nss-policy-check.xml (3892B)
1 <?xml version="1.0" encoding="UTF-8"?> 2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" 3 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [ 4 <!ENTITY date SYSTEM "date.xml"> 5 <!ENTITY version SYSTEM "version.xml"> 6 ]> 7 8 <refentry id="nss-policy-check"> 9 10 <refentryinfo> 11 <date>&date;</date> 12 <title>NSS Security Tools</title> 13 <productname>nss-tools</productname> 14 <productnumber>&version;</productnumber> 15 </refentryinfo> 16 17 <refmeta> 18 <refentrytitle>NSS-POLICY-CHECK</refentrytitle> 19 <manvolnum>1</manvolnum> 20 </refmeta> 21 22 <refnamediv> 23 <refname>nss-policy-check</refname> 24 <refpurpose>nss-policy-check policy-file</refpurpose> 25 </refnamediv> 26 27 <refsynopsisdiv> 28 <cmdsynopsis> 29 <command>nss-policy-check</command> 30 </cmdsynopsis> 31 </refsynopsisdiv> 32 33 <refsection id="description"> 34 <title>Description</title> 35 <para><command>nss-policy-check</command> verifies crypto-policy configuration that controls certain crypto algorithms are allowed/disallowed to use in the NSS library.</para> 36 37 <para>The crypto-policy configuration can be stored in either a system-wide configuration file, specified with the POLICY_PATH and POLICY_FILE build options, or in the pkcs11.txt in NSS database.</para> 38 </refsection> 39 40 <refsection id="basic-usage"> 41 <title>Usage and Examples</title> 42 <para>To check the global crypto-policy configuration in <filename>/etc/crypto-policies/back-ends/nss.config</filename>: 43 </para> 44 <programlisting>$ nss-policy-check /etc/crypto-policies/back-ends/nss.config 45 NSS-POLICY-INFO: LOADED-SUCCESSFULLY 46 NSS-POLICY-INFO: PRIME256V1 is enabled for KX 47 NSS-POLICY-INFO: PRIME256V1 is enabled for CERT-SIGNATURE 48 NSS-POLICY-INFO: SECP256R1 is enabled for KX 49 NSS-POLICY-INFO: SECP256R1 is enabled for CERT-SIGNATURE 50 NSS-POLICY-INFO: SECP384R1 is enabled for KX 51 NSS-POLICY-INFO: SECP384R1 is enabled for CERT-SIGNATURE 52 ... 53 NSS-POLICY-INFO: NUMBER-OF-SSL-ALG-KX: 13 54 NSS-POLICY-INFO: NUMBER-OF-SSL-ALG: 9 55 NSS-POLICY-INFO: NUMBER-OF-CERT-SIG: 9 56 ... 57 NSS-POLICY-INFO: ciphersuite TLS_AES_128_GCM_SHA256 is enabled 58 NSS-POLICY-INFO: ciphersuite TLS_CHACHA20_POLY1305_SHA256 is enabled 59 NSS-POLICY-INFO: ciphersuite TLS_AES_256_GCM_SHA384 is enabled 60 ... 61 NSS-POLICY-INFO: NUMBER-OF-CIPHERSUITES: 24 62 NSS-POLICY-INFO: NUMBER-OF-TLS-VERSIONS: 3 63 NSS-POLICY-INFO: NUMBER-OF-DTLS-VERSIONS: 2 64 </programlisting> 65 <para>If there is a failure or warning, it will be prefixed with 66 NSS-POLICY-FAIL or NSS-POLICY_WARN. 67 </para> 68 <para><command>nss-policy-check</command> exits with 2 if any 69 failure is found, 1 if any warning is found, or 0 if no errors are 70 found.</para> 71 </refsection> 72 73 <!-- don't change --> 74 <refsection id="resources"> 75 <title>Additional Resources</title> 76 <para>For information about NSS and other tools related to NSS (like JSS), check out the NSS project wiki at <ulink url="http://www.mozilla.org/projects/security/pki/nss/">http://www.mozilla.org/projects/security/pki/nss/</ulink>. The NSS site relates directly to NSS code changes and releases.</para> 77 <para>Mailing lists: https://lists.mozilla.org/listinfo/dev-tech-crypto</para> 78 <para>IRC: Freenode at #dogtag-pki</para> 79 </refsection> 80 81 <!-- fill in your name first; keep the other names for reference --> 82 <refsection id="authors"> 83 <title>Authors</title> 84 <para>The NSS tools were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google.</para> 85 <para> 86 Authors: Elio Maldonado <emaldona@redhat.com>, Deon Lackey <dlackey@redhat.com>. 87 </para> 88 </refsection> 89 90 <!-- don't change --> 91 <refsection id="license"> 92 <title>LICENSE</title> 93 <para>Licensed under the Mozilla Public License, v. 2.0. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla.org/MPL/2.0/. 94 </para> 95 </refsection> 96 97 </refentry>