12b15cb3dSCy Schubert<html lang="en"> 22b15cb3dSCy Schubert<head> 32b15cb3dSCy Schubert<title>Ntp-keygen User's Manual</title> 42b15cb3dSCy Schubert<meta http-equiv="Content-Type" content="text/html"> 52b15cb3dSCy Schubert<meta name="description" content="Ntp-keygen User's Manual"> 62b15cb3dSCy Schubert<meta name="generator" content="makeinfo 4.7"> 72b15cb3dSCy Schubert<link title="Top" rel="top" href="#Top"> 82b15cb3dSCy Schubert<link href="http://www.gnu.org/software/texinfo/" rel="generator-home" title="Texinfo Homepage"> 92b15cb3dSCy Schubert<meta http-equiv="Content-Style-Type" content="text/css"> 102b15cb3dSCy Schubert<style type="text/css"><!-- 112b15cb3dSCy Schubert pre.display { font-family:inherit } 122b15cb3dSCy Schubert pre.format { font-family:inherit } 132b15cb3dSCy Schubert pre.smalldisplay { font-family:inherit; font-size:smaller } 142b15cb3dSCy Schubert pre.smallformat { font-family:inherit; font-size:smaller } 152b15cb3dSCy Schubert pre.smallexample { font-size:smaller } 162b15cb3dSCy Schubert pre.smalllisp { font-size:smaller } 172b15cb3dSCy Schubert span.sc { font-variant:small-caps } 182b15cb3dSCy Schubert span.roman { font-family: serif; font-weight: normal; } 192b15cb3dSCy Schubert--></style> 202b15cb3dSCy Schubert</head> 212b15cb3dSCy Schubert<body> 222b15cb3dSCy Schubert<h1 class="settitle">Ntp-keygen User's Manual</h1> 232b15cb3dSCy Schubert <div class="shortcontents"> 242b15cb3dSCy Schubert<h2>Short Contents</h2> 252b15cb3dSCy Schubert<ul> 262b15cb3dSCy Schubert<a href="#Top">Top</a> 272b15cb3dSCy Schubert<a href="#Top">NTP Key Generation Program User Manual</a> 282b15cb3dSCy Schubert</ul> 292b15cb3dSCy Schubert</div> 302b15cb3dSCy Schubert 312b15cb3dSCy Schubert 322b15cb3dSCy Schubert 332b15cb3dSCy Schubert<div class="node"> 342b15cb3dSCy Schubert<p><hr> 352b15cb3dSCy Schubert<a name="Top"></a>Up: <a rel="up" accesskey="u" href="#dir">(dir)</a> 362b15cb3dSCy Schubert<br> 372b15cb3dSCy Schubert</div> 382b15cb3dSCy Schubert 392b15cb3dSCy Schubert<h2 class="unnumbered">Top</h2> 402b15cb3dSCy Schubert 412b15cb3dSCy Schubert<ul class="menu"> 422b15cb3dSCy Schubert<li><a accesskey="1" href="#Description">Description</a> 432b15cb3dSCy Schubert<li><a accesskey="2" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a>: Invoking ntp-keygen 442b15cb3dSCy Schubert<li><a accesskey="3" href="#Running-the-Program">Running the Program</a> 452b15cb3dSCy Schubert<li><a accesskey="4" href="#Random-Seed-File">Random Seed File</a> 462b15cb3dSCy Schubert<li><a accesskey="5" href="#Cryptographic-Data-Files">Cryptographic Data Files</a> 472b15cb3dSCy Schubert</ul> 482b15cb3dSCy Schubert 492b15cb3dSCy Schubert<div class="node"> 502b15cb3dSCy Schubert<p><hr> 512b15cb3dSCy Schubert<a name="Top"></a>Next: <a rel="next" accesskey="n" href="#Description">Description</a>, 522b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#dir">(dir)</a>, 532b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#dir">(dir)</a> 542b15cb3dSCy Schubert<br> 552b15cb3dSCy Schubert</div> 562b15cb3dSCy Schubert 572b15cb3dSCy Schubert<h2 class="unnumbered">NTP Key Generation Program User Manual</h2> 582b15cb3dSCy Schubert 592b15cb3dSCy Schubert<p>This document describes the use of the NTP Project's <code>ntp-keygen</code> 602b15cb3dSCy Schubertprogram, that generates cryptographic data files used by the NTPv4 612b15cb3dSCy Schubertauthentication and identity schemes. 622b15cb3dSCy SchubertIt can generate message digest keys used in symmetric key cryptography and, 632b15cb3dSCy Schubertif the OpenSSL software 642b15cb3dSCy Schubertlibrary has been installed, it can generate host keys, sign keys, 652b15cb3dSCy Schubertcertificates, and identity keys and parameters used by the Autokey 662b15cb3dSCy Schubertpublic key cryptography. 672b15cb3dSCy SchubertThe message digest keys file is generated in a 682b15cb3dSCy Schubertformat compatible with NTPv3. 692b15cb3dSCy SchubertAll other files are in PEM-encoded 702b15cb3dSCy Schubertprintable ASCII format so they can be embedded as MIME attachments in 712b15cb3dSCy Schubertmail to other sites. 722b15cb3dSCy Schubert 73*4e1ef62aSXin LI <p>This document applies to version 4.2.8p12 of <code>ntp-keygen</code>. 742b15cb3dSCy Schubert 752b15cb3dSCy Schubert<div class="node"> 762b15cb3dSCy Schubert<p><hr> 772b15cb3dSCy Schubert<a name="Description"></a>Next: <a rel="next" accesskey="n" href="#Running-the-Program">Running the Program</a>, 782b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#Top">Top</a>, 792b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#Top">Top</a> 802b15cb3dSCy Schubert<br> 812b15cb3dSCy Schubert</div> 822b15cb3dSCy Schubert 832b15cb3dSCy Schubert<!-- node-name, next, previous, up --> 842b15cb3dSCy Schubert<h3 class="section">Description</h3> 852b15cb3dSCy Schubert 862b15cb3dSCy Schubert<p>This program generates cryptographic data files used by the NTPv4 872b15cb3dSCy Schubertauthentication and identity schemes. It can generate message digest 882b15cb3dSCy Schubertkeys used in symmetric key cryptography and, if the OpenSSL software 892b15cb3dSCy Schubertlibrary has been installed, it can generate host keys, sign keys, 902b15cb3dSCy Schubertcertificates, and identity keys and parameters used by the Autokey 912b15cb3dSCy Schubertpublic key cryptography. The message digest keys file is generated in a 922b15cb3dSCy Schubertformat compatible with NTPv3. All other files are in PEM-encoded 932b15cb3dSCy Schubertprintable ASCII format so they can be embedded as MIME attachments in 942b15cb3dSCy Schubertmail to other sites. 952b15cb3dSCy Schubert 962b15cb3dSCy Schubert <p>When used to generate message digest keys, the program produces a file 972b15cb3dSCy Schubertcontaining ten pseudo-random printable ASCII strings suitable for the 982b15cb3dSCy SchubertMD5 message digest algorithm included in the distribution. 992b15cb3dSCy SchubertIf the 1002b15cb3dSCy SchubertOpenSSL library is installed, it produces an additional ten hex-encoded 1012b15cb3dSCy Schubertrandom bit strings suitable for the SHA1 and other message digest 1022b15cb3dSCy Schubertalgorithms. 1032b15cb3dSCy SchubertThe message digest keys file must be distributed and stored 1042b15cb3dSCy Schubertusing secure means beyond the scope of NTP itself. 1052b15cb3dSCy SchubertBesides the keys 1062b15cb3dSCy Schubertused for ordinary NTP associations, additional keys can be defined as 1072b15cb3dSCy Schubertpasswords for the ntpq and ntpdc utility programs. 1082b15cb3dSCy Schubert 1092b15cb3dSCy Schubert <p>The remaining generated files are compatible with other OpenSSL 1102b15cb3dSCy Schubertapplications and other Public Key Infrastructure (PKI) resources. 1112b15cb3dSCy SchubertCertificates generated by this program are compatible with extant 1122b15cb3dSCy Schubertindustry practice, although some users might find the interpretation of 1132b15cb3dSCy SchubertX509v3 extension fields somewhat liberal. 1142b15cb3dSCy SchubertHowever, the identity keys 1152b15cb3dSCy Schubertare probably not compatible with anything other than Autokey. 1162b15cb3dSCy Schubert 1172b15cb3dSCy Schubert <p>Some files used by this program are encrypted using a private password. 1182b15cb3dSCy SchubertThe <code>-p</code> option specifies the password for local encrypted files and the 1192b15cb3dSCy Schubert<code>-q</code> option the password for encrypted files sent to remote sites. 1202b15cb3dSCy SchubertIf no password is specified, the host name returned by the Unix 1212b15cb3dSCy Schubert<code>gethostname()</code> function, normally the DNS name of the host, is used. 1222b15cb3dSCy Schubert 1232b15cb3dSCy Schubert <p>The <kbd>pw</kbd> option of the <code>crypto</code> configuration command 1242b15cb3dSCy Schubertspecifies the read password for previously encrypted local files. 1252b15cb3dSCy SchubertThis must match the local password used by this program. 1262b15cb3dSCy SchubertIf not specified, the host name is used. 1272b15cb3dSCy SchubertThus, if files are generated by this program without password, 1282b15cb3dSCy Schubertthey can be read back by ntpd without password, but only on the same 1292b15cb3dSCy Schuberthost. 1302b15cb3dSCy Schubert 1312b15cb3dSCy Schubert <p>Normally, encrypted files for each host are generated by that host and 1322b15cb3dSCy Schubertused only by that host, although exceptions exist as noted later on 1332b15cb3dSCy Schubertthis page. 1342b15cb3dSCy SchubertThe symmetric keys file, normally called <code>ntp.keys</code>, is 1352b15cb3dSCy Schubertusually installed in <code>/etc</code>. 1362b15cb3dSCy SchubertOther files and links are usually installed 1372b15cb3dSCy Schubertin <code>/usr/local/etc</code>, which is normally in a shared filesystem in 1382b15cb3dSCy SchubertNFS-mounted networks and cannot be changed by shared clients. 1392b15cb3dSCy SchubertThe location of the keys directory can be changed by the keysdir 1402b15cb3dSCy Schubertconfiguration command in such cases. 1412b15cb3dSCy SchubertNormally, this is in <code>/etc</code>. 1422b15cb3dSCy Schubert 1432b15cb3dSCy Schubert <p>This program directs commentary and error messages to the standard 1442b15cb3dSCy Schuberterror stream <code>stderr</code> and remote files to the standard output stream 1452b15cb3dSCy Schubert<code>stdout</code> where they can be piped to other applications or redirected to 1462b15cb3dSCy Schubertfiles. 1472b15cb3dSCy SchubertThe names used for generated files and links all begin with the 1482b15cb3dSCy Schubertstring <code>ntpkey</code> and include the file type, 1492b15cb3dSCy Schubertgenerating host and filestamp, 1502b15cb3dSCy Schubertas described in the <a href="#Cryptographic-Data-Files">Cryptographic Data Files</a> section below. 1512b15cb3dSCy Schubert 1522b15cb3dSCy Schubert<div class="node"> 1532b15cb3dSCy Schubert<p><hr> 1542b15cb3dSCy Schubert<a name="Running-the-Program"></a>Next: <a rel="next" accesskey="n" href="#Random-Seed-File">Random Seed File</a>, 1552b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#Description">Description</a>, 1562b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#Top">Top</a> 1572b15cb3dSCy Schubert<br> 1582b15cb3dSCy Schubert</div> 1592b15cb3dSCy Schubert 1602b15cb3dSCy Schubert<!-- node-name, next, previous, up --> 1612b15cb3dSCy Schubert<h3 class="section">Running the Program</h3> 1622b15cb3dSCy Schubert 1632b15cb3dSCy Schubert<p>To test and gain experience with Autokey concepts, log in as root and 1642b15cb3dSCy Schubertchange to the keys directory, usually <code>/usr/local/etc</code>. 1652b15cb3dSCy SchubertWhen run for the 1662b15cb3dSCy Schubertfirst time, or if all files with names beginning <code>ntpkey</code>] have been 1672b15cb3dSCy Schubertremoved, use the <code>ntp-keygen</code> command without arguments to generate a 1682b15cb3dSCy Schubertdefault RSA host key and matching RSA-MD5 certificate with expiration 1692b15cb3dSCy Schubertdate one year hence. 1702b15cb3dSCy SchubertIf run again without options, the program uses the 1712b15cb3dSCy Schubertexisting keys and parameters and generates only a new certificate with 1722b15cb3dSCy Schubertnew expiration date one year hence. 1732b15cb3dSCy Schubert 1742b15cb3dSCy Schubert <p>Run the command on as many hosts as necessary. 1752b15cb3dSCy SchubertDesignate one of them as the trusted host (TH) using <code>ntp-keygen</code> 1762b15cb3dSCy Schubertwith the <code>-T</code> option and configure 1772b15cb3dSCy Schubertit to synchronize from reliable Internet servers. 1782b15cb3dSCy SchubertThen configure the other hosts to synchronize to the TH directly or indirectly. 1792b15cb3dSCy SchubertA certificate trail is created when Autokey asks the immediately 1802b15cb3dSCy Schubertascendant host towards the TH to sign its certificate, which is then 1812b15cb3dSCy Schubertprovided to the immediately descendant host on request. 1822b15cb3dSCy SchubertAll group hosts should have acyclic certificate trails ending on the TH. 1832b15cb3dSCy Schubert 1842b15cb3dSCy Schubert <p>The host key is used to encrypt the cookie when required and so must be 1852b15cb3dSCy SchubertRSA type. 1862b15cb3dSCy SchubertBy default, the host key is also the sign key used to encrypt signatures. 1872b15cb3dSCy SchubertA different sign key can be assigned using the <code>-S</code> option 1882b15cb3dSCy Schubertand this can be either RSA or DSA type. 1892b15cb3dSCy SchubertBy default, the signature 1902b15cb3dSCy Schubertmessage digest type is MD5, but any combination of sign key type and 1912b15cb3dSCy Schubertmessage digest type supported by the OpenSSL library can be specified 1922b15cb3dSCy Schubertusing the <code>-c</code> option. 1932b15cb3dSCy Schubert 1942b15cb3dSCy Schubert <p>The rules say cryptographic media should be generated with proventic 1952b15cb3dSCy Schubertfilestamps, which means the host should already be synchronized before 1962b15cb3dSCy Schubertthis program is run. 1972b15cb3dSCy SchubertThis of course creates a chicken-and-egg problem 1982b15cb3dSCy Schubertwhen the host is started for the first time. 1992b15cb3dSCy SchubertAccordingly, the host time 2002b15cb3dSCy Schubertshould be set by some other means, such as eyeball-and-wristwatch, at 2012b15cb3dSCy Schubertleast so that the certificate lifetime is within the current year. 2022b15cb3dSCy SchubertAfter that and when the host is synchronized to a proventic source, the 2032b15cb3dSCy Schubertcertificate should be re-generated. 2042b15cb3dSCy Schubert 2052b15cb3dSCy Schubert <p>Additional information on trusted groups and identity schemes is on the 2062b15cb3dSCy SchubertAutokey Public-Key Authentication page. 2072b15cb3dSCy Schubert 2082b15cb3dSCy Schubert<div class="node"> 2092b15cb3dSCy Schubert<p><hr> 2102b15cb3dSCy Schubert<a name="ntp_002dkeygen-Invocation"></a> 2112b15cb3dSCy Schubert<br> 2122b15cb3dSCy Schubert</div> 2132b15cb3dSCy Schubert 2142b15cb3dSCy Schubert<h3 class="section">Invoking ntp-keygen</h3> 2152b15cb3dSCy Schubert 2162b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen-1"></a><a name="index-Create-a-NTP-host-key-2"></a> 2172b15cb3dSCy Schubert 2182b15cb3dSCy Schubert <p>This program generates cryptographic data files used by the NTPv4 2192b15cb3dSCy Schubertauthentication and identification schemes. 22009100258SXin LIIt can generate message digest keys used in symmetric key cryptography and, 22109100258SXin LIif the OpenSSL software library has been installed, it can generate host keys, 22209100258SXin LIsigning keys, certificates, and identity keys and parameters used in Autokey 22309100258SXin LIpublic key cryptography. 2242b15cb3dSCy SchubertThese files are used for cookie encryption, 22509100258SXin LIdigital signature, and challenge/response identification algorithms 2262b15cb3dSCy Schubertcompatible with the Internet standard security infrastructure. 2272b15cb3dSCy Schubert 22809100258SXin LI <p>The message digest symmetric keys file is generated in a format 22909100258SXin LIcompatible with NTPv3. 