dnssec-signzone.html revision d71e2e0c61df16ff37c9934c371a4a60c08974f7
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe - Copyright (C) 2000-2003 Internet Software Consortium.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe - Permission to use, copy, modify, and distribute this software for any
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe - purpose with or without fee is hereby granted, provided that the above
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe - copyright notice and this permission notice appear in all copies.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
ead9bb4b1be81d7bbf8ed86ee41d6c1e58b069a3Yuri Pankov - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
fe77cc0407fb667ddc04e1a8f2e203bb7b9c80e1Robert Mustacchi - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
bd93c05dbd9b8f1e8d2edf48c777bc881f927608Alexander Eremin - PERFORMANCE OF THIS SOFTWARE.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe<!-- $Id: dnssec-signzone.html,v 1.31 2007/05/09 03:33:50 marka Exp $ -->
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<a name="man.dnssec-signzone"></a><div class="titlepage"></div>
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<p><span class="application">dnssec-signzone</span> — DNSSEC zone signing tool</p>
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code> [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-p</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-t</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-z</code>] {zonefile} [key...]</p></div>
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<p><span><strong class="command">dnssec-signzone</strong></span>
d0054224e0ba320a05d1c27de508dc5224ff99d1Adam Stevko signs a zone. It generates
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov NSEC and RRSIG records and produces a signed version of the
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov zone. The security status of delegations from the signed zone
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov (that is, whether the child zones are secure or not) is
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov determined by the presence or absence of a
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov <code class="filename">keyset</code> file for each child zone.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov Verify all generated signatures.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov Specifies the DNS class of the zone.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<dt><span class="term">-k <em class="replaceable"><code>key</code></em></span></dt>
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov Treat specified key as a key signing key ignoring any
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov key flags. This option may be specified multiple times.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov Generate a DLV set in addition to the key (DNSKEY) and DS sets.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov The domain is appended to the name of the records.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<dt><span class="term">-d <em class="replaceable"><code>directory</code></em></span></dt>
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov Look for <code class="filename">keyset</code> files in
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov <code class="option">directory</code> as the directory
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov Generate DS records for child zones from keyset files.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov Existing DS records will be removed.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<dt><span class="term">-s <em class="replaceable"><code>start-time</code></em></span></dt>
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov Specify the date and time when the generated RRSIG records
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov become valid. This can be either an absolute or relative
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov time. An absolute start time is indicated by a number
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov in YYYYMMDDHHMMSS notation; 20000530144500 denotes
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov 14:45:00 UTC on May 30th, 2000. A relative start time is
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov indicated by +N, which is N seconds from the current time.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov If no <code class="option">start-time</code> is specified, the current
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov time minus 1 hour (to allow for clock skew) is used.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<dt><span class="term">-e <em class="replaceable"><code>end-time</code></em></span></dt>
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov Specify the date and time when the generated RRSIG records
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov expire. As with <code class="option">start-time</code>, an absolute
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov time is indicated in YYYYMMDDHHMMSS notation. A time relative
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov to the start time is indicated with +N, which is N seconds from
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov the start time. A time relative to the current time is
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov indicated with now+N. If no <code class="option">end-time</code> is
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov specified, 30 days from the start time is used as a default.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<dt><span class="term">-f <em class="replaceable"><code>output-file</code></em></span></dt>
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov The name of the output file containing the signed zone. The
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov default is to append <code class="filename">.signed</code> to
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov input filename.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov Prints a short summary of the options and arguments to
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov <span><strong class="command">dnssec-signzone</strong></span>.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov When a previously-signed zone is passed as input, records
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov may be resigned. The <code class="option">interval</code> option
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov specifies the cycle interval as an offset from the current
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov time (in seconds). If a RRSIG record expires after the
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov cycle interval, it is retained. Otherwise, it is considered
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov to be expiring soon, and it will be replaced.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov The default cycle interval is one quarter of the difference
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov between the signature end and start times. So if neither
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov <code class="option">end-time</code> or <code class="option">start-time</code>
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov are specified, <span><strong class="command">dnssec-signzone</strong></span>
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov signatures that are valid for 30 days, with a cycle
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov interval of 7.5 days. Therefore, if any existing RRSIG records
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov are due to expire in less than 7.5 days, they would be
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<dt><span class="term">-I <em class="replaceable"><code>input-format</code></em></span></dt>
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov The format of the input zone file.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov Possible formats are <span><strong class="command">"text"</strong></span> (default)
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov and <span><strong class="command">"raw"</strong></span>.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov This option is primarily intended to be used for dynamic
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov signed zones so that the dumped zone file in a non-text
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov format containing updates can be signed directly.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov The use of this option does not make much sense for
