diff options
Diffstat (limited to 'doc/man/dnssec-settime.1in')
| -rw-r--r-- | doc/man/dnssec-settime.1in | 296 |
1 files changed, 296 insertions, 0 deletions
diff --git a/doc/man/dnssec-settime.1in b/doc/man/dnssec-settime.1in new file mode 100644 index 0000000..b0862d9 --- /dev/null +++ b/doc/man/dnssec-settime.1in @@ -0,0 +1,296 @@ +.\" Man page generated from reStructuredText. +. +. +.nr rst2man-indent-level 0 +. +.de1 rstReportMargin +\\$1 \\n[an-margin] +level \\n[rst2man-indent-level] +level margin: \\n[rst2man-indent\\n[rst2man-indent-level]] +- +\\n[rst2man-indent0] +\\n[rst2man-indent1] +\\n[rst2man-indent2] +.. +.de1 INDENT +.\" .rstReportMargin pre: +. RS \\$1 +. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin] +. nr rst2man-indent-level +1 +.\" .rstReportMargin post: +.. +.de UNINDENT +. RE +.\" indent \\n[an-margin] +.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]] +.nr rst2man-indent-level -1 +.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]] +.in \\n[rst2man-indent\\n[rst2man-indent-level]]u +.. +.TH "DNSSEC-SETTIME" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9" +.SH NAME +dnssec-settime \- set the key timing metadata for a DNSSEC key +.SH SYNOPSIS +.sp +\fBdnssec\-settime\fP [\fB\-f\fP] [\fB\-K\fP directory] [\fB\-L\fP ttl] [\fB\-P\fP date/offset] [\fB\-P\fP ds date/offset] [\fB\-P\fP sync date/offset] [\fB\-A\fP date/offset] [\fB\-R\fP date/offset] [\fB\-I\fP date/offset] [\fB\-D\fP date/offset] [\fB\-D\fP ds date/offset] [\fB\-D\fP sync date/offset] [\fB\-S\fP key] [\fB\-i\fP interval] [\fB\-h\fP] [\fB\-V\fP] [\fB\-v\fP level] [\fB\-E\fP engine] {keyfile} [\fB\-s\fP] [\fB\-g\fP state] [\fB\-d\fP state date/offset] [\fB\-k\fP state date/offset] [\fB\-r\fP state date/offset] [\fB\-z\fP state date/offset] +.SH DESCRIPTION +.sp +\fBdnssec\-settime\fP reads a DNSSEC private key file and sets the key +timing metadata as specified by the \fI\%\-P\fP, \fI\%\-A\fP, \fI\%\-R\fP, +\fI\%\-I\fP, and \fI\%\-D\fP options. The metadata can then be used by +\fI\%dnssec\-signzone\fP or other signing software to determine when a key is +to be published, whether it should be used for signing a zone, etc. +.sp +If none of these options is set on the command line, +\fBdnssec\-settime\fP simply prints the key timing metadata already stored +in the key. +.sp +When key metadata fields are changed, both files of a key pair +(\fBKnnnn.+aaa+iiiii.key\fP and \fBKnnnn.+aaa+iiiii.private\fP) are +regenerated. +.sp +Metadata fields are stored in the private file. A +human\-readable description of the metadata is also placed in comments in +the key file. The private file\(aqs permissions are always set to be +inaccessible to anyone other than the owner (mode 0600). +.sp +When working with state files, it is possible to update the timing metadata in +those files as well with \fI\%\-s\fP\&. With this option, it is also possible +to update key states with \fI\%\-d\fP (DS), \fI\%\-k\fP (DNSKEY), \fI\%\-r\fP +(RRSIG of KSK), or \fI\%\-z\fP (RRSIG of ZSK). Allowed states are HIDDEN, +RUMOURED, OMNIPRESENT, and UNRETENTIVE. +.sp +The goal state of the key can also be set with \fI\%\-g\fP\&. This should be either +HIDDEN or OMNIPRESENT, representing whether the key should be removed from the +zone or published. +.sp +It is NOT RECOMMENDED to manipulate state files manually, except for testing +purposes. +.SH OPTIONS +.INDENT 0.0 +.TP +.B \-f +This option forces an update of an old\-format key with no metadata fields. Without +this option, \fBdnssec\-settime\fP fails when attempting to update a +legacy key. With this option, the key is recreated in the new +format, but with the original key data retained. The key\(aqs creation +date is set to the present time. If no other values are +specified, then the key\(aqs