+[no]expandaaaa+ When printing AAAA record print all zero nibbles rather + than the default RFC 5952 preferred presentation format. +
++[no]fail
diff --git a/bin/dnssec/dnssec-dsfromkey.8 b/bin/dnssec/dnssec-dsfromkey.8
index 55621c05ae..3cfb1f3f67 100644
--- a/bin/dnssec/dnssec-dsfromkey.8
+++ b/bin/dnssec/dnssec-dsfromkey.8
@@ -10,12 +10,12 @@
.\" Title: dnssec-dsfromkey
.\" Author:
.\" Generator: DocBook XSL Stylesheets v1.78.1
- An abbreviation for -a SHA1
+ An abbreviation for -a SHA-1.
+ (Note: The SHA-1 algorithm is no longer recommended for use
+ when generating new DS and CDS records.)
- An abbreviation for -a SHA-256
+ An abbreviation for -a SHA-256.
algorithm
dnssec-keygen
- [-a ]
- [algorithm-b ]
- [keysize-n ]
[nametype-3]
[-A ]
+ [date/offset-a ]
+ [algorithm-b ]
[keysize-C]
[-c ]
[class-D ]
@@ -52,6 +51,7 @@
[date/offset-K ]
[directory-k]
[-L ]
+ [ttl-n ]
[nametype-P ]
[date/offset-P sync ]
[date/offset-p ]
@@ -62,7 +62,6 @@
[protocol-t ]
[type-V]
[-v ]
- [level-z]
{name}
+ Use an NSEC3-capable algorithm to generate a DNSSEC key. + If this option is used with an algorithm that has both + NSEC and NSEC3 versions, then the NSEC3 version will be + used; for example, dnssec-keygen -3a RSASHA1 + specifies the NSEC3RSASHA1 algorithm. +
+algorithm@@ -130,11 +139,9 @@
Specifies the number of bits in the key. The choice of key size depends on the algorithm used. RSA keys must be - between 1024 and 2048 bits. Diffie Hellman keys must be between - 128 and 4096 bits. DSA keys must be between 512 and 1024 - bits and an exact multiple of 64. HMAC keys must be - between 1 and 512 bits. Elliptic curve algorithms don't need - this parameter. + between 1024 and 4096 bits. Diffie Hellman keys must be between + 128 and 4096 bits. Elliptic curve algorithms don't need this + parameter.
If the key size is not specified, some algorithms have
@@ -144,36 +151,15 @@
-f KSK) default to 2048 bits.
nametype
- Specifies the owner type of the key. The value of
- nametype must either be ZONE (for a DNSSEC
- zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated
- with a host (KEY)), USER (for a key associated with a
- user(KEY)) or OTHER (DNSKEY). These values are case
- insensitive. Defaults to ZONE for DNSKEY generation.
-
- Use an NSEC3-capable algorithm to generate a DNSSEC key. - If this option is used with an algorithm that has both - NSEC and NSEC3 versions, then the NSEC3 version will be - used; for example, dnssec-keygen -3a RSASHA1 - specifies the NSEC3RSASHA1 algorithm. -
-
- Compatibility mode: generates an old-style key, without
- any metadata. By default, dnssec-keygen
- will include the key's creation date in the metadata stored
- with the private key, and other dates may be set there as well
- (publication date, activation date, etc). Keys that include
- this data may be incompatible with older versions of BIND; the
+ Compatibility mode: generates an old-style key, without any
+ timing metadata. By default, dnssec-keygen
+ will include the key's creation date in the metadata stored with
+ the private key, and other dates may be set there as well
+ (publication date, activation date, etc). Keys that include this
+ data may be incompatible with older versions of BIND; the
-C option suppresses them.
- Deprecated in favor of -T KEY. -
-ttl
@@ -253,13 +233,24 @@
or none is the same as leaving it unset.
nametype
+ Specifies the owner type of the key. The value of
+ nametype must either be ZONE (for a DNSSEC
+ zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated
+ with a host (KEY)), USER (for a key associated with a
+ user(KEY)) or OTHER (DNSKEY). These values are case
+ insensitive. Defaults to ZONE for DNSKEY generation.
+
protocol
- Sets the protocol value for the generated key. The protocol
- is a number between 0 and 255. The default is 3 (DNSSEC).
- Other possible values for this argument are listed in
- RFC 2535 and its successors.
+ Sets the protocol value for the generated key, for use
+ with -T KEY. The protocol is a number between 0
+ and 255. The default is 3 (DNSSEC). Other possible values for
+ this argument are listed in RFC 2535 and its successors.
