man.dnssec-dsfromkey.html revision 54e57d8ff46096e9c6a9af95f2522b56cb3877b2
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - Copyright (C) 2000-2003 Internet Software Consortium.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - Permission to use, copy, modify, and/or distribute this software for any
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - purpose with or without fee is hereby granted, provided that the above
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - copyright notice and this permission notice appear in all copies.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - PERFORMANCE OF THIS SOFTWARE.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<!-- $Id: man.dnssec-dsfromkey.html,v 1.93 2011/10/07 01:14:43 tbox Exp $ -->
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<link rel="next" href="man.dnssec-keyfromlabel.html" title="dnssec-keyfromlabel">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<tr><th colspan="3" align="center"><span class="application">dnssec-dsfromkey</span></th></tr>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<a accesskey="p" href="man.host.html">Prev</a>�</td>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-keyfromlabel.html">Next</a>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<a name="man.dnssec-dsfromkey"></a><div class="titlepage"></div>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<p><span class="application">dnssec-dsfromkey</span> — DNSSEC DS RR generation tool</p>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] {keyfile}</p></div>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> {-s} [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-s</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-A</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {dnsname}</p></div>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<p><span><strong class="command">dnssec-dsfromkey</strong></span>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync outputs the Delegation Signer (DS) resource record (RR), as defined in
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync RFC 3658 and RFC 4509, for the given key(s).
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Use SHA-1 as the digest algorithm (the default is to use
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync both SHA-1 and SHA-256).
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Use SHA-256 as the digest algorithm.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Select the digest algorithm. The value of
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <code class="option">algorithm</code> must be one of SHA-1 (SHA1),
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync SHA-256 (SHA256) or GOST. These values are case insensitive.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Look for key files (or, in keyset mode,
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Zone file mode: in place of the keyfile name, the argument is
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync the DNS domain name of a zone master file, which can be read
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync from <code class="option">file</code>. If the zone name is the same as
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <code class="option">file</code>, then it may be omitted.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync If <code class="option">file</code> is set to <code class="literal">"-"</code>, then
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync the zone data is read from the standard input. This makes it
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync possible to use the output of the <span><strong class="command">dig</strong></span>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync command as input, as in:
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <strong class="userinput"><code>dig dnskey example.com | dnssec-dsfromkey -f - example.com</code></strong>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Include ZSK's when generating DS records. Without this option,
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync only keys which have the KSK flag set will be converted to DS
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync records and printed. Useful only in zone file mode.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Generate a DLV set instead of a DS set. The specified
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <code class="option">domain</code> is appended to the name for each
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync record in the set.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync The DNSSEC Lookaside Validation (DLV) RR is described
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync in RFC 4431.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Keyset mode: in place of the keyfile name, the argument is
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync the DNS domain name of a keyset file.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Specifies the DNS class (default is IN). Useful only
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync in keyset or zone file mode.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Sets the debugging level.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync To build the SHA-256 DS RR from the
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync keyfile name, the following command would be issued:
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<p><strong class="userinput"><code>dnssec-dsfromkey -2 Kexample.com.+003+26160</code></strong>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync The command would print something like:
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<p><strong class="userinput"><code>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</code></strong>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync The keyfile can be designed by the key identification
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <code class="filename">Knnnn.+aaa+iiiii.key</code> as generated by
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="refentrytitle">dnssec-keygen</span>(8).
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync The keyset file name is built from the <code class="option">directory</code>,
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync the string <code class="filename">keyset-</code> and the
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync A keyfile error can give a "file not found" even if the file exists.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<p><span class="corpauthor">Internet Systems Consortium</span>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<a accesskey="p" href="man.host.html">Prev</a>�</td>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-keyfromlabel.html">Next</a>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<td width="40%" align="left" valign="top">host�</td>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<td width="40%" align="right" valign="top">�<span class="application">dnssec-keyfromlabel</span>