credence —
Generate or check key pairs for services using
libDwmCredence
credence |
keygen
[-i
identity
]
[-d
directory
] |
credence |
keycheck
[-d
directory
] |
credence is a simple command-line utility for
creating and checking public/private keypairs (Ed25519) to be used by services
that utilize libDwmCredence for authentication. It operates in a somewhat
similar manner to
ssh-keygen(1)
but does not use passphrases and only uses Ed25519 keys (other key types are
not supported).
credence(1)
operates in two possible modes: key generation and key checking.
credence
keygen
[
-i
identity
]
[
-d
directory
]
Generates public and private key files. The following command line options are
available:
-
-
-i
identity- Specify the identity. If this option is not used, a default of
username@hostname will be used, where username will be determined
via getuid(2)
and
getpwuid(2)
and hostname will be determined via
gethostname(3).
-
-
-d
directory- Specify the directory in which the keys should be stored. The public key
will be stored in 'id_ed25519.pub' and the private key will be stored in
'id_ed25519' in the given directory. If this option is not used,
~/.credence will be used as the default directory.
A user will normally use their email address as the
identity, and not use
the
-d directory argument. They may then copy the contents of their
~/.credence directory onto any host from which they need access to
services using libDwmCredence, taking care to maintain 0600 permissions on
their key files and 0700 permissions on their
~/.credence directory.
For example:
% credence keygen -i dwm@mcplex.net
A service will normally use a service name and hostname as the
identity,
and an appropriate location for the key files. For example:
# credence keygen -i mcblockd@gw.mcplex.net -d /usr/local/etc/mcblockd
credence
keycheck
[
-d
directory
]
Checks the validity of a public/private key pair. The following command line
options are available:
-
-
-d
directory- Specify the directory in which the keys are stored. If this option is not
used, the default ~/.credence directory is used.
If the key pair is valid, "Valid key stash '<directory>'" will
be printed on stdout and the
credence(1)
process will exit with status 0. If any error occurs (invalid keypair, missing
file(s), etc.),
credence(1) will
print an error on stderr and exit with status 1.
-
-
- ${HOME}/.credence/id_ed25519
- The user's credence private key file, created with
credence(1).
This file should be owned by the user and have permissions 0600. It must
contain the private part of an Ed25519 key pair.
-
-
- ${HOME}/.credence/id_ed25519.pub
- The user's credence public key file, created with
credence(1).
This file should be owned by the user and have permissions 0600. It must
contain the public part of an Ed25519 key pair.
-
-
- ${HOME}/.credence/known_keys
- The user's credence known keys file. This file must contain the public
keys of services the user will access. Each public key is used to
authenticate a remote service during authentication.
-
-
- <service>/known_keys
- A service utilizing libDwmCredence will have a file containing the public
keys of those allowed to access the service. The location of this file is
service dependent.
Manpage Index
Copyright © 2022
Daniel W. McRobb
<
dwm@mcplex.net>