Section 8 · System administration
pki-server-kra.8
Package: idm-pki-server
pki-server-kra
NAME
SYNOPSIS
DESCRIPTION
AUDIT EVENTS
SEE ALSO
AUTHORS
COPYRIGHT
NAME
pki-server-kra - Command-line interface for managing PKI KRA.
SYNOPSIS
pki-server [CLI-options] kra-clone-prepare [command-options] **
pki-server** [CLI-options] kra-audit-event-find [command-options] **
pki-server** [CLI-options] kra-audit-event-enable [command-options] event-ID **
pki-server** [CLI-options] kra-audit-event-disable [command-options] event-ID **
pki-server** [CLI-options] kra-audit-event-modify [command-options] event-ID **
pki-server** [CLI-options] kra-audit-file-find [command-options] **
pki-server** [CLI-options] kra-audit-file-verify [command-options]
DESCRIPTION
The pki-server kra commands provide command-line interfaces to manage PKI KRA.
pki-server [CLI-options] kra [command-options]
This command is to list available PKI KRA management commands.
pki-server [CLI-options] kra-clone-prepare [command-options]
This command export KRA system certificates into a PKCS #12 file with private keys.
pki-server [CLI-options] kra-audit-event-find [command-options]
This command list all the audit events which are enabled/disabled.
pki-server [CLI-options] kra-audit-event-enable [command-options] event-ID
This command will enable audit events in the KRA.
pki-server [CLI-options] kra-audit-event-disable [command-options] event-ID
This command will disable audit events in the KRA.
pki-server [CLI-options] kra-audit-event-modify [command-options] event-ID
This command will modify the event filter for audit events.
pki-server [CLI-options] kra-audit-file-find [command-options]
This command lists audit logs generated by the KRA.
pki-server [CLI-options] kra-audit-file-verify [command-options]
This command will verify whether the signatures in the audit log files are valid.
AUDIT EVENTS
Logging audit events:
| • | AUDIT_LOG_STARTUP | |||
| • | AUDIT_LOG_SHUTDOWN | |||
| • | AUDIT_LOG_DELETE | |||
| • | LOG_PATH_CHANGE | |||
| • | LOG_EXPIRATION_CHANGE | |||
| • | CONFIG_SIGNED_AUDIT |
Authentication and authorization audit events:
| • | AUTHZ | |||
| • | AUTH | |||
| • | ROLE_ASSUME | |||
| • | CONFIG_AUTH | |||
| • | CONFIG_ROLE | |||
| • | ACCESS_SESSION_ESTABLISH | |||
| • | ACCESS_SESSION_TERMINATED |
Key audit events:
| • | PRIVATE_KEY_ARCHIVE_REQUEST | |||
| • | PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED | |||
| • | PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS | |||
| • | CONFIG_TRUSTED_PUBLIC_KEY | |||
| • | PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE | |||
| • | KEY_RECOVERY_REQUEST | |||
| • | KEY_RECOVERY_REQUEST_ASYNC | |||
| • | KEY_RECOVERY_AGENT_LOGIN | |||
| • | KEY_RECOVERY_REQUEST_PROCESSED | |||
| • | KEY_RECOVERY_REQUEST_PROCESSED_ASYNC | |||
| • | KEY_GEN_ASYMMETRIC | |||
| • | COMPUTE_SESSION_KEY_REQUEST_PROCESSED_SUCCESS | |||
| • | COMPUTE_SESSION_KEY_REQUEST | |||
| • | COMPUTE_SESSION_KEY_REQUEST_PROCESSED_FAILURE | |||
| • | DIVERSIFY_KEY_REQUEST | |||
| • | DIVERSIFY_KEY_REQUEST_PROCESSED_SUCCESS | |||
| • | DIVERSIFY_KEY_REQUEST_PROCESSED_FAILURE | |||
| • | SERVER_SIDE_KEYGEN_REQUEST | |||
| • | SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS | |||
| • | SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE |
CMC audit events:
| • | CMC_RESPONSE_SENT | |||
| • | CMC_ID_POP_LINK_WITNESS | |||
| • | CMC_SIGNED_REQUEST_SIG_VERIFY | |||
| • | CMC_PROOF_OF_IDENTIFICATION | |||
| • | CMC_REQUEST_RECEIVED | |||
| • | CMC_USER_SIGNED_REQUEST_SIG_VERIFY | |||
| • | PROOF_OF_POSSESSION |
Profile audit events:
| • | CONFIG_CERT_PROFILE | |||
| • | CONFIG_CRL_PROFILE | |||
| • | CONFIG_OCSP_PROFILE |
Certificate audit events:
| • | CERT_SIGNING_INFO | |||
| • | CERT_PROFILE_APPROVAL | |||
| • | CERT_REQUEST_PROCESSED | |||
| • | CERT_STATUS_CHANGE_REQUEST | |||
| • | CERT_STATUS_CHANGE_REQUEST_PROCESSED | |||
| • | CONFIG_CERT_POLICY | |||
| • | PROFILE_CERT_REQUEST | |||
| • | CIMC_CERT_VERIFICATION | |||
| • | NON_PROFILE_CERT_REQUEST |
ACL audit events:
| • | CONFIG_ACL |
OCSP audit events:
| • | OCSP_SIGNING_INFO | |||
| • | OCSP_GENERATION |
CRL audit events:
| • | SCHEDULE_CRL_GENERATION | |||
| • | DELTA_CRL_PUBLISHING | |||
| • | CRL_VALIDATION | |||
| • | CRL_RETRIEVAL | |||
| • | CRL_SIGNING_INFO | |||
| • | FULL_CRL_GENERATION | |||
| • | DELTA_CRL_GENERATION |
Authority audit events:
| • | AUTHORITY_CONFIG | |||
| • | SECURITY_DOMAIN_UPDATE | |||
| • | CONFIG_DRM |
Selftest audit events:
| • | SELFTESTS_EXECUTION |
Encryption data audit events:
| • | CONFIG_ENCRYPTION | |||
| • | ENCRYPT_DATA_REQUEST | |||
| • | ENCRYPT_DATA_REQUEST_PROCESSED_SUCCESS | |||
| • | ENCRYPT_DATA_REQUEST_PROCESSED_FAILURE | |||
| • | COMPUTE_RANDOM_DATA_REQUEST | |||
| • | COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_FAILURE | |||
| • | COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_SUCCESS | |||
| • | SECURITY_DATA_ARCHIVAL_REQUEST |
Serial/random number audit events:
| • | INTER_BOUNDARY | |||
| • | CONFIG_SERIAL_NUMBER | |||
| • | RANDOM_GENERATION |
SEE ALSO
pki-server(8)
PKI server management commands
AUTHORS
Amol Kahat <akahat@redhat.com>.
COPYRIGHT
Copyright (c) 2018 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.