man.dnssec-dsfromkey.html revision ab3bdbd2ee61b06fa1dc4d3adbcff46cd808185a
2d453384452f29ab46f29c0163a830492f936512Till Mossakowski - Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC")
2d453384452f29ab46f29c0163a830492f936512Till Mossakowski - Copyright (C) 2000-2003 Internet Software Consortium.
97018cf5fa25b494adffd7e9b4e87320dae6bf47Christian Maeder - Permission to use, copy, modify, and/or distribute this software for any
2d453384452f29ab46f29c0163a830492f936512Till Mossakowski - purpose with or without fee is hereby granted, provided that the above
b4fbc96e05117839ca409f5f20f97b3ac872d1edTill Mossakowski - copyright notice and this permission notice appear in all copies.
c673000621dd506e5fc7babf8ca6303b7fcefc14Christian Maeder - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
2d453384452f29ab46f29c0163a830492f936512Till Mossakowski - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
f3a94a197960e548ecd6520bb768cb0d547457bbChristian Maeder - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
2d453384452f29ab46f29c0163a830492f936512Till Mossakowski - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
2d453384452f29ab46f29c0163a830492f936512Till Mossakowski - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
2f65d931e866162d39d09c43021a55314040b377Christian Maeder - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
613bf0ed7d98a961755408ead328687ec17f74fdChristian Maeder - PERFORMANCE OF THIS SOFTWARE.
2d453384452f29ab46f29c0163a830492f936512Till Mossakowski<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
d5ef5a29a89fa5548f81fcd49fcf0ffda69d45b0Christian Maeder<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
e42eddbc69dd31f7cd696e38f82acad678831cb7Jian Chun Wang<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
036037a4510ea63a81a4829ad0c11ef39b2391b0Christian Maeder<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
ad270004874ce1d0697fb30d7309f180553bb315Christian Maeder<link rel="prev" href="man.dnssec-coverage.html" title="dnssec-coverage">
39982c927a6052fe2ebd13d4c03b2fcbae0d2f0cJian Chun Wang<link rel="next" href="man.dnssec-importkey.html" title="dnssec-importkey">
a3acfb955e4427cde9094615b8a62623a441f8c7Christian Maeder<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
62dd3cd58cda003c32ac69ff12dc82b0a6f5d9d3Christian Maeder<table width="100%" summary="Navigation header">
b6a54d7292d7a3713000847334de4316d105f40fChristian Maeder<tr><th colspan="3" align="center"><span class="application">dnssec-dsfromkey</span></th></tr>
b6a54d7292d7a3713000847334de4316d105f40fChristian Maeder<a accesskey="p" href="man.dnssec-coverage.html">Prev</a>�</td>
b6a54d7292d7a3713000847334de4316d105f40fChristian Maeder<th width="60%" align="center">Manual pages</th>
62b04256f84128edd94c0575757332f84450bd69Christian Maeder<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-importkey.html">Next</a>
b6a54d7292d7a3713000847334de4316d105f40fChristian Maeder<a name="man.dnssec-dsfromkey"></a><div class="titlepage"></div>
b6a54d7292d7a3713000847334de4316d105f40fChristian Maeder<p><span class="application">dnssec-dsfromkey</span> — DNSSEC DS RR generation tool</p>
b6a54d7292d7a3713000847334de4316d105f40fChristian Maeder<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] {keyfile}</p></div>
e4546debeef926f8a8b6b034ae105269de2cd817Christian Maeder<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> {-s} [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-s</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-A</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {dnsname}</p></div>
e4546debeef926f8a8b6b034ae105269de2cd817Christian Maeder<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> [<code class="option">-h</code>] [<code class="option">-V</code>]</p></div>
b6a54d7292d7a3713000847334de4316d105f40fChristian Maeder<a name="id2620334"></a><h2>DESCRIPTION</h2>
b6a54d7292d7a3713000847334de4316d105f40fChristian Maeder<p><span><strong class="command">dnssec-dsfromkey</strong></span>
ca3a4317b88adee116c04c6b08458b5690d83209Christian Maeder outputs the Delegation Signer (DS) resource record (RR), as defined in
d12de70436e416b477af9ae1bf6989f57488bf92Christian Maeder RFC 3658 and RFC 4509, for the given key(s).
cbac0a99fd23a43b4e94d30e58ebf93a6af6caa0Christian Maeder Use SHA-1 as the digest algorithm (the default is to use
cbac0a99fd23a43b4e94d30e58ebf93a6af6caa0Christian Maeder both SHA-1 and SHA-256).
b6a54d7292d7a3713000847334de4316d105f40fChristian Maeder Use SHA-256 as the digest algorithm.
