ipsec_showhostkey8
Show host's authentication key
Usage
ipsec showhostkey
[--verbose]
{--version | --list | --dump | --left | --right | --ipseckey | --pem}
[{--ckaid
ckaid | --rsaid
rsaid}]
[--gateway
gateway]
[--precedence
precedence]
[--nssdir
nssdir]
[--password
password]
Overview
Showhostkey outputs (on standard output) a public key suitable for this host, in the format specified, using the host key information stored in the NSS database.
In general, since only the super-user can access the NSS database, only the super-user can display the public key information.
Common Options
-
--version -
Print the libreswan version, then exit.
-
--verbose -
Increase the verbosity.
-
--nssdir nssdir -
Specify the libreswan directory that contains the NSS database (default /var/lib/ipsec/nss).
-
--password password -
Specify the password to use when accessing the NSS database (default contained in /etc/ipsec.d/nsspassword).
List Options
-
--list -
List the private keys.
-
--dump -
List, with more details, the private keys.
Public Key Options
-
--ckaid ckaid -
Select the public key to display using the NSS ckaid.
-
--rsaid rsaid -
Select the public key to display using the RSA key ID.
-
--pem -
Print the selected public key in PEM encoded ASN.1 format.
-
--left, --right -
Print the selected public key in ipsec.conf(5) format, as a
leftrsasigkeyorrightrsasigkeyparameter respectively. For example,--leftmight give (with the key data trimmed down for clarity):leftrsasigkey=0sAQOF8tZ2...+buFuFn/
-
--ipseckey -
Print the selected public key in a format suitable for use as opportunistic-encryption DNS IPSECKEY record format (RFC 4025). A gateway can be specified with the
--gateway, which currently supports IPv4 and IPv6 addresses. For the host name, the value returned by gethostname is used, with a . appended.For example, --ipseckey --gateway 10.11.12.13 might give (with the key data trimmed for clarity):
IN IPSECKEY 10 1 2 10.11.12.13 AQOF8tZ2...+buFuFn/"
-
--gateway gateway -
For
--ipseckey, specify the gateway to display with the DNS IPSECKEY record.
-
--precedence precedence -
For
--ipseckey, specify the precedence to display with the DNS IPSECKEY record.
Diagnostics
A complaint about “no pubkey line found” indicates that the host has a key but it was generated with an old version of FreeS/WAN and does not contain the information that showhostkey needs.
Files
/var/lib/ipsec/nss, /etc/ipsec.d/nsspassword
Releases
7 releases since Debian 3.1 (Sarge); the text changed 5 times.
--ckaid since Debian 10 (Buster);
--dump since Debian 10 (Buster);
--gateway since Debian 10 (Buster);
--ipseckey since Debian 10 (Buster);
--left since Debian 10 (Buster);
--list since Debian 10 (Buster);
--nssdir since Debian 10 (Buster);
--password since Debian 10 (Buster);
--pem since Debian 12 (Bookworm);
--precedence since Debian 10 (Buster);
--right since Debian 10 (Buster);
--rsaid since Debian 10 (Buster);
--verbose since Debian 10 (Buster);
--version since Debian 10 (Buster).