doc rebuild
This commit is contained in:
Tinderbox User
committed by
Evan Hunt
Evan Hunt
parent
4b1b4e1f78
commit
4738d62e1c
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2012-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2012-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -83,5 +83,5 @@ binary\&. Used for testing\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2012-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2012-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2012-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2012-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2013-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -152,5 +152,5 @@ binary\&. Used for testing\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2013-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2013-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2016-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2016-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -49,7 +49,7 @@ and
|
||||
\fBdnssec\-settime\fR\&.
|
||||
.PP
|
||||
DNSSEC policy can be read from a configuration file (default
|
||||
/etc/dnssec\-policy\&.conf), from which the key parameters, publication and rollover schedule, and desired coverage duration for any given zone can be determined\&. This file may be used to define individual DNSSEC policies on a per\-zone basis, or to set a default policy used for all zones\&.
|
||||
/etc/dnssec\-policy\&.conf), from which the key parameters, publication and rollover schedule, and desired coverage duration for any given zone can be determined\&. This file may be used to define individual DNSSEC policies on a per\-zone basis, or to set a "default" policy used for all zones\&.
|
||||
.PP
|
||||
When
|
||||
\fBdnssec\-keymgr\fR
|
||||
@@ -69,6 +69,10 @@ will search the key directory (either the current working directory or the direc
|
||||
\fB\-K\fR
|
||||
option), and check the keys for all the zones represented in the directory\&.
|
||||
.PP
|
||||
Key times that are in the past will not be updated unless the
|
||||
\fB\-f\fR
|
||||
is used (see below)\&. Key inactivation and deletion times that are less than five minutes in the future will be delayed by five minutes\&.
|
||||
.PP
|
||||
It is expected that this tool will be run automatically and unattended (for example, by
|
||||
\fBcron\fR)\&.
|
||||
.SH "OPTIONS"
|
||||
@@ -186,7 +190,8 @@ would be used for zones that had unusually high security needs\&.
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
Algorithm policies: (\fBalgorithm\-policy \fR\fB\fIalgorithm\fR\fR\fB { \&.\&.\&. };\fR
|
||||
\fIAlgorithm policies:\fR
|
||||
(\fBalgorithm\-policy \fR\fB\fIalgorithm\fR\fR\fB { \&.\&.\&. };\fR
|
||||
) override default per\-algorithm settings\&. For example, by default, RSASHA256 keys use 2048\-bit key sizes for both KSK and ZSK\&. This can be modified using
|
||||
\fBalgorithm\-policy\fR, and the new key sizes would then be used for any key of type RSASHA256\&.
|
||||
.RE
|
||||
@@ -199,59 +204,60 @@ Algorithm policies: (\fBalgorithm\-policy \fR\fB\fIalgorithm\fR\fR\fB { \&.\&.\&
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
Zone policies: (\fBzone \fR\fB\fIname\fR\fR\fB { \&.\&.\&. };\fR
|
||||
\fIZone policies:\fR
|
||||
(\fBzone \fR\fB\fIname\fR\fR\fB { \&.\&.\&. };\fR
|
||||
) set policy for a single zone by name\&. A zone policy can inherit a policy class by including a
|
||||
\fBpolicy\fR
|
||||
option\&. Zone names beginning with digits (i\&.e\&., 0\-9) must be quoted\&.
|
||||
option\&. Zone names beginning with digits (i\&.e\&., 0\-9) must be quoted\&. If a zone does not have its own policy then the "default" policy applies\&.
|
||||
.RE
|
||||
.PP
|
||||
Options that can be specified in policies:
|
||||
.PP
|
||||
\fBalgorithm\fR
|
||||
\fBalgorithm\fR \fIname\fR;
|
||||
.RS 4
|
||||
The key algorithm\&. If no policy is defined, the default is RSASHA256\&.
|
||||
.RE
|
||||
.PP
|
||||
\fBcoverage\fR
|
||||
\fBcoverage\fR \fIduration\fR;
|
||||
.RS 4
|
||||
The length of time to ensure that keys will be correct; no action will be taken to create new keys to be activated after this time\&. This can be represented as a number of seconds, or as a duration using human\-readable units (examples: "1y" or "6 months")\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is six months\&.
|
||||
.RE
|
||||
.PP
|
||||
\fBdirectory\fR
|
||||
\fBdirectory\fR \fIpath\fR;
|
||||
.RS 4
|
||||
Specifies the directory in which keys should be stored\&.
|
||||
.RE
|
||||
.PP
|
||||
\fBkey\-size\fR
|
||||
\fBkey\-size\fR \fIkeytype\fR \fIsize\fR;
|
||||
.RS 4
|
||||
Specifies the number of bits to use in creating keys\&. Takes two arguments: keytype (eihter "zsk" or "ksk") and size\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is 1024 bits for DSA keys and 2048 for RSA\&.
|
||||
Specifies the number of bits to use in creating keys\&. The keytype is either "zsk" or "ksk"\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is 1024 bits for DSA keys and 2048 for RSA\&.
