
1892*052d159aSCy Schubert<p>or by
1893*052d159aSCy Schubert</p><div class="example">
18942b15cb3dSCy Schubert<pre class="example">&lt;?program ntp-keygen&gt;
1895*052d159aSCy Schubert</pre></div>
1896*052d159aSCy Schubert<p>Do not mix these styles within one configuration file.
1897*052d159aSCy Schubert</p>
18982b15cb3dSCy Schubert<p>Compound values and carefully constructed string values may also be
18992b15cb3dSCy Schubertspecified using XML syntax:
1900*052d159aSCy Schubert</p><div class="example">
19012b15cb3dSCy Schubert<pre class="example">&lt;option-name&gt;
19022b15cb3dSCy Schubert   &lt;sub-opt&gt;...&amp;lt;...&amp;gt;...&lt;/sub-opt&gt;
19032b15cb3dSCy Schubert&lt;/option-name&gt;
1904*052d159aSCy Schubert</pre></div>
1905*052d159aSCy Schubert<p>yielding an <code>option-name.sub-opt</code> string value of
1906*052d159aSCy Schubert</p><div class="example">
1907*052d159aSCy Schubert<pre class="example">&quot;...&lt;...&gt;...&quot;
1908*052d159aSCy Schubert</pre></div>
19092b15cb3dSCy Schubert<p><code>AutoOpts</code> does not track suboptions.  You simply note that it is a
19102b15cb3dSCy Schuberthierarchicly valued option.  <code>AutoOpts</code> does provide a means for searching
19112b15cb3dSCy Schubertthe associated name/value pair list (see: optionFindValue).
1912*052d159aSCy Schubert</p>
19132b15cb3dSCy Schubert<p>The command line options relating to configuration and/or usage help are:
1914*052d159aSCy Schubert</p>
1915*052d159aSCy Schubert<a name="version-_0028_002d_0029"></a>
1916*052d159aSCy Schubert<h4 class="subsubheading">version (-)</h4>
19172b15cb3dSCy Schubert
19182b15cb3dSCy Schubert<p>Print the program version to standard out, optionally with licensing
19192b15cb3dSCy Schubertinformation, then exit 0.  The optional argument specifies how much licensing
19202b15cb3dSCy Schubertdetail to provide.  The default is to print just the version.  The licensing infomation may be selected with an option argument.
19212b15cb3dSCy SchubertOnly the first letter of the argument is examined:
1922*052d159aSCy Schubert</p>
1923*052d159aSCy Schubert<dl compact="compact">
1924*052d159aSCy Schubert<dt>&lsquo;<samp>version</samp>&rsquo;</dt>
1925*052d159aSCy Schubert<dd><p>Only print the version.  This is the default.
1926*052d159aSCy Schubert</p></dd>
1927*052d159aSCy Schubert<dt>&lsquo;<samp>copyright</samp>&rsquo;</dt>
1928*052d159aSCy Schubert<dd><p>Name the copyright usage licensing terms.
1929*052d159aSCy Schubert</p></dd>
1930*052d159aSCy Schubert<dt>&lsquo;<samp>verbose</samp>&rsquo;</dt>
1931*052d159aSCy Schubert<dd><p>Print the full copyright usage licensing terms.
1932*052d159aSCy Schubert</p></dd>
19332b15cb3dSCy Schubert</dl>
19342b15cb3dSCy Schubert
1935*052d159aSCy Schubert<hr>
1936*052d159aSCy Schubert<a name="ntp_002dkeygen-exit-status"></a>
1937*052d159aSCy Schubert<div class="header">
1938*052d159aSCy Schubert<p>
1939*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-Usage" accesskey="n" rel="next">ntp-keygen Usage</a>, Previous: <a href="#ntp_002dkeygen-config" accesskey="p" rel="prev">ntp-keygen config</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> &nbsp; </p>
19402b15cb3dSCy Schubert</div>
1941*052d159aSCy Schubert<a name="ntp_002dkeygen-exit-status-1"></a>
1942*052d159aSCy Schubert<h4 class="subsection">1.2.23 ntp-keygen exit status</h4>
19432b15cb3dSCy Schubert
19442b15cb3dSCy Schubert<p>One of the following exit values will be returned:
1945*052d159aSCy Schubert</p><dl compact="compact">
1946*052d159aSCy Schubert<dt>&lsquo;<samp>0 (EXIT_SUCCESS)</samp>&rsquo;</dt>
1947*052d159aSCy Schubert<dd><p>Successful program execution.
