dnssec-signzone.docbook revision 268a4475065fe6a8cd7cc707820982cf5e98f430
5cd4555ad444fd391002ae32450572054369fd42Rob Austein<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
5cd4555ad444fd391002ae32450572054369fd42Rob Austein "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein [<!ENTITY mdash "—">]>
c1a883f2e04d94e99c433b1f6cfd0c0338f4ed85Mark Andrews - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - Copyright (C) 2000-2003 Internet Software Consortium.
f202f2587b9ba4753afba49b796f599cc12b4d0fAndreas Gustafsson - Permission to use, copy, modify, and distribute this software for any
f202f2587b9ba4753afba49b796f599cc12b4d0fAndreas Gustafsson - purpose with or without fee is hereby granted, provided that the above
f202f2587b9ba4753afba49b796f599cc12b4d0fAndreas Gustafsson - copyright notice and this permission notice appear in all copies.
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - PERFORMANCE OF THIS SOFTWARE.
f5d30e2864e048a42c4dc1134993ae7efdb5d6c3Mark Andrews<!-- $Id: dnssec-signzone.docbook,v 1.16 2005/05/11 05:55:36 sra Exp $ -->
b5ad6dfea4cc3e7d1d322ac99f1e5a31096837c4Mark Andrews <refentryinfo>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </refentryinfo>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <refentrytitle><application>dnssec-signzone</application></refentrytitle>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <refnamediv>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <refname><application>dnssec-signzone</application></refname>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <refpurpose>DNSSEC zone signing tool</refpurpose>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </refnamediv>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
f5d30e2864e048a42c4dc1134993ae7efdb5d6c3Mark Andrews </copyright>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </copyright>
f5d30e2864e048a42c4dc1134993ae7efdb5d6c3Mark Andrews <refsynopsisdiv>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <cmdsynopsis>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <arg><option>-d <replaceable class="parameter">directory</replaceable></option></arg>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <arg><option>-e <replaceable class="parameter">end-time</replaceable></option></arg>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <arg><option>-f <replaceable class="parameter">output-file</replaceable></option></arg>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <arg><option>-k <replaceable class="parameter">key</replaceable></option></arg>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <arg><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <arg><option>-i <replaceable class="parameter">interval</replaceable></option></arg>
a268fec7f54a89a0772a91da0511c8eae09e6157Mark Andrews <arg><option>-j <replaceable class="parameter">jitter</replaceable></option></arg>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <arg><option>-n <replaceable class="parameter">nthreads</replaceable></option></arg>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <arg><option>-o <replaceable class="parameter">origin</replaceable></option></arg>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <arg><option>-r <replaceable class="parameter">randomdev</replaceable></option></arg>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <arg><option>-s <replaceable class="parameter">start-time</replaceable></option></arg>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </cmdsynopsis>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </refsynopsisdiv>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein signs a zone. It generates
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein NSEC and RRSIG records and produces a signed version of the
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein zone. The security status of delegations from the signed zone
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein (that is, whether the child zones are secure or not) is
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein determined by the presence or absence of a
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <filename>keyset</filename> file for each child zone.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <variablelist>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Verify all generated signatures.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <term>-c <replaceable class="parameter">class</replaceable></term>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Specifies the DNS class of the zone.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <term>-k <replaceable class="parameter">key</replaceable></term>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Treat specified key as a key signing key ignoring any
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein key flags. This option may be specified multiple times.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <term>-l <replaceable class="parameter">domain</replaceable></term>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Generate a DLV set in addition to the key (DNSKEY) and DS sets.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein The domain is appended to the name of the records.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </varlistentry>
065c66d9bf1c349600027bb50e3759a3736f73abMark Andrews <varlistentry>
065c66d9bf1c349600027bb50e3759a3736f73abMark Andrews <term>-d <replaceable class="parameter">directory</replaceable></term>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Generate DS records for child zones from keyset files.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Existing DS records will be removed.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <term>-s <replaceable class="parameter">start-time</replaceable></term>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Specify the date and time when the generated RRSIG records
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein become valid. This can be either an absolute or relative
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein time. An absolute start time is indicated by a number
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein in YYYYMMDDHHMMSS notation; 20000530144500 denotes
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein 14:45:00 UTC on May 30th, 2000. A relative start time is
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein indicated by +N, which is N seconds from the current time.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein If no <option>start-time</option> is specified, the current
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein time minus 1 hour (to allow for clock skew) is used.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <term>-e <replaceable class="parameter">end-time</replaceable></term>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Specify the date and time when the generated RRSIG records
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein expire. As with <option>start-time</option>, an absolute
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein time is indicated in YYYYMMDDHHMMSS notation. A time relative
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein to the start time is indicated with +N, which is N seconds from
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein the start time. A time relative to the current time is
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein indicated with now+N. If no <option>end-time</option> is
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein specified, 30 days from the start time is used as a default.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <term>-f <replaceable class="parameter">output-file</replaceable></term>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein The name of the output file containing the signed zone. The
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein default is to append <filename>.signed</filename> to
