man.dnssec-keymgr.html revision 0da02c26a6631c25f075a8e4ac6de9e58f49a0c2
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync - Copyright (C) 2000-2016 Internet Systems Consortium, Inc. ("ISC")
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync - This Source Code Form is subject to the terms of the Mozilla Public
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync - License, v. 2.0. If a copy of the MPL was not distributed with this
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync - file, You can obtain one at http://mozilla.org/MPL/2.0/.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync<link rel="prev" href="man.dnssec-keygen.html" title="dnssec-keygen">
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync<link rel="next" href="man.dnssec-revoke.html" title="dnssec-revoke">
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync<tr><th colspan="3" align="center"><span class="application">dnssec-keymgr</span></th></tr>
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync<a accesskey="p" href="man.dnssec-keygen.html">Prev</a>�</td>
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-revoke.html">Next</a>
46fecc499044c1c2248f10d3b219b8d478df9d2evboxsync<a name="man.dnssec-keymgr"></a><div class="titlepage"></div>
ea23461901e0318ce17ab1edfaf4d93d0f6aa732vboxsync — Ensures correct DNSKEY coverage for a zone based on a defined policy
7f464cee1cb8600dd30024a1f3f693753d6483abvboxsync [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
8bf8c6b1914c9e7e60b1547888400668f1774497vboxsync [<code class="option">-c <em class="replaceable"><code>file</code></em></code>]
8bf8c6b1914c9e7e60b1547888400668f1774497vboxsync [<code class="option">-g <em class="replaceable"><code>path</code></em></code>]
8bf8c6b1914c9e7e60b1547888400668f1774497vboxsync [<code class="option">-r <em class="replaceable"><code>path</code></em></code>]
2c88ab948d19aa00c64cc412b6860d682a497571vboxsync [<code class="option">-s <em class="replaceable"><code>path</code></em></code>]
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync <span class="command"><strong>dnssec-keymgr</strong></span> is a high level Python wrapper
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync to facilitate the key rollover process for zones handled by
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync BIND. It uses the BIND commands for manipulating DNSSEC key
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync metadata: <span class="command"><strong>dnssec-keygen</strong></span> and
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync <span class="command"><strong>dnssec-settime</strong></span>.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync DNSSEC policy can be read from a configuration file (default
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync <code class="filename">/etc/dnssec-policy.conf</code>), from which the key
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync parameters, publication and rollover schedule, and desired
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync coverage duration for any given zone can be determined. This
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync file may be used to define individual DNSSEC policies on a
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync per-zone basis, or to set a default policy used for all zones.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync When <span class="command"><strong>dnssec-keymgr</strong></span> runs, it examines the DNSSEC
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync keys for one or more zones, comparing their timing metadata against
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync the policies for those zones. If key settings do not conform to the
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync DNSSEC policy (for example, because the policy has been changed),
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync they are automatically corrected.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync A zone policy can specify a duration for which we want to
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync ensure the key correctness (<code class="option">coverage</code>). It can
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync also specify a rollover period (<code class="option">roll-period</code>).
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync If policy indicates that a key should roll over before the
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync coverage period ends, then a successor key will automatically be
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync created and added to the end of the key series.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync If zones are specified on the command line,
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync <span class="command"><strong>dnssec-keymgr</strong></span> will examine only those zones.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync If a specified zone does not already have keys in place, then
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync keys will be generated for it according to policy.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync If zones are <span class="emphasis"><em>not</em></span> specified on the command
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync line, then <span class="command"><strong>dnssec-keymgr</strong></span> will search the
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync key directory (either the current working directory or the directory
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync set by the <code class="option">-K</code> option), and check the keys for
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync all the zones represented in the directory.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync It is expected that this tool will be run automatically and
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync unattended (for example, by <span class="command"><strong>cron</strong></span>).
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync <div class="variablelist"><dl class="variablelist">
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync<dt><span class="term">-c <em class="replaceable"><code>file</code></em></span></dt>
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync If <code class="option">-c</code> is specified, then the DNSSEC
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync policy is read from <code class="option">file</code>. (If not
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync specified, then the policy is read from
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync <code class="filename">/etc/dnssec-policy.conf</code>; if that file
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync doesn't exist, a built-in global default policy is used.)
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync Force: allow updating of key events even if they are
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync already in the past. This is not recommended for use with
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync zones in which keys have already been published. However,
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync if a set of keys has been generated all of which have
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync publication and activation dates in the past, but the
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync keys have not been published in a zone as yet, then this
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync option can be used to clean them up and turn them into a
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync proper series of keys with appropriate rollover intervals.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync<dt><span class="term">-g <em class="replaceable"><code>keygen-path</code></em></span></dt>
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync Specifies a path to a <span class="command"><strong>dnssec-keygen</strong></span> binary.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync Used for testing.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync See also the <code class="option">-s</code> option.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync Print the <span class="command"><strong>dnssec-keymgr</strong></span> help summary
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync Sets the directory in which keys can be found. Defaults to the
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync current working directory.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync Only apply policies to KSK keys.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync See also the <code class="option">-z</code> option.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync Quiet: suppress printing of <span class="command"><strong>dnssec-keygen</strong></span>
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync and <span class="command"><strong>dnssec-settime</strong></span>.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync<dt><span class="term">-r <em class="replaceable"><code>randomdev</code></em></span></dt>
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync Specifies a path to a file containing random data.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync This is passed to the <span class="command"><strong>dnssec-keygen</strong></span> binary
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync<dt><span class="term">-s <em class="replaceable"><code>settime-path</code></em></span></dt>
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync Specifies a path to a <span class="command"><strong>dnssec-settime</strong></span> binary.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync Used for testing.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync See also the <code class="option">-g</code> option.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync Print the <span class="command"><strong>dnssec-keymgr</strong></span> version and exit.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync Only apply policies to ZSK keys.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync See also the <code class="option">-k</code> option.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync<a name="id-1.14.13.9"></a><h2>POLICY CONFIGURATION</h2>
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync The <code class="filename">dnssec-policy.conf</code> file can specify three kinds
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync of policies:
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync <span class="emphasis"><em>Policy classes</em></span>
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync (<code class="option">policy <em class="replaceable"><code>name</code></em> { ... };</code>)
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync can be inherited by zone policies or other policy classes; these
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync can be used to create sets of different security profiles. For
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync example, a policy class <strong class="userinput"><code>normal</code></strong> might specify
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync 1024-bit key sizes, but a class <strong class="userinput"><code>extra</code></strong> might
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync specify 2048 bits instead; <strong class="userinput"><code>extra</code></strong> would be
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync used for zones that had unusually high security needs.