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov non-dynamic zones.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<dt><span class="term">-j <em class="replaceable"><code>jitter</code></em></span></dt>
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov When signing a zone with a fixed signature lifetime, all
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov RRSIG records issued at the time of signing expires
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov simultaneously. If the zone is incrementally signed, i.e.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov a previously-signed zone is passed as input to the signer,
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov all expired signatures have to be regenerated at about the
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov same time. The <code class="option">jitter</code> option specifies a
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov jitter window that will be used to randomize the signature
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov expire time, thus spreading incremental signature
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov regeneration over time.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov Signature lifetime jitter also to some extent benefits
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov validators and servers by spreading out cache expiration,
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov i.e. if large numbers of RRSIGs don't expire at the same time
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov from all caches there will be less congestion than if all
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov validators need to refetch at mostly the same time.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<dt><span class="term">-n <em class="replaceable"><code>ncpus</code></em></span></dt>
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov Specifies the number of threads to use. By default, one
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov thread is started for each detected CPU.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<dt><span class="term">-N <em class="replaceable"><code>soa-serial-format</code></em></span></dt>
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov The SOA serial number format of the signed zone.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov Possible formats are <span><strong class="command">"keep"</strong></span> (default),
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov <span><strong class="command">"increment"</strong></span> and
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov <span><strong class="command">"unixtime"</strong></span>.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<dt><span class="term"><span><strong class="command">"keep"</strong></span></span></dt>
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<dd><p>Do not modify the SOA serial number.</p></dd>
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<dt><span class="term"><span><strong class="command">"increment"</strong></span></span></dt>
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<dd><p>Increment the SOA serial number using RFC 1982
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<dt><span class="term"><span><strong class="command">"unixtime"</strong></span></span></dt>
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<dd><p>Set the SOA serial number to the number of seconds
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<dt><span class="term">-o <em class="replaceable"><code>origin</code></em></span></dt>
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov The zone origin. If not specified, the name of the zone file
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov is assumed to be the origin.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<dt><span class="term">-O <em class="replaceable"><code>output-format</code></em></span></dt>
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov The format of the output file containing the signed zone.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov Possible formats are <span><strong class="command">"text"</strong></span> (default)
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov and <span><strong class="command">"raw"</strong></span>.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov Use pseudo-random data when signing the zone. This is faster,
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov but less secure, than using real random data. This option
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov may be useful when signing large zones or when the entropy
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov source is limited.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<dt><span class="term">-r <em class="replaceable"><code>randomdev</code></em></span></dt>
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov Specifies the source of randomness. If the operating
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov system does not provide a <code class="filename">/dev/random</code>
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov or equivalent device, the default source of randomness
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov is keyboard input. <code class="filename">randomdev</code>
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov the name of a character device or file containing random
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov data to be used instead of the default. The special value
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov <code class="filename">keyboard</code> indicates that keyboard
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov input should be used.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov Print statistics at completion.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov Sets the debugging level.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov Ignore KSK flag on key when determining what to sign.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov The file containing the zone to be signed.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov Specify which keys should be used to sign the zone. If
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov no keys are specified, then the zone will be examined
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov for DNSKEY records at the zone apex. If these are found and
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov there are matching private keys, in the current directory,
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov then these will be used for signing.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov The following command signs the <strong class="userinput"><code>example.com</code></strong>
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov zone with the DSA key generated by <span><strong class="command">dnssec-keygen</strong></span>
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov (Kexample.com.+003+17247). The zone's keys must be in the master
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov file (<code class="filename">db.example.com</code>). This invocation looks
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov for <code class="filename">keyset</code> files, in the current directory,
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov so that DS records can be generated from them (<span><strong class="command">-g</strong></span>).
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<pre class="programlisting">% dnssec-signzone -g -o example.com db.example.com \
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov In the above example, <span><strong class="command">dnssec-signzone</strong></span> creates
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov the file <code class="filename">db.example.com.signed</code>. This
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov file should be referenced in a zone statement in a
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov This example re-signs a previously signed zone with default parameters.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov The private keys are assumed to be in the current directory.
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<pre class="programlisting">% cp db.example.com.signed db.example.com
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
a9478106a12424322498e53cf7cd75bd8a4d6004Yuri Pankov<p><span class="corpauthor">Internet Systems Consortium</span>