1*052d159aSCy Schubert<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> 2*052d159aSCy Schubert<html> 3*052d159aSCy Schubert<!-- Created by GNU Texinfo 6.5, http://www.gnu.org/software/texinfo/ --> 42b15cb3dSCy Schubert<head> 5*052d159aSCy Schubert<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> 6*052d159aSCy Schubert<title>Ntp-keygen User’s Manual</title> 7*052d159aSCy Schubert 8*052d159aSCy Schubert<meta name="description" content="Ntp-keygen User’s Manual"> 9*052d159aSCy Schubert<meta name="keywords" content="Ntp-keygen User’s Manual"> 10*052d159aSCy Schubert<meta name="resource-type" content="document"> 11*052d159aSCy Schubert<meta name="distribution" content="global"> 12*052d159aSCy Schubert<meta name="Generator" content="makeinfo"> 13*052d159aSCy Schubert<link href="#Top" rel="start" title="Top"> 14*052d159aSCy Schubert<link href="dir.html#Top" rel="up" title="(dir)"> 15*052d159aSCy Schubert<style type="text/css"> 16*052d159aSCy Schubert<!-- 17*052d159aSCy Schuberta.summary-letter {text-decoration: none} 18*052d159aSCy Schubertblockquote.indentedblock {margin-right: 0em} 19*052d159aSCy Schubertblockquote.smallindentedblock {margin-right: 0em; font-size: smaller} 20*052d159aSCy Schubertblockquote.smallquotation {font-size: smaller} 21*052d159aSCy Schubertdiv.display {margin-left: 3.2em} 22*052d159aSCy Schubertdiv.example {margin-left: 3.2em} 23*052d159aSCy Schubertdiv.lisp {margin-left: 3.2em} 24*052d159aSCy Schubertdiv.smalldisplay {margin-left: 3.2em} 25*052d159aSCy Schubertdiv.smallexample {margin-left: 3.2em} 26*052d159aSCy Schubertdiv.smalllisp {margin-left: 3.2em} 27*052d159aSCy Schubertkbd {font-style: oblique} 282b15cb3dSCy Schubertpre.display {font-family: inherit} 292b15cb3dSCy Schubertpre.format {font-family: inherit} 30*052d159aSCy Schubertpre.menu-comment {font-family: serif} 31*052d159aSCy Schubertpre.menu-preformatted {font-family: serif} 322b15cb3dSCy Schubertpre.smalldisplay {font-family: inherit; font-size: smaller} 332b15cb3dSCy Schubertpre.smallexample {font-size: smaller} 34*052d159aSCy Schubertpre.smallformat {font-family: inherit; font-size: smaller} 352b15cb3dSCy Schubertpre.smalllisp {font-size: smaller} 36*052d159aSCy Schubertspan.nolinebreak {white-space: nowrap} 37*052d159aSCy Schubertspan.roman {font-family: initial; font-weight: normal} 38*052d159aSCy Schubertspan.sansserif {font-family: sans-serif; font-weight: normal} 39*052d159aSCy Schubertul.no-bullet {list-style: none} 40*052d159aSCy Schubert--> 41*052d159aSCy Schubert</style> 42*052d159aSCy Schubert 43*052d159aSCy Schubert 442b15cb3dSCy Schubert</head> 45*052d159aSCy Schubert 46*052d159aSCy Schubert<body lang="en"> 47*052d159aSCy Schubert<h1 class="settitle" align="center">Ntp-keygen User’s Manual</h1> 48*052d159aSCy Schubert 49*052d159aSCy Schubert 50*052d159aSCy Schubert 51*052d159aSCy Schubert 52*052d159aSCy Schubert 53*052d159aSCy Schubert<a name="SEC_Overview"></a> 54*052d159aSCy Schubert<h2 class="shortcontents-heading">Short Table of Contents</h2> 55*052d159aSCy Schubert 562b15cb3dSCy Schubert<div class="shortcontents"> 57*052d159aSCy Schubert<ul class="no-bullet"> 58*052d159aSCy Schubert<li><a name="stoc-Description-1" href="#toc-Description-1">1 Description</a></li> 592b15cb3dSCy Schubert</ul> 602b15cb3dSCy Schubert</div> 612b15cb3dSCy Schubert 622b15cb3dSCy Schubert 63*052d159aSCy Schubert<table class="menu" border="0" cellspacing="0"> 64*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#Description" accesskey="1">Description</a>:</td><td> </td><td align="left" valign="top"> 65*052d159aSCy Schubert</td></tr> 66*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-Invocation" accesskey="2">ntp-keygen Invocation</a>:</td><td> </td><td align="left" valign="top">Invoking ntp-keygen 67*052d159aSCy Schubert</td></tr> 68*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#Running-the-Program" accesskey="3">Running the Program</a>:</td><td> </td><td align="left" valign="top"> 69*052d159aSCy Schubert</td></tr> 70*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#Random-Seed-File" accesskey="4">Random Seed File</a>:</td><td> </td><td align="left" valign="top"> 71*052d159aSCy Schubert</td></tr> 72*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#Cryptographic-Data-Files" accesskey="5">Cryptographic Data Files</a>:</td><td> </td><td align="left" valign="top"> 73*052d159aSCy Schubert</td></tr> 74*052d159aSCy Schubert</table> 752b15cb3dSCy Schubert 76*052d159aSCy Schubert<a name="Top"></a> 77*052d159aSCy Schubert<div class="header"> 78*052d159aSCy Schubert<p> 79*052d159aSCy SchubertNext: <a href="#Description" accesskey="n" rel="next">Description</a>, Previous: <a href="dir.html#Top" accesskey="p" rel="prev">(dir)</a>, Up: <a href="dir.html#Top" accesskey="u" rel="up">(dir)</a> </p> 802b15cb3dSCy Schubert</div> 81*052d159aSCy Schubert<a name="NTP-Key-Generation-Program-User-Manual"></a> 82*052d159aSCy Schubert<h1 class="top">NTP Key Generation Program User Manual</h1> 832b15cb3dSCy Schubert 84*052d159aSCy Schubert<p>This document describes the use of the NTP Project’s <code>ntp-keygen</code> 852b15cb3dSCy Schubertprogram, that generates cryptographic data files used by the NTPv4 862b15cb3dSCy Schubertauthentication and identity schemes. 872b15cb3dSCy SchubertIt can generate message digest keys used in symmetric key cryptography and, 882b15cb3dSCy Schubertif the OpenSSL software 892b15cb3dSCy Schubertlibrary has been installed, it can generate host keys, sign keys, 902b15cb3dSCy Schubertcertificates, and identity keys and parameters used by the Autokey 912b15cb3dSCy Schubertpublic key cryptography. 922b15cb3dSCy SchubertThe message digest keys file is generated in a 932b15cb3dSCy Schubertformat compatible with NTPv3. 942b15cb3dSCy SchubertAll other files are in PEM-encoded 952b15cb3dSCy Schubertprintable ASCII format so they can be embedded as MIME attachments in 962b15cb3dSCy Schubertmail to other sites. 97*052d159aSCy Schubert</p> 98*052d159aSCy Schubert<p>This document applies to version 4.2.8p13 of <code>ntp-keygen</code>. 99*052d159aSCy Schubert</p> 100*052d159aSCy Schubert<table class="menu" border="0" cellspacing="0"> 101*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#Description" accesskey="1">Description</a>:</td><td> </td><td align="left" valign="top"> 102*052d159aSCy Schubert</td></tr> 103*052d159aSCy Schubert</table> 1042b15cb3dSCy Schubert 105*052d159aSCy Schubert<hr> 106*052d159aSCy Schubert<a name="Description"></a> 107*052d159aSCy Schubert<div class="header"> 108*052d159aSCy Schubert<p> 109*052d159aSCy SchubertNext: <a href="#Running-the-Program" accesskey="n" rel="next">Running the Program</a>, Previous: <a href="#Top" accesskey="p" rel="prev">Top</a>, Up: <a href="#Top" accesskey="u" rel="up">Top</a> </p> 1102b15cb3dSCy Schubert</div> 111*052d159aSCy Schubert<a name="Description-1"></a> 112*052d159aSCy Schubert<h2 class="chapter">1 Description</h2> 1132b15cb3dSCy Schubert 1142b15cb3dSCy Schubert<p>This program generates cryptographic data files used by the NTPv4 1152b15cb3dSCy Schubertauthentication and identity schemes. It can generate message digest 1162b15cb3dSCy Schubertkeys used in symmetric key cryptography and, if the OpenSSL software 1172b15cb3dSCy Schubertlibrary has been installed, it can generate host keys, sign keys, 1182b15cb3dSCy Schubertcertificates, and identity keys and parameters used by the Autokey 1192b15cb3dSCy Schubertpublic key cryptography. The message digest keys file is generated in a 1202b15cb3dSCy Schubertformat compatible with NTPv3. All other files are in PEM-encoded 1212b15cb3dSCy Schubertprintable ASCII format so they can be embedded as MIME attachments in 1222b15cb3dSCy Schubertmail to other sites. 123*052d159aSCy Schubert</p> 1242b15cb3dSCy Schubert<p>When used to generate message digest keys, the program produces a file 1252b15cb3dSCy Schubertcontaining ten pseudo-random printable ASCII strings suitable for the 1262b15cb3dSCy SchubertMD5 message digest algorithm included in the distribution. 1272b15cb3dSCy SchubertIf the 1282b15cb3dSCy SchubertOpenSSL library is installed, it produces an additional ten hex-encoded 1292b15cb3dSCy Schubertrandom bit strings suitable for the SHA1 and other message digest 1302b15cb3dSCy Schubertalgorithms. 1312b15cb3dSCy SchubertThe message digest keys file must be distributed and stored 1322b15cb3dSCy Schubertusing secure means beyond the scope of NTP itself. 1332b15cb3dSCy SchubertBesides the keys 1342b15cb3dSCy Schubertused for ordinary NTP associations, additional keys can be defined as 1352b15cb3dSCy Schubertpasswords for the ntpq and ntpdc utility programs. 136*052d159aSCy Schubert</p> 1372b15cb3dSCy Schubert<p>The remaining generated files are compatible with other OpenSSL 1382b15cb3dSCy Schubertapplications and other Public Key Infrastructure (PKI) resources. 1392b15cb3dSCy SchubertCertificates generated by this program are compatible with extant 1402b15cb3dSCy Schubertindustry practice, although some users might find the interpretation of 1412b15cb3dSCy SchubertX509v3 extension fields somewhat liberal. 1422b15cb3dSCy SchubertHowever, the identity keys 1432b15cb3dSCy Schubertare probably not compatible with anything other than Autokey. 144*052d159aSCy Schubert</p> 1452b15cb3dSCy Schubert<p>Some files used by this program are encrypted using a private password. 1462b15cb3dSCy SchubertThe <code>-p</code> option specifies the password for local encrypted files and the 1472b15cb3dSCy Schubert<code>-q</code> option the password for encrypted files sent to remote sites. 1482b15cb3dSCy SchubertIf no password is specified, the host name returned by the Unix 1492b15cb3dSCy Schubert<code>gethostname()</code> function, normally the DNS name of the host, is used. 150*052d159aSCy Schubert</p> 1512b15cb3dSCy Schubert<p>The <kbd>pw</kbd> option of the <code>crypto</code> configuration command 1522b15cb3dSCy Schubertspecifies the read password for previously encrypted local files. 1532b15cb3dSCy SchubertThis must match the local password used by this program. 1542b15cb3dSCy SchubertIf not specified, the host name is used. 1552b15cb3dSCy SchubertThus, if files are generated by this program without password, 1562b15cb3dSCy Schubertthey can be read back by ntpd without password, but only on the same 1572b15cb3dSCy Schuberthost. 158*052d159aSCy Schubert</p> 1592b15cb3dSCy Schubert<p>Normally, encrypted files for each host are generated by that host and 1602b15cb3dSCy Schubertused only by that host, although exceptions exist as noted later on 1612b15cb3dSCy Schubertthis page. 1622b15cb3dSCy SchubertThe symmetric keys file, normally called <code>ntp.keys</code>, is 1632b15cb3dSCy Schubertusually installed in <code>/etc</code>. 1642b15cb3dSCy SchubertOther files and links are usually installed 1652b15cb3dSCy Schubertin <code>/usr/local/etc</code>, which is normally in a shared filesystem in 1662b15cb3dSCy SchubertNFS-mounted networks and cannot be changed by shared clients. 1672b15cb3dSCy SchubertThe location of the keys directory can be changed by the keysdir 1682b15cb3dSCy Schubertconfiguration command in such cases. 1692b15cb3dSCy SchubertNormally, this is in <code>/etc</code>. 170*052d159aSCy Schubert</p> 1712b15cb3dSCy Schubert<p>This program directs commentary and error messages to the standard 1722b15cb3dSCy Schuberterror stream <code>stderr</code> and remote files to the standard output stream 1732b15cb3dSCy Schubert<code>stdout</code> where they can be piped to other applications or redirected to 1742b15cb3dSCy Schubertfiles. 1752b15cb3dSCy SchubertThe names used for generated files and links all begin with the 1762b15cb3dSCy Schubertstring <code>ntpkey</code> and include the file type, 1772b15cb3dSCy Schubertgenerating host and filestamp, 1782b15cb3dSCy Schubertas described in the <a href="#Cryptographic-Data-Files">Cryptographic Data Files</a> section below. 179*052d159aSCy Schubert</p> 180*052d159aSCy Schubert<table class="menu" border="0" cellspacing="0"> 181*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#Running-the-Program" accesskey="1">Running the Program</a>:</td><td> </td><td align="left" valign="top"> 182*052d159aSCy Schubert</td></tr> 183*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-Invocation" accesskey="2">ntp-keygen Invocation</a>:</td><td> </td><td align="left" valign="top"> 184*052d159aSCy Schubert</td></tr> 185*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#Random-Seed-File" accesskey="3">Random Seed File</a>:</td><td> </td><td align="left" valign="top"> 186*052d159aSCy Schubert</td></tr> 187*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#Cryptographic-Data-Files" accesskey="4">Cryptographic Data Files</a>:</td><td> </td><td align="left" valign="top"> 188*052d159aSCy Schubert</td></tr> 189*052d159aSCy Schubert</table> 1902b15cb3dSCy Schubert 191*052d159aSCy Schubert<hr> 192*052d159aSCy Schubert<a name="Running-the-Program"></a> 193*052d159aSCy Schubert<div class="header"> 194*052d159aSCy Schubert<p> 195*052d159aSCy SchubertNext: <a href="#Random-Seed-File" accesskey="n" rel="next">Random Seed File</a>, Previous: <a href="#Description" accesskey="p" rel="prev">Description</a>, Up: <a href="#Top" accesskey="u" rel="up">Top</a> </p> 1962b15cb3dSCy Schubert</div> 197*052d159aSCy Schubert<a name="Running-the-Program-1"></a> 198*052d159aSCy Schubert<h3 class="section">1.1 Running the Program</h3> 1992b15cb3dSCy Schubert 2002b15cb3dSCy Schubert<p>To test and gain experience with Autokey concepts, log in as root and 2012b15cb3dSCy Schubertchange to the keys directory, usually <code>/usr/local/etc</code>. 2022b15cb3dSCy SchubertWhen run for the 2032b15cb3dSCy Schubertfirst time, or if all files with names beginning <code>ntpkey</code>] have been 2042b15cb3dSCy Schubertremoved, use the <code>ntp-keygen</code> command without arguments to generate a 2052b15cb3dSCy Schubertdefault RSA host key and matching RSA-MD5 certificate with expiration 2062b15cb3dSCy Schubertdate one year hence. 2072b15cb3dSCy SchubertIf run again without options, the program uses the 2082b15cb3dSCy Schubertexisting keys and parameters and generates only a new certificate with 2092b15cb3dSCy Schubertnew expiration date one year hence. 210*052d159aSCy Schubert</p> 2112b15cb3dSCy Schubert<p>Run the command on as many hosts as necessary. 2122b15cb3dSCy SchubertDesignate one of them as the trusted host (TH) using <code>ntp-keygen</code> 2132b15cb3dSCy Schubertwith the <code>-T</code> option and configure 2142b15cb3dSCy Schubertit to synchronize from reliable Internet servers. 2152b15cb3dSCy SchubertThen configure the other hosts to synchronize to the TH directly or indirectly. 2162b15cb3dSCy SchubertA certificate trail is created when Autokey asks the immediately 2172b15cb3dSCy Schubertascendant host towards the TH to sign its certificate, which is then 2182b15cb3dSCy Schubertprovided to the immediately descendant host on request. 2192b15cb3dSCy SchubertAll group hosts should have acyclic certificate trails ending on the TH. 220*052d159aSCy Schubert</p> 2212b15cb3dSCy Schubert<p>The host key is used to encrypt the cookie when required and so must be 2222b15cb3dSCy SchubertRSA type. 2232b15cb3dSCy SchubertBy default, the host key is also the sign key used to encrypt signatures. 2242b15cb3dSCy SchubertA different sign key can be assigned using the <code>-S</code> option 2252b15cb3dSCy Schubertand this can be either RSA or DSA type. 2262b15cb3dSCy SchubertBy default, the signature 2272b15cb3dSCy Schubertmessage digest type is MD5, but any combination of sign key type and 2282b15cb3dSCy Schubertmessage digest type supported by the OpenSSL library can be specified 2292b15cb3dSCy Schubertusing the <code>-c</code> option. 230*052d159aSCy Schubert</p> 2312b15cb3dSCy Schubert<p>The rules say cryptographic media should be generated with proventic 2322b15cb3dSCy Schubertfilestamps, which means the host should already be synchronized before 2332b15cb3dSCy Schubertthis program is run. 2342b15cb3dSCy SchubertThis of course creates a chicken-and-egg problem 2352b15cb3dSCy Schubertwhen the host is started for the first time. 2362b15cb3dSCy SchubertAccordingly, the host time 2372b15cb3dSCy Schubertshould be set by some other means, such as eyeball-and-wristwatch, at 2382b15cb3dSCy Schubertleast so that the certificate lifetime is within the current year. 2392b15cb3dSCy SchubertAfter that and when the host is synchronized to a proventic source, the 2402b15cb3dSCy Schubertcertificate should be re-generated. 