contrib/bind9/bin/dnssec/dnssec-dsfromkey.docbook

   1 <!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
   2                "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
   3                [<!ENTITY mdash "&#8212;">]>
   4 <!--
   5  - Copyright (C) 2008-2012, 2014  Internet Systems Consortium, Inc. ("ISC")
   6  -
   7  - Permission to use, copy, modify, and/or distribute this software for any
   8  - purpose with or without fee is hereby granted, provided that the above
   9  - copyright notice and this permission notice appear in all copies.
  10  -
  11  - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
  12  - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  13  - AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
  14  - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
  15  - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
  16  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  17  - PERFORMANCE OF THIS SOFTWARE.
  18 -->
  19
  20 <refentry id="man.dnssec-dsfromkey">
  21   <refentryinfo>
  22     <date>May 17, 2012</date>
  23   </refentryinfo>
  24
  25   <refmeta>
  26     <refentrytitle><application>dnssec-dsfromkey</application></refentrytitle>
  27     <manvolnum>8</manvolnum>
  28     <refmiscinfo>BIND9</refmiscinfo>
  29   </refmeta>
  30
  31   <refnamediv>
  32     <refname><application>dnssec-dsfromkey</application></refname>
  33     <refpurpose>DNSSEC DS RR generation tool</refpurpose>
  34   </refnamediv>
  35
  36   <docinfo>
  37     <copyright>
  38       <year>2008</year>
  39       <year>2009</year>
  40       <year>2010</year>
  41       <year>2011</year>
  42       <year>2012</year>
  43       <year>2014</year>
  44       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
  45     </copyright>
  46   </docinfo>
  47
  48   <refsynopsisdiv>
  49     <cmdsynopsis>
  50       <command>dnssec-dsfromkey</command>
  51       <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>
  52       <arg><option>-1</option></arg>
  53       <arg><option>-2</option></arg>
  54       <arg><option>-a <replaceable class="parameter">alg</replaceable></option></arg>
  55       <arg><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
  56       <arg><option>-T <replaceable class="parameter">TTL</replaceable></option></arg>
  57       <arg choice="req">keyfile</arg>
  58     </cmdsynopsis>
  59     <cmdsynopsis>
  60       <command>dnssec-dsfromkey</command>
  61       <arg choice="req">-s</arg>
  62       <arg><option>-1</option></arg>
  63       <arg><option>-2</option></arg>
  64       <arg><option>-a <replaceable class="parameter">alg</replaceable></option></arg>
  65       <arg><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
  66       <arg><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
  67       <arg><option>-s</option></arg>
  68       <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg>
  69       <arg><option>-T <replaceable class="parameter">TTL</replaceable></option></arg>
  70       <arg><option>-f <replaceable class="parameter">file</replaceable></option></arg>
  71       <arg><option>-A</option></arg>
  72       <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>
  73       <arg choice="req">dnsname</arg>
  74    </cmdsynopsis>
  75     <cmdsynopsis>
  76       <command>dnssec-dsfromkey</command>
  77       <arg><option>-h</option></arg>
  78       <arg><option>-V</option></arg>
  79    </cmdsynopsis>
  80   </refsynopsisdiv>
  81
  82   <refsect1>
  83     <title>DESCRIPTION</title>
  84     <para><command>dnssec-dsfromkey</command>
  85       outputs the Delegation Signer (DS) resource record (RR), as defined in
  86       RFC 3658 and RFC 4509, for the given key(s).
  87     </para>
  88   </refsect1>
  89
  90   <refsect1>
  91     <title>OPTIONS</title>
  92
  93     <variablelist>
  94       <varlistentry>
  95         <term>-1</term>
  96         <listitem>
  97           <para>
  98             Use SHA-1 as the digest algorithm (the default is to use
  99             both SHA-1 and SHA-256).
 100           </para>
 101         </listitem>
 102       </varlistentry>
 103
 104       <varlistentry>
 105         <term>-2</term>
 106         <listitem>
 107           <para>
 108             Use SHA-256 as the digest algorithm.
 109           </para>
 110         </listitem>
 111       </varlistentry>
 112
 113       <varlistentry>
 114         <term>-a <replaceable class="parameter">algorithm</replaceable></term>
 115         <listitem>
 116           <para>
 117             Select the digest algorithm. The value of
 118             <option>algorithm</option> must be one of SHA-1 (SHA1),
 119             SHA-256 (SHA256), GOST or SHA-384 (SHA384).
 120             These values are case insensitive.
 121           </para>
 122         </listitem>
 123       </varlistentry>
 124
 125       <varlistentry>
 126         <term>-T <replaceable class="parameter">TTL</replaceable></term>
 127         <listitem>
 128           <para>
 129             Specifies the TTL of the DS records.
 130           </para>
 131           </listitem>
 132       </varlistentry>
 133
 134       <varlistentry>
 135         <term>-K <replaceable class="parameter">directory</replaceable></term>
 136         <listitem>
 137           <para>
 138             Look for key files (or, in keyset mode,
 139             <filename>keyset-</filename> files) in
 140             <option>directory</option>.