1948*052d159aSCy Schubert</p></dd>
1949*052d159aSCy Schubert<dt>&lsquo;<samp>1 (EXIT_FAILURE)</samp>&rsquo;</dt>
1950*052d159aSCy Schubert<dd><p>The operation failed or the command syntax was not valid.
1951*052d159aSCy Schubert</p></dd>
1952*052d159aSCy Schubert<dt>&lsquo;<samp>66 (EX_NOINPUT)</samp>&rsquo;</dt>
1953*052d159aSCy Schubert<dd><p>A specified configuration file could not be loaded.
1954*052d159aSCy Schubert</p></dd>
1955*052d159aSCy Schubert<dt>&lsquo;<samp>70 (EX_SOFTWARE)</samp>&rsquo;</dt>
1956*052d159aSCy Schubert<dd><p>libopts had an internal operational error.  Please report
19572b15cb3dSCy Schubertit to autogen-users@lists.sourceforge.net.  Thank you.
1958*052d159aSCy Schubert</p></dd>
19592b15cb3dSCy Schubert</dl>
1960*052d159aSCy Schubert<hr>
1961*052d159aSCy Schubert<a name="ntp_002dkeygen-Usage"></a>
1962*052d159aSCy Schubert<div class="header">
1963*052d159aSCy Schubert<p>
1964*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-Notes" accesskey="n" rel="next">ntp-keygen Notes</a>, Previous: <a href="#ntp_002dkeygen-exit-status" accesskey="p" rel="prev">ntp-keygen exit status</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> &nbsp; </p>
19652b15cb3dSCy Schubert</div>
1966*052d159aSCy Schubert<a name="ntp_002dkeygen-Usage-1"></a>
1967*052d159aSCy Schubert<h4 class="subsection">1.2.24 ntp-keygen Usage</h4>
1968*052d159aSCy Schubert<hr>
1969*052d159aSCy Schubert<a name="ntp_002dkeygen-Notes"></a>
1970*052d159aSCy Schubert<div class="header">
1971*052d159aSCy Schubert<p>
1972*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-Bugs" accesskey="n" rel="next">ntp-keygen Bugs</a>, Previous: <a href="#ntp_002dkeygen-Usage" accesskey="p" rel="prev">ntp-keygen Usage</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> &nbsp; </p>
19732b15cb3dSCy Schubert</div>
1974*052d159aSCy Schubert<a name="ntp_002dkeygen-Notes-1"></a>
1975*052d159aSCy Schubert<h4 class="subsection">1.2.25 ntp-keygen Notes</h4>
1976*052d159aSCy Schubert<hr>
1977*052d159aSCy Schubert<a name="ntp_002dkeygen-Bugs"></a>
1978*052d159aSCy Schubert<div class="header">
1979*052d159aSCy Schubert<p>
1980*052d159aSCy SchubertPrevious: <a href="#ntp_002dkeygen-Notes" accesskey="p" rel="prev">ntp-keygen Notes</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> &nbsp; </p>
19812b15cb3dSCy Schubert</div>
1982*052d159aSCy Schubert<a name="ntp_002dkeygen-Bugs-1"></a>
1983*052d159aSCy Schubert<h4 class="subsection">1.2.26 ntp-keygen Bugs</h4>
19842b15cb3dSCy Schubert
1985*052d159aSCy Schubert<hr>
1986*052d159aSCy Schubert<a name="Random-Seed-File"></a>
1987*052d159aSCy Schubert<div class="header">
1988*052d159aSCy Schubert<p>
1989*052d159aSCy SchubertNext: <a href="#Cryptographic-Data-Files" accesskey="n" rel="next">Cryptographic Data Files</a>, Previous: <a href="#Running-the-Program" accesskey="p" rel="prev">Running the Program</a>, Up: <a href="#Top" accesskey="u" rel="up">Top</a> &nbsp; </p>
19902b15cb3dSCy Schubert</div>
1991*052d159aSCy Schubert<a name="Random-Seed-File-2"></a>
1992*052d159aSCy Schubert<h3 class="section">1.3 Random Seed File</h3>
19932b15cb3dSCy Schubert
19942b15cb3dSCy Schubert<p>All cryptographically sound key generation schemes must have means to
19952b15cb3dSCy Schubertrandomize the entropy seed used to initialize the internal
19962b15cb3dSCy Schubertpseudo-random number generator used by the OpenSSL library routines.