241*052d159aSCy Schubert</p> 2422b15cb3dSCy Schubert<p>Additional information on trusted groups and identity schemes is on the 2432b15cb3dSCy SchubertAutokey Public-Key Authentication page. 244*052d159aSCy Schubert</p> 245*052d159aSCy Schubert<hr> 2462b15cb3dSCy Schubert<a name="ntp_002dkeygen-Invocation"></a> 247*052d159aSCy Schubert<div class="header"> 248*052d159aSCy Schubert<p> 249*052d159aSCy SchubertNext: <a href="#Random-Seed-File" accesskey="n" rel="next">Random Seed File</a>, Previous: <a href="#Running-the-Program" accesskey="p" rel="prev">Running the Program</a>, Up: <a href="#Description" accesskey="u" rel="up">Description</a> </p> 2502b15cb3dSCy Schubert</div> 251*052d159aSCy Schubert<a name="Invoking-ntp_002dkeygen"></a> 252*052d159aSCy Schubert<h3 class="section">1.2 Invoking ntp-keygen</h3> 253*052d159aSCy Schubert<a name="index-ntp_002dkeygen"></a> 254*052d159aSCy Schubert<a name="index-Create-a-NTP-host-key"></a> 2552b15cb3dSCy Schubert 2562b15cb3dSCy Schubert 2572b15cb3dSCy Schubert 2582b15cb3dSCy Schubert<p>This program generates cryptographic data files used by the NTPv4 2592b15cb3dSCy Schubertauthentication and identification schemes. 26009100258SXin LIIt can generate message digest keys used in symmetric key cryptography and, 26109100258SXin LIif the OpenSSL software library has been installed, it can generate host keys, 26209100258SXin LIsigning keys, certificates, and identity keys and parameters used in Autokey 26309100258SXin LIpublic key cryptography. 2642b15cb3dSCy SchubertThese files are used for cookie encryption, 26509100258SXin LIdigital signature, and challenge/response identification algorithms 2662b15cb3dSCy Schubertcompatible with the Internet standard security infrastructure. 267*052d159aSCy Schubert</p> 26809100258SXin LI<p>The message digest symmetric keys file is generated in a format 26909100258SXin LIcompatible with NTPv3. 27009100258SXin LIAll other files are in PEM-encoded printable ASCII format, 27109100258SXin LIso they can be embedded as MIME attachments in email to other sites 2722b15cb3dSCy Schubertand certificate authorities. 2732b15cb3dSCy SchubertBy default, files are not encrypted. 274*052d159aSCy Schubert</p> 27509100258SXin LI<p>When used to generate message digest symmetric keys, the program 27609100258SXin LIproduces a file containing ten pseudo-random printable ASCII strings 27709100258SXin LIsuitable for the MD5 message digest algorithm included in the 27809100258SXin LIdistribution. 2792b15cb3dSCy SchubertIf the OpenSSL library is installed, it produces an additional ten 28009100258SXin LIhex-encoded random bit strings suitable for SHA1, AES-128-CMAC, and 28109100258SXin LIother message digest algorithms. 28209100258SXin LIThe message digest symmetric keys file must be distributed and stored 2832b15cb3dSCy Schubertusing secure means beyond the scope of NTP itself. 2842b15cb3dSCy SchubertBesides the keys used for ordinary NTP associations, additional keys 2852b15cb3dSCy Schubertcan be defined as passwords for the 2862b15cb3dSCy Schubert<code>ntpq(1ntpqmdoc)</code> 2872b15cb3dSCy Schubertand 2882b15cb3dSCy Schubert<code>ntpdc(1ntpdcmdoc)</code> 2892b15cb3dSCy Schubertutility programs. 290*052d159aSCy Schubert</p> 2912b15cb3dSCy Schubert<p>The remaining generated files are compatible with other OpenSSL 2922b15cb3dSCy Schubertapplications and other Public Key Infrastructure (PKI) resources. 2932b15cb3dSCy SchubertCertificates generated by this program are compatible with extant 2942b15cb3dSCy Schubertindustry practice, although some users might find the interpretation of 2952b15cb3dSCy SchubertX509v3 extension fields somewhat liberal. 2962b15cb3dSCy SchubertHowever, the identity keys are probably not compatible with anything 2972b15cb3dSCy Schubertother than Autokey. 298*052d159aSCy Schubert</p> 2992b15cb3dSCy Schubert<p>Some files used by this program are encrypted using a private password. 3002b15cb3dSCy SchubertThe 3012b15cb3dSCy Schubert<code>-p</code> 30209100258SXin LIoption specifies the read password for local encrypted files and the 3032b15cb3dSCy Schubert<code>-q</code> 30409100258SXin LIoption the write password for encrypted files sent to remote sites. 3052b15cb3dSCy SchubertIf no password is specified, the host name returned by the Unix 30609100258SXin LI<code>hostname(1)</code> 30709100258SXin LIcommand, normally the DNS name of the host, is used as the the default read 30809100258SXin LIpassword, for convenience. 30909100258SXin LIThe 31009100258SXin LI<code>ntp-keygen</code> 31109100258SXin LIprogram prompts for the password if it reads an encrypted file 31209100258SXin LIand the password is missing or incorrect. 31309100258SXin LIIf an encrypted file is read successfully and 31409100258SXin LIno write password is specified, the read password is used 31509100258SXin LIas the write password by default. 316*052d159aSCy Schubert</p> 3172b15cb3dSCy Schubert<p>The 31809100258SXin LI<code>pw</code> 3192b15cb3dSCy Schubertoption of the 32009100258SXin LI<code>crypto</code> 32109100258SXin LI<code>ntpd(1ntpdmdoc)</code> 3222b15cb3dSCy Schubertconfiguration command specifies the read 3232b15cb3dSCy Schubertpassword for previously encrypted local files. 32409100258SXin LIThis must match the local read password used by this program. 3252b15cb3dSCy SchubertIf not specified, the host name is used. 32609100258SXin LIThus, if files are generated by this program without an explicit password, 3272b15cb3dSCy Schubertthey can be read back by 32809100258SXin LI<code>ntpd(1ntpdmdoc)</code> 32909100258SXin LIwithout specifying an explicit password but only on the same host. 33009100258SXin LIIf the write password used for encryption is specified as the host name, 33109100258SXin LIthese files can be read by that host with no explicit password. 332*052d159aSCy Schubert</p> 3332b15cb3dSCy Schubert<p>Normally, encrypted files for each host are generated by that host and 3342b15cb3dSCy Schubertused only by that host, although exceptions exist as noted later on 3352b15cb3dSCy Schubertthis page. 3362b15cb3dSCy SchubertThe symmetric keys file, normally called 337*052d159aSCy Schubert<samp>ntp.keys</samp>, 3382b15cb3dSCy Schubertis usually installed in 339*052d159aSCy Schubert<samp>/etc</samp>. 3402b15cb3dSCy SchubertOther files and links are usually installed in 341*052d159aSCy Schubert<samp>/usr/local/etc</samp>, 3422b15cb3dSCy Schubertwhich is normally in a shared filesystem in 3432b15cb3dSCy SchubertNFS-mounted networks and cannot be changed by shared clients. 34409100258SXin LIIn these cases, NFS clients can specify the files in another 34509100258SXin LIdirectory such as 346*052d159aSCy Schubert<samp>/etc</samp> 34709100258SXin LIusing the 34809100258SXin LI<code>keysdir</code> 34909100258SXin LI<code>ntpd(1ntpdmdoc)</code> 35009100258SXin LIconfiguration file command. 351*052d159aSCy Schubert</p> 3522b15cb3dSCy Schubert<p>This program directs commentary and error messages to the standard 3532b15cb3dSCy Schuberterror stream 354*052d159aSCy Schubert<samp>stderr</samp> 3552b15cb3dSCy Schubertand remote files to the standard output stream 356*052d159aSCy Schubert<samp>stdout</samp> 3572b15cb3dSCy Schubertwhere they can be piped to other applications or redirected to files. 3582b15cb3dSCy SchubertThe names used for generated files and links all begin with the 3592b15cb3dSCy Schubertstring 360*052d159aSCy Schubert<samp>ntpkey*</samp> 3612b15cb3dSCy Schubertand include the file type, generating host and filestamp, 3622b15cb3dSCy Schubertas described in the 36309100258SXin LI<a href="#Cryptographic-Data-Files">Cryptographic Data Files</a> 3642b15cb3dSCy Schubertsection below. 365*052d159aSCy Schubert</p> 366*052d159aSCy Schubert<table class="menu" border="0" cellspacing="0"> 367*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-usage" accesskey="1">ntp-keygen usage</a>:</td><td> </td><td align="left" valign="top"> 368*052d159aSCy Schubert</td></tr> 369*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-imbits" accesskey="2">ntp-keygen imbits</a>:</td><td> </td><td align="left" valign="top"> 370*052d159aSCy Schubert</td></tr> 371*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-certificate" accesskey="3">ntp-keygen certificate</a>:</td><td> </td><td align="left" valign="top"> 372*052d159aSCy Schubert</td></tr> 373*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-cipher" accesskey="4">ntp-keygen cipher</a>:</td><td> </td><td align="left" valign="top"> 374*052d159aSCy Schubert</td></tr> 375*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-id_002dkey" accesskey="5">ntp-keygen id-key</a>:</td><td> </td><td align="left" valign="top"> 376*052d159aSCy Schubert</td></tr> 377*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-gq_002dparams" accesskey="6">ntp-keygen gq-params</a>:</td><td> </td><td align="left" valign="top"> 378*052d159aSCy Schubert</td></tr> 379*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-host_002dkey" accesskey="7">ntp-keygen host-key</a>:</td><td> </td><td align="left" valign="top"> 380*052d159aSCy Schubert</td></tr> 381*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-iffkey" accesskey="8">ntp-keygen iffkey</a>:</td><td> </td><td align="left" valign="top"> 382*052d159aSCy Schubert</td></tr> 383*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-ident" accesskey="9">ntp-keygen ident</a>:</td><td> </td><td align="left" valign="top"> 384*052d159aSCy Schubert</td></tr> 385*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-lifetime">ntp-keygen lifetime</a>:</td><td> </td><td align="left" valign="top"> 386*052d159aSCy Schubert</td></tr> 387*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-modulus">ntp-keygen modulus</a>:</td><td> </td><td align="left" valign="top"> 388*052d159aSCy Schubert</td></tr> 389*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-md5key">ntp-keygen md5key</a>:</td><td> </td><td align="left" valign="top"> 390*052d159aSCy Schubert</td></tr> 391*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-pvt_002dcert">ntp-keygen pvt-cert</a>:</td><td> </td><td align="left" valign="top"> 392*052d159aSCy Schubert</td></tr> 393*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-password">ntp-keygen password</a>:</td><td> </td><td align="left" valign="top"> 394*052d159aSCy Schubert</td></tr> 395*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-export_002dpasswd">ntp-keygen export-passwd</a>:</td><td> </td><td align="left" valign="top"> 396*052d159aSCy Schubert</td></tr> 397*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-subject_002dname">ntp-keygen subject-name</a>:</td><td> </td><td align="left" valign="top"> 398*052d159aSCy Schubert</td></tr> 399*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-sign_002dkey">ntp-keygen sign-key</a>:</td><td> </td><td align="left" valign="top"> 400*052d159aSCy Schubert</td></tr> 401*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-trusted_002dcert">ntp-keygen trusted-cert</a>:</td><td> </td><td align="left" valign="top"> 402*052d159aSCy Schubert</td></tr> 403*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-mv_002dparams">ntp-keygen mv-params</a>:</td><td> </td><td align="left" valign="top"> 404*052d159aSCy Schubert</td></tr> 405*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-mv_002dkeys">ntp-keygen mv-keys</a>:</td><td> </td><td align="left" valign="top"> 406*052d159aSCy Schubert</td></tr> 407*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-config">ntp-keygen config</a>:</td><td> </td><td align="left" valign="top"> 408*052d159aSCy Schubert</td></tr> 409*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-exit-status">ntp-keygen exit status</a>:</td><td> </td><td align="left" valign="top"> 410*052d159aSCy Schubert</td></tr> 411*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-Usage">ntp-keygen Usage</a>:</td><td> </td><td align="left" valign="top"> 412*052d159aSCy Schubert</td></tr> 413*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-Notes">ntp-keygen Notes</a>:</td><td> </td><td align="left" valign="top"> 414*052d159aSCy Schubert</td></tr> 415*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-Bugs">ntp-keygen Bugs</a>:</td><td> </td><td align="left" valign="top"> 416*052d159aSCy Schubert</td></tr> 417*052d159aSCy Schubert</table> 4182b15cb3dSCy Schubert 419*052d159aSCy Schubert<a name="Running-the-Program-2"></a> 420*052d159aSCy Schubert<h4 class="subsection">1.2.1 Running the Program</h4> 42109100258SXin LI<p>The safest way to run the 42209100258SXin LI<code>ntp-keygen</code> 42309100258SXin LIprogram is logged in directly as root. 42409100258SXin LIThe recommended procedure is change to the 42509100258SXin LI<kbd>keys</kbd> 42609100258SXin LIdirectory, usually 427*052d159aSCy Schubert<samp>/usr/local/etc</samp>, 42809100258SXin LIthen run the program. 429*052d159aSCy Schubert</p> 4302b15cb3dSCy Schubert<p>To test and gain experience with Autokey concepts, log in as root and 43109100258SXin LIchange to the 43209100258SXin LI<kbd>keys</kbd> 43309100258SXin LIdirectory, usually 434*052d159aSCy Schubert<samp>/usr/local/etc</samp>. 4352b15cb3dSCy SchubertWhen run for the first time, or if all files with names beginning with 436*052d159aSCy Schubert<samp>ntpkey*</samp> 4372b15cb3dSCy Schuberthave been removed, use the 4382b15cb3dSCy Schubert<code>ntp-keygen</code> 43909100258SXin LIcommand without arguments to generate a default 44009100258SXin LI<code>RSA</code> 44109100258SXin LIhost key and matching 44209100258SXin LI<code>RSA-MD5</code> 44309100258SXin LIcertificate file with expiration date one year hence, 44409100258SXin LIwhich is all that is necessary in many cases. 44509100258SXin LIThe program also generates soft links from the generic names 44609100258SXin LIto the respective files. 4472b15cb3dSCy SchubertIf run again without options, the program uses the 44809100258SXin LIexisting keys and parameters and generates a new certificate file with 44909100258SXin LInew expiration date one year hence, and soft link. 450*052d159aSCy Schubert</p> 45109100258SXin LI<p>The host key is used to encrypt the cookie when required and so must be 45209100258SXin LI<code>RSA</code> 45309100258SXin LItype. 45409100258SXin LIBy default, the host key is also the sign key used to encrypt signatures. 45509100258SXin LIWhen necessary, a different sign key can be specified and this can be 45609100258SXin LIeither 45709100258SXin LI<code>RSA</code> 45809100258SXin LIor 45909100258SXin LI<code>DSA</code> 46009100258SXin LItype. 46109100258SXin LIBy default, the message digest type is 46209100258SXin LI<code>MD5</code>, 46309100258SXin LIbut any combination 46409100258SXin LIof sign key type and message digest type supported by the OpenSSL library 46509100258SXin LIcan be specified, including those using the 46609100258SXin LI<code>AES128CMAC</code>, <code>MD2</code>, <code>MD5</code>, <code>MDC2</code>, <code>SHA</code>, <code>SHA1</code> 46709100258SXin LIand 46809100258SXin LI<code>RIPE160</code> 46909100258SXin LImessage digest algorithms. 47009100258SXin LIHowever, the scheme specified in the certificate must be compatible 47109100258SXin LIwith the sign key. 47209100258SXin LICertificates using any digest algorithm are compatible with 47309100258SXin LI<code>RSA</code> 47409100258SXin LIsign keys; 47509100258SXin LIhowever, only 47609100258SXin LI<code>SHA</code> 47709100258SXin LIand 47809100258SXin LI<code>SHA1</code> 47909100258SXin LIcertificates are compatible with 48009100258SXin LI<code>DSA</code> 48109100258SXin LIsign keys. 482*052d159aSCy Schubert</p> 48309100258SXin LI<p>Private/public key files and certificates are compatible with 48409100258SXin LIother OpenSSL applications and very likely other libraries as well. 48509100258SXin LICertificates or certificate requests derived from them should be compatible 48609100258SXin LIwith extant industry practice, although some users might find 48709100258SXin LIthe interpretation of X509v3 extension fields somewhat liberal. 48809100258SXin LIHowever, the identification parameter files, although encoded 48909100258SXin LIas the other files, are probably not compatible with anything other than Autokey. 490*052d159aSCy Schubert</p> 49109100258SXin LI<p>Running the program as other than root and using the Unix 49209100258SXin LI<code>su(1)</code> 49309100258SXin LIcommand 49409100258SXin LIto assume root may not work properly, since by default the OpenSSL library 49509100258SXin LIlooks for the random seed file 496*052d159aSCy Schubert<samp>.rnd</samp> 49709100258SXin LIin the user home directory. 49809100258SXin LIHowever, there should be only one 499*052d159aSCy Schubert<samp>.rnd</samp>, 50009100258SXin LImost conveniently 50109100258SXin LIin the root directory, so it is convenient to define the 50209100258SXin LI.Ev RANDFILE 50309100258SXin LIenvironment variable used by the OpenSSL library as the path to 504*052d159aSCy Schubert<samp>.rnd</samp>. 505*052d159aSCy Schubert</p> 50609100258SXin LI<p>Installing the keys as root might not work in NFS-mounted 50709100258SXin LIshared file systems, as NFS clients may not be able to write 50809100258SXin LIto the shared keys directory, even as root. 50909100258SXin LIIn this case, NFS clients can specify the files in another 51009100258SXin LIdirectory such as 511*052d159aSCy Schubert<samp>/etc</samp> 51209100258SXin LIusing the 51309100258SXin LI<code>keysdir</code> 51409100258SXin LI<code>ntpd(1ntpdmdoc)</code> 51509100258SXin LIconfiguration file command. 