12b15cb3dSCy Schubert<html lang="en"> 22b15cb3dSCy Schubert<head> 32b15cb3dSCy Schubert<title>Ntp-keygen User's Manual</title> 42b15cb3dSCy Schubert<meta http-equiv="Content-Type" content="text/html"> 52b15cb3dSCy Schubert<meta name="description" content="Ntp-keygen User's Manual"> 62b15cb3dSCy Schubert<meta name="generator" content="makeinfo 4.7"> 72b15cb3dSCy Schubert<link title="Top" rel="top" href="#Top"> 82b15cb3dSCy Schubert<link href="http://www.gnu.org/software/texinfo/" rel="generator-home" title="Texinfo Homepage"> 92b15cb3dSCy Schubert<meta http-equiv="Content-Style-Type" content="text/css"> 102b15cb3dSCy Schubert<style type="text/css"><!-- 112b15cb3dSCy Schubert pre.display { font-family:inherit } 122b15cb3dSCy Schubert pre.format { font-family:inherit } 132b15cb3dSCy Schubert pre.smalldisplay { font-family:inherit; font-size:smaller } 142b15cb3dSCy Schubert pre.smallformat { font-family:inherit; font-size:smaller } 152b15cb3dSCy Schubert pre.smallexample { font-size:smaller } 162b15cb3dSCy Schubert pre.smalllisp { font-size:smaller } 172b15cb3dSCy Schubert span.sc { font-variant:small-caps } 182b15cb3dSCy Schubert span.roman { font-family: serif; font-weight: normal; } 192b15cb3dSCy Schubert--></style> 202b15cb3dSCy Schubert</head> 212b15cb3dSCy Schubert<body> 222b15cb3dSCy Schubert<h1 class="settitle">Ntp-keygen User's Manual</h1> 232b15cb3dSCy Schubert <div class="shortcontents"> 242b15cb3dSCy Schubert<h2>Short Contents</h2> 252b15cb3dSCy Schubert<ul> 262b15cb3dSCy Schubert<a href="#Top">Top</a> 272b15cb3dSCy Schubert<a href="#Top">NTP Key Generation Program User Manual</a> 282b15cb3dSCy Schubert</ul> 292b15cb3dSCy Schubert</div> 302b15cb3dSCy Schubert 312b15cb3dSCy Schubert 322b15cb3dSCy Schubert 332b15cb3dSCy Schubert<div class="node"> 342b15cb3dSCy Schubert<p><hr> 352b15cb3dSCy Schubert<a name="Top"></a>Up: <a rel="up" accesskey="u" href="#dir">(dir)</a> 362b15cb3dSCy Schubert<br> 372b15cb3dSCy Schubert</div> 382b15cb3dSCy Schubert 392b15cb3dSCy Schubert<h2 class="unnumbered">Top</h2> 402b15cb3dSCy Schubert 412b15cb3dSCy Schubert<ul class="menu"> 422b15cb3dSCy Schubert<li><a accesskey="1" href="#Description">Description</a> 432b15cb3dSCy Schubert<li><a accesskey="2" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a>: Invoking ntp-keygen 442b15cb3dSCy Schubert<li><a accesskey="3" href="#Running-the-Program">Running the Program</a> 452b15cb3dSCy Schubert<li><a accesskey="4" href="#Random-Seed-File">Random Seed File</a> 462b15cb3dSCy Schubert<li><a accesskey="5" href="#Cryptographic-Data-Files">Cryptographic Data Files</a> 472b15cb3dSCy Schubert</ul> 482b15cb3dSCy Schubert 492b15cb3dSCy Schubert<div class="node"> 502b15cb3dSCy Schubert<p><hr> 512b15cb3dSCy Schubert<a name="Top"></a>Next: <a rel="next" accesskey="n" href="#Description">Description</a>, 522b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#dir">(dir)</a>, 532b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#dir">(dir)</a> 542b15cb3dSCy Schubert<br> 552b15cb3dSCy Schubert</div> 562b15cb3dSCy Schubert 572b15cb3dSCy Schubert<h2 class="unnumbered">NTP Key Generation Program User Manual</h2> 582b15cb3dSCy Schubert 592b15cb3dSCy Schubert<p>This document describes the use of the NTP Project's <code>ntp-keygen</code> 602b15cb3dSCy Schubertprogram, that generates cryptographic data files used by the NTPv4 612b15cb3dSCy Schubertauthentication and identity schemes. 622b15cb3dSCy SchubertIt can generate message digest keys used in symmetric key cryptography and, 632b15cb3dSCy Schubertif the OpenSSL software 642b15cb3dSCy Schubertlibrary has been installed, it can generate host keys, sign keys, 652b15cb3dSCy Schubertcertificates, and identity keys and parameters used by the Autokey 662b15cb3dSCy Schubertpublic key cryptography. 672b15cb3dSCy SchubertThe message digest keys file is generated in a 682b15cb3dSCy Schubertformat compatible with NTPv3. 692b15cb3dSCy SchubertAll other files are in PEM-encoded 702b15cb3dSCy Schubertprintable ASCII format so they can be embedded as MIME attachments in 712b15cb3dSCy Schubertmail to other sites. 722b15cb3dSCy Schubert 73*09100258SXin LI <p>This document applies to version 4.2.8p11 of <code>ntp-keygen</code>. 742b15cb3dSCy Schubert 752b15cb3dSCy Schubert<div class="node"> 762b15cb3dSCy Schubert<p><hr> 772b15cb3dSCy Schubert<a name="Description"></a>Next: <a rel="next" accesskey="n" href="#Running-the-Program">Running the Program</a>, 782b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#Top">Top</a>, 792b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#Top">Top</a> 802b15cb3dSCy Schubert<br> 812b15cb3dSCy Schubert</div> 822b15cb3dSCy Schubert 832b15cb3dSCy Schubert<!-- node-name, next, previous, up --> 842b15cb3dSCy Schubert<h3 class="section">Description</h3> 852b15cb3dSCy Schubert 862b15cb3dSCy Schubert<p>This program generates cryptographic data files used by the NTPv4 872b15cb3dSCy Schubertauthentication and identity schemes. It can generate message digest 882b15cb3dSCy Schubertkeys used in symmetric key cryptography and, if the OpenSSL software 892b15cb3dSCy Schubertlibrary has been installed, it can generate host keys, sign keys, 902b15cb3dSCy Schubertcertificates, and identity keys and parameters used by the Autokey 912b15cb3dSCy Schubertpublic key cryptography. The message digest keys file is generated in a 922b15cb3dSCy Schubertformat compatible with NTPv3. All other files are in PEM-encoded 932b15cb3dSCy Schubertprintable ASCII format so they can be embedded as MIME attachments in 942b15cb3dSCy Schubertmail to other sites. 952b15cb3dSCy Schubert 962b15cb3dSCy Schubert <p>When used to generate message digest keys, the program produces a file 972b15cb3dSCy Schubertcontaining ten pseudo-random printable ASCII strings suitable for the 982b15cb3dSCy SchubertMD5 message digest algorithm included in the distribution. 992b15cb3dSCy SchubertIf the 1002b15cb3dSCy SchubertOpenSSL library is installed, it produces an additional ten hex-encoded 1012b15cb3dSCy Schubertrandom bit strings suitable for the SHA1 and other message digest 1022b15cb3dSCy Schubertalgorithms. 1032b15cb3dSCy SchubertThe message digest keys file must be distributed and stored 1042b15cb3dSCy Schubertusing secure means beyond the scope of NTP itself. 1052b15cb3dSCy SchubertBesides the keys 1062b15cb3dSCy Schubertused for ordinary NTP associations, additional keys can be defined as 1072b15cb3dSCy Schubertpasswords for the ntpq and ntpdc utility programs. 1082b15cb3dSCy Schubert 1092b15cb3dSCy Schubert <p>The remaining generated files are compatible with other OpenSSL 1102b15cb3dSCy Schubertapplications and other Public Key Infrastructure (PKI) resources. 1112b15cb3dSCy SchubertCertificates generated by this program are compatible with extant 1122b15cb3dSCy Schubertindustry practice, although some users might find the interpretation of 1132b15cb3dSCy SchubertX509v3 extension fields somewhat liberal. 1142b15cb3dSCy SchubertHowever, the identity keys 1152b15cb3dSCy Schubertare probably not compatible with anything other than Autokey. 1162b15cb3dSCy Schubert 1172b15cb3dSCy Schubert <p>Some files used by this program are encrypted using a private password. 1182b15cb3dSCy SchubertThe <code>-p</code> option specifies the password for local encrypted files and the 1192b15cb3dSCy Schubert<code>-q</code> option the password for encrypted files sent to remote sites. 1202b15cb3dSCy SchubertIf no password is specified, the host name returned by the Unix 1212b15cb3dSCy Schubert<code>gethostname()</code> function, normally the DNS name of the host, is used. 1222b15cb3dSCy Schubert 1232b15cb3dSCy Schubert <p>The <kbd>pw</kbd> option of the <code>crypto</code> configuration command 1242b15cb3dSCy Schubertspecifies the read password for previously encrypted local files. 1252b15cb3dSCy SchubertThis must match the local password used by this program. 1262b15cb3dSCy SchubertIf not specified, the host name is used. 1272b15cb3dSCy SchubertThus, if files are generated by this program without password, 1282b15cb3dSCy Schubertthey can be read back by ntpd without password, but only on the same 1292b15cb3dSCy Schuberthost. 1302b15cb3dSCy Schubert 1312b15cb3dSCy Schubert <p>Normally, encrypted files for each host are generated by that host and 1322b15cb3dSCy Schubertused only by that host, although exceptions exist as noted later on 1332b15cb3dSCy Schubertthis page. 1342b15cb3dSCy SchubertThe symmetric keys file, normally called <code>ntp.keys</code>, is 1352b15cb3dSCy Schubertusually installed in <code>/etc</code>. 1362b15cb3dSCy SchubertOther files and links are usually installed 1372b15cb3dSCy Schubertin <code>/usr/local/etc</code>, which is normally in a shared filesystem in 1382b15cb3dSCy SchubertNFS-mounted networks and cannot be changed by shared clients. 1392b15cb3dSCy SchubertThe location of the keys directory can be changed by the keysdir 1402b15cb3dSCy Schubertconfiguration command in such cases. 1412b15cb3dSCy SchubertNormally, this is in <code>/etc</code>. 1422b15cb3dSCy Schubert 1432b15cb3dSCy Schubert <p>This program directs commentary and error messages to the standard 1442b15cb3dSCy Schuberterror stream <code>stderr</code> and remote files to the standard output stream 1452b15cb3dSCy Schubert<code>stdout</code> where they can be piped to other applications or redirected to 1462b15cb3dSCy Schubertfiles. 1472b15cb3dSCy SchubertThe names used for generated files and links all begin with the 1482b15cb3dSCy Schubertstring <code>ntpkey</code> and include the file type, 1492b15cb3dSCy Schubertgenerating host and filestamp, 1502b15cb3dSCy Schubertas described in the <a href="#Cryptographic-Data-Files">Cryptographic Data Files</a> section below. 1512b15cb3dSCy Schubert 1522b15cb3dSCy Schubert<div class="node"> 1532b15cb3dSCy Schubert<p><hr> 1542b15cb3dSCy Schubert<a name="Running-the-Program"></a>Next: <a rel="next" accesskey="n" href="#Random-Seed-File">Random Seed File</a>, 1552b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#Description">Description</a>, 1562b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#Top">Top</a> 1572b15cb3dSCy Schubert<br> 1582b15cb3dSCy Schubert</div> 1592b15cb3dSCy Schubert 1602b15cb3dSCy Schubert<!-- node-name, next, previous, up --> 1612b15cb3dSCy Schubert<h3 class="section">Running the Program</h3> 1622b15cb3dSCy Schubert 1632b15cb3dSCy Schubert<p>To test and gain experience with Autokey concepts, log in as root and 1642b15cb3dSCy Schubertchange to the keys directory, usually <code>/usr/local/etc</code>. 1652b15cb3dSCy SchubertWhen run for the 1662b15cb3dSCy Schubertfirst time, or if all files with names beginning <code>ntpkey</code>] have been 1672b15cb3dSCy Schubertremoved, use the <code>ntp-keygen</code> command without arguments to generate a 1682b15cb3dSCy Schubertdefault RSA host key and matching RSA-MD5 certificate with expiration 1692b15cb3dSCy Schubertdate one year hence. 1702b15cb3dSCy SchubertIf run again without options, the program uses the 1712b15cb3dSCy Schubertexisting keys and parameters and generates only a new certificate with 1722b15cb3dSCy Schubertnew expiration date one year hence. 1732b15cb3dSCy Schubert 1742b15cb3dSCy Schubert <p>Run the command on as many hosts as necessary. 1752b15cb3dSCy SchubertDesignate one of them as the trusted host (TH) using <code>ntp-keygen</code> 1762b15cb3dSCy Schubertwith the <code>-T</code> option and configure 1772b15cb3dSCy Schubertit to synchronize from reliable Internet servers. 1782b15cb3dSCy SchubertThen configure the other hosts to synchronize to the TH directly or indirectly. 1792b15cb3dSCy SchubertA certificate trail is created when Autokey asks the immediately 1802b15cb3dSCy Schubertascendant host towards the TH to sign its certificate, which is then 1812b15cb3dSCy Schubertprovided to the immediately descendant host on request. 1822b15cb3dSCy SchubertAll group hosts should have acyclic certificate trails ending on the TH. 1832b15cb3dSCy Schubert 1842b15cb3dSCy Schubert <p>The host key is used to encrypt the cookie when required and so must be 1852b15cb3dSCy SchubertRSA type. 1862b15cb3dSCy SchubertBy default, the host key is also the sign key used to encrypt signatures. 1872b15cb3dSCy SchubertA different sign key can be assigned using the <code>-S</code> option 1882b15cb3dSCy Schubertand this can be either RSA or DSA type. 1892b15cb3dSCy SchubertBy default, the signature 1902b15cb3dSCy Schubertmessage digest type is MD5, but any combination of sign key type and 1912b15cb3dSCy Schubertmessage digest type supported by the OpenSSL library can be specified 1922b15cb3dSCy Schubertusing the <code>-c</code> option. 1932b15cb3dSCy Schubert 1942b15cb3dSCy Schubert <p>The rules say cryptographic media should be generated with proventic 1952b15cb3dSCy Schubertfilestamps, which means the host should already be synchronized before 1962b15cb3dSCy Schubertthis program is run. 1972b15cb3dSCy SchubertThis of course creates a chicken-and-egg problem 1982b15cb3dSCy Schubertwhen the host is started for the first time. 1992b15cb3dSCy SchubertAccordingly, the host time 2002b15cb3dSCy Schubertshould be set by some other means, such as eyeball-and-wristwatch, at 2012b15cb3dSCy Schubertleast so that the certificate lifetime is within the current year. 2022b15cb3dSCy SchubertAfter that and when the host is synchronized to a proventic source, the 2032b15cb3dSCy Schubertcertificate should be re-generated. 2042b15cb3dSCy Schubert 2052b15cb3dSCy Schubert <p>Additional information on trusted groups and identity schemes is on the 2062b15cb3dSCy SchubertAutokey Public-Key Authentication page. 2072b15cb3dSCy Schubert 2082b15cb3dSCy Schubert<div class="node"> 2092b15cb3dSCy Schubert<p><hr> 2102b15cb3dSCy Schubert<a name="ntp_002dkeygen-Invocation"></a> 2112b15cb3dSCy Schubert<br> 2122b15cb3dSCy Schubert</div> 2132b15cb3dSCy Schubert 2142b15cb3dSCy Schubert<h3 class="section">Invoking ntp-keygen</h3> 2152b15cb3dSCy Schubert 2162b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen-1"></a><a name="index-Create-a-NTP-host-key-2"></a> 2172b15cb3dSCy Schubert 2182b15cb3dSCy Schubert <p>This program generates cryptographic data files used by the NTPv4 2192b15cb3dSCy Schubertauthentication and identification schemes. 220*09100258SXin LIIt can generate message digest keys used in symmetric key cryptography and, 221*09100258SXin LIif the OpenSSL software library has been installed, it can generate host keys, 222*09100258SXin LIsigning keys, certificates, and identity keys and parameters used in Autokey 223*09100258SXin LIpublic key cryptography. 2242b15cb3dSCy SchubertThese files are used for cookie encryption, 225*09100258SXin LIdigital signature, and challenge/response identification algorithms 2262b15cb3dSCy Schubertcompatible with the Internet standard security infrastructure. 2272b15cb3dSCy Schubert 228*09100258SXin LI <p>The message digest symmetric keys file is generated in a format 229*09100258SXin LIcompatible with NTPv3. 