99c923311eab71a85f1dcc4785d349609c828da4Christian Maeder<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
b6a54d7292d7a3713000847334de4316d105f40fChristian Maeder Select the digest algorithm. The value of
b6a54d7292d7a3713000847334de4316d105f40fChristian Maeder <code class="option">algorithm</code> must be one of SHA-1 (SHA1),
b6a54d7292d7a3713000847334de4316d105f40fChristian Maeder SHA-256 (SHA256), GOST or SHA-384 (SHA384).
d12de70436e416b477af9ae1bf6989f57488bf92Christian Maeder These values are case insensitive.
b6a54d7292d7a3713000847334de4316d105f40fChristian Maeder<dt><span class="term">-T <em class="replaceable"><code>TTL</code></em></span></dt>
b6a54d7292d7a3713000847334de4316d105f40fChristian Maeder Specifies the TTL of the DS records.
b6a54d7292d7a3713000847334de4316d105f40fChristian Maeder<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
b6a54d7292d7a3713000847334de4316d105f40fChristian Maeder Look for key files (or, in keyset mode,
b6a54d7292d7a3713000847334de4316d105f40fChristian Maeder <code class="filename">keyset-</code> files) in
b6a54d7292d7a3713000847334de4316d105f40fChristian Maeder<dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
b6a54d7292d7a3713000847334de4316d105f40fChristian Maeder Zone file mode: in place of the keyfile name, the argument is
b6a54d7292d7a3713000847334de4316d105f40fChristian Maeder the DNS domain name of a zone master file, which can be read
b6a54d7292d7a3713000847334de4316d105f40fChristian Maeder from <code class="option">file</code>. If the zone name is the same as
b6a54d7292d7a3713000847334de4316d105f40fChristian Maeder <code class="option">file</code>, then it may be omitted.
1c8c2ec97ff7dee8381aca53f0fca99c01f7b32fSonja Gröning If <code class="option">file</code> is set to <code class="literal">"-"</code>, then
1c8c2ec97ff7dee8381aca53f0fca99c01f7b32fSonja Gröning the zone data is read from the standard input. This makes it
7f6b97541fdee30d62a0a3cfa58173212a6cd002Christian Maeder possible to use the output of the <span><strong class="command">dig</strong></span>
7f6b97541fdee30d62a0a3cfa58173212a6cd002Christian Maeder command as input, as in:
62dd3cd58cda003c32ac69ff12dc82b0a6f5d9d3Christian Maeder <strong class="userinput"><code>dig dnskey example.com | dnssec-dsfromkey -f - example.com</code></strong>
e42eddbc69dd31f7cd696e38f82acad678831cb7Jian Chun Wang Include ZSKs when generating DS records. Without this option,
4eed11f3c47a94e8908e15a0af70370ad35b3586Paolo Torrini only keys which have the KSK flag set will be converted to DS
89c8609b3606fdb621eb8f987b88dc3813b5bbd5Christian Maeder records and printed. Useful only in zone file mode.
bb027d3cacbd83dfec98beb38001f105e4918557Christian Maeder<dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
bb027d3cacbd83dfec98beb38001f105e4918557Christian Maeder Generate a DLV set instead of a DS set. The specified
99c923311eab71a85f1dcc4785d349609c828da4Christian Maeder <code class="option">domain</code> is appended to the name for each
99c923311eab71a85f1dcc4785d349609c828da4Christian Maeder record in the set.
99c923311eab71a85f1dcc4785d349609c828da4Christian Maeder The DNSSEC Lookaside Validation (DLV) RR is described
613bf0ed7d98a961755408ead328687ec17f74fdChristian Maeder Keyset mode: in place of the keyfile name, the argument is
62dd3cd58cda003c32ac69ff12dc82b0a6f5d9d3Christian Maeder the DNS domain name of a keyset file.