|
||||
.RE
|
||||
.PP
|
||||
\fBkeyttl\fR
|
||||
\fBkeyttl\fR \fIduration\fR;
|
||||
.RS 4
|
||||
The key TTL\&. If no policy is defined, the default is one hour\&.
|
||||
.RE
|
||||
.PP
|
||||
\fBpost\-publish\fR
|
||||
\fBpost\-publish\fR \fIkeytype\fR \fIduration\fR;
|
||||
.RS 4
|
||||
How long after inactivation a key should be deleted from the zone\&. Note: If
|
||||
\fBroll\-period\fR
|
||||
is not set, this value is ignored\&. Takes two arguments: keytype (eihter "zsk" or "ksk") and a duration\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. The default is one month\&.
|
||||
is not set, this value is ignored\&. The keytype is either "zsk" or "ksk"\&. A default duration for this option can be set in algorithm policies as well as in policy classes or zone policies\&. The default is one month\&.
|
||||
.RE
|
||||
.PP
|
||||
\fBpre\-publish\fR
|
||||
\fBpre\-publish\fR \fIkeytype\fR \fIduration\fR;
|
||||
.RS 4
|
||||
How long before activation a key should be published\&. Note: If
|
||||
\fBroll\-period\fR
|
||||
is not set, this value is ignored\&. Takes two arguments: keytype (either "zsk" or "ksk") and a duration\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. The default is one month\&.
|
||||
is not set, this value is ignored\&. The keytype is either "zsk" or "ksk"\&. A default duration for this option can be set in algorithm policies as well as in policy classes or zone policies\&. The default is one month\&.
|
||||
.RE
|
||||
.PP
|
||||
\fBroll\-period\fR
|
||||
\fBroll\-period\fR \fIkeytype\fR \fIduration\fR;
|
||||
.RS 4
|
||||
How frequently keys should be rolled over\&. Takes two arguments: keytype (eihter "zsk" or "ksk") and a duration\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is one year for ZSK\*(Aqs\&. KSK\*(Aqs do not roll over by default\&.
|
||||
How frequently keys should be rolled over\&. The keytype is either "zsk" or "ksk"\&. A default duration for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is one year for ZSKs\&. KSKs do not roll over by default\&.
|
||||
.RE
|
||||
.PP
|
||||
\fBstandby\fR
|
||||
\fBstandby\fR \fIkeytype\fR \fInumber\fR;
|
||||
.RS 4
|
||||
Not yet implemented\&.
|
||||
.RE
|
||||
@@ -297,5 +303,5 @@ Allow configuration of standby keys and use of the REVOKE bit, for keys that use
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2016-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2016-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2016-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2016-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -58,11 +58,12 @@
|
||||
</p>
|
||||
<p>
|
||||
DNSSEC policy can be read from a configuration file (default
|
||||
<code class="filename">/etc/dnssec-policy.conf</code>), from which the key
|
||||
parameters, publication and rollover schedule, and desired
|
||||
coverage duration for any given zone can be determined. This
|
||||
<code class="filename">/etc/dnssec-policy.conf</code>), from which the
|
||||
key parameters, publication and rollover schedule, and desired
|
||||
coverage duration for any given zone can be determined. This
|
||||
file may be used to define individual DNSSEC policies on a
|
||||
per-zone basis, or to set a default policy used for all zones.
|
||||
per-zone basis, or to set a "<code class="literal">default</code>" policy
|
||||
used for all zones.
|
||||
</p>
|
||||
<p>
|
||||
When <span class="command"><strong>dnssec-keymgr</strong></span> runs, it examines the DNSSEC
|
||||
@@ -92,6 +93,12 @@
|
||||
set by the <code class="option">-K</code> option), and check the keys for
|
||||
all the zones represented in the directory.
|
||||
</p>
|
||||
<p>
|
||||
Key times that are in the past will not be updated unless
|
||||
the <code class="option">-f</code> is used (see below). Key inactivation
|
||||
and deletion times that are less than five minutes in the future
|
||||
will be delayed by five minutes.
|
||||
</p>
|
||||
<p>
|
||||
It is expected that this tool will be run automatically and
|
||||
unattended (for example, by <span class="command"><strong>cron</strong></span>).
|
||||
@@ -214,7 +221,7 @@
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
Algorithm policies:
|
||||
<span class="emphasis"><em>Algorithm policies:</em></span>
|
||||
(<code class="option">algorithm-policy <em class="replaceable"><code>algorithm</code></em> { ... };</code> )
|
||||
override default per-algorithm settings. For example, by default,
|
||||
RSASHA256 keys use 2048-bit key sizes for both KSK and ZSK. This
|
||||
@@ -224,11 +231,13 @@
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
Zone policies:
|
||||
<span class="emphasis"><em>Zone policies:</em></span>
|
||||
(<code class="option">zone <em class="replaceable"><code>name</code></em> { ... };</code> )
|
||||
set policy for a single zone by name. A zone policy can inherit
|
||||
a policy class by including a <code class="option">policy</code> option.
|
||||
Zone names beginning with digits (i.e., 0-9) must be quoted.
|
||||
If a zone does not have its own policy then the
|
||||
"<code class="literal">default</code>" policy applies.
