man.dnssec-dsfromkey.html revision 2895f101b5585a19015ac2c2c1e1812ac467fa12
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak - Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak - Copyright (C) 2000-2003 Internet Software Consortium.
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak - Permission to use, copy, modify, and/or distribute this software for any
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak - purpose with or without fee is hereby granted, provided that the above
031b91a62d25106ae69d4693475c79618dd5e884fielding - copyright notice and this permission notice appear in all copies.
031b91a62d25106ae69d4693475c79618dd5e884fielding - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
031b91a62d25106ae69d4693475c79618dd5e884fielding - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
031b91a62d25106ae69d4693475c79618dd5e884fielding - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
031b91a62d25106ae69d4693475c79618dd5e884fielding - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak - PERFORMANCE OF THIS SOFTWARE.
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<!-- $Id: man.dnssec-dsfromkey.html,v 1.35 2009/09/03 01:14:41 tbox Exp $ -->
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<link rel="next" href="man.dnssec-keyfromlabel.html" title="dnssec-keyfromlabel">
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<tr><th colspan="3" align="center"><span class="application">dnssec-dsfromkey</span></th></tr>
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<a accesskey="p" href="man.host.html">Prev</a>�</td>
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-keyfromlabel.html">Next</a>
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<a name="man.dnssec-dsfromkey"></a><div class="titlepage"></div>
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<p><span class="application">dnssec-dsfromkey</span> — DNSSEC DS RR generation tool</p>
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] {keyfile}</p></div>
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> {-s} [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-s</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-A</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {dnsname}</p></div>
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<p><span><strong class="command">dnssec-dsfromkey</strong></span>
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak outputs the Delegation Signer (DS) resource record (RR), as defined in
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak RFC 3658 and RFC 4509, for the given key(s).
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak Use SHA-1 as the digest algorithm (the default is to use
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak both SHA-1 and SHA-256).
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak Use SHA-256 as the digest algorithm.
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak Select the digest algorithm. The value of
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak <code class="option">algorithm</code> must be one of SHA-1 (SHA1) or
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak SHA-256 (SHA256). These values are case insensitive.
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak Look for key files (or, in keyset mode,
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak Zone file mode: in place of the keyfile name, the argument is
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak the DNS domain name of a zone master file, which can be read
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak from <code class="option">file</code>. If the zone name is the same as
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak <code class="option">file</code>, then it may be omitted.
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak Include ZSK's when generating DS records. Without this option,
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak only keys which have the KSK flag set will be converted to DS
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak records and printed. Useful only in zone file mode.
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak Generate a DLV set instead of a DS set. The specified
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak <code class="option">domain</code> is appended to the name for each
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak record in the set.
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak The DNSSEC Lookaside Validation (DLV) RR is described
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak in RFC 4431.
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak Keyset mode: in place of the keyfile name, the argument is
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak the DNS domain name of a keyset file.
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak Specifies the DNS class (default is IN). Useful only
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak in keyset or zone file mode.
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak Sets the debugging level.
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak To build the SHA-256 DS RR from the
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak <strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak keyfile name, the following command would be issued:
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<p><strong class="userinput"><code>dnssec-dsfromkey -2 Kexample.com.+003+26160</code></strong>
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak The command would print something like:
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<p><strong class="userinput"><code>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</code></strong>
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak The keyfile can be designed by the key identification
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak <code class="filename">Knnnn.+aaa+iiiii.key</code> as generated by
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak <span class="refentrytitle">dnssec-keygen</span>(8).
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak The keyset file name is built from the <code class="option">directory</code>,
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak the string <code class="filename">keyset-</code> and the
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak A keyfile error can give a "file not found" even if the file exists.
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<p><span class="corpauthor">Internet Systems Consortium</span>
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<a accesskey="p" href="man.host.html">Prev</a>�</td>
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-keyfromlabel.html">Next</a>
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<td width="40%" align="left" valign="top">host�</td>
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
6aadbc6fd703e73d1d419e9f06b84a4338c898f1maczniak<td width="40%" align="right" valign="top">�<span class="application">dnssec-keyfromlabel</span>