man.dnssec-keygen.html revision e9ed929fd1a190f29391be9c7ae324e7e56ff9c9
dfd576109cb676448a2c4574150060aa3d8626bavboxsync - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
dfd576109cb676448a2c4574150060aa3d8626bavboxsync - Copyright (C) 2000-2003 Internet Software Consortium.
dfd576109cb676448a2c4574150060aa3d8626bavboxsync - Permission to use, copy, modify, and/or distribute this software for any
dfd576109cb676448a2c4574150060aa3d8626bavboxsync - purpose with or without fee is hereby granted, provided that the above
dfd576109cb676448a2c4574150060aa3d8626bavboxsync - copyright notice and this permission notice appear in all copies.
dfd576109cb676448a2c4574150060aa3d8626bavboxsync - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
dfd576109cb676448a2c4574150060aa3d8626bavboxsync - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
dfd576109cb676448a2c4574150060aa3d8626bavboxsync - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
dfd576109cb676448a2c4574150060aa3d8626bavboxsync - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
dfd576109cb676448a2c4574150060aa3d8626bavboxsync - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
dfd576109cb676448a2c4574150060aa3d8626bavboxsync - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
dfd576109cb676448a2c4574150060aa3d8626bavboxsync - PERFORMANCE OF THIS SOFTWARE.
dfd576109cb676448a2c4574150060aa3d8626bavboxsync<!-- $Id$ -->
dfd576109cb676448a2c4574150060aa3d8626bavboxsync<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
dfd576109cb676448a2c4574150060aa3d8626bavboxsync<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
dfd576109cb676448a2c4574150060aa3d8626bavboxsync<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
dfd576109cb676448a2c4574150060aa3d8626bavboxsync<link rel="prev" href="man.dnssec-keyfromlabel.html" title="dnssec-keyfromlabel">
dfd576109cb676448a2c4574150060aa3d8626bavboxsync<link rel="next" href="man.dnssec-revoke.html" title="dnssec-revoke">
dfd576109cb676448a2c4574150060aa3d8626bavboxsync<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync<tr><th colspan="3" align="center"><span class="application">dnssec-keygen</span></th></tr>
8d8dfc00d014a62894327907a04f148b00a08529vboxsync<a accesskey="p" href="man.dnssec-keyfromlabel.html">Prev</a>�</td>
8d8dfc00d014a62894327907a04f148b00a08529vboxsync<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-revoke.html">Next</a>
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync<a name="man.dnssec-keygen"></a><div class="titlepage"></div>
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync<p><span class="application">dnssec-keygen</span> — DNSSEC key generation tool</p>
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync<div class="cmdsynopsis"><p><code class="command">dnssec-keygen</code> [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-3</code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-C</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>] [<code class="option">-h</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-k</code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-q</code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-z</code>] {name}</p></div>
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync<p><span><strong class="command">dnssec-keygen</strong></span>
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync generates keys for DNSSEC (Secure DNS), as defined in RFC 2535
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync and RFC 4034. It can also generate keys for use with
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync TSIG (Transaction Signatures) as defined in RFC 2845, or TKEY
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync (Transaction Key) as defined in RFC 2930.
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync The <code class="option">name</code> of the key is specified on the command
8d8dfc00d014a62894327907a04f148b00a08529vboxsync line. For DNSSEC keys, this must match the name of the zone for
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync which the key is being generated.
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync Selects the cryptographic algorithm. For DNSSEC keys, the value
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync of <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync ECDSAP256SHA256 or ECDSAP384SHA384.
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync be DH (Diffie Hellman), HMAC-MD5, HMAC-SHA1, HMAC-SHA224,
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512. These values are
1960568d96ad2cc533d6a2c9b3a4de93c5188710vboxsync case insensitive.
1960568d96ad2cc533d6a2c9b3a4de93c5188710vboxsync If no algorithm is specified, then RSASHA1 will be used by
1960568d96ad2cc533d6a2c9b3a4de93c5188710vboxsync default, unless the <code class="option">-3</code> option is specified,
1960568d96ad2cc533d6a2c9b3a4de93c5188710vboxsync in which case NSEC3RSASHA1 will be used instead. (If
1960568d96ad2cc533d6a2c9b3a4de93c5188710vboxsync <code class="option">-3</code> is used and an algorithm is specified,
1960568d96ad2cc533d6a2c9b3a4de93c5188710vboxsync that algorithm will be checked for compatibility with NSEC3.)
1960568d96ad2cc533d6a2c9b3a4de93c5188710vboxsync Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync algorithm, and DSA is recommended. For TSIG, HMAC-MD5 is
1960568d96ad2cc533d6a2c9b3a4de93c5188710vboxsync Note 2: DH, HMAC-MD5, and HMAC-SHA1 through HMAC-SHA512
1960568d96ad2cc533d6a2c9b3a4de93c5188710vboxsync automatically set the -T KEY option.
