From ea648e70a989cca190cd7403fe892fd2dcc290b4 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sun, 5 May 2024 20:37:14 +0200 Subject: Adding upstream version 1:9.11.5.P4+dfsg. Signed-off-by: Daniel Baumann --- bin/dnssec/dnssec-dsfromkey.docbook | 305 ++++++++++++++++++++++++++++++++++++ 1 file changed, 305 insertions(+) create mode 100644 bin/dnssec/dnssec-dsfromkey.docbook (limited to 'bin/dnssec/dnssec-dsfromkey.docbook') diff --git a/bin/dnssec/dnssec-dsfromkey.docbook b/bin/dnssec/dnssec-dsfromkey.docbook new file mode 100644 index 0000000..4fdc507 --- /dev/null +++ b/bin/dnssec/dnssec-dsfromkey.docbook @@ -0,0 +1,305 @@ + + + + + + 2012-05-02 + + + ISC + Internet Systems Consortium, Inc. + + + + dnssec-dsfromkey + 8 + BIND9 + + + + dnssec-dsfromkey + DNSSEC DS RR generation tool + + + + + 2008 + 2009 + 2010 + 2011 + 2012 + 2014 + 2015 + 2016 + 2018 + 2019 + Internet Systems Consortium, Inc. ("ISC") + + + + + + dnssec-dsfromkey + + + + + + + + keyfile + + + dnssec-dsfromkey + -s + + + + + + + + + + + + dnsname + + + dnssec-dsfromkey + + + + + + DESCRIPTION + + dnssec-dsfromkey + outputs the Delegation Signer (DS) resource record (RR), as defined in + RFC 3658 and RFC 4509, for the given key(s). + + + + OPTIONS + + + + + -1 + + + Use SHA-1 as the digest algorithm (the default is to use + both SHA-1 and SHA-256). + + + + + + -2 + + + Use SHA-256 as the digest algorithm. + + + + + + -a algorithm + + + Select the digest algorithm. The value of + must be one of SHA-1 (SHA1), + SHA-256 (SHA256), GOST or SHA-384 (SHA384). + These values are case insensitive. + + + + + + -C + + + Generate CDS records rather than DS records. This is mutually + exclusive with generating lookaside records. + + + + + + -T TTL + + + Specifies the TTL of the DS records. + + + + + + -K directory + + + Look for key files (or, in keyset mode, + keyset- files) in + . + + + + + + -f file + + + Zone file mode: in place of the keyfile name, the argument is + the DNS domain name of a zone master file, which can be read + from . If the zone name is the same as + , then it may be omitted. + + + If is set to "-", then + the zone data is read from the standard input. This makes it + possible to use the output of the dig + command as input, as in: + + + dig dnskey example.com | dnssec-dsfromkey -f - example.com + + + + + + -A + + + Include ZSKs when generating DS records. Without this option, + only keys which have the KSK flag set will be converted to DS + records and printed. Useful only in zone file mode. + + + + + + -l domain + + + Generate a DLV set instead of a DS set. The specified + is appended to the name for each + record in the set. + The DNSSEC Lookaside Validation (DLV) RR is described + in RFC 4431. This is mutually exclusive with generating + CDS records. + + + + + + -s + + + Keyset mode: in place of the keyfile name, the argument is + the DNS domain name of a keyset file. + + + + + + -c class + + + Specifies the DNS class (default is IN). Useful only + in keyset or zone file mode. + + + + + + -v level + + + Sets the debugging level. + + + + + + -h + + + Prints usage information. + + + + + + -V + + + Prints version information. + + + + + + + EXAMPLE + + + To build the SHA-256 DS RR from the + Kexample.com.+003+26160 + keyfile name, the following command would be issued: + + dnssec-dsfromkey -2 Kexample.com.+003+26160 + + + The command would print something like: + + example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94 + + + + FILES + + + The keyfile can be designed by the key identification + Knnnn.+aaa+iiiii or the full file name + Knnnn.+aaa+iiiii.key as generated by + dnssec-keygen8. + + + The keyset file name is built from the , + the string keyset- and the + . + + + + CAVEAT + + + A keyfile error can give a "file not found" even if the file exists. + + + + SEE ALSO + + + dnssec-keygen8 + , + + dnssec-signzone8 + , + BIND 9 Administrator Reference Manual, + RFC 3658, + RFC 4431. + RFC 4509. + + + + -- cgit v1.2.3