dnssec-signzone.html revision d4ef65050feac78554addf6e16a06c6e2e0bd331
910df8b3f50a0515b430b999d4750de94c509f2atrawick - Copyright (C) 2001 Internet Software Consortium.
e57f991fe2b9a4c080cd50ca913a2a5693b096b5aaron - Permission to use, copy, modify, and distribute this software for any
e57f991fe2b9a4c080cd50ca913a2a5693b096b5aaron - purpose with or without fee is hereby granted, provided that the above
924c8dd40352ca7775704a31a7a77ab86dc951b4ianh - copyright notice and this permission notice appear in all copies.
910df8b3f50a0515b430b999d4750de94c509f2atrawick - THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
910df8b3f50a0515b430b999d4750de94c509f2atrawick - DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
910df8b3f50a0515b430b999d4750de94c509f2atrawick - IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
910df8b3f50a0515b430b999d4750de94c509f2atrawick - INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
0d628dd174dd6de13463b10d2599f6cac24e9fe8brianp - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
0d628dd174dd6de13463b10d2599f6cac24e9fe8brianp - FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
0d628dd174dd6de13463b10d2599f6cac24e9fe8brianp - NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
2fee4fe267fa3577fd71d8c314fe9b527e2b90c0brianp - WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
2fee4fe267fa3577fd71d8c314fe9b527e2b90c0brianp<!-- $Id: dnssec-signzone.html,v 1.2 2001/04/10 21:50:38 bwelling Exp $ -->
6ef713e25735887d4a59a879b97a68bd575ecb92trawick>dnssec-signzone</TITLE
cef5cb47e2ea4c174c01762d4430613db0f41e5cstoddardNAME="GENERATOR"
cef5cb47e2ea4c174c01762d4430613db0f41e5cstoddardCONTENT="Modular DocBook HTML Stylesheet Version 1.61
8abd60101b9794e224795ccf68b8ba984efbc94astoddardCLASS="REFENTRY"
ca47a2b6bcea23e8af185c68f256dcbbfd2a0f9dtrawickBGCOLOR="#FFFFFF"
ca47a2b6bcea23e8af185c68f256dcbbfd2a0f9dtrawickTEXT="#000000"
6ef713e25735887d4a59a879b97a68bd575ecb92trawickLINK="#0000FF"
6ef713e25735887d4a59a879b97a68bd575ecb92trawickVLINK="#840084"
ca47a2b6bcea23e8af185c68f256dcbbfd2a0f9dtrawickALINK="#0000FF"
26d590c0e5338f66ca1aad6f925374843fac5121stoddardCLASS="APPLICATION"
2b31ac2c6342d2afcf67b7b0f08c928a87f98c74wrowe>dnssec-signzone</SPAN
d472f67198d6b15dd1270136f180cca9c9263243trawickCLASS="REFNAMEDIV"
b760518cc17e7124ba546ed63063603f1ab82a40aaronCLASS="APPLICATION"
b760518cc17e7124ba546ed63063603f1ab82a40aaron>dnssec-signzone</SPAN
b760518cc17e7124ba546ed63063603f1ab82a40aaron> -- DNSSEC zone signing tool</DIV
b760518cc17e7124ba546ed63063603f1ab82a40aaronCLASS="REFSYNOPSISDIV"
b760518cc17e7124ba546ed63063603f1ab82a40aaronNAME="AEN13"
23d8f62856c1531526042e1c5edf44557cadd2e5trawick>Synopsis</H2
705c8ed3ef608706c91ca12483d7b54ff9007cc9jerenkrantzCLASS="COMMAND"
705c8ed3ef608706c91ca12483d7b54ff9007cc9jerenkrantz>dnssec-signzone</B
ef154948c97c53cdc1ad5329cb83c32ad26cf416aaronCLASS="OPTION"
c6741d11357aace4c9ba39535d3cb2d751f46114trawickCLASS="OPTION"
c6741d11357aace4c9ba39535d3cb2d751f46114trawickCLASS="REPLACEABLE"
86a5d34400b7f586ad2cca97c8b33b2f55bac61btrawickCLASS="OPTION"