51609100258SXin LIThere is no need for one client to read the keys and certificates 51709100258SXin LIof other clients or servers, as these data are obtained automatically 51809100258SXin LIby the Autokey protocol. 519*052d159aSCy Schubert</p> 52009100258SXin LI<p>Ordinarily, cryptographic files are generated by the host that uses them, 52109100258SXin LIbut it is possible for a trusted agent (TA) to generate these files 52209100258SXin LIfor other hosts; however, in such cases files should always be encrypted. 52309100258SXin LIThe subject name and trusted name default to the hostname 52409100258SXin LIof the host generating the files, but can be changed by command line options. 52509100258SXin LIIt is convenient to designate the owner name and trusted name 52609100258SXin LIas the subject and issuer fields, respectively, of the certificate. 52709100258SXin LIThe owner name is also used for the host and sign key files, 52809100258SXin LIwhile the trusted name is used for the identity files. 529*052d159aSCy Schubert</p> 53009100258SXin LI<p>All files are installed by default in the keys directory 531*052d159aSCy Schubert<samp>/usr/local/etc</samp>, 53209100258SXin LIwhich is normally in a shared filesystem 53309100258SXin LIin NFS-mounted networks. 53409100258SXin LIThe actual location of the keys directory 53509100258SXin LIand each file can be overridden by configuration commands, 53609100258SXin LIbut this is not recommended. 53709100258SXin LINormally, the files for each host are generated by that host 53809100258SXin LIand used only by that host, although exceptions exist 53909100258SXin LIas noted later on this page. 540*052d159aSCy Schubert</p> 54109100258SXin LI<p>Normally, files containing private values, 54209100258SXin LIincluding the host key, sign key and identification parameters, 54309100258SXin LIare permitted root read/write-only; 54409100258SXin LIwhile others containing public values are permitted world readable. 54509100258SXin LIAlternatively, files containing private values can be encrypted 54609100258SXin LIand these files permitted world readable, 54709100258SXin LIwhich simplifies maintenance in shared file systems. 54809100258SXin LISince uniqueness is insured by the 54909100258SXin LI<kbd>hostname</kbd> 55009100258SXin LIand 55109100258SXin LI<kbd>filestamp</kbd> 55209100258SXin LIfile name extensions, the files for an NTP server and 55309100258SXin LIdependent clients can all be installed in the same shared directory. 554*052d159aSCy Schubert</p> 55509100258SXin LI<p>The recommended practice is to keep the file name extensions 55609100258SXin LIwhen installing a file and to install a soft link 55709100258SXin LIfrom the generic names specified elsewhere on this page 55809100258SXin LIto the generated files. 55909100258SXin LIThis allows new file generations to be activated simply 56009100258SXin LIby changing the link. 56109100258SXin LIIf a link is present, 56209100258SXin LI<code>ntpd(1ntpdmdoc)</code> 56309100258SXin LIfollows it to the file name to extract the 56409100258SXin LI<kbd>filestamp</kbd>. 56509100258SXin LIIf a link is not present, 56609100258SXin LI<code>ntpd(1ntpdmdoc)</code> 56709100258SXin LIextracts the 56809100258SXin LI<kbd>filestamp</kbd> 56909100258SXin LIfrom the file itself. 57009100258SXin LIThis allows clients to verify that the file and generation times 57109100258SXin LIare always current. 57209100258SXin LIThe 57309100258SXin LI<code>ntp-keygen</code> 57409100258SXin LIprogram uses the same 57509100258SXin LI<kbd>filestamp</kbd> 57609100258SXin LIextension for all files generated 57709100258SXin LIat one time, so each generation is distinct and can be readily 57809100258SXin LIrecognized in monitoring data. 579*052d159aSCy Schubert</p> 5802b15cb3dSCy Schubert<p>Run the command on as many hosts as necessary. 5812b15cb3dSCy SchubertDesignate one of them as the trusted host (TH) using 5822b15cb3dSCy Schubert<code>ntp-keygen</code> 5832b15cb3dSCy Schubertwith the 5842b15cb3dSCy Schubert<code>-T</code> 5852b15cb3dSCy Schubertoption and configure it to synchronize from reliable Internet servers. 5862b15cb3dSCy SchubertThen configure the other hosts to synchronize to the TH directly or 5872b15cb3dSCy Schubertindirectly. 5882b15cb3dSCy SchubertA certificate trail is created when Autokey asks the immediately 5892b15cb3dSCy Schubertascendant host towards the TH to sign its certificate, which is then 5902b15cb3dSCy Schubertprovided to the immediately descendant host on request. 5912b15cb3dSCy SchubertAll group hosts should have acyclic certificate trails ending on the TH. 592*052d159aSCy Schubert</p> 5932b15cb3dSCy Schubert<p>The host key is used to encrypt the cookie when required and so must be 5942b15cb3dSCy SchubertRSA type. 5952b15cb3dSCy SchubertBy default, the host key is also the sign key used to encrypt 5962b15cb3dSCy Schubertsignatures. 5972b15cb3dSCy SchubertA different sign key can be assigned using the 5982b15cb3dSCy Schubert<code>-S</code> 59909100258SXin LIoption and this can be either 60009100258SXin LI<code>RSA</code> 60109100258SXin LIor 60209100258SXin LI<code>DSA</code> 60309100258SXin LItype. 6042b15cb3dSCy SchubertBy default, the signature 60509100258SXin LImessage digest type is 60609100258SXin LI<code>MD5</code>, 60709100258SXin LIbut any combination of sign key type and 6082b15cb3dSCy Schubertmessage digest type supported by the OpenSSL library can be specified 6092b15cb3dSCy Schubertusing the 6102b15cb3dSCy Schubert<code>-c</code> 6112b15cb3dSCy Schubertoption. 612*052d159aSCy Schubert</p> 61309100258SXin LI<p>The rules say cryptographic media should be generated with proventic 6142b15cb3dSCy Schubertfilestamps, which means the host should already be synchronized before 6152b15cb3dSCy Schubertthis program is run. 6162b15cb3dSCy SchubertThis of course creates a chicken-and-egg problem 6172b15cb3dSCy Schubertwhen the host is started for the first time. 6182b15cb3dSCy SchubertAccordingly, the host time 6192b15cb3dSCy Schubertshould be set by some other means, such as eyeball-and-wristwatch, at 6202b15cb3dSCy Schubertleast so that the certificate lifetime is within the current year. 6212b15cb3dSCy SchubertAfter that and when the host is synchronized to a proventic source, the 6222b15cb3dSCy Schubertcertificate should be re-generated. 623*052d159aSCy Schubert</p> 6242b15cb3dSCy Schubert<p>Additional information on trusted groups and identity schemes is on the 625*052d159aSCy Schubert“Autokey Public-Key Authentication” 6262b15cb3dSCy Schubertpage. 627*052d159aSCy Schubert</p> 6282b15cb3dSCy Schubert<p>File names begin with the prefix 629*052d159aSCy Schubert<samp>ntpkey</samp>_ 63009100258SXin LIand end with the suffix 631*052d159aSCy Schubert<samp>_</samp><kbd>hostname</kbd>. <kbd>filestamp</kbd>, 6322b15cb3dSCy Schubertwhere 6332b15cb3dSCy Schubert<kbd>hostname</kbd> 6342b15cb3dSCy Schubertis the owner name, usually the string returned 63509100258SXin LIby the Unix 63609100258SXin LI<code>hostname(1)</code> 63709100258SXin LIcommand, and 6382b15cb3dSCy Schubert<kbd>filestamp</kbd> 6392b15cb3dSCy Schubertis the NTP seconds when the file was generated, in decimal digits. 6402b15cb3dSCy SchubertThis both guarantees uniqueness and simplifies maintenance 6412b15cb3dSCy Schubertprocedures, since all files can be quickly removed 6422b15cb3dSCy Schubertby a 643*052d159aSCy Schubert<code>rm</code> <samp>ntpkey*</samp> 6442b15cb3dSCy Schubertcommand or all files generated 6452b15cb3dSCy Schubertat a specific time can be removed by a 646*052d159aSCy Schubert<code>rm</code> <samp>*</samp><kbd>filestamp</kbd> 6472b15cb3dSCy Schubertcommand. 6482b15cb3dSCy SchubertTo further reduce the risk of misconfiguration, 6492b15cb3dSCy Schubertthe first two lines of a file contain the file name 6502b15cb3dSCy Schubertand generation date and time as comments. 651*052d159aSCy Schubert</p> 652*052d159aSCy Schubert<a name="Trusted-Hosts-and-Groups"></a> 653*052d159aSCy Schubert<h4 class="subsubsection">1.2.1.1 Trusted Hosts and Groups</h4> 65409100258SXin LI<p>Each cryptographic configuration involves selection of a signature scheme 6552b15cb3dSCy Schubertand identification scheme, called a cryptotype, 6562b15cb3dSCy Schubertas explained in the 657*052d159aSCy Schubert‘Authentication Options’ 6582b15cb3dSCy Schubertsection of 6592b15cb3dSCy Schubert<code>ntp.conf(5)</code>. 66009100258SXin LIThe default cryptotype uses 66109100258SXin LI<code>RSA</code> 66209100258SXin LIencryption, 66309100258SXin LI<code>MD5</code> 66409100258SXin LImessage digest 66509100258SXin LIand 66609100258SXin LI<code>TC</code> 66709100258SXin LIidentification. 6682b15cb3dSCy SchubertFirst, configure a NTP subnet including one or more low-stratum 6692b15cb3dSCy Schuberttrusted hosts from which all other hosts derive synchronization 6702b15cb3dSCy Schubertdirectly or indirectly. 6712b15cb3dSCy SchubertTrusted hosts have trusted certificates; 6722b15cb3dSCy Schubertall other hosts have nontrusted certificates. 6732b15cb3dSCy SchubertThese hosts will automatically and dynamically build authoritative 6742b15cb3dSCy Schubertcertificate trails to one or more trusted hosts. 6752b15cb3dSCy SchubertA trusted group is the set of all hosts that have, directly or indirectly, 6762b15cb3dSCy Schuberta certificate trail ending at a trusted host. 6772b15cb3dSCy SchubertThe trail is defined by static configuration file entries 6782b15cb3dSCy Schubertor dynamic means described on the 679*052d159aSCy Schubert‘Automatic NTP Configuration Options’ 6802b15cb3dSCy Schubertsection of 6812b15cb3dSCy Schubert<code>ntp.conf(5)</code>. 682*052d159aSCy Schubert</p> 6832b15cb3dSCy Schubert<p>On each trusted host as root, change to the keys directory. 6842b15cb3dSCy SchubertTo insure a fresh fileset, remove all 685*052d159aSCy Schubert<samp>ntpkey</samp> 6862b15cb3dSCy Schubertfiles. 6872b15cb3dSCy SchubertThen run 6882b15cb3dSCy Schubert<code>ntp-keygen</code> 6892b15cb3dSCy Schubert<code>-T</code> 6902b15cb3dSCy Schubertto generate keys and a trusted certificate. 6912b15cb3dSCy SchubertOn all other hosts do the same, but leave off the 6922b15cb3dSCy Schubert<code>-T</code> 6932b15cb3dSCy Schubertflag to generate keys and nontrusted certificates. 6942b15cb3dSCy SchubertWhen complete, start the NTP daemons beginning at the lowest stratum 6952b15cb3dSCy Schubertand working up the tree. 6962b15cb3dSCy SchubertIt may take some time for Autokey to instantiate the certificate trails 6972b15cb3dSCy Schubertthroughout the subnet, but setting up the environment is completely automatic. 698*052d159aSCy Schubert</p> 6992b15cb3dSCy Schubert<p>If it is necessary to use a different sign key or different digest/signature 7002b15cb3dSCy Schubertscheme than the default, run 7012b15cb3dSCy Schubert<code>ntp-keygen</code> 7022b15cb3dSCy Schubertwith the 7032b15cb3dSCy Schubert<code>-S</code> <kbd>type</kbd> 7042b15cb3dSCy Schubertoption, where 7052b15cb3dSCy Schubert<kbd>type</kbd> 7062b15cb3dSCy Schubertis either 7072b15cb3dSCy Schubert<code>RSA</code> 7082b15cb3dSCy Schubertor 7092b15cb3dSCy Schubert<code>DSA</code>. 71009100258SXin LIThe most frequent need to do this is when a 71109100258SXin LI<code>DSA</code>-signed 71209100258SXin LIcertificate is used. 7132b15cb3dSCy SchubertIf it is necessary to use a different certificate scheme than the default, 7142b15cb3dSCy Schubertrun 7152b15cb3dSCy Schubert<code>ntp-keygen</code> 7162b15cb3dSCy Schubertwith the 7172b15cb3dSCy Schubert<code>-c</code> <kbd>scheme</kbd> 7182b15cb3dSCy Schubertoption and selected 7192b15cb3dSCy Schubert<kbd>scheme</kbd> 7202b15cb3dSCy Schubertas needed. 72109100258SXin LIIf 7222b15cb3dSCy Schubert<code>ntp-keygen</code> 7232b15cb3dSCy Schubertis run again without these options, it generates a new certificate 72409100258SXin LIusing the same scheme and sign key, and soft link. 725*052d159aSCy Schubert</p> 7262b15cb3dSCy Schubert<p>After setting up the environment it is advisable to update certificates 7272b15cb3dSCy Schubertfrom time to time, if only to extend the validity interval. 7282b15cb3dSCy SchubertSimply run 7292b15cb3dSCy Schubert<code>ntp-keygen</code> 7302b15cb3dSCy Schubertwith the same flags as before to generate new certificates 73109100258SXin LIusing existing keys, and soft links. 7322b15cb3dSCy SchubertHowever, if the host or sign key is changed, 7332b15cb3dSCy Schubert<code>ntpd(1ntpdmdoc)</code> 7342b15cb3dSCy Schubertshould be restarted. 7352b15cb3dSCy SchubertWhen 7362b15cb3dSCy Schubert<code>ntpd(1ntpdmdoc)</code> 7372b15cb3dSCy Schubertis restarted, it loads any new files and restarts the protocol. 7382b15cb3dSCy SchubertOther dependent hosts will continue as usual until signatures are refreshed, 7392b15cb3dSCy Schubertat which time the protocol is restarted. 740*052d159aSCy Schubert</p> 741*052d159aSCy Schubert<a name="Identity-Schemes"></a> 742*052d159aSCy Schubert<h4 class="subsubsection">1.2.1.2 Identity Schemes</h4> 7432b15cb3dSCy Schubert<p>As mentioned on the Autonomous Authentication page, 74409100258SXin LIthe default 74509100258SXin LI<code>TC</code> 74609100258SXin LIidentity scheme is vulnerable to a middleman attack. 7472b15cb3dSCy SchubertHowever, there are more secure identity schemes available, 74809100258SXin LIincluding 74909100258SXin LI<code>PC</code>, <code>IFF</code>, <code>GQ</code> 75009100258SXin LIand 75109100258SXin LI<code>MV</code> 75209100258SXin LIschemes described below. 7532b15cb3dSCy SchubertThese schemes are based on a TA, one or more trusted hosts 7542b15cb3dSCy Schubertand some number of nontrusted hosts. 7552b15cb3dSCy SchubertTrusted hosts prove identity using values provided by the TA, 7562b15cb3dSCy Schubertwhile the remaining hosts prove identity using values provided 7572b15cb3dSCy Schubertby a trusted host and certificate trails that end on that host. 7582b15cb3dSCy SchubertThe name of a trusted host is also the name of its sugroup 7592b15cb3dSCy Schubertand also the subject and issuer name on its trusted certificate. 7602b15cb3dSCy SchubertThe TA is not necessarily a trusted host in this sense, but often is. 761*052d159aSCy Schubert</p> 7622b15cb3dSCy Schubert<p>In some schemes there are separate keys for servers and clients. 7632b15cb3dSCy SchubertA server can also be a client of another server, 7642b15cb3dSCy Schubertbut a client can never be a server for another client. 7652b15cb3dSCy SchubertIn general, trusted hosts and nontrusted hosts that operate 7662b15cb3dSCy Schubertas both server and client have parameter files that contain 7672b15cb3dSCy Schubertboth server and client keys. 7682b15cb3dSCy SchubertHosts that operate 7692b15cb3dSCy Schubertonly as clients have key files that contain only client keys. 770*052d159aSCy Schubert</p> 7712b15cb3dSCy Schubert<p>The PC scheme supports only one trusted host in the group. 7722b15cb3dSCy SchubertOn trusted host alice run 7732b15cb3dSCy Schubert<code>ntp-keygen</code> 7742b15cb3dSCy Schubert<code>-P</code> 7752b15cb3dSCy Schubert<code>-p</code> <kbd>password</kbd> 7762b15cb3dSCy Schubertto generate the host key file 777*052d159aSCy Schubert<samp>ntpkey</samp>_ <code>RSA</code> <samp>key_alice.</samp> <kbd>filestamp</kbd> 7782b15cb3dSCy Schubertand trusted private certificate file 779*052d159aSCy Schubert<samp>ntpkey</samp>_ <code>RSA-MD5</code> <code>_</code> <samp>cert_alice.</samp> <kbd>filestamp</kbd>, 78009100258SXin LIand soft links. 7812b15cb3dSCy SchubertCopy both files to all group hosts; 7822b15cb3dSCy Schubertthey replace the files which would be generated in other schemes. 78309100258SXin LIOn each host 78409100258SXin LI<kbd>bob</kbd> 78509100258SXin LIinstall a soft link from the generic name 786*052d159aSCy Schubert<samp>ntpkey_host_</samp><kbd>bob</kbd> 7872b15cb3dSCy Schubertto the host key file and soft link 788*052d159aSCy Schubert<samp>ntpkey_cert_</samp><kbd>bob</kbd> 7892b15cb3dSCy Schubertto the private certificate file. 7902b15cb3dSCy SchubertNote the generic links are on bob, but point to files generated 7912b15cb3dSCy Schubertby trusted host alice. 7922b15cb3dSCy SchubertIn this scheme it is not possible to refresh 7932b15cb3dSCy Schuberteither the keys or certificates without copying them 79409100258SXin LIto all other hosts in the group, and recreating the soft links. 