man.dnssec-dsfromkey.html revision 19e593a7a5c3e854a59063a25f72be2983f1c60e
36488004520b3a22fbd37ef8e10e5641be154ac1slive - Copyright (C) 2004-2012 Internet Systems Consortium, Inc. ("ISC")
36488004520b3a22fbd37ef8e10e5641be154ac1slive - Copyright (C) 2000-2003 Internet Software Consortium.
36488004520b3a22fbd37ef8e10e5641be154ac1slive - Permission to use, copy, modify, and/or distribute this software for any
acc36ab93565d2880447d535da6ca6e5feac7a70nd - purpose with or without fee is hereby granted, provided that the above
db479b48bd4d75423ed4a45e15b75089d1a8ad72fielding - copyright notice and this permission notice appear in all copies.
db479b48bd4d75423ed4a45e15b75089d1a8ad72fielding - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
db479b48bd4d75423ed4a45e15b75089d1a8ad72fielding - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
db479b48bd4d75423ed4a45e15b75089d1a8ad72fielding - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
db479b48bd4d75423ed4a45e15b75089d1a8ad72fielding - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
acc36ab93565d2880447d535da6ca6e5feac7a70nd - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
acc36ab93565d2880447d535da6ca6e5feac7a70nd - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
acc36ab93565d2880447d535da6ca6e5feac7a70nd - PERFORMANCE OF THIS SOFTWARE.
acc36ab93565d2880447d535da6ca6e5feac7a70nd<!-- $Id$ -->
acc36ab93565d2880447d535da6ca6e5feac7a70nd<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
acc36ab93565d2880447d535da6ca6e5feac7a70nd<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
7db9f691a00ead175b03335457ca296a33ddf31bnd<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
36488004520b3a22fbd37ef8e10e5641be154ac1slive<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
36488004520b3a22fbd37ef8e10e5641be154ac1slive<link rel="next" href="man.dnssec-keyfromlabel.html" title="dnssec-keyfromlabel">
64a27bbe8bf7a6f41afed34360e381c227cf15cdpoirier<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
64a27bbe8bf7a6f41afed34360e381c227cf15cdpoirier<tr><th colspan="3" align="center"><span class="application">dnssec-dsfromkey</span></th></tr>
64a27bbe8bf7a6f41afed34360e381c227cf15cdpoirier<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-keyfromlabel.html">Next</a>
36488004520b3a22fbd37ef8e10e5641be154ac1slive<a name="man.dnssec-dsfromkey"></a><div class="titlepage"></div>
36488004520b3a22fbd37ef8e10e5641be154ac1slive<p><span class="application">dnssec-dsfromkey</span> — DNSSEC DS RR generation tool</p>
36488004520b3a22fbd37ef8e10e5641be154ac1slive<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] {keyfile}</p></div>
36488004520b3a22fbd37ef8e10e5641be154ac1slive<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> {-s} [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-s</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-A</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {dnsname}</p></div>
36488004520b3a22fbd37ef8e10e5641be154ac1slive<p><span><strong class="command">dnssec-dsfromkey</strong></span>
36488004520b3a22fbd37ef8e10e5641be154ac1slive outputs the Delegation Signer (DS) resource record (RR), as defined in
36488004520b3a22fbd37ef8e10e5641be154ac1slive RFC 3658 and RFC 4509, for the given key(s).
36488004520b3a22fbd37ef8e10e5641be154ac1slive Use SHA-1 as the digest algorithm (the default is to use
36488004520b3a22fbd37ef8e10e5641be154ac1slive both SHA-1 and SHA-256).
36488004520b3a22fbd37ef8e10e5641be154ac1slive Use SHA-256 as the digest algorithm.
36488004520b3a22fbd37ef8e10e5641be154ac1slive<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
36488004520b3a22fbd37ef8e10e5641be154ac1slive Select the digest algorithm. The value of
36488004520b3a22fbd37ef8e10e5641be154ac1slive <code class="option">algorithm</code> must be one of SHA-1 (SHA1),
58d2a5e8ffbed482ce45f8d92680aa1577873c5derikabele SHA-256 (SHA256), GOST or SHA-384 (SHA384).
36488004520b3a22fbd37ef8e10e5641be154ac1slive These values are case insensitive.
38a01d3776f9a98839742b8f024ecb4d0d2ea613jsl<dt><span class="term">-T <em class="replaceable"><code>TTL</code></em></span></dt>
36488004520b3a22fbd37ef8e10e5641be154ac1slive Specifies the TTL of the DS records.
36488004520b3a22fbd37ef8e10e5641be154ac1slive<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
36488004520b3a22fbd37ef8e10e5641be154ac1slive Look for key files (or, in keyset mode,
36488004520b3a22fbd37ef8e10e5641be154ac1slive<dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
38a01d3776f9a98839742b8f024ecb4d0d2ea613jsl Zone file mode: in place of the keyfile name, the argument is
36488004520b3a22fbd37ef8e10e5641be154ac1slive the DNS domain name of a zone master file, which can be read
60516f4f7bc2c342dbbcac9b6e166146f7d1f4e5nilgun from <code class="option">file</code>. If the zone name is the same as
60516f4f7bc2c342dbbcac9b6e166146f7d1f4e5nilgun <code class="option">file</code>, then it may be omitted.