86a5d34400b7f586ad2cca97c8b33b2f55bac61btrawickCLASS="REPLACEABLE"
6b477c0a238733ca8fd156629310513d29dc7e02trawick>directory</I
2b31ac2c6342d2afcf67b7b0f08c928a87f98c74wroweCLASS="OPTION"
557eb8d48357657fa898250560f089c65539c634gregamesCLASS="REPLACEABLE"
557eb8d48357657fa898250560f089c65539c634gregames>start-time</I
25b715e9687f82ea055fdea2a9761c7e5f1ac6eetrawickCLASS="OPTION"
51ced3b28ef430a96586284d4320f7dbdaf7225ebrianpCLASS="REPLACEABLE"
51ced3b28ef430a96586284d4320f7dbdaf7225ebrianp>end-time</I
a222035458f89e2db231450ba6d5fae8052da5f5aaronCLASS="OPTION"
4a872628ca5bf20847f442a625c255b643120db0wroweCLASS="REPLACEABLE"
74528257888620220641cd28366731539a37e1f3ianh>output-file</I
f2afeedf074acc1a698a9527154eacd138e6c5a1trawickCLASS="OPTION"
855e263a93fde2e30d10a48a9ffc047039bfc9d9brianpCLASS="OPTION"
54b3b7946d22324cea615d7c8a4ff0c9eadd1f8crbbCLASS="REPLACEABLE"
54b3b7946d22324cea615d7c8a4ff0c9eadd1f8crbb>interval</I
e28c02dc08247d3fcb71e81791cac2311a248dfdrbbCLASS="OPTION"
e28c02dc08247d3fcb71e81791cac2311a248dfdrbbCLASS="REPLACEABLE"
e28c02dc08247d3fcb71e81791cac2311a248dfdrbb>nthreads</I
f9f506f0686ad065b4c6fe14dd962cdd478350dbianhCLASS="OPTION"
9d0665da83d1e22c0ea0e5f6f940f70f75bf5237ianhCLASS="REPLACEABLE"
47c2fb4c1f155ddb6954e46e7f6d125eef78b3bbaaronCLASS="OPTION"
9ca934cec0a1cc3c425fde5dc51956bce6cd3183brianpCLASS="OPTION"
0cdca1e056a05a09fe16fe736abcf79969c9767ejerenkrantzCLASS="REPLACEABLE"
0cdca1e056a05a09fe16fe736abcf79969c9767ejerenkrantz>randomdev</I
0a2d57d962bef3a8898723925b3fb02d2e836994dougmCLASS="OPTION"
06461d67f387ea068187e6dfa036875a8205c04cjerenkrantzCLASS="OPTION"
900127764fb985c340ee4979cac97146a330c694trawickCLASS="REPLACEABLE"
6f4c27ba6e152792f3729069e8d8313ebc87cc60jwoolley>] {zonefile} [key...]</P
23ce412bd50a47accab4dd26019b78810bbf46ebtrawickCLASS="REFSECT1"
23ce412bd50a47accab4dd26019b78810bbf46ebtrawickNAME="AEN56"
6865813dee5d3c1ebf12dd810368171792a0190atrawick>DESCRIPTION</H2
97719ad970d779ac48af9364ab0ea9fdcc27470ajwoolleyCLASS="COMMAND"
5ad238c42b1e159ee8f164515e0c4ee6c727c2fdtrawick>dnssec-signzone</B
5ad238c42b1e159ee8f164515e0c4ee6c727c2fdtrawick> signs a zone. It generates NXT
5ad238c42b1e159ee8f164515e0c4ee6c727c2fdtrawick and SIG records and produces a signed version of the zone. If there
ba00c3b7c20f00ce631b89ae3b1cd3bae8d1b165rbbCLASS="FILENAME"
ba00c3b7c20f00ce631b89ae3b1cd3bae8d1b165rbb>signedkey</TT
ba00c3b7c20f00ce631b89ae3b1cd3bae8d1b165rbb> file from the zone's parent,
ba00c3b7c20f00ce631b89ae3b1cd3bae8d1b165rbb the parent's signatures will be incorporated into the generated
ba00c3b7c20f00ce631b89ae3b1cd3bae8d1b165rbb signed zone file. The security status of delegations from the the
6e954603b02f2b7d4ad80af17d9b3cc6f0bacf69rbb signed zone (that is, whether the child zones are secure or not) is
6e954603b02f2b7d4ad80af17d9b3cc6f0bacf69rbb determined by the presence or absence of a
6e954603b02f2b7d4ad80af17d9b3cc6f0bacf69rbbCLASS="FILENAME"
6e954603b02f2b7d4ad80af17d9b3cc6f0bacf69rbb>signedkey</TT
6e954603b02f2b7d4ad80af17d9b3cc6f0bacf69rbb> file for each child zone.