795*052d159aSCy Schubert</p> 79609100258SXin LI<p>For the 79709100258SXin LI<code>IFF</code> 79809100258SXin LIscheme proceed as in the 79909100258SXin LI<code>TC</code> 80009100258SXin LIscheme to generate keys 8012b15cb3dSCy Schubertand certificates for all group hosts, then for every trusted host in the group, 80209100258SXin LIgenerate the 80309100258SXin LI<code>IFF</code> 80409100258SXin LIparameter file. 8052b15cb3dSCy SchubertOn trusted host alice run 8062b15cb3dSCy Schubert<code>ntp-keygen</code> 8072b15cb3dSCy Schubert<code>-T</code> 8082b15cb3dSCy Schubert<code>-I</code> 8092b15cb3dSCy Schubert<code>-p</code> <kbd>password</kbd> 8102b15cb3dSCy Schubertto produce her parameter file 811*052d159aSCy Schubert<samp>ntpkey_IFFpar_alice.</samp><kbd>filestamp</kbd>, 8122b15cb3dSCy Schubertwhich includes both server and client keys. 8132b15cb3dSCy SchubertCopy this file to all group hosts that operate as both servers 8142b15cb3dSCy Schubertand clients and install a soft link from the generic 815*052d159aSCy Schubert<samp>ntpkey_iff_alice</samp> 8162b15cb3dSCy Schubertto this file. 8172b15cb3dSCy SchubertIf there are no hosts restricted to operate only as clients, 8182b15cb3dSCy Schubertthere is nothing further to do. 81909100258SXin LIAs the 82009100258SXin LI<code>IFF</code> 82109100258SXin LIscheme is independent 8222b15cb3dSCy Schubertof keys and certificates, these files can be refreshed as needed. 823*052d159aSCy Schubert</p> 8242b15cb3dSCy Schubert<p>If a rogue client has the parameter file, it could masquerade 8252b15cb3dSCy Schubertas a legitimate server and present a middleman threat. 8262b15cb3dSCy SchubertTo eliminate this threat, the client keys can be extracted 8272b15cb3dSCy Schubertfrom the parameter file and distributed to all restricted clients. 8282b15cb3dSCy SchubertAfter generating the parameter file, on alice run 8292b15cb3dSCy Schubert<code>ntp-keygen</code> 8302b15cb3dSCy Schubert<code>-e</code> 83109100258SXin LIand pipe the output to a file or email program. 83209100258SXin LICopy or email this file to all restricted clients. 8332b15cb3dSCy SchubertOn these clients install a soft link from the generic 834*052d159aSCy Schubert<samp>ntpkey_iff_alice</samp> 8352b15cb3dSCy Schubertto this file. 8362b15cb3dSCy SchubertTo further protect the integrity of the keys, 8372b15cb3dSCy Schuberteach file can be encrypted with a secret password. 838*052d159aSCy Schubert</p> 83909100258SXin LI<p>For the 84009100258SXin LI<code>GQ</code> 84109100258SXin LIscheme proceed as in the 84209100258SXin LI<code>TC</code> 84309100258SXin LIscheme to generate keys 8442b15cb3dSCy Schubertand certificates for all group hosts, then for every trusted host 84509100258SXin LIin the group, generate the 84609100258SXin LI<code>IFF</code> 84709100258SXin LIparameter file. 8482b15cb3dSCy SchubertOn trusted host alice run 8492b15cb3dSCy Schubert<code>ntp-keygen</code> 8502b15cb3dSCy Schubert<code>-T</code> 8512b15cb3dSCy Schubert<code>-G</code> 8522b15cb3dSCy Schubert<code>-p</code> <kbd>password</kbd> 8532b15cb3dSCy Schubertto produce her parameter file 854*052d159aSCy Schubert<samp>ntpkey_GQpar_alice.</samp><kbd>filestamp</kbd>, 8552b15cb3dSCy Schubertwhich includes both server and client keys. 8562b15cb3dSCy SchubertCopy this file to all group hosts and install a soft link 8572b15cb3dSCy Schubertfrom the generic 858*052d159aSCy Schubert<samp>ntpkey_gq_alice</samp> 8592b15cb3dSCy Schubertto this file. 86009100258SXin LIIn addition, on each host 86109100258SXin LI<kbd>bob</kbd> 86209100258SXin LIinstall a soft link 8632b15cb3dSCy Schubertfrom generic 864*052d159aSCy Schubert<samp>ntpkey_gq_</samp><kbd>bob</kbd> 8652b15cb3dSCy Schubertto this file. 86609100258SXin LIAs the 86709100258SXin LI<code>GQ</code> 86809100258SXin LIscheme updates the 86909100258SXin LI<code>GQ</code> 87009100258SXin LIparameters file and certificate 8712b15cb3dSCy Schubertat the same time, keys and certificates can be regenerated as needed. 872*052d159aSCy Schubert</p> 87309100258SXin LI<p>For the 87409100258SXin LI<code>MV</code> 87509100258SXin LIscheme, proceed as in the 87609100258SXin LI<code>TC</code> 87709100258SXin LIscheme to generate keys 8782b15cb3dSCy Schubertand certificates for all group hosts. 8792b15cb3dSCy SchubertFor illustration assume trish is the TA, alice one of several trusted hosts 8802b15cb3dSCy Schubertand bob one of her clients. 8812b15cb3dSCy SchubertOn TA trish run 8822b15cb3dSCy Schubert<code>ntp-keygen</code> 8832b15cb3dSCy Schubert<code>-V</code> <kbd>n</kbd> 8842b15cb3dSCy Schubert<code>-p</code> <kbd>password</kbd>, 8852b15cb3dSCy Schubertwhere 8862b15cb3dSCy Schubert<kbd>n</kbd> 8872b15cb3dSCy Schubertis the number of revokable keys (typically 5) to produce 8882b15cb3dSCy Schubertthe parameter file 889*052d159aSCy Schubert<samp>ntpkeys_MVpar_trish.</samp><kbd>filestamp</kbd> 8902b15cb3dSCy Schubertand client key files 891*052d159aSCy Schubert<samp>ntpkeys_MVkey</samp><kbd>d</kbd> <kbd>_</kbd> <samp>trish.</samp> <kbd>filestamp</kbd> 8922b15cb3dSCy Schubertwhere 8932b15cb3dSCy Schubert<kbd>d</kbd> 8942b15cb3dSCy Schubertis the key number (0 < 8952b15cb3dSCy Schubert<kbd>d</kbd> 8962b15cb3dSCy Schubert< 8972b15cb3dSCy Schubert<kbd>n</kbd>). 8982b15cb3dSCy SchubertCopy the parameter file to alice and install a soft link 8992b15cb3dSCy Schubertfrom the generic 900*052d159aSCy Schubert<samp>ntpkey_mv_alice</samp> 9012b15cb3dSCy Schubertto this file. 9022b15cb3dSCy SchubertCopy one of the client key files to alice for later distribution 9032b15cb3dSCy Schubertto her clients. 90409100258SXin LIIt does not matter which client key file goes to alice, 9052b15cb3dSCy Schubertsince they all work the same way. 90609100258SXin LIAlice copies the client key file to all of her clients. 9072b15cb3dSCy SchubertOn client bob install a soft link from generic 908*052d159aSCy Schubert<samp>ntpkey_mvkey_bob</samp> 9092b15cb3dSCy Schubertto the client key file. 91009100258SXin LIAs the 91109100258SXin LI<code>MV</code> 91209100258SXin LIscheme is independent of keys and certificates, 9132b15cb3dSCy Schubertthese files can be refreshed as needed. 914*052d159aSCy Schubert</p> 915*052d159aSCy Schubert<a name="Command-Line-Options"></a> 916*052d159aSCy Schubert<h4 class="subsubsection">1.2.1.3 Command Line Options</h4> 917*052d159aSCy Schubert<dl compact="compact"> 918*052d159aSCy Schubert<dt><code>-b</code> <code>--imbits</code>= <kbd>modulus</kbd></dt> 919*052d159aSCy Schubert<dd><p>Set the number of bits in the identity modulus for generating identity keys to 92009100258SXin LI<kbd>modulus</kbd> 92109100258SXin LIbits. 92209100258SXin LIThe number of bits in the identity modulus defaults to 256, but can be set to 92309100258SXin LIvalues from 256 to 2048 (32 to 256 octets). 92409100258SXin LIUse the larger moduli with caution, as this can consume considerable computing 92509100258SXin LIresources and increases the size of authenticated packets. 926*052d159aSCy Schubert</p></dd> 927*052d159aSCy Schubert<dt><code>-c</code> <code>--certificate</code>= <kbd>scheme</kbd></dt> 928*052d159aSCy Schubert<dd><p>Select certificate signature encryption/message digest scheme. 9292b15cb3dSCy SchubertThe 9302b15cb3dSCy Schubert<kbd>scheme</kbd> 9312b15cb3dSCy Schubertcan be one of the following: 93209100258SXin LI<code>RSA-MD2</code>, <code>RSA-MD5</code>, <code>RSA-MDC2</code>, <code>RSA-SHA</code>, <code>RSA-SHA1</code>, <code>RSA-RIPEMD160</code>, <code>DSA-SHA</code>, 9332b15cb3dSCy Schubertor 9342b15cb3dSCy Schubert<code>DSA-SHA1</code>. 93509100258SXin LINote that 93609100258SXin LI<code>RSA</code> 93709100258SXin LIschemes must be used with an 93809100258SXin LI<code>RSA</code> 93909100258SXin LIsign key and 94009100258SXin LI<code>DSA</code> 94109100258SXin LIschemes must be used with a 94209100258SXin LI<code>DSA</code> 94309100258SXin LIsign key. 9442b15cb3dSCy SchubertThe default without this option is 9452b15cb3dSCy Schubert<code>RSA-MD5</code>. 94609100258SXin LIIf compatibility with FIPS 140-2 is required, either the 94709100258SXin LI<code>DSA-SHA</code> 94809100258SXin LIor 94909100258SXin LI<code>DSA-SHA1</code> 95009100258SXin LIscheme must be used. 951*052d159aSCy Schubert</p></dd> 952*052d159aSCy Schubert<dt><code>-C</code> <code>--cipher</code>= <kbd>cipher</kbd></dt> 953*052d159aSCy Schubert<dd><p>Select the OpenSSL cipher to encrypt the files containing private keys. 95409100258SXin LIThe default without this option is three-key triple DES in CBC mode, 95509100258SXin LI<code>des-ede3-cbc</code>. 95609100258SXin LIThe 95709100258SXin LI<code>openssl</code> <code>-h</code> 95809100258SXin LIcommand provided with OpenSSL displays available ciphers. 959*052d159aSCy Schubert</p></dd> 960*052d159aSCy Schubert<dt><code>-d</code> <code>--debug-level</code></dt> 961*052d159aSCy Schubert<dd><p>Increase debugging verbosity level. 9622b15cb3dSCy SchubertThis option displays the cryptographic data produced in eye-friendly billboards. 963*052d159aSCy Schubert</p></dd> 964*052d159aSCy Schubert<dt><code>-D</code> <code>--set-debug-level</code>= <kbd>level</kbd></dt> 965*052d159aSCy Schubert<dd><p>Set the debugging verbosity to 96609100258SXin LI<kbd>level</kbd>. 96709100258SXin LIThis option displays the cryptographic data produced in eye-friendly billboards. 968*052d159aSCy Schubert</p></dd> 969*052d159aSCy Schubert<dt><code>-e</code> <code>--id-key</code></dt> 970*052d159aSCy Schubert<dd><p>Write the 97109100258SXin LI<code>IFF</code> 97209100258SXin LIor 97309100258SXin LI<code>GQ</code> 97409100258SXin LIpublic parameters from the 97509100258SXin LI<kbd>IFFkey</kbd> <kbd>or</kbd> <kbd>GQkey</kbd> 97609100258SXin LIclient keys file previously specified 97709100258SXin LIas unencrypted data to the standard output stream 978*052d159aSCy Schubert<samp>stdout</samp>. 97909100258SXin LIThis is intended for automatic key distribution by email. 980*052d159aSCy Schubert</p></dd> 981*052d159aSCy Schubert<dt><code>-G</code> <code>--gq-params</code></dt> 982*052d159aSCy Schubert<dd><p>Generate a new encrypted 98309100258SXin LI<code>GQ</code> 98409100258SXin LIparameters and key file for the Guillou-Quisquater (GQ) identity scheme. 98509100258SXin LIThis option is mutually exclusive with the 98609100258SXin LI<code>-I</code> 98709100258SXin LIand 98809100258SXin LI<code>-V</code> 98909100258SXin LIoptions. 990*052d159aSCy Schubert</p></dd> 991*052d159aSCy Schubert<dt><code>-H</code> <code>--host-key</code></dt> 992*052d159aSCy Schubert<dd><p>Generate a new encrypted 99309100258SXin LI<code>RSA</code> 99409100258SXin LIpublic/private host key file. 995*052d159aSCy Schubert</p></dd> 996*052d159aSCy Schubert<dt><code>-I</code> <code>--iffkey</code></dt> 997*052d159aSCy Schubert<dd><p>Generate a new encrypted 99809100258SXin LI<code>IFF</code> 99909100258SXin LIkey file for the Schnorr (IFF) identity scheme. 100009100258SXin LIThis option is mutually exclusive with the 100109100258SXin LI<code>-G</code> 100209100258SXin LIand 100309100258SXin LIFl V 100409100258SXin LIoptions. 1005*052d159aSCy Schubert</p></dd> 1006*052d159aSCy Schubert<dt><code>-i</code> <code>--ident</code>= <kbd>group</kbd></dt> 1007*052d159aSCy Schubert<dd><p>Set the optional Autokey group name to 100809100258SXin LI<kbd>group</kbd>. 100909100258SXin LIThis is used in the identity scheme parameter file names of 101009100258SXin LI<code>IFF</code>, <code>GQ</code>, 101109100258SXin LIand 101209100258SXin LI<code>MV</code> 101309100258SXin LIclient parameters files. 101409100258SXin LIIn that role, the default is the host name if no group is provided. 101509100258SXin LIThe group name, if specified using 101609100258SXin LI<code>-i</code> 101709100258SXin LIor 101809100258SXin LI<code>-s</code> 101909100258SXin LIfollowing an 1020*052d159aSCy Schubert‘@’ 102109100258SXin LIcharacter, is also used in certificate subject and issuer names in the form 102209100258SXin LI<kbd>host</kbd> <kbd>@</kbd> <kbd>group</kbd> 102309100258SXin LIand should match the group specified via 102409100258SXin LI<code>crypto</code> <code>ident</code> 102509100258SXin LIor 102609100258SXin LI<code>server</code> <code>ident</code> 102709100258SXin LIin the ntpd configuration file. 1028*052d159aSCy Schubert</p></dd> 1029*052d159aSCy Schubert<dt><code>-l</code> <code>--lifetime</code>= <kbd>days</kbd></dt> 1030*052d159aSCy Schubert<dd><p>Set the lifetime for certificate expiration to 103109100258SXin LI<kbd>days</kbd>. 103209100258SXin LIThe default lifetime is one year (365 days). 1033*052d159aSCy Schubert</p></dd> 1034*052d159aSCy Schubert<dt><code>-m</code> <code>--modulus</code>= <kbd>bits</kbd></dt> 1035*052d159aSCy Schubert<dd><p>Set the number of bits in the prime modulus for generating files to 103609100258SXin LI<kbd>bits</kbd>. 103709100258SXin LIThe modulus defaults to 512, but can be set from 256 to 2048 (32 to 256 octets). 103809100258SXin LIUse the larger moduli with caution, as this can consume considerable computing 103909100258SXin LIresources and increases the size of authenticated packets. 1040*052d159aSCy Schubert</p></dd> 1041*052d159aSCy Schubert<dt><code>-M</code> <code>--md5key</code></dt> 1042*052d159aSCy Schubert<dd><p>Generate a new symmetric keys file containing 10 104309100258SXin LI<code>MD5</code> 104409100258SXin LIkeys, and if OpenSSL is available, 10 104509100258SXin LI<code>SHA</code> 104609100258SXin LIkeys. 104709100258SXin LIAn 104809100258SXin LI<code>MD5</code> 104909100258SXin LIkey is a string of 20 random printable ASCII characters, while a 105009100258SXin LI<code>SHA</code> 105109100258SXin LIkey is a string of 40 random hex digits. 105209100258SXin LIThe file can be edited using a text editor to change the key type or key content. 105309100258SXin LIThis option is mutually exclusive with all other options. 1054*052d159aSCy Schubert</p></dd> 1055*052d159aSCy Schubert<dt><code>-p</code> <code>--password</code>= <kbd>passwd</kbd></dt> 1056*052d159aSCy Schubert<dd><p>Set the password for reading and writing encrypted files to 105709100258SXin LI<kbd>passwd</kbd>. 105809100258SXin LIThese include the host, sign and identify key files. 105909100258SXin LIBy default, the password is the string returned by the Unix 106009100258SXin LI<code>hostname</code> 106109100258SXin LIcommand. 1062*052d159aSCy Schubert</p></dd> 1063*052d159aSCy Schubert<dt><code>-P</code> <code>--pvt-cert</code></dt> 1064*052d159aSCy Schubert<dd><p>Generate a new private certificate used by the 106509100258SXin LI<code>PC</code> 106609100258SXin LIidentity scheme. 10672b15cb3dSCy SchubertBy default, the program generates public certificates. 106809100258SXin LINote: the PC identity scheme is not recommended for new installations. 1069*052d159aSCy Schubert</p></dd> 1070*052d159aSCy Schubert<dt><code>-q</code> <code>--export-passwd</code>= <kbd>passwd</kbd></dt> 1071*052d159aSCy Schubert<dd><p>Set the password for writing encrypted 107209100258SXin LI<code>IFF</code>, <code>GQ</code> <code>and</code> <code>MV</code> 107309100258SXin LIidentity files redirected to 1074*052d159aSCy Schubert<samp>stdout</samp> 107509100258SXin LIto 107609100258SXin LI<kbd>passwd</kbd>. 107709100258SXin LIIn effect, these files are decrypted with the 107809100258SXin LI<code>-p</code> 107909100258SXin LIpassword, then encrypted with the 108009100258SXin LI<code>-q</code> 108109100258SXin LIpassword. 108209100258SXin LIBy default, the password is the string returned by the Unix 108309100258SXin LI<code>hostname</code> 108409100258SXin LIcommand. 1085*052d159aSCy Schubert</p></dd> 1086*052d159aSCy Schubert<dt><code>-s</code> <code>--subject-key</code>= <code>[host]</code> <code>[@ <kbd>group</kbd>]</code></dt> 1087*052d159aSCy Schubert<dd><p>Specify the Autokey host name, where 108809100258SXin LI<kbd>host</kbd> 108909100258SXin LIis the optional host name and 109009100258SXin LI<kbd>group</kbd> 109109100258SXin LIis the optional group name. 109209100258SXin LIThe host name, and if provided, group name are used in 109309100258SXin LI<kbd>host</kbd> <kbd>@</kbd> <kbd>group</kbd> 109409100258SXin LIform as certificate subject and issuer. 109509100258SXin LISpecifying 109609100258SXin LI<code>-s</code> <code>-@</code> <kbd>group</kbd> 109709100258SXin LIis allowed, and results in leaving the host name unchanged, as with 109809100258SXin LI<code>-i</code> <kbd>group</kbd>. 109909100258SXin LIThe group name, or if no group is provided, the host name are also used in the 110009100258SXin LIfile names of 110109100258SXin LI<code>IFF</code>, <code>GQ</code>, 110209100258SXin LIand 110309100258SXin LI<code>MV</code> 110409100258SXin LIidentity scheme client parameter files. 110509100258SXin LIIf 110609100258SXin LI<kbd>host</kbd> 110709100258SXin LIis not specified, the default host name is the string returned by the Unix 110809100258SXin LI<code>hostname</code> 110909100258SXin LIcommand. 1110*052d159aSCy Schubert</p></dd> 1111*052d159aSCy Schubert<dt><code>-S</code> <code>--sign-key</code>= <code>[<code>RSA</code> | <code>DSA</code>]</code></dt> 1112*052d159aSCy Schubert<dd><p>Generate a new encrypted public/private sign key file of the specified type. 111309100258SXin LIBy default, the sign key is the host key and has the same type. 111409100258SXin LIIf compatibility with FIPS 140-2 is required, the sign key type must be 111509100258SXin LI<code>DSA</code>. 