man.dnssec-dsfromkey.html revision 8168c2873909444bdf62325b29fe118a879b22fc
452a29e62cf661c7a91b7a2a18b0ccbba50d832fTinderbox User - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
7829fad4093f2c1985b1efb7cea00287ff015d2bckb - Copyright (C) 2000-2003 Internet Software Consortium.
7829fad4093f2c1985b1efb7cea00287ff015d2bckb - Permission to use, copy, modify, and/or distribute this software for any
7829fad4093f2c1985b1efb7cea00287ff015d2bckb - purpose with or without fee is hereby granted, provided that the above
7829fad4093f2c1985b1efb7cea00287ff015d2bckb - copyright notice and this permission notice appear in all copies.
7829fad4093f2c1985b1efb7cea00287ff015d2bckb - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
7829fad4093f2c1985b1efb7cea00287ff015d2bckb - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
7829fad4093f2c1985b1efb7cea00287ff015d2bckb - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
7829fad4093f2c1985b1efb7cea00287ff015d2bckb - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
7829fad4093f2c1985b1efb7cea00287ff015d2bckb - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
7829fad4093f2c1985b1efb7cea00287ff015d2bckb - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
7829fad4093f2c1985b1efb7cea00287ff015d2bckb - PERFORMANCE OF THIS SOFTWARE.
7829fad4093f2c1985b1efb7cea00287ff015d2bckb<!-- $Id$ -->
7829fad4093f2c1985b1efb7cea00287ff015d2bckb<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
7829fad4093f2c1985b1efb7cea00287ff015d2bckb<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
7829fad4093f2c1985b1efb7cea00287ff015d2bckb<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
127a4a90b0d03ebf55ad44d25f75b30c3a6fb728Evan Hunt<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
7829fad4093f2c1985b1efb7cea00287ff015d2bckb<link rel="prev" href="man.dnssec-coverage.html" title="dnssec-coverage">
7829fad4093f2c1985b1efb7cea00287ff015d2bckb<link rel="next" href="man.dnssec-importkey.html" title="dnssec-importkey">
7829fad4093f2c1985b1efb7cea00287ff015d2bckb<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
625ee5d01559befb2fc2e279e363eececd9cc816Evan Hunt<tr><th colspan="3" align="center"><span class="application">dnssec-dsfromkey</span></th></tr>
7829fad4093f2c1985b1efb7cea00287ff015d2bckb<a accesskey="p" href="man.dnssec-coverage.html">Prev</a>�</td>
7829fad4093f2c1985b1efb7cea00287ff015d2bckb<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-importkey.html">Next</a>
7829fad4093f2c1985b1efb7cea00287ff015d2bckb<a name="man.dnssec-dsfromkey"></a><div class="titlepage"></div>
7829fad4093f2c1985b1efb7cea00287ff015d2bckb<p><span class="application">dnssec-dsfromkey</span> — DNSSEC DS RR generation tool</p>
7829fad4093f2c1985b1efb7cea00287ff015d2bckb<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] {keyfile}</p></div>
7829fad4093f2c1985b1efb7cea00287ff015d2bckb<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> {-s} [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-s</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-A</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {dnsname}</p></div>
9ff0b976a1c09767e7ceb060f1f2e80b95800f6aMukund Sivaraman<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> [<code class="option">-h</code>] [<code class="option">-V</code>]</p></div>
7829fad4093f2c1985b1efb7cea00287ff015d2bckb<p><span><strong class="command">dnssec-dsfromkey</strong></span>
7829fad4093f2c1985b1efb7cea00287ff015d2bckb outputs the Delegation Signer (DS) resource record (RR), as defined in
7829fad4093f2c1985b1efb7cea00287ff015d2bckb RFC 3658 and RFC 4509, for the given key(s).
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman Use SHA-1 as the digest algorithm (the default is to use
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman both SHA-1 and SHA-256).
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman Use SHA-256 as the digest algorithm.
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman Select the digest algorithm. The value of
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman <code class="option">algorithm</code> must be one of SHA-1 (SHA1),
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman SHA-256 (SHA256), GOST or SHA-384 (SHA384).
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman These values are case insensitive.
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman<dt><span class="term">-T <em class="replaceable"><code>TTL</code></em></span></dt>
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman Specifies the TTL of the DS records.
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman Look for key files (or, in keyset mode,
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman <code class="filename">keyset-</code> files) in
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman<dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
7829fad4093f2c1985b1efb7cea00287ff015d2bckb Zone file mode: in place of the keyfile name, the argument is
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman the DNS domain name of a zone master file, which can be read
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman from <code class="option">file</code>. If the zone name is the same as
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman <code class="option">file</code>, then it may be omitted.
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman If <code class="option">file</code> is set to <code class="literal">"-"</code>, then
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman the zone data is read from the standard input. This makes it
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman possible to use the output of the <span><strong class="command">dig</strong></span>
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman command as input, as in:
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman <strong class="userinput"><code>dig dnskey example.com | dnssec-dsfromkey -f - example.com</code></strong>
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman Include ZSKs when generating DS records. Without this option,
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman only keys which have the KSK flag set will be converted to DS
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman records and printed. Useful only in zone file mode.
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman<dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman Generate a DLV set instead of a DS set. The specified
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman <code class="option">domain</code> is appended to the name for each
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman record in the set.
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman The DNSSEC Lookaside Validation (DLV) RR is described
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman Keyset mode: in place of the keyfile name, the argument is
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman the DNS domain name of a keyset file.
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman Specifies the DNS class (default is IN). Useful only
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman in keyset or zone file mode.
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
7829fad4093f2c1985b1efb7cea00287ff015d2bckb Sets the debugging level.
7829fad4093f2c1985b1efb7cea00287ff015d2bckb Prints usage information.
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman Prints version information.
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman To build the SHA-256 DS RR from the
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman <strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman keyfile name, the following command would be issued:
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman<p><strong class="userinput"><code>dnssec-dsfromkey -2 Kexample.com.+003+26160</code></strong>
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman The command would print something like:
7829fad4093f2c1985b1efb7cea00287ff015d2bckb<p><strong class="userinput"><code>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</code></strong>
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman The keyfile can be designed by the key identification
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman <code class="filename">Knnnn.+aaa+iiiii.key</code> as generated by
3b398443f0dca316ba7a6e057ba2d1b8ab4ddf70Tinderbox User <span class="refentrytitle">dnssec-keygen</span>(8).
d9f0c713fe1d50f1848ca827c5f31db79d904f04Evan Hunt The keyset file name is built from the <code class="option">directory</code>,
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman the string <code class="filename">keyset-</code> and the
01e41f88b05a4b0a98fccccc2badd64c05ed1dd4Mark Andrews A keyfile error can give a "file not found" even if the file exists.
3b398443f0dca316ba7a6e057ba2d1b8ab4ddf70Tinderbox User<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
127a4a90b0d03ebf55ad44d25f75b30c3a6fb728Evan Hunt <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman<p><span class="corpauthor">Internet Systems Consortium</span>
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman<table width="100%" summary="Navigation footer">
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman<a accesskey="p" href="man.dnssec-coverage.html">Prev</a>�</td>
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-importkey.html">Next</a>
7829fad4093f2c1985b1efb7cea00287ff015d2bckb<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
ce376a81fa674d240197628ceb6113a4fa5a1ab3Mukund Sivaraman<td width="40%" align="right" valign="top">�<span class="application">dnssec-importkey</span>