fa449f5bc87c5d87c4c60e778c9c882e7254de7ejwoolleyCLASS="REFSECT1"
fa449f5bc87c5d87c4c60e778c9c882e7254de7ejwoolleyNAME="AEN62"
227d23a7db41dd89f52391c9356dbb1adcd675e0jwoolley>OPTIONS</H2
227d23a7db41dd89f52391c9356dbb1adcd675e0jwoolleyCLASS="VARIABLELIST"
17bc0e8f2e3816e25bc8fd3fadf39357340aebd0jerenkrantz> Verify all generated signatures.
e6cc28a5eb3371ba0c38e941855e71ff0054f50erbbCLASS="REPLACEABLE"
cf233fb4b439415a2bf7bab7e622afd994e0bebftrawick> Specifies the DNS class of the zone.
2a20a2f8432a15b530e0a6b0998c32f40aef82a8gregamesCLASS="REPLACEABLE"
2a20a2f8432a15b530e0a6b0998c32f40aef82a8gregames>directory</I
2a20a2f8432a15b530e0a6b0998c32f40aef82a8gregames> Look for <TT
2a20a2f8432a15b530e0a6b0998c32f40aef82a8gregamesCLASS="FILENAME"
8d49090fd56a8ce06c7f7135f19e5ff8e24b5ff3gregames>signedkey</TT
270609308f247c5e934b400b5f1691c2cca16c61jerenkrantzCLASS="OPTION"
270609308f247c5e934b400b5f1691c2cca16c61jerenkrantz>directory</TT
8458877c9ba0af86acd590eea531476adde3d02dmartin> as the directory
644be6f54749d2d9950d2c4d2ac448f7af016d26martinCLASS="REPLACEABLE"
644be6f54749d2d9950d2c4d2ac448f7af016d26martin>start-time</I
b30b04f639d479b96cc08c43ffa34c92ba275676ianh> Specify the date and time when the generated SIG records
c4fbc4018fd2b6716673a38ee27eeb36cba41c5djwoolley become valid. This can be either an absolute or relative
c4fbc4018fd2b6716673a38ee27eeb36cba41c5djwoolley time. An absolute start time is indicated by a number
c4fbc4018fd2b6716673a38ee27eeb36cba41c5djwoolley in YYYYMMDDHHMMSS notation; 20000530144500 denotes
c4fbc4018fd2b6716673a38ee27eeb36cba41c5djwoolley 14:45:00 UTC on May 30th, 2000. A relative start time is
f4e4643c309e5b5da60e13f9a25984d54b307caawrowe indicated by +N, which is N seconds from the current time.
f4e4643c309e5b5da60e13f9a25984d54b307caawroweCLASS="OPTION"
2548497d480c4f3e9b3fe14711bd510aa2157434gregames>start-time</TT
2548497d480c4f3e9b3fe14711bd510aa2157434gregames> is specified, the current
2548497d480c4f3e9b3fe14711bd510aa2157434gregames time is used.