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Prints a short summary of the options and arguments to
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <term>-i <replaceable class="parameter">interval</replaceable></term>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein When a previously signed zone is passed as input, records
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein may be resigned. The <option>interval</option> option
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein specifies the cycle interval as an offset from the current
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein time (in seconds). If a RRSIG record expires after the
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein cycle interval, it is retained. Otherwise, it is considered
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein to be expiring soon, and it will be replaced.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein The default cycle interval is one quarter of the difference
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein between the signature end and start times. So if neither
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <option>end-time</option> or <option>start-time</option>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein are specified, <command>dnssec-signzone</command>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein signatures that are valid for 30 days, with a cycle
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein interval of 7.5 days. Therefore, if any existing RRSIG records
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein are due to expire in less than 7.5 days, they would be
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <term>-j <replaceable class="parameter">jitter</replaceable></term>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein When signing a zone with a fixed signature lifetime, all
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein RRSIG records issued at the time of signing expires
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein simultaneously. If the zone is incrementally signed, i.e.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein a previously signed zone is passed as input to the signer,
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein all expired signatures has to be regenerated at about the
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein same time. The <option>jitter</option> option specifies a
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein jitter window that will be used to randomize the signature
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein expire time, thus spreading incremental signature
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein regeneration over time.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Signature lifetime jitter also to some extent benefits
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein validators and servers by spreading out cache expiration,
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein i.e. if large numbers of RRSIGs don't expire at the same time
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein from all caches there will be less congestion than if all
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein validators need to refetch at mostly the same time.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <term>-n <replaceable class="parameter">ncpus</replaceable></term>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Specifies the number of threads to use. By default, one
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein thread is started for each detected CPU.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </varlistentry>
a268fec7f54a89a0772a91da0511c8eae09e6157Mark Andrews <varlistentry>
561a29af8c54a216e7d30b5b4f6e0d21661654ecMark Andrews <term>-o <replaceable class="parameter">origin</replaceable></term>
a268fec7f54a89a0772a91da0511c8eae09e6157Mark Andrews The zone origin. If not specified, the name of the zone file
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein is assumed to be the origin.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Use pseudo-random data when signing the zone. This is faster,
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein but less secure, than using real random data. This option
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein may be useful when signing large zones or when the entropy
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein source is limited.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <term>-r <replaceable class="parameter">randomdev</replaceable></term>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Specifies the source of randomness. If the operating
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein system does not provide a <filename>/dev/random</filename>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein or equivalent device, the default source of randomness
c6d4f781529d2f28693546b25b2967d44ec89e60Mark Andrews is keyboard input. <filename>randomdev</filename>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein the name of a character device or file containing random
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein data to be used instead of the default. The special value
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <filename>keyboard</filename> indicates that keyboard
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein input should be used.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Print statistics at completion.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <term>-v <replaceable class="parameter">level</replaceable></term>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Sets the debugging level.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Ignore KSK flag on key when determining what to sign.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein The file containing the zone to be signed.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Sets the debugging level.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein The keys used to sign the zone. If no keys are specified, the
561a29af8c54a216e7d30b5b4f6e0d21661654ecMark Andrews default all zone keys that have private key files in the
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein current directory.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </variablelist>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein The following command signs the <userinput>example.com</userinput>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein zone with the DSA key generated in the <command>dnssec-keygen</command>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein man page. The zone's keys must be in the zone. If there are
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <filename>keyset</filename> files associated with child
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein they must be in the current directory.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <userinput>example.com</userinput>, the following command would be
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <para><userinput>dnssec-signzone -o example.com db.example.com
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein The command would print a string of the form:
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein In this example, <command>dnssec-signzone</command> creates
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein the file <filename>db.example.com.signed</filename>. This
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein should be referenced in a zone statement in a
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </citerefentry>,
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <para><corpauthor>Internet Systems Consortium</corpauthor>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein - Local variables:
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein - mode: sgml