man.dnssec-dsfromkey.html revision 5d564da348e890e42f63eebf2dced9a05b41f4fb
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering - Copyright (C) 2000-2003 Internet Software Consortium.
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering - Permission to use, copy, modify, and/or distribute this software for any
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering - purpose with or without fee is hereby granted, provided that the above
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering - copyright notice and this permission notice appear in all copies.
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering - PERFORMANCE OF THIS SOFTWARE.
b5efdb8af40ea759a1ea584c1bc44ecc81dd00ceLennart Poettering<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
07630cea1f3a845c09309f197ac7c4f11edd3b62Lennart Poettering<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
07630cea1f3a845c09309f197ac7c4f11edd3b62Lennart Poettering<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
07630cea1f3a845c09309f197ac7c4f11edd3b62Lennart Poettering<link rel="prev" href="man.dnssec-coverage.html" title="dnssec-coverage">
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering<link rel="next" href="man.dnssec-importkey.html" title="dnssec-importkey">
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
3ef64445cdf12d7703aa79b39f3c170037d587c7Lennart Poettering<table width="100%" summary="Navigation header">
ec2c5e4398f9d65e5dfe61530f2556224733d1e6Lennart Poettering<tr><th colspan="3" align="center"><span class="application">dnssec-dsfromkey</span></th></tr>
ec2c5e4398f9d65e5dfe61530f2556224733d1e6Lennart Poettering<a accesskey="p" href="man.dnssec-coverage.html">Prev</a>�</td>
ec2c5e4398f9d65e5dfe61530f2556224733d1e6Lennart Poettering<th width="60%" align="center">Manual pages</th>
ec2c5e4398f9d65e5dfe61530f2556224733d1e6Lennart Poettering<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-importkey.html">Next</a>
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering<a name="man.dnssec-dsfromkey"></a><div class="titlepage"></div>
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering<p><span class="application">dnssec-dsfromkey</span> — DNSSEC DS RR generation tool</p>
ec2c5e4398f9d65e5dfe61530f2556224733d1e6Lennart Poettering<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-C</code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] {keyfile}</p></div>
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> {-s} [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-s</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-A</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {dnsname}</p></div>
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> [<code class="option">-h</code>] [<code class="option">-V</code>]</p></div>
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering<a name="id2621627"></a><h2>DESCRIPTION</h2>
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering<p><span><strong class="command">dnssec-dsfromkey</strong></span>
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering outputs the Delegation Signer (DS) resource record (RR), as defined in
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering RFC 3658 and RFC 4509, for the given key(s).
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering Use SHA-1 as the digest algorithm (the default is to use
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering both SHA-1 and SHA-256).
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering Use SHA-256 as the digest algorithm.
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering Select the digest algorithm. The value of
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering <code class="option">algorithm</code> must be one of SHA-1 (SHA1),
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering SHA-256 (SHA256), GOST or SHA-384 (SHA384).
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering These values are case insensitive.
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering Generate CDS records rather than DS records. This is mutually
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering exclusive with generating lookaside records.
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering<dt><span class="term">-T <em class="replaceable"><code>TTL</code></em></span></dt>
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering Specifies the TTL of the DS records.
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering Look for key files (or, in keyset mode,
525d3cc746a037e8cc6b2e0ebaaf76a51856fa6bLennart Poettering <code class="filename">keyset-</code> files) in
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering<dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering Zone file mode: in place of the keyfile name, the argument is
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering the DNS domain name of a zone master file, which can be read
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering from <code class="option">file</code>. If the zone name is the same as
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering <code class="option">file</code>, then it may be omitted.
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering If <code class="option">file</code> is set to <code class="literal">"-"</code>, then
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering the zone data is read from the standard input. This makes it
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering possible to use the output of the <span><strong class="command">dig</strong></span>
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering command as input, as in:
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering <strong class="userinput"><code>dig dnskey example.com | dnssec-dsfromkey -f - example.com</code></strong>
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering Include ZSKs when generating DS records. Without this option,
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering only keys which have the KSK flag set will be converted to DS
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering records and printed. Useful only in zone file mode.
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering<dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering Generate a DLV set instead of a DS set. The specified
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering <code class="option">domain</code> is appended to the name for each
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering record in the set.
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering The DNSSEC Lookaside Validation (DLV) RR is described
d5099efc47d4e6ac60816b5381a5f607ab03f06eMichal Schmidt in RFC 4431. This is mutually exclusive with generating
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering Keyset mode: in place of the keyfile name, the argument is
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering the DNS domain name of a keyset file.
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering Specifies the DNS class (default is IN). Useful only
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering in keyset or zone file mode.
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering Sets the debugging level.
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering Prints usage information.
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering Prints version information.
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering To build the SHA-256 DS RR from the
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering <strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering keyfile name, the following command would be issued:
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering<p><strong class="userinput"><code>dnssec-dsfromkey -2 Kexample.com.+003+26160</code></strong>
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering The command would print something like:
ec2c5e4398f9d65e5dfe61530f2556224733d1e6Lennart Poettering<p><strong class="userinput"><code>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</code></strong>
ec2c5e4398f9d65e5dfe61530f2556224733d1e6Lennart Poettering The keyfile can be designed by the key identification
ec2c5e4398f9d65e5dfe61530f2556224733d1e6Lennart Poettering <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
1b4f6e79ec51a57003896a0b605fba427b4a98d2Lennart Poettering <code class="filename">Knnnn.+aaa+iiiii.key</code> as generated by
ec2c5e4398f9d65e5dfe61530f2556224733d1e6Lennart Poettering <span class="refentrytitle">dnssec-keygen</span>(8).
1b4f6e79ec51a57003896a0b605fba427b4a98d2Lennart Poettering The keyset file name is built from the <code class="option">directory</code>,
1b4f6e79ec51a57003896a0b605fba427b4a98d2Lennart Poettering the string <code class="filename">keyset-</code> and the
ec2c5e4398f9d65e5dfe61530f2556224733d1e6Lennart Poettering A keyfile error can give a "file not found" even if the file exists.
547973dea7abd6c124ff6c79fe2bbe322a7314aeLennart Poettering<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
ec2c5e4398f9d65e5dfe61530f2556224733d1e6Lennart Poettering <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
ec2c5e4398f9d65e5dfe61530f2556224733d1e6Lennart Poettering <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
ec2c5e4398f9d65e5dfe61530f2556224733d1e6Lennart Poettering<p><span class="corpauthor">Internet Systems Consortium</span>
ec2c5e4398f9d65e5dfe61530f2556224733d1e6Lennart Poettering<table width="100%" summary="Navigation footer">
ec2c5e4398f9d65e5dfe61530f2556224733d1e6Lennart Poettering<a accesskey="p" href="man.dnssec-coverage.html">Prev</a>�</td>
ec2c5e4398f9d65e5dfe61530f2556224733d1e6Lennart Poettering<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
ec2c5e4398f9d65e5dfe61530f2556224733d1e6Lennart Poettering<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-importkey.html">Next</a>
ec2c5e4398f9d65e5dfe61530f2556224733d1e6Lennart Poettering<td width="40%" align="left" valign="top">
ec2c5e4398f9d65e5dfe61530f2556224733d1e6Lennart Poettering<span class="application">dnssec-coverage</span>�</td>
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering<td width="40%" align="right" valign="top">�<span class="application">dnssec-importkey</span>
623a4c97b9175f95c4b1c6fc34e36c56f1e4ddbfLennart Poettering<p style="text-align: center;">BIND 9.11.0pre-alpha</p>