da6e93dca0222159650783802e23172e3160605egregamesCLASS="REPLACEABLE"
c927e13f298c42251296d33cc1fa3eb8232b843daaron>end-time</I
9126ed10455a2a98a3a51c68ed1b356e1873e8e6aaron> Specify the date and time when the generated SIG records
9126ed10455a2a98a3a51c68ed1b356e1873e8e6aaron expire. As with <TT
9126ed10455a2a98a3a51c68ed1b356e1873e8e6aaronCLASS="OPTION"
fa3ca21e09bac0dbc2045e9f53963ba46cfed5b1trawick>start-time</TT
fa3ca21e09bac0dbc2045e9f53963ba46cfed5b1trawick>, an absolute
fa3ca21e09bac0dbc2045e9f53963ba46cfed5b1trawick time is indicated in YYYYMMDDHHMMSS notation. A time relative
fa3ca21e09bac0dbc2045e9f53963ba46cfed5b1trawick to the start time is indicated with +N, which is N seconds from
18acb2c0df442ead1d075a1a2207cbb197725b14coar the start time. A time realtive to the current time is
18acb2c0df442ead1d075a1a2207cbb197725b14coar indicated with now+N. If no <TT
18acb2c0df442ead1d075a1a2207cbb197725b14coarCLASS="OPTION"
18acb2c0df442ead1d075a1a2207cbb197725b14coar>end-time</TT
617f972690d850a52cd4e9ef2f32d356e0fae715aaron specified, 30 days from the start time is used as a default.
9278d5393ef084f4fc6d7ec8641af5959442c157jwoolleyCLASS="REPLACEABLE"
022cff78006f698453640e0a0e97cc5f8c9de59drbb>output-file</I
526a776292f420ffeea0d081c61971ed381fad20stoddard> The name of the output file containing the signed zone. The
526a776292f420ffeea0d081c61971ed381fad20stoddard default is to append <TT
526a776292f420ffeea0d081c61971ed381fad20stoddardCLASS="FILENAME"
526a776292f420ffeea0d081c61971ed381fad20stoddard>.signed</TT
526a776292f420ffeea0d081c61971ed381fad20stoddard input file.
62ddc9851530478919d169ba9c34b80f60cf7718trawick> Prints a short summary of the options and arguments to
62ddc9851530478919d169ba9c34b80f60cf7718trawickCLASS="COMMAND"
62ddc9851530478919d169ba9c34b80f60cf7718trawick>dnssec-signzone</B
904d7bf799c6216beb34519463596b4fce630308wroweCLASS="REPLACEABLE"
904d7bf799c6216beb34519463596b4fce630308wrowe>interval</I
17a4c6968b2fa692ff4dde12fe305230ee6b0421aaron> When a previously signed zone is passed as input, records
83b031099aa3dc8a5fd2f708e397818cbd16c9aajerenkrantz may be resigned. The <TT
83b031099aa3dc8a5fd2f708e397818cbd16c9aajerenkrantzCLASS="OPTION"
83b031099aa3dc8a5fd2f708e397818cbd16c9aajerenkrantz>interval</TT
01e77cadbd9ad4962993380245bcc033dde523e4rbb specifies the cycle interval as an offset from the current
01e77cadbd9ad4962993380245bcc033dde523e4rbb time (in seconds). If a SIG record expires after the
8ea9794272347cfdd92861f46295406649f01afatrawick cycle interval, it is retained. Otherwise, it is considered
8ea9794272347cfdd92861f46295406649f01afatrawick to be expiring soon, and it will be replaced.
b900452c9c36031434d318880f023c0fb9143325rbb> The default cycle interval is one quarter of the difference
b900452c9c36031434d318880f023c0fb9143325rbb between the signature end and start times. So if neither
b900452c9c36031434d318880f023c0fb9143325rbbCLASS="OPTION"
b900452c9c36031434d318880f023c0fb9143325rbb>end-time</TT
b900452c9c36031434d318880f023c0fb9143325rbbCLASS="OPTION"
b900452c9c36031434d318880f023c0fb9143325rbb>start-time</TT
43053faf24ffe7657bb32bc06d4058dedf3ef053rbb are specified, <B
8b666e1fb772b6fe45de3604b224f3e1f2cfd620rbbCLASS="COMMAND"
c453a141db60a5b19649eac508f4851a8729c556rbb>dnssec-signzone</B
c453a141db60a5b19649eac508f4851a8729c556rbb> generates
c453a141db60a5b19649eac508f4851a8729c556rbb signatures that are valid for 30 days, with a cycle
8b91dcac0e1ef7796c72d16b0962267313cac486jerenkrantz interval of 7.5 days. Therefore, if any existing SIG records
8b91dcac0e1ef7796c72d16b0962267313cac486jerenkrantz are due to expire in less than 7.5 days, they would be
6ce942b017db75b559a42bdc2d7b8ea9e869a956wroweCLASS="REPLACEABLE"
7dfed2b71c9c4223996cbd7c5c0c85c7c8fef2a4rbb> Specifies the number of threads to use. By default, one
574f6ff9ee80ef4f772649c5c8319b764a8abe42jerenkrantz thread is started for each detected CPU.
