KEY(8)

NAME
keyadmin - manually manipulate the kernel key management database

SYNOPSIS
keyadmin [command [args]]

DESCRIPTION
The keyadmin command is used to manually enter security associations into the kernel key/security association database. (See key(4) ).

Almost any operation offered in the key(4) API is available to privileged users running keyadmin. Until there is an implementation of an automated key management protocol, which will manipulate the key database in a manner similar to how routed(8) or gated(8) manipulates the routing tables, keyadmin is the only way of establishing security associations.

If keyadmin is invoked without any arguments, it will enter an interactive mode, where the user can type in “command [args]” interactively, or use keyadmin to enter a single “command [args]”. Command can be one of the following:

del type spi source destination

Delete a security association between source and destination of the given type and spi. Example:

    	delete esp 90125 anderson.yes.org rabin.yes.org

get type spi source destination

Retrieve (and print) a security association between source and destination of the given type and spi. Example:

    	get ah 5150 eddie.vanhalen.com alex.vanhalen.com

dump

Display the entire security association table. WARNING: This prints a lot of data.

load filename

Load security association information from a file formatted as documented in keys(5). If “-” is specified for the filename, load keys from the standard input.

save filename

Save security association information to a file formatted as documented in keys(5). If “-” is specified for the filename, place the key file out on the standard output. (This can be used as a sort of lightweight dump command.) NOTE: The save command must create a new file; it will not write into an existing file. This is to prevent writing into a world-readable file, or a named pipe or UNIX socket (see socket(2) and mkfifo(1) ).

help [command]

Offer brief help without an argument, or slightly more specific help on a particular command.

flush

Erase all entries in the kernel security association table.

The following values for command are only available by using keyadmin in its interactive mode of operation:

add type spi source destination transform key [iv]

Add a security association of a particular type and spi from a source to a destination, using a particular transform and key. If a transform requires an initialization vector, the iv argument contains it. This command is available only in interactive mode because keyadmin makes no attempt to destroy its argument vector after use. A malicous user of the ps(1) command could determine security keys if add were allowed to be used straight from the command line. Example:

    	add esp 2112 temples.syrinx.org priests.syrinx.org des-cbc \
    		a652a476a652a476 87ac9876deac9876

exit

quit

Exit interaction with keyadmin. An EOF will also end interaction with keyadmin.

SEE ALSO
ipsec(4), key(4), route(4), gated(8), routed(8)

HISTORY
The keyadmin command first appeared in NRL's 4.4BSD IPv6 networking distribution. Keyadmin started its life as a pipe dream thought up by Dan McDonald, and came to life through the excruciating efforts of Ran Atkinson, Dan McDonald, Craig Metz, and Bao Phan. The NRL version of the program was originally called key, but was renamed to keyadmin because of the conflict with key(1).

BUGS
Keyadmin needs a -n flag like route(8) to avoid name lookups.

The dump and save commands currently display the first 30 or so entries.