skiplocal(9 May 1996)

NAME
skiplocal - Manage SKIP Local indentities

SYNOPSYS
skiplocal [add | rm | list | init | extract | keygen | export | passwd | rmpasswd ] ...

DESCRIPTION
skiplocal is the utility for managing SKIP identities on a workstation. A host may wish to have multiple identities if it must interoperate with other hosts which have incompatible Diffie-Hellman parameters (for instance a US host may wish to communicate with other US hosts with a 1024 bit modulus but must also communicate with a non-US host which is limited to a 512 bit modulus). Each local identity has a secret, a certificate and a unique name. The name is extracted from the certificiate and used as a local identity. skiplocal is the primary tool for administering local IDS. skiplocal can create, delete and list local identities based on the command option specified.

skiplocal can also set or remove a passphrase which is used to encrypt SKIP private values stored locally. See the passwd and rmpasswd sections of this man page for more information.

COMMANDS

add -o slot type -t cert type -n nsid -s secret-file -c cert-file
The add command is used to add local identifies to the trusted Certificate Authority database. All parameters above are required. -o specifies the type of slot. Currently, only "soft", for a software slot, is implemented. -t specifies a certificate type. Currently, x509 and udh are implemented. -n specifies the name space in which the certificate's name lives. -s specifies the file containing the Diffie-Hellman private key. -c specifies the certificate used to establish identity.

    When a local ID is added, the certificate is checked for validity. Therefore, the local certificate's CA must have been previously added to the CA database with the skipca command.

    If a password has been assigned for encryption of secrets using the skiplocal passwd subcommand, the user will be prompted for that password prior to adding any local ids.

rm [-v] del slot-number
The del command deletes the LocalID in the specified slot number. The control, secret and certificate files are all deleted. Note del is an alias for the rm command.

rmpasswd
The rmpasswd subcommand removes the password which is use to encrypt locally stored secrets. The user is prompted for the old password, and if it matches, all secrets are decrypted and stored and the password feature is disabled. Note, delpasswd is an alias for rmpasswd.

export [-s slot] [-n nsid]
Causes skiplocal to emit a skiphost command line which could be used to add an access control entry on a remote system for the local host.

    By default, 'skiplocal export' will choose the first slot in the local identity database. A slot may be specified with the -s option. If the -n option is provided, the first slot with an identity in the given namespace will be used.

    An attempt is made to determine the local hostname for inclusion in the generated skiphost command. This hostname may be overridden by setting the SKIPLOCAL_EXPORT_HOST environment variable.

    The default arguments provided for skiphost specify des for key and traffic encryption, and MD5 for authetication. These arguments may be overridden setting the environment variable SKIPLOCAL_EXPORT_ARGS.

    Examples:
      # skiplocal export
      skiphost -a miraj -s 1 -r 1 -R c7beb1e8 -k des-cbc -t des-cbc -m md5
      # SKIPLOCAL_EXPORT_HOST=foo \
        SKIPLOCAL_EXPORT_ARGS="-k des-ede-k3 -t des-ede-k3 -m md5" \
        skiplocal export
      skiphost -a foo -s 1 -r 1 -R c7beb1e8 -k des-ede-k3 -t des-ede-k3 -m md5

    Beware of electronically transmitting access control commands to remote hosts. For complete security, the receiving system must verify the remote key-id out of band.

extract
    slot-number The extract command writes the certificate in the specified slot-number to the standard output. If the output is redirected to a file, the file is suitable for the skipdb command.

init [-qo]
Prior to use, the Local ID database must be initialized. The init command creates the database. By default, if the database exists, the init command will NOT delete any of the Local Identities present. The user may forceable reinitialize the database and destroy all identities by specifying the -o option. -q tells init to be as quiet as possible about initializaiton.

keygen [-m modulus_size] [-e exponent_size] [-l lifetime] [-f] [-V]
Causes skiplocal to generate a new secret key and a udh (unsigned) certificate, and add them as a new slot to the set of local identities. -V produces output more easily machine parseable.

    The -m option specifies the modulus size in bits. Modulus sizes of 512, 1024 and 2048 bits are supported in the US domestic release. The highest number of bits allowed by the export control limitations of the software is the default The -l option specifies the lifetime of the udh certificate, in days. The default is 5 years. The -f option suppresses the prompt for keyboard input to obtain better random numbers.

    The -e option specifies how large of a random exponent will be generated. The default is 256 bits.

    If a password has been assigned for encryption of secrets using the skiplocal passwd subcommand, the user will be prompted for that password prior to adding any local ids.

list [-Vv] [slot-number]
The list command lists the local ids present on the system. By default, slot number, slot type, NSID, MKID (name) and validity periods are printed. The -v options specifies that the local certificate for that slot should be printed, as well. -V produces output more easily machine parseable.

passwd
The passwd subcommand allows you to assign or change the password which is used to encrypt locally stored secrets. If no password as present, you will be prompted for a new one. If a password already exists, you will be prompted for the old password prior to the new one.

USAGE

You must be root to run this command.

Note: After adding a local ID, the key manager must be restarted using skipd_restart in order for the changes to take effect.

FILES

/usr/local/etc/skip/localids

BUGS
skiplocal export does not work well for communicating with multiple keys. Since the local system does not know which key on the remote system should be used, incorrect bindings may occur. Therefore, it is recommended that skiplocal export command be used carefully. bind

SEE ALSO
skipdb(1m) skipca(1m) skipd(1m) skipd_restart(1m)