publication and activation dates are also +set to the present time. +.UNINDENT +.INDENT 0.0 +.TP +.B \-K directory +This option sets the directory in which the key files are to reside. +.UNINDENT +.INDENT 0.0 +.TP +.B \-L ttl +This option sets the default TTL to use for this key when it is converted into a +DNSKEY RR. This is the TTL used when the key is imported into a zone, +unless there was already a DNSKEY RRset in +place, in which case the existing TTL takes precedence. If this +value is not set and there is no existing DNSKEY RRset, the TTL +defaults to the SOA TTL. Setting the default TTL to \fB0\fP or \fBnone\fP +removes it from the key. +.UNINDENT +.INDENT 0.0 +.TP +.B \-h +This option emits a usage message and exits. +.UNINDENT +.INDENT 0.0 +.TP +.B \-V +This option prints version information. +.UNINDENT +.INDENT 0.0 +.TP +.B \-v level +This option sets the debugging level. +.UNINDENT +.INDENT 0.0 +.TP +.B \-E engine +This option specifies the cryptographic hardware to use, when applicable. +.sp +When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL +engine identifier that drives the cryptographic accelerator or +hardware service module (usually \fBpkcs11\fP). +.UNINDENT +.SH TIMING OPTIONS +.sp +Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS +(which is the format used inside key files), +or \(aqDay Mon DD HH:MM:SS YYYY\(aq (as printed by \fBdnssec\-settime \-p\fP), +or UNIX epoch time (as printed by \fBdnssec\-settime \-up\fP), +or the literal \fBnow\fP\&. +.sp +The argument can be followed by \fB+\fP or \fB\-\fP and an offset from the +given time. The literal \fBnow\fP can be omitted before an offset. The +offset can be followed by one of the suffixes \fBy\fP, \fBmo\fP, \fBw\fP, +\fBd\fP, \fBh\fP, or \fBmi\fP, so that it is computed in years (defined as +365 24\-hour days, ignoring leap years), months (defined as 30 24\-hour +days), weeks, days, hours, or minutes, respectively. Without a suffix, +the offset is computed in seconds. +.sp +To unset a date, use \fBnone\fP, \fBnever\fP, or \fBunset\fP\&. +.sp +All these formats are case\-insensitive. +.INDENT 0.0 +.TP +.B \-P date/offset +This option sets the date on which a key is to be published to the zone. After +that date, the key is included in the zone but is not used +to sign it. +.INDENT 7.0 +.TP +.B ds date/offset +This option sets the date on which DS records that match this key have been +seen in the parent zone. +.UNINDENT +.INDENT 7.0 +.TP +.B sync date/offset +This option sets the date on which CDS and CDNSKEY records that match this key +are to be published to the zone. +.UNINDENT +.UNINDENT +.INDENT 0.0 +.TP +.B \-A date/offset +This option sets the date on which the key is to be activated. After that date, +the key is included in the zone and used to sign it. +.UNINDENT +.INDENT 0.0 +.TP +.B \-R date/offset +This option sets the date on which the key is to be revoked. After that date, the +key is flagged as revoked. It is included in the zone and +is used to sign it. +.UNINDENT +.INDENT 0.0 +.TP +.B \-I date/offset +This option sets the date on which the key is to be retired. After that date, the +key is still included in the zone, but it is not used to +sign it. +.UNINDENT +.INDENT 0.0 +.TP +.B \-D date/offset +This option sets the date on which the key is to be deleted. After that date, the +key is no longer included in the zone. (However, it may remain in the key +repository.) +.INDENT 7.0 +.TP +.B ds date/offset +This option sets the date on which the DS records that match this key have +been seen removed from the parent zone. +.UNINDENT +.INDENT 7.0 +.TP +.B sync date/offset +This option sets the date on which the CDS and CDNSKEY records that match this +key are to be deleted. +.UNINDENT +.UNINDENT +.INDENT 0.0 +.TP +.B \-S