230*09100258SXin LIAll other files are in PEM-encoded printable ASCII format, 231*09100258SXin LIso they can be embedded as MIME attachments in email to other sites 2322b15cb3dSCy Schubertand certificate authorities. 2332b15cb3dSCy SchubertBy default, files are not encrypted. 2342b15cb3dSCy Schubert 235*09100258SXin LI <p>When used to generate message digest symmetric keys, the program 236*09100258SXin LIproduces a file containing ten pseudo-random printable ASCII strings 237*09100258SXin LIsuitable for the MD5 message digest algorithm included in the 238*09100258SXin LIdistribution. 2392b15cb3dSCy SchubertIf the OpenSSL library is installed, it produces an additional ten 240*09100258SXin LIhex-encoded random bit strings suitable for SHA1, AES-128-CMAC, and 241*09100258SXin LIother message digest algorithms. 242*09100258SXin LIThe message digest symmetric keys file must be distributed and stored 2432b15cb3dSCy Schubertusing secure means beyond the scope of NTP itself. 2442b15cb3dSCy SchubertBesides the keys used for ordinary NTP associations, additional keys 2452b15cb3dSCy Schubertcan be defined as passwords for the 2462b15cb3dSCy Schubert<code>ntpq(1ntpqmdoc)</code> 2472b15cb3dSCy Schubertand 2482b15cb3dSCy Schubert<code>ntpdc(1ntpdcmdoc)</code> 2492b15cb3dSCy Schubertutility programs. 2502b15cb3dSCy Schubert 2512b15cb3dSCy Schubert <p>The remaining generated files are compatible with other OpenSSL 2522b15cb3dSCy Schubertapplications and other Public Key Infrastructure (PKI) resources. 2532b15cb3dSCy SchubertCertificates generated by this program are compatible with extant 2542b15cb3dSCy Schubertindustry practice, although some users might find the interpretation of 2552b15cb3dSCy SchubertX509v3 extension fields somewhat liberal. 2562b15cb3dSCy SchubertHowever, the identity keys are probably not compatible with anything 2572b15cb3dSCy Schubertother than Autokey. 2582b15cb3dSCy Schubert 2592b15cb3dSCy Schubert <p>Some files used by this program are encrypted using a private password. 2602b15cb3dSCy SchubertThe 2612b15cb3dSCy Schubert<code>-p</code> 262*09100258SXin LIoption specifies the read password for local encrypted files and the 2632b15cb3dSCy Schubert<code>-q</code> 264*09100258SXin LIoption the write password for encrypted files sent to remote sites. 2652b15cb3dSCy SchubertIf no password is specified, the host name returned by the Unix 266*09100258SXin LI<code>hostname(1)</code> 267*09100258SXin LIcommand, normally the DNS name of the host, is used as the the default read 268*09100258SXin LIpassword, for convenience. 269*09100258SXin LIThe 270*09100258SXin LI<code>ntp-keygen</code> 271*09100258SXin LIprogram prompts for the password if it reads an encrypted file 272*09100258SXin LIand the password is missing or incorrect. 273*09100258SXin LIIf an encrypted file is read successfully and 274*09100258SXin LIno write password is specified, the read password is used 275*09100258SXin LIas the write password by default. 2762b15cb3dSCy Schubert 2772b15cb3dSCy Schubert <p>The 278*09100258SXin LI<code>pw</code> 2792b15cb3dSCy Schubertoption of the 280*09100258SXin LI<code>crypto</code> 281*09100258SXin LI<code>ntpd(1ntpdmdoc)</code> 2822b15cb3dSCy Schubertconfiguration command specifies the read 2832b15cb3dSCy Schubertpassword for previously encrypted local files. 284*09100258SXin LIThis must match the local read password used by this program. 2852b15cb3dSCy SchubertIf not specified, the host name is used. 286*09100258SXin LIThus, if files are generated by this program without an explicit password, 2872b15cb3dSCy Schubertthey can be read back by 288*09100258SXin LI<code>ntpd(1ntpdmdoc)</code> 289*09100258SXin LIwithout specifying an explicit password but only on the same host. 290*09100258SXin LIIf the write password used for encryption is specified as the host name, 291*09100258SXin LIthese files can be read by that host with no explicit password. 2922b15cb3dSCy Schubert 2932b15cb3dSCy Schubert <p>Normally, encrypted files for each host are generated by that host and 2942b15cb3dSCy Schubertused only by that host, although exceptions exist as noted later on 2952b15cb3dSCy Schubertthis page. 2962b15cb3dSCy SchubertThe symmetric keys file, normally called 297*09100258SXin LI<span class="file">ntp.keys</span>, 2982b15cb3dSCy Schubertis usually installed in 2992b15cb3dSCy Schubert<span class="file">/etc</span>. 3002b15cb3dSCy SchubertOther files and links are usually installed in 3012b15cb3dSCy Schubert<span class="file">/usr/local/etc</span>, 3022b15cb3dSCy Schubertwhich is normally in a shared filesystem in 3032b15cb3dSCy SchubertNFS-mounted networks and cannot be changed by shared clients. 304*09100258SXin LIIn these cases, NFS clients can specify the files in another 305*09100258SXin LIdirectory such as 306*09100258SXin LI<span class="file">/etc</span> 307*09100258SXin LIusing the 308*09100258SXin LI<code>keysdir</code> 309*09100258SXin LI<code>ntpd(1ntpdmdoc)</code> 310*09100258SXin LIconfiguration file command. 3112b15cb3dSCy Schubert 3122b15cb3dSCy Schubert <p>This program directs commentary and error messages to the standard 3132b15cb3dSCy Schuberterror stream 314*09100258SXin LI<span class="file">stderr</span> 3152b15cb3dSCy Schubertand remote files to the standard output stream 316*09100258SXin LI<span class="file">stdout</span> 3172b15cb3dSCy Schubertwhere they can be piped to other applications or redirected to files. 3182b15cb3dSCy SchubertThe names used for generated files and links all begin with the 3192b15cb3dSCy Schubertstring 320*09100258SXin LI<span class="file">ntpkey*</span> 3212b15cb3dSCy Schubertand include the file type, generating host and filestamp, 3222b15cb3dSCy Schubertas described in the 323*09100258SXin LI<a href="#Cryptographic-Data-Files">Cryptographic Data Files</a> 3242b15cb3dSCy Schubertsection below. 3252b15cb3dSCy Schubert 3262b15cb3dSCy Schubert<h5 class="subsubsection">Running the Program</h5> 3272b15cb3dSCy Schubert 328*09100258SXin LI<p>The safest way to run the 329*09100258SXin LI<code>ntp-keygen</code> 330*09100258SXin LIprogram is logged in directly as root. 331*09100258SXin LIThe recommended procedure is change to the 332*09100258SXin LI<kbd>keys</kbd> 333*09100258SXin LIdirectory, usually 334*09100258SXin LI<span class="file">/usr/local/etc</span>, 335*09100258SXin LIthen run the program. 336*09100258SXin LI 3372b15cb3dSCy Schubert <p>To test and gain experience with Autokey concepts, log in as root and 338*09100258SXin LIchange to the 339*09100258SXin LI<kbd>keys</kbd> 340*09100258SXin LIdirectory, usually 341*09100258SXin LI<span class="file">/usr/local/etc</span>. 3422b15cb3dSCy SchubertWhen run for the first time, or if all files with names beginning with 343*09100258SXin LI<span class="file">ntpkey*</span> 3442b15cb3dSCy Schuberthave been removed, use the 3452b15cb3dSCy Schubert<code>ntp-keygen</code> 346*09100258SXin LIcommand without arguments to generate a default 347*09100258SXin LI<code>RSA</code> 348*09100258SXin LIhost key and matching 349*09100258SXin LI<code>RSA-MD5</code> 350*09100258SXin LIcertificate file with expiration date one year hence, 351*09100258SXin LIwhich is all that is necessary in many cases. 352*09100258SXin LIThe program also generates soft links from the generic names 353*09100258SXin LIto the respective files. 3542b15cb3dSCy SchubertIf run again without options, the program uses the 355*09100258SXin LIexisting keys and parameters and generates a new certificate file with 356*09100258SXin LInew expiration date one year hence, and soft link. 357*09100258SXin LI 358*09100258SXin LI <p>The host key is used to encrypt the cookie when required and so must be 359*09100258SXin LI<code>RSA</code> 360*09100258SXin LItype. 361*09100258SXin LIBy default, the host key is also the sign key used to encrypt signatures. 362*09100258SXin LIWhen necessary, a different sign key can be specified and this can be 363*09100258SXin LIeither 364*09100258SXin LI<code>RSA</code> 365*09100258SXin LIor 366*09100258SXin LI<code>DSA</code> 367*09100258SXin LItype. 368*09100258SXin LIBy default, the message digest type is 369*09100258SXin LI<code>MD5</code>, 370*09100258SXin LIbut any combination 371*09100258SXin LIof sign key type and message digest type supported by the OpenSSL library 372*09100258SXin LIcan be specified, including those using the 373*09100258SXin LI<code>AES128CMAC</code>, <code>MD2</code>, <code>MD5</code>, <code>MDC2</code>, <code>SHA</code>, <code>SHA1</code> 374*09100258SXin LIand 375*09100258SXin LI<code>RIPE160</code> 376*09100258SXin LImessage digest algorithms. 377*09100258SXin LIHowever, the scheme specified in the certificate must be compatible 378*09100258SXin LIwith the sign key. 379*09100258SXin LICertificates using any digest algorithm are compatible with 380*09100258SXin LI<code>RSA</code> 381*09100258SXin LIsign keys; 382*09100258SXin LIhowever, only 383*09100258SXin LI<code>SHA</code> 384*09100258SXin LIand 385*09100258SXin LI<code>SHA1</code> 386*09100258SXin LIcertificates are compatible with 387*09100258SXin LI<code>DSA</code> 388*09100258SXin LIsign keys. 389*09100258SXin LI 390*09100258SXin LI <p>Private/public key files and certificates are compatible with 391*09100258SXin LIother OpenSSL applications and very likely other libraries as well. 392*09100258SXin LICertificates or certificate requests derived from them should be compatible 393*09100258SXin LIwith extant industry practice, although some users might find 394*09100258SXin LIthe interpretation of X509v3 extension fields somewhat liberal. 395*09100258SXin LIHowever, the identification parameter files, although encoded 396*09100258SXin LIas the other files, are probably not compatible with anything other than Autokey. 397*09100258SXin LI 398*09100258SXin LI <p>Running the program as other than root and using the Unix 399*09100258SXin LI<code>su(1)</code> 400*09100258SXin LIcommand 401*09100258SXin LIto assume root may not work properly, since by default the OpenSSL library 402*09100258SXin LIlooks for the random seed file 403*09100258SXin LI<span class="file">.rnd</span> 404*09100258SXin LIin the user home directory. 405*09100258SXin LIHowever, there should be only one 406*09100258SXin LI<span class="file">.rnd</span>, 407*09100258SXin LImost conveniently 408*09100258SXin LIin the root directory, so it is convenient to define the 409*09100258SXin LI.Ev RANDFILE 410*09100258SXin LIenvironment variable used by the OpenSSL library as the path to 411*09100258SXin LI<span class="file">.rnd</span>. 412*09100258SXin LI 413*09100258SXin LI <p>Installing the keys as root might not work in NFS-mounted 414*09100258SXin LIshared file systems, as NFS clients may not be able to write 415*09100258SXin LIto the shared keys directory, even as root. 416*09100258SXin LIIn this case, NFS clients can specify the files in another 417*09100258SXin LIdirectory such as 418*09100258SXin LI<span class="file">/etc</span> 419*09100258SXin LIusing the 420*09100258SXin LI<code>keysdir</code> 421*09100258SXin LI<code>ntpd(1ntpdmdoc)</code> 422*09100258SXin LIconfiguration file command. 423*09100258SXin LIThere is no need for one client to read the keys and certificates 424*09100258SXin LIof other clients or servers, as these data are obtained automatically 425*09100258SXin LIby the Autokey protocol. 426*09100258SXin LI 427*09100258SXin LI <p>Ordinarily, cryptographic files are generated by the host that uses them, 428*09100258SXin LIbut it is possible for a trusted agent (TA) to generate these files 429*09100258SXin LIfor other hosts; however, in such cases files should always be encrypted. 430*09100258SXin LIThe subject name and trusted name default to the hostname 431*09100258SXin LIof the host generating the files, but can be changed by command line options. 432*09100258SXin LIIt is convenient to designate the owner name and trusted name 433*09100258SXin LIas the subject and issuer fields, respectively, of the certificate. 434*09100258SXin LIThe owner name is also used for the host and sign key files, 435*09100258SXin LIwhile the trusted name is used for the identity files. 436*09100258SXin LI 437*09100258SXin LI <p>All files are installed by default in the keys directory 438*09100258SXin LI<span class="file">/usr/local/etc</span>, 439*09100258SXin LIwhich is normally in a shared filesystem 440*09100258SXin LIin NFS-mounted networks. 441*09100258SXin LIThe actual location of the keys directory 442*09100258SXin LIand each file can be overridden by configuration commands, 443*09100258SXin LIbut this is not recommended. 444*09100258SXin LINormally, the files for each host are generated by that host 445*09100258SXin LIand used only by that host, although exceptions exist 446*09100258SXin LIas noted later on this page. 447*09100258SXin LI 448*09100258SXin LI <p>Normally, files containing private values, 449*09100258SXin LIincluding the host key, sign key and identification parameters, 450*09100258SXin LIare permitted root read/write-only; 451*09100258SXin LIwhile others containing public values are permitted world readable. 452*09100258SXin LIAlternatively, files containing private values can be encrypted 453*09100258SXin LIand these files permitted world readable, 454*09100258SXin LIwhich simplifies maintenance in shared file systems. 455*09100258SXin LISince uniqueness is insured by the 456*09100258SXin LI<kbd>hostname</kbd> 457*09100258SXin LIand 458*09100258SXin LI<kbd>filestamp</kbd> 459*09100258SXin LIfile name extensions, the files for an NTP server and 460*09100258SXin LIdependent clients can all be installed in the same shared directory. 461*09100258SXin LI 462*09100258SXin LI <p>The recommended practice is to keep the file name extensions 463*09100258SXin LIwhen installing a file and to install a soft link 464*09100258SXin LIfrom the generic names specified elsewhere on this page 465*09100258SXin LIto the generated files. 466*09100258SXin LIThis allows new file generations to be activated simply 467*09100258SXin LIby changing the link. 468*09100258SXin LIIf a link is present, 469*09100258SXin LI<code>ntpd(1ntpdmdoc)</code> 470*09100258SXin LIfollows it to the file name to extract the 471*09100258SXin LI<kbd>filestamp</kbd>. 472*09100258SXin LIIf a link is not present, 473*09100258SXin LI<code>ntpd(1ntpdmdoc)</code> 474*09100258SXin LIextracts the 475*09100258SXin LI<kbd>filestamp</kbd> 476*09100258SXin LIfrom the file itself. 477*09100258SXin LIThis allows clients to verify that the file and generation times 478*09100258SXin LIare always current. 479*09100258SXin LIThe 480*09100258SXin LI<code>ntp-keygen</code> 481*09100258SXin LIprogram uses the same 482*09100258SXin LI<kbd>filestamp</kbd> 483*09100258SXin LIextension for all files generated 484*09100258SXin LIat one time, so each generation is distinct and can be readily 485*09100258SXin LIrecognized in monitoring data. 4862b15cb3dSCy Schubert 4872b15cb3dSCy Schubert <p>Run the command on as many hosts as necessary. 