6d7d70dbda8e461d87f2d41e323755496ae3ebc7trawickCLASS="REPLACEABLE"
a310497ca9c5112d759871e1b7d9f6a40fb78bcfwrowe> The zone origin. If not specified, the name of the zone file
a310497ca9c5112d759871e1b7d9f6a40fb78bcfwrowe is assumed to be the origin.
e36ef0d081aa59867688bcbb3da65952ec16fae3rbb> Use pseudo-random data when signing the zone. This is faster,
e36ef0d081aa59867688bcbb3da65952ec16fae3rbb but less secure, than using real random data. This option
e36ef0d081aa59867688bcbb3da65952ec16fae3rbb may be useful when signing large zones or when the entropy
e36ef0d081aa59867688bcbb3da65952ec16fae3rbb source is limited.
e36ef0d081aa59867688bcbb3da65952ec16fae3rbbCLASS="REPLACEABLE"
52df98b165194a0ad68885f49f81fdaf56ece568wrowe>randomdev</I
2c294c31addd5c957bafe6e78c4a30d423ad6e80rbb> Specifies the source of randomness. If the operating
2c294c31addd5c957bafe6e78c4a30d423ad6e80rbb system does not provide a <TT
7e44dd5082cd865068285e8f915bb5f045e0bb80larsCLASS="FILENAME"
7e44dd5082cd865068285e8f915bb5f045e0bb80lars or equivalent device, the default source of randomness
44a4ee1140769173da7bc2b42d1a686e3260ad84wrowe is keyboard input. <TT
44a4ee1140769173da7bc2b42d1a686e3260ad84wroweCLASS="FILENAME"
44a4ee1140769173da7bc2b42d1a686e3260ad84wrowe>randomdev</TT
44a4ee1140769173da7bc2b42d1a686e3260ad84wrowe the name of a character device or file containing random
e379fc6d7f79163700290d92ce75deb4f3005301jerenkrantz data to be used instead of the default. The special value
e379fc6d7f79163700290d92ce75deb4f3005301jerenkrantzCLASS="FILENAME"
978faa9e29e0f0c42e66c07240e562325a4717b0jerenkrantz>keyboard</TT
978faa9e29e0f0c42e66c07240e562325a4717b0jerenkrantz> indicates that keyboard
978faa9e29e0f0c42e66c07240e562325a4717b0jerenkrantz input should be used.
976501adbc040220270f7d1d77c4b8373033be69wrowe> Print statistics at completion.
8a3a703eae0e35f674b189181609545c6fc77a09rbbCLASS="REPLACEABLE"
9d41fafe32b324c197f25224207fc6ce34f085bfrbb> Sets the debugging level.
889d9c84f8b1ad850f977a6d8e548696994f8f86jerenkrantz>zonefile</DT
8c83461e53ca7d204e1d634f0c78199d60320d7bjerenkrantz> The file containing the zone to be signed.
8c83461e53ca7d204e1d634f0c78199d60320d7bjerenkrantz Sets the debugging level.
798c7c11dc2fe3b08e591e9c76fc1a84857f2cd4jerenkrantz> The keys used to sign the zone. If no keys are specified, the
798c7c11dc2fe3b08e591e9c76fc1a84857f2cd4jerenkrantz default all zone keys that have private key files in the
798c7c11dc2fe3b08e591e9c76fc1a84857f2cd4jerenkrantz current directory.