-
-
- Specifying any TSIG algorithm (HMAC-* or DH) with
- -a forces this option to KEY.
-
type
- Indicates the use of the key. type must be
- one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
- is AUTHCONF. AUTH refers to the ability to authenticate
- data, and CONF the ability to encrypt data.
-
level
- Sets the debugging level.
+ Indicates the use of the key, for use with -T
+ KEY. type must be one of AUTHCONF,
+ NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH
+ refers to the ability to authenticate data, and CONF the ability
+ to encrypt data.
level+ Sets the debugging level. +
+
- The .key file contains a DNS KEY record
- that
- can be inserted into a zone file (directly or with a $INCLUDE
- statement).
+ The .key file contains a DNSKEY or KEY record.
+ When a zone is being signed by named
+ or dnssec-signzone -S, DNSKEY
+ records are included automatically. In other cases,
+ the .key file can be inserted into a zone file
+ manually or with a $INCLUDE statement.
The .private file contains
@@ -487,22 +475,17 @@
fields. For obvious security reasons, this file does not have
general read permission.
- Both .key and .private
- files are generated for symmetric cryptography algorithms such as
- HMAC-MD5, even though the public and private key are equivalent.
-
- To generate an ECDSAP256SHA256 key for the domain
- example.com, the following command would be
- issued:
+ To generate an ECDSAP256SHA256 zone-signing key for the zone
+ example.com, issue the command:
dnssec-keygen -a ECDSAP256SHA256 -n ZONE example.com
+
+ dnssec-keygen -a ECDSAP256SHA256 example.com
The command would print a string of the form:
@@ -515,6 +498,12 @@
and
Kexample.com.+013+26160.private.
+ To generate a matching key-signing key, issue the command: +
+
+ dnssec-keygen -a ECDSAP256SHA256 -f KSK example.com
+
algorithm+ Specify a digest algorithm to use when converting the + zone's DNSKEY records to expected DS or DLV records. This + option can be repeated, so that multiple records are + checked for each DNSKEY record. +
+
+ The algorithm must be one of
+ SHA-1, SHA-256, or SHA-384. These values are case insensitive,
+ and the hyphen may be omitted. If no algorithm is specified,
+ the default is SHA-256.
+
filediff --git a/bin/python/dnssec-keymgr.8 b/bin/python/dnssec-keymgr.8 index 3f39fd408d..4a658dbe88 100644 --- a/bin/python/dnssec-keymgr.8 +++ b/bin/python/dnssec-keymgr.8 @@ -49,7 +49,7 @@ and \fBdnssec\-settime\fR\&. .PP DNSSEC policy can be read from a configuration file (default -/etc/dnssec\-policy\&.conf), from which the key parameters, publication and rollover schedule, and desired coverage duration for any given zone can be determined\&. This file may be used to define individual DNSSEC policies on a per\-zone basis, or to set a default policy used for all zones\&. +/etc/dnssec\-policy\&.conf), from which the key parameters, publication and rollover schedule, and desired coverage duration for any given zone can be determined\&. This file may be used to define individual DNSSEC policies on a per\-zone basis, or to set a "default" policy used for all zones\&. .PP When \fBdnssec\-keymgr\fR @@ -181,7 +181,8 @@ would be used for zones that had unusually high security needs\&. .sp -1 .IP \(bu 2.3 .\} -Algorithm policies: (\fBalgorithm\-policy \fR\fB\fIalgorithm\fR\fR\fB { \&.\&.\&. };\fR +\fIAlgorithm policies:\fR +(\fBalgorithm\-policy \fR\fB\fIalgorithm\fR\fR\fB { \&.\&.\&. };\fR ) override default per\-algorithm settings\&. For example, by default, RSASHA256 keys use 2048\-bit key sizes for both KSK and ZSK\&. This can be modified using \fBalgorithm\-policy\fR, and the new key sizes would then be used for any key of type RSASHA256\&. .RE @@ -194,59 +195,60 @@ Algorithm policies: (\fBalgorithm\-policy \fR\fB\fIalgorithm\fR\fR\fB { \&.\&.\& .sp -1 .IP \(bu 2.3 .\} -Zone policies: (\fBzone \fR\fB\fIname\fR\fR\fB { \&.\&.\&. };\fR +\fIZone policies:\fR +(\fBzone \fR\fB\fIname\fR\fR\fB { \&.\&.