4882b15cb3dSCy SchubertDesignate one of them as the trusted host (TH) using 4892b15cb3dSCy Schubert<code>ntp-keygen</code> 4902b15cb3dSCy Schubertwith the 4912b15cb3dSCy Schubert<code>-T</code> 4922b15cb3dSCy Schubertoption and configure it to synchronize from reliable Internet servers. 4932b15cb3dSCy SchubertThen configure the other hosts to synchronize to the TH directly or 4942b15cb3dSCy Schubertindirectly. 4952b15cb3dSCy SchubertA certificate trail is created when Autokey asks the immediately 4962b15cb3dSCy Schubertascendant host towards the TH to sign its certificate, which is then 4972b15cb3dSCy Schubertprovided to the immediately descendant host on request. 4982b15cb3dSCy SchubertAll group hosts should have acyclic certificate trails ending on the TH. 4992b15cb3dSCy Schubert 5002b15cb3dSCy Schubert <p>The host key is used to encrypt the cookie when required and so must be 5012b15cb3dSCy SchubertRSA type. 5022b15cb3dSCy SchubertBy default, the host key is also the sign key used to encrypt 5032b15cb3dSCy Schubertsignatures. 5042b15cb3dSCy SchubertA different sign key can be assigned using the 5052b15cb3dSCy Schubert<code>-S</code> 506*09100258SXin LIoption and this can be either 507*09100258SXin LI<code>RSA</code> 508*09100258SXin LIor 509*09100258SXin LI<code>DSA</code> 510*09100258SXin LItype. 5112b15cb3dSCy SchubertBy default, the signature 512*09100258SXin LImessage digest type is 513*09100258SXin LI<code>MD5</code>, 514*09100258SXin LIbut any combination of sign key type and 5152b15cb3dSCy Schubertmessage digest type supported by the OpenSSL library can be specified 5162b15cb3dSCy Schubertusing the 5172b15cb3dSCy Schubert<code>-c</code> 5182b15cb3dSCy Schubertoption. 519*09100258SXin LI 520*09100258SXin LI <p>The rules say cryptographic media should be generated with proventic 5212b15cb3dSCy Schubertfilestamps, which means the host should already be synchronized before 5222b15cb3dSCy Schubertthis program is run. 5232b15cb3dSCy SchubertThis of course creates a chicken-and-egg problem 5242b15cb3dSCy Schubertwhen the host is started for the first time. 5252b15cb3dSCy SchubertAccordingly, the host time 5262b15cb3dSCy Schubertshould be set by some other means, such as eyeball-and-wristwatch, at 5272b15cb3dSCy Schubertleast so that the certificate lifetime is within the current year. 5282b15cb3dSCy SchubertAfter that and when the host is synchronized to a proventic source, the 5292b15cb3dSCy Schubertcertificate should be re-generated. 5302b15cb3dSCy Schubert 5312b15cb3dSCy Schubert <p>Additional information on trusted groups and identity schemes is on the 5322b15cb3dSCy SchubertAutokey Public-Key Authentication 5332b15cb3dSCy Schubertpage. 5342b15cb3dSCy Schubert 5352b15cb3dSCy Schubert <p>File names begin with the prefix 536*09100258SXin LI<span class="file">ntpkey</span>_ 537*09100258SXin LIand end with the suffix 538*09100258SXin LI<span class="file">_</span><kbd>hostname</kbd>. <kbd>filestamp</kbd>, 5392b15cb3dSCy Schubertwhere 5402b15cb3dSCy Schubert<kbd>hostname</kbd> 5412b15cb3dSCy Schubertis the owner name, usually the string returned 542*09100258SXin LIby the Unix 543*09100258SXin LI<code>hostname(1)</code> 544*09100258SXin LIcommand, and 5452b15cb3dSCy Schubert<kbd>filestamp</kbd> 5462b15cb3dSCy Schubertis the NTP seconds when the file was generated, in decimal digits. 5472b15cb3dSCy SchubertThis both guarantees uniqueness and simplifies maintenance 5482b15cb3dSCy Schubertprocedures, since all files can be quickly removed 5492b15cb3dSCy Schubertby a 550*09100258SXin LI<code>rm</code> <span class="file">ntpkey*</span> 5512b15cb3dSCy Schubertcommand or all files generated 5522b15cb3dSCy Schubertat a specific time can be removed by a 553*09100258SXin LI<code>rm</code> <span class="file">*</span><kbd>filestamp</kbd> 5542b15cb3dSCy Schubertcommand. 5552b15cb3dSCy SchubertTo further reduce the risk of misconfiguration, 5562b15cb3dSCy Schubertthe first two lines of a file contain the file name 5572b15cb3dSCy Schubertand generation date and time as comments. 5582b15cb3dSCy Schubert 559*09100258SXin LI<h5 class="subsubsection">Trusted Hosts and Groups</h5> 5602b15cb3dSCy Schubert 561*09100258SXin LI<p>Each cryptographic configuration involves selection of a signature scheme 5622b15cb3dSCy Schubertand identification scheme, called a cryptotype, 5632b15cb3dSCy Schubertas explained in the 5642b15cb3dSCy Schubert<a href="#Authentication-Options">Authentication Options</a> 5652b15cb3dSCy Schubertsection of 5662b15cb3dSCy Schubert<code>ntp.conf(5)</code>. 567*09100258SXin LIThe default cryptotype uses 568*09100258SXin LI<code>RSA</code> 569*09100258SXin LIencryption, 570*09100258SXin LI<code>MD5</code> 571*09100258SXin LImessage digest 572*09100258SXin LIand 573*09100258SXin LI<code>TC</code> 574*09100258SXin LIidentification. 5752b15cb3dSCy SchubertFirst, configure a NTP subnet including one or more low-stratum 5762b15cb3dSCy Schuberttrusted hosts from which all other hosts derive synchronization 5772b15cb3dSCy Schubertdirectly or indirectly. 5782b15cb3dSCy SchubertTrusted hosts have trusted certificates; 5792b15cb3dSCy Schubertall other hosts have nontrusted certificates. 5802b15cb3dSCy SchubertThese hosts will automatically and dynamically build authoritative 5812b15cb3dSCy Schubertcertificate trails to one or more trusted hosts. 5822b15cb3dSCy SchubertA trusted group is the set of all hosts that have, directly or indirectly, 5832b15cb3dSCy Schuberta certificate trail ending at a trusted host. 5842b15cb3dSCy SchubertThe trail is defined by static configuration file entries 5852b15cb3dSCy Schubertor dynamic means described on the 5862b15cb3dSCy Schubert<a href="#Automatic-NTP-Configuration-Options">Automatic NTP Configuration Options</a> 5872b15cb3dSCy Schubertsection of 5882b15cb3dSCy Schubert<code>ntp.conf(5)</code>. 5892b15cb3dSCy Schubert 5902b15cb3dSCy Schubert <p>On each trusted host as root, change to the keys directory. 5912b15cb3dSCy SchubertTo insure a fresh fileset, remove all 592*09100258SXin LI<span class="file">ntpkey</span> 5932b15cb3dSCy Schubertfiles. 5942b15cb3dSCy SchubertThen run 5952b15cb3dSCy Schubert<code>ntp-keygen</code> 5962b15cb3dSCy Schubert<code>-T</code> 5972b15cb3dSCy Schubertto generate keys and a trusted certificate. 5982b15cb3dSCy SchubertOn all other hosts do the same, but leave off the 5992b15cb3dSCy Schubert<code>-T</code> 6002b15cb3dSCy Schubertflag to generate keys and nontrusted certificates. 6012b15cb3dSCy SchubertWhen complete, start the NTP daemons beginning at the lowest stratum 6022b15cb3dSCy Schubertand working up the tree. 6032b15cb3dSCy SchubertIt may take some time for Autokey to instantiate the certificate trails 6042b15cb3dSCy Schubertthroughout the subnet, but setting up the environment is completely automatic. 6052b15cb3dSCy Schubert 6062b15cb3dSCy Schubert <p>If it is necessary to use a different sign key or different digest/signature 6072b15cb3dSCy Schubertscheme than the default, run 6082b15cb3dSCy Schubert<code>ntp-keygen</code> 6092b15cb3dSCy Schubertwith the 6102b15cb3dSCy Schubert<code>-S</code> <kbd>type</kbd> 6112b15cb3dSCy Schubertoption, where 6122b15cb3dSCy Schubert<kbd>type</kbd> 6132b15cb3dSCy Schubertis either 6142b15cb3dSCy Schubert<code>RSA</code> 6152b15cb3dSCy Schubertor 6162b15cb3dSCy Schubert<code>DSA</code>. 617*09100258SXin LIThe most frequent need to do this is when a 618*09100258SXin LI<code>DSA</code>-signed 619*09100258SXin LIcertificate is used. 6202b15cb3dSCy SchubertIf it is necessary to use a different certificate scheme than the default, 6212b15cb3dSCy Schubertrun 6222b15cb3dSCy Schubert<code>ntp-keygen</code> 6232b15cb3dSCy Schubertwith the 6242b15cb3dSCy Schubert<code>-c</code> <kbd>scheme</kbd> 6252b15cb3dSCy Schubertoption and selected 6262b15cb3dSCy Schubert<kbd>scheme</kbd> 6272b15cb3dSCy Schubertas needed. 628*09100258SXin LIIf 6292b15cb3dSCy Schubert<code>ntp-keygen</code> 6302b15cb3dSCy Schubertis run again without these options, it generates a new certificate 631*09100258SXin LIusing the same scheme and sign key, and soft link. 6322b15cb3dSCy Schubert 6332b15cb3dSCy Schubert <p>After setting up the environment it is advisable to update certificates 6342b15cb3dSCy Schubertfrom time to time, if only to extend the validity interval. 6352b15cb3dSCy SchubertSimply run 6362b15cb3dSCy Schubert<code>ntp-keygen</code> 6372b15cb3dSCy Schubertwith the same flags as before to generate new certificates 638*09100258SXin LIusing existing keys, and soft links. 6392b15cb3dSCy SchubertHowever, if the host or sign key is changed, 6402b15cb3dSCy Schubert<code>ntpd(1ntpdmdoc)</code> 6412b15cb3dSCy Schubertshould be restarted. 6422b15cb3dSCy SchubertWhen 6432b15cb3dSCy Schubert<code>ntpd(1ntpdmdoc)</code> 6442b15cb3dSCy Schubertis restarted, it loads any new files and restarts the protocol. 6452b15cb3dSCy SchubertOther dependent hosts will continue as usual until signatures are refreshed, 6462b15cb3dSCy Schubertat which time the protocol is restarted. 6472b15cb3dSCy Schubert 6482b15cb3dSCy Schubert<h5 class="subsubsection">Identity Schemes</h5> 6492b15cb3dSCy Schubert 6502b15cb3dSCy Schubert<p>As mentioned on the Autonomous Authentication page, 651*09100258SXin LIthe default 652*09100258SXin LI<code>TC</code> 653*09100258SXin LIidentity scheme is vulnerable to a middleman attack. 6542b15cb3dSCy SchubertHowever, there are more secure identity schemes available, 655*09100258SXin LIincluding 656*09100258SXin LI<code>PC</code>, <code>IFF</code>, <code>GQ</code> 657*09100258SXin LIand 658*09100258SXin LI<code>MV</code> 659*09100258SXin LIschemes described below. 6602b15cb3dSCy SchubertThese schemes are based on a TA, one or more trusted hosts 6612b15cb3dSCy Schubertand some number of nontrusted hosts. 6622b15cb3dSCy SchubertTrusted hosts prove identity using values provided by the TA, 6632b15cb3dSCy Schubertwhile the remaining hosts prove identity using values provided 6642b15cb3dSCy Schubertby a trusted host and certificate trails that end on that host. 6652b15cb3dSCy SchubertThe name of a trusted host is also the name of its sugroup 6662b15cb3dSCy Schubertand also the subject and issuer name on its trusted certificate. 6672b15cb3dSCy SchubertThe TA is not necessarily a trusted host in this sense, but often is. 6682b15cb3dSCy Schubert 6692b15cb3dSCy Schubert <p>In some schemes there are separate keys for servers and clients. 6702b15cb3dSCy SchubertA server can also be a client of another server, 6712b15cb3dSCy Schubertbut a client can never be a server for another client. 6722b15cb3dSCy SchubertIn general, trusted hosts and nontrusted hosts that operate 6732b15cb3dSCy Schubertas both server and client have parameter files that contain 6742b15cb3dSCy Schubertboth server and client keys. 6752b15cb3dSCy SchubertHosts that operate 6762b15cb3dSCy Schubertonly as clients have key files that contain only client keys. 6772b15cb3dSCy Schubert 6782b15cb3dSCy Schubert <p>The PC scheme supports only one trusted host in the group. 6792b15cb3dSCy SchubertOn trusted host alice run 6802b15cb3dSCy Schubert<code>ntp-keygen</code> 6812b15cb3dSCy Schubert<code>-P</code> 6822b15cb3dSCy Schubert<code>-p</code> <kbd>password</kbd> 6832b15cb3dSCy Schubertto generate the host key file 684*09100258SXin LI<span class="file">ntpkey</span>_ <code>RSA</code> <span class="file">key_alice.</span> <kbd>filestamp</kbd> 6852b15cb3dSCy Schubertand trusted private certificate file 686*09100258SXin LI<span class="file">ntpkey</span>_ <code>RSA-MD5</code> <code>_</code> <span class="file">cert_alice.</span> <kbd>filestamp</kbd>, 687*09100258SXin LIand soft links. 6882b15cb3dSCy SchubertCopy both files to all group hosts; 6892b15cb3dSCy Schubertthey replace the files which would be generated in other schemes. 690*09100258SXin LIOn each host 691*09100258SXin LI<kbd>bob</kbd> 692*09100258SXin LIinstall a soft link from the generic name 6932b15cb3dSCy Schubert<span class="file">ntpkey_host_</span><kbd>bob</kbd> 6942b15cb3dSCy Schubertto the host key file and soft link 6952b15cb3dSCy Schubert<span class="file">ntpkey_cert_</span><kbd>bob</kbd> 6962b15cb3dSCy Schubertto the private certificate file. 6972b15cb3dSCy SchubertNote the generic links are on bob, but point to files generated 6982b15cb3dSCy Schubertby trusted host alice. 6992b15cb3dSCy SchubertIn this scheme it is not possible to refresh 7002b15cb3dSCy Schuberteither the keys or certificates without copying them 701*09100258SXin LIto all other hosts in the group, and recreating the soft links. 7022b15cb3dSCy Schubert 703*09100258SXin LI <p>For the 704*09100258SXin LI<code>IFF</code> 705*09100258SXin LIscheme proceed as in the 706*09100258SXin LI<code>TC</code> 707*09100258SXin LIscheme to generate keys 7082b15cb3dSCy Schubertand certificates for all group hosts, then for every trusted host in the group, 709*09100258SXin LIgenerate the 710*09100258SXin LI<code>IFF</code> 711*09100258SXin LIparameter file. 7122b15cb3dSCy SchubertOn trusted host alice run 7132b15cb3dSCy Schubert<code>ntp-keygen</code> 7142b15cb3dSCy Schubert<code>-T</code> 7152b15cb3dSCy Schubert<code>-I</code> 7162b15cb3dSCy Schubert<code>-p</code> <kbd>password</kbd> 7172b15cb3dSCy Schubertto produce her parameter file 718*09100258SXin LI<span class="file">ntpkey_IFFpar_alice.</span><kbd>filestamp</kbd>, 7192b15cb3dSCy Schubertwhich includes both server and client keys. 7202b15cb3dSCy SchubertCopy this file to all group hosts that operate as both servers 7212b15cb3dSCy Schubertand clients and install a soft link from the generic 722*09100258SXin LI<span class="file">ntpkey_iff_alice</span> 7232b15cb3dSCy Schubertto this file. 7242b15cb3dSCy SchubertIf there are no hosts restricted to operate only as clients, 7252b15cb3dSCy Schubertthere is nothing further to do. 726*09100258SXin LIAs the 727*09100258SXin LI<code>IFF</code> 728*09100258SXin LIscheme is independent 7292b15cb3dSCy Schubertof keys and certificates, these files can be refreshed as needed. 7302b15cb3dSCy Schubert 7312b15cb3dSCy Schubert <p>If a rogue client has the parameter file, it could masquerade 7322b15cb3dSCy Schubertas a legitimate server and present a middleman threat. 7332b15cb3dSCy SchubertTo eliminate this threat, the client keys can be extracted 7342b15cb3dSCy Schubertfrom the parameter file and distributed to all restricted clients. 7352b15cb3dSCy SchubertAfter generating the parameter file, on alice run 7362b15cb3dSCy Schubert<code>ntp-keygen</code> 7372b15cb3dSCy Schubert<code>-e</code> 738*09100258SXin LIand pipe the output to a file or email program. 739*09100258SXin LICopy or email this file to all restricted clients. 7402b15cb3dSCy SchubertOn these clients install a soft link from the generic 741*09100258SXin LI<span class="file">ntpkey_iff_alice</span> 7422b15cb3dSCy Schubertto this file. 7432b15cb3dSCy SchubertTo further protect the integrity of the keys, 7442b15cb3dSCy Schuberteach file can be encrypted with a secret password. 