 141           </para>
 142         </listitem>
 143       </varlistentry>
 144
 145       <varlistentry>
 146         <term>-f <replaceable class="parameter">file</replaceable></term>
 147         <listitem>
 148           <para>
 149             Zone file mode: in place of the keyfile name, the argument is
 150             the DNS domain name of a zone master file, which can be read
 151             from <option>file</option>.  If the zone name is the same as
 152             <option>file</option>, then it may be omitted.
 153           </para>
 154           <para>
 155             If <option>file</option> is set to <literal>"-"</literal>, then
 156             the zone data is read from the standard input.  This makes it
 157             possible to use the output of the <command>dig</command>
 158             command as input, as in:
 159           </para>
 160           <para>
 161             <userinput>dig dnskey example.com | dnssec-dsfromkey -f - example.com</userinput>
 162           </para>
 163         </listitem>
 164       </varlistentry>
 165
 166       <varlistentry>
 167         <term>-A</term>
 168         <listitem>
 169           <para>
 170             Include ZSK's when generating DS records.  Without this option,
 171             only keys which have the KSK flag set will be converted to DS
 172             records and printed.  Useful only in zone file mode.
 173           </para>
 174         </listitem>
 175       </varlistentry>
 176
 177       <varlistentry>
 178         <term>-l <replaceable class="parameter">domain</replaceable></term>
 179         <listitem>
 180           <para>
 181             Generate a DLV set instead of a DS set.  The specified
 182             <option>domain</option> is appended to the name for each
 183             record in the set.
 184             The DNSSEC Lookaside Validation (DLV) RR is described
 185             in RFC 4431.
 186           </para>
 187         </listitem>
 188       </varlistentry>
 189
 190       <varlistentry>
 191         <term>-s</term>
 192         <listitem>
 193           <para>
 194             Keyset mode: in place of the keyfile name, the argument is
 195             the DNS domain name of a keyset file.
 196           </para>
 197         </listitem>
 198       </varlistentry>
 199
 200       <varlistentry>
 201         <term>-c <replaceable class="parameter">class</replaceable></term>
 202         <listitem>
 203           <para>
 204             Specifies the DNS class (default is IN).  Useful only
 205             in keyset or zone file mode.
 206           </para>
 207           </listitem>
 208       </varlistentry>
 209
 210       <varlistentry>
 211         <term>-v <replaceable class="parameter">level</replaceable></term>
 212         <listitem>
 213           <para>
 214             Sets the debugging level.
 215           </para>
 216         </listitem>
 217       </varlistentry>
 218
 219       <varlistentry>
 220         <term>-h</term>
 221         <listitem>
 222           <para>
 223             Prints usage information.
 224           </para>
 225         </listitem>
 226       </varlistentry>
 227
 228       <varlistentry>
 229         <term>-V</term>
 230         <listitem>
 231           <para>
 232             Prints version information.
 233           </para>
 234         </listitem>
 235       </varlistentry>
 236     </variablelist>
 237   </refsect1>
 238
 239   <refsect1>
 240     <title>EXAMPLE</title>
 241     <para>
 242       To build the SHA-256 DS RR from the
 243       <userinput>Kexample.com.+003+26160</userinput>
 244       keyfile name, the following command would be issued:
 245     </para>
 246     <para><userinput>dnssec-dsfromkey -2 Kexample.com.+003+26160</userinput>
 247     </para>
 248     <para>
 249       The command would print something like:
 250     </para>
 251     <para><userinput>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</userinput>
 252     </para>
 253   </refsect1>
 254
 255   <refsect1>
 256     <title>FILES</title>
 257     <para>
 258       The keyfile can be designed by the key identification
 259       <filename>Knnnn.+aaa+iiiii</filename> or the full file name
 260       <filename>Knnnn.+aaa+iiiii.key</filename> as generated by
 261       <refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>.
 262     </para>
 263     <para>
 264       The keyset file name is built from the <option>directory</option>,
 265       the string <filename>keyset-</filename> and the
 266       <option>dnsname</option>.
 267     </para>
 268   </refsect1>
 269
 270   <refsect1>
 271     <title>CAVEAT</title>
 272     <para>
 273       A keyfile error can give a "file not found" even if the file exists.
 274     </para>
 275   </refsect1>
 276
 277   <refsect1>
 278     <title>SEE ALSO</title>
 279     <para><citerefentry>
 280         <refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>
 281       </citerefentry>,
 282       <citerefentry>
 283         <refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
 284       </citerefentry>,
 285       <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
 286       <citetitle>RFC 3658</citetitle>,
 287       <citetitle>RFC 4431</citetitle>.
 288       <citetitle>RFC 4509</citetitle>.
 289     </para>
 290   </refsect1>
 291
 292   <refsect1>
 293     <title>AUTHOR</title>
 294     <para><corpauthor>Internet Systems Consortium</corpauthor>
 295     </para>
 296   </refsect1>
 297
 298 </refentry><!--
 299  - Local variables:
 300  - mode: sgml
 301  - End:
 302 -->