23009100258SXin LIAll other files are in PEM-encoded printable ASCII format, 23109100258SXin LIso they can be embedded as MIME attachments in email to other sites 2322b15cb3dSCy Schubertand certificate authorities. 2332b15cb3dSCy SchubertBy default, files are not encrypted. 2342b15cb3dSCy Schubert 23509100258SXin LI <p>When used to generate message digest symmetric keys, the program 23609100258SXin LIproduces a file containing ten pseudo-random printable ASCII strings 23709100258SXin LIsuitable for the MD5 message digest algorithm included in the 23809100258SXin LIdistribution. 2392b15cb3dSCy SchubertIf the OpenSSL library is installed, it produces an additional ten 24009100258SXin LIhex-encoded random bit strings suitable for SHA1, AES-128-CMAC, and 24109100258SXin LIother message digest algorithms. 24209100258SXin LIThe message digest symmetric keys file must be distributed and stored 2432b15cb3dSCy Schubertusing secure means beyond the scope of NTP itself. 2442b15cb3dSCy SchubertBesides the keys used for ordinary NTP associations, additional keys 2452b15cb3dSCy Schubertcan be defined as passwords for the 2462b15cb3dSCy Schubert<code>ntpq(1ntpqmdoc)</code> 2472b15cb3dSCy Schubertand 2482b15cb3dSCy Schubert<code>ntpdc(1ntpdcmdoc)</code> 2492b15cb3dSCy Schubertutility programs. 2502b15cb3dSCy Schubert 2512b15cb3dSCy Schubert <p>The remaining generated files are compatible with other OpenSSL 2522b15cb3dSCy Schubertapplications and other Public Key Infrastructure (PKI) resources. 2532b15cb3dSCy SchubertCertificates generated by this program are compatible with extant 2542b15cb3dSCy Schubertindustry practice, although some users might find the interpretation of 2552b15cb3dSCy SchubertX509v3 extension fields somewhat liberal. 2562b15cb3dSCy SchubertHowever, the identity keys are probably not compatible with anything 2572b15cb3dSCy Schubertother than Autokey. 2582b15cb3dSCy Schubert 2592b15cb3dSCy Schubert <p>Some files used by this program are encrypted using a private password. 2602b15cb3dSCy SchubertThe 2612b15cb3dSCy Schubert<code>-p</code> 26209100258SXin LIoption specifies the read password for local encrypted files and the 2632b15cb3dSCy Schubert<code>-q</code> 26409100258SXin LIoption the write password for encrypted files sent to remote sites. 2652b15cb3dSCy SchubertIf no password is specified, the host name returned by the Unix 26609100258SXin LI<code>hostname(1)</code> 26709100258SXin LIcommand, normally the DNS name of the host, is used as the the default read 26809100258SXin LIpassword, for convenience. 26909100258SXin LIThe 27009100258SXin LI<code>ntp-keygen</code> 27109100258SXin LIprogram prompts for the password if it reads an encrypted file 27209100258SXin LIand the password is missing or incorrect. 27309100258SXin LIIf an encrypted file is read successfully and 27409100258SXin LIno write password is specified, the read password is used 27509100258SXin LIas the write password by default. 2762b15cb3dSCy Schubert 2772b15cb3dSCy Schubert <p>The 27809100258SXin LI<code>pw</code> 2792b15cb3dSCy Schubertoption of the 28009100258SXin LI<code>crypto</code> 28109100258SXin LI<code>ntpd(1ntpdmdoc)</code> 2822b15cb3dSCy Schubertconfiguration command specifies the read 2832b15cb3dSCy Schubertpassword for previously encrypted local files. 28409100258SXin LIThis must match the local read password used by this program. 2852b15cb3dSCy SchubertIf not specified, the host name is used. 28609100258SXin LIThus, if files are generated by this program without an explicit password, 2872b15cb3dSCy Schubertthey can be read back by 28809100258SXin LI<code>ntpd(1ntpdmdoc)</code> 28909100258SXin LIwithout specifying an explicit password but only on the same host. 29009100258SXin LIIf the write password used for encryption is specified as the host name, 29109100258SXin LIthese files can be read by that host with no explicit password. 2922b15cb3dSCy Schubert 2932b15cb3dSCy Schubert <p>Normally, encrypted files for each host are generated by that host and 2942b15cb3dSCy Schubertused only by that host, although exceptions exist as noted later on 2952b15cb3dSCy Schubertthis page. 2962b15cb3dSCy SchubertThe symmetric keys file, normally called 29709100258SXin LI<span class="file">ntp.keys</span>, 2982b15cb3dSCy Schubertis usually installed in 2992b15cb3dSCy Schubert<span class="file">/etc</span>. 3002b15cb3dSCy SchubertOther files and links are usually installed in 3012b15cb3dSCy Schubert<span class="file">/usr/local/etc</span>, 3022b15cb3dSCy Schubertwhich is normally in a shared filesystem in 3032b15cb3dSCy SchubertNFS-mounted networks and cannot be changed by shared clients. 30409100258SXin LIIn these cases, NFS clients can specify the files in another 30509100258SXin LIdirectory such as 30609100258SXin LI<span class="file">/etc</span> 30709100258SXin LIusing the 30809100258SXin LI<code>keysdir</code> 30909100258SXin LI<code>ntpd(1ntpdmdoc)</code> 31009100258SXin LIconfiguration file command. 3112b15cb3dSCy Schubert 3122b15cb3dSCy Schubert <p>This program directs commentary and error messages to the standard 3132b15cb3dSCy Schuberterror stream 31409100258SXin LI<span class="file">stderr</span> 3152b15cb3dSCy Schubertand remote files to the standard output stream 31609100258SXin LI<span class="file">stdout</span> 3172b15cb3dSCy Schubertwhere they can be piped to other applications or redirected to files. 3182b15cb3dSCy SchubertThe names used for generated files and links all begin with the 3192b15cb3dSCy Schubertstring 32009100258SXin LI<span class="file">ntpkey*</span> 3212b15cb3dSCy Schubertand include the file type, generating host and filestamp, 3222b15cb3dSCy Schubertas described in the 32309100258SXin LI<a href="#Cryptographic-Data-Files">Cryptographic Data Files</a> 3242b15cb3dSCy Schubertsection below. 3252b15cb3dSCy Schubert 3262b15cb3dSCy Schubert<h5 class="subsubsection">Running the Program</h5> 3272b15cb3dSCy Schubert 32809100258SXin LI<p>The safest way to run the 32909100258SXin LI<code>ntp-keygen</code> 33009100258SXin LIprogram is logged in directly as root. 33109100258SXin LIThe recommended procedure is change to the 33209100258SXin LI<kbd>keys</kbd> 33309100258SXin LIdirectory, usually 33409100258SXin LI<span class="file">/usr/local/etc</span>, 33509100258SXin LIthen run the program. 33609100258SXin LI 3372b15cb3dSCy Schubert <p>To test and gain experience with Autokey concepts, log in as root and 33809100258SXin LIchange to the 33909100258SXin LI<kbd>keys</kbd> 34009100258SXin LIdirectory, usually 34109100258SXin LI<span class="file">/usr/local/etc</span>. 3422b15cb3dSCy SchubertWhen run for the first time, or if all files with names beginning with 34309100258SXin LI<span class="file">ntpkey*</span> 3442b15cb3dSCy Schuberthave been removed, use the 3452b15cb3dSCy Schubert<code>ntp-keygen</code> 34609100258SXin LIcommand without arguments to generate a default 34709100258SXin LI<code>RSA</code> 34809100258SXin LIhost key and matching 34909100258SXin LI<code>RSA-MD5</code> 35009100258SXin LIcertificate file with expiration date one year hence, 35109100258SXin LIwhich is all that is necessary in many cases. 35209100258SXin LIThe program also generates soft links from the generic names 35309100258SXin LIto the respective files. 3542b15cb3dSCy SchubertIf run again without options, the program uses the 35509100258SXin LIexisting keys and parameters and generates a new certificate file with 35609100258SXin LInew expiration date one year hence, and soft link. 35709100258SXin LI 35809100258SXin LI <p>The host key is used to encrypt the cookie when required and so must be 35909100258SXin LI<code>RSA</code> 36009100258SXin LItype. 36109100258SXin LIBy default, the host key is also the sign key used to encrypt signatures. 36209100258SXin LIWhen necessary, a different sign key can be specified and this can be 36309100258SXin LIeither 36409100258SXin LI<code>RSA</code> 36509100258SXin LIor 36609100258SXin LI<code>DSA</code> 36709100258SXin LItype. 36809100258SXin LIBy default, the message digest type is 36909100258SXin LI<code>MD5</code>, 37009100258SXin LIbut any combination 37109100258SXin LIof sign key type and message digest type supported by the OpenSSL library 37209100258SXin LIcan be specified, including those using the 37309100258SXin LI<code>AES128CMAC</code>, <code>MD2</code>, <code>MD5</code>, <code>MDC2</code>, <code>SHA</code>, <code>SHA1</code> 37409100258SXin LIand 37509100258SXin LI<code>RIPE160</code> 37609100258SXin LImessage digest algorithms. 37709100258SXin LIHowever, the scheme specified in the certificate must be compatible 37809100258SXin LIwith the sign key. 37909100258SXin LICertificates using any digest algorithm are compatible with 38009100258SXin LI<code>RSA</code> 38109100258SXin LIsign keys; 38209100258SXin LIhowever, only 38309100258SXin LI<code>SHA</code> 38409100258SXin LIand 38509100258SXin LI<code>SHA1</code> 38609100258SXin LIcertificates are compatible with 38709100258SXin LI<code>DSA</code> 38809100258SXin LIsign keys. 38909100258SXin LI 39009100258SXin LI <p>Private/public key files and certificates are compatible with 39109100258SXin LIother OpenSSL applications and very likely other libraries as well. 39209100258SXin LICertificates or certificate requests derived from them should be compatible 39309100258SXin LIwith extant industry practice, although some users might find 39409100258SXin LIthe interpretation of X509v3 extension fields somewhat liberal. 39509100258SXin LIHowever, the identification parameter files, although encoded 39609100258SXin LIas the other files, are probably not compatible with anything other than Autokey. 39709100258SXin LI 39809100258SXin LI <p>Running the program as other than root and using the Unix 39909100258SXin LI<code>su(1)</code> 40009100258SXin LIcommand 40109100258SXin LIto assume root may not work properly, since by default the OpenSSL library 40209100258SXin LIlooks for the random seed file 40309100258SXin LI<span class="file">.rnd</span> 40409100258SXin LIin the user home directory. 40509100258SXin LIHowever, there should be only one 40609100258SXin LI<span class="file">.rnd</span>, 40709100258SXin LImost conveniently 40809100258SXin LIin the root directory, so it is convenient to define the 40909100258SXin LI.Ev RANDFILE 41009100258SXin LIenvironment variable used by the OpenSSL library as the path to 41109100258SXin LI<span class="file">.rnd</span>. 41209100258SXin LI 41309100258SXin LI <p>Installing the keys as root might not work in NFS-mounted 41409100258SXin LIshared file systems, as NFS clients may not be able to write 41509100258SXin LIto the shared keys directory, even as root. 41609100258SXin LIIn this case, NFS clients can specify the files in another 41709100258SXin LIdirectory such as 41809100258SXin LI<span class="file">/etc</span> 41909100258SXin LIusing the 42009100258SXin LI<code>keysdir</code> 42109100258SXin LI<code>ntpd(1ntpdmdoc)</code> 42209100258SXin LIconfiguration file command. 42309100258SXin LIThere is no need for one client to read the keys and certificates 42409100258SXin LIof other clients or servers, as these data are obtained automatically 42509100258SXin LIby the Autokey protocol. 42609100258SXin LI 42709100258SXin LI <p>Ordinarily, cryptographic files are generated by the host that uses them, 42809100258SXin LIbut it is possible for a trusted agent (TA) to generate these files 42909100258SXin LIfor other hosts; however, in such cases files should always be encrypted. 43009100258SXin LIThe subject name and trusted name default to the hostname 43109100258SXin LIof the host generating the files, but can be changed by command line options. 43209100258SXin LIIt is convenient to designate the owner name and trusted name 43309100258SXin LIas the subject and issuer fields, respectively, of the certificate. 43409100258SXin LIThe owner name is also used for the host and sign key files, 43509100258SXin LIwhile the trusted name is used for the identity files. 43609100258SXin LI 43709100258SXin LI <p>All files are installed by default in the keys directory 43809100258SXin LI<span class="file">/usr/local/etc</span>, 43909100258SXin LIwhich is normally in a shared filesystem 44009100258SXin LIin NFS-mounted networks. 44109100258SXin LIThe actual location of the keys directory 44209100258SXin LIand each file can be overridden by configuration commands, 44309100258SXin LIbut this is not recommended. 44409100258SXin LINormally, the files for each host are generated by that host 44509100258SXin LIand used only by that host, although exceptions exist 44609100258SXin LIas noted later on this page. 44709100258SXin LI 44809100258SXin LI <p>Normally, files containing private values, 44909100258SXin LIincluding the host key, sign key and identification parameters, 45009100258SXin LIare permitted root read/write-only; 45109100258SXin LIwhile others containing public values are permitted world readable. 45209100258SXin LIAlternatively, files containing private values can be encrypted 45309100258SXin LIand these files permitted world readable, 45409100258SXin LIwhich simplifies maintenance in shared file systems. 45509100258SXin LISince uniqueness is insured by the 45609100258SXin LI<kbd>hostname</kbd> 45709100258SXin LIand 45809100258SXin LI<kbd>filestamp</kbd> 45909100258SXin LIfile name extensions, the files for an NTP server and 46009100258SXin LIdependent clients can all be installed in the same shared directory. 46109100258SXin LI 46209100258SXin LI <p>The recommended practice is to keep the file name extensions 46309100258SXin LIwhen installing a file and to install a soft link 46409100258SXin LIfrom the generic names specified elsewhere on this page 46509100258SXin LIto the generated files. 46609100258SXin LIThis allows new file generations to be activated simply 46709100258SXin LIby changing the link. 46809100258SXin LIIf a link is present, 46909100258SXin LI<code>ntpd(1ntpdmdoc)</code> 47009100258SXin LIfollows it to the file name to extract the 47109100258SXin LI<kbd>filestamp</kbd>. 47209100258SXin LIIf a link is not present, 47309100258SXin LI<code>ntpd(1ntpdmdoc)</code> 47409100258SXin LIextracts the 47509100258SXin LI<kbd>filestamp</kbd> 47609100258SXin LIfrom the file itself. 47709100258SXin LIThis allows clients to verify that the file and generation times 47809100258SXin LIare always current. 47909100258SXin LIThe 48009100258SXin LI<code>ntp-keygen</code> 48109100258SXin LIprogram uses the same 48209100258SXin LI<kbd>filestamp</kbd> 48309100258SXin LIextension for all files generated 48409100258SXin LIat one time, so each generation is distinct and can be readily 48509100258SXin LIrecognized in monitoring data. 4862b15cb3dSCy Schubert 4872b15cb3dSCy Schubert <p>Run the command on as many hosts as necessary. 4882b15cb3dSCy SchubertDesignate one of them as the trusted host (TH) using 4892b15cb3dSCy Schubert<code>ntp-keygen</code> 4902b15cb3dSCy Schubertwith the 4912b15cb3dSCy Schubert<code>-T</code> 4922b15cb3dSCy Schubertoption and configure it to synchronize from reliable Internet servers. 