man.dnssec-dsfromkey.html revision ba713ac34af236ef867cc27288e599659379cd66
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder - Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC")
1a6464613c59e35072b90ca296ae402cbe956144Christian Maeder - Copyright (C) 2000-2003 Internet Software Consortium.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder - Permission to use, copy, modify, and/or distribute this software for any
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder - purpose with or without fee is hereby granted, provided that the above
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder - copyright notice and this permission notice appear in all copies.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder - PERFORMANCE OF THIS SOFTWARE.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<link rel="prev" href="man.dnssec-coverage.html" title="dnssec-coverage">
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<link rel="next" href="man.dnssec-importkey.html" title="dnssec-importkey">
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<table width="100%" summary="Navigation header">
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<tr><th colspan="3" align="center"><span class="application">dnssec-dsfromkey</span></th></tr>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<a accesskey="p" href="man.dnssec-coverage.html">Prev</a>�</td>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<th width="60%" align="center">Manual pages</th>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-importkey.html">Next</a>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<a name="man.dnssec-dsfromkey"></a><div class="titlepage"></div>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<p><span class="application">dnssec-dsfromkey</span> — DNSSEC DS RR generation tool</p>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] {keyfile}</p></div>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> {-s} [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-s</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-A</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {dnsname}</p></div>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<a name="id2617633"></a><h2>DESCRIPTION</h2>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<p><span><strong class="command">dnssec-dsfromkey</strong></span>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder outputs the Delegation Signer (DS) resource record (RR), as defined in
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder RFC 3658 and RFC 4509, for the given key(s).
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder Use SHA-1 as the digest algorithm (the default is to use
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder both SHA-1 and SHA-256).
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder Use SHA-256 as the digest algorithm.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder Select the digest algorithm. The value of
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder <code class="option">algorithm</code> must be one of SHA-1 (SHA1),
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder SHA-256 (SHA256), GOST or SHA-384 (SHA384).
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder These values are case insensitive.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<dt><span class="term">-T <em class="replaceable"><code>TTL</code></em></span></dt>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder Specifies the TTL of the DS records.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder Look for key files (or, in keyset mode,
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder <code class="filename">keyset-</code> files) in
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder Zone file mode: in place of the keyfile name, the argument is
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder the DNS domain name of a zone master file, which can be read
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder from <code class="option">file</code>. If the zone name is the same as
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder <code class="option">file</code>, then it may be omitted.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder If <code class="option">file</code> is set to <code class="literal">"-"</code>, then
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder the zone data is read from the standard input. This makes it
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder possible to use the output of the <span><strong class="command">dig</strong></span>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder command as input, as in:
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder <strong class="userinput"><code>dig dnskey example.com | dnssec-dsfromkey -f - example.com</code></strong>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder Include ZSK's when generating DS records. Without this option,
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder only keys which have the KSK flag set will be converted to DS
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder records and printed. Useful only in zone file mode.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
26f228bf3a3fea810223396e5794c217a79a8d5bChristian Maeder Generate a DLV set instead of a DS set. The specified
26f228bf3a3fea810223396e5794c217a79a8d5bChristian Maeder <code class="option">domain</code> is appended to the name for each
26f228bf3a3fea810223396e5794c217a79a8d5bChristian Maeder record in the set.
ba904a15082557e939db689fcfba0c68c9a4f740Christian Maeder The DNSSEC Lookaside Validation (DLV) RR is described
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder Keyset mode: in place of the keyfile name, the argument is
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder the DNS domain name of a keyset file.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder Specifies the DNS class (default is IN). Useful only
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder in keyset or zone file mode.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder Sets the debugging level.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder To build the SHA-256 DS RR from the
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder <strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder keyfile name, the following command would be issued:
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<p><strong class="userinput"><code>dnssec-dsfromkey -2 Kexample.com.+003+26160</code></strong>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder The command would print something like:
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<p><strong class="userinput"><code>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</code></strong>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder The keyfile can be designed by the key identification
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder <code class="filename">Knnnn.+aaa+iiiii.key</code> as generated by
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder <span class="refentrytitle">dnssec-keygen</span>(8).
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder The keyset file name is built from the <code class="option">directory</code>,
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder the string <code class="filename">keyset-</code> and the
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder A keyfile error can give a "file not found" even if the file exists.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<p><span class="corpauthor">Internet Systems Consortium</span>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<table width="100%" summary="Navigation footer">
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<a accesskey="p" href="man.dnssec-coverage.html">Prev</a>�</td>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-importkey.html">Next</a>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<span class="application">dnssec-coverage</span>�</td>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<td width="40%" align="right" valign="top">�<span class="application">dnssec-importkey</span>