7452b15cb3dSCy Schubert 746*09100258SXin LI <p>For the 747*09100258SXin LI<code>GQ</code> 748*09100258SXin LIscheme proceed as in the 749*09100258SXin LI<code>TC</code> 750*09100258SXin LIscheme to generate keys 7512b15cb3dSCy Schubertand certificates for all group hosts, then for every trusted host 752*09100258SXin LIin the group, generate the 753*09100258SXin LI<code>IFF</code> 754*09100258SXin LIparameter file. 7552b15cb3dSCy SchubertOn trusted host alice run 7562b15cb3dSCy Schubert<code>ntp-keygen</code> 7572b15cb3dSCy Schubert<code>-T</code> 7582b15cb3dSCy Schubert<code>-G</code> 7592b15cb3dSCy Schubert<code>-p</code> <kbd>password</kbd> 7602b15cb3dSCy Schubertto produce her parameter file 761*09100258SXin LI<span class="file">ntpkey_GQpar_alice.</span><kbd>filestamp</kbd>, 7622b15cb3dSCy Schubertwhich includes both server and client keys. 7632b15cb3dSCy SchubertCopy this file to all group hosts and install a soft link 7642b15cb3dSCy Schubertfrom the generic 765*09100258SXin LI<span class="file">ntpkey_gq_alice</span> 7662b15cb3dSCy Schubertto this file. 767*09100258SXin LIIn addition, on each host 768*09100258SXin LI<kbd>bob</kbd> 769*09100258SXin LIinstall a soft link 7702b15cb3dSCy Schubertfrom generic 7712b15cb3dSCy Schubert<span class="file">ntpkey_gq_</span><kbd>bob</kbd> 7722b15cb3dSCy Schubertto this file. 773*09100258SXin LIAs the 774*09100258SXin LI<code>GQ</code> 775*09100258SXin LIscheme updates the 776*09100258SXin LI<code>GQ</code> 777*09100258SXin LIparameters file and certificate 7782b15cb3dSCy Schubertat the same time, keys and certificates can be regenerated as needed. 7792b15cb3dSCy Schubert 780*09100258SXin LI <p>For the 781*09100258SXin LI<code>MV</code> 782*09100258SXin LIscheme, proceed as in the 783*09100258SXin LI<code>TC</code> 784*09100258SXin LIscheme to generate keys 7852b15cb3dSCy Schubertand certificates for all group hosts. 7862b15cb3dSCy SchubertFor illustration assume trish is the TA, alice one of several trusted hosts 7872b15cb3dSCy Schubertand bob one of her clients. 7882b15cb3dSCy SchubertOn TA trish run 7892b15cb3dSCy Schubert<code>ntp-keygen</code> 7902b15cb3dSCy Schubert<code>-V</code> <kbd>n</kbd> 7912b15cb3dSCy Schubert<code>-p</code> <kbd>password</kbd>, 7922b15cb3dSCy Schubertwhere 7932b15cb3dSCy Schubert<kbd>n</kbd> 7942b15cb3dSCy Schubertis the number of revokable keys (typically 5) to produce 7952b15cb3dSCy Schubertthe parameter file 796*09100258SXin LI<span class="file">ntpkeys_MVpar_trish.</span><kbd>filestamp</kbd> 7972b15cb3dSCy Schubertand client key files 798*09100258SXin LI<span class="file">ntpkeys_MVkey</span><kbd>d</kbd> <kbd>_</kbd> <span class="file">trish.</span> <kbd>filestamp</kbd> 7992b15cb3dSCy Schubertwhere 8002b15cb3dSCy Schubert<kbd>d</kbd> 8012b15cb3dSCy Schubertis the key number (0 < 8022b15cb3dSCy Schubert<kbd>d</kbd> 8032b15cb3dSCy Schubert< 8042b15cb3dSCy Schubert<kbd>n</kbd>). 8052b15cb3dSCy SchubertCopy the parameter file to alice and install a soft link 8062b15cb3dSCy Schubertfrom the generic 807*09100258SXin LI<span class="file">ntpkey_mv_alice</span> 8082b15cb3dSCy Schubertto this file. 8092b15cb3dSCy SchubertCopy one of the client key files to alice for later distribution 8102b15cb3dSCy Schubertto her clients. 811*09100258SXin LIIt does not matter which client key file goes to alice, 8122b15cb3dSCy Schubertsince they all work the same way. 813*09100258SXin LIAlice copies the client key file to all of her clients. 8142b15cb3dSCy SchubertOn client bob install a soft link from generic 815*09100258SXin LI<span class="file">ntpkey_mvkey_bob</span> 8162b15cb3dSCy Schubertto the client key file. 817*09100258SXin LIAs the 818*09100258SXin LI<code>MV</code> 819*09100258SXin LIscheme is independent of keys and certificates, 8202b15cb3dSCy Schubertthese files can be refreshed as needed. 8212b15cb3dSCy Schubert 8222b15cb3dSCy Schubert<h5 class="subsubsection">Command Line Options</h5> 8232b15cb3dSCy Schubert 8242b15cb3dSCy Schubert <dl> 825*09100258SXin LI<dt><code>-b</code> <code>--imbits</code>= <kbd>modulus</kbd><dd>Set the number of bits in the identity modulus for generating identity keys to 826*09100258SXin LI<kbd>modulus</kbd> 827*09100258SXin LIbits. 828*09100258SXin LIThe number of bits in the identity modulus defaults to 256, but can be set to 829*09100258SXin LIvalues from 256 to 2048 (32 to 256 octets). 830*09100258SXin LIUse the larger moduli with caution, as this can consume considerable computing 831*09100258SXin LIresources and increases the size of authenticated packets. 832*09100258SXin LI<br><dt><code>-c</code> <code>--certificate</code>= <kbd>scheme</kbd><dd>Select certificate signature encryption/message digest scheme. 8332b15cb3dSCy SchubertThe 8342b15cb3dSCy Schubert<kbd>scheme</kbd> 8352b15cb3dSCy Schubertcan be one of the following: 836*09100258SXin LI<code>RSA-MD2</code>, <code>RSA-MD5</code>, <code>RSA-MDC2</code>, <code>RSA-SHA</code>, <code>RSA-SHA1</code>, <code>RSA-RIPEMD160</code>, <code>DSA-SHA</code>, 8372b15cb3dSCy Schubertor 8382b15cb3dSCy Schubert<code>DSA-SHA1</code>. 839*09100258SXin LINote that 840*09100258SXin LI<code>RSA</code> 841*09100258SXin LIschemes must be used with an 842*09100258SXin LI<code>RSA</code> 843*09100258SXin LIsign key and 844*09100258SXin LI<code>DSA</code> 845*09100258SXin LIschemes must be used with a 846*09100258SXin LI<code>DSA</code> 847*09100258SXin LIsign key. 8482b15cb3dSCy SchubertThe default without this option is 8492b15cb3dSCy Schubert<code>RSA-MD5</code>. 850*09100258SXin LIIf compatibility with FIPS 140-2 is required, either the 851*09100258SXin LI<code>DSA-SHA</code> 852*09100258SXin LIor 853*09100258SXin LI<code>DSA-SHA1</code> 854*09100258SXin LIscheme must be used. 855*09100258SXin LI<br><dt><code>-C</code> <code>--cipher</code>= <kbd>cipher</kbd><dd>Select the OpenSSL cipher to encrypt the files containing private keys. 856*09100258SXin LIThe default without this option is three-key triple DES in CBC mode, 857*09100258SXin LI<code>des-ede3-cbc</code>. 858*09100258SXin LIThe 859*09100258SXin LI<code>openssl</code> <code>-h</code> 860*09100258SXin LIcommand provided with OpenSSL displays available ciphers. 861*09100258SXin LI<br><dt><code>-d</code> <code>--debug-level</code><dd>Increase debugging verbosity level. 8622b15cb3dSCy SchubertThis option displays the cryptographic data produced in eye-friendly billboards. 863*09100258SXin LI<br><dt><code>-D</code> <code>--set-debug-level</code>= <kbd>level</kbd><dd>Set the debugging verbosity to 864*09100258SXin LI<kbd>level</kbd>. 865*09100258SXin LIThis option displays the cryptographic data produced in eye-friendly billboards. 866*09100258SXin LI<br><dt><code>-e</code> <code>--id-key</code><dd>Write the 867*09100258SXin LI<code>IFF</code> 868*09100258SXin LIor 869*09100258SXin LI<code>GQ</code> 870*09100258SXin LIpublic parameters from the 871*09100258SXin LI<kbd>IFFkey</kbd> <kbd>or</kbd> <kbd>GQkey</kbd> 872*09100258SXin LIclient keys file previously specified 873*09100258SXin LIas unencrypted data to the standard output stream 874*09100258SXin LI<span class="file">stdout</span>. 875*09100258SXin LIThis is intended for automatic key distribution by email. 876*09100258SXin LI<br><dt><code>-G</code> <code>--gq-params</code><dd>Generate a new encrypted 877*09100258SXin LI<code>GQ</code> 878*09100258SXin LIparameters and key file for the Guillou-Quisquater (GQ) identity scheme. 879*09100258SXin LIThis option is mutually exclusive with the 880*09100258SXin LI<code>-I</code> 881*09100258SXin LIand 882*09100258SXin LI<code>-V</code> 883*09100258SXin LIoptions. 884*09100258SXin LI<br><dt><code>-H</code> <code>--host-key</code><dd>Generate a new encrypted 885*09100258SXin LI<code>RSA</code> 886*09100258SXin LIpublic/private host key file. 887*09100258SXin LI<br><dt><code>-I</code> <code>--iffkey</code><dd>Generate a new encrypted 888*09100258SXin LI<code>IFF</code> 889*09100258SXin LIkey file for the Schnorr (IFF) identity scheme. 890*09100258SXin LIThis option is mutually exclusive with the 891*09100258SXin LI<code>-G</code> 892*09100258SXin LIand 893*09100258SXin LIFl V 894*09100258SXin LIoptions. 895*09100258SXin LI<br><dt><code>-i</code> <code>--ident</code>= <kbd>group</kbd><dd>Set the optional Autokey group name to 896*09100258SXin LI<kbd>group</kbd>. 897*09100258SXin LIThis is used in the identity scheme parameter file names of 898*09100258SXin LI<code>IFF</code>, <code>GQ</code>, 899*09100258SXin LIand 900*09100258SXin LI<code>MV</code> 901*09100258SXin LIclient parameters files. 902*09100258SXin LIIn that role, the default is the host name if no group is provided. 903*09100258SXin LIThe group name, if specified using 904*09100258SXin LI<code>-i</code> 905*09100258SXin LIor 906*09100258SXin LI<code>-s</code> 907*09100258SXin LIfollowing an 908*09100258SXin LI@ 909*09100258SXin LIcharacter, is also used in certificate subject and issuer names in the form 910*09100258SXin LI<kbd>host</kbd> <kbd>@</kbd> <kbd>group</kbd> 911*09100258SXin LIand should match the group specified via 912*09100258SXin LI<code>crypto</code> <code>ident</code> 913*09100258SXin LIor 914*09100258SXin LI<code>server</code> <code>ident</code> 915*09100258SXin LIin the ntpd configuration file. 916*09100258SXin LI<br><dt><code>-l</code> <code>--lifetime</code>= <kbd>days</kbd><dd>Set the lifetime for certificate expiration to 917*09100258SXin LI<kbd>days</kbd>. 918*09100258SXin LIThe default lifetime is one year (365 days). 919*09100258SXin LI<br><dt><code>-m</code> <code>--modulus</code>= <kbd>bits</kbd><dd>Set the number of bits in the prime modulus for generating files to 920*09100258SXin LI<kbd>bits</kbd>. 921*09100258SXin LIThe modulus defaults to 512, but can be set from 256 to 2048 (32 to 256 octets). 922*09100258SXin LIUse the larger moduli with caution, as this can consume considerable computing 923*09100258SXin LIresources and increases the size of authenticated packets. 924*09100258SXin LI<br><dt><code>-M</code> <code>--md5key</code><dd>Generate a new symmetric keys file containing 10 925*09100258SXin LI<code>MD5</code> 926*09100258SXin LIkeys, and if OpenSSL is available, 10 927*09100258SXin LI<code>SHA</code> 928*09100258SXin LIkeys. 929*09100258SXin LIAn 930*09100258SXin LI<code>MD5</code> 931*09100258SXin LIkey is a string of 20 random printable ASCII characters, while a 932*09100258SXin LI<code>SHA</code> 933*09100258SXin LIkey is a string of 40 random hex digits. 934*09100258SXin LIThe file can be edited using a text editor to change the key type or key content. 935*09100258SXin LIThis option is mutually exclusive with all other options. 936*09100258SXin LI<br><dt><code>-p</code> <code>--password</code>= <kbd>passwd</kbd><dd>Set the password for reading and writing encrypted files to 937*09100258SXin LI<kbd>passwd</kbd>. 938*09100258SXin LIThese include the host, sign and identify key files. 939*09100258SXin LIBy default, the password is the string returned by the Unix 940*09100258SXin LI<code>hostname</code> 941*09100258SXin LIcommand. 942*09100258SXin LI<br><dt><code>-P</code> <code>--pvt-cert</code><dd>Generate a new private certificate used by the 943*09100258SXin LI<code>PC</code> 944*09100258SXin LIidentity scheme. 9452b15cb3dSCy SchubertBy default, the program generates public certificates. 946*09100258SXin LINote: the PC identity scheme is not recommended for new installations. 947*09100258SXin LI<br><dt><code>-q</code> <code>--export-passwd</code>= <kbd>passwd</kbd><dd>Set the password for writing encrypted 948*09100258SXin LI<code>IFF</code>, <code>GQ</code> <code>and</code> <code>MV</code> 949*09100258SXin LIidentity files redirected to 950*09100258SXin LI<span class="file">stdout</span> 951*09100258SXin LIto 952*09100258SXin LI<kbd>passwd</kbd>. 953*09100258SXin LIIn effect, these files are decrypted with the 954*09100258SXin LI<code>-p</code> 955*09100258SXin LIpassword, then encrypted with the 956*09100258SXin LI<code>-q</code> 957*09100258SXin LIpassword. 958*09100258SXin LIBy default, the password is the string returned by the Unix 959*09100258SXin LI<code>hostname</code> 960*09100258SXin LIcommand. 961*09100258SXin LI<br><dt><code>-s</code> <code>--subject-key</code>= <code>[host]</code> <code>[@ </code><kbd>group</kbd><code>]</code><dd>Specify the Autokey host name, where 962*09100258SXin LI<kbd>host</kbd> 963*09100258SXin LIis the optional host name and 964*09100258SXin LI<kbd>group</kbd> 965*09100258SXin LIis the optional group name. 966*09100258SXin LIThe host name, and if provided, group name are used in 967*09100258SXin LI<kbd>host</kbd> <kbd>@</kbd> <kbd>group</kbd> 968*09100258SXin LIform as certificate subject and issuer. 969*09100258SXin LISpecifying 970*09100258SXin LI<code>-s</code> <code>-@</code> <kbd>group</kbd> 971*09100258SXin LIis allowed, and results in leaving the host name unchanged, as with 972*09100258SXin LI<code>-i</code> <kbd>group</kbd>. 973*09100258SXin LIThe group name, or if no group is provided, the host name are also used in the 974*09100258SXin LIfile names of 975*09100258SXin LI<code>IFF</code>, <code>GQ</code>, 976*09100258SXin LIand 977*09100258SXin LI<code>MV</code> 978*09100258SXin LIidentity scheme client parameter files. 979*09100258SXin LIIf 980*09100258SXin LI<kbd>host</kbd> 981*09100258SXin LIis not specified, the default host name is the string returned by the Unix 982*09100258SXin LI<code>hostname</code> 983*09100258SXin LIcommand. 984*09100258SXin LI<br><dt><code>-S</code> <code>--sign-key</code>= <code>[RSA | DSA]</code><dd>Generate a new encrypted public/private sign key file of the specified type. 985*09100258SXin LIBy default, the sign key is the host key and has the same type. 986*09100258SXin LIIf compatibility with FIPS 140-2 is required, the sign key type must be 987*09100258SXin LI<code>DSA</code>. 988*09100258SXin LI<br><dt><code>-T</code> <code>--trusted-cert</code><dd>Generate a trusted certificate. 9892b15cb3dSCy SchubertBy default, the program generates a non-trusted certificate. 990*09100258SXin LI<br><dt><code>-V</code> <code>--mv-params</code> <kbd>nkeys</kbd><dd>Generate 991*09100258SXin LI<kbd>nkeys</kbd> 992*09100258SXin LIencrypted server keys and parameters for the Mu-Varadharajan (MV) 993*09100258SXin LIidentity scheme. 994*09100258SXin LIThis option is mutually exclusive with the 995*09100258SXin LI<code>-I</code> 996*09100258SXin LIand 997*09100258SXin LI<code>-G</code> 998*09100258SXin LIoptions. 999*09100258SXin LINote: support for this option should be considered a work in progress. 10002b15cb3dSCy Schubert</dl> 10012b15cb3dSCy Schubert 10022b15cb3dSCy Schubert<h5 class="subsubsection">Random Seed File</h5> 10032b15cb3dSCy Schubert 10042b15cb3dSCy Schubert<p>All cryptographically sound key generation schemes must have means 10052b15cb3dSCy Schubertto randomize the entropy seed used to initialize 10062b15cb3dSCy Schubertthe internal pseudo-random number generator used 10072b15cb3dSCy Schubertby the library routines. 10082b15cb3dSCy SchubertThe OpenSSL library uses a designated random seed file for this purpose. 10092b15cb3dSCy SchubertThe file must be available when starting the NTP daemon and 10102b15cb3dSCy Schubert<code>ntp-keygen</code> 10112b15cb3dSCy Schubertprogram. 