19972b15cb3dSCy SchubertIf a site supports ssh, it is very likely that means to do this are
19982b15cb3dSCy Schubertalready available.
19992b15cb3dSCy SchubertThe entropy seed used by the OpenSSL library is contained in a file,
20002b15cb3dSCy Schubertusually called <code>.rnd</code>, which must be available when
20012b15cb3dSCy Schubertstarting the <code>ntp-keygen</code> program or <code>ntpd</code> daemon.
2002*052d159aSCy Schubert</p>
20032b15cb3dSCy Schubert<p>The OpenSSL library looks for the file using the path specified by the
20042b15cb3dSCy Schubert<code>RANDFILE</code> environment variable in the user home directory, whether root
20052b15cb3dSCy Schubertor some other user.
20062b15cb3dSCy SchubertIf the <code>RANDFILE</code> environment variable is not
20072b15cb3dSCy Schubertpresent, the library looks for the <code>.rnd</code> file in the user home
20082b15cb3dSCy Schubertdirectory.
20092b15cb3dSCy SchubertSince both the <code>ntp-keygen</code> program and <code>ntpd</code> daemon must run
20102b15cb3dSCy Schubertas root, the logical place to put this file is in <code>/.rnd</code> or
20112b15cb3dSCy Schubert<code>/root/.rnd</code>.
20122b15cb3dSCy SchubertIf the file is not available or cannot be written, the program exits
20132b15cb3dSCy Schubertwith a message to the system log.
2014*052d159aSCy Schubert</p>
2015*052d159aSCy Schubert<hr>
2016*052d159aSCy Schubert<a name="Cryptographic-Data-Files"></a>
2017*052d159aSCy Schubert<div class="header">
2018*052d159aSCy Schubert<p>
2019*052d159aSCy SchubertPrevious: <a href="#Random-Seed-File" accesskey="p" rel="prev">Random Seed File</a>, Up: <a href="#Top" accesskey="u" rel="up">Top</a> &nbsp; </p>
20202b15cb3dSCy Schubert</div>
2021*052d159aSCy Schubert<a name="Cryptographic-Data-Files-2"></a>
2022*052d159aSCy Schubert<h3 class="section">1.4 Cryptographic Data Files</h3>
20232b15cb3dSCy Schubert
20242b15cb3dSCy Schubert<p>File and link names are in the <code>form ntpkey_key_name.fstamp</code>,
20252b15cb3dSCy Schubertwhere <code>key</code> is the key or parameter type,
20262b15cb3dSCy Schubert<code>name</code> is the host or group name and
20272b15cb3dSCy Schubert<code>fstamp</code> is the filestamp (NTP seconds) when the file was created).
20282b15cb3dSCy SchubertBy convention, key names in generated file names include both upper and
20292b15cb3dSCy Schubertlower case characters, while key names in generated link names include
20302b15cb3dSCy Schubertonly lower case characters. The filestamp is not used in generated link
20312b15cb3dSCy Schubertnames.
2032*052d159aSCy Schubert</p>
20332b15cb3dSCy Schubert<p>The key name is a string defining the cryptographic key type.
20342b15cb3dSCy SchubertKey types include public/private keys host and sign, certificate cert
20352b15cb3dSCy Schubertand several challenge/response key types.
20362b15cb3dSCy SchubertBy convention, client files used for
20372b15cb3dSCy Schubertchallenges have a par subtype, as in the IFF challenge IFFpar, while
20382b15cb3dSCy Schubertserver files for responses have a key subtype, as in the GQ response
20392b15cb3dSCy SchubertGQkey.