0aa8e8fd5a242948518655f2296b3c76386754e5jerenkrantzCLASS="REFSECT1"
de3abad1fe263e577bb11e99b358836bd901397crbbNAME="AEN154"
de3abad1fe263e577bb11e99b358836bd901397crbb>EXAMPLE</H2
de3abad1fe263e577bb11e99b358836bd901397crbb> The following command signs the <TT
de3abad1fe263e577bb11e99b358836bd901397crbbCLASS="USERINPUT"
0a549489abdb309ef25483431e1e5610ed4ba7a8gstein zone with the DSA key generated in the <B
0a549489abdb309ef25483431e1e5610ed4ba7a8gsteinCLASS="COMMAND"
0a549489abdb309ef25483431e1e5610ed4ba7a8gstein>dnssec-keygen</B
14c6f2e13d97a4fafac1fbc247a274a298d5b418wrowe man page. The zone's keys must be in the zone. If there are
14c6f2e13d97a4fafac1fbc247a274a298d5b418wroweCLASS="FILENAME"
14c6f2e13d97a4fafac1fbc247a274a298d5b418wrowe>signedkey</TT
f00d1e76bae896c2f6a520eec69b1d0d802d4108jerenkrantz> files associated with this zone
f00d1e76bae896c2f6a520eec69b1d0d802d4108jerenkrantz or any child zones, they must be in the current directory.
58097d7d8d1a394092374b9f6ddf76b7993724a4rbbCLASS="USERINPUT"
2f6cebd6b8bf0b044f6579d23117a4a3c364a554wrowe>, the following command would be
070d2f9fd52a3f0e45ca7ae1235c5a5755b80d24rbbCLASS="USERINPUT"
070d2f9fd52a3f0e45ca7ae1235c5a5755b80d24rbb>dnssec-signzone -o example.com db.example.com Kexample.com.+003+26160</B
7c19ce86bbd72bba1d018522250f5f315ffbc0afjerenkrantz> The command would print a string of the form:
2264fbcbab4c796c4222c30393c0b218c98b6befrbb> In this example, <B
2264fbcbab4c796c4222c30393c0b218c98b6befrbbCLASS="COMMAND"
e099672a13ea4ff4a11f130406f1baecba5949bajerenkrantz>dnssec-signzone</B
e099672a13ea4ff4a11f130406f1baecba5949bajerenkrantz the file <TT
9b29e0cfeb2c89a047806cc4a2a764afed6bb170wroweCLASS="FILENAME"
9b29e0cfeb2c89a047806cc4a2a764afed6bb170wrowe>. This file
9b29e0cfeb2c89a047806cc4a2a764afed6bb170wrowe should be referenced in a zone statement in a
441bd066858500e75e4f63ef149120bcf523de58jerenkrantzCLASS="FILENAME"
c839614b4216fe34f6346668ad646aca2c0f23c6wroweCLASS="REFSECT1"
c839614b4216fe34f6346668ad646aca2c0f23c6wroweNAME="AEN168"
117e2968318323d2ad2187fcd4de379d2eca245cwrowe>SEE ALSO</H2
117e2968318323d2ad2187fcd4de379d2eca245cwroweCLASS="CITEREFENTRY"
117e2968318323d2ad2187fcd4de379d2eca245cwroweCLASS="REFENTRYTITLE"
117e2968318323d2ad2187fcd4de379d2eca245cwrowe>dnssec-keygen</SPAN
117e2968318323d2ad2187fcd4de379d2eca245cwroweCLASS="CITEREFENTRY"
e9fa5a00f39f6aabbc5dcd776c5bc6bd0638f955wroweCLASS="REFENTRYTITLE"
e9fa5a00f39f6aabbc5dcd776c5bc6bd0638f955wrowe>dnssec-signkey</SPAN
e9fa5a00f39f6aabbc5dcd776c5bc6bd0638f955wroweCLASS="CITETITLE"
e9fa5a00f39f6aabbc5dcd776c5bc6bd0638f955wrowe>BIND 9 Administrator Reference Manual</I
de419544885a5c64589dddf1b8517672ee17c1feminfrinCLASS="CITETITLE"
df14f0d3a5191cdd7c4bb5b03acd135d43a6f51brbb>RFC 2535</I
9c4321d9cc4eecbb0c5d568aea53d5e6812c7b96martinCLASS="REFSECT1"
956c6100798467199833e7159a00506ee879d772minfrinNAME="AEN179"
956c6100798467199833e7159a00506ee879d772minfrin> Internet Software Consortium