skiplocal(1M)

NAME
skiplocal - Manage SKIP Local indentities

SYNOPSIS
/usr/sbin/skiplocal -[a|r|l|i|e|k|x|P|R] [ subcommand-specific arguments ... ]

DESCRIPTION
skiplocal is the utility for managing SKIP identities on a workstation. A host may wish to have multiple identities if it must interoperate with other hosts which have incompatible Diffie-Hellman parameters (for instance a US host may wish to communicate with other US hosts with a 1024 bit modulus but must also communicate with a non-US host which is limited to a 512 bit modulus). Each local identity has a secret, a certificate and a unique name. The name is extracted from the certificate and used as a local identity. skiplocal is the primary tool for administering local IDS. skiplocal can create, delete and list local identities based on the command option specified.

skiplocal can also set or remove a passphrase which is used to encrypt SKIP private values stored locally. See the -P and -R sections of this man page for more information.

COMMON OPTIONS

-d directory
Specifies an alternate directory to store or retrieve localid information. The default is /etc/skip/localid. (This option applies to all the subcommands below.)

-T slot type
specifies the type of slot. It applies to the -a and -k subcommands (see below). Currently, only soft, for a software slot, is implemented.

-v
Produces more verbose output. It applies to the -l and -a subcommands (see below). In particular, it causes the local certificate(s) to be printed.

-V
Produces output more easily parsed by machine (e.g., a script written by a system administrator). It applies to the -l and -k subcommands (see below).

SUBCOMMANDS

-a -t cert type -n nsid -Z secret-file -c cert-file -T slot type -v
Used to add local identities to the trusted Certificate Authority database. All parameters above are required. -t specifies a certificate type. Currently, x509 and UDH are implemented. -n specifies the name space in which the certificate's name lives. -Z specifies the file containing the Diffie-Hellman private key. -c specifies the certificate used to establish identity.

    When a local ID is added, the certificate is checked for validity. Therefore, the local certificate's CA must have been previously added to the CA database with the skipca command.

    If a password has been assigned for encryption of secrets using the skiplocal -P subcommand, the user will be prompted for that password prior to adding any local ids.

-r -s slot-number
Deletes the LocalID in the specified slot number. The control, secret and certificate files are all deleted.

-R
Removes the password which is use to encrypt locally stored secrets. The user is prompted for the old password, and if it matches, all secrets are decrypted and stored and the password feature is disabled.

-x [-s slot] [-n nsid]
Emits an ``exportable'' skiphost command. This is a command line which could be used to add an access control entry for the local host on a remote system (e.g., in the remote /etc/skip/acl.interface file).

    By default, -x will use the first slot in the local identity database. A slot may be specified with the -s option. If the -n option is provided, the first slot with an identity in the given namespace will be used.

    An attempt is made to determine the local hostname for inclusion in the generated skiphost command. This hostname may be overridden by setting the SKIPLOCAL_EXPORT_HOST environment variable.

    The default arguments provided for skiphost specify des for key and traffic encryption, and MD5 for authentication. These arguments may be overridden setting the environment variable SKIPLOCAL_EXPORT_ARGS.

    Examples:
      # skiplocal -x
      skiphost -a miraj -s 1 -r 1 -R c7beb1e8 -k des-cbc -t des-cbc -m md5
      # SKIPLOCAL_EXPORT_HOST=foo \
        SKIPLOCAL_EXPORT_ARGS="-k des-ede-k3 -t des-ede-k3 -m md5" \
        skiplocal -x
      skiphost -a foo -s 1 -r 1 -R c7beb1e8 -k des-ede-k3 -t des-ede-k3 -m md5

    Beware of electronically transmitting access control commands to remote hosts. For complete security, the receiving system must verify the remote key-id out of band.

-e -s slot-number
Extracts the certificate in the specified slot-number, and writes it to the standard output. If the output is redirected to a file, the file is suitable for the skipdb command.

-i [-qo]
Initializes (creates) the local ID database. This must be done prior to first use. By default, if the database exists, the init command will NOT delete any of the Local Identities present. The user may forceable reinitialize the database and destroy all identities by specifying the -o option. -q tells init to be as quiet as possible about initialization.

-k [-m modulus_size] [-E exponent_size] [-L lifetime] [-f] [-V] [-M] [-T slot type]
Generates a new secret key and a UDH (unsigned Diffie-Hellman) certificate, and add them as a new slot to the set of local identities.

    The -m option specifies the modulus size in bits. Modulus sizes of 512, 1024 and 2048 bits are supported in the US domestic release. The highest number of bits allowed by the export control limitations of the software is the default. The -L option specifies the lifetime of the UDH certificate, in days. The default is 5 years. The -f option suppresses the prompt for keyboard input to obtain better random numbers.

    The -E option specifies how large of a random exponent will be generated. The default is 256 bits.

    The -M option simply reports the modulus of the key that would have been generated. (No key is actually generated.)

    If a password has been assigned for encryption of secrets using the skiplocal passwd subcommand, the user will be prompted for that password prior to adding any local ids.

-l [-Vv] [ -s slot-number ]
Lists the local ids present on the system. By default, slot number, slot type, NSID, MKID (name) and validity periods are printed.

-P
Assigns or changes the password which is used to encrypt locally stored secrets. If no password as present, you will be prompted for a new one. If a password already exists, you will be prompted for the old password prior to the new one.

USAGE

You must be root to run this command.

Note: After adding a local ID, the key manager must be restarted using skipd_restart in order for the changes to take effect.

FILES

/etc/skip/localid
/etc/skip/acl.interface

BUGS
skiplocal -x does not work well for communicating with multiple keys. Since the local system does not know which key on the remote system should be used, incorrect bindings may occur. Therefore, it is recommended that skiplocal -x command be used carefully. bind

SEE ALSO
skipdb(1m) skipca(1m) skipd(1m) skipd_restart(1m)