1116*052d159aSCy Schubert</p></dd> 1117*052d159aSCy Schubert<dt><code>-T</code> <code>--trusted-cert</code></dt> 1118*052d159aSCy Schubert<dd><p>Generate a trusted certificate. 11192b15cb3dSCy SchubertBy default, the program generates a non-trusted certificate. 1120*052d159aSCy Schubert</p></dd> 1121*052d159aSCy Schubert<dt><code>-V</code> <code>--mv-params</code> <kbd>nkeys</kbd></dt> 1122*052d159aSCy Schubert<dd><p>Generate 112309100258SXin LI<kbd>nkeys</kbd> 112409100258SXin LIencrypted server keys and parameters for the Mu-Varadharajan (MV) 112509100258SXin LIidentity scheme. 112609100258SXin LIThis option is mutually exclusive with the 112709100258SXin LI<code>-I</code> 112809100258SXin LIand 112909100258SXin LI<code>-G</code> 113009100258SXin LIoptions. 113109100258SXin LINote: support for this option should be considered a work in progress. 1132*052d159aSCy Schubert</p></dd> 11332b15cb3dSCy Schubert</dl> 11342b15cb3dSCy Schubert 1135*052d159aSCy Schubert<a name="Random-Seed-File-1"></a> 1136*052d159aSCy Schubert<h4 class="subsubsection">1.2.1.4 Random Seed File</h4> 11372b15cb3dSCy Schubert<p>All cryptographically sound key generation schemes must have means 11382b15cb3dSCy Schubertto randomize the entropy seed used to initialize 11392b15cb3dSCy Schubertthe internal pseudo-random number generator used 11402b15cb3dSCy Schubertby the library routines. 11412b15cb3dSCy SchubertThe OpenSSL library uses a designated random seed file for this purpose. 11422b15cb3dSCy SchubertThe file must be available when starting the NTP daemon and 11432b15cb3dSCy Schubert<code>ntp-keygen</code> 11442b15cb3dSCy Schubertprogram. 11452b15cb3dSCy SchubertIf a site supports OpenSSL or its companion OpenSSH, 11462b15cb3dSCy Schubertit is very likely that means to do this are already available. 1147*052d159aSCy Schubert</p> 11482b15cb3dSCy Schubert<p>It is important to understand that entropy must be evolved 11492b15cb3dSCy Schubertfor each generation, for otherwise the random number sequence 11502b15cb3dSCy Schubertwould be predictable. 11512b15cb3dSCy SchubertVarious means dependent on external events, such as keystroke intervals, 11522b15cb3dSCy Schubertcan be used to do this and some systems have built-in entropy sources. 11532b15cb3dSCy SchubertSuitable means are described in the OpenSSL software documentation, 11542b15cb3dSCy Schubertbut are outside the scope of this page. 1155*052d159aSCy Schubert</p> 11562b15cb3dSCy Schubert<p>The entropy seed used by the OpenSSL library is contained in a file, 11572b15cb3dSCy Schubertusually called 1158*052d159aSCy Schubert<samp>.rnd</samp>, 11592b15cb3dSCy Schubertwhich must be available when starting the NTP daemon 11602b15cb3dSCy Schubertor the 11612b15cb3dSCy Schubert<code>ntp-keygen</code> 11622b15cb3dSCy Schubertprogram. 11632b15cb3dSCy SchubertThe NTP daemon will first look for the file 11642b15cb3dSCy Schubertusing the path specified by the 11652b15cb3dSCy Schubert<code>randfile</code> 11662b15cb3dSCy Schubertsubcommand of the 11672b15cb3dSCy Schubert<code>crypto</code> 11682b15cb3dSCy Schubertconfiguration command. 11692b15cb3dSCy SchubertIf not specified in this way, or when starting the 11702b15cb3dSCy Schubert<code>ntp-keygen</code> 11712b15cb3dSCy Schubertprogram, 11722b15cb3dSCy Schubertthe OpenSSL library will look for the file using the path specified 11732b15cb3dSCy Schubertby the 11742b15cb3dSCy Schubert.Ev RANDFILE 11752b15cb3dSCy Schubertenvironment variable in the user home directory, 11762b15cb3dSCy Schubertwhether root or some other user. 11772b15cb3dSCy SchubertIf the 11782b15cb3dSCy Schubert.Ev RANDFILE 11792b15cb3dSCy Schubertenvironment variable is not present, 11802b15cb3dSCy Schubertthe library will look for the 1181*052d159aSCy Schubert<samp>.rnd</samp> 11822b15cb3dSCy Schubertfile in the user home directory. 118309100258SXin LISince both the 118409100258SXin LI<code>ntp-keygen</code> 118509100258SXin LIprogram and 118609100258SXin LI<code>ntpd(1ntpdmdoc)</code> 118709100258SXin LIdaemon must run as root, the logical place to put this file is in 1188*052d159aSCy Schubert<samp>/.rnd</samp> 118909100258SXin LIor 1190*052d159aSCy Schubert<samp>/root/.rnd</samp>. 11912b15cb3dSCy SchubertIf the file is not available or cannot be written, 11922b15cb3dSCy Schubertthe daemon exits with a message to the system log and the program 11932b15cb3dSCy Schubertexits with a suitable error message. 1194*052d159aSCy Schubert</p> 1195*052d159aSCy Schubert<a name="Cryptographic-Data-Files-1"></a> 1196*052d159aSCy Schubert<h4 class="subsubsection">1.2.1.5 Cryptographic Data Files</h4> 119709100258SXin LI<p>All file formats begin with two nonencrypted lines. 119809100258SXin LIThe first line contains the file name, including the generated host name 119909100258SXin LIand filestamp, in the format 1200*052d159aSCy Schubert<samp>ntpkey_</samp><kbd>key</kbd> <kbd>_</kbd> <kbd>name</kbd>. <kbd>filestamp</kbd>, 120109100258SXin LIwhere 120209100258SXin LI<kbd>key</kbd> 120309100258SXin LIis the key or parameter type, 120409100258SXin LI<kbd>name</kbd> 120509100258SXin LIis the host or group name and 120609100258SXin LI<kbd>filestamp</kbd> 120709100258SXin LIis the filestamp (NTP seconds) when the file was created. 120809100258SXin LIBy convention, 120909100258SXin LI<kbd>key</kbd> 121009100258SXin LInames in generated file names include both upper and lower case 121109100258SXin LIcharacters, while 121209100258SXin LI<kbd>key</kbd> 121309100258SXin LInames in generated link names include only lower case characters. 121409100258SXin LIThe filestamp is not used in generated link names. 121509100258SXin LIThe second line contains the datestamp in conventional Unix 1216*052d159aSCy Schubert<samp>date</samp> 121709100258SXin LIformat. 121809100258SXin LILines beginning with 1219*052d159aSCy Schubert‘#’ 122009100258SXin LIare considered comments and ignored by the 12212b15cb3dSCy Schubert<code>ntp-keygen</code> 12222b15cb3dSCy Schubertprogram and 12232b15cb3dSCy Schubert<code>ntpd(1ntpdmdoc)</code> 12242b15cb3dSCy Schubertdaemon. 1225*052d159aSCy Schubert</p> 122609100258SXin LI<p>The remainder of the file contains cryptographic data, encoded first using ASN.1 122709100258SXin LIrules, then encrypted if necessary, and finally written in PEM-encoded 122809100258SXin LIprintable ASCII text, preceded and followed by MIME content identifier lines. 1229*052d159aSCy Schubert</p> 123009100258SXin LI<p>The format of the symmetric keys file, ordinarily named 1231*052d159aSCy Schubert<samp>ntp.keys</samp>, 123209100258SXin LIis somewhat different than the other files in the interest of backward compatibility. 123309100258SXin LIOrdinarily, the file is generated by this program, but it can be constructed 123409100258SXin LIand edited using an ordinary text editor. 1235*052d159aSCy Schubert</p><pre class="verbatim"># ntpkey_MD5key_bk.ntp.org.3595864945 123609100258SXin LI# Thu Dec 12 19:22:25 2013 123709100258SXin LI 1238*052d159aSCy Schubert1 MD5 L";Nw<\`.I<f4U0)247"i # MD5 key 1239*052d159aSCy Schubert2 MD5 &>l0%XXK9O'51VwV<xq~ # MD5 key 124009100258SXin LI3 MD5 lb4zLW~d^!K:]RsD'qb6 # MD5 key 124109100258SXin LI4 MD5 Yue:tL[+vR)M\`n~bY,'? # MD5 key 124209100258SXin LI5 MD5 B;fx'Kgr/&4ZTbL6=RxA # MD5 key 124309100258SXin LI6 MD5 4eYwa\`o@}3i@@@@V@@..R9!l # MD5 key 124409100258SXin LI7 MD5 \`A.([h+;wTQ|xfi%Sn_! # MD5 key 1245*052d159aSCy Schubert8 MD5 45:V,r4]l6y^JH6"Sh?F # MD5 key 124609100258SXin LI9 MD5 3-5vcn*6l29DS?Xdsg)* # MD5 key 124709100258SXin LI10 MD5 2late4Me # MD5 key 124809100258SXin LI11 SHA1 a27872d3030a9025b8446c751b4551a7629af65c # SHA1 key 124909100258SXin LI12 SHA1 21bc3b4865dbb9e920902abdccb3e04ff97a5e74 # SHA1 key 125009100258SXin LI13 SHA1 2b7736fe24fef5ba85ae11594132ab5d6f6daba9 # SHA1 key 125109100258SXin LI14 SHA a5332809c8878dd3a5b918819108a111509aeceb # SHA key 125209100258SXin LI15 MD2 2fe16c88c760ff2f16d4267e36c1aa6c926e6964 # MD2 key 125309100258SXin LI16 MD4 b2691811dc19cfc0e2f9bcacd74213f29812183d # MD4 key 125409100258SXin LI17 MD5 e4d6735b8bdad58ec5ffcb087300a17f7fef1f7c # MD5 key 125509100258SXin LI18 MDC2 a8d5e2315c025bf3a79174c87fbd10477de2eabc # MDC2 key 125609100258SXin LI19 RIPEMD160 77ca332cafb30e3cafb174dcd5b80ded7ba9b3d2 # RIPEMD160 key 125709100258SXin LI20 AES128CMAC f92ff73eee86c1e7dc638d6489a04e4e555af878 # AES128CMAC key 1258*052d159aSCy Schubert</pre><div class="example"> 125909100258SXin LI<pre class="example">Figure 1. Typical Symmetric Key File 1260*052d159aSCy Schubert</pre></div> 1261*052d159aSCy Schubert 126209100258SXin LI<p>Figure 1 shows a typical symmetric keys file used by the reference 126309100258SXin LIimplementation. 126409100258SXin LIFollowing the header the keys are entered one per line in the format 1265*052d159aSCy Schubert</p><div class="example"> 12662b15cb3dSCy Schubert<pre class="example"><kbd>keyno</kbd> <kbd>type</kbd> <kbd>key</kbd> 1267*052d159aSCy Schubert</pre></div> 12682b15cb3dSCy Schubert<p>where 12692b15cb3dSCy Schubert<kbd>keyno</kbd> 12704e1ef62aSXin LIis a positive integer in the range 1-65535; 12712b15cb3dSCy Schubert<kbd>type</kbd> 127209100258SXin LIis the key type for the message digest algorithm, which in the absence of the 127309100258SXin LIOpenSSL library must be 127409100258SXin LI<code>MD5</code> 127509100258SXin LIto designate the MD5 message digest algorithm; 127609100258SXin LIif the OpenSSL library is installed, the key type can be any 127709100258SXin LImessage digest algorithm supported by that library; 127809100258SXin LIhowever, if compatibility with FIPS 140-2 is required, 127909100258SXin LIthe key type must be either 128009100258SXin LI<code>SHA</code> 128109100258SXin LIor 128209100258SXin LI<code>SHA1</code>; 12832b15cb3dSCy Schubert<kbd>key</kbd> 12842b15cb3dSCy Schubertis the key itself, 128509100258SXin LIwhich is a printable ASCII string 20 characters or less in length: 128609100258SXin LIeach character is chosen from the 93 printable characters 128709100258SXin LIin the range 0x21 through 0x7e ( 1288*052d159aSCy Schubert‘’! 128909100258SXin LIthrough 1290*052d159aSCy Schubert‘~’ 129109100258SXin LI) excluding space and the 1292*052d159aSCy Schubert‘#’ 129309100258SXin LIcharacter, and terminated by whitespace or a 1294*052d159aSCy Schubert‘#’ 12952b15cb3dSCy Schubertcharacter. 129609100258SXin LIAn OpenSSL key consists of a hex-encoded ASCII string of 40 characters, which 129709100258SXin LIis truncated as necessary. 1298*052d159aSCy Schubert</p> 12992b15cb3dSCy Schubert<p>Note that the keys used by the 13002b15cb3dSCy Schubert<code>ntpq(1ntpqmdoc)</code> 13012b15cb3dSCy Schubertand 13022b15cb3dSCy Schubert<code>ntpdc(1ntpdcmdoc)</code> 13032b15cb3dSCy Schubertprograms 13042b15cb3dSCy Schubertare checked against passwords requested by the programs 13052b15cb3dSCy Schubertand entered by hand, so it is generally appropriate to specify these keys 13062b15cb3dSCy Schubertin human readable ASCII format. 1307*052d159aSCy Schubert</p> 13082b15cb3dSCy Schubert<p>The 13092b15cb3dSCy Schubert<code>ntp-keygen</code> 131009100258SXin LIprogram generates a symmetric keys file 1311*052d159aSCy Schubert<samp>ntpkey_MD5key_</samp><kbd>hostname</kbd>. <kbd>filestamp</kbd>. 13122b15cb3dSCy SchubertSince the file contains private shared keys, 13132b15cb3dSCy Schubertit should be visible only to root and distributed by secure means 13142b15cb3dSCy Schubertto other subnet hosts. 13152b15cb3dSCy SchubertThe NTP daemon loads the file 1316*052d159aSCy Schubert<samp>ntp.keys</samp>, 13172b15cb3dSCy Schubertso 13182b15cb3dSCy Schubert<code>ntp-keygen</code> 13192b15cb3dSCy Schubertinstalls a soft link from this name to the generated file. 13202b15cb3dSCy SchubertSubsequently, similar soft links must be installed by manual 13212b15cb3dSCy Schubertor automated means on the other subnet hosts. 13222b15cb3dSCy SchubertWhile this file is not used with the Autokey Version 2 protocol, 13232b15cb3dSCy Schubertit is needed to authenticate some remote configuration commands 13242b15cb3dSCy Schubertused by the 13252b15cb3dSCy Schubert<code>ntpq(1ntpqmdoc)</code> 13262b15cb3dSCy Schubertand 13272b15cb3dSCy Schubert<code>ntpdc(1ntpdcmdoc)</code> 13282b15cb3dSCy Schubertutilities. 1329*052d159aSCy Schubert</p> 13302b15cb3dSCy Schubert<p>This section was generated by <strong>AutoGen</strong>, 13312b15cb3dSCy Schubertusing the <code>agtexi-cmd</code> template and the option descriptions for the <code>ntp-keygen</code> program. 13322b15cb3dSCy SchubertThis software is released under the NTP license, <http://ntp.org/license>. 1333*052d159aSCy Schubert</p> 1334*052d159aSCy Schubert<table class="menu" border="0" cellspacing="0"> 1335*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-usage" accesskey="1">ntp-keygen usage</a>:</td><td> </td><td align="left" valign="top">ntp-keygen help/usage (<samp>--help</samp>) 1336*052d159aSCy Schubert</td></tr> 1337*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-imbits" accesskey="2">ntp-keygen imbits</a>:</td><td> </td><td align="left" valign="top">imbits option (-b) 1338*052d159aSCy Schubert</td></tr> 1339*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-certificate" accesskey="3">ntp-keygen certificate</a>:</td><td> </td><td align="left" valign="top">certificate option (-c) 1340*052d159aSCy Schubert</td></tr> 1341*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-cipher" accesskey="4">ntp-keygen cipher</a>:</td><td> </td><td align="left" valign="top">cipher option (-C) 1342*052d159aSCy Schubert</td></tr> 1343*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-id_002dkey" accesskey="5">ntp-keygen id-key</a>:</td><td> </td><td align="left" valign="top">id-key option (-e) 1344*052d159aSCy Schubert</td></tr> 1345*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-gq_002dparams" accesskey="6">ntp-keygen gq-params</a>:</td><td> </td><td align="left" valign="top">gq-params option (-G) 1346*052d159aSCy Schubert</td></tr> 1347*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-host_002dkey" accesskey="7">ntp-keygen host-key</a>:</td><td> </td><td align="left" valign="top">host-key option (-H) 1348*052d159aSCy Schubert</td></tr> 1349*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-iffkey" accesskey="8">ntp-keygen iffkey</a>:</td><td> </td><td align="left" valign="top">iffkey option (-I) 1350*052d159aSCy Schubert</td></tr> 1351*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-ident" accesskey="9">ntp-keygen ident</a>:</td><td> </td><td align="left" valign="top">ident option (-i) 1352*052d159aSCy Schubert</td></tr> 1353*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-lifetime">ntp-keygen lifetime</a>:</td><td> </td><td align="left" valign="top">lifetime option (-l) 1354*052d159aSCy Schubert</td></tr> 1355*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-modulus">ntp-keygen modulus</a>:</td><td> </td><td align="left" valign="top">modulus option (-m) 1356*052d159aSCy Schubert</td></tr> 1357*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-md5key">ntp-keygen md5key</a>:</td><td> </td><td align="left" valign="top">md5key option (-M) 1358*052d159aSCy Schubert</td></tr> 1359*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-pvt_002dcert">ntp-keygen pvt-cert</a>:</td><td> </td><td align="left" valign="top">pvt-cert option (-P) 1360*052d159aSCy Schubert</td></tr> 1361*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-password">ntp-keygen password</a>:</td><td> </td><td align="left" valign="top">password option (-p) 1362*052d159aSCy Schubert</td></tr> 1363*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-export_002dpasswd">ntp-keygen export-passwd</a>:</td><td> </td><td align="left" valign="top">export-passwd option (-q) 1364*052d159aSCy Schubert</td></tr> 1365*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-subject_002dname">ntp-keygen subject-name</a>:</td><td> </td><td align="left" valign="top">subject-name option (-s) 1366*052d159aSCy Schubert</td></tr> 1367*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-sign_002dkey">ntp-keygen sign-key</a>:</td><td> </td><td align="left" valign="top">sign-key option (-S) 1368*052d159aSCy Schubert</td></tr> 1369*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-trusted_002dcert">ntp-keygen trusted-cert</a>:</td><td> </td><td align="left" valign="top">trusted-cert option (-T) 1370*052d159aSCy Schubert</td></tr> 1371*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-mv_002dparams">ntp-keygen mv-params</a>:</td><td> </td><td align="left" valign="top">mv-params option (-V) 1372*052d159aSCy Schubert</td></tr> 1373*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-mv_002dkeys">ntp-keygen mv-keys</a>:</td><td> </td><td align="left" valign="top">mv-keys option (-v) 1374*052d159aSCy Schubert</td></tr> 1375*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-config">ntp-keygen config</a>:</td><td> </td><td align="left" valign="top">presetting/configuring ntp-keygen 1376*052d159aSCy Schubert</td></tr> 1377*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-exit-status">ntp-keygen exit status</a>:</td><td> </td><td align="left" valign="top">exit status 1378*052d159aSCy Schubert</td></tr> 1379*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-Usage">ntp-keygen Usage</a>:</td><td> </td><td align="left" valign="top">Usage 1380*052d159aSCy Schubert</td></tr> 1381*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-Notes">ntp-keygen Notes</a>:</td><td> </td><td align="left" valign="top">Notes 1382*052d159aSCy Schubert</td></tr> 1383*052d159aSCy Schubert<tr><td align="left" valign="top">• <a href="#ntp_002dkeygen-Bugs">ntp-keygen Bugs</a>:</td><td> </td><td align="left" valign="top">Bugs 1384*052d159aSCy Schubert</td></tr> 1385*052d159aSCy Schubert</table> 13862b15cb3dSCy Schubert 1387*052d159aSCy Schubert<hr> 1388*052d159aSCy Schubert<a name="ntp_002dkeygen-usage"></a> 1389*052d159aSCy Schubert<div class="header"> 1390*052d159aSCy Schubert<p> 1391*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-imbits" accesskey="n" rel="next">ntp-keygen imbits</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 13922b15cb3dSCy Schubert</div> 1393*052d159aSCy Schubert<a name="ntp_002dkeygen-help_002fusage-_0028_002d_002dhelp_0029"></a> 1394*052d159aSCy Schubert<h4 class="subsection">1.2.2 ntp-keygen help/usage (<samp>--help</samp>)</h4> 1395*052d159aSCy Schubert<a name="index-ntp_002dkeygen-help"></a> 13962b15cb3dSCy Schubert 1397*052d159aSCy Schubert<p>This is the automatically generated usage text for ntp-keygen. 