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync<dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync Specifies the number of bits in the key. The choice of key
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync size depends on the algorithm used. RSA keys must be
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync between 512 and 2048 bits. Diffie Hellman keys must be between
2af83f845f4d566e97a557a88d47a24d27194c07vboxsync 128 and 4096 bits. DSA keys must be between 512 and 1024
b4e89d495c2988c10068923397d31fd27112b9ebvboxsync bits and an exact multiple of 64. HMAC keys must be
2af83f845f4d566e97a557a88d47a24d27194c07vboxsync between 1 and 512 bits. Elliptic curve algorithms don't need
2af83f845f4d566e97a557a88d47a24d27194c07vboxsync this parameter.
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync The key size does not need to be specified if using a default
2af83f845f4d566e97a557a88d47a24d27194c07vboxsync algorithm. The default key size is 1024 bits for zone signing
0cec432d9663133d971451c30d969c065010e886vboxsync keys (ZSKs) and 2048 bits for key signing keys (KSKs,
2af83f845f4d566e97a557a88d47a24d27194c07vboxsync generated with <code class="option">-f KSK</code>). However, if an
2af83f845f4d566e97a557a88d47a24d27194c07vboxsync algorithm is explicitly specified with the <code class="option">-a</code>,
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync then there is no default key size, and the <code class="option">-b</code>
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync must be used.
b4e89d495c2988c10068923397d31fd27112b9ebvboxsync<dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync Specifies the owner type of the key. The value of
2af83f845f4d566e97a557a88d47a24d27194c07vboxsync <code class="option">nametype</code> must either be ZONE (for a DNSSEC
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
8d8dfc00d014a62894327907a04f148b00a08529vboxsync a host (KEY)),
dfd576109cb676448a2c4574150060aa3d8626bavboxsync USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
dfd576109cb676448a2c4574150060aa3d8626bavboxsync These values are case insensitive. Defaults to ZONE for DNSKEY
dfd576109cb676448a2c4574150060aa3d8626bavboxsync generation.
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync Use an NSEC3-capable algorithm to generate a DNSSEC key.
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync If this option is used and no algorithm is explicitly
8d8dfc00d014a62894327907a04f148b00a08529vboxsync set on the command line, NSEC3RSASHA1 will be used by
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync default. Note that RSASHA256, RSASHA512, ECCGOST,
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync ECDSAP256SHA256 and ECDSAP384SHA384 algorithms
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync are NSEC3-capable.
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync Compatibility mode: generates an old-style key, without
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync any metadata. By default, <span><strong class="command">dnssec-keygen</strong></span>
8d8dfc00d014a62894327907a04f148b00a08529vboxsync will include the key's creation date in the metadata stored
4d5a2d10140117cca0a93d7e1b4d71304701d6e1vboxsync with the private key, and other dates may be set there as well
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync (publication date, activation date, etc). Keys that include
8d8dfc00d014a62894327907a04f148b00a08529vboxsync this data may be incompatible with older versions of BIND; the
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync <code class="option">-C</code> option suppresses them.
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync Indicates that the DNS record containing the key should have
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync the specified class. If not specified, class IN is used.
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
8d8dfc00d014a62894327907a04f148b00a08529vboxsync Specifies the cryptographic hardware to use, when applicable.
8d8dfc00d014a62894327907a04f148b00a08529vboxsync When BIND is built with OpenSSL PKCS#11 support, this defaults
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync to the string "pkcs11", which identifies an OpenSSL engine
8d8dfc00d014a62894327907a04f148b00a08529vboxsync that can drive a cryptographic accelerator or hardware service
dfd576109cb676448a2c4574150060aa3d8626bavboxsync module. When BIND is built with native PKCS#11 cryptography
dfd576109cb676448a2c4574150060aa3d8626bavboxsync (--enable-native-pkcs11), it defaults to the path of the PKCS#11
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync provider library specified via "--with-pkcs11".
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync<dt><span class="term">-f <em class="replaceable"><code>flag</code></em></span></dt>
dfd576109cb676448a2c4574150060aa3d8626bavboxsync Set the specified flag in the flag field of the KEY/DNSKEY record.
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync The only recognized flags are KSK (Key Signing Key) and REVOKE.