\&. };\fR ) set policy for a single zone by name\&. A zone policy can inherit a policy class by including a \fBpolicy\fR -option\&. Zone names beginning with digits (i\&.e\&., 0\-9) must be quoted\&. +option\&. Zone names beginning with digits (i\&.e\&., 0\-9) must be quoted\&. If a zone does not have its own policy then the "default" policy applies\&. .RE .PP Options that can be specified in policies: .PP -\fBalgorithm\fR +\fBalgorithm\fR \fIname\fR; .RS 4 The key algorithm\&. If no policy is defined, the default is RSASHA256\&. .RE .PP -\fBcoverage\fR +\fBcoverage\fR \fIduration\fR; .RS 4 The length of time to ensure that keys will be correct; no action will be taken to create new keys to be activated after this time\&. This can be represented as a number of seconds, or as a duration using human\-readable units (examples: "1y" or "6 months")\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is six months\&. .RE .PP -\fBdirectory\fR +\fBdirectory\fR \fIpath\fR; .RS 4 Specifies the directory in which keys should be stored\&. .RE .PP -\fBkey\-size\fR +\fBkey\-size\fR \fIkeytype\fR \fIsize\fR; .RS 4 -Specifies the number of bits to use in creating keys\&. Takes two arguments: keytype (eihter "zsk" or "ksk") and size\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is 2048 bits for RSA keys\&. +Specifies the number of bits to use in creating keys\&. The keytype is either "zsk" or "ksk"\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is 2048 bits for RSA keys\&. .RE .PP -\fBkeyttl\fR +\fBkeyttl\fR \fIduration\fR; .RS 4 The key TTL\&. If no policy is defined, the default is one hour\&. .RE .PP -\fBpost\-publish\fR +\fBpost\-publish\fR \fIkeytype\fR \fIduration\fR; .RS 4 How long after inactivation a key should be deleted from the zone\&. Note: If \fBroll\-period\fR -is not set, this value is ignored\&. Takes two arguments: keytype (eihter "zsk" or "ksk") and a duration\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. The default is one month\&. +is not set, this value is ignored\&. The keytype is either "zsk" or "ksk"\&. A default duration for this option can be set in algorithm policies as well as in policy classes or zone policies\&. The default is one month\&. .RE .PP -\fBpre\-publish\fR +\fBpre\-publish\fR \fIkeytype\fR \fIduration\fR; .RS 4 How long before activation a key should be published\&. Note: If \fBroll\-period\fR -is not set, this value is ignored\&. Takes two arguments: keytype (either "zsk" or "ksk") and a duration\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. The default is one month\&. +is not set, this value is ignored\&. The keytype is either "zsk" or "ksk"\&. A default duration for this option can be set in algorithm policies as well as in policy classes or zone policies\&. The default is one month\&. .RE .PP -\fBroll\-period\fR +\fBroll\-period\fR \fIkeytype\fR \fIduration\fR; .RS 4 -How frequently keys should be rolled over\&. Takes two arguments: keytype (eihter "zsk" or "ksk") and a duration\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is one year for ZSK\*(Aqs\&. KSK\*(Aqs do not roll over by default\&. +How frequently keys should be rolled over\&. The keytype is either "zsk" or "ksk"\&. A default duration for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is one year for ZSKs\&. KSKs do not roll over by default\&. .RE .PP -\fBstandby\fR +\fBstandby\fR \fIkeytype\fR \fInumber\fR; .RS 4 Not yet implemented\&. .RE diff --git a/bin/python/dnssec-keymgr.html b/bin/python/dnssec-keymgr.html index b9a0a0beb1..564dab7b19 100644 --- a/bin/python/dnssec-keymgr.html +++ b/bin/python/dnssec-keymgr.html @@ -57,11 +57,12 @@
DNSSEC policy can be read from a configuration file (default
- /etc/dnssec-policy.conf), from which the key
- parameters, publication and rollover schedule, and desired
- coverage duration for any given zone can be determined. This
+ /etc/dnssec-policy.conf), from which the
+ key parameters, publication and rollover schedule, and desired
+ coverage duration for any given zone can be determined. This
file may be used to define individual DNSSEC policies on a
- per-zone basis, or to set a default policy used for all zones.
+ per-zone basis, or to set a "default" policy
+ used for all zones.
When dnssec-keymgr runs, it examines the DNSSEC @@ -210,7 +211,7 @@
- Algorithm policies:
+ Algorithm policies:
(algorithm-policy )
override default per-algorithm settings. For example, by default,
RSASHA256 keys use 2048-bit key sizes for both KSK and ZSK. This
@@ -220,11 +221,13 @@
algorithm { ... };
- Zone policies:
+ Zone policies:
(zone )
set policy for a single zone by name. A zone policy can inherit
a policy class by including a name { ... };policy option.
