man.dnssec-dsfromkey.html revision 25ae0fd27c7f65d235511e9b20f97f6ba92a14cf
7d32c065c7bb56f281651ae3dd2888f32ce4f1d9Bob Halley - Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC")
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence - Copyright (C) 2000-2003 Internet Software Consortium.
985687b4e080182c1a3a2173df02b94a5b78b24fBob Halley - Permission to use, copy, modify, and/or distribute this software for any
985687b4e080182c1a3a2173df02b94a5b78b24fBob Halley - purpose with or without fee is hereby granted, provided that the above
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence - copyright notice and this permission notice appear in all copies.
15a44745412679c30a6d022733925af70a38b715David Lawrence - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
15a44745412679c30a6d022733925af70a38b715David Lawrence - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
15a44745412679c30a6d022733925af70a38b715David Lawrence - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
15a44745412679c30a6d022733925af70a38b715David Lawrence - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
15a44745412679c30a6d022733925af70a38b715David Lawrence - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
15a44745412679c30a6d022733925af70a38b715David Lawrence - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
15a44745412679c30a6d022733925af70a38b715David Lawrence - PERFORMANCE OF THIS SOFTWARE.
985687b4e080182c1a3a2173df02b94a5b78b24fBob Halley<!-- $Id$ -->
985687b4e080182c1a3a2173df02b94a5b78b24fBob Halley<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
985687b4e080182c1a3a2173df02b94a5b78b24fBob Halley<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
904a5734375869ffb504ed8cde6b68cafadb6d64Bob Halley<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
985687b4e080182c1a3a2173df02b94a5b78b24fBob Halley<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
985687b4e080182c1a3a2173df02b94a5b78b24fBob Halley<link rel="prev" href="man.dnssec-coverage.html" title="dnssec-coverage">
985687b4e080182c1a3a2173df02b94a5b78b24fBob Halley<link rel="next" href="man.dnssec-importkey.html" title="dnssec-importkey">
904a5734375869ffb504ed8cde6b68cafadb6d64Bob Halley<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
ecb6c5782ea248307e86c4bceac6c371d27576a6David Lawrence<tr><th colspan="3" align="center"><span class="application">dnssec-dsfromkey</span></th></tr>
ecb6c5782ea248307e86c4bceac6c371d27576a6David Lawrence<a accesskey="p" href="man.dnssec-coverage.html">Prev</a>�</td>
ecb6c5782ea248307e86c4bceac6c371d27576a6David Lawrence<th width="60%" align="center">Manual pages</th>
ecb6c5782ea248307e86c4bceac6c371d27576a6David Lawrence<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-importkey.html">Next</a>
985687b4e080182c1a3a2173df02b94a5b78b24fBob Halley<a name="man.dnssec-dsfromkey"></a><div class="titlepage"></div>
985687b4e080182c1a3a2173df02b94a5b78b24fBob Halley<p><span class="application">dnssec-dsfromkey</span> — DNSSEC DS RR generation tool</p>
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] {keyfile}</p></div>
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> {-s} [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-s</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-A</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {dnsname}</p></div>
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> [<code class="option">-h</code>] [<code class="option">-V</code>]</p></div>
985687b4e080182c1a3a2173df02b94a5b78b24fBob Halley<p><span><strong class="command">dnssec-dsfromkey</strong></span>
985687b4e080182c1a3a2173df02b94a5b78b24fBob Halley outputs the Delegation Signer (DS) resource record (RR), as defined in
985687b4e080182c1a3a2173df02b94a5b78b24fBob Halley RFC 3658 and RFC 4509, for the given key(s).
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence Use SHA-1 as the digest algorithm (the default is to use
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence both SHA-1 and SHA-256).
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews Use SHA-256 as the digest algorithm.
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews Select the digest algorithm. The value of
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews <code class="option">algorithm</code> must be one of SHA-1 (SHA1),
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews SHA-256 (SHA256), GOST or SHA-384 (SHA384).
c1a2cfef7f9156ffd15ded6cca6429a174319cc1Michael Graff These values are case insensitive.