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync Generate a key, but do not publish it or sign with it. This
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync option is incompatible with -P and -A.
dfd576109cb676448a2c4574150060aa3d8626bavboxsync<dt><span class="term">-g <em class="replaceable"><code>generator</code></em></span></dt>
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync If generating a Diffie Hellman key, use this generator.
dfd576109cb676448a2c4574150060aa3d8626bavboxsync Allowed values are 2 and 5. If no generator
8d8dfc00d014a62894327907a04f148b00a08529vboxsync is specified, a known prime from RFC 2539 will be used
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync if possible; otherwise the default is 2.
dfd576109cb676448a2c4574150060aa3d8626bavboxsync Prints a short summary of the options and arguments to
dfd576109cb676448a2c4574150060aa3d8626bavboxsync <span><strong class="command">dnssec-keygen</strong></span>.
dfd576109cb676448a2c4574150060aa3d8626bavboxsync<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync Sets the directory in which the key files are to be written.
dfd576109cb676448a2c4574150060aa3d8626bavboxsync Deprecated in favor of -T KEY.
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync<dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
dfd576109cb676448a2c4574150060aa3d8626bavboxsync Sets the default TTL to use for this key when it is converted
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync into a DNSKEY RR. If the key is imported into a zone,
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync this is the TTL that will be used for it, unless there was
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync already a DNSKEY RRset in place, in which case the existing TTL
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync would take precedence. If this value is not set and there
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync is no existing DNSKEY RRset, the TTL will default to the
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync SOA TTL. Setting the default TTL to <code class="literal">0</code>
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync or <code class="literal">none</code> is the same as leaving it unset.
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync<dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>
a3d33059b39a600e1e4595dc37b58104840f0910vboxsync Sets the protocol value for the generated key. The protocol
a3d33059b39a600e1e4595dc37b58104840f0910vboxsync is a number between 0 and 255. The default is 3 (DNSSEC).
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync Other possible values for this argument are listed in
dfd576109cb676448a2c4574150060aa3d8626bavboxsync RFC 2535 and its successors.
dfd576109cb676448a2c4574150060aa3d8626bavboxsync Quiet mode: Suppresses unnecessary output, including
dfd576109cb676448a2c4574150060aa3d8626bavboxsync progress indication. Without this option, when
dfd576109cb676448a2c4574150060aa3d8626bavboxsync <span><strong class="command">dnssec-keygen</strong></span> is run interactively
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync to generate an RSA or DSA key pair, it will print a string
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync of symbols to <code class="filename">stderr</code> indicating the
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync progress of the key generation. A '.' indicates that a
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync random number has been found which passed an initial
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync sieve test; '+' means a number has passed a single
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync round of the Miller-Rabin primality test; a space
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync means that the number has passed all the tests and is
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync a satisfactory key.
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync<dt><span class="term">-r <em class="replaceable"><code>randomdev</code></em></span></dt>
dfd576109cb676448a2c4574150060aa3d8626bavboxsync Specifies the source of randomness. If the operating
dfd576109cb676448a2c4574150060aa3d8626bavboxsync system does not provide a <code class="filename">/dev/random</code>
dfd576109cb676448a2c4574150060aa3d8626bavboxsync or equivalent device, the default source of randomness
dfd576109cb676448a2c4574150060aa3d8626bavboxsync is keyboard input. <code class="filename">randomdev</code>
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync the name of a character device or file containing random
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync data to be used instead of the default. The special value
c371a0f6f78033721d8faa94fec7a8b2792fe165vboxsync <code class="filename">keyboard</code> indicates that keyboard
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync input should be used.
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync<dt><span class="term">-S <em class="replaceable"><code>key</code></em></span></dt>
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync Create a new key which is an explicit successor to an
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync existing key. The name, algorithm, size, and type of the
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync key will be set to match the existing key. The activation
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync date of the new key will be set to the inactivation date of
5d74c7672f6c2d1f2ab95efcb6713e97ca361113vboxsync the existing one. The publication date will be set to the
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync activation date minus the prepublication interval, which
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync defaults to 30 days.
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync<dt><span class="term">-s <em class="replaceable"><code>strength</code></em></span></dt>
072f9d45583716b8940901b43edd43d68d6845ffvboxsync Specifies the strength value of the key. The strength is
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync a number between 0 and 15, and currently has no defined
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync purpose in DNSSEC.
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync<dt><span class="term">-T <em class="replaceable"><code>rrtype</code></em></span></dt>
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync Specifies the resource record type to use for the key.
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync <code class="option">rrtype</code> must be either DNSKEY or KEY. The
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync default is DNSKEY when using a DNSSEC algorithm, but it can be
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync overridden to KEY for use with SIG(0).
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync Using any TSIG algorithm (HMAC-* or DH) forces this option
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync<dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
b3a643fa111c6f3a826cf2e84e0806e4d19e3ba9vboxsync Indicates the use of the key. <code class="option">type</code> must be
dfd576109cb676448a2c4574150060aa3d8626bavboxsync one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
dfd576109cb676448a2c4574150060aa3d8626bavboxsync is AUTHCONF. AUTH refers to the ability to authenticate