10122b15cb3dSCy SchubertIf a site supports OpenSSL or its companion OpenSSH, 10132b15cb3dSCy Schubertit is very likely that means to do this are already available. 10142b15cb3dSCy Schubert 10152b15cb3dSCy Schubert <p>It is important to understand that entropy must be evolved 10162b15cb3dSCy Schubertfor each generation, for otherwise the random number sequence 10172b15cb3dSCy Schubertwould be predictable. 10182b15cb3dSCy SchubertVarious means dependent on external events, such as keystroke intervals, 10192b15cb3dSCy Schubertcan be used to do this and some systems have built-in entropy sources. 10202b15cb3dSCy SchubertSuitable means are described in the OpenSSL software documentation, 10212b15cb3dSCy Schubertbut are outside the scope of this page. 10222b15cb3dSCy Schubert 10232b15cb3dSCy Schubert <p>The entropy seed used by the OpenSSL library is contained in a file, 10242b15cb3dSCy Schubertusually called 1025*09100258SXin LI<span class="file">.rnd</span>, 10262b15cb3dSCy Schubertwhich must be available when starting the NTP daemon 10272b15cb3dSCy Schubertor the 10282b15cb3dSCy Schubert<code>ntp-keygen</code> 10292b15cb3dSCy Schubertprogram. 10302b15cb3dSCy SchubertThe NTP daemon will first look for the file 10312b15cb3dSCy Schubertusing the path specified by the 10322b15cb3dSCy Schubert<code>randfile</code> 10332b15cb3dSCy Schubertsubcommand of the 10342b15cb3dSCy Schubert<code>crypto</code> 10352b15cb3dSCy Schubertconfiguration command. 10362b15cb3dSCy SchubertIf not specified in this way, or when starting the 10372b15cb3dSCy Schubert<code>ntp-keygen</code> 10382b15cb3dSCy Schubertprogram, 10392b15cb3dSCy Schubertthe OpenSSL library will look for the file using the path specified 10402b15cb3dSCy Schubertby the 10412b15cb3dSCy Schubert.Ev RANDFILE 10422b15cb3dSCy Schubertenvironment variable in the user home directory, 10432b15cb3dSCy Schubertwhether root or some other user. 10442b15cb3dSCy SchubertIf the 10452b15cb3dSCy Schubert.Ev RANDFILE 10462b15cb3dSCy Schubertenvironment variable is not present, 10472b15cb3dSCy Schubertthe library will look for the 1048*09100258SXin LI<span class="file">.rnd</span> 10492b15cb3dSCy Schubertfile in the user home directory. 1050*09100258SXin LISince both the 1051*09100258SXin LI<code>ntp-keygen</code> 1052*09100258SXin LIprogram and 1053*09100258SXin LI<code>ntpd(1ntpdmdoc)</code> 1054*09100258SXin LIdaemon must run as root, the logical place to put this file is in 1055*09100258SXin LI<span class="file">/.rnd</span> 1056*09100258SXin LIor 1057*09100258SXin LI<span class="file">/root/.rnd</span>. 10582b15cb3dSCy SchubertIf the file is not available or cannot be written, 10592b15cb3dSCy Schubertthe daemon exits with a message to the system log and the program 10602b15cb3dSCy Schubertexits with a suitable error message. 10612b15cb3dSCy Schubert 10622b15cb3dSCy Schubert<h5 class="subsubsection">Cryptographic Data Files</h5> 10632b15cb3dSCy Schubert 1064*09100258SXin LI<p>All file formats begin with two nonencrypted lines. 1065*09100258SXin LIThe first line contains the file name, including the generated host name 1066*09100258SXin LIand filestamp, in the format 1067*09100258SXin LI<span class="file">ntpkey_</span><kbd>key</kbd> <kbd>_</kbd> <kbd>name</kbd>. <kbd>filestamp</kbd>, 1068*09100258SXin LIwhere 1069*09100258SXin LI<kbd>key</kbd> 1070*09100258SXin LIis the key or parameter type, 1071*09100258SXin LI<kbd>name</kbd> 1072*09100258SXin LIis the host or group name and 1073*09100258SXin LI<kbd>filestamp</kbd> 1074*09100258SXin LIis the filestamp (NTP seconds) when the file was created. 1075*09100258SXin LIBy convention, 1076*09100258SXin LI<kbd>key</kbd> 1077*09100258SXin LInames in generated file names include both upper and lower case 1078*09100258SXin LIcharacters, while 1079*09100258SXin LI<kbd>key</kbd> 1080*09100258SXin LInames in generated link names include only lower case characters. 1081*09100258SXin LIThe filestamp is not used in generated link names. 1082*09100258SXin LIThe second line contains the datestamp in conventional Unix 1083*09100258SXin LI<span class="file">date</span> 1084*09100258SXin LIformat. 1085*09100258SXin LILines beginning with 1086*09100258SXin LI# 1087*09100258SXin LIare considered comments and ignored by the 10882b15cb3dSCy Schubert<code>ntp-keygen</code> 10892b15cb3dSCy Schubertprogram and 10902b15cb3dSCy Schubert<code>ntpd(1ntpdmdoc)</code> 10912b15cb3dSCy Schubertdaemon. 10922b15cb3dSCy Schubert 1093*09100258SXin LI <p>The remainder of the file contains cryptographic data, encoded first using ASN.1 1094*09100258SXin LIrules, then encrypted if necessary, and finally written in PEM-encoded 1095*09100258SXin LIprintable ASCII text, preceded and followed by MIME content identifier lines. 1096*09100258SXin LI 1097*09100258SXin LI <p>The format of the symmetric keys file, ordinarily named 1098*09100258SXin LI<span class="file">ntp.keys</span>, 1099*09100258SXin LIis somewhat different than the other files in the interest of backward compatibility. 1100*09100258SXin LIOrdinarily, the file is generated by this program, but it can be constructed 1101*09100258SXin LIand edited using an ordinary text editor. 1102*09100258SXin LI<pre class="verbatim"> 1103*09100258SXin LI# ntpkey_MD5key_bk.ntp.org.3595864945 1104*09100258SXin LI# Thu Dec 12 19:22:25 2013 1105*09100258SXin LI 1106*09100258SXin LI1 MD5 L";Nw<\`.I<f4U0)247"i # MD5 key 1107*09100258SXin LI2 MD5 &>l0%XXK9O'51VwV<xq~ # MD5 key 1108*09100258SXin LI3 MD5 lb4zLW~d^!K:]RsD'qb6 # MD5 key 1109*09100258SXin LI4 MD5 Yue:tL[+vR)M\`n~bY,'? # MD5 key 1110*09100258SXin LI5 MD5 B;fx'Kgr/&4ZTbL6=RxA # MD5 key 1111*09100258SXin LI6 MD5 4eYwa\`o@}3i@@@@V@@..R9!l # MD5 key 1112*09100258SXin LI7 MD5 \`A.([h+;wTQ|xfi%Sn_! # MD5 key 1113*09100258SXin LI8 MD5 45:V,r4]l6y^JH6"Sh?F # MD5 key 1114*09100258SXin LI9 MD5 3-5vcn*6l29DS?Xdsg)* # MD5 key 1115*09100258SXin LI10 MD5 2late4Me # MD5 key 1116*09100258SXin LI11 SHA1 a27872d3030a9025b8446c751b4551a7629af65c # SHA1 key 1117*09100258SXin LI12 SHA1 21bc3b4865dbb9e920902abdccb3e04ff97a5e74 # SHA1 key 1118*09100258SXin LI13 SHA1 2b7736fe24fef5ba85ae11594132ab5d6f6daba9 # SHA1 key 1119*09100258SXin LI14 SHA a5332809c8878dd3a5b918819108a111509aeceb # SHA key 1120*09100258SXin LI15 MD2 2fe16c88c760ff2f16d4267e36c1aa6c926e6964 # MD2 key 1121*09100258SXin LI16 MD4 b2691811dc19cfc0e2f9bcacd74213f29812183d # MD4 key 1122*09100258SXin LI17 MD5 e4d6735b8bdad58ec5ffcb087300a17f7fef1f7c # MD5 key 1123*09100258SXin LI18 MDC2 a8d5e2315c025bf3a79174c87fbd10477de2eabc # MDC2 key 1124*09100258SXin LI19 RIPEMD160 77ca332cafb30e3cafb174dcd5b80ded7ba9b3d2 # RIPEMD160 key 1125*09100258SXin LI20 AES128CMAC f92ff73eee86c1e7dc638d6489a04e4e555af878 # AES128CMAC key 1126*09100258SXin LI</pre> 1127*09100258SXin LI<pre class="example"> Figure 1. Typical Symmetric Key File 1128*09100258SXin LI</pre> 1129*09100258SXin LI <p>Figure 1 shows a typical symmetric keys file used by the reference 1130*09100258SXin LIimplementation. 1131*09100258SXin LIFollowing the header the keys are entered one per line in the format 11322b15cb3dSCy Schubert<pre class="example"> <kbd>keyno</kbd> <kbd>type</kbd> <kbd>key</kbd> 11332b15cb3dSCy Schubert</pre> 11342b15cb3dSCy Schubert <p>where 11352b15cb3dSCy Schubert<kbd>keyno</kbd> 1136*09100258SXin LIis a positive integer in the range 1-65534; 11372b15cb3dSCy Schubert<kbd>type</kbd> 1138*09100258SXin LIis the key type for the message digest algorithm, which in the absence of the 1139*09100258SXin LIOpenSSL library must be 1140*09100258SXin LI<code>MD5</code> 1141*09100258SXin LIto designate the MD5 message digest algorithm; 1142*09100258SXin LIif the OpenSSL library is installed, the key type can be any 1143*09100258SXin LImessage digest algorithm supported by that library; 1144*09100258SXin LIhowever, if compatibility with FIPS 140-2 is required, 1145*09100258SXin LIthe key type must be either 1146*09100258SXin LI<code>SHA</code> 1147*09100258SXin LIor 1148*09100258SXin LI<code>SHA1</code>; 11492b15cb3dSCy Schubert<kbd>key</kbd> 11502b15cb3dSCy Schubertis the key itself, 1151*09100258SXin LIwhich is a printable ASCII string 20 characters or less in length: 1152*09100258SXin LIeach character is chosen from the 93 printable characters 1153*09100258SXin LIin the range 0x21 through 0x7e ( 1154*09100258SXin LI! 1155*09100258SXin LIthrough 1156*09100258SXin LI~ 1157*09100258SXin LI) excluding space and the 1158*09100258SXin LI# 1159*09100258SXin LIcharacter, and terminated by whitespace or a 11602b15cb3dSCy Schubert# 11612b15cb3dSCy Schubertcharacter. 1162*09100258SXin LIAn OpenSSL key consists of a hex-encoded ASCII string of 40 characters, which 1163*09100258SXin LIis truncated as necessary. 11642b15cb3dSCy Schubert 11652b15cb3dSCy Schubert <p>Note that the keys used by the 11662b15cb3dSCy Schubert<code>ntpq(1ntpqmdoc)</code> 11672b15cb3dSCy Schubertand 11682b15cb3dSCy Schubert<code>ntpdc(1ntpdcmdoc)</code> 11692b15cb3dSCy Schubertprograms 11702b15cb3dSCy Schubertare checked against passwords requested by the programs 11712b15cb3dSCy Schubertand entered by hand, so it is generally appropriate to specify these keys 11722b15cb3dSCy Schubertin human readable ASCII format. 11732b15cb3dSCy Schubert 11742b15cb3dSCy Schubert <p>The 11752b15cb3dSCy Schubert<code>ntp-keygen</code> 1176*09100258SXin LIprogram generates a symmetric keys file 1177*09100258SXin LI<span class="file">ntpkey_MD5key_</span><kbd>hostname</kbd>. <kbd>filestamp</kbd>. 11782b15cb3dSCy SchubertSince the file contains private shared keys, 11792b15cb3dSCy Schubertit should be visible only to root and distributed by secure means 11802b15cb3dSCy Schubertto other subnet hosts. 11812b15cb3dSCy SchubertThe NTP daemon loads the file 11822b15cb3dSCy Schubert<span class="file">ntp.keys</span>, 11832b15cb3dSCy Schubertso 11842b15cb3dSCy Schubert<code>ntp-keygen</code> 11852b15cb3dSCy Schubertinstalls a soft link from this name to the generated file. 11862b15cb3dSCy SchubertSubsequently, similar soft links must be installed by manual 11872b15cb3dSCy Schubertor automated means on the other subnet hosts. 11882b15cb3dSCy SchubertWhile this file is not used with the Autokey Version 2 protocol, 11892b15cb3dSCy Schubertit is needed to authenticate some remote configuration commands 11902b15cb3dSCy Schubertused by the 11912b15cb3dSCy Schubert<code>ntpq(1ntpqmdoc)</code> 11922b15cb3dSCy Schubertand 11932b15cb3dSCy Schubert<code>ntpdc(1ntpdcmdoc)</code> 11942b15cb3dSCy Schubertutilities. 11952b15cb3dSCy Schubert 11962b15cb3dSCy Schubert <p>This section was generated by <strong>AutoGen</strong>, 11972b15cb3dSCy Schubertusing the <code>agtexi-cmd</code> template and the option descriptions for the <code>ntp-keygen</code> program. 11982b15cb3dSCy SchubertThis software is released under the NTP license, <http://ntp.org/license>. 11992b15cb3dSCy Schubert 12002b15cb3dSCy Schubert<ul class="menu"> 12012b15cb3dSCy Schubert<li><a accesskey="1" href="#ntp_002dkeygen-usage">ntp-keygen usage</a>: ntp-keygen help/usage (<span class="option">--help</span>) 12022b15cb3dSCy Schubert<li><a accesskey="2" href="#ntp_002dkeygen-imbits">ntp-keygen imbits</a>: imbits option (-b) 12032b15cb3dSCy Schubert<li><a accesskey="3" href="#ntp_002dkeygen-certificate">ntp-keygen certificate</a>: certificate option (-c) 12042b15cb3dSCy Schubert<li><a accesskey="4" href="#ntp_002dkeygen-cipher">ntp-keygen cipher</a>: cipher option (-C) 12052b15cb3dSCy Schubert<li><a accesskey="5" href="#ntp_002dkeygen-id_002dkey">ntp-keygen id-key</a>: id-key option (-e) 12062b15cb3dSCy Schubert<li><a accesskey="6" href="#ntp_002dkeygen-gq_002dparams">ntp-keygen gq-params</a>: gq-params option (-G) 12072b15cb3dSCy Schubert<li><a accesskey="7" href="#ntp_002dkeygen-host_002dkey">ntp-keygen host-key</a>: host-key option (-H) 12082b15cb3dSCy Schubert<li><a accesskey="8" href="#ntp_002dkeygen-iffkey">ntp-keygen iffkey</a>: iffkey option (-I) 12092b15cb3dSCy Schubert<li><a accesskey="9" href="#ntp_002dkeygen-ident">ntp-keygen ident</a>: ident option (-i) 12102b15cb3dSCy Schubert<li><a href="#ntp_002dkeygen-lifetime">ntp-keygen lifetime</a>: lifetime option (-l) 12112b15cb3dSCy Schubert<li><a href="#ntp_002dkeygen-modulus">ntp-keygen modulus</a>: modulus option (-m) 1212*09100258SXin LI<li><a href="#ntp_002dkeygen-md5key">ntp-keygen md5key</a>: md5key option (-M) 12132b15cb3dSCy Schubert<li><a href="#ntp_002dkeygen-pvt_002dcert">ntp-keygen pvt-cert</a>: pvt-cert option (-P) 12142b15cb3dSCy Schubert<li><a href="#ntp_002dkeygen-password">ntp-keygen password</a>: password option (-p) 12152b15cb3dSCy Schubert<li><a href="#ntp_002dkeygen-export_002dpasswd">ntp-keygen export-passwd</a>: export-passwd option (-q) 12162b15cb3dSCy Schubert<li><a href="#ntp_002dkeygen-subject_002dname">ntp-keygen subject-name</a>: subject-name option (-s) 1217*09100258SXin LI<li><a href="#ntp_002dkeygen-sign_002dkey">ntp-keygen sign-key</a>: sign-key option (-S) 12182b15cb3dSCy Schubert<li><a href="#ntp_002dkeygen-trusted_002dcert">ntp-keygen trusted-cert</a>: trusted-cert option (-T) 12192b15cb3dSCy Schubert<li><a href="#ntp_002dkeygen-mv_002dparams">ntp-keygen mv-params</a>: mv-params option (-V) 12202b15cb3dSCy Schubert<li><a href="#ntp_002dkeygen-mv_002dkeys">ntp-keygen mv-keys</a>: mv-keys option (-v) 12212b15cb3dSCy Schubert<li><a href="#ntp_002dkeygen-config">ntp-keygen config</a>: presetting/configuring ntp-keygen 12222b15cb3dSCy Schubert<li><a href="#ntp_002dkeygen-exit-status">ntp-keygen exit status</a>: exit status 12232b15cb3dSCy Schubert<li><a href="#ntp_002dkeygen-Usage">ntp-keygen Usage</a>: Usage 12242b15cb3dSCy Schubert<li><a href="#ntp_002dkeygen-Notes">ntp-keygen Notes</a>: Notes 12252b15cb3dSCy Schubert<li><a href="#ntp_002dkeygen-Bugs">ntp-keygen Bugs</a>: Bugs 12262b15cb3dSCy Schubert</ul> 12272b15cb3dSCy Schubert 12282b15cb3dSCy Schubert<div class="node"> 12292b15cb3dSCy Schubert<p><hr> 12302b15cb3dSCy Schubert<a name="ntp_002dkeygen-usage"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-imbits">ntp-keygen imbits</a>, 12312b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 12322b15cb3dSCy Schubert<br> 12332b15cb3dSCy Schubert</div> 12342b15cb3dSCy Schubert 12352b15cb3dSCy Schubert<h4 class="subsection">ntp-keygen help/usage (<span class="option">--help</span>)</h4> 12362b15cb3dSCy Schubert 12372b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen-help-3"></a> 12382b15cb3dSCy SchubertThis is the automatically generated usage text for ntp-keygen. 12392b15cb3dSCy Schubert 12402b15cb3dSCy Schubert <p>The text printed is the same whether selected with the <code>help</code> option 12412b15cb3dSCy Schubert(<span class="option">--help</span>) or the <code>more-help</code> option (<span class="option">--more-help</span>). <code>more-help</code> will print 12422b15cb3dSCy Schubertthe usage text by passing it through a pager program. 