kxd(1)

💖 kxd — the key exchange daemon bestie 💖

okay so. this is the manual page for kxd(1), the key exchange daemon. she's a whole vibe and she's here to hand out keys over https, no cap. let's get into it 🫶

---

✨ NAME ✨

kxd — Key exchange daemon 👑

---

🌸 SYNOPSIS 🌸

kxd [options...]

that's it. that's the whole thing. iconic, honestly.

---

🦋 DESCRIPTION 🦋

so kxd is a key exchange daemon, and what she does is serve up blobs of data — we're calling those keys — over https. simple. elegant. slay.

the whole point? you can grab your keys remotely instead of hoarding them in local storage like a little gremlin. the main character use case, the one everybody's here for: getting keys to open dm-crypt devices automatically, without having to store them on the local machine. like, you don't have to keep the key sitting right there on the box. she's remote. she's secure. she's giving main character energy. 💅

---

🎀 SETUP 🎀

so the server config lives in a root directory — that's /etc/kxd/data/ by default, fyi. and inside that root directory, you've got per-key directories, like for example /etc/kxd/data/host1/key1/. each one of those little directories holds the following files:

• key — contains the key to give to the client. that's the whole point, that's the prize 🏆
• allowed_clients — contains one or more PEM-encoded client certificates that are allowed to request the key. ⚠️ and listen: if this file is not present, then no clients will be allowed to access this key. zero. nobody. so don't forget it bestie.
• allowed_hosts — contains one or more host names, one per line. if it's not present, then all hosts will be allowed to access that key (as long as they're authorized with a valid client certificate, obvi ✨).
• email_to — contains one or more email destinations to notify, one per line. if it's not there, then no notifications will be sent when keys get accessed. silent mode. 🤫

---

💅 OPTIONS 💅

• --key=file — the private key to use, in PAM format. defaults to /etc/kxd/key.pem.
• --cert=file — the certificate to use, in PAM format. and bestie, it must match the given key. defaults to /etc/kxd/cert.pem.
• --data_dir=directory — the data directory, where the key and the configuration live (peep the SETUP section up there 👆). defaults to /etc/kxd/data.
• --ip_addr=ip-address — the IP address to listen on. defaults to all of them. every single one.
• --logfile=file — the file to write logs to. use "-" for stdout. by default, the daemon logs to syslog.
• --port=port — the port to listen on. default port is 19840.
• --email_from=email-address — the email address to send email from.
• --smtp_addr=host:port — the address of the SMTP server to use when sending emails. if none is given, then emails will not be sent. no smtp, no mail, periodt.
• --hook=file — a script to run before authorizing keys. it gets skipped if it doesn't exist. defaults to /etc/kxd/hook.

---

🌈 FILES 🌈

• /etc/kxd/key.pem — the private key to use, in PAM format.
• /etc/kxd/cert.pem — the certificate to use, in PAM format; must match the given key.
• /etc/kxd/hook — the script to run before authorizing keys. skipped if it doesn't exist.
• /etc/kxd/data/ — the data directory, where the keys and their configuration live. the whole little ecosystem 💖

---

💜 CONTACT 💜

main website: <https://blitiri.com.ar/p/kxd> 🌐

if you've got any questions, comments or patches, please send them to "albertito@blitiri.com.ar". she reads them, fr fr 🫶

---

⭐ SEE ALSO ⭐

kxc(1), kxc-cryptsetup(1) — go read those next bestie, they're the sequel 👑

---

and that's the whole page!! this little kxd(1) manual is from 2019-08-10, so give her the respect she deserves, and go forth and exchange those keys securely. no cap. 💖✨🎀🦋🌸💅