Red Hat Enterprise Linux 5 Administration Unleashed

146CHAPTER 5Working with RPM SoftwareIf you do not already have a GPG key or want to use a different one for signing packages,use the following command to generate a GPG key:gpg --gen-keyBe sure to run this command as root so that the memory used to generate the key can belocked. Non-root users can not lock access to memory, giving someone the opportunity toread the memory used to generate the key. Unlocked memory might also be written todisk. Listing 5.13 shows what is displayed after executing the command.LISTING 5.13Generating a GPG Keygpg (GnuPG) 1.4.5; Copyright (C) 2006 Free Software Foundation, Inc.This program comes with ABSOLUTELY NO WARRANTY.This is free software, and you are welcome to redistribute itunder certain conditions. See the file COPYING for details.gpg: directory `/root/.gnupg’ createdgpg: new configuration file `/root/.gnupg/gpg.conf’ createdgpg: WARNING: options in `/root/.gnupg/gpg.conf’ are not yet active during this rungpg: keyring `/root/.gnupg/secring.gpg’ createdgpg: keyring `/root/.gnupg/pubring.gpg’ createdPlease select what kind of key you want:(1) DSA and Elgamal (default)(2) DSA (sign only)(5) RSA (sign only)Your selection?Select the default key type by typing 1 when prompted. Next, you are prompted for a keysize. The longer the key size, the more secure. A size of at least 1024 bits is recommended.A key can have an expiration date. If an expiration date is entered, everyone with thepublic key is notified of its expiration when they try to use the public key after the expirationdate. Unless you have a specific reason to make the key expire, enter 0 for the expirationdate, meaning that there is not expiration date for the key. Type y to confirm thatthe key will not expire.The following message appears next:You need a user ID to identify your key; the software constructs the user IDfrom the Real Name, Comment and Email Address in this form:“Heinrich Heine (Der Dichter) ”This user ID can be read by everyone with the public key, so choose it carefully. If youare generating this for your company, instead of using your name, use the companyname. Use an email address that will still be active after several years such assecurity@example.com. The individual email address that receives the email can changeover the years, while the generic email address stays the same.