ASTGENKEY(8)

📦 version 22.10.0, in alpine 3.22, alpine 3.23, alpine 3.24, epel 9, fedora 43, fedora 44, nixos 26.05, nixpkgs unstable, ubuntu jammy, ubuntu noble, ubuntu resolute, ubuntu stonking

💅 astgenkey — the astgenkey(8) page, but make it make sense

okay so bestie, welcome to the Linux Programmer's Manual corner of the group chat. today's main character is astgenkey, and she's here to hand you keys for Asterisk IAX2 RSA authentication. let's get into it 🎀

✨ SYNOPSIS ✨

astgenkey [ -q ] [ -n ] [ keyname ]

🦋 DESCRIPTION 🦋

so this script? it generates an RSA private and public key pair in PEM format, specifically for Asterisk to use. slay.

now listen. the private key is a secret, okay? like, keep-it-in-the-vault secret, because it can be used to fake your system's identity. that's not a vibe, that's a felony-ish vibe. so by default — meaning without the -n option — the script makes a passphrase-encrypted copy of your secret key. and if you don't enter that passphrase? you literally can't use it. no passphrase, no key, no service. periodt. 💀

but here's the catch, bestie: if you do want to use such a key with Asterisk, you'll have to start it interactively, because the scripts that start asterisk can't use that encrypted key. they just can't. they weren't built for that. 🙈

the key gets identified by a name. don't put the name on the command line? the script will prompt you for one. no skipping. 👑

the outputs of the script are:

  • name.pub — the public key: not secret. send this to the other side. share it like a playlist, it's fine. 💖
  • name.key — the private key: secret. do not share. do not post. do not text it to the group chat. 🫶

those files should be copied to /var/lib/asterisk/keys

(private key: on your system. public key: on other systems) ✨

and if you wanna see the currently-installed keys from the asterisk CLI, use this command:

keys show

🌸 OPTIONS 🌸

  • -q — run quietly. no yapping, just keys. 🤫
  • -n — don't encrypt the private key. (reminder that this is the un-encrypted route, so be careful bestie) ⚠️

🔥 SECURITY 🔥

okay this part is highkey important, so read it twice.

the keys are created using the umask of the user running the command. that means if your umask is being messy, your private key might be readable by the whole world. not iconic. not even a little.

to create the keys in a secure manner, you should check to ensure that your umask is first set to disallow the private key from being world-readable, such as with the following commands:

umask 0066

astgenkey yourkey

and then make the key accessible to Asterisk (assuming you run it as user "asterisk").

  chown asterisk /var/lib/asterisk/keys/yourname.*
🚨 do NOT skip the umask step. a world-readable private key is a whole villain arc.

🧚 FILES 🧚

  • /var/lib/asterisk/keys

🌈 SEE ALSO 🌈

👑 AUTHOR 👑

this manual page was written by Tzafrir Cohen <tzafrir.cohen@xorcom.com> 💜

permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation.

on Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL-2.

okay and that's the whole page bestie 🫶 this came from the Asterisk peeps, dated May 14th, 2005 — yes she's vintage, yes she still ate. go generate those keys responsibly, set that umask, and keep the private one private. mwah 💅✨

📦 where this page comes from