[
.B \-\-key
] [
.B \-\-left
] [
.B \-\-right
] [
.B \-\-txt
gateway
] [
.B \-\-dhclient
] [
.B \-\-file
secretfile
] [
.B \-\-id
identity
]
.SH DESCRIPTION
.I Showhostkey
outputs (on standard output) a public key suitable for this host,
in the format specified,
using the host key information stored in
.IR /etc/ipsec.secrets .
In general only the super-user can run this command,
since only he can read
.IR ipsec.secrets .
.PP
The
.B \-\-txt
option causes the output to be in opportunistic-encryption DNS TXT record
format,
with the specified
.I gateway
value.
If information about how the key was generated is available,
that is provided as a DNS-file comment.
For example,
.B "\-\-txt 10.11.12.13"
might give (with the key data trimmed for clarity):
.PP
.nf
  ; RSA 2048 bits   xy.example.com   Sat Apr 15 13:53:22 2000
      IN TXT  "X-IPsec-Server(10)=10.11.12.13 AQOF8tZ2...+buFuFn/"
.fi
.PP
No name is supplied in the TXT record
because there are too many possibilities,
depending on how it will be used.
If the text string is longer than 255 bytes,
it is split up into multiple strings (matching the restrictions of
the DNS TXT binary format).
Again, generation information is included if available.
For example,
.B \-\-left
might give (with the key data trimmed down for clarity):
.PP
.nf
  # RSA 2048 bits   xy.example.com   Sat Apr 15 13:53:22 2000
  leftrsasigkey=0sAQOF8tZ2...+buFuFn/
.fi
.PP
The
.B \-\-dhclient
option cause the output to be suitable for inclusion in
.IR dhclient.conf (5)
as part of configuring WAVEsec.
See <http://www.wavesec.org>.
.PP
If
.B \-\-key
is specified,
the output format is the text form of a DNS KEY record;
the host name is the one included in the key information
(or, if that is not available,
the output of
.BR "hostname\ \-\-fqdn" ),
with a
.B \&.
appended.
Again, generation information is included if available.
For example (with the key data trimmed down for clarity):
.PP
.nf
  ; RSA 2048 bits   xy.example.com   Sat Apr 15 13:53:22 2000
  xy.example.com.   IN   KEY   0x4200 4 1 AQOF8tZ2...+buFuFn/
.fi
.PP
Normally, the default key for this host
(the one with no host identities specified for it) is the one extracted.
The
.B \-\-id
option overrides this,
causing extraction of the key labeled with the specified
.IR identity ,
if any.
The specified
.I identity
must
.I exactly
match the identity in the file;
in particular, the comparison is case-sensitive.
.PP
The
.SH HISTORY
Written for the Linux FreeS/WAN project



Man(1) output converted with
man2html