2040*052d159aSCy Schubert</p>
20412b15cb3dSCy Schubert<p>All files begin with two nonencrypted lines. The first line contains
20422b15cb3dSCy Schubertthe file name in the format <code>ntpkey_key_host.fstamp</code>.
20432b15cb3dSCy SchubertThe second line contains the datestamp in conventional Unix date format.
20442b15cb3dSCy SchubertLines beginning with <code>#</code> are ignored.
2045*052d159aSCy Schubert</p>
20462b15cb3dSCy Schubert<p>The remainder of the file contains cryptographic data encoded first
20472b15cb3dSCy Schubertusing ASN.1 rules, then encrypted using the DES-CBC algorithm with
20482b15cb3dSCy Schubertgiven password and finally written in PEM-encoded printable ASCII text
20492b15cb3dSCy Schubertpreceded and followed by MIME content identifier lines.
2050*052d159aSCy Schubert</p>
20512b15cb3dSCy Schubert<p>The format of the symmetric keys file, ordinarily named <code>ntp.keys</code>,
20522b15cb3dSCy Schubertis somewhat different than the other files in the interest of backward
20532b15cb3dSCy Schubertcompatibility.
20542b15cb3dSCy SchubertOrdinarily, the file is generated by this program, but
20552b15cb3dSCy Schubertit can be constructed and edited using an ordinary text editor.
2056*052d159aSCy Schubert</p>
2057*052d159aSCy Schubert<div class="example">
20582b15cb3dSCy Schubert<pre class="example"># ntpkey_MD5key_hms.local.3564038757
20592b15cb3dSCy Schubert# Sun Dec  9 02:45:57 2012
20602b15cb3dSCy Schubert
2061*052d159aSCy Schubert 1 MD5 &quot;]!ghT%O;3)WJ,/Nc:&gt;I  # MD5 key
20622b15cb3dSCy Schubert 2 MD5 lu+H^tF46BKR-6~pV_5  # MD5 key
20632b15cb3dSCy Schubert 3 MD5 :lnoVsE%Yz*avh%EtNC  # MD5 key
2064*052d159aSCy Schubert 4 MD5 |fdZrf0sF~;w-i^V  # MD5 key
2065*052d159aSCy Schubert 5 MD5 IyAG&gt;O&quot;y&quot;LmCRS!*bHC  # MD5 key
2066*052d159aSCy Schubert 6 MD5 &quot;&gt;e\A&gt;hT/661ri52,,H  # MD5 key
20672b15cb3dSCy Schubert 7 MD5 c9x=M'CfLxax9v)PV-si  # MD5 key
20682b15cb3dSCy Schubert 8 MD5 E|=jvFVov?Bn|Ev=&amp;aK\  # MD5 key
20692b15cb3dSCy Schubert 9 MD5 T!c4UT&amp;`(m$+m+B6,`Q0  # MD5 key
20702b15cb3dSCy Schubert10 MD5 JVF/1=)=IFbHbJQz..Cd  # MD5 key
20712b15cb3dSCy Schubert11 SHA1 6dea311109529e436c2b4fccae9bc753c16d1b48  # SHA1 key
20722b15cb3dSCy Schubert12 SHA1 7076f373d86c4848c59ff8046e49cb7d614ec394  # SHA1 key
20732b15cb3dSCy Schubert13 SHA1 5f48b1b60591eb01b7cf1d33b7774f08d20262d3  # SHA1 key
20742b15cb3dSCy Schubert14 SHA1 eed5ab9d9497319ec60cf3781d52607e76720178  # SHA1 key
20752b15cb3dSCy Schubert15 SHA1 f283562611a04c964da8126296f5f8e58c3f85de  # SHA1 key
20762b15cb3dSCy Schubert16 SHA1 1930da171297dd63549af50b29449de17dcf341f  # SHA1 key
20772b15cb3dSCy Schubert17 SHA1 fee892110358cd4382322b889869e750db8e8a8f  # SHA1 key
20782b15cb3dSCy Schubert18 SHA1 b5520c9fadd7ad3fd8bfa061c8821b65d029bb37  # SHA1 key
20792b15cb3dSCy Schubert19 SHA1 8c74fb440ec80f453ec6aaa62b9baed0ab723b92  # SHA1 key
20802b15cb3dSCy Schubert20 SHA1 6bc05f734306a189326000970c19b3910f403795  # SHA1 key
2081*052d159aSCy Schubert</pre></div>
20822b15cb3dSCy Schubert
2083*052d159aSCy Schubert<p>Figure 1. Typical Symmetric Key File
2084*052d159aSCy Schubert</p>
20852b15cb3dSCy Schubert<p>Figure 1 shows a typical symmetric keys file used by the reference
20862b15cb3dSCy Schubertimplementation.