1398*052d159aSCy Schubert</p> 13992b15cb3dSCy Schubert<p>The text printed is the same whether selected with the <code>help</code> option 1400*052d159aSCy Schubert(<samp>--help</samp>) or the <code>more-help</code> option (<samp>--more-help</samp>). <code>more-help</code> will print 14012b15cb3dSCy Schubertthe usage text by passing it through a pager program. 14022b15cb3dSCy Schubert<code>more-help</code> is disabled on platforms without a working 14032b15cb3dSCy Schubert<code>fork(2)</code> function. The <code>PAGER</code> environment variable is 1404*052d159aSCy Schubertused to select the program, defaulting to <samp>more</samp>. Both will exit 14052b15cb3dSCy Schubertwith a status code of 0. 1406*052d159aSCy Schubert</p> 1407*052d159aSCy Schubert<div class="example"> 1408*052d159aSCy Schubert<pre class="example">ntp-keygen (ntp) - Create a NTP host key - Ver. 4.2.8p12 14092b15cb3dSCy SchubertUsage: ntp-keygen [ -<flag> [<val>] | --<name>[{=| }<val>] ]... 14102b15cb3dSCy Schubert Flg Arg Option-Name Description 14112b15cb3dSCy Schubert -b Num imbits identity modulus bits 14122b15cb3dSCy Schubert - it must be in the range: 14132b15cb3dSCy Schubert 256 to 2048 14142b15cb3dSCy Schubert -c Str certificate certificate scheme 14152b15cb3dSCy Schubert -C Str cipher privatekey cipher 14162b15cb3dSCy Schubert -d no debug-level Increase debug verbosity level 14172b15cb3dSCy Schubert - may appear multiple times 14182b15cb3dSCy Schubert -D Num set-debug-level Set the debug verbosity level 14192b15cb3dSCy Schubert - may appear multiple times 14202b15cb3dSCy Schubert -e no id-key Write IFF or GQ identity keys 14212b15cb3dSCy Schubert -G no gq-params Generate GQ parameters and keys 14222b15cb3dSCy Schubert -H no host-key generate RSA host key 14232b15cb3dSCy Schubert -I no iffkey generate IFF parameters 14242b15cb3dSCy Schubert -i Str ident set Autokey group name 14252b15cb3dSCy Schubert -l Num lifetime set certificate lifetime 142609100258SXin LI -m Num modulus prime modulus 14272b15cb3dSCy Schubert - it must be in the range: 14282b15cb3dSCy Schubert 256 to 2048 142909100258SXin LI -M no md5key generate symmetric keys 14302b15cb3dSCy Schubert -P no pvt-cert generate PC private certificate 14312b15cb3dSCy Schubert -p Str password local private password 14322b15cb3dSCy Schubert -q Str export-passwd export IFF or GQ group keys with password 14332b15cb3dSCy Schubert -s Str subject-name set host and optionally group name 143409100258SXin LI -S Str sign-key generate sign key (RSA or DSA) 14352b15cb3dSCy Schubert -T no trusted-cert trusted certificate (TC scheme) 14362b15cb3dSCy Schubert -V Num mv-params generate <num> MV parameters 14372b15cb3dSCy Schubert -v Num mv-keys update <num> MV keys 14382b15cb3dSCy Schubert opt version output version information and exit 14392b15cb3dSCy Schubert -? no help display extended usage information and exit 14402b15cb3dSCy Schubert -! no more-help extended usage information passed thru pager 14412b15cb3dSCy Schubert -> opt save-opts save the option state to a config file 14422b15cb3dSCy Schubert -< Str load-opts load options from a config file 14432b15cb3dSCy Schubert - disabled as '--no-load-opts' 14442b15cb3dSCy Schubert - may appear multiple times 14452b15cb3dSCy Schubert 14462b15cb3dSCy SchubertOptions are specified by doubled hyphens and their name or by a single 14472b15cb3dSCy Schuberthyphen and the flag character. 14482b15cb3dSCy Schubert 14492b15cb3dSCy Schubert 14502b15cb3dSCy SchubertThe following option preset mechanisms are supported: 14512b15cb3dSCy Schubert - reading file $HOME/.ntprc 14522b15cb3dSCy Schubert - reading file ./.ntprc 14532b15cb3dSCy Schubert - examining environment variables named NTP_KEYGEN_* 14542b15cb3dSCy Schubert 14552b15cb3dSCy SchubertPlease send bug reports to: <http://bugs.ntp.org, bugs@ntp.org> 1456*052d159aSCy Schubert</pre></div> 1457*052d159aSCy Schubert 1458*052d159aSCy Schubert<hr> 1459*052d159aSCy Schubert<a name="ntp_002dkeygen-imbits"></a> 1460*052d159aSCy Schubert<div class="header"> 1461*052d159aSCy Schubert<p> 1462*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-certificate" accesskey="n" rel="next">ntp-keygen certificate</a>, Previous: <a href="#ntp_002dkeygen-usage" accesskey="p" rel="prev">ntp-keygen usage</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 14632b15cb3dSCy Schubert</div> 1464*052d159aSCy Schubert<a name="imbits-option-_0028_002db_0029"></a> 1465*052d159aSCy Schubert<h4 class="subsection">1.2.3 imbits option (-b)</h4> 1466*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dimbits"></a> 14672b15cb3dSCy Schubert 1468*052d159aSCy Schubert<p>This is the “identity modulus bits” option. 1469*052d159aSCy SchubertThis option takes a number argument <samp>imbits</samp>. 1470*052d159aSCy Schubert</p> 1471*052d159aSCy Schubert<p>This option has some usage constraints. It: 1472*052d159aSCy Schubert</p><ul> 14732b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1474*052d159aSCy Schubert</li></ul> 14752b15cb3dSCy Schubert 14762b15cb3dSCy Schubert<p>The number of bits in the identity modulus. The default is 256. 1477*052d159aSCy Schubert</p><hr> 1478*052d159aSCy Schubert<a name="ntp_002dkeygen-certificate"></a> 1479*052d159aSCy Schubert<div class="header"> 1480*052d159aSCy Schubert<p> 1481*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-cipher" accesskey="n" rel="next">ntp-keygen cipher</a>, Previous: <a href="#ntp_002dkeygen-imbits" accesskey="p" rel="prev">ntp-keygen imbits</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 14822b15cb3dSCy Schubert</div> 1483*052d159aSCy Schubert<a name="certificate-option-_0028_002dc_0029"></a> 1484*052d159aSCy Schubert<h4 class="subsection">1.2.4 certificate option (-c)</h4> 1485*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dcertificate"></a> 14862b15cb3dSCy Schubert 1487*052d159aSCy Schubert<p>This is the “certificate scheme” option. 1488*052d159aSCy SchubertThis option takes a string argument <samp>scheme</samp>. 1489*052d159aSCy Schubert</p> 1490*052d159aSCy Schubert<p>This option has some usage constraints. It: 1491*052d159aSCy Schubert</p><ul> 14922b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1493*052d159aSCy Schubert</li></ul> 14942b15cb3dSCy Schubert 14952b15cb3dSCy Schubert<p>scheme is one of 149609100258SXin LIRSA-MD2, RSA-MD5, RSA-MDC2, RSA-SHA, RSA-SHA1, RSA-RIPEMD160, 14972b15cb3dSCy SchubertDSA-SHA, or DSA-SHA1. 1498*052d159aSCy Schubert</p> 149909100258SXin LI<p>Select the certificate signature encryption/message digest scheme. 15002b15cb3dSCy SchubertNote that RSA schemes must be used with a RSA sign key and DSA 15012b15cb3dSCy Schubertschemes must be used with a DSA sign key. The default without 15022b15cb3dSCy Schubertthis option is RSA-MD5. 1503*052d159aSCy Schubert</p><hr> 1504*052d159aSCy Schubert<a name="ntp_002dkeygen-cipher"></a> 1505*052d159aSCy Schubert<div class="header"> 1506*052d159aSCy Schubert<p> 1507*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-id_002dkey" accesskey="n" rel="next">ntp-keygen id-key</a>, Previous: <a href="#ntp_002dkeygen-certificate" accesskey="p" rel="prev">ntp-keygen certificate</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 15082b15cb3dSCy Schubert</div> 1509*052d159aSCy Schubert<a name="cipher-option-_0028_002dC_0029"></a> 1510*052d159aSCy Schubert<h4 class="subsection">1.2.5 cipher option (-C)</h4> 1511*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dcipher"></a> 15122b15cb3dSCy Schubert 1513*052d159aSCy Schubert<p>This is the “privatekey cipher” option. 1514*052d159aSCy SchubertThis option takes a string argument <samp>cipher</samp>. 1515*052d159aSCy Schubert</p> 1516*052d159aSCy Schubert<p>This option has some usage constraints. It: 1517*052d159aSCy Schubert</p><ul> 15182b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1519*052d159aSCy Schubert</li></ul> 15202b15cb3dSCy Schubert 15212b15cb3dSCy Schubert<p>Select the cipher which is used to encrypt the files containing 15222b15cb3dSCy Schubertprivate keys. The default is three-key triple DES in CBC mode, 1523*052d159aSCy Schubertequivalent to "<code>-C des-ede3-cbc</code>". The openssl tool lists ciphers 1524*052d159aSCy Schubertavailable in "<code>openssl -h</code>" output. 1525*052d159aSCy Schubert</p><hr> 1526*052d159aSCy Schubert<a name="ntp_002dkeygen-id_002dkey"></a> 1527*052d159aSCy Schubert<div class="header"> 1528*052d159aSCy Schubert<p> 1529*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-gq_002dparams" accesskey="n" rel="next">ntp-keygen gq-params</a>, Previous: <a href="#ntp_002dkeygen-cipher" accesskey="p" rel="prev">ntp-keygen cipher</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 15302b15cb3dSCy Schubert</div> 1531*052d159aSCy Schubert<a name="id_002dkey-option-_0028_002de_0029"></a> 1532*052d159aSCy Schubert<h4 class="subsection">1.2.6 id-key option (-e)</h4> 1533*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002did_002dkey"></a> 15342b15cb3dSCy Schubert 1535*052d159aSCy Schubert<p>This is the “write iff or gq identity keys” option. 1536*052d159aSCy Schubert</p> 1537*052d159aSCy Schubert<p>This option has some usage constraints. It: 1538*052d159aSCy Schubert</p><ul> 15392b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1540*052d159aSCy Schubert</li></ul> 15412b15cb3dSCy Schubert 154209100258SXin LI<p>Write the public parameters from the IFF or GQ client keys to 154309100258SXin LIthe standard output. 154409100258SXin LIThis is intended for automatic key distribution by email. 1545*052d159aSCy Schubert</p><hr> 1546*052d159aSCy Schubert<a name="ntp_002dkeygen-gq_002dparams"></a> 1547*052d159aSCy Schubert<div class="header"> 1548*052d159aSCy Schubert<p> 1549*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-host_002dkey" accesskey="n" rel="next">ntp-keygen host-key</a>, Previous: <a href="#ntp_002dkeygen-id_002dkey" accesskey="p" rel="prev">ntp-keygen id-key</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 15502b15cb3dSCy Schubert</div> 1551*052d159aSCy Schubert<a name="gq_002dparams-option-_0028_002dG_0029"></a> 1552*052d159aSCy Schubert<h4 class="subsection">1.2.7 gq-params option (-G)</h4> 1553*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dgq_002dparams"></a> 15542b15cb3dSCy Schubert 1555*052d159aSCy Schubert<p>This is the “generate gq parameters and keys” option. 1556*052d159aSCy Schubert</p> 1557*052d159aSCy Schubert<p>This option has some usage constraints. It: 1558*052d159aSCy Schubert</p><ul> 15592b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1560*052d159aSCy Schubert</li></ul> 15612b15cb3dSCy Schubert 15622b15cb3dSCy Schubert<p>Generate parameters and keys for the GQ identification scheme, 15632b15cb3dSCy Schubertobsoleting any that may exist. 1564*052d159aSCy Schubert</p><hr> 1565*052d159aSCy Schubert<a name="ntp_002dkeygen-host_002dkey"></a> 1566*052d159aSCy Schubert<div class="header"> 1567*052d159aSCy Schubert<p> 1568*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-iffkey" accesskey="n" rel="next">ntp-keygen iffkey</a>, Previous: <a href="#ntp_002dkeygen-gq_002dparams" accesskey="p" rel="prev">ntp-keygen gq-params</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 15692b15cb3dSCy Schubert</div> 1570*052d159aSCy Schubert<a name="host_002dkey-option-_0028_002dH_0029"></a> 1571*052d159aSCy Schubert<h4 class="subsection">1.2.8 host-key option (-H)</h4> 1572*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dhost_002dkey"></a> 15732b15cb3dSCy Schubert 1574*052d159aSCy Schubert<p>This is the “generate rsa host key” option. 1575*052d159aSCy Schubert</p> 1576*052d159aSCy Schubert<p>This option has some usage constraints. It: 1577*052d159aSCy Schubert</p><ul> 15782b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1579*052d159aSCy Schubert</li></ul> 15802b15cb3dSCy Schubert 15812b15cb3dSCy Schubert<p>Generate new host keys, obsoleting any that may exist. 1582*052d159aSCy Schubert</p><hr> 1583*052d159aSCy Schubert<a name="ntp_002dkeygen-iffkey"></a> 1584*052d159aSCy Schubert<div class="header"> 1585*052d159aSCy Schubert<p> 1586*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-ident" accesskey="n" rel="next">ntp-keygen ident</a>, Previous: <a href="#ntp_002dkeygen-host_002dkey" accesskey="p" rel="prev">ntp-keygen host-key</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 15872b15cb3dSCy Schubert</div> 1588*052d159aSCy Schubert<a name="iffkey-option-_0028_002dI_0029"></a> 1589*052d159aSCy Schubert<h4 class="subsection">1.2.9 iffkey option (-I)</h4> 1590*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002diffkey"></a> 15912b15cb3dSCy Schubert 1592*052d159aSCy Schubert<p>This is the “generate iff parameters” option. 1593*052d159aSCy Schubert</p> 1594*052d159aSCy Schubert<p>This option has some usage constraints. It: 1595*052d159aSCy Schubert</p><ul> 15962b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1597*052d159aSCy Schubert</li></ul> 15982b15cb3dSCy Schubert 15992b15cb3dSCy Schubert<p>Generate parameters for the IFF identification scheme, obsoleting 16002b15cb3dSCy Schubertany that may exist. 1601*052d159aSCy Schubert</p><hr> 1602*052d159aSCy Schubert<a name="ntp_002dkeygen-ident"></a> 1603*052d159aSCy Schubert<div class="header"> 1604*052d159aSCy Schubert<p> 1605*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-lifetime" accesskey="n" rel="next">ntp-keygen lifetime</a>, Previous: <a href="#ntp_002dkeygen-iffkey" accesskey="p" rel="prev">ntp-keygen iffkey</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 16062b15cb3dSCy Schubert</div> 1607*052d159aSCy Schubert<a name="ident-option-_0028_002di_0029"></a> 1608*052d159aSCy Schubert<h4 class="subsection">1.2.10 ident option (-i)</h4> 1609*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dident"></a> 16102b15cb3dSCy Schubert 1611*052d159aSCy Schubert<p>This is the “set autokey group name” option. 1612*052d159aSCy SchubertThis option takes a string argument <samp>group</samp>. 1613*052d159aSCy Schubert</p> 1614*052d159aSCy Schubert<p>This option has some usage constraints. It: 1615*052d159aSCy Schubert</p><ul> 16162b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1617*052d159aSCy Schubert</li></ul> 16182b15cb3dSCy Schubert 16192b15cb3dSCy Schubert<p>Set the optional Autokey group name to name. This is used in 16202b15cb3dSCy Schubertthe file name of IFF, GQ, and MV client parameters files. In 16212b15cb3dSCy Schubertthat role, the default is the host name if this option is not 16222b15cb3dSCy Schubertprovided. The group name, if specified using <code>-i/--ident</code> or 1623*052d159aSCy Schubertusing <code>-s/--subject-name</code> following an ’<code>@</code>’ character, 162409100258SXin LIis also a part of the self-signed host certificate subject and 162509100258SXin LIissuer names in the form <code>host@group</code> and should match the 1626*052d159aSCy Schubert’<code>crypto ident</code>’ or ’<code>server ident</code>’ configuration in the 162709100258SXin LI<code>ntpd</code> configuration file. 1628*052d159aSCy Schubert</p><hr> 1629*052d159aSCy Schubert<a name="ntp_002dkeygen-lifetime"></a> 1630*052d159aSCy Schubert<div class="header"> 1631*052d159aSCy Schubert<p> 1632*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-modulus" accesskey="n" rel="next">ntp-keygen modulus</a>, Previous: <a href="#ntp_002dkeygen-ident" accesskey="p" rel="prev">ntp-keygen ident</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 16332b15cb3dSCy Schubert</div> 1634*052d159aSCy Schubert<a name="lifetime-option-_0028_002dl_0029"></a> 1635*052d159aSCy Schubert<h4 class="subsection">1.2.11 lifetime option (-l)</h4> 1636*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dlifetime"></a> 16372b15cb3dSCy Schubert 1638*052d159aSCy Schubert<p>This is the “set certificate lifetime” option. 