36488004520b3a22fbd37ef8e10e5641be154ac1slive If <code class="option">file</code> is set to <code class="literal">"-"</code>, then
60516f4f7bc2c342dbbcac9b6e166146f7d1f4e5nilgun the zone data is read from the standard input. This makes it
60516f4f7bc2c342dbbcac9b6e166146f7d1f4e5nilgun possible to use the output of the <span><strong class="command">dig</strong></span>
36488004520b3a22fbd37ef8e10e5641be154ac1slive command as input, as in:
36488004520b3a22fbd37ef8e10e5641be154ac1slive <strong class="userinput"><code>dig dnskey example.com | dnssec-dsfromkey -f - example.com</code></strong>
36488004520b3a22fbd37ef8e10e5641be154ac1slive Include ZSK's when generating DS records. Without this option,
36488004520b3a22fbd37ef8e10e5641be154ac1slive only keys which have the KSK flag set will be converted to DS
38a01d3776f9a98839742b8f024ecb4d0d2ea613jsl records and printed. Useful only in zone file mode.
36488004520b3a22fbd37ef8e10e5641be154ac1slive<dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
38a01d3776f9a98839742b8f024ecb4d0d2ea613jsl Generate a DLV set instead of a DS set. The specified
36488004520b3a22fbd37ef8e10e5641be154ac1slive <code class="option">domain</code> is appended to the name for each
36488004520b3a22fbd37ef8e10e5641be154ac1slive record in the set.
36488004520b3a22fbd37ef8e10e5641be154ac1slive The DNSSEC Lookaside Validation (DLV) RR is described
36488004520b3a22fbd37ef8e10e5641be154ac1slive in RFC 4431.
36488004520b3a22fbd37ef8e10e5641be154ac1slive Keyset mode: in place of the keyfile name, the argument is
36488004520b3a22fbd37ef8e10e5641be154ac1slive the DNS domain name of a keyset file.
38a01d3776f9a98839742b8f024ecb4d0d2ea613jsl<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
36488004520b3a22fbd37ef8e10e5641be154ac1slive Specifies the DNS class (default is IN). Useful only
36488004520b3a22fbd37ef8e10e5641be154ac1slive in keyset or zone file mode.
a1ef40892ffa2b44fc249423c5b6c42a74a84c68nd<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
36488004520b3a22fbd37ef8e10e5641be154ac1slive Sets the debugging level.
36488004520b3a22fbd37ef8e10e5641be154ac1slive To build the SHA-256 DS RR from the
36488004520b3a22fbd37ef8e10e5641be154ac1slive <strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
36488004520b3a22fbd37ef8e10e5641be154ac1slive keyfile name, the following command would be issued:
2d2de64c25c1519122a76150a7daf2c05f53fd9asf<p><strong class="userinput"><code>dnssec-dsfromkey -2 Kexample.com.+003+26160</code></strong>
2d2de64c25c1519122a76150a7daf2c05f53fd9asf The command would print something like:
2d2de64c25c1519122a76150a7daf2c05f53fd9asf<p><strong class="userinput"><code>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</code></strong>
ba8375b656d52602cedf9deb53220f184ad60209noodl The keyfile can be designed by the key identification
36488004520b3a22fbd37ef8e10e5641be154ac1slive <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
36488004520b3a22fbd37ef8e10e5641be154ac1slive <code class="filename">Knnnn.+aaa+iiiii.key</code> as generated by
38a01d3776f9a98839742b8f024ecb4d0d2ea613jsl The keyset file name is built from the <code class="option">directory</code>,
36488004520b3a22fbd37ef8e10e5641be154ac1slive the string <code class="filename">keyset-</code> and the
36488004520b3a22fbd37ef8e10e5641be154ac1slive A keyfile error can give a "file not found" even if the file exists.
36488004520b3a22fbd37ef8e10e5641be154ac1slive<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
df47c169dad27600c1e98e547a065378c5e9a2b3rbowen <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
f36d6b9fd84a70b9be1819ed376e67327f763db9slive <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
36488004520b3a22fbd37ef8e10e5641be154ac1slive<p><span class="corpauthor">Internet Systems Consortium</span>
36488004520b3a22fbd37ef8e10e5641be154ac1slive<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
36488004520b3a22fbd37ef8e10e5641be154ac1slive<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-keyfromlabel.html">Next</a>
36488004520b3a22fbd37ef8e10e5641be154ac1slive<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
36488004520b3a22fbd37ef8e10e5641be154ac1slive<td width="40%" align="right" valign="top">�<span class="application">dnssec-keyfromlabel</span>