20872b15cb3dSCy SchubertEach line of the file contains three fields, first an
20884e1ef62aSXin LIinteger between 1 and 65535, inclusive, representing the key identifier
20892b15cb3dSCy Schubertused in the server and peer configuration commands.
20902b15cb3dSCy SchubertNext is the key type for the message digest algorithm,
20912b15cb3dSCy Schubertwhich in the absence of the
20922b15cb3dSCy SchubertOpenSSL library must be MD5 to designate the MD5 message digest
20932b15cb3dSCy Schubertalgorithm.
20942b15cb3dSCy SchubertIf the OpenSSL library is installed, the key type can be any
20952b15cb3dSCy Schubertmessage digest algorithm supported by that library.
20962b15cb3dSCy SchubertHowever, if
20972b15cb3dSCy Schubertcompatibility with FIPS 140-2 is required, the key type must be either
20982b15cb3dSCy SchubertSHA or SHA1.
20992b15cb3dSCy SchubertThe key type can be changed using an ASCII text editor.
2100*052d159aSCy Schubert</p>
21012b15cb3dSCy Schubert<p>An MD5 key consists of a printable ASCII string less than or equal to
21022b15cb3dSCy Schubert16 characters and terminated by whitespace or a # character.
21032b15cb3dSCy SchubertAn OpenSSL
21042b15cb3dSCy Schubertkey consists of a hex-encoded ASCII string of 40 characters, which is
21052b15cb3dSCy Schuberttruncated as necessary.
2106*052d159aSCy Schubert</p>
21072b15cb3dSCy Schubert<p>Note that the keys used by the <code>ntpq</code> and <code>ntpdc</code> programs are
21082b15cb3dSCy Schubertchecked against passwords requested by the programs and entered by hand,
21092b15cb3dSCy Schubertso it
21102b15cb3dSCy Schubertis generally appropriate to specify these keys in human readable ASCII
21112b15cb3dSCy Schubertformat.
2112*052d159aSCy Schubert</p>
21132b15cb3dSCy Schubert<p>The <code>ntp-keygen</code> program generates a MD5 symmetric keys file
21142b15cb3dSCy Schubert<code>ntpkey_MD5key_hostname.filestamp</code>.
21152b15cb3dSCy SchubertSince the file contains private
21162b15cb3dSCy Schubertshared keys, it should be visible only to root and distributed by
21172b15cb3dSCy Schubertsecure means to other subnet hosts.
21182b15cb3dSCy SchubertThe NTP daemon loads the file <code>ntp.keys</code>, so <code>ntp-keygen</code>
21192b15cb3dSCy Schubertinstalls a soft link from this name to the generated file.
21202b15cb3dSCy SchubertSubsequently, similar soft links must be installed by
21212b15cb3dSCy Schubertmanual or automated means on the other subnet hosts.
21222b15cb3dSCy SchubertWhile this file is
21232b15cb3dSCy Schubertnot used with the Autokey Version 2 protocol, it is needed to
21242b15cb3dSCy Schubertauthenticate some remote configuration commands used by the <code>ntpq</code> and
21252b15cb3dSCy Schubert<code>ntpdc</code> utilities.
2126*052d159aSCy Schubert</p><hr>
21272b15cb3dSCy Schubert
21282b15cb3dSCy Schubert
2129*052d159aSCy Schubert
2130*052d159aSCy Schubert</body>
2131*052d159aSCy Schubert</html>
2132