12432b15cb3dSCy Schubert<code>more-help</code> is disabled on platforms without a working 12442b15cb3dSCy Schubert<code>fork(2)</code> function. The <code>PAGER</code> environment variable is 12452b15cb3dSCy Schubertused to select the program, defaulting to <span class="file">more</span>. Both will exit 12462b15cb3dSCy Schubertwith a status code of 0. 12472b15cb3dSCy Schubert 1248*09100258SXin LI<pre class="example">ntp-keygen (ntp) - Create a NTP host key - Ver. 4.2.8p10 12492b15cb3dSCy SchubertUsage: ntp-keygen [ -<flag> [<val>] | --<name>[{=| }<val>] ]... 12502b15cb3dSCy Schubert Flg Arg Option-Name Description 12512b15cb3dSCy Schubert -b Num imbits identity modulus bits 12522b15cb3dSCy Schubert - it must be in the range: 12532b15cb3dSCy Schubert 256 to 2048 12542b15cb3dSCy Schubert -c Str certificate certificate scheme 12552b15cb3dSCy Schubert -C Str cipher privatekey cipher 12562b15cb3dSCy Schubert -d no debug-level Increase debug verbosity level 12572b15cb3dSCy Schubert - may appear multiple times 12582b15cb3dSCy Schubert -D Num set-debug-level Set the debug verbosity level 12592b15cb3dSCy Schubert - may appear multiple times 12602b15cb3dSCy Schubert -e no id-key Write IFF or GQ identity keys 12612b15cb3dSCy Schubert -G no gq-params Generate GQ parameters and keys 12622b15cb3dSCy Schubert -H no host-key generate RSA host key 12632b15cb3dSCy Schubert -I no iffkey generate IFF parameters 12642b15cb3dSCy Schubert -i Str ident set Autokey group name 12652b15cb3dSCy Schubert -l Num lifetime set certificate lifetime 1266*09100258SXin LI -m Num modulus prime modulus 12672b15cb3dSCy Schubert - it must be in the range: 12682b15cb3dSCy Schubert 256 to 2048 1269*09100258SXin LI -M no md5key generate symmetric keys 12702b15cb3dSCy Schubert -P no pvt-cert generate PC private certificate 12712b15cb3dSCy Schubert -p Str password local private password 12722b15cb3dSCy Schubert -q Str export-passwd export IFF or GQ group keys with password 12732b15cb3dSCy Schubert -s Str subject-name set host and optionally group name 1274*09100258SXin LI -S Str sign-key generate sign key (RSA or DSA) 12752b15cb3dSCy Schubert -T no trusted-cert trusted certificate (TC scheme) 12762b15cb3dSCy Schubert -V Num mv-params generate <num> MV parameters 12772b15cb3dSCy Schubert -v Num mv-keys update <num> MV keys 12782b15cb3dSCy Schubert opt version output version information and exit 12792b15cb3dSCy Schubert -? no help display extended usage information and exit 12802b15cb3dSCy Schubert -! no more-help extended usage information passed thru pager 12812b15cb3dSCy Schubert -> opt save-opts save the option state to a config file 12822b15cb3dSCy Schubert -< Str load-opts load options from a config file 12832b15cb3dSCy Schubert - disabled as '--no-load-opts' 12842b15cb3dSCy Schubert - may appear multiple times 12852b15cb3dSCy Schubert 12862b15cb3dSCy SchubertOptions are specified by doubled hyphens and their name or by a single 12872b15cb3dSCy Schuberthyphen and the flag character. 12882b15cb3dSCy Schubert 12892b15cb3dSCy Schubert 12902b15cb3dSCy SchubertThe following option preset mechanisms are supported: 12912b15cb3dSCy Schubert - reading file $HOME/.ntprc 12922b15cb3dSCy Schubert - reading file ./.ntprc 12932b15cb3dSCy Schubert - examining environment variables named NTP_KEYGEN_* 12942b15cb3dSCy Schubert 12952b15cb3dSCy SchubertPlease send bug reports to: <http://bugs.ntp.org, bugs@ntp.org> 12962b15cb3dSCy Schubert</pre> 12972b15cb3dSCy Schubert <div class="node"> 12982b15cb3dSCy Schubert<p><hr> 12992b15cb3dSCy Schubert<a name="ntp_002dkeygen-imbits"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-certificate">ntp-keygen certificate</a>, 13002b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-usage">ntp-keygen usage</a>, 13012b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 13022b15cb3dSCy Schubert<br> 13032b15cb3dSCy Schubert</div> 13042b15cb3dSCy Schubert 13052b15cb3dSCy Schubert<h4 class="subsection">imbits option (-b)</h4> 13062b15cb3dSCy Schubert 13072b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002dimbits-4"></a> 13082b15cb3dSCy SchubertThis is the “identity modulus bits” option. 13092b15cb3dSCy SchubertThis option takes a number argument <span class="file">imbits</span>. 13102b15cb3dSCy Schubert 13112b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 13122b15cb3dSCy Schubert <ul> 13132b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 13142b15cb3dSCy Schubert</ul> 13152b15cb3dSCy Schubert 13162b15cb3dSCy Schubert <p>The number of bits in the identity modulus. The default is 256. 13172b15cb3dSCy Schubert<div class="node"> 13182b15cb3dSCy Schubert<p><hr> 13192b15cb3dSCy Schubert<a name="ntp_002dkeygen-certificate"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-cipher">ntp-keygen cipher</a>, 13202b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-imbits">ntp-keygen imbits</a>, 13212b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 13222b15cb3dSCy Schubert<br> 13232b15cb3dSCy Schubert</div> 13242b15cb3dSCy Schubert 13252b15cb3dSCy Schubert<h4 class="subsection">certificate option (-c)</h4> 13262b15cb3dSCy Schubert 13272b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002dcertificate-5"></a> 13282b15cb3dSCy SchubertThis is the “certificate scheme” option. 13292b15cb3dSCy SchubertThis option takes a string argument <span class="file">scheme</span>. 13302b15cb3dSCy Schubert 13312b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 13322b15cb3dSCy Schubert <ul> 13332b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 13342b15cb3dSCy Schubert</ul> 13352b15cb3dSCy Schubert 13362b15cb3dSCy Schubert <p>scheme is one of 1337*09100258SXin LIRSA-MD2, RSA-MD5, RSA-MDC2, RSA-SHA, RSA-SHA1, RSA-RIPEMD160, 13382b15cb3dSCy SchubertDSA-SHA, or DSA-SHA1. 13392b15cb3dSCy Schubert 1340*09100258SXin LI <p>Select the certificate signature encryption/message digest scheme. 13412b15cb3dSCy SchubertNote that RSA schemes must be used with a RSA sign key and DSA 13422b15cb3dSCy Schubertschemes must be used with a DSA sign key. The default without 13432b15cb3dSCy Schubertthis option is RSA-MD5. 13442b15cb3dSCy Schubert<div class="node"> 13452b15cb3dSCy Schubert<p><hr> 13462b15cb3dSCy Schubert<a name="ntp_002dkeygen-cipher"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-id_002dkey">ntp-keygen id-key</a>, 13472b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-certificate">ntp-keygen certificate</a>, 13482b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 13492b15cb3dSCy Schubert<br> 13502b15cb3dSCy Schubert</div> 13512b15cb3dSCy Schubert 13522b15cb3dSCy Schubert<h4 class="subsection">cipher option (-C)</h4> 13532b15cb3dSCy Schubert 13542b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002dcipher-6"></a> 13552b15cb3dSCy SchubertThis is the “privatekey cipher” option. 13562b15cb3dSCy SchubertThis option takes a string argument <span class="file">cipher</span>. 13572b15cb3dSCy Schubert 13582b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 13592b15cb3dSCy Schubert <ul> 13602b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 13612b15cb3dSCy Schubert</ul> 13622b15cb3dSCy Schubert 13632b15cb3dSCy Schubert <p>Select the cipher which is used to encrypt the files containing 13642b15cb3dSCy Schubertprivate keys. The default is three-key triple DES in CBC mode, 1365*09100258SXin LIequivalent to "<code>-C des-ede3-cbc</code>". The openssl tool lists ciphers 1366*09100258SXin LIavailable in "<code>openssl -h</code>" output. 1367*09100258SXin LI<div class="node"> 13682b15cb3dSCy Schubert<p><hr> 13692b15cb3dSCy Schubert<a name="ntp_002dkeygen-id_002dkey"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-gq_002dparams">ntp-keygen gq-params</a>, 13702b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-cipher">ntp-keygen cipher</a>, 13712b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 13722b15cb3dSCy Schubert<br> 13732b15cb3dSCy Schubert</div> 13742b15cb3dSCy Schubert 13752b15cb3dSCy Schubert<h4 class="subsection">id-key option (-e)</h4> 13762b15cb3dSCy Schubert 13772b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002did_002dkey-7"></a> 13782b15cb3dSCy SchubertThis is the “write iff or gq identity keys” option. 13792b15cb3dSCy Schubert 13802b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 13812b15cb3dSCy Schubert <ul> 13822b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 13832b15cb3dSCy Schubert</ul> 13842b15cb3dSCy Schubert 1385*09100258SXin LI <p>Write the public parameters from the IFF or GQ client keys to 1386*09100258SXin LIthe standard output. 1387*09100258SXin LIThis is intended for automatic key distribution by email. 13882b15cb3dSCy Schubert<div class="node"> 13892b15cb3dSCy Schubert<p><hr> 13902b15cb3dSCy Schubert<a name="ntp_002dkeygen-gq_002dparams"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-host_002dkey">ntp-keygen host-key</a>, 13912b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-id_002dkey">ntp-keygen id-key</a>, 13922b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 13932b15cb3dSCy Schubert<br> 13942b15cb3dSCy Schubert</div> 13952b15cb3dSCy Schubert 13962b15cb3dSCy Schubert<h4 class="subsection">gq-params option (-G)</h4> 13972b15cb3dSCy Schubert 13982b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002dgq_002dparams-8"></a> 13992b15cb3dSCy SchubertThis is the “generate gq parameters and keys” option. 14002b15cb3dSCy Schubert 14012b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 14022b15cb3dSCy Schubert <ul> 14032b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 14042b15cb3dSCy Schubert</ul> 14052b15cb3dSCy Schubert 14062b15cb3dSCy Schubert <p>Generate parameters and keys for the GQ identification scheme, 14072b15cb3dSCy Schubertobsoleting any that may exist. 14082b15cb3dSCy Schubert<div class="node"> 14092b15cb3dSCy Schubert<p><hr> 14102b15cb3dSCy Schubert<a name="ntp_002dkeygen-host_002dkey"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-iffkey">ntp-keygen iffkey</a>, 14112b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-gq_002dparams">ntp-keygen gq-params</a>, 14122b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 14132b15cb3dSCy Schubert<br> 14142b15cb3dSCy Schubert</div> 14152b15cb3dSCy Schubert 14162b15cb3dSCy Schubert<h4 class="subsection">host-key option (-H)</h4> 14172b15cb3dSCy Schubert 14182b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002dhost_002dkey-9"></a> 14192b15cb3dSCy SchubertThis is the “generate rsa host key” option. 14202b15cb3dSCy Schubert 14212b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 14222b15cb3dSCy Schubert <ul> 14232b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 14242b15cb3dSCy Schubert</ul> 14252b15cb3dSCy Schubert 14262b15cb3dSCy Schubert <p>Generate new host keys, obsoleting any that may exist. 14272b15cb3dSCy Schubert<div class="node"> 14282b15cb3dSCy Schubert<p><hr> 14292b15cb3dSCy Schubert<a name="ntp_002dkeygen-iffkey"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-ident">ntp-keygen ident</a>, 14302b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-host_002dkey">ntp-keygen host-key</a>, 14312b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 14322b15cb3dSCy Schubert<br> 14332b15cb3dSCy Schubert</div> 14342b15cb3dSCy Schubert 14352b15cb3dSCy Schubert<h4 class="subsection">iffkey option (-I)</h4> 14362b15cb3dSCy Schubert 14372b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002diffkey-10"></a> 14382b15cb3dSCy SchubertThis is the “generate iff parameters” option. 14392b15cb3dSCy Schubert 14402b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 14412b15cb3dSCy Schubert <ul> 14422b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 14432b15cb3dSCy Schubert</ul> 14442b15cb3dSCy Schubert 14452b15cb3dSCy Schubert <p>Generate parameters for the IFF identification scheme, obsoleting 14462b15cb3dSCy Schubertany that may exist. 14472b15cb3dSCy Schubert<div class="node"> 14482b15cb3dSCy Schubert<p><hr> 14492b15cb3dSCy Schubert<a name="ntp_002dkeygen-ident"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-lifetime">ntp-keygen lifetime</a>, 14502b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-iffkey">ntp-keygen iffkey</a>, 14512b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 14522b15cb3dSCy Schubert<br> 14532b15cb3dSCy Schubert</div> 14542b15cb3dSCy Schubert 14552b15cb3dSCy Schubert<h4 class="subsection">ident option (-i)</h4> 14562b15cb3dSCy Schubert 14572b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002dident-11"></a> 14582b15cb3dSCy SchubertThis is the “set autokey group name” option. 14592b15cb3dSCy SchubertThis option takes a string argument <span class="file">group</span>. 14602b15cb3dSCy Schubert 14612b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 14622b15cb3dSCy Schubert <ul> 14632b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 14642b15cb3dSCy Schubert</ul> 14652b15cb3dSCy Schubert 14662b15cb3dSCy Schubert <p>Set the optional Autokey group name to name. This is used in 14672b15cb3dSCy Schubertthe file name of IFF, GQ, and MV client parameters files. In 14682b15cb3dSCy Schubertthat role, the default is the host name if this option is not 14692b15cb3dSCy Schubertprovided. The group name, if specified using <code>-i/--ident</code> or 1470*09100258SXin LIusing <code>-s/--subject-name</code> following an '<code>@</code>' character, 1471*09100258SXin LIis also a part of the self-signed host certificate subject and 1472*09100258SXin LIissuer names in the form <code>host@group</code> and should match the 1473*09100258SXin LI'<code>crypto ident</code>' or '<code>server ident</code>' configuration in the 1474*09100258SXin LI<code>ntpd</code> configuration file. 1475*09100258SXin LI<div class="node"> 14762b15cb3dSCy Schubert<p><hr> 1477*09100258SXin LI<a name="ntp_002dkeygen-lifetime"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-modulus">ntp-keygen modulus</a>, 14782b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-ident">ntp-keygen ident</a>, 14792b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 14802b15cb3dSCy Schubert<br> 14812b15cb3dSCy Schubert</div> 14822b15cb3dSCy Schubert 14832b15cb3dSCy Schubert<h4 class="subsection">lifetime option (-l)</h4> 14842b15cb3dSCy Schubert 14852b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002dlifetime-12"></a> 1486*09100258SXin LIThis is the “set certificate lifetime” option. 14872b15cb3dSCy SchubertThis option takes a number argument <span class="file">lifetime</span>. 14882b15cb3dSCy Schubert 14892b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 14902b15cb3dSCy Schubert <ul> 14912b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 14922b15cb3dSCy Schubert</ul> 14932b15cb3dSCy Schubert 14942b15cb3dSCy Schubert <p>Set the certificate expiration to lifetime days from now. 14952b15cb3dSCy Schubert<div class="node"> 14962b15cb3dSCy Schubert<p><hr> 1497*09100258SXin LI<a name="ntp_002dkeygen-modulus"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-md5key">ntp-keygen md5key</a>, 14982b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-lifetime">ntp-keygen lifetime</a>, 14992b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 15002b15cb3dSCy Schubert<br> 15012b15cb3dSCy Schubert</div> 15022b15cb3dSCy Schubert 15032b15cb3dSCy Schubert<h4 class="subsection">modulus option (-m)</h4> 15042b15cb3dSCy Schubert 1505*09100258SXin LI<p><a name="index-ntp_002dkeygen_002dmodulus-13"></a> 1506*09100258SXin LIThis is the “prime modulus” option. 