1639*052d159aSCy SchubertThis option takes a number argument <samp>lifetime</samp>. 1640*052d159aSCy Schubert</p> 1641*052d159aSCy Schubert<p>This option has some usage constraints. It: 1642*052d159aSCy Schubert</p><ul> 16432b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1644*052d159aSCy Schubert</li></ul> 16452b15cb3dSCy Schubert 16462b15cb3dSCy Schubert<p>Set the certificate expiration to lifetime days from now. 1647*052d159aSCy Schubert</p><hr> 1648*052d159aSCy Schubert<a name="ntp_002dkeygen-modulus"></a> 1649*052d159aSCy Schubert<div class="header"> 1650*052d159aSCy Schubert<p> 1651*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-md5key" accesskey="n" rel="next">ntp-keygen md5key</a>, Previous: <a href="#ntp_002dkeygen-lifetime" accesskey="p" rel="prev">ntp-keygen lifetime</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 16522b15cb3dSCy Schubert</div> 1653*052d159aSCy Schubert<a name="modulus-option-_0028_002dm_0029"></a> 1654*052d159aSCy Schubert<h4 class="subsection">1.2.12 modulus option (-m)</h4> 1655*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dmodulus"></a> 16562b15cb3dSCy Schubert 1657*052d159aSCy Schubert<p>This is the “prime modulus” option. 1658*052d159aSCy SchubertThis option takes a number argument <samp>modulus</samp>. 1659*052d159aSCy Schubert</p> 1660*052d159aSCy Schubert<p>This option has some usage constraints. It: 1661*052d159aSCy Schubert</p><ul> 16622b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1663*052d159aSCy Schubert</li></ul> 16642b15cb3dSCy Schubert 16652b15cb3dSCy Schubert<p>The number of bits in the prime modulus. The default is 512. 1666*052d159aSCy Schubert</p><hr> 1667*052d159aSCy Schubert<a name="ntp_002dkeygen-md5key"></a> 1668*052d159aSCy Schubert<div class="header"> 1669*052d159aSCy Schubert<p> 1670*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-pvt_002dcert" accesskey="n" rel="next">ntp-keygen pvt-cert</a>, Previous: <a href="#ntp_002dkeygen-modulus" accesskey="p" rel="prev">ntp-keygen modulus</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 16712b15cb3dSCy Schubert</div> 1672*052d159aSCy Schubert<a name="md5key-option-_0028_002dM_0029"></a> 1673*052d159aSCy Schubert<h4 class="subsection">1.2.13 md5key option (-M)</h4> 1674*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dmd5key"></a> 16752b15cb3dSCy Schubert 1676*052d159aSCy Schubert<p>This is the “generate symmetric keys” option. 167709100258SXin LIGenerate symmetric keys, obsoleting any that may exist. 1678*052d159aSCy Schubert</p><hr> 1679*052d159aSCy Schubert<a name="ntp_002dkeygen-pvt_002dcert"></a> 1680*052d159aSCy Schubert<div class="header"> 1681*052d159aSCy Schubert<p> 1682*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-password" accesskey="n" rel="next">ntp-keygen password</a>, Previous: <a href="#ntp_002dkeygen-md5key" accesskey="p" rel="prev">ntp-keygen md5key</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 168309100258SXin LI</div> 1684*052d159aSCy Schubert<a name="pvt_002dcert-option-_0028_002dP_0029"></a> 1685*052d159aSCy Schubert<h4 class="subsection">1.2.14 pvt-cert option (-P)</h4> 1686*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dpvt_002dcert"></a> 168709100258SXin LI 1688*052d159aSCy Schubert<p>This is the “generate pc private certificate” option. 1689*052d159aSCy Schubert</p> 1690*052d159aSCy Schubert<p>This option has some usage constraints. It: 1691*052d159aSCy Schubert</p><ul> 16922b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1693*052d159aSCy Schubert</li></ul> 16942b15cb3dSCy Schubert 16952b15cb3dSCy Schubert<p>Generate a private certificate. By default, the program generates 16962b15cb3dSCy Schubertpublic certificates. 1697*052d159aSCy Schubert</p><hr> 1698*052d159aSCy Schubert<a name="ntp_002dkeygen-password"></a> 1699*052d159aSCy Schubert<div class="header"> 1700*052d159aSCy Schubert<p> 1701*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-export_002dpasswd" accesskey="n" rel="next">ntp-keygen export-passwd</a>, Previous: <a href="#ntp_002dkeygen-pvt_002dcert" accesskey="p" rel="prev">ntp-keygen pvt-cert</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 17022b15cb3dSCy Schubert</div> 1703*052d159aSCy Schubert<a name="password-option-_0028_002dp_0029"></a> 1704*052d159aSCy Schubert<h4 class="subsection">1.2.15 password option (-p)</h4> 1705*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dpassword"></a> 17062b15cb3dSCy Schubert 1707*052d159aSCy Schubert<p>This is the “local private password” option. 1708*052d159aSCy SchubertThis option takes a string argument <samp>passwd</samp>. 1709*052d159aSCy Schubert</p> 1710*052d159aSCy Schubert<p>This option has some usage constraints. It: 1711*052d159aSCy Schubert</p><ul> 17122b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1713*052d159aSCy Schubert</li></ul> 17142b15cb3dSCy Schubert 17152b15cb3dSCy Schubert<p>Local files containing private data are encrypted with the 17162b15cb3dSCy SchubertDES-CBC algorithm and the specified password. The same password 1717*052d159aSCy Schubertmust be specified to the local ntpd via the "crypto pw password" 17182b15cb3dSCy Schubertconfiguration command. The default password is the local 17192b15cb3dSCy Schuberthostname. 1720*052d159aSCy Schubert</p><hr> 1721*052d159aSCy Schubert<a name="ntp_002dkeygen-export_002dpasswd"></a> 1722*052d159aSCy Schubert<div class="header"> 1723*052d159aSCy Schubert<p> 1724*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-subject_002dname" accesskey="n" rel="next">ntp-keygen subject-name</a>, Previous: <a href="#ntp_002dkeygen-password" accesskey="p" rel="prev">ntp-keygen password</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 17252b15cb3dSCy Schubert</div> 1726*052d159aSCy Schubert<a name="export_002dpasswd-option-_0028_002dq_0029"></a> 1727*052d159aSCy Schubert<h4 class="subsection">1.2.16 export-passwd option (-q)</h4> 1728*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dexport_002dpasswd"></a> 17292b15cb3dSCy Schubert 1730*052d159aSCy Schubert<p>This is the “export iff or gq group keys with password” option. 1731*052d159aSCy SchubertThis option takes a string argument <samp>passwd</samp>. 1732*052d159aSCy Schubert</p> 1733*052d159aSCy Schubert<p>This option has some usage constraints. It: 1734*052d159aSCy Schubert</p><ul> 17352b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1736*052d159aSCy Schubert</li></ul> 17372b15cb3dSCy Schubert 17382b15cb3dSCy Schubert<p>Export IFF or GQ identity group keys to the standard output, 17392b15cb3dSCy Schubertencrypted with the DES-CBC algorithm and the specified password. 17402b15cb3dSCy SchubertThe same password must be specified to the remote ntpd via the 1741*052d159aSCy Schubert"crypto pw password" configuration command. See also the option 174209100258SXin LI–id-key (-e) for unencrypted exports. 1743*052d159aSCy Schubert</p><hr> 1744*052d159aSCy Schubert<a name="ntp_002dkeygen-subject_002dname"></a> 1745*052d159aSCy Schubert<div class="header"> 1746*052d159aSCy Schubert<p> 1747*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-sign_002dkey" accesskey="n" rel="next">ntp-keygen sign-key</a>, Previous: <a href="#ntp_002dkeygen-export_002dpasswd" accesskey="p" rel="prev">ntp-keygen export-passwd</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 17482b15cb3dSCy Schubert</div> 1749*052d159aSCy Schubert<a name="subject_002dname-option-_0028_002ds_0029"></a> 1750*052d159aSCy Schubert<h4 class="subsection">1.2.17 subject-name option (-s)</h4> 1751*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dsubject_002dname"></a> 17522b15cb3dSCy Schubert 1753*052d159aSCy Schubert<p>This is the “set host and optionally group name” option. 1754*052d159aSCy SchubertThis option takes a string argument <samp>host@group</samp>. 1755*052d159aSCy Schubert</p> 1756*052d159aSCy Schubert<p>This option has some usage constraints. It: 1757*052d159aSCy Schubert</p><ul> 175809100258SXin LI<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1759*052d159aSCy Schubert</li></ul> 176009100258SXin LI 176109100258SXin LI<p>Set the Autokey host name, and optionally, group name specified 1762*052d159aSCy Schubertfollowing an ’<code>@</code>’ character. The host name is used in the file 176309100258SXin LIname of generated host and signing certificates, without the 176409100258SXin LIgroup name. The host name, and if provided, group name are used 176509100258SXin LIin <code>host@group</code> form for the host certificate subject and issuer 1766*052d159aSCy Schubertfields. Specifying ’<code>-s @group</code>’ is allowed, and results in 176709100258SXin LIleaving the host name unchanged while appending <code>@group</code> to the 176809100258SXin LIsubject and issuer fields, as with <code>-i group</code>. The group name, or 176909100258SXin LIif not provided, the host name are also used in the file names 177009100258SXin LIof IFF, GQ, and MV client parameter files. 1771*052d159aSCy Schubert</p><hr> 1772*052d159aSCy Schubert<a name="ntp_002dkeygen-sign_002dkey"></a> 1773*052d159aSCy Schubert<div class="header"> 1774*052d159aSCy Schubert<p> 1775*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-trusted_002dcert" accesskey="n" rel="next">ntp-keygen trusted-cert</a>, Previous: <a href="#ntp_002dkeygen-subject_002dname" accesskey="p" rel="prev">ntp-keygen subject-name</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 177609100258SXin LI</div> 1777*052d159aSCy Schubert<a name="sign_002dkey-option-_0028_002dS_0029"></a> 1778*052d159aSCy Schubert<h4 class="subsection">1.2.18 sign-key option (-S)</h4> 1779*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dsign_002dkey"></a> 178009100258SXin LI 1781*052d159aSCy Schubert<p>This is the “generate sign key (rsa or dsa)” option. 1782*052d159aSCy SchubertThis option takes a string argument <samp>sign</samp>. 1783*052d159aSCy Schubert</p> 1784*052d159aSCy Schubert<p>This option has some usage constraints. It: 1785*052d159aSCy Schubert</p><ul> 17862b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1787*052d159aSCy Schubert</li></ul> 17882b15cb3dSCy Schubert 17892b15cb3dSCy Schubert<p>Generate a new sign key of the designated type, obsoleting any 17902b15cb3dSCy Schubertthat may exist. By default, the program uses the host key as the 17912b15cb3dSCy Schubertsign key. 1792*052d159aSCy Schubert</p><hr> 1793*052d159aSCy Schubert<a name="ntp_002dkeygen-trusted_002dcert"></a> 1794*052d159aSCy Schubert<div class="header"> 1795*052d159aSCy Schubert<p> 1796*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-mv_002dparams" accesskey="n" rel="next">ntp-keygen mv-params</a>, Previous: <a href="#ntp_002dkeygen-sign_002dkey" accesskey="p" rel="prev">ntp-keygen sign-key</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 17972b15cb3dSCy Schubert</div> 1798*052d159aSCy Schubert<a name="trusted_002dcert-option-_0028_002dT_0029"></a> 1799*052d159aSCy Schubert<h4 class="subsection">1.2.19 trusted-cert option (-T)</h4> 1800*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dtrusted_002dcert"></a> 18012b15cb3dSCy Schubert 1802*052d159aSCy Schubert<p>This is the “trusted certificate (tc scheme)” option. 1803*052d159aSCy Schubert</p> 1804*052d159aSCy Schubert<p>This option has some usage constraints. It: 1805*052d159aSCy Schubert</p><ul> 18062b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1807*052d159aSCy Schubert</li></ul> 18082b15cb3dSCy Schubert 18092b15cb3dSCy Schubert<p>Generate a trusted certificate. By default, the program generates 18102b15cb3dSCy Schuberta non-trusted certificate. 1811*052d159aSCy Schubert</p><hr> 1812*052d159aSCy Schubert<a name="ntp_002dkeygen-mv_002dparams"></a> 1813*052d159aSCy Schubert<div class="header"> 1814*052d159aSCy Schubert<p> 1815*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-mv_002dkeys" accesskey="n" rel="next">ntp-keygen mv-keys</a>, Previous: <a href="#ntp_002dkeygen-trusted_002dcert" accesskey="p" rel="prev">ntp-keygen trusted-cert</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 18162b15cb3dSCy Schubert</div> 1817*052d159aSCy Schubert<a name="mv_002dparams-option-_0028_002dV_0029"></a> 1818*052d159aSCy Schubert<h4 class="subsection">1.2.20 mv-params option (-V)</h4> 1819*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dmv_002dparams"></a> 18202b15cb3dSCy Schubert 1821*052d159aSCy Schubert<p>This is the “generate <num> mv parameters” option. 1822*052d159aSCy SchubertThis option takes a number argument <samp>num</samp>. 1823*052d159aSCy Schubert</p> 1824*052d159aSCy Schubert<p>This option has some usage constraints. It: 1825*052d159aSCy Schubert</p><ul> 18262b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1827*052d159aSCy Schubert</li></ul> 18282b15cb3dSCy Schubert 18292b15cb3dSCy Schubert<p>Generate parameters and keys for the Mu-Varadharajan (MV) 18302b15cb3dSCy Schubertidentification scheme. 1831*052d159aSCy Schubert</p><hr> 1832*052d159aSCy Schubert<a name="ntp_002dkeygen-mv_002dkeys"></a> 1833*052d159aSCy Schubert<div class="header"> 1834*052d159aSCy Schubert<p> 1835*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-config" accesskey="n" rel="next">ntp-keygen config</a>, Previous: <a href="#ntp_002dkeygen-mv_002dparams" accesskey="p" rel="prev">ntp-keygen mv-params</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 18362b15cb3dSCy Schubert</div> 1837*052d159aSCy Schubert<a name="mv_002dkeys-option-_0028_002dv_0029"></a> 1838*052d159aSCy Schubert<h4 class="subsection">1.2.21 mv-keys option (-v)</h4> 1839*052d159aSCy Schubert<a name="index-ntp_002dkeygen_002dmv_002dkeys"></a> 18402b15cb3dSCy Schubert 1841*052d159aSCy Schubert<p>This is the “update <num> mv keys” option. 1842*052d159aSCy SchubertThis option takes a number argument <samp>num</samp>. 1843*052d159aSCy Schubert</p> 1844*052d159aSCy Schubert<p>This option has some usage constraints. It: 1845*052d159aSCy Schubert</p><ul> 18462b15cb3dSCy Schubert<li> must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1847*052d159aSCy Schubert</li></ul> 18482b15cb3dSCy Schubert 1849*052d159aSCy Schubert<p>This option has no ‘<samp>doc</samp>’ documentation. 1850*052d159aSCy Schubert</p> 18512b15cb3dSCy Schubert 1852*052d159aSCy Schubert<hr> 1853*052d159aSCy Schubert<a name="ntp_002dkeygen-config"></a> 1854*052d159aSCy Schubert<div class="header"> 1855*052d159aSCy Schubert<p> 1856*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-exit-status" accesskey="n" rel="next">ntp-keygen exit status</a>, Previous: <a href="#ntp_002dkeygen-mv_002dkeys" accesskey="p" rel="prev">ntp-keygen mv-keys</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 18572b15cb3dSCy Schubert</div> 1858*052d159aSCy Schubert<a name="presetting_002fconfiguring-ntp_002dkeygen"></a> 1859*052d159aSCy Schubert<h4 class="subsection">1.2.22 presetting/configuring ntp-keygen</h4> 18602b15cb3dSCy Schubert 18612b15cb3dSCy Schubert<p>Any option that is not marked as <i>not presettable</i> may be preset by 1862*052d159aSCy Schubertloading values from configuration ("rc" or "ini") files, and values from environment variables named <code>NTP-KEYGEN</code> and <code>NTP-KEYGEN_<OPTION_NAME></code>. <code><OPTION_NAME></code> must be one of 18632b15cb3dSCy Schubertthe options listed above in upper case and segmented with underscores. 18642b15cb3dSCy SchubertThe <code>NTP-KEYGEN</code> variable will be tokenized and parsed like 18652b15cb3dSCy Schubertthe command line. The remaining variables are tested for existence and their 18662b15cb3dSCy Schubertvalues are treated like option arguments. 1867*052d159aSCy Schubert</p> 18682b15cb3dSCy Schubert 1869*052d159aSCy Schubert<p><code>libopts</code> will search in 2 places for configuration files: 1870*052d159aSCy Schubert</p><ul> 18712b15cb3dSCy Schubert<li> $HOME 1872*052d159aSCy Schubert</li><li> $PWD 1873*052d159aSCy Schubert</li></ul> 1874*052d159aSCy Schubert<p>The environment variables <code>HOME</code>, and <code>PWD</code> 1875*052d159aSCy Schubertare expanded and replaced when <samp>ntp-keygen</samp> runs. 18762b15cb3dSCy SchubertFor any of these that are plain files, they are simply processed. 1877*052d159aSCy SchubertFor any that are directories, then a file named <samp>.ntprc</samp> is searched for 18782b15cb3dSCy Schubertwithin that directory and processed. 1879*052d159aSCy Schubert</p> 18802b15cb3dSCy Schubert<p>Configuration files may be in a wide variety of formats. 