first draft of man pages on dnssec tools
This commit is contained in:
Jim Reid
157
bin/dnssec/dnssec-signkey.8
Normal file
157
bin/dnssec/dnssec-signkey.8
Normal file
@@ -0,0 +1,157 @@
|
||||
.\"
|
||||
.\" Copyright (C) 2000 Internet Software Consortium.
|
||||
.\"
|
||||
.\" Permission to use, copy, modify, and distribute this document for any
|
||||
.\" purpose with or without fee is hereby granted, provided that the above
|
||||
.\" copyright notice and this permission notice appear in all copies.
|
||||
.\"
|
||||
.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
|
||||
.\" DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
|
||||
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
|
||||
.\" INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
|
||||
.\" FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
|
||||
.\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
|
||||
.\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
.\"
|
||||
.\" $Id: dnssec-signkey.8,v 1.1 2000/06/27 21:50:27 jim Exp $
|
||||
.\"
|
||||
.Dd Jun 30, 2000
|
||||
.Dt DNSSEC-SIGNKEY 8
|
||||
.Os BIND9 9
|
||||
.ds vT BIND9 Programmer's Manual
|
||||
.Sh NAME
|
||||
.Nm dnssec-signkey
|
||||
.Nd DNSSEC keyset signing tool
|
||||
.Sh SYNOPSIS
|
||||
.Nm dnssec-signkey
|
||||
.Op Fl h
|
||||
.Op Fl p
|
||||
.Op Fl r Ar randomdev
|
||||
.Op Fl v Ar level
|
||||
.Ar keyset
|
||||
.Ar keyfile ...
|
||||
.Sh DESCRIPTION
|
||||
.Nm dnssec-signkey
|
||||
is used to sign a key set for a child zone.
|
||||
Typically this would be provided by a
|
||||
.Ar .keyset
|
||||
file generated by
|
||||
.Xr dnssec-makekeyset 8 .
|
||||
This provides a mechanism for a DNSSEC-aware zone to sign the keys of
|
||||
any DNSSEC-aware child zones.
|
||||
The child zone's key set gets signed with the zone keys for its parent
|
||||
zone.
|
||||
.Ar keyset
|
||||
will be the pathname of the child zone's
|
||||
.Ar .keyset
|
||||
file.
|
||||
Each
|
||||
.Ar keyfile
|
||||
argument will be a key identification string as reported by
|
||||
.Xr dnssec-keygen 8
|
||||
for the parent zone.
|
||||
This allows the child's keys to be signed by more than 1 parent zone
|
||||
key if these exist.
|
||||
.Pp
|
||||
The
|
||||
.Ar p
|
||||
option instructs
|
||||
.Nm dnssec-signkey
|
||||
to use pseudo-random data when signing the keys which is faster, but
|
||||
less secure, than using genuinely random data for signing.
|
||||
This option may be useful when there are many child zone keysets to
|
||||
sign and CPU resources are limited.
|
||||
It could also be used for short-lived keys and signatures that don't
|
||||
require strengthening against cryptanalysis: for instance when the key
|
||||
will be discarded long before it could be compromised.
|
||||
.Pp
|
||||
An alternate file for obtaining random data can be used with the
|
||||
.Ar r
|
||||
option.
|
||||
.Ar filename
|
||||
is the name of the file to use.
|
||||
If no
|
||||
.Ar r
|
||||
option is used and the default file for random data
|
||||
.Pa /dev/random
|
||||
does not exist,
|
||||
.Nm dnssec-signkey
|
||||
will prompt for input from the keyboard.
|
||||
The time between keystrokes will be measured and used to derive random
|
||||
data.
|
||||
.Pp
|
||||
The
|
||||
.Ar v
|
||||
option can be used to make
|
||||
.Nm dnssec-signkey
|
||||
more verbose.
|
||||
As the debugging/tracing level
|
||||
.Ar level
|
||||
increases,
|
||||
.Nm dnssec-signkey
|
||||
generates increasingly detailed reports about what it is doing.
|
||||
The default level is zero.
|
||||
.Pp
|
||||
An option of
|
||||
.Ar h
|
||||
makes
|
||||
.Nm dnssec-signkey
|
||||
print a short summary of its command line options
|
||||
and arguments.
|
||||
.Pp
|
||||
When
|
||||
.Nm dnssec-signkey
|
||||
completes successfully, it generates a file called
|
||||
.Ar nnnn.signedkey
|
||||
containing the signed keys for child zone
|
||||
.Ar nnnn .
|
||||
The keys from the
|
||||
.Ar keyset
|
||||
file will have been signed by the parent zone's key or keys which were
|
||||
supplied as
|
||||
.Ar keyfile
|
||||
arguments.
|
||||
This file should be sent to the DNS administrator of the child zone.
|
||||
They arrange for its contents to be incorporated into the zone file
|
||||
when it next gets signed with
|
||||
.Xr dnssec-signzone 8 .
|
||||
A copy of the generated
|
||||
.Ar signedkey
|
||||
file should be kept by the parent zone's DNS administrator.
|
||||
.Sh EXAMPLE
|
||||
The DNS administrator for a DNSSEC-aware
|
||||
.Dv .com
|
||||
zone would use the following command to make
|
||||
.Nm dnssec-signkey
|
||||
sign the
|
||||
.Ar .keyset
|
||||
file for
|
||||
.Dv example.com
|
||||
created in the example shown in the man page for
|
||||
.Nm dnssec-makekeyset :
|
||||
.Dl # dnssec-signkey example.com.keyset Kcom.+003+51944
|
||||
.Pp
|
||||
where
|
||||
.Dv Kcom.+003+51944
|
||||
was a key file identifier that was produced when
|
||||
.Nm dnssec-keygen
|
||||
generated a key for the
|
||||
.Dv .com
|
||||
zone.
|
||||
.Pp
|
||||
.Nm dnssec-signkey
|
||||
will produce a file called
|
||||
.Dv example.com.signedkey
|
||||
which has the keys for
|
||||
.Dv example.com
|
||||
signed by the
|
||||
.Dv com
|
||||
zone's zone key.
|
||||
.Sh FILES
|
||||
.Pa /dev/random
|
||||
.Sh SEE ALSO
|
||||
.Xr RFC2065,
|
||||
.Xr dnssec-keygen 8 ,
|
||||
.Xr dnssec-makekeyset 8 ,
|
||||
.Xr dnssec-signzone 8 .
|
||||
Reference in New Issue
Block a user