table of contents
IPSEC_SHOWHOSTKEY(8) | Executable programs | IPSEC_SHOWHOSTKEY(8) |
NAME¶
ipsec_showhostkey - show host's authentication keySYNOPSIS¶
ipsec showhostkey [--verbose]
{--version | --list | --dump | --left | --right | --ipseckey}
[--ckaid ckaid | --rsaid rsaid]
[--gateway gateway] [--precedence precedence]
[--nssdir nssdir] [--password password]
DESCRIPTION¶
Showhostkey outputs (on standard output) a public key suitable for this host, in the format specified, using the host key information stored in the NSS database.In general, since only the super-user can access the NSS database, only the super-user can display the public key information.
Common Options¶
--version--verbose
--nssdir nssdir
--password password
List Options¶
--list--dump
Public Key Options¶
--ckaid ckaid--rsaid rsaid
--left, --right
leftrsasigkey=0sAQOF8tZ2...+buFuFn/
--ipseckey
For example, --ipseckey --gateway 10.11.12.13 might give (with the key data trimmed for clarity):
IN IPSECKEY 10 1 2 10.11.12.13 AQOF8tZ2...+buFuFn/"
--gateway gateway
--precedence precedence
DIAGNOSTICS¶
A complaint about “no pubkey line found” indicates that the host has a key but it was generated with an old version of FreeS/WAN and does not contain the information that showhostkey needs.FILES¶
/var/lib/ipsec/nss, /etc/ipsec.d/nsspasswordSEE ALSO¶
ipsec.conf(5), ipsec rsasigkey(8) ipsec newhostkey(8)HISTORY¶
Written for the Linux FreeS/WAN project <http://www.freeswan.org> by Henry Spencer. Updated by Paul Wouters for the IPSECKEY format.BUGS¶
Arguably, rather than just reporting the no-IN-KEY-line-found problem, showhostkey should be smart enough to run the existing key through rsasigkey with the --oldkey option, to generate a suitable output line.AUTHOR¶
Paul Wouters05/13/2020 | libreswan |