SHIB-SECKEYGEN.8(8)

📦
version 3.5.2 · 6 versions
, in ubuntu resolute, ubuntu stonking

✨ SHIB-SECKEYGEN.8(8) ✨

okay bestie, so this is shib-seckeygen, a section 8 (admin/system) manual page from the Shibboleth fam. it does exactly one iconic thing and it does it well: it rotates the keys of a Versioned DataSealer. 🎀

💖 NAME 💖

shib-seckeygen — rotate the keys of a Versioned DataSealer

🦋 SYNOPSIS 🦋

shib-seckeygen [-o output-dir] [-f filename]
    [-h history-length] [-b key-size]
    [-u user] [-g group]

🌸 DESCRIPTION 🌸

The Versioned <DataSealer> type? it's literally built for production use, no cap. it gets its key material from a simple flat file, and that flat file is the whole vibe: it lets you keep a history of several keys around so you can still decrypt older data, and it lets you continuously rotate the encryption key on a regular basis — usually daily. 🗓️✨

The flat file format is just lines that look like this:

<name>:<key>

where the name is typically a number for record keeping (but bestie, it can be any label you want, go off), and the key is base64-encoded. The key length is what dictates which AES-GCM algorithm gets used, and the supported key sizes are 128, 192, and 256. the "default" key — the one used for new operations — is the last line in the file. 👑

This script gives you a simple means of rotating the key, and the Service Provider software will typically notice when the file changes and reload it. it's giving set-it-and-forget-it. 💅

✨ OPTIONS ✨

  • -b key-size — how many random bits go into the newly generated key. supported sizes are listed up above (look at you, reading). default is 128.
  • -g group — change the group ownership of the key file to this group. default is "_shibd".
  • -h history-length — the maximum number of keys to keep in the file. default is 14.
  • -f filename — the name of the file containing the keys, inside output-dir. default is "sealer.keys".
  • -o output-dir — the key file and a temporary key file are created in this directory. default is "/etc/shibboleth".
  • -u user — change the ownership of the key file to this user. default is "_shibd".

🎀 FILES 🎀

  • /etc/shibboleth/sealer.keys — the default key file that this script rotates. that's the one, that's the main character. 👑

🫶 AUTHOR 🫶

This manual page was written by Ferenc Wágner for Debian GNU/Linux, using the text on

https://wiki.shibboleth.net/confluence/display/SP3/VersionedDataSealer

Copyright 2018 Shibboleth Project. License: Creative Commons Attribution-ShareAlike 3.0.

and that's the whole page, bestie!! 🌈⭐ this was version 3.5.2, dated 2026-02-01, and honestly? she ate. 💅✨ go rotate those keys, ily, mwah 🎀🦋🌸

📦 where this page comes from