Zone names beginning with digits (i.e., 0-9) must be quoted.
+ If a zone does not have its own policy then the
+ "default" policy applies.
name;The key algorithm. If no policy is defined, the default is RSASHA256.
duration;The length of time to ensure that keys will be correct; no action will be taken to create new keys to be activated after this time. - This can be represented as a number of seconds, or as a duration using - human-readable units (examples: "1y" or "6 months"). + This can be represented as a number of seconds, or as a duration + using human-readable units (examples: "1y" or "6 months"). A default value for this option can be set in algorithm policies as well as in policy classes or zone policies. If no policy is configured, the default is six months.
path;Specifies the directory in which keys should be stored.
keytype
+ size;Specifies the number of bits to use in creating keys. - Takes two arguments: keytype (eihter "zsk" or "ksk") and size. + The keytype is either "zsk" or "ksk". A default value for this option can be set in algorithm policies as well as in policy classes or zone policies. If no policy is configured, the default is 2048 bits for RSA keys.
duration;The key TTL. If no policy is defined, the default is one hour.
keytype
+ duration;
How long after inactivation a key should be deleted from the zone.
Note: If roll-period is not set, this value is
- ignored. Takes two arguments: keytype (eihter "zsk" or "ksk") and a
- duration. A default value for this option can be set in algorithm
+ ignored. The keytype is either "zsk" or "ksk".
+ A default duration for this option can be set in algorithm
policies as well as in policy classes or zone policies. The default
is one month.
keytype
+ duration;
How long before activation a key should be published. Note: If
roll-period is not set, this value is ignored.
- Takes two arguments: keytype (either "zsk" or "ksk") and a duration.
- A default value for this option can be set in algorithm policies
+ The keytype is either "zsk" or "ksk".
+ A default duration for this option can be set in algorithm policies
as well as in policy classes or zone policies. The default is
one month.
keytype
+ duration;How frequently keys should be rolled over. - Takes two arguments: keytype (eihter "zsk" or "ksk") and a duration. - A default value for this option can be set in algorithm policies + The keytype is either "zsk" or "ksk". + A default duration for this option can be set in algorithm policies as well as in policy classes or zone policies. If no policy is - configured, the default is one year for ZSK's. KSK's do not + configured, the default is one year for ZSKs. KSKs do not roll over by default.
keytype
+ number;Not yet implemented. diff --git a/bin/rndc/rndc.8 b/bin/rndc/rndc.8 index daff682c65..0ce4c203a0 100644 --- a/bin/rndc/rndc.8 +++ b/bin/rndc/rndc.8 @@ -702,14 +702,7 @@ in each view\&. The list both statically configured keys and dynamic TKEY\-negot .PP \fBvalidation ( on | off | status ) \fR\fB[\fIview \&.\&.\&.\fR]\fR\fB \fR .RS 4 -Enable, disable, or check the current status of DNSSEC validation\&. By default, validation is enabled\&. (Note that -\fBdnssec\-enable\fR -must also be -\fByes\fR -(the default value) for signatures to be returned along with validated data\&. If validation is enabled while -\fBdnssec\-enable\fR -is set to -\fBno\fR, the server will validate internally, but will not supply clients with the necessary records to allow validity to be confirmed\&.) +Enable, disable, or check the current status of DNSSEC validation\&. By default, validation is enabled\&. .RE .PP \fBzonestatus \fR\fB\fIzone\fR\fR\fB \fR\fB[\fIclass\fR [\fIview\fR]]\fR diff --git a/bin/rndc/rndc.html b/bin/rndc/rndc.html index 5a2276759e..8b9df50b16 100644 --- a/bin/rndc/rndc.html +++ b/bin/rndc/rndc.html @@ -914,13 +914,6 @@
Enable, disable, or check the current status of
DNSSEC validation. By default, validation is enabled.
- (Note that dnssec-enable must also be
- yes (the default value) for signatures
- to be returned along with validated data. If validation is
- enabled while dnssec-enable is set to
- no, the server will validate internally,
- but will not supply clients with the necessary records to allow
- validity to be confirmed.)
zonestatus zone [class [view]]This version of the manual corresponds to BIND version 9.13.
+This version of the manual corresponds to BIND version 9.15.
BIND 9.13.6 (Development Release)
+BIND 9.15.0 (Development Release)