18812b15cb3dSCy SchubertThe basic format is an option name followed by a value (argument) on the 18822b15cb3dSCy Schubertsame line. Values may be separated from the option name with a colon, 18832b15cb3dSCy Schubertequal sign or simply white space. Values may be continued across multiple 18842b15cb3dSCy Schubertlines by escaping the newline with a backslash. 1885*052d159aSCy Schubert</p> 18862b15cb3dSCy Schubert<p>Multiple programs may also share the same initialization file. 18872b15cb3dSCy SchubertCommon options are collected at the top, followed by program specific 18882b15cb3dSCy Schubertsegments. The segments are separated by lines like: 1889*052d159aSCy Schubert</p><div class="example"> 18902b15cb3dSCy Schubert<pre class="example">[NTP-KEYGEN] 1891*052d159aSCy Schubert</pre></div> 1892*052d159aSCy Schubert<p>or by 1893*052d159aSCy Schubert</p><div class="example"> 18942b15cb3dSCy Schubert<pre class="example"><?program ntp-keygen> 1895*052d159aSCy Schubert</pre></div> 1896*052d159aSCy Schubert<p>Do not mix these styles within one configuration file. 1897*052d159aSCy Schubert</p> 18982b15cb3dSCy Schubert<p>Compound values and carefully constructed string values may also be 18992b15cb3dSCy Schubertspecified using XML syntax: 1900*052d159aSCy Schubert</p><div class="example"> 19012b15cb3dSCy Schubert<pre class="example"><option-name> 19022b15cb3dSCy Schubert <sub-opt>...&lt;...&gt;...</sub-opt> 19032b15cb3dSCy Schubert</option-name> 1904*052d159aSCy Schubert</pre></div> 1905*052d159aSCy Schubert<p>yielding an <code>option-name.sub-opt</code> string value of 1906*052d159aSCy Schubert</p><div class="example"> 1907*052d159aSCy Schubert<pre class="example">"...<...>..." 1908*052d159aSCy Schubert</pre></div> 19092b15cb3dSCy Schubert<p><code>AutoOpts</code> does not track suboptions. You simply note that it is a 19102b15cb3dSCy Schuberthierarchicly valued option. <code>AutoOpts</code> does provide a means for searching 19112b15cb3dSCy Schubertthe associated name/value pair list (see: optionFindValue). 1912*052d159aSCy Schubert</p> 19132b15cb3dSCy Schubert<p>The command line options relating to configuration and/or usage help are: 1914*052d159aSCy Schubert</p> 1915*052d159aSCy Schubert<a name="version-_0028_002d_0029"></a> 1916*052d159aSCy Schubert<h4 class="subsubheading">version (-)</h4> 19172b15cb3dSCy Schubert 19182b15cb3dSCy Schubert<p>Print the program version to standard out, optionally with licensing 19192b15cb3dSCy Schubertinformation, then exit 0. The optional argument specifies how much licensing 19202b15cb3dSCy Schubertdetail to provide. The default is to print just the version. The licensing infomation may be selected with an option argument. 19212b15cb3dSCy SchubertOnly the first letter of the argument is examined: 1922*052d159aSCy Schubert</p> 1923*052d159aSCy Schubert<dl compact="compact"> 1924*052d159aSCy Schubert<dt>‘<samp>version</samp>’</dt> 1925*052d159aSCy Schubert<dd><p>Only print the version. This is the default. 1926*052d159aSCy Schubert</p></dd> 1927*052d159aSCy Schubert<dt>‘<samp>copyright</samp>’</dt> 1928*052d159aSCy Schubert<dd><p>Name the copyright usage licensing terms. 1929*052d159aSCy Schubert</p></dd> 1930*052d159aSCy Schubert<dt>‘<samp>verbose</samp>’</dt> 1931*052d159aSCy Schubert<dd><p>Print the full copyright usage licensing terms. 1932*052d159aSCy Schubert</p></dd> 19332b15cb3dSCy Schubert</dl> 19342b15cb3dSCy Schubert 1935*052d159aSCy Schubert<hr> 1936*052d159aSCy Schubert<a name="ntp_002dkeygen-exit-status"></a> 1937*052d159aSCy Schubert<div class="header"> 1938*052d159aSCy Schubert<p> 1939*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-Usage" accesskey="n" rel="next">ntp-keygen Usage</a>, Previous: <a href="#ntp_002dkeygen-config" accesskey="p" rel="prev">ntp-keygen config</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 19402b15cb3dSCy Schubert</div> 1941*052d159aSCy Schubert<a name="ntp_002dkeygen-exit-status-1"></a> 1942*052d159aSCy Schubert<h4 class="subsection">1.2.23 ntp-keygen exit status</h4> 19432b15cb3dSCy Schubert 19442b15cb3dSCy Schubert<p>One of the following exit values will be returned: 1945*052d159aSCy Schubert</p><dl compact="compact"> 1946*052d159aSCy Schubert<dt>‘<samp>0 (EXIT_SUCCESS)</samp>’</dt> 1947*052d159aSCy Schubert<dd><p>Successful program execution. 1948*052d159aSCy Schubert</p></dd> 1949*052d159aSCy Schubert<dt>‘<samp>1 (EXIT_FAILURE)</samp>’</dt> 1950*052d159aSCy Schubert<dd><p>The operation failed or the command syntax was not valid. 1951*052d159aSCy Schubert</p></dd> 1952*052d159aSCy Schubert<dt>‘<samp>66 (EX_NOINPUT)</samp>’</dt> 1953*052d159aSCy Schubert<dd><p>A specified configuration file could not be loaded. 1954*052d159aSCy Schubert</p></dd> 1955*052d159aSCy Schubert<dt>‘<samp>70 (EX_SOFTWARE)</samp>’</dt> 1956*052d159aSCy Schubert<dd><p>libopts had an internal operational error. Please report 19572b15cb3dSCy Schubertit to autogen-users@lists.sourceforge.net. Thank you. 1958*052d159aSCy Schubert</p></dd> 19592b15cb3dSCy Schubert</dl> 1960*052d159aSCy Schubert<hr> 1961*052d159aSCy Schubert<a name="ntp_002dkeygen-Usage"></a> 1962*052d159aSCy Schubert<div class="header"> 1963*052d159aSCy Schubert<p> 1964*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-Notes" accesskey="n" rel="next">ntp-keygen Notes</a>, Previous: <a href="#ntp_002dkeygen-exit-status" accesskey="p" rel="prev">ntp-keygen exit status</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 19652b15cb3dSCy Schubert</div> 1966*052d159aSCy Schubert<a name="ntp_002dkeygen-Usage-1"></a> 1967*052d159aSCy Schubert<h4 class="subsection">1.2.24 ntp-keygen Usage</h4> 1968*052d159aSCy Schubert<hr> 1969*052d159aSCy Schubert<a name="ntp_002dkeygen-Notes"></a> 1970*052d159aSCy Schubert<div class="header"> 1971*052d159aSCy Schubert<p> 1972*052d159aSCy SchubertNext: <a href="#ntp_002dkeygen-Bugs" accesskey="n" rel="next">ntp-keygen Bugs</a>, Previous: <a href="#ntp_002dkeygen-Usage" accesskey="p" rel="prev">ntp-keygen Usage</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 19732b15cb3dSCy Schubert</div> 1974*052d159aSCy Schubert<a name="ntp_002dkeygen-Notes-1"></a> 1975*052d159aSCy Schubert<h4 class="subsection">1.2.25 ntp-keygen Notes</h4> 1976*052d159aSCy Schubert<hr> 1977*052d159aSCy Schubert<a name="ntp_002dkeygen-Bugs"></a> 1978*052d159aSCy Schubert<div class="header"> 1979*052d159aSCy Schubert<p> 1980*052d159aSCy SchubertPrevious: <a href="#ntp_002dkeygen-Notes" accesskey="p" rel="prev">ntp-keygen Notes</a>, Up: <a href="#ntp_002dkeygen-Invocation" accesskey="u" rel="up">ntp-keygen Invocation</a> </p> 19812b15cb3dSCy Schubert</div> 1982*052d159aSCy Schubert<a name="ntp_002dkeygen-Bugs-1"></a> 1983*052d159aSCy Schubert<h4 class="subsection">1.2.26 ntp-keygen Bugs</h4> 19842b15cb3dSCy Schubert 1985*052d159aSCy Schubert<hr> 1986*052d159aSCy Schubert<a name="Random-Seed-File"></a> 1987*052d159aSCy Schubert<div class="header"> 1988*052d159aSCy Schubert<p> 1989*052d159aSCy SchubertNext: <a href="#Cryptographic-Data-Files" accesskey="n" rel="next">Cryptographic Data Files</a>, Previous: <a href="#Running-the-Program" accesskey="p" rel="prev">Running the Program</a>, Up: <a href="#Top" accesskey="u" rel="up">Top</a> </p> 19902b15cb3dSCy Schubert</div> 1991*052d159aSCy Schubert<a name="Random-Seed-File-2"></a> 1992*052d159aSCy Schubert<h3 class="section">1.3 Random Seed File</h3> 19932b15cb3dSCy Schubert 19942b15cb3dSCy Schubert<p>All cryptographically sound key generation schemes must have means to 19952b15cb3dSCy Schubertrandomize the entropy seed used to initialize the internal 19962b15cb3dSCy Schubertpseudo-random number generator used by the OpenSSL library routines. 19972b15cb3dSCy SchubertIf a site supports ssh, it is very likely that means to do this are 19982b15cb3dSCy Schubertalready available. 19992b15cb3dSCy SchubertThe entropy seed used by the OpenSSL library is contained in a file, 20002b15cb3dSCy Schubertusually called <code>.rnd</code>, which must be available when 20012b15cb3dSCy Schubertstarting the <code>ntp-keygen</code> program or <code>ntpd</code> daemon. 2002*052d159aSCy Schubert</p> 20032b15cb3dSCy Schubert<p>The OpenSSL library looks for the file using the path specified by the 20042b15cb3dSCy Schubert<code>RANDFILE</code> environment variable in the user home directory, whether root 20052b15cb3dSCy Schubertor some other user. 20062b15cb3dSCy SchubertIf the <code>RANDFILE</code> environment variable is not 20072b15cb3dSCy Schubertpresent, the library looks for the <code>.rnd</code> file in the user home 20082b15cb3dSCy Schubertdirectory. 20092b15cb3dSCy SchubertSince both the <code>ntp-keygen</code> program and <code>ntpd</code> daemon must run 20102b15cb3dSCy Schubertas root, the logical place to put this file is in <code>/.rnd</code> or 20112b15cb3dSCy Schubert<code>/root/.rnd</code>. 20122b15cb3dSCy SchubertIf the file is not available or cannot be written, the program exits 20132b15cb3dSCy Schubertwith a message to the system log. 2014*052d159aSCy Schubert</p> 2015*052d159aSCy Schubert<hr> 2016*052d159aSCy Schubert<a name="Cryptographic-Data-Files"></a> 2017*052d159aSCy Schubert<div class="header"> 2018*052d159aSCy Schubert<p> 2019*052d159aSCy SchubertPrevious: <a href="#Random-Seed-File" accesskey="p" rel="prev">Random Seed File</a>, Up: <a href="#Top" accesskey="u" rel="up">Top</a> </p> 20202b15cb3dSCy Schubert</div> 2021*052d159aSCy Schubert<a name="Cryptographic-Data-Files-2"></a> 2022*052d159aSCy Schubert<h3 class="section">1.4 Cryptographic Data Files</h3> 20232b15cb3dSCy Schubert 20242b15cb3dSCy Schubert<p>File and link names are in the <code>form ntpkey_key_name.fstamp</code>, 20252b15cb3dSCy Schubertwhere <code>key</code> is the key or parameter type, 20262b15cb3dSCy Schubert<code>name</code> is the host or group name and 20272b15cb3dSCy Schubert<code>fstamp</code> is the filestamp (NTP seconds) when the file was created). 20282b15cb3dSCy SchubertBy convention, key names in generated file names include both upper and 20292b15cb3dSCy Schubertlower case characters, while key names in generated link names include 20302b15cb3dSCy Schubertonly lower case characters. The filestamp is not used in generated link 20312b15cb3dSCy Schubertnames. 2032*052d159aSCy Schubert</p> 20332b15cb3dSCy Schubert<p>The key name is a string defining the cryptographic key type. 20342b15cb3dSCy SchubertKey types include public/private keys host and sign, certificate cert 20352b15cb3dSCy Schubertand several challenge/response key types. 20362b15cb3dSCy SchubertBy convention, client files used for 20372b15cb3dSCy Schubertchallenges have a par subtype, as in the IFF challenge IFFpar, while 20382b15cb3dSCy Schubertserver files for responses have a key subtype, as in the GQ response 20392b15cb3dSCy SchubertGQkey. 2040*052d159aSCy Schubert</p> 20412b15cb3dSCy Schubert<p>All files begin with two nonencrypted lines. The first line contains 20422b15cb3dSCy Schubertthe file name in the format <code>ntpkey_key_host.fstamp</code>. 20432b15cb3dSCy SchubertThe second line contains the datestamp in conventional Unix date format. 20442b15cb3dSCy SchubertLines beginning with <code>#</code> are ignored. 2045*052d159aSCy Schubert</p> 20462b15cb3dSCy Schubert<p>The remainder of the file contains cryptographic data encoded first 20472b15cb3dSCy Schubertusing ASN.1 rules, then encrypted using the DES-CBC algorithm with 20482b15cb3dSCy Schubertgiven password and finally written in PEM-encoded printable ASCII text 20492b15cb3dSCy Schubertpreceded and followed by MIME content identifier lines. 2050*052d159aSCy Schubert</p> 20512b15cb3dSCy Schubert<p>The format of the symmetric keys file, ordinarily named <code>ntp.keys</code>, 20522b15cb3dSCy Schubertis somewhat different than the other files in the interest of backward 20532b15cb3dSCy Schubertcompatibility. 20542b15cb3dSCy SchubertOrdinarily, the file is generated by this program, but 20552b15cb3dSCy Schubertit can be constructed and edited using an ordinary text editor. 2056*052d159aSCy Schubert</p> 2057*052d159aSCy Schubert<div class="example"> 20582b15cb3dSCy Schubert<pre class="example"># ntpkey_MD5key_hms.local.3564038757 20592b15cb3dSCy Schubert# Sun Dec 9 02:45:57 2012 20602b15cb3dSCy Schubert 2061*052d159aSCy Schubert 1 MD5 "]!ghT%O;3)WJ,/Nc:>I # MD5 key 20622b15cb3dSCy Schubert 2 MD5 lu+H^tF46BKR-6~pV_5 # MD5 key 20632b15cb3dSCy Schubert 3 MD5 :lnoVsE%Yz*avh%EtNC # MD5 key 2064*052d159aSCy Schubert 4 MD5 |fdZrf0sF~;w-i^V # MD5 key 2065*052d159aSCy Schubert 5 MD5 IyAG>O"y"LmCRS!*bHC # MD5 key 2066*052d159aSCy Schubert 6 MD5 ">e\A>hT/661ri52,,H # MD5 key 20672b15cb3dSCy Schubert 7 MD5 c9x=M'CfLxax9v)PV-si # MD5 key 20682b15cb3dSCy Schubert 8 MD5 E|=jvFVov?Bn|Ev=&aK\ # MD5 key 20692b15cb3dSCy Schubert 9 MD5 T!c4UT&`(m$+m+B6,`Q0 # MD5 key 20702b15cb3dSCy Schubert10 MD5 JVF/1=)=IFbHbJQz..Cd # MD5 key 20712b15cb3dSCy Schubert11 SHA1 6dea311109529e436c2b4fccae9bc753c16d1b48 # SHA1 key 20722b15cb3dSCy Schubert12 SHA1 7076f373d86c4848c59ff8046e49cb7d614ec394 # SHA1 key 20732b15cb3dSCy Schubert13 SHA1 5f48b1b60591eb01b7cf1d33b7774f08d20262d3 # SHA1 key 20742b15cb3dSCy Schubert14 SHA1 eed5ab9d9497319ec60cf3781d52607e76720178 # SHA1 key 20752b15cb3dSCy Schubert15 SHA1 f283562611a04c964da8126296f5f8e58c3f85de # SHA1 key 20762b15cb3dSCy Schubert16 SHA1 1930da171297dd63549af50b29449de17dcf341f # SHA1 key 20772b15cb3dSCy Schubert17 SHA1 fee892110358cd4382322b889869e750db8e8a8f # SHA1 key 20782b15cb3dSCy Schubert18 SHA1 b5520c9fadd7ad3fd8bfa061c8821b65d029bb37 # SHA1 key 20792b15cb3dSCy Schubert19 SHA1 8c74fb440ec80f453ec6aaa62b9baed0ab723b92 # SHA1 key 20802b15cb3dSCy Schubert20 SHA1 6bc05f734306a189326000970c19b3910f403795 # SHA1 key 2081*052d159aSCy Schubert</pre></div> 20822b15cb3dSCy Schubert 2083*052d159aSCy Schubert<p>Figure 1. Typical Symmetric Key File 2084*052d159aSCy Schubert</p> 20852b15cb3dSCy Schubert<p>Figure 1 shows a typical symmetric keys file used by the reference 20862b15cb3dSCy Schubertimplementation. 20872b15cb3dSCy SchubertEach line of the file contains three fields, first an 20884e1ef62aSXin LIinteger between 1 and 65535, inclusive, representing the key identifier 20892b15cb3dSCy Schubertused in the server and peer configuration commands. 20902b15cb3dSCy SchubertNext is the key type for the message digest algorithm, 20912b15cb3dSCy Schubertwhich in the absence of the 20922b15cb3dSCy SchubertOpenSSL library must be MD5 to designate the MD5 message digest 20932b15cb3dSCy Schubertalgorithm. 20942b15cb3dSCy SchubertIf the OpenSSL library is installed, the key type can be any 20952b15cb3dSCy Schubertmessage digest algorithm supported by that library. 20962b15cb3dSCy SchubertHowever, if 20972b15cb3dSCy Schubertcompatibility with FIPS 140-2 is required, the key type must be either 20982b15cb3dSCy SchubertSHA or SHA1. 20992b15cb3dSCy SchubertThe key type can be changed using an ASCII text editor. 2100*052d159aSCy Schubert</p> 21012b15cb3dSCy Schubert<p>An MD5 key consists of a printable ASCII string less than or equal to 21022b15cb3dSCy Schubert16 characters and terminated by whitespace or a # character. 21032b15cb3dSCy SchubertAn OpenSSL 21042b15cb3dSCy Schubertkey consists of a hex-encoded ASCII string of 40 characters, which is 21052b15cb3dSCy Schuberttruncated as necessary. 2106*052d159aSCy Schubert</p> 21072b15cb3dSCy Schubert<p>Note that the keys used by the <code>ntpq</code> and <code>ntpdc</code> programs are 21082b15cb3dSCy Schubertchecked against passwords requested by the programs and entered by hand, 21092b15cb3dSCy Schubertso it 21102b15cb3dSCy Schubertis generally appropriate to specify these keys in human readable ASCII 21112b15cb3dSCy Schubertformat. 2112*052d159aSCy Schubert</p> 21132b15cb3dSCy Schubert<p>The <code>ntp-keygen</code> program generates a MD5 symmetric keys file 21142b15cb3dSCy Schubert<code>ntpkey_MD5key_hostname.filestamp</code>. 21152b15cb3dSCy SchubertSince the file contains private 21162b15cb3dSCy Schubertshared keys, it should be visible only to root and distributed by 21172b15cb3dSCy Schubertsecure means to other subnet hosts. 21182b15cb3dSCy SchubertThe NTP daemon loads the file <code>ntp.keys</code>, so <code>ntp-keygen</code> 21192b15cb3dSCy Schubertinstalls a soft link from this name to the generated file. 21202b15cb3dSCy SchubertSubsequently, similar soft links must be installed by 21212b15cb3dSCy Schubertmanual or automated means on the other subnet hosts. 21222b15cb3dSCy SchubertWhile this file is 21232b15cb3dSCy Schubertnot used with the Autokey Version 2 protocol, it is needed to 21242b15cb3dSCy Schubertauthenticate some remote configuration commands used by the <code>ntpq</code> and 21252b15cb3dSCy Schubert<code>ntpdc</code> utilities. 2126*052d159aSCy Schubert</p><hr> 21272b15cb3dSCy Schubert 21282b15cb3dSCy Schubert 2129*052d159aSCy Schubert 2130*052d159aSCy Schubert</body> 2131*052d159aSCy Schubert</html> 2132