4932b15cb3dSCy SchubertThen configure the other hosts to synchronize to the TH directly or 4942b15cb3dSCy Schubertindirectly. 4952b15cb3dSCy SchubertA certificate trail is created when Autokey asks the immediately 4962b15cb3dSCy Schubertascendant host towards the TH to sign its certificate, which is then 4972b15cb3dSCy Schubertprovided to the immediately descendant host on request. 4982b15cb3dSCy SchubertAll group hosts should have acyclic certificate trails ending on the TH. 4992b15cb3dSCy Schubert 5002b15cb3dSCy Schubert <p>The host key is used to encrypt the cookie when required and so must be 5012b15cb3dSCy SchubertRSA type. 5022b15cb3dSCy SchubertBy default, the host key is also the sign key used to encrypt 5032b15cb3dSCy Schubertsignatures. 5042b15cb3dSCy SchubertA different sign key can be assigned using the 5052b15cb3dSCy Schubert<code>-S</code> 50609100258SXin LIoption and this can be either 50709100258SXin LI<code>RSA</code> 50809100258SXin LIor 50909100258SXin LI<code>DSA</code> 51009100258SXin LItype. 5112b15cb3dSCy SchubertBy default, the signature 51209100258SXin LImessage digest type is 51309100258SXin LI<code>MD5</code>, 51409100258SXin LIbut any combination of sign key type and 5152b15cb3dSCy Schubertmessage digest type supported by the OpenSSL library can be specified 5162b15cb3dSCy Schubertusing the 5172b15cb3dSCy Schubert<code>-c</code> 5182b15cb3dSCy Schubertoption. 51909100258SXin LI 52009100258SXin LI <p>The rules say cryptographic media should be generated with proventic 5212b15cb3dSCy Schubertfilestamps, which means the host should already be synchronized before 5222b15cb3dSCy Schubertthis program is run. 5232b15cb3dSCy SchubertThis of course creates a chicken-and-egg problem 5242b15cb3dSCy Schubertwhen the host is started for the first time. 5252b15cb3dSCy SchubertAccordingly, the host time 5262b15cb3dSCy Schubertshould be set by some other means, such as eyeball-and-wristwatch, at 5272b15cb3dSCy Schubertleast so that the certificate lifetime is within the current year. 5282b15cb3dSCy SchubertAfter that and when the host is synchronized to a proventic source, the 5292b15cb3dSCy Schubertcertificate should be re-generated. 5302b15cb3dSCy Schubert 5312b15cb3dSCy Schubert <p>Additional information on trusted groups and identity schemes is on the 5322b15cb3dSCy SchubertAutokey Public-Key Authentication 5332b15cb3dSCy Schubertpage. 5342b15cb3dSCy Schubert 5352b15cb3dSCy Schubert <p>File names begin with the prefix 53609100258SXin LI<span class="file">ntpkey</span>_ 53709100258SXin LIand end with the suffix 53809100258SXin LI<span class="file">_</span><kbd>hostname</kbd>. <kbd>filestamp</kbd>, 5392b15cb3dSCy Schubertwhere 5402b15cb3dSCy Schubert<kbd>hostname</kbd> 5412b15cb3dSCy Schubertis the owner name, usually the string returned 54209100258SXin LIby the Unix 54309100258SXin LI<code>hostname(1)</code> 54409100258SXin LIcommand, and 5452b15cb3dSCy Schubert<kbd>filestamp</kbd> 5462b15cb3dSCy Schubertis the NTP seconds when the file was generated, in decimal digits. 5472b15cb3dSCy SchubertThis both guarantees uniqueness and simplifies maintenance 5482b15cb3dSCy Schubertprocedures, since all files can be quickly removed 5492b15cb3dSCy Schubertby a 55009100258SXin LI<code>rm</code> <span class="file">ntpkey*</span> 5512b15cb3dSCy Schubertcommand or all files generated 5522b15cb3dSCy Schubertat a specific time can be removed by a 55309100258SXin LI<code>rm</code> <span class="file">*</span><kbd>filestamp</kbd> 5542b15cb3dSCy Schubertcommand. 5552b15cb3dSCy SchubertTo further reduce the risk of misconfiguration, 5562b15cb3dSCy Schubertthe first two lines of a file contain the file name 5572b15cb3dSCy Schubertand generation date and time as comments. 5582b15cb3dSCy Schubert 55909100258SXin LI<h5 class="subsubsection">Trusted Hosts and Groups</h5> 5602b15cb3dSCy Schubert 56109100258SXin LI<p>Each cryptographic configuration involves selection of a signature scheme 5622b15cb3dSCy Schubertand identification scheme, called a cryptotype, 5632b15cb3dSCy Schubertas explained in the 5642b15cb3dSCy Schubert<a href="#Authentication-Options">Authentication Options</a> 5652b15cb3dSCy Schubertsection of 5662b15cb3dSCy Schubert<code>ntp.conf(5)</code>. 56709100258SXin LIThe default cryptotype uses 56809100258SXin LI<code>RSA</code> 56909100258SXin LIencryption, 57009100258SXin LI<code>MD5</code> 57109100258SXin LImessage digest 57209100258SXin LIand 57309100258SXin LI<code>TC</code> 57409100258SXin LIidentification. 5752b15cb3dSCy SchubertFirst, configure a NTP subnet including one or more low-stratum 5762b15cb3dSCy Schuberttrusted hosts from which all other hosts derive synchronization 5772b15cb3dSCy Schubertdirectly or indirectly. 5782b15cb3dSCy SchubertTrusted hosts have trusted certificates; 5792b15cb3dSCy Schubertall other hosts have nontrusted certificates. 5802b15cb3dSCy SchubertThese hosts will automatically and dynamically build authoritative 5812b15cb3dSCy Schubertcertificate trails to one or more trusted hosts. 5822b15cb3dSCy SchubertA trusted group is the set of all hosts that have, directly or indirectly, 5832b15cb3dSCy Schuberta certificate trail ending at a trusted host. 5842b15cb3dSCy SchubertThe trail is defined by static configuration file entries 5852b15cb3dSCy Schubertor dynamic means described on the 5862b15cb3dSCy Schubert<a href="#Automatic-NTP-Configuration-Options">Automatic NTP Configuration Options</a> 5872b15cb3dSCy Schubertsection of 5882b15cb3dSCy Schubert<code>ntp.conf(5)</code>. 5892b15cb3dSCy Schubert 5902b15cb3dSCy Schubert <p>On each trusted host as root, change to the keys directory. 5912b15cb3dSCy SchubertTo insure a fresh fileset, remove all 59209100258SXin LI<span class="file">ntpkey</span> 5932b15cb3dSCy Schubertfiles. 5942b15cb3dSCy SchubertThen run 5952b15cb3dSCy Schubert<code>ntp-keygen</code> 5962b15cb3dSCy Schubert<code>-T</code> 5972b15cb3dSCy Schubertto generate keys and a trusted certificate. 5982b15cb3dSCy SchubertOn all other hosts do the same, but leave off the 5992b15cb3dSCy Schubert<code>-T</code> 6002b15cb3dSCy Schubertflag to generate keys and nontrusted certificates. 6012b15cb3dSCy SchubertWhen complete, start the NTP daemons beginning at the lowest stratum 6022b15cb3dSCy Schubertand working up the tree. 6032b15cb3dSCy SchubertIt may take some time for Autokey to instantiate the certificate trails 6042b15cb3dSCy Schubertthroughout the subnet, but setting up the environment is completely automatic. 6052b15cb3dSCy Schubert 6062b15cb3dSCy Schubert <p>If it is necessary to use a different sign key or different digest/signature 6072b15cb3dSCy Schubertscheme than the default, run 6082b15cb3dSCy Schubert<code>ntp-keygen</code> 6092b15cb3dSCy Schubertwith the 6102b15cb3dSCy Schubert<code>-S</code> <kbd>type</kbd> 6112b15cb3dSCy Schubertoption, where 6122b15cb3dSCy Schubert<kbd>type</kbd> 6132b15cb3dSCy Schubertis either 6142b15cb3dSCy Schubert<code>RSA</code> 6152b15cb3dSCy Schubertor 6162b15cb3dSCy Schubert<code>DSA</code>. 61709100258SXin LIThe most frequent need to do this is when a 61809100258SXin LI<code>DSA</code>-signed 61909100258SXin LIcertificate is used. 6202b15cb3dSCy SchubertIf it is necessary to use a different certificate scheme than the default, 6212b15cb3dSCy Schubertrun 6222b15cb3dSCy Schubert<code>ntp-keygen</code> 6232b15cb3dSCy Schubertwith the 6242b15cb3dSCy Schubert<code>-c</code> <kbd>scheme</kbd> 6252b15cb3dSCy Schubertoption and selected 6262b15cb3dSCy Schubert<kbd>scheme</kbd> 6272b15cb3dSCy Schubertas needed. 62809100258SXin LIIf 6292b15cb3dSCy Schubert<code>ntp-keygen</code> 6302b15cb3dSCy Schubertis run again without these options, it generates a new certificate 63109100258SXin LIusing the same scheme and sign key, and soft link. 6322b15cb3dSCy Schubert 6332b15cb3dSCy Schubert <p>After setting up the environment it is advisable to update certificates 6342b15cb3dSCy Schubertfrom time to time, if only to extend the validity interval. 6352b15cb3dSCy SchubertSimply run 6362b15cb3dSCy Schubert<code>ntp-keygen</code> 6372b15cb3dSCy Schubertwith the same flags as before to generate new certificates 63809100258SXin LIusing existing keys, and soft links. 6392b15cb3dSCy SchubertHowever, if the host or sign key is changed, 6402b15cb3dSCy Schubert<code>ntpd(1ntpdmdoc)</code> 6412b15cb3dSCy Schubertshould be restarted. 6422b15cb3dSCy SchubertWhen 6432b15cb3dSCy Schubert<code>ntpd(1ntpdmdoc)</code> 6442b15cb3dSCy Schubertis restarted, it loads any new files and restarts the protocol. 6452b15cb3dSCy SchubertOther dependent hosts will continue as usual until signatures are refreshed, 6462b15cb3dSCy Schubertat which time the protocol is restarted. 6472b15cb3dSCy Schubert 6482b15cb3dSCy Schubert<h5 class="subsubsection">Identity Schemes</h5> 6492b15cb3dSCy Schubert 6502b15cb3dSCy Schubert<p>As mentioned on the Autonomous Authentication page, 65109100258SXin LIthe default 65209100258SXin LI<code>TC</code> 65309100258SXin LIidentity scheme is vulnerable to a middleman attack. 6542b15cb3dSCy SchubertHowever, there are more secure identity schemes available, 65509100258SXin LIincluding 65609100258SXin LI<code>PC</code>, <code>IFF</code>, <code>GQ</code> 65709100258SXin LIand 65809100258SXin LI<code>MV</code> 65909100258SXin LIschemes described below. 6602b15cb3dSCy SchubertThese schemes are based on a TA, one or more trusted hosts 6612b15cb3dSCy Schubertand some number of nontrusted hosts. 6622b15cb3dSCy SchubertTrusted hosts prove identity using values provided by the TA, 6632b15cb3dSCy Schubertwhile the remaining hosts prove identity using values provided 6642b15cb3dSCy Schubertby a trusted host and certificate trails that end on that host. 6652b15cb3dSCy SchubertThe name of a trusted host is also the name of its sugroup 6662b15cb3dSCy Schubertand also the subject and issuer name on its trusted certificate. 6672b15cb3dSCy SchubertThe TA is not necessarily a trusted host in this sense, but often is. 6682b15cb3dSCy Schubert 6692b15cb3dSCy Schubert <p>In some schemes there are separate keys for servers and clients. 6702b15cb3dSCy SchubertA server can also be a client of another server, 6712b15cb3dSCy Schubertbut a client can never be a server for another client. 6722b15cb3dSCy SchubertIn general, trusted hosts and nontrusted hosts that operate 6732b15cb3dSCy Schubertas both server and client have parameter files that contain 6742b15cb3dSCy Schubertboth server and client keys. 6752b15cb3dSCy SchubertHosts that operate 6762b15cb3dSCy Schubertonly as clients have key files that contain only client keys. 6772b15cb3dSCy Schubert 6782b15cb3dSCy Schubert <p>The PC scheme supports only one trusted host in the group. 6792b15cb3dSCy SchubertOn trusted host alice run 6802b15cb3dSCy Schubert<code>ntp-keygen</code> 6812b15cb3dSCy Schubert<code>-P</code> 6822b15cb3dSCy Schubert<code>-p</code> <kbd>password</kbd> 6832b15cb3dSCy Schubertto generate the host key file 68409100258SXin LI<span class="file">ntpkey</span>_ <code>RSA</code> <span class="file">key_alice.</span> <kbd>filestamp</kbd> 6852b15cb3dSCy Schubertand trusted private certificate file 68609100258SXin LI<span class="file">ntpkey</span>_ <code>RSA-MD5</code> <code>_</code> <span class="file">cert_alice.</span> <kbd>filestamp</kbd>, 68709100258SXin LIand soft links. 6882b15cb3dSCy SchubertCopy both files to all group hosts; 6892b15cb3dSCy Schubertthey replace the files which would be generated in other schemes. 69009100258SXin LIOn each host 69109100258SXin LI<kbd>bob</kbd> 69209100258SXin LIinstall a soft link from the generic name 6932b15cb3dSCy Schubert<span class="file">ntpkey_host_</span><kbd>bob</kbd> 6942b15cb3dSCy Schubertto the host key file and soft link 6952b15cb3dSCy Schubert<span class="file">ntpkey_cert_</span><kbd>bob</kbd> 6962b15cb3dSCy Schubertto the private certificate file. 6972b15cb3dSCy SchubertNote the generic links are on bob, but point to files generated 6982b15cb3dSCy Schubertby trusted host alice. 6992b15cb3dSCy SchubertIn this scheme it is not possible to refresh 7002b15cb3dSCy Schuberteither the keys or certificates without copying them 70109100258SXin LIto all other hosts in the group, and recreating the soft links. 7022b15cb3dSCy Schubert 70309100258SXin LI <p>For the 70409100258SXin LI<code>IFF</code> 70509100258SXin LIscheme proceed as in the 70609100258SXin LI<code>TC</code> 70709100258SXin LIscheme to generate keys 7082b15cb3dSCy Schubertand certificates for all group hosts, then for every trusted host in the group, 70909100258SXin LIgenerate the 71009100258SXin LI<code>IFF</code> 71109100258SXin LIparameter file. 7122b15cb3dSCy SchubertOn trusted host alice run 7132b15cb3dSCy Schubert<code>ntp-keygen</code> 7142b15cb3dSCy Schubert<code>-T</code> 7152b15cb3dSCy Schubert<code>-I</code> 7162b15cb3dSCy Schubert<code>-p</code> <kbd>password</kbd> 7172b15cb3dSCy Schubertto produce her parameter file 71809100258SXin LI<span class="file">ntpkey_IFFpar_alice.</span><kbd>filestamp</kbd>, 7192b15cb3dSCy Schubertwhich includes both server and client keys. 7202b15cb3dSCy SchubertCopy this file to all group hosts that operate as both servers 7212b15cb3dSCy Schubertand clients and install a soft link from the generic 72209100258SXin LI<span class="file">ntpkey_iff_alice</span> 7232b15cb3dSCy Schubertto this file. 7242b15cb3dSCy SchubertIf there are no hosts restricted to operate only as clients, 7252b15cb3dSCy Schubertthere is nothing further to do. 72609100258SXin LIAs the 72709100258SXin LI<code>IFF</code> 72809100258SXin LIscheme is independent 7292b15cb3dSCy Schubertof keys and certificates, these files can be refreshed as needed. 7302b15cb3dSCy Schubert 7312b15cb3dSCy Schubert <p>If a rogue client has the parameter file, it could masquerade 7322b15cb3dSCy Schubertas a legitimate server and present a middleman threat. 7332b15cb3dSCy SchubertTo eliminate this threat, the client keys can be extracted 7342b15cb3dSCy Schubertfrom the parameter file and distributed to all restricted clients. 7352b15cb3dSCy SchubertAfter generating the parameter file, on alice run 7362b15cb3dSCy Schubert<code>ntp-keygen</code> 7372b15cb3dSCy Schubert<code>-e</code> 73809100258SXin LIand pipe the output to a file or email program. 73909100258SXin LICopy or email this file to all restricted clients. 7402b15cb3dSCy SchubertOn these clients install a soft link from the generic 74109100258SXin LI<span class="file">ntpkey_iff_alice</span> 7422b15cb3dSCy Schubertto this file. 7432b15cb3dSCy SchubertTo further protect the integrity of the keys, 7442b15cb3dSCy Schuberteach file can be encrypted with a secret password. 