ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

This commit was manufactured by cvs2git to create branch 'v9_0'.

Browse Source
This commit is contained in:
cvs2git
2000-07-26 22:41:29 +00:00
parent a44b1b277b 371827c1e0
commit 5fd4b1c60c
9 changed files with 1676 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/man/bin/lwresd.8
+166
View File
@@ -0,0 +1,166 @@
.\"
.\" Copyright (C) 2000 Internet Software Consortium.
.\"
.\" Permission to use, copy, modify, and distribute this document for any
.\" purpose with or without fee is hereby granted, provided that the above
.\" copyright notice and this permission notice appear in all copies.
.\"
.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
.\" DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
.\" INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
.\" FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
.\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
.\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\"
.\" $Id: lwresd.8,v 1.4 2000/07/17 17:49:25 gson Exp $
.\"
.Dd Jun 30, 2000
.Dt LWRESD 8
.Os BIND9 9
.ds vT BIND 9 Programmer's Manual
.Sh NAME
.Nm lwresd
.Nd lightweight resolver daemon
.Sh SYNOPSIS
.Nm lwresd
.Op Fl C Ar config-file
.Op Fl d Ar debuglevel
.Op Fl f g s
.Op Fl i Ar pid-file
.Op Fl n Ar #cpus
.Op Fl P Ar query-port#
.Op Fl p Ar port#
.Op Fl t Ar directory
.Op Fl u Ar user-id
.Sh DESCRIPTION
.Nm lwresd
is the daemon providing name lookup services to clients that use
the BIND 9 lightweight resolver library.
It is essentially a stripped-down, caching-only name server that
answers queries using the BIND 9 lightweight resolver protocol
rather than the DNS protocol.
.Pp
.Nm lwresd
listens for resolver queries on a UDP port on the IPv4 loopback
interface, 127.0.0.1.
This means that
.Nm lwresd
can only be used by processes running on the local machine.
By default UDP port number 921 is used for lightweight resolver
requests and responses.
.Pp
Incoming lightweight resolver requests are decoded by
.Nm lwresd
which then resolves them using the DNS protocol.
When the DNS lookup completes,
.Nm lwresd
encodes the answers from the name servers in the lightweight
resolver format and returns them to the client that made the original
request.
.Pp
If
.Pa /etc/resolv.conf
contains any
.Sy nameserver
entries,
.Nm lwresd
sends recursive DNS queries to those servers. This
is similar to the use of forwarders in a chaching name
server. If no
.Sy nameserver
entries are present, or if forwarding fails,
.Nm lwresd
resolves the queries autonomously starting at the
root name servers, using a compiled-in list of root
servers hints.
.Pp
The options to
.Nm lwresd
are as follows:
.Bl -tag -width Ds
.It Fl C
use
.Ar config-file
as the configuration file instead of the default,
.Pa /etc/resolv.conf .
.It Fl d
set the daemon's debug level to
.Ar debuglevel .
Debugging traces from
.Nm lwresd
become more verbose as the debug level increases.
.It Fl f
run
.Nm lwresd
in the foreground.
.It Fl g
run
.Nm lwresd
in the foreground and force all logging to
.Dv stderr .
.It Fl i
write the daemon's process id to
.Ar pid-file
instead of the default pathname.
.It Fl n
create
.Ar #cpus
worker threads to take advantage of multiple CPUs.
If no option is given,
.Nm lwresd
will try to determine the number of CPUs present and create
one thread per CPU. If
.Nm lwresd
is unable to determine the number of CPUs, a single worker thread
is created.
.It Fl P
send DNS lookups to port number
.Ar query-port#
when querying name servers.
This provides a way of testing the lightweight resolver daemon with a
name server that listens for queries on a non-standard port number.
.It Fl p
listen for lightweight resolver queries on the loopback interface
using UDP port
.Ar port#
instead of the default port number, 921.
.It Fl s
write memory usage statistics to
.Dv stdout
on exit.
This option is only of interest to BIND 9 developers and may be
removed or changed in a future release.
.It Fl t
tells
.Nm lwresd
to chroot() to
.Ar directory
immediately after reading its configuration file.
.It Fl u
run
.Nm lwresd
as
.Ar user-id ,
which is a user name or numeric id that must be present in the
password file.
The lightweight resolver daemon will change its user-id after it has
carried out any privileged operations, such as writing the process-id
file or binding a socket to a privileged port (typically any port
less than 1024).
.El
.Sh FILES
.Bl -tag -width /var/run/lwresd.pid -compact
.It Pa /etc/resolv.conf
default configuration file
.It Pa /var/run/lwresd.pid
default process-id file
.El
.Sh SEE ALSO
.Xr named 8 ,
.Xr lwres 3 .
.Sh NOTES
.Nm lwresd
is a daemon for lightweight resolvers, not a lightweight daemon
for resolvers.
doc/man/bin/named.8
+171
View File
@@ -0,0 +1,171 @@
.\"
.\" Copyright (C) 2000 Internet Software Consortium.