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync Algorithm policies:
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync (<code class="option">algorithm-policy <em class="replaceable"><code>algorithm</code></em> { ... };</code> )
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync override default per-algorithm settings. For example, by default,
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync RSASHA256 keys use 2048-bit key sizes for both KSK and ZSK. This
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync can be modified using <span class="command"><strong>algorithm-policy</strong></span>, and the
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync new key sizes would then be used for any key of type RSASHA256.
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync Zone policies:
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync (<code class="option">zone <em class="replaceable"><code>name</code></em> { ... };</code> )
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync set policy for a single zone by name. A zone policy can inherit
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync a policy class by including a <code class="option">policy</code> option.
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync Options that can be specified in policies:
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync <div class="variablelist"><dl class="variablelist">
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync<dt><span class="term"><span class="command"><strong>algorithm</strong></span></span></dt>
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync The key algorithm. If no policy is defined, the default is
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync<dt><span class="term"><span class="command"><strong>coverage</strong></span></span></dt>
9f72be0517ae135bdd3e6ee140d3321b40aeb6e7vboxsync The length of time to ensure that keys will be correct; no action
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync will be taken to create new keys to be activated after this time.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync This can be represented as a number of seconds, or as a duration using
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync human-readable units (examples: "1y" or "6 months").
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync A default value for this option can be set in algorithm policies
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync as well as in policy classes or zone policies.
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync If no policy is configured, the default is six months.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync<dt><span class="term"><span class="command"><strong>directory</strong></span></span></dt>
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync Specifies the directory in which keys should be stored.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync<dt><span class="term"><span class="command"><strong>key-size</strong></span></span></dt>
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync Specifies the number of bits to use in creating keys.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync Takes two arguments: keytype (eihter "zsk" or "ksk") and size.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync A default value for this option can be set in algorithm policies
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync as well as in policy classes or zone policies. If no policy is
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync configured, the default is 1024 bits for DSA keys and 2048 for
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync<dt><span class="term"><span class="command"><strong>keyttl</strong></span></span></dt>
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync The key TTL. If no policy is defined, the default is one hour.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync<dt><span class="term"><span class="command"><strong>post-publish</strong></span></span></dt>
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync How long after inactivation a key should be deleted from the zone.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync Note: If <code class="option">roll-period</code> is not set, this value is
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync ignored. Takes two arguments: keytype (eihter "zsk" or "ksk") and a
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync duration. A default value for this option can be set in algorithm
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync policies as well as in policy classes or zone policies. The default
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync is one month.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync<dt><span class="term"><span class="command"><strong>pre-publish</strong></span></span></dt>
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync How long before activation a key should be published. Note: If
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync <code class="option">roll-period</code> is not set, this value is ignored.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync Takes two arguments: keytype (either "zsk" or "ksk") and a duration.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync A default value for this option can be set in algorithm policies
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync as well as in policy classes or zone policies. The default is
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync<dt><span class="term"><span class="command"><strong>roll-period</strong></span></span></dt>
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync How frequently keys should be rolled over.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync Takes two arguments: keytype (eihter "zsk" or "ksk") and a duration.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync A default value for this option can be set in algorithm policies
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync as well as in policy classes or zone policies. If no policy is
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync configured, the default is one year for ZSK's. KSK's do not
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync roll over by default.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync<dt><span class="term"><span class="command"><strong>standby</strong></span></span></dt>
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync Not yet implemented.
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync Enable scheduling of KSK rollovers using the <code class="option">-P sync</code>
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync <span class="command"><strong>dnssec-keygen</strong></span> and
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync <span class="command"><strong>dnssec-settime</strong></span>. Check the parent zone
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync (as in <span class="command"><strong>dnssec-checkds</strong></span>) to determine when it's
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync safe for the key to roll.
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync Allow configuration of standby keys and use of the REVOKE bit,
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync for keys that use RFC 5011 semantics.
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync <span class="refentrytitle">dnssec-coverage</span>(8)
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync <span class="refentrytitle">dnssec-keygen</span>(8)
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync <span class="refentrytitle">dnssec-settime</span>(8)
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync <span class="refentrytitle">dnssec-checkds</span>(8)
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync<a accesskey="p" href="man.dnssec-keygen.html">Prev</a>�</td>
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
5aaed3512e7f21c9cf3077ff6ce7d4d88671c628vboxsync<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-revoke.html">Next</a>
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync<span class="application">dnssec-keygen</span>�</td>
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync<td width="40%" align="right" valign="top">�<span class="application">dnssec-revoke</span>
cb48b678483eed76053da41c3f0f2600eeeed5f4vboxsync<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.1b1</p>