7452b15cb3dSCy Schubert 74609100258SXin LI <p>For the 74709100258SXin LI<code>GQ</code> 74809100258SXin LIscheme proceed as in the 74909100258SXin LI<code>TC</code> 75009100258SXin LIscheme to generate keys 7512b15cb3dSCy Schubertand certificates for all group hosts, then for every trusted host 75209100258SXin LIin the group, generate the 75309100258SXin LI<code>IFF</code> 75409100258SXin LIparameter file. 7552b15cb3dSCy SchubertOn trusted host alice run 7562b15cb3dSCy Schubert<code>ntp-keygen</code> 7572b15cb3dSCy Schubert<code>-T</code> 7582b15cb3dSCy Schubert<code>-G</code> 7592b15cb3dSCy Schubert<code>-p</code> <kbd>password</kbd> 7602b15cb3dSCy Schubertto produce her parameter file 76109100258SXin LI<span class="file">ntpkey_GQpar_alice.</span><kbd>filestamp</kbd>, 7622b15cb3dSCy Schubertwhich includes both server and client keys. 7632b15cb3dSCy SchubertCopy this file to all group hosts and install a soft link 7642b15cb3dSCy Schubertfrom the generic 76509100258SXin LI<span class="file">ntpkey_gq_alice</span> 7662b15cb3dSCy Schubertto this file. 76709100258SXin LIIn addition, on each host 76809100258SXin LI<kbd>bob</kbd> 76909100258SXin LIinstall a soft link 7702b15cb3dSCy Schubertfrom generic 7712b15cb3dSCy Schubert<span class="file">ntpkey_gq_</span><kbd>bob</kbd> 7722b15cb3dSCy Schubertto this file. 77309100258SXin LIAs the 77409100258SXin LI<code>GQ</code> 77509100258SXin LIscheme updates the 77609100258SXin LI<code>GQ</code> 77709100258SXin LIparameters file and certificate 7782b15cb3dSCy Schubertat the same time, keys and certificates can be regenerated as needed. 7792b15cb3dSCy Schubert 78009100258SXin LI <p>For the 78109100258SXin LI<code>MV</code> 78209100258SXin LIscheme, proceed as in the 78309100258SXin LI<code>TC</code> 78409100258SXin LIscheme to generate keys 7852b15cb3dSCy Schubertand certificates for all group hosts. 7862b15cb3dSCy SchubertFor illustration assume trish is the TA, alice one of several trusted hosts 7872b15cb3dSCy Schubertand bob one of her clients. 7882b15cb3dSCy SchubertOn TA trish run 7892b15cb3dSCy Schubert<code>ntp-keygen</code> 7902b15cb3dSCy Schubert<code>-V</code> <kbd>n</kbd> 7912b15cb3dSCy Schubert<code>-p</code> <kbd>password</kbd>, 7922b15cb3dSCy Schubertwhere 7932b15cb3dSCy Schubert<kbd>n</kbd> 7942b15cb3dSCy Schubertis the number of revokable keys (typically 5) to produce 7952b15cb3dSCy Schubertthe parameter file 79609100258SXin LI<span class="file">ntpkeys_MVpar_trish.</span><kbd>filestamp</kbd> 7972b15cb3dSCy Schubertand client key files 79809100258SXin LI<span class="file">ntpkeys_MVkey</span><kbd>d</kbd> <kbd>_</kbd> <span class="file">trish.</span> <kbd>filestamp</kbd> 7992b15cb3dSCy Schubertwhere 8002b15cb3dSCy Schubert<kbd>d</kbd> 8012b15cb3dSCy Schubertis the key number (0 < 8022b15cb3dSCy Schubert<kbd>d</kbd> 8032b15cb3dSCy Schubert< 8042b15cb3dSCy Schubert<kbd>n</kbd>). 8052b15cb3dSCy SchubertCopy the parameter file to alice and install a soft link 8062b15cb3dSCy Schubertfrom the generic 80709100258SXin LI<span class="file">ntpkey_mv_alice</span> 8082b15cb3dSCy Schubertto this file. 8092b15cb3dSCy SchubertCopy one of the client key files to alice for later distribution 8102b15cb3dSCy Schubertto her clients. 81109100258SXin LIIt does not matter which client key file goes to alice, 8122b15cb3dSCy Schubertsince they all work the same way. 81309100258SXin LIAlice copies the client key file to all of her clients. 8142b15cb3dSCy SchubertOn client bob install a soft link from generic 81509100258SXin LI<span class="file">ntpkey_mvkey_bob</span> 8162b15cb3dSCy Schubertto the client key file. 81709100258SXin LIAs the 81809100258SXin LI<code>MV</code> 81909100258SXin LIscheme is independent of keys and certificates, 8202b15cb3dSCy Schubertthese files can be refreshed as needed. 8212b15cb3dSCy Schubert 8222b15cb3dSCy Schubert<h5 class="subsubsection">Command Line Options</h5> 8232b15cb3dSCy Schubert 8242b15cb3dSCy Schubert <dl> 82509100258SXin LI<dt><code>-b</code> <code>--imbits</code>= <kbd>modulus</kbd><dd>Set the number of bits in the identity modulus for generating identity keys to 82609100258SXin LI<kbd>modulus</kbd> 82709100258SXin LIbits. 82809100258SXin LIThe number of bits in the identity modulus defaults to 256, but can be set to 82909100258SXin LIvalues from 256 to 2048 (32 to 256 octets). 83009100258SXin LIUse the larger moduli with caution, as this can consume considerable computing 83109100258SXin LIresources and increases the size of authenticated packets. 83209100258SXin LI<br><dt><code>-c</code> <code>--certificate</code>= <kbd>scheme</kbd><dd>Select certificate signature encryption/message digest scheme. 8332b15cb3dSCy SchubertThe 8342b15cb3dSCy Schubert<kbd>scheme</kbd> 8352b15cb3dSCy Schubertcan be one of the following: 83609100258SXin LI<code>RSA-MD2</code>, <code>RSA-MD5</code>, <code>RSA-MDC2</code>, <code>RSA-SHA</code>, <code>RSA-SHA1</code>, <code>RSA-RIPEMD160</code>, <code>DSA-SHA</code>, 8372b15cb3dSCy Schubertor 8382b15cb3dSCy Schubert<code>DSA-SHA1</code>. 83909100258SXin LINote that 84009100258SXin LI<code>RSA</code> 84109100258SXin LIschemes must be used with an 84209100258SXin LI<code>RSA</code> 84309100258SXin LIsign key and 84409100258SXin LI<code>DSA</code> 84509100258SXin LIschemes must be used with a 84609100258SXin LI<code>DSA</code> 84709100258SXin LIsign key. 8482b15cb3dSCy SchubertThe default without this option is 8492b15cb3dSCy Schubert<code>RSA-MD5</code>. 85009100258SXin LIIf compatibility with FIPS 140-2 is required, either the 85109100258SXin LI<code>DSA-SHA</code> 85209100258SXin LIor 85309100258SXin LI<code>DSA-SHA1</code> 85409100258SXin LIscheme must be used. 85509100258SXin LI<br><dt><code>-C</code> <code>--cipher</code>= <kbd>cipher</kbd><dd>Select the OpenSSL cipher to encrypt the files containing private keys. 85609100258SXin LIThe default without this option is three-key triple DES in CBC mode, 85709100258SXin LI<code>des-ede3-cbc</code>. 85809100258SXin LIThe 85909100258SXin LI<code>openssl</code> <code>-h</code> 86009100258SXin LIcommand provided with OpenSSL displays available ciphers. 86109100258SXin LI<br><dt><code>-d</code> <code>--debug-level</code><dd>Increase debugging verbosity level. 8622b15cb3dSCy SchubertThis option displays the cryptographic data produced in eye-friendly billboards. 86309100258SXin LI<br><dt><code>-D</code> <code>--set-debug-level</code>= <kbd>level</kbd><dd>Set the debugging verbosity to 86409100258SXin LI<kbd>level</kbd>. 86509100258SXin LIThis option displays the cryptographic data produced in eye-friendly billboards. 86609100258SXin LI<br><dt><code>-e</code> <code>--id-key</code><dd>Write the 86709100258SXin LI<code>IFF</code> 86809100258SXin LIor 86909100258SXin LI<code>GQ</code> 87009100258SXin LIpublic parameters from the 87109100258SXin LI<kbd>IFFkey</kbd> <kbd>or</kbd> <kbd>GQkey</kbd> 87209100258SXin LIclient keys file previously specified 87309100258SXin LIas unencrypted data to the standard output stream 87409100258SXin LI<span class="file">stdout</span>. 87509100258SXin LIThis is intended for automatic key distribution by email. 87609100258SXin LI<br><dt><code>-G</code> <code>--gq-params</code><dd>Generate a new encrypted 87709100258SXin LI<code>GQ</code> 87809100258SXin LIparameters and key file for the Guillou-Quisquater (GQ) identity scheme. 87909100258SXin LIThis option is mutually exclusive with the 88009100258SXin LI<code>-I</code> 88109100258SXin LIand 88209100258SXin LI<code>-V</code> 88309100258SXin LIoptions. 88409100258SXin LI<br><dt><code>-H</code> <code>--host-key</code><dd>Generate a new encrypted 88509100258SXin LI<code>RSA</code> 88609100258SXin LIpublic/private host key file. 88709100258SXin LI<br><dt><code>-I</code> <code>--iffkey</code><dd>Generate a new encrypted 88809100258SXin LI<code>IFF</code> 88909100258SXin LIkey file for the Schnorr (IFF) identity scheme. 89009100258SXin LIThis option is mutually exclusive with the 89109100258SXin LI<code>-G</code> 89209100258SXin LIand 89309100258SXin LIFl V 89409100258SXin LIoptions. 89509100258SXin LI<br><dt><code>-i</code> <code>--ident</code>= <kbd>group</kbd><dd>Set the optional Autokey group name to 89609100258SXin LI<kbd>group</kbd>. 89709100258SXin LIThis is used in the identity scheme parameter file names of 89809100258SXin LI<code>IFF</code>, <code>GQ</code>, 89909100258SXin LIand 90009100258SXin LI<code>MV</code> 90109100258SXin LIclient parameters files. 90209100258SXin LIIn that role, the default is the host name if no group is provided. 90309100258SXin LIThe group name, if specified using 90409100258SXin LI<code>-i</code> 90509100258SXin LIor 90609100258SXin LI<code>-s</code> 90709100258SXin LIfollowing an 90809100258SXin LI@ 90909100258SXin LIcharacter, is also used in certificate subject and issuer names in the form 91009100258SXin LI<kbd>host</kbd> <kbd>@</kbd> <kbd>group</kbd> 91109100258SXin LIand should match the group specified via 91209100258SXin LI<code>crypto</code> <code>ident</code> 91309100258SXin LIor 91409100258SXin LI<code>server</code> <code>ident</code> 91509100258SXin LIin the ntpd configuration file. 91609100258SXin LI<br><dt><code>-l</code> <code>--lifetime</code>= <kbd>days</kbd><dd>Set the lifetime for certificate expiration to 91709100258SXin LI<kbd>days</kbd>. 91809100258SXin LIThe default lifetime is one year (365 days). 91909100258SXin LI<br><dt><code>-m</code> <code>--modulus</code>= <kbd>bits</kbd><dd>Set the number of bits in the prime modulus for generating files to 92009100258SXin LI<kbd>bits</kbd>. 92109100258SXin LIThe modulus defaults to 512, but can be set from 256 to 2048 (32 to 256 octets). 92209100258SXin LIUse the larger moduli with caution, as this can consume considerable computing 92309100258SXin LIresources and increases the size of authenticated packets. 92409100258SXin LI<br><dt><code>-M</code> <code>--md5key</code><dd>Generate a new symmetric keys file containing 10 92509100258SXin LI<code>MD5</code> 92609100258SXin LIkeys, and if OpenSSL is available, 10 92709100258SXin LI<code>SHA</code> 92809100258SXin LIkeys. 92909100258SXin LIAn 93009100258SXin LI<code>MD5</code> 93109100258SXin LIkey is a string of 20 random printable ASCII characters, while a 93209100258SXin LI<code>SHA</code> 93309100258SXin LIkey is a string of 40 random hex digits. 93409100258SXin LIThe file can be edited using a text editor to change the key type or key content. 93509100258SXin LIThis option is mutually exclusive with all other options. 93609100258SXin LI<br><dt><code>-p</code> <code>--password</code>= <kbd>passwd</kbd><dd>Set the password for reading and writing encrypted files to 93709100258SXin LI<kbd>passwd</kbd>. 93809100258SXin LIThese include the host, sign and identify key files. 93909100258SXin LIBy default, the password is the string returned by the Unix 94009100258SXin LI<code>hostname</code> 94109100258SXin LIcommand. 94209100258SXin LI<br><dt><code>-P</code> <code>--pvt-cert</code><dd>Generate a new private certificate used by the 94309100258SXin LI<code>PC</code> 94409100258SXin LIidentity scheme. 9452b15cb3dSCy SchubertBy default, the program generates public certificates. 94609100258SXin LINote: the PC identity scheme is not recommended for new installations. 94709100258SXin LI<br><dt><code>-q</code> <code>--export-passwd</code>= <kbd>passwd</kbd><dd>Set the password for writing encrypted 94809100258SXin LI<code>IFF</code>, <code>GQ</code> <code>and</code> <code>MV</code> 94909100258SXin LIidentity files redirected to 95009100258SXin LI<span class="file">stdout</span> 95109100258SXin LIto 95209100258SXin LI<kbd>passwd</kbd>. 95309100258SXin LIIn effect, these files are decrypted with the 95409100258SXin LI<code>-p</code> 95509100258SXin LIpassword, then encrypted with the 95609100258SXin LI<code>-q</code> 95709100258SXin LIpassword. 95809100258SXin LIBy default, the password is the string returned by the Unix 95909100258SXin LI<code>hostname</code> 96009100258SXin LIcommand. 96109100258SXin LI<br><dt><code>-s</code> <code>--subject-key</code>= <code>[host]</code> <code>[@ </code><kbd>group</kbd><code>]</code><dd>Specify the Autokey host name, where 96209100258SXin LI<kbd>host</kbd> 96309100258SXin LIis the optional host name and 96409100258SXin LI<kbd>group</kbd> 96509100258SXin LIis the optional group name. 96609100258SXin LIThe host name, and if provided, group name are used in 96709100258SXin LI<kbd>host</kbd> <kbd>@</kbd> <kbd>group</kbd> 96809100258SXin LIform as certificate subject and issuer. 96909100258SXin LISpecifying 97009100258SXin LI<code>-s</code> <code>-@</code> <kbd>group</kbd> 97109100258SXin LIis allowed, and results in leaving the host name unchanged, as with 97209100258SXin LI<code>-i</code> <kbd>group</kbd>. 97309100258SXin LIThe group name, or if no group is provided, the host name are also used in the 97409100258SXin LIfile names of 97509100258SXin LI<code>IFF</code>, <code>GQ</code>, 97609100258SXin LIand 97709100258SXin LI<code>MV</code> 97809100258SXin LIidentity scheme client parameter files. 97909100258SXin LIIf 98009100258SXin LI<kbd>host</kbd> 98109100258SXin LIis not specified, the default host name is the string returned by the Unix 98209100258SXin LI<code>hostname</code> 98309100258SXin LIcommand. 98409100258SXin LI<br><dt><code>-S</code> <code>--sign-key</code>= <code>[RSA | DSA]</code><dd>Generate a new encrypted public/private sign key file of the specified type. 98509100258SXin LIBy default, the sign key is the host key and has the same type. 98609100258SXin LIIf compatibility with FIPS 140-2 is required, the sign key type must be 98709100258SXin LI<code>DSA</code>. 98809100258SXin LI<br><dt><code>-T</code> <code>--trusted-cert</code><dd>Generate a trusted certificate. 9892b15cb3dSCy SchubertBy default, the program generates a non-trusted certificate. 99009100258SXin LI<br><dt><code>-V</code> <code>--mv-params</code> <kbd>nkeys</kbd><dd>Generate 99109100258SXin LI<kbd>nkeys</kbd> 99209100258SXin LIencrypted server keys and parameters for the Mu-Varadharajan (MV) 99309100258SXin LIidentity scheme. 99409100258SXin LIThis option is mutually exclusive with the 99509100258SXin LI<code>-I</code> 99609100258SXin LIand 99709100258SXin LI<code>-G</code> 99809100258SXin LIoptions. 99909100258SXin LINote: support for this option should be considered a work in progress. 10002b15cb3dSCy Schubert</dl> 10012b15cb3dSCy Schubert 10022b15cb3dSCy Schubert<h5 class="subsubsection">Random Seed File</h5> 10032b15cb3dSCy Schubert 10042b15cb3dSCy Schubert<p>All cryptographically sound key generation schemes must have means 10052b15cb3dSCy Schubertto randomize the entropy seed used to initialize 10062b15cb3dSCy Schubertthe internal pseudo-random number generator used 10072b15cb3dSCy Schubertby the library routines. 10082b15cb3dSCy SchubertThe OpenSSL library uses a designated random seed file for this purpose. 10092b15cb3dSCy SchubertThe file must be available when starting the NTP daemon and 10102b15cb3dSCy Schubert<code>ntp-keygen</code> 10112b15cb3dSCy Schubertprogram. 10122b15cb3dSCy SchubertIf a site supports OpenSSL or its companion OpenSSH, 10132b15cb3dSCy Schubertit is very likely that means to do this are already available. 