predecessor key +This option selects a key for which the key being modified is an explicit +successor. The name, algorithm, size, and type of the predecessor key +must exactly match those of the key being modified. The activation +date of the successor key is set to the inactivation date of the +predecessor. The publication date is set to the activation date +minus the prepublication interval, which defaults to 30 days. +.UNINDENT +.INDENT 0.0 +.TP +.B \-i interval +This option sets the prepublication interval for a key. If set, then the +publication and activation dates must be separated by at least this +much time. If the activation date is specified but the publication +date is not, the publication date defaults to this much time +before the activation date; conversely, if the publication date is +specified but not the activation date, activation is set to +this much time after publication. +.sp +If the key is being created as an explicit successor to another key, +then the default prepublication interval is 30 days; otherwise it is +zero. +.sp +As with date offsets, if the argument is followed by one of the +suffixes \fBy\fP, \fBmo\fP, \fBw\fP, \fBd\fP, \fBh\fP, or \fBmi\fP, the interval is +measured in years, months, weeks, days, hours, or minutes, +respectively. Without a suffix, the interval is measured in seconds. +.UNINDENT +.SH KEY STATE OPTIONS +.sp +To test dnssec\-policy it may be necessary to construct keys with artificial +state information; these options are used by the testing framework for that +purpose, but should never be used in production. +.sp +Known key states are HIDDEN, RUMOURED, OMNIPRESENT, and UNRETENTIVE. +.INDENT 0.0 +.TP +.B \-s +This option indicates that when setting key timing data, the state file should also be updated. +.UNINDENT +.INDENT 0.0 +.TP +.B \-g state +This option sets the goal state for this key. Must be HIDDEN or OMNIPRESENT. +.UNINDENT +.INDENT 0.0 +.TP +.B \-d state date/offset +This option sets the DS state for this key as of the specified date, offset from the current date. +.UNINDENT +.INDENT 0.0 +.TP +.B \-k state date/offset +This option sets the DNSKEY state for this key as of the specified date, offset from the current date. +.UNINDENT +.INDENT 0.0 +.TP +.B \-r state date/offset +This option sets the RRSIG (KSK) state for this key as of the specified date, offset from the current date. +.UNINDENT +.INDENT 0.0 +.TP +.B \-z state date/offset +This option sets the RRSIG (ZSK) state for this key as of the specified date, offset from the current date. +.UNINDENT +.SH PRINTING OPTIONS +.sp +\fBdnssec\-settime\fP can also be used to print the timing metadata +associated with a key. +.INDENT 0.0 +.TP +.B \-u +This option indicates that times should be printed in Unix epoch format. +.UNINDENT +.INDENT 0.0 +.TP +.B \-p C/P/Pds/Psync/A/R/I/D/Dds/Dsync/all +This option prints a specific metadata value or set of metadata values. +The \fI\%\-p\fP option may be followed by one or more of the following letters or +strings to indicate which value or values to print: \fBC\fP for the +creation date, \fBP\fP for the publication date, \fBPds\(ga for the DS publication +date, \(ga\(gaPsync\fP for the CDS and CDNSKEY publication date, \fBA\fP for the +activation date, \fBR\fP for the revocation date, \fBI\fP for the inactivation +date, \fBD\fP for the deletion date, \fBDds\fP for the DS deletion date, +and \fBDsync\fP for the CDS and CDNSKEY deletion date. To print all of the +metadata, use \fBall\fP\&. +.UNINDENT +.SH SEE ALSO +.sp +\fI\%dnssec\-keygen(8)\fP, \fI\%dnssec\-signzone(8)\fP, BIND 9 Administrator Reference Manual, +\fI\%RFC 5011\fP\&. +.SH AUTHOR +Internet Systems Consortium +.SH COPYRIGHT +2023, Internet Systems Consortium +.\" Generated by docutils manpage writer. +. |