2f65d931e866162d39d09c43021a55314040b377Christian Maeder<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
2f65d931e866162d39d09c43021a55314040b377Christian Maeder Specifies the DNS class (default is IN). Useful only
89c8609b3606fdb621eb8f987b88dc3813b5bbd5Christian Maeder in keyset or zone file mode.
89c8609b3606fdb621eb8f987b88dc3813b5bbd5Christian Maeder<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
62dd3cd58cda003c32ac69ff12dc82b0a6f5d9d3Christian Maeder Sets the debugging level.
62dd3cd58cda003c32ac69ff12dc82b0a6f5d9d3Christian Maeder Prints usage information.
62dd3cd58cda003c32ac69ff12dc82b0a6f5d9d3Christian Maeder Prints version information.
613bf0ed7d98a961755408ead328687ec17f74fdChristian Maeder To build the SHA-256 DS RR from the
613bf0ed7d98a961755408ead328687ec17f74fdChristian Maeder <strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
2f65d931e866162d39d09c43021a55314040b377Christian Maeder keyfile name, the following command would be issued:
62dd3cd58cda003c32ac69ff12dc82b0a6f5d9d3Christian Maeder<p><strong class="userinput"><code>dnssec-dsfromkey -2 Kexample.com.+003+26160</code></strong>
62dd3cd58cda003c32ac69ff12dc82b0a6f5d9d3Christian Maeder The command would print something like:
62dd3cd58cda003c32ac69ff12dc82b0a6f5d9d3Christian Maeder<p><strong class="userinput"><code>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</code></strong>
99c923311eab71a85f1dcc4785d349609c828da4Christian Maeder The keyfile can be designed by the key identification
036037a4510ea63a81a4829ad0c11ef39b2391b0Christian Maeder <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
036037a4510ea63a81a4829ad0c11ef39b2391b0Christian Maeder <code class="filename">Knnnn.+aaa+iiiii.key</code> as generated by
036037a4510ea63a81a4829ad0c11ef39b2391b0Christian Maeder <span class="refentrytitle">dnssec-keygen</span>(8).
61091743da1a9ed6dfd5e077fdcc972553358962Christian Maeder The keyset file name is built from the <code class="option">directory</code>,
61091743da1a9ed6dfd5e077fdcc972553358962Christian Maeder the string <code class="filename">keyset-</code> and the
d12de70436e416b477af9ae1bf6989f57488bf92Christian Maeder A keyfile error can give a "file not found" even if the file exists.
d12de70436e416b477af9ae1bf6989f57488bf92Christian Maeder<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
b6a54d7292d7a3713000847334de4316d105f40fChristian Maeder <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
036037a4510ea63a81a4829ad0c11ef39b2391b0Christian Maeder <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
613bf0ed7d98a961755408ead328687ec17f74fdChristian Maeder<p><span class="corpauthor">Internet Systems Consortium</span>
addb54340af3b3a96ef3a4cd2e0eae8f21cce733Christian Maeder<table width="100%" summary="Navigation footer">
addb54340af3b3a96ef3a4cd2e0eae8f21cce733Christian Maeder<a accesskey="p" href="man.dnssec-coverage.html">Prev</a>�</td>
addb54340af3b3a96ef3a4cd2e0eae8f21cce733Christian Maeder<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
addb54340af3b3a96ef3a4cd2e0eae8f21cce733Christian Maeder<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-importkey.html">Next</a>
4ef05f4edeb290beb89845f57156baa5298af7c4Christian Maeder<span class="application">dnssec-coverage</span>�</td>
addb54340af3b3a96ef3a4cd2e0eae8f21cce733Christian Maeder<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
576ccd5a62961b379f40158ad35589c90cb7758bChristian Maeder<td width="40%" align="right" valign="top">�<span class="application">dnssec-importkey</span>
a63bf534ba3839dee4bbc76b30755e7d5149986cChristian Maeder<p style="text-align: center;">BIND 9.11.0pre-alpha</p>