10142b15cb3dSCy Schubert 10152b15cb3dSCy Schubert <p>It is important to understand that entropy must be evolved 10162b15cb3dSCy Schubertfor each generation, for otherwise the random number sequence 10172b15cb3dSCy Schubertwould be predictable. 10182b15cb3dSCy SchubertVarious means dependent on external events, such as keystroke intervals, 10192b15cb3dSCy Schubertcan be used to do this and some systems have built-in entropy sources. 10202b15cb3dSCy SchubertSuitable means are described in the OpenSSL software documentation, 10212b15cb3dSCy Schubertbut are outside the scope of this page. 10222b15cb3dSCy Schubert 10232b15cb3dSCy Schubert <p>The entropy seed used by the OpenSSL library is contained in a file, 10242b15cb3dSCy Schubertusually called 102509100258SXin LI<span class="file">.rnd</span>, 10262b15cb3dSCy Schubertwhich must be available when starting the NTP daemon 10272b15cb3dSCy Schubertor the 10282b15cb3dSCy Schubert<code>ntp-keygen</code> 10292b15cb3dSCy Schubertprogram. 10302b15cb3dSCy SchubertThe NTP daemon will first look for the file 10312b15cb3dSCy Schubertusing the path specified by the 10322b15cb3dSCy Schubert<code>randfile</code> 10332b15cb3dSCy Schubertsubcommand of the 10342b15cb3dSCy Schubert<code>crypto</code> 10352b15cb3dSCy Schubertconfiguration command. 10362b15cb3dSCy SchubertIf not specified in this way, or when starting the 10372b15cb3dSCy Schubert<code>ntp-keygen</code> 10382b15cb3dSCy Schubertprogram, 10392b15cb3dSCy Schubertthe OpenSSL library will look for the file using the path specified 10402b15cb3dSCy Schubertby the 10412b15cb3dSCy Schubert.Ev RANDFILE 10422b15cb3dSCy Schubertenvironment variable in the user home directory, 10432b15cb3dSCy Schubertwhether root or some other user. 10442b15cb3dSCy SchubertIf the 10452b15cb3dSCy Schubert.Ev RANDFILE 10462b15cb3dSCy Schubertenvironment variable is not present, 10472b15cb3dSCy Schubertthe library will look for the 104809100258SXin LI<span class="file">.rnd</span> 10492b15cb3dSCy Schubertfile in the user home directory. 105009100258SXin LISince both the 105109100258SXin LI<code>ntp-keygen</code> 105209100258SXin LIprogram and 105309100258SXin LI<code>ntpd(1ntpdmdoc)</code> 105409100258SXin LIdaemon must run as root, the logical place to put this file is in 105509100258SXin LI<span class="file">/.rnd</span> 105609100258SXin LIor 105709100258SXin LI<span class="file">/root/.rnd</span>. 10582b15cb3dSCy SchubertIf the file is not available or cannot be written, 10592b15cb3dSCy Schubertthe daemon exits with a message to the system log and the program 10602b15cb3dSCy Schubertexits with a suitable error message. 10612b15cb3dSCy Schubert 10622b15cb3dSCy Schubert<h5 class="subsubsection">Cryptographic Data Files</h5> 10632b15cb3dSCy Schubert 106409100258SXin LI<p>All file formats begin with two nonencrypted lines. 106509100258SXin LIThe first line contains the file name, including the generated host name 106609100258SXin LIand filestamp, in the format 106709100258SXin LI<span class="file">ntpkey_</span><kbd>key</kbd> <kbd>_</kbd> <kbd>name</kbd>. <kbd>filestamp</kbd>, 106809100258SXin LIwhere 106909100258SXin LI<kbd>key</kbd> 107009100258SXin LIis the key or parameter type, 107109100258SXin LI<kbd>name</kbd> 107209100258SXin LIis the host or group name and 107309100258SXin LI<kbd>filestamp</kbd> 107409100258SXin LIis the filestamp (NTP seconds) when the file was created. 107509100258SXin LIBy convention, 107609100258SXin LI<kbd>key</kbd> 107709100258SXin LInames in generated file names include both upper and lower case 107809100258SXin LIcharacters, while 107909100258SXin LI<kbd>key</kbd> 108009100258SXin LInames in generated link names include only lower case characters. 108109100258SXin LIThe filestamp is not used in generated link names. 108209100258SXin LIThe second line contains the datestamp in conventional Unix 108309100258SXin LI<span class="file">date</span> 108409100258SXin LIformat. 108509100258SXin LILines beginning with 108609100258SXin LI# 108709100258SXin LIare considered comments and ignored by the 10882b15cb3dSCy Schubert<code>ntp-keygen</code> 10892b15cb3dSCy Schubertprogram and 10902b15cb3dSCy Schubert<code>ntpd(1ntpdmdoc)</code> 10912b15cb3dSCy Schubertdaemon. 10922b15cb3dSCy Schubert 109309100258SXin LI <p>The remainder of the file contains cryptographic data, encoded first using ASN.1 109409100258SXin LIrules, then encrypted if necessary, and finally written in PEM-encoded 109509100258SXin LIprintable ASCII text, preceded and followed by MIME content identifier lines. 109609100258SXin LI 109709100258SXin LI <p>The format of the symmetric keys file, ordinarily named 109809100258SXin LI<span class="file">ntp.keys</span>, 109909100258SXin LIis somewhat different than the other files in the interest of backward compatibility. 110009100258SXin LIOrdinarily, the file is generated by this program, but it can be constructed 110109100258SXin LIand edited using an ordinary text editor. 110209100258SXin LI<pre class="verbatim"> 110309100258SXin LI# ntpkey_MD5key_bk.ntp.org.3595864945 110409100258SXin LI# Thu Dec 12 19:22:25 2013 110509100258SXin LI 110609100258SXin LI1 MD5 L";Nw<\`.I<f4U0)247"i # MD5 key 110709100258SXin LI2 MD5 &>l0%XXK9O'51VwV<xq~ # MD5 key 110809100258SXin LI3 MD5 lb4zLW~d^!K:]RsD'qb6 # MD5 key 110909100258SXin LI4 MD5 Yue:tL[+vR)M\`n~bY,'? # MD5 key 111009100258SXin LI5 MD5 B;fx'Kgr/&4ZTbL6=RxA # MD5 key 111109100258SXin LI6 MD5 4eYwa\`o@}3i@@@@V@@..R9!l # MD5 key 111209100258SXin LI7 MD5 \`A.([h+;wTQ|xfi%Sn_! # MD5 key 111309100258SXin LI8 MD5 45:V,r4]l6y^JH6"Sh?F # MD5 key 111409100258SXin LI9 MD5 3-5vcn*6l29DS?Xdsg)* # MD5 key 111509100258SXin LI10 MD5 2late4Me # MD5 key 111609100258SXin LI11 SHA1 a27872d3030a9025b8446c751b4551a7629af65c # SHA1 key 111709100258SXin LI12 SHA1 21bc3b4865dbb9e920902abdccb3e04ff97a5e74 # SHA1 key 111809100258SXin LI13 SHA1 2b7736fe24fef5ba85ae11594132ab5d6f6daba9 # SHA1 key 111909100258SXin LI14 SHA a5332809c8878dd3a5b918819108a111509aeceb # SHA key 112009100258SXin LI15 MD2 2fe16c88c760ff2f16d4267e36c1aa6c926e6964 # MD2 key 112109100258SXin LI16 MD4 b2691811dc19cfc0e2f9bcacd74213f29812183d # MD4 key 112209100258SXin LI17 MD5 e4d6735b8bdad58ec5ffcb087300a17f7fef1f7c # MD5 key 112309100258SXin LI18 MDC2 a8d5e2315c025bf3a79174c87fbd10477de2eabc # MDC2 key 112409100258SXin LI19 RIPEMD160 77ca332cafb30e3cafb174dcd5b80ded7ba9b3d2 # RIPEMD160 key 112509100258SXin LI20 AES128CMAC f92ff73eee86c1e7dc638d6489a04e4e555af878 # AES128CMAC key 112609100258SXin LI</pre> 112709100258SXin LI<pre class="example"> Figure 1. Typical Symmetric Key File 112809100258SXin LI</pre> 112909100258SXin LI <p>Figure 1 shows a typical symmetric keys file used by the reference 113009100258SXin LIimplementation. 113109100258SXin LIFollowing the header the keys are entered one per line in the format 11322b15cb3dSCy Schubert<pre class="example"> <kbd>keyno</kbd> <kbd>type</kbd> <kbd>key</kbd> 11332b15cb3dSCy Schubert</pre> 11342b15cb3dSCy Schubert <p>where 11352b15cb3dSCy Schubert<kbd>keyno</kbd> 1136*4e1ef62aSXin LIis a positive integer in the range 1-65535; 11372b15cb3dSCy Schubert<kbd>type</kbd> 113809100258SXin LIis the key type for the message digest algorithm, which in the absence of the 113909100258SXin LIOpenSSL library must be 114009100258SXin LI<code>MD5</code> 114109100258SXin LIto designate the MD5 message digest algorithm; 114209100258SXin LIif the OpenSSL library is installed, the key type can be any 114309100258SXin LImessage digest algorithm supported by that library; 114409100258SXin LIhowever, if compatibility with FIPS 140-2 is required, 114509100258SXin LIthe key type must be either 114609100258SXin LI<code>SHA</code> 114709100258SXin LIor 114809100258SXin LI<code>SHA1</code>; 11492b15cb3dSCy Schubert<kbd>key</kbd> 11502b15cb3dSCy Schubertis the key itself, 115109100258SXin LIwhich is a printable ASCII string 20 characters or less in length: 115209100258SXin LIeach character is chosen from the 93 printable characters 115309100258SXin LIin the range 0x21 through 0x7e ( 115409100258SXin LI! 115509100258SXin LIthrough 115609100258SXin LI~ 115709100258SXin LI) excluding space and the 115809100258SXin LI# 115909100258SXin LIcharacter, and terminated by whitespace or a 11602b15cb3dSCy Schubert# 11612b15cb3dSCy Schubertcharacter. 116209100258SXin LIAn OpenSSL key consists of a hex-encoded ASCII string of 40 characters, which 116309100258SXin LIis truncated as necessary. 11642b15cb3dSCy Schubert 11652b15cb3dSCy Schubert <p>Note that the keys used by the 11662b15cb3dSCy Schubert<code>ntpq(1ntpqmdoc)</code> 11672b15cb3dSCy Schubertand 11682b15cb3dSCy Schubert<code>ntpdc(1ntpdcmdoc)</code> 11692b15cb3dSCy Schubertprograms 11702b15cb3dSCy Schubertare checked against passwords requested by the programs 11712b15cb3dSCy Schubertand entered by hand, so it is generally appropriate to specify these keys 11722b15cb3dSCy Schubertin human readable ASCII format. 11732b15cb3dSCy Schubert 11742b15cb3dSCy Schubert <p>The 11752b15cb3dSCy Schubert<code>ntp-keygen</code> 117609100258SXin LIprogram generates a symmetric keys file 117709100258SXin LI<span class="file">ntpkey_MD5key_</span><kbd>hostname</kbd>. <kbd>filestamp</kbd>. 11782b15cb3dSCy SchubertSince the file contains private shared keys, 11792b15cb3dSCy Schubertit should be visible only to root and distributed by secure means 11802b15cb3dSCy Schubertto other subnet hosts. 11812b15cb3dSCy SchubertThe NTP daemon loads the file 11822b15cb3dSCy Schubert<span class="file">ntp.keys</span>, 11832b15cb3dSCy Schubertso 11842b15cb3dSCy Schubert<code>ntp-keygen</code> 11852b15cb3dSCy Schubertinstalls a soft link from this name to the generated file. 11862b15cb3dSCy SchubertSubsequently, similar soft links must be installed by manual 11872b15cb3dSCy Schubertor automated means on the other subnet hosts. 11882b15cb3dSCy SchubertWhile this file is not used with the Autokey Version 2 protocol, 11892b15cb3dSCy Schubertit is needed to authenticate some remote configuration commands 11902b15cb3dSCy Schubertused by the 11912b15cb3dSCy Schubert<code>ntpq(1ntpqmdoc)</code> 11922b15cb3dSCy Schubertand 11932b15cb3dSCy Schubert<code>ntpdc(1ntpdcmdoc)</code> 11942b15cb3dSCy Schubertutilities. 11952b15cb3dSCy Schubert 11962b15cb3dSCy Schubert <p>This section was generated by <strong>AutoGen</strong>, 11972b15cb3dSCy Schubertusing the <code>agtexi-cmd</code> template and the option descriptions for the <code>ntp-keygen</code> program. 11982b15cb3dSCy SchubertThis software is released under the NTP license, <http://ntp.org/license>. 11992b15cb3dSCy Schubert 12002b15cb3dSCy Schubert<ul class="menu"> 12012b15cb3dSCy Schubert<li><a accesskey="1" href="#ntp_002dkeygen-usage">ntp-keygen usage</a>: ntp-keygen help/usage (<span class="option">--help</span>) 12022b15cb3dSCy Schubert<li><a accesskey="2" href="#ntp_002dkeygen-imbits">ntp-keygen imbits</a>: imbits option (-b) 12032b15cb3dSCy Schubert<li><a accesskey="3" href="#ntp_002dkeygen-certificate">ntp-keygen certificate</a>: certificate option (-c) 12042b15cb3dSCy Schubert<li><a accesskey="4" href="#ntp_002dkeygen-cipher">ntp-keygen cipher</a>: cipher option (-C) 12052b15cb3dSCy Schubert<li><a accesskey="5" href="#ntp_002dkeygen-id_002dkey">ntp-keygen id-key</a>: id-key option (-e) 12062b15cb3dSCy Schubert<li><a accesskey="6" href="#ntp_002dkeygen-gq_002dparams">ntp-keygen gq-params</a>: gq-params option (-G) 12072b15cb3dSCy Schubert<li><a accesskey="7" href="#ntp_002dkeygen-host_002dkey">ntp-keygen host-key</a>: host-key option (-H) 12082b15cb3dSCy Schubert<li><a accesskey="8" href="#ntp_002dkeygen-iffkey">ntp-keygen iffkey</a>: iffkey option (-I) 12092b15cb3dSCy Schubert<li><a accesskey="9" href="#ntp_002dkeygen-ident">ntp-keygen ident</a>: ident option (-i) 12102b15cb3dSCy Schubert<li><a href="#ntp_002dkeygen-lifetime">ntp-keygen lifetime</a>: lifetime option (-l) 12112b15cb3dSCy Schubert<li><a href="#ntp_002dkeygen-modulus">ntp-keygen modulus</a>: modulus option (-m) 121209100258SXin LI<li><a href="#ntp_002dkeygen-md5key">ntp-keygen md5key</a>: md5key option (-M) 12132b15cb3dSCy Schubert<li><a href="#ntp_002dkeygen-pvt_002dcert">ntp-keygen pvt-cert</a>: pvt-cert option (-P) 12142b15cb3dSCy Schubert<li><a href="#ntp_002dkeygen-password">ntp-keygen password</a>: password option (-p) 12152b15cb3dSCy Schubert<li><a href="#ntp_002dkeygen-export_002dpasswd">ntp-keygen export-passwd</a>: export-passwd option (-q) 12162b15cb3dSCy Schubert<li><a href="#ntp_002dkeygen-subject_002dname">ntp-keygen subject-name</a>: subject-name option (-s) 121709100258SXin LI<li><a href="#ntp_002dkeygen-sign_002dkey">ntp-keygen sign-key</a>: sign-key option (-S) 12182b15cb3dSCy Schubert<li><a href="#ntp_002dkeygen-trusted_002dcert">ntp-keygen trusted-cert</a>: trusted-cert option (-T) 12192b15cb3dSCy Schubert<li><a href="#ntp_002dkeygen-mv_002dparams">ntp-keygen mv-params</a>: mv-params option (-V) 12202b15cb3dSCy Schubert<li><a href="#ntp_002dkeygen-mv_002dkeys">ntp-keygen mv-keys</a>: mv-keys option (-v) 12212b15cb3dSCy Schubert<li><a href="#ntp_002dkeygen-config">ntp-keygen config</a>: presetting/configuring ntp-keygen 12222b15cb3dSCy Schubert<li><a href="#ntp_002dkeygen-exit-status">ntp-keygen exit status</a>: exit status 12232b15cb3dSCy Schubert<li><a href="#ntp_002dkeygen-Usage">ntp-keygen Usage</a>: Usage 12242b15cb3dSCy Schubert<li><a href="#ntp_002dkeygen-Notes">ntp-keygen Notes</a>: Notes 12252b15cb3dSCy Schubert<li><a href="#ntp_002dkeygen-Bugs">ntp-keygen Bugs</a>: Bugs 12262b15cb3dSCy Schubert</ul> 12272b15cb3dSCy Schubert 12282b15cb3dSCy Schubert<div class="node"> 12292b15cb3dSCy Schubert<p><hr> 12302b15cb3dSCy Schubert<a name="ntp_002dkeygen-usage"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-imbits">ntp-keygen imbits</a>, 12312b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 12322b15cb3dSCy Schubert<br> 12332b15cb3dSCy Schubert</div> 12342b15cb3dSCy Schubert 12352b15cb3dSCy Schubert<h4 class="subsection">ntp-keygen help/usage (<span class="option">--help</span>)</h4> 12362b15cb3dSCy Schubert 12372b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen-help-3"></a> 12382b15cb3dSCy SchubertThis is the automatically generated usage text for ntp-keygen. 12392b15cb3dSCy Schubert 12402b15cb3dSCy Schubert <p>The text printed is the same whether selected with the <code>help</code> option 12412b15cb3dSCy Schubert(<span class="option">--help</span>) or the <code>more-help</code> option (<span class="option">--more-help</span>). <code>more-help</code> will print 12422b15cb3dSCy Schubertthe usage text by passing it through a pager program. 12432b15cb3dSCy Schubert<code>more-help</code> is disabled on platforms without a working 12442b15cb3dSCy Schubert<code>fork(2)</code> function. The <code>PAGER</code> environment variable is 12452b15cb3dSCy Schubertused to select the program, defaulting to <span class="file">more</span>. Both will exit 12462b15cb3dSCy Schubertwith a status code of 0. 