|
||||
</p>
|
||||
</li>
|
||||
</ul></div>
|
||||
@@ -236,82 +245,91 @@
|
||||
Options that can be specified in policies:
|
||||
</p>
|
||||
<div class="variablelist"><dl class="variablelist">
|
||||
<dt><span class="term"><span class="command"><strong>algorithm</strong></span></span></dt>
|
||||
<dt><span class="term"><span class="command"><strong>algorithm</strong></span>
|
||||
<em class="replaceable"><code>name</code></em><code class="literal">;</code></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
The key algorithm. If no policy is defined, the default is
|
||||
RSASHA256.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term"><span class="command"><strong>coverage</strong></span></span></dt>
|
||||
<dt><span class="term"><span class="command"><strong>coverage</strong></span>
|
||||
<em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
The length of time to ensure that keys will be correct; no action
|
||||
will be taken to create new keys to be activated after this time.
|
||||
This can be represented as a number of seconds, or as a duration using
|
||||
human-readable units (examples: "1y" or "6 months").
|
||||
This can be represented as a number of seconds, or as a duration
|
||||
using human-readable units (examples: "1y" or "6 months").
|
||||
A default value for this option can be set in algorithm policies
|
||||
as well as in policy classes or zone policies.
|
||||
If no policy is configured, the default is six months.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term"><span class="command"><strong>directory</strong></span></span></dt>
|
||||
<dt><span class="term"><span class="command"><strong>directory</strong></span>
|
||||
<em class="replaceable"><code>path</code></em><code class="literal">;</code></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Specifies the directory in which keys should be stored.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term"><span class="command"><strong>key-size</strong></span></span></dt>
|
||||
<dt><span class="term"><span class="command"><strong>key-size</strong></span> <em class="replaceable"><code>keytype</code></em>
|
||||
<em class="replaceable"><code>size</code></em><code class="literal">;</code></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Specifies the number of bits to use in creating keys.
|
||||
Takes two arguments: keytype (eihter "zsk" or "ksk") and size.
|
||||
The keytype is either "zsk" or "ksk".
|
||||
A default value for this option can be set in algorithm policies
|
||||
as well as in policy classes or zone policies. If no policy is
|
||||
configured, the default is 1024 bits for DSA keys and 2048 for
|
||||
RSA.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term"><span class="command"><strong>keyttl</strong></span></span></dt>
|
||||
<dt><span class="term"><span class="command"><strong>keyttl</strong></span>
|
||||
<em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
The key TTL. If no policy is defined, the default is one hour.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term"><span class="command"><strong>post-publish</strong></span></span></dt>
|
||||
<dt><span class="term"><span class="command"><strong>post-publish</strong></span> <em class="replaceable"><code>keytype</code></em>
|
||||
<em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
How long after inactivation a key should be deleted from the zone.
|
||||
Note: If <code class="option">roll-period</code> is not set, this value is
|
||||
ignored. Takes two arguments: keytype (eihter "zsk" or "ksk") and a
|
||||
duration. A default value for this option can be set in algorithm
|
||||
ignored. The keytype is either "zsk" or "ksk".
|
||||
A default duration for this option can be set in algorithm
|
||||
policies as well as in policy classes or zone policies. The default
|
||||
is one month.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term"><span class="command"><strong>pre-publish</strong></span></span></dt>
|
||||
<dt><span class="term"><span class="command"><strong>pre-publish</strong></span> <em class="replaceable"><code>keytype</code></em>
|
||||
<em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
How long before activation a key should be published. Note: If
|
||||
<code class="option">roll-period</code> is not set, this value is ignored.
|
||||
Takes two arguments: keytype (either "zsk" or "ksk") and a duration.
|
||||
A default value for this option can be set in algorithm policies
|
||||
The keytype is either "zsk" or "ksk".
|
||||
A default duration for this option can be set in algorithm policies
|
||||
as well as in policy classes or zone policies. The default is
|
||||
one month.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term"><span class="command"><strong>roll-period</strong></span></span></dt>
|
||||
<dt><span class="term"><span class="command"><strong>roll-period</strong></span> <em class="replaceable"><code>keytype</code></em>
|
||||
<em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
How frequently keys should be rolled over.
|
||||
Takes two arguments: keytype (eihter "zsk" or "ksk") and a duration.
|
||||
A default value for this option can be set in algorithm policies
|
||||
The keytype is either "zsk" or "ksk".
|
||||
A default duration for this option can be set in algorithm policies
|
||||
as well as in policy classes or zone policies. If no policy is
|
||||
configured, the default is one year for ZSK's. KSK's do not
|
||||
configured, the default is one year for ZSKs. KSKs do not
|
||||
roll over by default.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term"><span class="command"><strong>standby</strong></span></span></dt>
|
||||
<dt><span class="term"><span class="command"><strong>standby</strong></span> <em class="replaceable"><code>keytype</code></em>
|
||||
<em class="replaceable"><code>number</code></em><code class="literal">;</code></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Not yet implemented.
|
||||
|
||||
Reference in New Issue
Block a user