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews<dt><span class="term">-T <em class="replaceable"><code>TTL</code></em></span></dt>
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews Specifies the TTL of the DS records.
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews Look for key files (or, in keyset mode,
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews <code class="filename">keyset-</code> files) in
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews<dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews Zone file mode: in place of the keyfile name, the argument is
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews the DNS domain name of a zone master file, which can be read
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews from <code class="option">file</code>. If the zone name is the same as
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews <code class="option">file</code>, then it may be omitted.
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews If <code class="option">file</code> is set to <code class="literal">"-"</code>, then
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews the zone data is read from the standard input. This makes it
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews possible to use the output of the <span><strong class="command">dig</strong></span>
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews command as input, as in:
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews <strong class="userinput"><code>dig dnskey example.com | dnssec-dsfromkey -f - example.com</code></strong>
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews Include ZSKs when generating DS records. Without this option,
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews only keys which have the KSK flag set will be converted to DS
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews records and printed. Useful only in zone file mode.
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews<dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews Generate a DLV set instead of a DS set. The specified
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews <code class="option">domain</code> is appended to the name for each
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews record in the set.
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews The DNSSEC Lookaside Validation (DLV) RR is described
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews in RFC 4431.
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews Keyset mode: in place of the keyfile name, the argument is
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews the DNS domain name of a keyset file.
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews Specifies the DNS class (default is IN). Useful only
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews in keyset or zone file mode.
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews Sets the debugging level.
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews Prints usage information.
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews Prints version information.
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews To build the SHA-256 DS RR from the
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews <strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews keyfile name, the following command would be issued:
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews<p><strong class="userinput"><code>dnssec-dsfromkey -2 Kexample.com.+003+26160</code></strong>
ecb6c5782ea248307e86c4bceac6c371d27576a6David Lawrence The command would print something like:
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews<p><strong class="userinput"><code>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</code></strong>
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews The keyfile can be designed by the key identification
518be7faab2498c795e6dc9bb25ac10ca38b3a8dMark Andrews <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews <code class="filename">Knnnn.+aaa+iiiii.key</code> as generated by
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews <span class="refentrytitle">dnssec-keygen</span>(8).
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews The keyset file name is built from the <code class="option">directory</code>,
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews the string <code class="filename">keyset-</code> and the
1ef8965366d91e02a4672c35a187d30aa4a4c72cMark Andrews A keyfile error can give a "file not found" even if the file exists.
d0221bfa6a08f7b284b231886928aa5d8ac87fc2Mark Andrews<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
d0221bfa6a08f7b284b231886928aa5d8ac87fc2Mark Andrews <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
d0221bfa6a08f7b284b231886928aa5d8ac87fc2Mark Andrews <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
d0221bfa6a08f7b284b231886928aa5d8ac87fc2Mark Andrews<p><span class="corpauthor">Internet Systems Consortium</span>
1ef8965366d91e02a4672c35a187d30aa4a4c72cMark Andrews<table width="100%" summary="Navigation footer">
d0221bfa6a08f7b284b231886928aa5d8ac87fc2Mark Andrews<a accesskey="p" href="man.dnssec-coverage.html">Prev</a>�</td>
d0221bfa6a08f7b284b231886928aa5d8ac87fc2Mark Andrews<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
d0221bfa6a08f7b284b231886928aa5d8ac87fc2Mark Andrews<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-importkey.html">Next</a>
1ef8965366d91e02a4672c35a187d30aa4a4c72cMark Andrews<span class="application">dnssec-coverage</span>�</td>
1ef8965366d91e02a4672c35a187d30aa4a4c72cMark Andrews<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
1ef8965366d91e02a4672c35a187d30aa4a4c72cMark Andrews<td width="40%" align="right" valign="top">�<span class="application">dnssec-importkey</span>
d0221bfa6a08f7b284b231886928aa5d8ac87fc2Mark Andrews<p style="text-align: center;">BIND 9.11.0pre-alpha</p>