12472b15cb3dSCy Schubert 1248*4e1ef62aSXin LI<pre class="example">ntp-keygen (ntp) - Create a NTP host key - Ver. 4.2.8p11 12492b15cb3dSCy SchubertUsage: ntp-keygen [ -<flag> [<val>] | --<name>[{=| }<val>] ]... 12502b15cb3dSCy Schubert Flg Arg Option-Name Description 12512b15cb3dSCy Schubert -b Num imbits identity modulus bits 12522b15cb3dSCy Schubert - it must be in the range: 12532b15cb3dSCy Schubert 256 to 2048 12542b15cb3dSCy Schubert -c Str certificate certificate scheme 12552b15cb3dSCy Schubert -C Str cipher privatekey cipher 12562b15cb3dSCy Schubert -d no debug-level Increase debug verbosity level 12572b15cb3dSCy Schubert - may appear multiple times 12582b15cb3dSCy Schubert -D Num set-debug-level Set the debug verbosity level 12592b15cb3dSCy Schubert - may appear multiple times 12602b15cb3dSCy Schubert -e no id-key Write IFF or GQ identity keys 12612b15cb3dSCy Schubert -G no gq-params Generate GQ parameters and keys 12622b15cb3dSCy Schubert -H no host-key generate RSA host key 12632b15cb3dSCy Schubert -I no iffkey generate IFF parameters 12642b15cb3dSCy Schubert -i Str ident set Autokey group name 12652b15cb3dSCy Schubert -l Num lifetime set certificate lifetime 126609100258SXin LI -m Num modulus prime modulus 12672b15cb3dSCy Schubert - it must be in the range: 12682b15cb3dSCy Schubert 256 to 2048 126909100258SXin LI -M no md5key generate symmetric keys 12702b15cb3dSCy Schubert -P no pvt-cert generate PC private certificate 12712b15cb3dSCy Schubert -p Str password local private password 12722b15cb3dSCy Schubert -q Str export-passwd export IFF or GQ group keys with password 12732b15cb3dSCy Schubert -s Str subject-name set host and optionally group name 127409100258SXin LI -S Str sign-key generate sign key (RSA or DSA) 12752b15cb3dSCy Schubert -T no trusted-cert trusted certificate (TC scheme) 12762b15cb3dSCy Schubert -V Num mv-params generate <num> MV parameters 12772b15cb3dSCy Schubert -v Num mv-keys update <num> MV keys 12782b15cb3dSCy Schubert opt version output version information and exit 12792b15cb3dSCy Schubert -? no help display extended usage information and exit 12802b15cb3dSCy Schubert -! no more-help extended usage information passed thru pager 12812b15cb3dSCy Schubert -> opt save-opts save the option state to a config file 12822b15cb3dSCy Schubert -< Str load-opts load options from a config file 12832b15cb3dSCy Schubert - disabled as '--no-load-opts' 12842b15cb3dSCy Schubert - may appear multiple times 12852b15cb3dSCy Schubert 12862b15cb3dSCy SchubertOptions are specified by doubled hyphens and their name or by a single 12872b15cb3dSCy Schuberthyphen and the flag character. 12882b15cb3dSCy Schubert 12892b15cb3dSCy Schubert 12902b15cb3dSCy SchubertThe following option preset mechanisms are supported: 12912b15cb3dSCy Schubert - reading file $HOME/.ntprc 12922b15cb3dSCy Schubert - reading file ./.ntprc 12932b15cb3dSCy Schubert - examining environment variables named NTP_KEYGEN_* 12942b15cb3dSCy Schubert 12952b15cb3dSCy SchubertPlease send bug reports to: <http://bugs.ntp.org, bugs@ntp.org> 12962b15cb3dSCy Schubert</pre> 12972b15cb3dSCy Schubert <div class="node"> 12982b15cb3dSCy Schubert<p><hr> 12992b15cb3dSCy Schubert<a name="ntp_002dkeygen-imbits"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-certificate">ntp-keygen certificate</a>, 13002b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-usage">ntp-keygen usage</a>, 13012b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 13022b15cb3dSCy Schubert<br> 13032b15cb3dSCy Schubert</div> 13042b15cb3dSCy Schubert 13052b15cb3dSCy Schubert<h4 class="subsection">imbits option (-b)</h4> 13062b15cb3dSCy Schubert 13072b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002dimbits-4"></a> 13082b15cb3dSCy SchubertThis is the “identity modulus bits” option. 13092b15cb3dSCy SchubertThis option takes a number argument <span class="file">imbits</span>. 13102b15cb3dSCy Schubert 13112b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 13122b15cb3dSCy Schubert <ul> 13132b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 13142b15cb3dSCy Schubert</ul> 13152b15cb3dSCy Schubert 13162b15cb3dSCy Schubert <p>The number of bits in the identity modulus. The default is 256. 13172b15cb3dSCy Schubert<div class="node"> 13182b15cb3dSCy Schubert<p><hr> 13192b15cb3dSCy Schubert<a name="ntp_002dkeygen-certificate"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-cipher">ntp-keygen cipher</a>, 13202b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-imbits">ntp-keygen imbits</a>, 13212b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 13222b15cb3dSCy Schubert<br> 13232b15cb3dSCy Schubert</div> 13242b15cb3dSCy Schubert 13252b15cb3dSCy Schubert<h4 class="subsection">certificate option (-c)</h4> 13262b15cb3dSCy Schubert 13272b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002dcertificate-5"></a> 13282b15cb3dSCy SchubertThis is the “certificate scheme” option. 13292b15cb3dSCy SchubertThis option takes a string argument <span class="file">scheme</span>. 13302b15cb3dSCy Schubert 13312b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 13322b15cb3dSCy Schubert <ul> 13332b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 13342b15cb3dSCy Schubert</ul> 13352b15cb3dSCy Schubert 13362b15cb3dSCy Schubert <p>scheme is one of 133709100258SXin LIRSA-MD2, RSA-MD5, RSA-MDC2, RSA-SHA, RSA-SHA1, RSA-RIPEMD160, 13382b15cb3dSCy SchubertDSA-SHA, or DSA-SHA1. 13392b15cb3dSCy Schubert 134009100258SXin LI <p>Select the certificate signature encryption/message digest scheme. 13412b15cb3dSCy SchubertNote that RSA schemes must be used with a RSA sign key and DSA 13422b15cb3dSCy Schubertschemes must be used with a DSA sign key. The default without 13432b15cb3dSCy Schubertthis option is RSA-MD5. 13442b15cb3dSCy Schubert<div class="node"> 13452b15cb3dSCy Schubert<p><hr> 13462b15cb3dSCy Schubert<a name="ntp_002dkeygen-cipher"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-id_002dkey">ntp-keygen id-key</a>, 13472b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-certificate">ntp-keygen certificate</a>, 13482b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 13492b15cb3dSCy Schubert<br> 13502b15cb3dSCy Schubert</div> 13512b15cb3dSCy Schubert 13522b15cb3dSCy Schubert<h4 class="subsection">cipher option (-C)</h4> 13532b15cb3dSCy Schubert 13542b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002dcipher-6"></a> 13552b15cb3dSCy SchubertThis is the “privatekey cipher” option. 13562b15cb3dSCy SchubertThis option takes a string argument <span class="file">cipher</span>. 13572b15cb3dSCy Schubert 13582b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 13592b15cb3dSCy Schubert <ul> 13602b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 13612b15cb3dSCy Schubert</ul> 13622b15cb3dSCy Schubert 13632b15cb3dSCy Schubert <p>Select the cipher which is used to encrypt the files containing 13642b15cb3dSCy Schubertprivate keys. The default is three-key triple DES in CBC mode, 136509100258SXin LIequivalent to "<code>-C des-ede3-cbc</code>". The openssl tool lists ciphers 136609100258SXin LIavailable in "<code>openssl -h</code>" output. 136709100258SXin LI<div class="node"> 13682b15cb3dSCy Schubert<p><hr> 13692b15cb3dSCy Schubert<a name="ntp_002dkeygen-id_002dkey"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-gq_002dparams">ntp-keygen gq-params</a>, 13702b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-cipher">ntp-keygen cipher</a>, 13712b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 13722b15cb3dSCy Schubert<br> 13732b15cb3dSCy Schubert</div> 13742b15cb3dSCy Schubert 13752b15cb3dSCy Schubert<h4 class="subsection">id-key option (-e)</h4> 13762b15cb3dSCy Schubert 13772b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002did_002dkey-7"></a> 13782b15cb3dSCy SchubertThis is the “write iff or gq identity keys” option. 13792b15cb3dSCy Schubert 13802b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 13812b15cb3dSCy Schubert <ul> 13822b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 13832b15cb3dSCy Schubert</ul> 13842b15cb3dSCy Schubert 138509100258SXin LI <p>Write the public parameters from the IFF or GQ client keys to 138609100258SXin LIthe standard output. 138709100258SXin LIThis is intended for automatic key distribution by email. 13882b15cb3dSCy Schubert<div class="node"> 13892b15cb3dSCy Schubert<p><hr> 13902b15cb3dSCy Schubert<a name="ntp_002dkeygen-gq_002dparams"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-host_002dkey">ntp-keygen host-key</a>, 13912b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-id_002dkey">ntp-keygen id-key</a>, 13922b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 13932b15cb3dSCy Schubert<br> 13942b15cb3dSCy Schubert</div> 13952b15cb3dSCy Schubert 13962b15cb3dSCy Schubert<h4 class="subsection">gq-params option (-G)</h4> 13972b15cb3dSCy Schubert 13982b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002dgq_002dparams-8"></a> 13992b15cb3dSCy SchubertThis is the “generate gq parameters and keys” option. 14002b15cb3dSCy Schubert 14012b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 14022b15cb3dSCy Schubert <ul> 14032b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 14042b15cb3dSCy Schubert</ul> 14052b15cb3dSCy Schubert 14062b15cb3dSCy Schubert <p>Generate parameters and keys for the GQ identification scheme, 14072b15cb3dSCy Schubertobsoleting any that may exist. 14082b15cb3dSCy Schubert<div class="node"> 14092b15cb3dSCy Schubert<p><hr> 14102b15cb3dSCy Schubert<a name="ntp_002dkeygen-host_002dkey"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-iffkey">ntp-keygen iffkey</a>, 14112b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-gq_002dparams">ntp-keygen gq-params</a>, 14122b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 14132b15cb3dSCy Schubert<br> 14142b15cb3dSCy Schubert</div> 14152b15cb3dSCy Schubert 14162b15cb3dSCy Schubert<h4 class="subsection">host-key option (-H)</h4> 14172b15cb3dSCy Schubert 14182b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002dhost_002dkey-9"></a> 14192b15cb3dSCy SchubertThis is the “generate rsa host key” option. 14202b15cb3dSCy Schubert 14212b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 14222b15cb3dSCy Schubert <ul> 14232b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 14242b15cb3dSCy Schubert</ul> 14252b15cb3dSCy Schubert 14262b15cb3dSCy Schubert <p>Generate new host keys, obsoleting any that may exist. 14272b15cb3dSCy Schubert<div class="node"> 14282b15cb3dSCy Schubert<p><hr> 14292b15cb3dSCy Schubert<a name="ntp_002dkeygen-iffkey"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-ident">ntp-keygen ident</a>, 14302b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-host_002dkey">ntp-keygen host-key</a>, 14312b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 14322b15cb3dSCy Schubert<br> 14332b15cb3dSCy Schubert</div> 14342b15cb3dSCy Schubert 14352b15cb3dSCy Schubert<h4 class="subsection">iffkey option (-I)</h4> 14362b15cb3dSCy Schubert 14372b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002diffkey-10"></a> 14382b15cb3dSCy SchubertThis is the “generate iff parameters” option. 14392b15cb3dSCy Schubert 14402b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 14412b15cb3dSCy Schubert <ul> 14422b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 14432b15cb3dSCy Schubert</ul> 14442b15cb3dSCy Schubert 14452b15cb3dSCy Schubert <p>Generate parameters for the IFF identification scheme, obsoleting 14462b15cb3dSCy Schubertany that may exist. 14472b15cb3dSCy Schubert<div class="node"> 14482b15cb3dSCy Schubert<p><hr> 14492b15cb3dSCy Schubert<a name="ntp_002dkeygen-ident"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-lifetime">ntp-keygen lifetime</a>, 14502b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-iffkey">ntp-keygen iffkey</a>, 14512b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 14522b15cb3dSCy Schubert<br> 14532b15cb3dSCy Schubert</div> 14542b15cb3dSCy Schubert 14552b15cb3dSCy Schubert<h4 class="subsection">ident option (-i)</h4> 14562b15cb3dSCy Schubert 14572b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002dident-11"></a> 14582b15cb3dSCy SchubertThis is the “set autokey group name” option. 14592b15cb3dSCy SchubertThis option takes a string argument <span class="file">group</span>. 14602b15cb3dSCy Schubert 14612b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 14622b15cb3dSCy Schubert <ul> 14632b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 14642b15cb3dSCy Schubert</ul> 14652b15cb3dSCy Schubert 14662b15cb3dSCy Schubert <p>Set the optional Autokey group name to name. This is used in 14672b15cb3dSCy Schubertthe file name of IFF, GQ, and MV client parameters files. In 14682b15cb3dSCy Schubertthat role, the default is the host name if this option is not 14692b15cb3dSCy Schubertprovided. The group name, if specified using <code>-i/--ident</code> or 147009100258SXin LIusing <code>-s/--subject-name</code> following an '<code>@</code>' character, 147109100258SXin LIis also a part of the self-signed host certificate subject and 147209100258SXin LIissuer names in the form <code>host@group</code> and should match the 147309100258SXin LI'<code>crypto ident</code>' or '<code>server ident</code>' configuration in the 147409100258SXin LI<code>ntpd</code> configuration file. 147509100258SXin LI<div class="node"> 14762b15cb3dSCy Schubert<p><hr> 147709100258SXin LI<a name="ntp_002dkeygen-lifetime"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-modulus">ntp-keygen modulus</a>, 14782b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-ident">ntp-keygen ident</a>, 14792b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 14802b15cb3dSCy Schubert<br> 14812b15cb3dSCy Schubert</div> 14822b15cb3dSCy Schubert 14832b15cb3dSCy Schubert<h4 class="subsection">lifetime option (-l)</h4> 14842b15cb3dSCy Schubert 14852b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002dlifetime-12"></a> 148609100258SXin LIThis is the “set certificate lifetime” option. 14872b15cb3dSCy SchubertThis option takes a number argument <span class="file">lifetime</span>. 14882b15cb3dSCy Schubert 14892b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 14902b15cb3dSCy Schubert <ul> 14912b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 14922b15cb3dSCy Schubert</ul> 14932b15cb3dSCy Schubert 14942b15cb3dSCy Schubert <p>Set the certificate expiration to lifetime days from now. 14952b15cb3dSCy Schubert<div class="node"> 14962b15cb3dSCy Schubert<p><hr> 149709100258SXin LI<a name="ntp_002dkeygen-modulus"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-md5key">ntp-keygen md5key</a>, 14982b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-lifetime">ntp-keygen lifetime</a>, 14992b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 15002b15cb3dSCy Schubert<br> 15012b15cb3dSCy Schubert</div> 15022b15cb3dSCy Schubert 15032b15cb3dSCy Schubert<h4 class="subsection">modulus option (-m)</h4> 15042b15cb3dSCy Schubert 150509100258SXin LI<p><a name="index-ntp_002dkeygen_002dmodulus-13"></a> 150609100258SXin LIThis is the “prime modulus” option. 