15072b15cb3dSCy SchubertThis option takes a number argument <span class="file">modulus</span>. 15082b15cb3dSCy Schubert 15092b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 15102b15cb3dSCy Schubert <ul> 15112b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 15122b15cb3dSCy Schubert</ul> 15132b15cb3dSCy Schubert 15142b15cb3dSCy Schubert <p>The number of bits in the prime modulus. The default is 512. 15152b15cb3dSCy Schubert<div class="node"> 15162b15cb3dSCy Schubert<p><hr> 1517*09100258SXin LI<a name="ntp_002dkeygen-md5key"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-pvt_002dcert">ntp-keygen pvt-cert</a>, 15182b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-modulus">ntp-keygen modulus</a>, 15192b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 15202b15cb3dSCy Schubert<br> 15212b15cb3dSCy Schubert</div> 15222b15cb3dSCy Schubert 1523*09100258SXin LI<h4 class="subsection">md5key option (-M)</h4> 1524*09100258SXin LI 1525*09100258SXin LI<p><a name="index-ntp_002dkeygen_002dmd5key-14"></a> 1526*09100258SXin LIThis is the “generate symmetric keys” option. 1527*09100258SXin LIGenerate symmetric keys, obsoleting any that may exist. 1528*09100258SXin LI<div class="node"> 1529*09100258SXin LI<p><hr> 1530*09100258SXin LI<a name="ntp_002dkeygen-pvt_002dcert"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-password">ntp-keygen password</a>, 1531*09100258SXin LIPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-md5key">ntp-keygen md5key</a>, 1532*09100258SXin LIUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 1533*09100258SXin LI<br> 1534*09100258SXin LI</div> 1535*09100258SXin LI 15362b15cb3dSCy Schubert<h4 class="subsection">pvt-cert option (-P)</h4> 15372b15cb3dSCy Schubert 15382b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002dpvt_002dcert-15"></a> 1539*09100258SXin LIThis is the “generate pc private certificate” option. 15402b15cb3dSCy Schubert 15412b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 15422b15cb3dSCy Schubert <ul> 15432b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 15442b15cb3dSCy Schubert</ul> 15452b15cb3dSCy Schubert 15462b15cb3dSCy Schubert <p>Generate a private certificate. By default, the program generates 15472b15cb3dSCy Schubertpublic certificates. 15482b15cb3dSCy Schubert<div class="node"> 15492b15cb3dSCy Schubert<p><hr> 15502b15cb3dSCy Schubert<a name="ntp_002dkeygen-password"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-export_002dpasswd">ntp-keygen export-passwd</a>, 15512b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-pvt_002dcert">ntp-keygen pvt-cert</a>, 15522b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 15532b15cb3dSCy Schubert<br> 15542b15cb3dSCy Schubert</div> 15552b15cb3dSCy Schubert 15562b15cb3dSCy Schubert<h4 class="subsection">password option (-p)</h4> 15572b15cb3dSCy Schubert 15582b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002dpassword-16"></a> 1559*09100258SXin LIThis is the “local private password” option. 15602b15cb3dSCy SchubertThis option takes a string argument <span class="file">passwd</span>. 15612b15cb3dSCy Schubert 15622b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 15632b15cb3dSCy Schubert <ul> 15642b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 15652b15cb3dSCy Schubert</ul> 15662b15cb3dSCy Schubert 15672b15cb3dSCy Schubert <p>Local files containing private data are encrypted with the 15682b15cb3dSCy SchubertDES-CBC algorithm and the specified password. The same password 15692b15cb3dSCy Schubertmust be specified to the local ntpd via the "crypto pw password" 15702b15cb3dSCy Schubertconfiguration command. The default password is the local 15712b15cb3dSCy Schuberthostname. 15722b15cb3dSCy Schubert<div class="node"> 15732b15cb3dSCy Schubert<p><hr> 1574*09100258SXin LI<a name="ntp_002dkeygen-export_002dpasswd"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-subject_002dname">ntp-keygen subject-name</a>, 15752b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-password">ntp-keygen password</a>, 15762b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 15772b15cb3dSCy Schubert<br> 15782b15cb3dSCy Schubert</div> 15792b15cb3dSCy Schubert 15802b15cb3dSCy Schubert<h4 class="subsection">export-passwd option (-q)</h4> 15812b15cb3dSCy Schubert 15822b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002dexport_002dpasswd-17"></a> 1583*09100258SXin LIThis is the “export iff or gq group keys with password” option. 15842b15cb3dSCy SchubertThis option takes a string argument <span class="file">passwd</span>. 15852b15cb3dSCy Schubert 15862b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 15872b15cb3dSCy Schubert <ul> 15882b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 15892b15cb3dSCy Schubert</ul> 15902b15cb3dSCy Schubert 15912b15cb3dSCy Schubert <p>Export IFF or GQ identity group keys to the standard output, 15922b15cb3dSCy Schubertencrypted with the DES-CBC algorithm and the specified password. 15932b15cb3dSCy SchubertThe same password must be specified to the remote ntpd via the 15942b15cb3dSCy Schubert"crypto pw password" configuration command. See also the option 1595*09100258SXin LI–id-key (-e) for unencrypted exports. 15962b15cb3dSCy Schubert<div class="node"> 15972b15cb3dSCy Schubert<p><hr> 1598*09100258SXin LI<a name="ntp_002dkeygen-subject_002dname"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-sign_002dkey">ntp-keygen sign-key</a>, 15992b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-export_002dpasswd">ntp-keygen export-passwd</a>, 16002b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 16012b15cb3dSCy Schubert<br> 16022b15cb3dSCy Schubert</div> 16032b15cb3dSCy Schubert 1604*09100258SXin LI<h4 class="subsection">subject-name option (-s)</h4> 1605*09100258SXin LI 1606*09100258SXin LI<p><a name="index-ntp_002dkeygen_002dsubject_002dname-18"></a> 1607*09100258SXin LIThis is the “set host and optionally group name” option. 1608*09100258SXin LIThis option takes a string argument <span class="file">host@group</span>. 1609*09100258SXin LI 1610*09100258SXin LI<p class="noindent">This option has some usage constraints. It: 1611*09100258SXin LI <ul> 1612*09100258SXin LI<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 1613*09100258SXin LI</ul> 1614*09100258SXin LI 1615*09100258SXin LI <p>Set the Autokey host name, and optionally, group name specified 1616*09100258SXin LIfollowing an '<code>@</code>' character. The host name is used in the file 1617*09100258SXin LIname of generated host and signing certificates, without the 1618*09100258SXin LIgroup name. The host name, and if provided, group name are used 1619*09100258SXin LIin <code>host@group</code> form for the host certificate subject and issuer 1620*09100258SXin LIfields. Specifying '<code>-s @group</code>' is allowed, and results in 1621*09100258SXin LIleaving the host name unchanged while appending <code>@group</code> to the 1622*09100258SXin LIsubject and issuer fields, as with <code>-i group</code>. The group name, or 1623*09100258SXin LIif not provided, the host name are also used in the file names 1624*09100258SXin LIof IFF, GQ, and MV client parameter files. 1625*09100258SXin LI<div class="node"> 1626*09100258SXin LI<p><hr> 1627*09100258SXin LI<a name="ntp_002dkeygen-sign_002dkey"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-trusted_002dcert">ntp-keygen trusted-cert</a>, 1628*09100258SXin LIPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-subject_002dname">ntp-keygen subject-name</a>, 1629*09100258SXin LIUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 1630*09100258SXin LI<br> 1631*09100258SXin LI</div> 1632*09100258SXin LI 16332b15cb3dSCy Schubert<h4 class="subsection">sign-key option (-S)</h4> 16342b15cb3dSCy Schubert 1635*09100258SXin LI<p><a name="index-ntp_002dkeygen_002dsign_002dkey-19"></a> 1636*09100258SXin LIThis is the “generate sign key (rsa or dsa)” option. 16372b15cb3dSCy SchubertThis option takes a string argument <span class="file">sign</span>. 16382b15cb3dSCy Schubert 16392b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 16402b15cb3dSCy Schubert <ul> 16412b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 16422b15cb3dSCy Schubert</ul> 16432b15cb3dSCy Schubert 16442b15cb3dSCy Schubert <p>Generate a new sign key of the designated type, obsoleting any 16452b15cb3dSCy Schubertthat may exist. By default, the program uses the host key as the 16462b15cb3dSCy Schubertsign key. 16472b15cb3dSCy Schubert<div class="node"> 16482b15cb3dSCy Schubert<p><hr> 16492b15cb3dSCy Schubert<a name="ntp_002dkeygen-trusted_002dcert"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-mv_002dparams">ntp-keygen mv-params</a>, 1650*09100258SXin LIPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-sign_002dkey">ntp-keygen sign-key</a>, 16512b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 16522b15cb3dSCy Schubert<br> 16532b15cb3dSCy Schubert</div> 16542b15cb3dSCy Schubert 16552b15cb3dSCy Schubert<h4 class="subsection">trusted-cert option (-T)</h4> 16562b15cb3dSCy Schubert 16572b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002dtrusted_002dcert-20"></a> 1658*09100258SXin LIThis is the “trusted certificate (tc scheme)” option. 16592b15cb3dSCy Schubert 16602b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 16612b15cb3dSCy Schubert <ul> 16622b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 16632b15cb3dSCy Schubert</ul> 16642b15cb3dSCy Schubert 16652b15cb3dSCy Schubert <p>Generate a trusted certificate. By default, the program generates 16662b15cb3dSCy Schuberta non-trusted certificate. 16672b15cb3dSCy Schubert<div class="node"> 16682b15cb3dSCy Schubert<p><hr> 16692b15cb3dSCy Schubert<a name="ntp_002dkeygen-mv_002dparams"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-mv_002dkeys">ntp-keygen mv-keys</a>, 16702b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-trusted_002dcert">ntp-keygen trusted-cert</a>, 16712b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 16722b15cb3dSCy Schubert<br> 16732b15cb3dSCy Schubert</div> 16742b15cb3dSCy Schubert 16752b15cb3dSCy Schubert<h4 class="subsection">mv-params option (-V)</h4> 16762b15cb3dSCy Schubert 16772b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002dmv_002dparams-21"></a> 1678*09100258SXin LIThis is the “generate <num> mv parameters” option. 16792b15cb3dSCy SchubertThis option takes a number argument <span class="file">num</span>. 16802b15cb3dSCy Schubert 16812b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 16822b15cb3dSCy Schubert <ul> 16832b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 16842b15cb3dSCy Schubert</ul> 16852b15cb3dSCy Schubert 16862b15cb3dSCy Schubert <p>Generate parameters and keys for the Mu-Varadharajan (MV) 16872b15cb3dSCy Schubertidentification scheme. 16882b15cb3dSCy Schubert<div class="node"> 16892b15cb3dSCy Schubert<p><hr> 16902b15cb3dSCy Schubert<a name="ntp_002dkeygen-mv_002dkeys"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-config">ntp-keygen config</a>, 16912b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-mv_002dparams">ntp-keygen mv-params</a>, 16922b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 16932b15cb3dSCy Schubert<br> 16942b15cb3dSCy Schubert</div> 16952b15cb3dSCy Schubert 16962b15cb3dSCy Schubert<h4 class="subsection">mv-keys option (-v)</h4> 16972b15cb3dSCy Schubert 16982b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002dmv_002dkeys-22"></a> 1699*09100258SXin LIThis is the “update <num> mv keys” option. 17002b15cb3dSCy SchubertThis option takes a number argument <span class="file">num</span>. 17012b15cb3dSCy Schubert 17022b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 17032b15cb3dSCy Schubert <ul> 17042b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 17052b15cb3dSCy Schubert</ul> 17062b15cb3dSCy Schubert 17072b15cb3dSCy Schubert <p>This option has no <span class="samp">doc</span> documentation. 17082b15cb3dSCy Schubert 17092b15cb3dSCy Schubert<div class="node"> 17102b15cb3dSCy Schubert<p><hr> 17112b15cb3dSCy Schubert<a name="ntp_002dkeygen-config"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-exit-status">ntp-keygen exit status</a>, 17122b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-mv_002dkeys">ntp-keygen mv-keys</a>, 17132b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 17142b15cb3dSCy Schubert<br> 17152b15cb3dSCy Schubert</div> 17162b15cb3dSCy Schubert 17172b15cb3dSCy Schubert<h4 class="subsection">presetting/configuring ntp-keygen</h4> 17182b15cb3dSCy Schubert 17192b15cb3dSCy Schubert<p>Any option that is not marked as <i>not presettable</i> may be preset by 17202b15cb3dSCy Schubertloading values from configuration ("rc" or "ini") files, and values from environment variables named <code>NTP-KEYGEN</code> and <code>NTP-KEYGEN_<OPTION_NAME></code>. <code><OPTION_NAME></code> must be one of 17212b15cb3dSCy Schubertthe options listed above in upper case and segmented with underscores. 17222b15cb3dSCy SchubertThe <code>NTP-KEYGEN</code> variable will be tokenized and parsed like 17232b15cb3dSCy Schubertthe command line. The remaining variables are tested for existence and their 17242b15cb3dSCy Schubertvalues are treated like option arguments. 17252b15cb3dSCy Schubert 17262b15cb3dSCy Schubert<p class="noindent"><code>libopts</code> will search in 2 places for configuration files: 17272b15cb3dSCy Schubert <ul> 17282b15cb3dSCy Schubert<li>$HOME 17292b15cb3dSCy Schubert<li>$PWD 17302b15cb3dSCy Schubert</ul> 17312b15cb3dSCy Schubert The environment variables <code>HOME</code>, and <code>PWD</code> 17322b15cb3dSCy Schubertare expanded and replaced when <span class="file">ntp-keygen</span> runs. 17332b15cb3dSCy SchubertFor any of these that are plain files, they are simply processed. 17342b15cb3dSCy SchubertFor any that are directories, then a file named <span class="file">.ntprc</span> is searched for 17352b15cb3dSCy Schubertwithin that directory and processed. 17362b15cb3dSCy Schubert 17372b15cb3dSCy Schubert <p>Configuration files may be in a wide variety of formats. 17382b15cb3dSCy SchubertThe basic format is an option name followed by a value (argument) on the 17392b15cb3dSCy Schubertsame line. Values may be separated from the option name with a colon, 17402b15cb3dSCy Schubertequal sign or simply white space. Values may be continued across multiple 17412b15cb3dSCy Schubertlines by escaping the newline with a backslash. 