Source-Changes-HG archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
[src/trunk]: src/sbin/cgdconfig New sentence, new line. Some mdoc cleanup, ot...
details: https://anonhg.NetBSD.org/src/rev/ac9c62f9266c
branches: trunk
changeset: 537754:ac9c62f9266c
user: grant <grant%NetBSD.org@localhost>
date: Sat Oct 05 15:45:52 2002 +0000
description:
New sentence, new line. Some mdoc cleanup, other minor nits.
diffstat:
sbin/cgdconfig/cgdconfig.8 | 69 +++++++++++++++++++++++++++------------------
1 files changed, 41 insertions(+), 28 deletions(-)
diffs (152 lines):
diff -r 497844951e9b -r ac9c62f9266c sbin/cgdconfig/cgdconfig.8
--- a/sbin/cgdconfig/cgdconfig.8 Sat Oct 05 15:45:04 2002 +0000
+++ b/sbin/cgdconfig/cgdconfig.8 Sat Oct 05 15:45:52 2002 +0000
@@ -1,4 +1,4 @@
-.\" $NetBSD: cgdconfig.8,v 1.3 2002/10/05 00:34:35 dan Exp $
+.\" $NetBSD: cgdconfig.8,v 1.4 2002/10/05 15:45:52 grant Exp $
.\"
.\" Copyright (c) 2002, The NetBSD Foundation, Inc.
.\" All rights reserved.
@@ -105,7 +105,8 @@
.It Fl u
Unconfigure a cgd.
.It Fl v
-Be verbose. May be specified multiple times.
+Be verbose.
+May be specified multiple times.
.El
.Pp
For more information about the cryptographic algorithms and IV methods
@@ -117,16 +118,20 @@
.Bl -tag -width indentxxxxxx
.It pkcs5_pbkdf2
This method requires a passphrase which is entered at configuration
-time. It is a salted hmac-based scheme detailed in ``PKCS#5 v2.0:
-Password-Based Cryptography Standard'', RSA Laboratories, March
-25, 1999, pages 8-10. PKCS #5 was also republished as RFC 2898.
+time.
+It is a salted hmac-based scheme detailed in
+.Dq PKCS#5 v2.0: Password-Based Cryptography Standard ,
+RSA Laboratories, March 25, 1999, pages 8-10.
+PKCS #5 was also republished as RFC 2898.
.It randomkey
The method simply reads
.Pa /dev/random
-and uses the resulting bits as the key. It does not require a
-passphrase to be entered. This method is typically used to present
+and uses the resulting bits as the key.
+It does not require a passphrase to be entered.
+This method is typically used to present
disk devices that do not need to survive a reboot, such as the swap
-partition. It is also handy to facilitate overwriting the contents of
+partition.
+It is also handy to facilitate overwriting the contents of
a disk volume with meaningless data prior to use.
.El
.Ss /etc/cgd/cgd.conf
@@ -138,13 +143,15 @@
.Fl C
or
.Fl U
-are specified. Each line of the file is composed of either two or three
+are specified.
+Each line of the file is composed of either two or three
tokens: cgd, target, and optional paramsfile.
.Pp
A
.Sq \&#
character is interpreted as a comment and indicated that the
-rest of the line should be ignored. A
+rest of the line should be ignored.
+A
.Sq \e
at the end of a line indicates that the next line is a continuation of
the current line.
@@ -155,21 +162,23 @@
.Pa /etc/cgd/cgd.conf .
.Ss Parameters File
The Parameters File contains the required information to generate the
-key and configure a device. These files are typically generated by with
-the
+key and configure a device.
+These files are typically generated by with the
.Fl g
-flag and not edited by hand. When a device is configured the default
+flag and not edited by hand.
+When a device is configured the default
parameters file is constructed by taking the basename of the target disk
and prepending
.Pa /etc/cgd/
-to it. E.g.: if the target is
+to it.
+e.g.: if the target is
.Pa /dev/sd0h ,
then the default parameters file will be
.Pa /etc/cgd/sd0h .
.Pp
The parameters file contains a list of key-value pairs which are
-specified one per line. Comments and line continuation work in the
-same way as for
+specified one per line.
+Comments and line continuation work in the same way as for
.Pa /etc/cgd/cgd.conf .
.Pp
The keys are as follows:
@@ -183,15 +192,16 @@
.It keygen_method
The method used to generate the key.
.It keygen_salt
-If the keygen_method requires a salt, then this is the salt. It is
-base64 encoded.
+If the keygen_method requires a salt, then this is the salt.
+It is base64 encoded.
.It xor_key
If this is present, then it will be XOR'ed with the generated key before
-the device is configured. This can be used if the parameters file is
+the device is configured.
+This can be used if the parameters file is
stored on separate removable media, e.g. USB mass storage, to ensure that
-the generated key is immune to passphrase-guessing attacks. It is not
-valuable unless the parameters file is stored on removable media. It is
-base64 encoded.
+the generated key is immune to passphrase-guessing attacks.
+It is not valuable unless the parameters file is stored on removable media.
+It is base64 encoded.
.El
.Sh FILES
.Bl -tag -width indentxxxxxxxxxxxxxxxxxx -compact
@@ -202,7 +212,9 @@
.El
.Sh EXAMPLES
To set up and configure a cgd that uses AES with a 192 bit key
-in CBC mode with the IV Method "encblkno" (encrypted block number):
+in CBC mode with the IV Method
+.Sq encblkno
+(encrypted block number):
.Bd -literal
# cgdconfig -g -o /etc/cgd/wd0e aes-cbc 192
# cgdconfig cgd0 /dev/wd0e
@@ -234,10 +246,10 @@
.Sh SEE ALSO
.Xr cgd 4
.Pp
-``PKCS #5 v2.0: Password-Based Cryptography Standard'', RSA Laboratories,
-March 25, 1999.
+.Dq PKCS #5 v2.0: Password-Based Cryptography Standard ,
+RSA Laboratories, March 25, 1999.
.Sh HISTORY
-A
+The
.Nm
utility appeared in
.Nx 1.6.1 .
@@ -249,5 +261,6 @@
to read in the passphrase, it is limited to 128 characters.
.Pp
At present, there is no mechanism to validate that the key supplied
-matches that used to encrypt the disk. An option to validate the
-checksum of a disklabel inside the cgd device may be added shortly.
\ No newline at end of file
+matches that used to encrypt the disk.
+An option to validate the
+checksum of a disklabel inside the cgd device may be added shortly.
Home |
Main Index |
Thread Index |
Old Index