15072b15cb3dSCy SchubertThis option takes a number argument <span class="file">modulus</span>. 15082b15cb3dSCy Schubert 15092b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 15102b15cb3dSCy Schubert <ul> 15112b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 15122b15cb3dSCy Schubert</ul> 15132b15cb3dSCy Schubert 15142b15cb3dSCy Schubert <p>The number of bits in the prime modulus. The default is 512. 15152b15cb3dSCy Schubert<div class="node"> 15162b15cb3dSCy Schubert<p><hr> 151709100258SXin LI<a name="ntp_002dkeygen-md5key"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-pvt_002dcert">ntp-keygen pvt-cert</a>, 15182b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-modulus">ntp-keygen modulus</a>, 15192b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 15202b15cb3dSCy Schubert<br> 15212b15cb3dSCy Schubert</div> 15222b15cb3dSCy Schubert 152309100258SXin LI<h4 class="subsection">md5key option (-M)</h4> 152409100258SXin LI 152509100258SXin LI<p><a name="index-ntp_002dkeygen_002dmd5key-14"></a> 152609100258SXin LIThis is the “generate symmetric keys” option. 152709100258SXin LIGenerate symmetric keys, obsoleting any that may exist. 152809100258SXin LI<div class="node"> 152909100258SXin LI<p><hr> 153009100258SXin LI<a name="ntp_002dkeygen-pvt_002dcert"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-password">ntp-keygen password</a>, 153109100258SXin LIPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-md5key">ntp-keygen md5key</a>, 153209100258SXin LIUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 153309100258SXin LI<br> 153409100258SXin LI</div> 153509100258SXin LI 15362b15cb3dSCy Schubert<h4 class="subsection">pvt-cert option (-P)</h4> 15372b15cb3dSCy Schubert 15382b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002dpvt_002dcert-15"></a> 153909100258SXin LIThis is the “generate pc private certificate” option. 15402b15cb3dSCy Schubert 15412b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 15422b15cb3dSCy Schubert <ul> 15432b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 15442b15cb3dSCy Schubert</ul> 15452b15cb3dSCy Schubert 15462b15cb3dSCy Schubert <p>Generate a private certificate. By default, the program generates 15472b15cb3dSCy Schubertpublic certificates. 15482b15cb3dSCy Schubert<div class="node"> 15492b15cb3dSCy Schubert<p><hr> 15502b15cb3dSCy Schubert<a name="ntp_002dkeygen-password"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-export_002dpasswd">ntp-keygen export-passwd</a>, 15512b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-pvt_002dcert">ntp-keygen pvt-cert</a>, 15522b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 15532b15cb3dSCy Schubert<br> 15542b15cb3dSCy Schubert</div> 15552b15cb3dSCy Schubert 15562b15cb3dSCy Schubert<h4 class="subsection">password option (-p)</h4> 15572b15cb3dSCy Schubert 15582b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002dpassword-16"></a> 155909100258SXin LIThis is the “local private password” option. 15602b15cb3dSCy SchubertThis option takes a string argument <span class="file">passwd</span>. 15612b15cb3dSCy Schubert 15622b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 15632b15cb3dSCy Schubert <ul> 15642b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 15652b15cb3dSCy Schubert</ul> 15662b15cb3dSCy Schubert 15672b15cb3dSCy Schubert <p>Local files containing private data are encrypted with the 15682b15cb3dSCy SchubertDES-CBC algorithm and the specified password. The same password 15692b15cb3dSCy Schubertmust be specified to the local ntpd via the "crypto pw password" 15702b15cb3dSCy Schubertconfiguration command. The default password is the local 15712b15cb3dSCy Schuberthostname. 15722b15cb3dSCy Schubert<div class="node"> 15732b15cb3dSCy Schubert<p><hr> 157409100258SXin LI<a name="ntp_002dkeygen-export_002dpasswd"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-subject_002dname">ntp-keygen subject-name</a>, 15752b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-password">ntp-keygen password</a>, 15762b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 15772b15cb3dSCy Schubert<br> 15782b15cb3dSCy Schubert</div> 15792b15cb3dSCy Schubert 15802b15cb3dSCy Schubert<h4 class="subsection">export-passwd option (-q)</h4> 15812b15cb3dSCy Schubert 15822b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002dexport_002dpasswd-17"></a> 158309100258SXin LIThis is the “export iff or gq group keys with password” option. 15842b15cb3dSCy SchubertThis option takes a string argument <span class="file">passwd</span>. 15852b15cb3dSCy Schubert 15862b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 15872b15cb3dSCy Schubert <ul> 15882b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 15892b15cb3dSCy Schubert</ul> 15902b15cb3dSCy Schubert 15912b15cb3dSCy Schubert <p>Export IFF or GQ identity group keys to the standard output, 15922b15cb3dSCy Schubertencrypted with the DES-CBC algorithm and the specified password. 15932b15cb3dSCy SchubertThe same password must be specified to the remote ntpd via the 15942b15cb3dSCy Schubert"crypto pw password" configuration command. See also the option 159509100258SXin LI–id-key (-e) for unencrypted exports. 15962b15cb3dSCy Schubert<div class="node"> 15972b15cb3dSCy Schubert<p><hr> 159809100258SXin LI<a name="ntp_002dkeygen-subject_002dname"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-sign_002dkey">ntp-keygen sign-key</a>, 15992b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-export_002dpasswd">ntp-keygen export-passwd</a>, 16002b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 16012b15cb3dSCy Schubert<br> 16022b15cb3dSCy Schubert</div> 16032b15cb3dSCy Schubert 160409100258SXin LI<h4 class="subsection">subject-name option (-s)</h4> 160509100258SXin LI 160609100258SXin LI<p><a name="index-ntp_002dkeygen_002dsubject_002dname-18"></a> 160709100258SXin LIThis is the “set host and optionally group name” option. 160809100258SXin LIThis option takes a string argument <span class="file">host@group</span>. 160909100258SXin LI 161009100258SXin LI<p class="noindent">This option has some usage constraints. It: 161109100258SXin LI <ul> 161209100258SXin LI<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 161309100258SXin LI</ul> 161409100258SXin LI 161509100258SXin LI <p>Set the Autokey host name, and optionally, group name specified 161609100258SXin LIfollowing an '<code>@</code>' character. The host name is used in the file 161709100258SXin LIname of generated host and signing certificates, without the 161809100258SXin LIgroup name. The host name, and if provided, group name are used 161909100258SXin LIin <code>host@group</code> form for the host certificate subject and issuer 162009100258SXin LIfields. Specifying '<code>-s @group</code>' is allowed, and results in 162109100258SXin LIleaving the host name unchanged while appending <code>@group</code> to the 162209100258SXin LIsubject and issuer fields, as with <code>-i group</code>. The group name, or 162309100258SXin LIif not provided, the host name are also used in the file names 162409100258SXin LIof IFF, GQ, and MV client parameter files. 162509100258SXin LI<div class="node"> 162609100258SXin LI<p><hr> 162709100258SXin LI<a name="ntp_002dkeygen-sign_002dkey"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-trusted_002dcert">ntp-keygen trusted-cert</a>, 162809100258SXin LIPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-subject_002dname">ntp-keygen subject-name</a>, 162909100258SXin LIUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 163009100258SXin LI<br> 163109100258SXin LI</div> 163209100258SXin LI 16332b15cb3dSCy Schubert<h4 class="subsection">sign-key option (-S)</h4> 16342b15cb3dSCy Schubert 163509100258SXin LI<p><a name="index-ntp_002dkeygen_002dsign_002dkey-19"></a> 163609100258SXin LIThis is the “generate sign key (rsa or dsa)” option. 16372b15cb3dSCy SchubertThis option takes a string argument <span class="file">sign</span>. 16382b15cb3dSCy Schubert 16392b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 16402b15cb3dSCy Schubert <ul> 16412b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 16422b15cb3dSCy Schubert</ul> 16432b15cb3dSCy Schubert 16442b15cb3dSCy Schubert <p>Generate a new sign key of the designated type, obsoleting any 16452b15cb3dSCy Schubertthat may exist. By default, the program uses the host key as the 16462b15cb3dSCy Schubertsign key. 16472b15cb3dSCy Schubert<div class="node"> 16482b15cb3dSCy Schubert<p><hr> 16492b15cb3dSCy Schubert<a name="ntp_002dkeygen-trusted_002dcert"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-mv_002dparams">ntp-keygen mv-params</a>, 165009100258SXin LIPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-sign_002dkey">ntp-keygen sign-key</a>, 16512b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 16522b15cb3dSCy Schubert<br> 16532b15cb3dSCy Schubert</div> 16542b15cb3dSCy Schubert 16552b15cb3dSCy Schubert<h4 class="subsection">trusted-cert option (-T)</h4> 16562b15cb3dSCy Schubert 16572b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002dtrusted_002dcert-20"></a> 165809100258SXin LIThis is the “trusted certificate (tc scheme)” option. 16592b15cb3dSCy Schubert 16602b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 16612b15cb3dSCy Schubert <ul> 16622b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 16632b15cb3dSCy Schubert</ul> 16642b15cb3dSCy Schubert 16652b15cb3dSCy Schubert <p>Generate a trusted certificate. By default, the program generates 16662b15cb3dSCy Schuberta non-trusted certificate. 16672b15cb3dSCy Schubert<div class="node"> 16682b15cb3dSCy Schubert<p><hr> 16692b15cb3dSCy Schubert<a name="ntp_002dkeygen-mv_002dparams"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-mv_002dkeys">ntp-keygen mv-keys</a>, 16702b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-trusted_002dcert">ntp-keygen trusted-cert</a>, 16712b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 16722b15cb3dSCy Schubert<br> 16732b15cb3dSCy Schubert</div> 16742b15cb3dSCy Schubert 16752b15cb3dSCy Schubert<h4 class="subsection">mv-params option (-V)</h4> 16762b15cb3dSCy Schubert 16772b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002dmv_002dparams-21"></a> 167809100258SXin LIThis is the “generate <num> mv parameters” option. 16792b15cb3dSCy SchubertThis option takes a number argument <span class="file">num</span>. 16802b15cb3dSCy Schubert 16812b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 16822b15cb3dSCy Schubert <ul> 16832b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 16842b15cb3dSCy Schubert</ul> 16852b15cb3dSCy Schubert 16862b15cb3dSCy Schubert <p>Generate parameters and keys for the Mu-Varadharajan (MV) 16872b15cb3dSCy Schubertidentification scheme. 16882b15cb3dSCy Schubert<div class="node"> 16892b15cb3dSCy Schubert<p><hr> 16902b15cb3dSCy Schubert<a name="ntp_002dkeygen-mv_002dkeys"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-config">ntp-keygen config</a>, 16912b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-mv_002dparams">ntp-keygen mv-params</a>, 16922b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 16932b15cb3dSCy Schubert<br> 16942b15cb3dSCy Schubert</div> 16952b15cb3dSCy Schubert 16962b15cb3dSCy Schubert<h4 class="subsection">mv-keys option (-v)</h4> 16972b15cb3dSCy Schubert 16982b15cb3dSCy Schubert<p><a name="index-ntp_002dkeygen_002dmv_002dkeys-22"></a> 169909100258SXin LIThis is the “update <num> mv keys” option. 17002b15cb3dSCy SchubertThis option takes a number argument <span class="file">num</span>. 17012b15cb3dSCy Schubert 17022b15cb3dSCy Schubert<p class="noindent">This option has some usage constraints. It: 17032b15cb3dSCy Schubert <ul> 17042b15cb3dSCy Schubert<li>must be compiled in by defining <code>AUTOKEY</code> during the compilation. 17052b15cb3dSCy Schubert</ul> 17062b15cb3dSCy Schubert 17072b15cb3dSCy Schubert <p>This option has no <span class="samp">doc</span> documentation. 17082b15cb3dSCy Schubert 17092b15cb3dSCy Schubert<div class="node"> 17102b15cb3dSCy Schubert<p><hr> 17112b15cb3dSCy Schubert<a name="ntp_002dkeygen-config"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-exit-status">ntp-keygen exit status</a>, 17122b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-mv_002dkeys">ntp-keygen mv-keys</a>, 17132b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 17142b15cb3dSCy Schubert<br> 17152b15cb3dSCy Schubert</div> 17162b15cb3dSCy Schubert 17172b15cb3dSCy Schubert<h4 class="subsection">presetting/configuring ntp-keygen</h4> 17182b15cb3dSCy Schubert 17192b15cb3dSCy Schubert<p>Any option that is not marked as <i>not presettable</i> may be preset by 17202b15cb3dSCy Schubertloading values from configuration ("rc" or "ini") files, and values from environment variables named <code>NTP-KEYGEN</code> and <code>NTP-KEYGEN_<OPTION_NAME></code>. <code><OPTION_NAME></code> must be one of 17212b15cb3dSCy Schubertthe options listed above in upper case and segmented with underscores. 17222b15cb3dSCy SchubertThe <code>NTP-KEYGEN</code> variable will be tokenized and parsed like 17232b15cb3dSCy Schubertthe command line. The remaining variables are tested for existence and their 17242b15cb3dSCy Schubertvalues are treated like option arguments. 17252b15cb3dSCy Schubert 17262b15cb3dSCy Schubert<p class="noindent"><code>libopts</code> will search in 2 places for configuration files: 17272b15cb3dSCy Schubert <ul> 17282b15cb3dSCy Schubert<li>$HOME 17292b15cb3dSCy Schubert<li>$PWD 17302b15cb3dSCy Schubert</ul> 17312b15cb3dSCy Schubert The environment variables <code>HOME</code>, and <code>PWD</code> 17322b15cb3dSCy Schubertare expanded and replaced when <span class="file">ntp-keygen</span> runs. 17332b15cb3dSCy SchubertFor any of these that are plain files, they are simply processed. 17342b15cb3dSCy SchubertFor any that are directories, then a file named <span class="file">.ntprc</span> is searched for 17352b15cb3dSCy Schubertwithin that directory and processed. 17362b15cb3dSCy Schubert 17372b15cb3dSCy Schubert <p>Configuration files may be in a wide variety of formats. 17382b15cb3dSCy SchubertThe basic format is an option name followed by a value (argument) on the 17392b15cb3dSCy Schubertsame line. Values may be separated from the option name with a colon, 17402b15cb3dSCy Schubertequal sign or simply white space. Values may be continued across multiple 17412b15cb3dSCy Schubertlines by escaping the newline with a backslash. 17422b15cb3dSCy Schubert 17432b15cb3dSCy Schubert <p>Multiple programs may also share the same initialization file. 17442b15cb3dSCy SchubertCommon options are collected at the top, followed by program specific 17452b15cb3dSCy Schubertsegments. The segments are separated by lines like: 17462b15cb3dSCy Schubert<pre class="example"> [NTP-KEYGEN] 17472b15cb3dSCy Schubert</pre> 17482b15cb3dSCy Schubert <p class="noindent">or by 17492b15cb3dSCy Schubert<pre class="example"> <?program ntp-keygen> 17502b15cb3dSCy Schubert</pre> 17512b15cb3dSCy Schubert <p class="noindent">Do not mix these styles within one configuration file. 17522b15cb3dSCy Schubert 17532b15cb3dSCy Schubert <p>Compound values and carefully constructed string values may also be 17542b15cb3dSCy Schubertspecified using XML syntax: 17552b15cb3dSCy Schubert<pre class="example"> <option-name> 17562b15cb3dSCy Schubert <sub-opt>...