17422b15cb3dSCy Schubert 17432b15cb3dSCy Schubert <p>Multiple programs may also share the same initialization file. 17442b15cb3dSCy SchubertCommon options are collected at the top, followed by program specific 17452b15cb3dSCy Schubertsegments. The segments are separated by lines like: 17462b15cb3dSCy Schubert<pre class="example"> [NTP-KEYGEN] 17472b15cb3dSCy Schubert</pre> 17482b15cb3dSCy Schubert <p class="noindent">or by 17492b15cb3dSCy Schubert<pre class="example"> <?program ntp-keygen> 17502b15cb3dSCy Schubert</pre> 17512b15cb3dSCy Schubert <p class="noindent">Do not mix these styles within one configuration file. 17522b15cb3dSCy Schubert 17532b15cb3dSCy Schubert <p>Compound values and carefully constructed string values may also be 17542b15cb3dSCy Schubertspecified using XML syntax: 17552b15cb3dSCy Schubert<pre class="example"> <option-name> 17562b15cb3dSCy Schubert <sub-opt>...&lt;...&gt;...</sub-opt> 17572b15cb3dSCy Schubert </option-name> 17582b15cb3dSCy Schubert</pre> 17592b15cb3dSCy Schubert <p class="noindent">yielding an <code>option-name.sub-opt</code> string value of 17602b15cb3dSCy Schubert<pre class="example"> "...<...>..." 17612b15cb3dSCy Schubert</pre> 17622b15cb3dSCy Schubert <p><code>AutoOpts</code> does not track suboptions. You simply note that it is a 17632b15cb3dSCy Schuberthierarchicly valued option. <code>AutoOpts</code> does provide a means for searching 17642b15cb3dSCy Schubertthe associated name/value pair list (see: optionFindValue). 17652b15cb3dSCy Schubert 17662b15cb3dSCy Schubert <p>The command line options relating to configuration and/or usage help are: 17672b15cb3dSCy Schubert 17682b15cb3dSCy Schubert<h5 class="subsubheading">version (-)</h5> 17692b15cb3dSCy Schubert 17702b15cb3dSCy Schubert<p>Print the program version to standard out, optionally with licensing 17712b15cb3dSCy Schubertinformation, then exit 0. The optional argument specifies how much licensing 17722b15cb3dSCy Schubertdetail to provide. The default is to print just the version. The licensing infomation may be selected with an option argument. 17732b15cb3dSCy SchubertOnly the first letter of the argument is examined: 17742b15cb3dSCy Schubert 17752b15cb3dSCy Schubert <dl> 17762b15cb3dSCy Schubert<dt><span class="samp">version</span><dd>Only print the version. This is the default. 17772b15cb3dSCy Schubert<br><dt><span class="samp">copyright</span><dd>Name the copyright usage licensing terms. 17782b15cb3dSCy Schubert<br><dt><span class="samp">verbose</span><dd>Print the full copyright usage licensing terms. 17792b15cb3dSCy Schubert</dl> 17802b15cb3dSCy Schubert 17812b15cb3dSCy Schubert<div class="node"> 17822b15cb3dSCy Schubert<p><hr> 17832b15cb3dSCy Schubert<a name="ntp_002dkeygen-exit-status"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-Usage">ntp-keygen Usage</a>, 17842b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-config">ntp-keygen config</a>, 17852b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 17862b15cb3dSCy Schubert<br> 17872b15cb3dSCy Schubert</div> 17882b15cb3dSCy Schubert 17892b15cb3dSCy Schubert<h4 class="subsection">ntp-keygen exit status</h4> 17902b15cb3dSCy Schubert 17912b15cb3dSCy Schubert<p>One of the following exit values will be returned: 17922b15cb3dSCy Schubert <dl> 17932b15cb3dSCy Schubert<dt><span class="samp">0 (EXIT_SUCCESS)</span><dd>Successful program execution. 17942b15cb3dSCy Schubert<br><dt><span class="samp">1 (EXIT_FAILURE)</span><dd>The operation failed or the command syntax was not valid. 17952b15cb3dSCy Schubert<br><dt><span class="samp">66 (EX_NOINPUT)</span><dd>A specified configuration file could not be loaded. 17962b15cb3dSCy Schubert<br><dt><span class="samp">70 (EX_SOFTWARE)</span><dd>libopts had an internal operational error. Please report 17972b15cb3dSCy Schubertit to autogen-users@lists.sourceforge.net. Thank you. 17982b15cb3dSCy Schubert</dl> 17992b15cb3dSCy Schubert <div class="node"> 18002b15cb3dSCy Schubert<p><hr> 18012b15cb3dSCy Schubert<a name="ntp_002dkeygen-Usage"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-Notes">ntp-keygen Notes</a>, 18022b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-exit-status">ntp-keygen exit status</a>, 18032b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 18042b15cb3dSCy Schubert<br> 18052b15cb3dSCy Schubert</div> 18062b15cb3dSCy Schubert 18072b15cb3dSCy Schubert<h4 class="subsection">ntp-keygen Usage</h4> 18082b15cb3dSCy Schubert 18092b15cb3dSCy Schubert<div class="node"> 18102b15cb3dSCy Schubert<p><hr> 18112b15cb3dSCy Schubert<a name="ntp_002dkeygen-Notes"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-Bugs">ntp-keygen Bugs</a>, 18122b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-Usage">ntp-keygen Usage</a>, 18132b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 18142b15cb3dSCy Schubert<br> 18152b15cb3dSCy Schubert</div> 18162b15cb3dSCy Schubert 18172b15cb3dSCy Schubert<h4 class="subsection">ntp-keygen Notes</h4> 18182b15cb3dSCy Schubert 18192b15cb3dSCy Schubert<div class="node"> 18202b15cb3dSCy Schubert<p><hr> 18212b15cb3dSCy Schubert<a name="ntp_002dkeygen-Bugs"></a>Previous: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-Notes">ntp-keygen Notes</a>, 18222b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 18232b15cb3dSCy Schubert<br> 18242b15cb3dSCy Schubert</div> 18252b15cb3dSCy Schubert 18262b15cb3dSCy Schubert<h4 class="subsection">ntp-keygen Bugs</h4> 18272b15cb3dSCy Schubert 18282b15cb3dSCy Schubert<div class="node"> 18292b15cb3dSCy Schubert<p><hr> 18302b15cb3dSCy Schubert<a name="Random-Seed-File"></a>Next: <a rel="next" accesskey="n" href="#Cryptographic-Data-Files">Cryptographic Data Files</a>, 18312b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#Running-the-Program">Running the Program</a>, 18322b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#Top">Top</a> 18332b15cb3dSCy Schubert<br> 18342b15cb3dSCy Schubert</div> 18352b15cb3dSCy Schubert 18362b15cb3dSCy Schubert<!-- node-name, next, previous, up --> 18372b15cb3dSCy Schubert<h3 class="section">Random Seed File</h3> 18382b15cb3dSCy Schubert 18392b15cb3dSCy Schubert<p>All cryptographically sound key generation schemes must have means to 18402b15cb3dSCy Schubertrandomize the entropy seed used to initialize the internal 18412b15cb3dSCy Schubertpseudo-random number generator used by the OpenSSL library routines. 18422b15cb3dSCy SchubertIf a site supports ssh, it is very likely that means to do this are 18432b15cb3dSCy Schubertalready available. 18442b15cb3dSCy SchubertThe entropy seed used by the OpenSSL library is contained in a file, 18452b15cb3dSCy Schubertusually called <code>.rnd</code>, which must be available when 18462b15cb3dSCy Schubertstarting the <code>ntp-keygen</code> program or <code>ntpd</code> daemon. 18472b15cb3dSCy Schubert 18482b15cb3dSCy Schubert <p>The OpenSSL library looks for the file using the path specified by the 18492b15cb3dSCy Schubert<code>RANDFILE</code> environment variable in the user home directory, whether root 18502b15cb3dSCy Schubertor some other user. 18512b15cb3dSCy SchubertIf the <code>RANDFILE</code> environment variable is not 18522b15cb3dSCy Schubertpresent, the library looks for the <code>.rnd</code> file in the user home 18532b15cb3dSCy Schubertdirectory. 18542b15cb3dSCy SchubertSince both the <code>ntp-keygen</code> program and <code>ntpd</code> daemon must run 18552b15cb3dSCy Schubertas root, the logical place to put this file is in <code>/.rnd</code> or 18562b15cb3dSCy Schubert<code>/root/.rnd</code>. 18572b15cb3dSCy SchubertIf the file is not available or cannot be written, the program exits 18582b15cb3dSCy Schubertwith a message to the system log. 18592b15cb3dSCy Schubert 18602b15cb3dSCy Schubert<div class="node"> 18612b15cb3dSCy Schubert<p><hr> 18622b15cb3dSCy Schubert<a name="Cryptographic-Data-Files"></a>Previous: <a rel="previous" accesskey="p" href="#Random-Seed-File">Random Seed File</a>, 18632b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#Top">Top</a> 18642b15cb3dSCy Schubert<br> 18652b15cb3dSCy Schubert</div> 18662b15cb3dSCy Schubert 18672b15cb3dSCy Schubert<!-- node-name, next, previous, up --> 18682b15cb3dSCy Schubert<h3 class="section">Cryptographic Data Files</h3> 18692b15cb3dSCy Schubert 18702b15cb3dSCy Schubert<p>File and link names are in the <code>form ntpkey_key_name.fstamp</code>, 18712b15cb3dSCy Schubertwhere <code>key</code> is the key or parameter type, 18722b15cb3dSCy Schubert<code>name</code> is the host or group name and 18732b15cb3dSCy Schubert<code>fstamp</code> is the filestamp (NTP seconds) when the file was created). 18742b15cb3dSCy SchubertBy convention, key names in generated file names include both upper and 18752b15cb3dSCy Schubertlower case characters, while key names in generated link names include 18762b15cb3dSCy Schubertonly lower case characters. The filestamp is not used in generated link 18772b15cb3dSCy Schubertnames. 18782b15cb3dSCy Schubert 18792b15cb3dSCy Schubert <p>The key name is a string defining the cryptographic key type. 18802b15cb3dSCy SchubertKey types include public/private keys host and sign, certificate cert 18812b15cb3dSCy Schubertand several challenge/response key types. 18822b15cb3dSCy SchubertBy convention, client files used for 18832b15cb3dSCy Schubertchallenges have a par subtype, as in the IFF challenge IFFpar, while 18842b15cb3dSCy Schubertserver files for responses have a key subtype, as in the GQ response 18852b15cb3dSCy SchubertGQkey. 18862b15cb3dSCy Schubert 18872b15cb3dSCy Schubert <p>All files begin with two nonencrypted lines. The first line contains 18882b15cb3dSCy Schubertthe file name in the format <code>ntpkey_key_host.fstamp</code>. 18892b15cb3dSCy SchubertThe second line contains the datestamp in conventional Unix date format. 18902b15cb3dSCy SchubertLines beginning with <code>#</code> are ignored. 18912b15cb3dSCy Schubert 18922b15cb3dSCy Schubert <p>The remainder of the file contains cryptographic data encoded first 18932b15cb3dSCy Schubertusing ASN.1 rules, then encrypted using the DES-CBC algorithm with 18942b15cb3dSCy Schubertgiven password and finally written in PEM-encoded printable ASCII text 18952b15cb3dSCy Schubertpreceded and followed by MIME content identifier lines. 18962b15cb3dSCy Schubert 18972b15cb3dSCy Schubert <p>The format of the symmetric keys file, ordinarily named <code>ntp.keys</code>, 18982b15cb3dSCy Schubertis somewhat different than the other files in the interest of backward 18992b15cb3dSCy Schubertcompatibility. 19002b15cb3dSCy SchubertOrdinarily, the file is generated by this program, but 19012b15cb3dSCy Schubertit can be constructed and edited using an ordinary text editor. 19022b15cb3dSCy Schubert 19032b15cb3dSCy Schubert<pre class="example"> # ntpkey_MD5key_hms.local.3564038757 19042b15cb3dSCy Schubert # Sun Dec 9 02:45:57 2012 19052b15cb3dSCy Schubert 19062b15cb3dSCy Schubert 1 MD5 "]!ghT%O;3)WJ,/Nc:>I # MD5 key 19072b15cb3dSCy Schubert 2 MD5 lu+H^tF46BKR-6~pV_5 # MD5 key 19082b15cb3dSCy Schubert 3 MD5 :lnoVsE%Yz*avh%EtNC # MD5 key 19092b15cb3dSCy Schubert 4 MD5 |fdZrf0sF~^V # MD5 key 19102b15cb3dSCy Schubert 5 MD5 IyAG>O"y"LmCRS!*bHC # MD5 key 19112b15cb3dSCy Schubert 6 MD5 ">e\A # MD5 key 19122b15cb3dSCy Schubert 7 MD5 c9x=M'CfLxax9v)PV-si # MD5 key 19132b15cb3dSCy Schubert 8 MD5 E|=jvFVov?Bn|Ev=&aK\ # MD5 key 19142b15cb3dSCy Schubert 9 MD5 T!c4UT&`(m$+m+B6,`Q0 # MD5 key 19152b15cb3dSCy Schubert 10 MD5 JVF/1=)=IFbHbJQz..Cd # MD5 key 19162b15cb3dSCy Schubert 11 SHA1 6dea311109529e436c2b4fccae9bc753c16d1b48 # SHA1 key 19172b15cb3dSCy Schubert 12 SHA1 7076f373d86c4848c59ff8046e49cb7d614ec394 # SHA1 key 19182b15cb3dSCy Schubert 13 SHA1 5f48b1b60591eb01b7cf1d33b7774f08d20262d3 # SHA1 key 19192b15cb3dSCy Schubert 14 SHA1 eed5ab9d9497319ec60cf3781d52607e76720178 # SHA1 key 19202b15cb3dSCy Schubert 15 SHA1 f283562611a04c964da8126296f5f8e58c3f85de # SHA1 key 19212b15cb3dSCy Schubert 16 SHA1 1930da171297dd63549af50b29449de17dcf341f # SHA1 key 19222b15cb3dSCy Schubert 17 SHA1 fee892110358cd4382322b889869e750db8e8a8f # SHA1 key 19232b15cb3dSCy Schubert 18 SHA1 b5520c9fadd7ad3fd8bfa061c8821b65d029bb37 # SHA1 key 19242b15cb3dSCy Schubert 19 SHA1 8c74fb440ec80f453ec6aaa62b9baed0ab723b92 # SHA1 key 19252b15cb3dSCy Schubert 20 SHA1 6bc05f734306a189326000970c19b3910f403795 # SHA1 key 19262b15cb3dSCy Schubert</pre> 19272b15cb3dSCy Schubert <p>Figure 1. Typical Symmetric Key File 19282b15cb3dSCy Schubert 19292b15cb3dSCy Schubert <p>Figure 1 shows a typical symmetric keys file used by the reference 19302b15cb3dSCy Schubertimplementation. 19312b15cb3dSCy SchubertEach line of the file contains three fields, first an 19322b15cb3dSCy Schubertinteger between 1 and 65534, inclusive, representing the key identifier 19332b15cb3dSCy Schubertused in the server and peer configuration commands. 19342b15cb3dSCy SchubertNext is the key type for the message digest algorithm, 19352b15cb3dSCy Schubertwhich in the absence of the 19362b15cb3dSCy SchubertOpenSSL library must be MD5 to designate the MD5 message digest 19372b15cb3dSCy Schubertalgorithm. 19382b15cb3dSCy SchubertIf the OpenSSL library is installed, the key type can be any 19392b15cb3dSCy Schubertmessage digest algorithm supported by that library. 19402b15cb3dSCy SchubertHowever, if 19412b15cb3dSCy Schubertcompatibility with FIPS 140-2 is required, the key type must be either 19422b15cb3dSCy SchubertSHA or SHA1. 19432b15cb3dSCy SchubertThe key type can be changed using an ASCII text editor. 19442b15cb3dSCy Schubert 19452b15cb3dSCy Schubert <p>An MD5 key consists of a printable ASCII string less than or equal to 19462b15cb3dSCy Schubert16 characters and terminated by whitespace or a # character. 19472b15cb3dSCy SchubertAn OpenSSL 19482b15cb3dSCy Schubertkey consists of a hex-encoded ASCII string of 40 characters, which is 19492b15cb3dSCy Schuberttruncated as necessary. 19502b15cb3dSCy Schubert 19512b15cb3dSCy Schubert <p>Note that the keys used by the <code>ntpq</code> and <code>ntpdc</code> programs are 19522b15cb3dSCy Schubertchecked against passwords requested by the programs and entered by hand, 19532b15cb3dSCy Schubertso it 19542b15cb3dSCy Schubertis generally appropriate to specify these keys in human readable ASCII 19552b15cb3dSCy Schubertformat. 19562b15cb3dSCy Schubert 19572b15cb3dSCy Schubert <p>The <code>ntp-keygen</code> program generates a MD5 symmetric keys file 19582b15cb3dSCy Schubert<code>ntpkey_MD5key_hostname.filestamp</code>. 19592b15cb3dSCy SchubertSince the file contains private 19602b15cb3dSCy Schubertshared keys, it should be visible only to root and distributed by 19612b15cb3dSCy Schubertsecure means to other subnet hosts. 19622b15cb3dSCy SchubertThe NTP daemon loads the file <code>ntp.keys</code>, so <code>ntp-keygen</code> 19632b15cb3dSCy Schubertinstalls a soft link from this name to the generated file. 19642b15cb3dSCy SchubertSubsequently, similar soft links must be installed by 19652b15cb3dSCy Schubertmanual or automated means on the other subnet hosts. 19662b15cb3dSCy SchubertWhile this file is 19672b15cb3dSCy Schubertnot used with the Autokey Version 2 protocol, it is needed to 19682b15cb3dSCy Schubertauthenticate some remote configuration commands used by the <code>ntpq</code> and 19692b15cb3dSCy Schubert<code>ntpdc</code> utilities. 19702b15cb3dSCy Schubert 19712b15cb3dSCy Schubert</body></html> 19722b15cb3dSCy Schubert 1973