&lt;...&gt;...</sub-opt> 17572b15cb3dSCy Schubert </option-name> 17582b15cb3dSCy Schubert</pre> 17592b15cb3dSCy Schubert <p class="noindent">yielding an <code>option-name.sub-opt</code> string value of 17602b15cb3dSCy Schubert<pre class="example"> "...<...>..." 17612b15cb3dSCy Schubert</pre> 17622b15cb3dSCy Schubert <p><code>AutoOpts</code> does not track suboptions. You simply note that it is a 17632b15cb3dSCy Schuberthierarchicly valued option. <code>AutoOpts</code> does provide a means for searching 17642b15cb3dSCy Schubertthe associated name/value pair list (see: optionFindValue). 17652b15cb3dSCy Schubert 17662b15cb3dSCy Schubert <p>The command line options relating to configuration and/or usage help are: 17672b15cb3dSCy Schubert 17682b15cb3dSCy Schubert<h5 class="subsubheading">version (-)</h5> 17692b15cb3dSCy Schubert 17702b15cb3dSCy Schubert<p>Print the program version to standard out, optionally with licensing 17712b15cb3dSCy Schubertinformation, then exit 0. The optional argument specifies how much licensing 17722b15cb3dSCy Schubertdetail to provide. The default is to print just the version. The licensing infomation may be selected with an option argument. 17732b15cb3dSCy SchubertOnly the first letter of the argument is examined: 17742b15cb3dSCy Schubert 17752b15cb3dSCy Schubert <dl> 17762b15cb3dSCy Schubert<dt><span class="samp">version</span><dd>Only print the version. This is the default. 17772b15cb3dSCy Schubert<br><dt><span class="samp">copyright</span><dd>Name the copyright usage licensing terms. 17782b15cb3dSCy Schubert<br><dt><span class="samp">verbose</span><dd>Print the full copyright usage licensing terms. 17792b15cb3dSCy Schubert</dl> 17802b15cb3dSCy Schubert 17812b15cb3dSCy Schubert<div class="node"> 17822b15cb3dSCy Schubert<p><hr> 17832b15cb3dSCy Schubert<a name="ntp_002dkeygen-exit-status"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-Usage">ntp-keygen Usage</a>, 17842b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-config">ntp-keygen config</a>, 17852b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 17862b15cb3dSCy Schubert<br> 17872b15cb3dSCy Schubert</div> 17882b15cb3dSCy Schubert 17892b15cb3dSCy Schubert<h4 class="subsection">ntp-keygen exit status</h4> 17902b15cb3dSCy Schubert 17912b15cb3dSCy Schubert<p>One of the following exit values will be returned: 17922b15cb3dSCy Schubert <dl> 17932b15cb3dSCy Schubert<dt><span class="samp">0 (EXIT_SUCCESS)</span><dd>Successful program execution. 17942b15cb3dSCy Schubert<br><dt><span class="samp">1 (EXIT_FAILURE)</span><dd>The operation failed or the command syntax was not valid. 17952b15cb3dSCy Schubert<br><dt><span class="samp">66 (EX_NOINPUT)</span><dd>A specified configuration file could not be loaded. 17962b15cb3dSCy Schubert<br><dt><span class="samp">70 (EX_SOFTWARE)</span><dd>libopts had an internal operational error. Please report 17972b15cb3dSCy Schubertit to autogen-users@lists.sourceforge.net. Thank you. 17982b15cb3dSCy Schubert</dl> 17992b15cb3dSCy Schubert <div class="node"> 18002b15cb3dSCy Schubert<p><hr> 18012b15cb3dSCy Schubert<a name="ntp_002dkeygen-Usage"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-Notes">ntp-keygen Notes</a>, 18022b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-exit-status">ntp-keygen exit status</a>, 18032b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 18042b15cb3dSCy Schubert<br> 18052b15cb3dSCy Schubert</div> 18062b15cb3dSCy Schubert 18072b15cb3dSCy Schubert<h4 class="subsection">ntp-keygen Usage</h4> 18082b15cb3dSCy Schubert 18092b15cb3dSCy Schubert<div class="node"> 18102b15cb3dSCy Schubert<p><hr> 18112b15cb3dSCy Schubert<a name="ntp_002dkeygen-Notes"></a>Next: <a rel="next" accesskey="n" href="#ntp_002dkeygen-Bugs">ntp-keygen Bugs</a>, 18122b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-Usage">ntp-keygen Usage</a>, 18132b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 18142b15cb3dSCy Schubert<br> 18152b15cb3dSCy Schubert</div> 18162b15cb3dSCy Schubert 18172b15cb3dSCy Schubert<h4 class="subsection">ntp-keygen Notes</h4> 18182b15cb3dSCy Schubert 18192b15cb3dSCy Schubert<div class="node"> 18202b15cb3dSCy Schubert<p><hr> 18212b15cb3dSCy Schubert<a name="ntp_002dkeygen-Bugs"></a>Previous: <a rel="previous" accesskey="p" href="#ntp_002dkeygen-Notes">ntp-keygen Notes</a>, 18222b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#ntp_002dkeygen-Invocation">ntp-keygen Invocation</a> 18232b15cb3dSCy Schubert<br> 18242b15cb3dSCy Schubert</div> 18252b15cb3dSCy Schubert 18262b15cb3dSCy Schubert<h4 class="subsection">ntp-keygen Bugs</h4> 18272b15cb3dSCy Schubert 18282b15cb3dSCy Schubert<div class="node"> 18292b15cb3dSCy Schubert<p><hr> 18302b15cb3dSCy Schubert<a name="Random-Seed-File"></a>Next: <a rel="next" accesskey="n" href="#Cryptographic-Data-Files">Cryptographic Data Files</a>, 18312b15cb3dSCy SchubertPrevious: <a rel="previous" accesskey="p" href="#Running-the-Program">Running the Program</a>, 18322b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#Top">Top</a> 18332b15cb3dSCy Schubert<br> 18342b15cb3dSCy Schubert</div> 18352b15cb3dSCy Schubert 18362b15cb3dSCy Schubert<!-- node-name, next, previous, up --> 18372b15cb3dSCy Schubert<h3 class="section">Random Seed File</h3> 18382b15cb3dSCy Schubert 18392b15cb3dSCy Schubert<p>All cryptographically sound key generation schemes must have means to 18402b15cb3dSCy Schubertrandomize the entropy seed used to initialize the internal 18412b15cb3dSCy Schubertpseudo-random number generator used by the OpenSSL library routines. 18422b15cb3dSCy SchubertIf a site supports ssh, it is very likely that means to do this are 18432b15cb3dSCy Schubertalready available. 18442b15cb3dSCy SchubertThe entropy seed used by the OpenSSL library is contained in a file, 18452b15cb3dSCy Schubertusually called <code>.rnd</code>, which must be available when 18462b15cb3dSCy Schubertstarting the <code>ntp-keygen</code> program or <code>ntpd</code> daemon. 18472b15cb3dSCy Schubert 18482b15cb3dSCy Schubert <p>The OpenSSL library looks for the file using the path specified by the 18492b15cb3dSCy Schubert<code>RANDFILE</code> environment variable in the user home directory, whether root 18502b15cb3dSCy Schubertor some other user. 18512b15cb3dSCy SchubertIf the <code>RANDFILE</code> environment variable is not 18522b15cb3dSCy Schubertpresent, the library looks for the <code>.rnd</code> file in the user home 18532b15cb3dSCy Schubertdirectory. 18542b15cb3dSCy SchubertSince both the <code>ntp-keygen</code> program and <code>ntpd</code> daemon must run 18552b15cb3dSCy Schubertas root, the logical place to put this file is in <code>/.rnd</code> or 18562b15cb3dSCy Schubert<code>/root/.rnd</code>. 18572b15cb3dSCy SchubertIf the file is not available or cannot be written, the program exits 18582b15cb3dSCy Schubertwith a message to the system log. 18592b15cb3dSCy Schubert 18602b15cb3dSCy Schubert<div class="node"> 18612b15cb3dSCy Schubert<p><hr> 18622b15cb3dSCy Schubert<a name="Cryptographic-Data-Files"></a>Previous: <a rel="previous" accesskey="p" href="#Random-Seed-File">Random Seed File</a>, 18632b15cb3dSCy SchubertUp: <a rel="up" accesskey="u" href="#Top">Top</a> 18642b15cb3dSCy Schubert<br> 18652b15cb3dSCy Schubert</div> 18662b15cb3dSCy Schubert 18672b15cb3dSCy Schubert<!-- node-name, next, previous, up --> 18682b15cb3dSCy Schubert<h3 class="section">Cryptographic Data Files</h3> 18692b15cb3dSCy Schubert 18702b15cb3dSCy Schubert<p>File and link names are in the <code>form ntpkey_key_name.fstamp</code>, 18712b15cb3dSCy Schubertwhere <code>key</code> is the key or parameter type, 18722b15cb3dSCy Schubert<code>name</code> is the host or group name and 18732b15cb3dSCy Schubert<code>fstamp</code> is the filestamp (NTP seconds) when the file was created). 18742b15cb3dSCy SchubertBy convention, key names in generated file names include both upper and 18752b15cb3dSCy Schubertlower case characters, while key names in generated link names include 18762b15cb3dSCy Schubertonly lower case characters. The filestamp is not used in generated link 18772b15cb3dSCy Schubertnames. 18782b15cb3dSCy Schubert 18792b15cb3dSCy Schubert <p>The key name is a string defining the cryptographic key type. 18802b15cb3dSCy SchubertKey types include public/private keys host and sign, certificate cert 18812b15cb3dSCy Schubertand several challenge/response key types. 18822b15cb3dSCy SchubertBy convention, client files used for 18832b15cb3dSCy Schubertchallenges have a par subtype, as in the IFF challenge IFFpar, while 18842b15cb3dSCy Schubertserver files for responses have a key subtype, as in the GQ response 18852b15cb3dSCy SchubertGQkey. 18862b15cb3dSCy Schubert 18872b15cb3dSCy Schubert <p>All files begin with two nonencrypted lines. The first line contains 18882b15cb3dSCy Schubertthe file name in the format <code>ntpkey_key_host.fstamp</code>. 18892b15cb3dSCy SchubertThe second line contains the datestamp in conventional Unix date format. 18902b15cb3dSCy SchubertLines beginning with <code>#</code> are ignored. 18912b15cb3dSCy Schubert 18922b15cb3dSCy Schubert <p>The remainder of the file contains cryptographic data encoded first 18932b15cb3dSCy Schubertusing ASN.1 rules, then encrypted using the DES-CBC algorithm with 18942b15cb3dSCy Schubertgiven password and finally written in PEM-encoded printable ASCII text 18952b15cb3dSCy Schubertpreceded and followed by MIME content identifier lines. 18962b15cb3dSCy Schubert 18972b15cb3dSCy Schubert <p>The format of the symmetric keys file, ordinarily named <code>ntp.keys</code>, 18982b15cb3dSCy Schubertis somewhat different than the other files in the interest of backward 18992b15cb3dSCy Schubertcompatibility. 19002b15cb3dSCy SchubertOrdinarily, the file is generated by this program, but 19012b15cb3dSCy Schubertit can be constructed and edited using an ordinary text editor. 19022b15cb3dSCy Schubert 19032b15cb3dSCy Schubert<pre class="example"> # ntpkey_MD5key_hms.local.3564038757 19042b15cb3dSCy Schubert # Sun Dec 9 02:45:57 2012 19052b15cb3dSCy Schubert 19062b15cb3dSCy Schubert 1 MD5 "]!ghT%O;3)WJ,/Nc:>I # MD5 key 19072b15cb3dSCy Schubert 2 MD5 lu+H^tF46BKR-6~pV_5 # MD5 key 19082b15cb3dSCy Schubert 3 MD5 :lnoVsE%Yz*avh%EtNC # MD5 key 19092b15cb3dSCy Schubert 4 MD5 |fdZrf0sF~^V # MD5 key 19102b15cb3dSCy Schubert 5 MD5 IyAG>O"y"LmCRS!*bHC # MD5 key 19112b15cb3dSCy Schubert 6 MD5 ">e\A # MD5 key 19122b15cb3dSCy Schubert 7 MD5 c9x=M'CfLxax9v)PV-si # MD5 key 19132b15cb3dSCy Schubert 8 MD5 E|=jvFVov?Bn|Ev=&aK\ # MD5 key 19142b15cb3dSCy Schubert 9 MD5 T!c4UT&`(m$+m+B6,`Q0 # MD5 key 19152b15cb3dSCy Schubert 10 MD5 JVF/1=)=IFbHbJQz..Cd # MD5 key 19162b15cb3dSCy Schubert 11 SHA1 6dea311109529e436c2b4fccae9bc753c16d1b48 # SHA1 key 19172b15cb3dSCy Schubert 12 SHA1 7076f373d86c4848c59ff8046e49cb7d614ec394 # SHA1 key 19182b15cb3dSCy Schubert 13 SHA1 5f48b1b60591eb01b7cf1d33b7774f08d20262d3 # SHA1 key 19192b15cb3dSCy Schubert 14 SHA1 eed5ab9d9497319ec60cf3781d52607e76720178 # SHA1 key 19202b15cb3dSCy Schubert 15 SHA1 f283562611a04c964da8126296f5f8e58c3f85de # SHA1 key 19212b15cb3dSCy Schubert 16 SHA1 1930da171297dd63549af50b29449de17dcf341f # SHA1 key 19222b15cb3dSCy Schubert 17 SHA1 fee892110358cd4382322b889869e750db8e8a8f # SHA1 key 19232b15cb3dSCy Schubert 18 SHA1 b5520c9fadd7ad3fd8bfa061c8821b65d029bb37 # SHA1 key 19242b15cb3dSCy Schubert 19 SHA1 8c74fb440ec80f453ec6aaa62b9baed0ab723b92 # SHA1 key 19252b15cb3dSCy Schubert 20 SHA1 6bc05f734306a189326000970c19b3910f403795 # SHA1 key 19262b15cb3dSCy Schubert</pre> 19272b15cb3dSCy Schubert <p>Figure 1. Typical Symmetric Key File 19282b15cb3dSCy Schubert 19292b15cb3dSCy Schubert <p>Figure 1 shows a typical symmetric keys file used by the reference 19302b15cb3dSCy Schubertimplementation. 19312b15cb3dSCy SchubertEach line of the file contains three fields, first an 1932*4e1ef62aSXin LIinteger between 1 and 65535, inclusive, representing the key identifier 19332b15cb3dSCy Schubertused in the server and peer configuration commands. 19342b15cb3dSCy SchubertNext is the key type for the message digest algorithm, 19352b15cb3dSCy Schubertwhich in the absence of the 19362b15cb3dSCy SchubertOpenSSL library must be MD5 to designate the MD5 message digest 19372b15cb3dSCy Schubertalgorithm. 19382b15cb3dSCy SchubertIf the OpenSSL library is installed, the key type can be any 19392b15cb3dSCy Schubertmessage digest algorithm supported by that library. 19402b15cb3dSCy SchubertHowever, if 19412b15cb3dSCy Schubertcompatibility with FIPS 140-2 is required, the key type must be either 19422b15cb3dSCy SchubertSHA or SHA1. 19432b15cb3dSCy SchubertThe key type can be changed using an ASCII text editor. 19442b15cb3dSCy Schubert 19452b15cb3dSCy Schubert <p>An MD5 key consists of a printable ASCII string less than or equal to 19462b15cb3dSCy Schubert16 characters and terminated by whitespace or a # character. 19472b15cb3dSCy SchubertAn OpenSSL 19482b15cb3dSCy Schubertkey consists of a hex-encoded ASCII string of 40 characters, which is 19492b15cb3dSCy Schuberttruncated as necessary. 19502b15cb3dSCy Schubert 19512b15cb3dSCy Schubert <p>Note that the keys used by the <code>ntpq</code> and <code>ntpdc</code> programs are 19522b15cb3dSCy Schubertchecked against passwords requested by the programs and entered by hand, 19532b15cb3dSCy Schubertso it 19542b15cb3dSCy Schubertis generally appropriate to specify these keys in human readable ASCII 19552b15cb3dSCy Schubertformat. 19562b15cb3dSCy Schubert 19572b15cb3dSCy Schubert <p>The <code>ntp-keygen</code> program generates a MD5 symmetric keys file 19582b15cb3dSCy Schubert<code>ntpkey_MD5key_hostname.filestamp</code>. 19592b15cb3dSCy SchubertSince the file contains private 19602b15cb3dSCy Schubertshared keys, it should be visible only to root and distributed by 19612b15cb3dSCy Schubertsecure means to other subnet hosts. 19622b15cb3dSCy SchubertThe NTP daemon loads the file <code>ntp.keys</code>, so <code>ntp-keygen</code> 19632b15cb3dSCy Schubertinstalls a soft link from this name to the generated file. 19642b15cb3dSCy SchubertSubsequently, similar soft links must be installed by 19652b15cb3dSCy Schubertmanual or automated means on the other subnet hosts. 19662b15cb3dSCy SchubertWhile this file is 19672b15cb3dSCy Schubertnot used with the Autokey Version 2 protocol, it is needed to 19682b15cb3dSCy Schubertauthenticate some remote configuration commands used by the <code>ntpq</code> and 19692b15cb3dSCy Schubert<code>ntpdc</code> utilities. 19702b15cb3dSCy Schubert 19712b15cb3dSCy Schubert</body></html> 19722b15cb3dSCy Schubert 1973