.\"
.\" Permission to use, copy, modify, and distribute this document for any
.\" purpose with or without fee is hereby granted, provided that the above
.\" copyright notice and this permission notice appear in all copies.
.\"
.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
.\" DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
.\" INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
.\" FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
.\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
.\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\"
.\" $Id: named.8,v 1.3 2000/07/12 02:07:32 gson Exp $
.\"
.Dd Jun 30, 2000
.Dt NAMED 8
.Os BIND9 9
.ds vT BIND9 Programmer's Manual
.Sh NAME
.Nm named
.Nd Internet domain name server (DNS)
.Sh SYNOPSIS
.Nm named
.Op Fl c Ar config-file
.Op Fl d Ar debuglevel
.Op Fl f g s
.Op Fl n Ar #cpus
.Op Fl p Ar port#
.Op Fl t Ar directory
.Op Fl u Ar user-id
.Op Fl x Ar cache-file
.Sh DESCRIPTION
.Nm named
is the ISC implementation of an Internet domain name server.
See RFCs 1033, 1034, and 1035 for more information on the Internet
domain name system.
For historical reasons, the ISC's DNS software is known as BIND -
Berkeley Internet Name Daemon - because it was originally
supplied with BSD
.Ux
releases.
.Pp
Without any arguments,
.Nm named
will read the default configuration file
.Pa /etc/named.conf ,
read any initial data, and listen for queries.
It is also possible to use the BIND9 name server
as a lightweight resolver server
.Nm lwresd .
However when operating as a lightweight resolver server,
.Nm named
is functionally and logically distinct from a
conventional name server.
More information can be found in
.Xr lwresd 8 .
.Pp
Although some command-line options can be used with
.Nm named ,
the name server's behaviour is mainly controlled by its configuration file,
.Pa /etc/named.conf .
Refer to the BIND9 Administrator Reference Manual for further details.
.Pp
The options to
.Nm named
are as follows:
.Bl -tag -width Ds
.It Fl c
use
.Ar config-file
as the configuration file instead of the default,
.Pa /etc/named.conf .
.It Fl d
set the daemon's debug level to
.Ar debuglevel .
Debugging traces from
.Nm named
become more verbose as the debug level increases.
.It Fl f
run
.Nm named
in the foreground.
.It Fl g
run
.Nm named
in the foreground and force all logging to
.Dv stderr .
.It Fl n
create
.Ar #cpus
worker threads to take advantage of multiple CPUs.
If no option is given,
.Nm named
will try to determine the number of CPUs present and create
one thread per CPU. If
.Nm named
is unable to determine the number of CPUs, a single worker thread
is created.
.It Fl p
listen for queries on port
.Ar port#
instead of the default port number, 53.
.It Fl s
write memory usage statistics to
.Dv stdout
on exit.
This option is mainly of interest
to BIND9 developers and may be removed or changed in a future release.
.It Fl t
tells
.Nm named
to chroot() to
.Ar directory
immediately after reading its config file.
.It Fl u
run
.Nm named
as UID
.Ar user-id .
.Nm named
will change its UID after it has
carried out any privileged operations, such as
creating sockets that listen on privileged ports.
.It Fl x
load data from
.Ar cache-file .
into the cache of the default view.
This option must not be used.
It is only of interest
to BIND9 developers and may be removed or changed in a future release.
.El
.Sh SIGNALS
In routine operation, signals should not be used to \*qcontrol\*q the
name server.
.Nm rndc
should be used instead.
Sending the name server a
.Dv SIGHUP
signal forces a reload of the server.
A
.Dv SIGINT
or
.Dv SIGTERM
signal can be used to gracefully shut down the server.
Sending any other signals to the name server
will have an undefined outcome.
.\".Sh CONFIGURATION FILE FORMAT
.\".Nm named 's
.\"configuration file is too complex to describe in detail here.
.\"A complete description is provided in the BIND9 Administrator
.\"Reference Manual.
.Sh FILES
.Bl -tag -width /var/run/named.pid -compact
.It Pa /etc/named.conf
default configuration file
.It Pa /var/run/named.pid
default process-id file
.El
.Sh SEE ALSO
.Xr RFC1033 ,
.Xr RFC1034 ,
.Xr RFC1035 ,
.Xr named.conf 5 ,
.Xr zonefile 5 ,
.Xr rndc 8 ,
.Xr lwresd 8 ,
BIND9 Administrator Reference Manual, June 2000.
doc/man/bin/rndc.8
+166
View File
@@ -0,0 +1,166 @@
.\" Copyright (C) @YEARS@ Internet Software Consortium.
.\"
.\" Permission to use, copy, modify, and distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
.\" copyright notice and this permission notice appear in all copies.
.\"
.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
.\" ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
.\" OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
.\" CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
.\" DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
.\" PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
.\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
.\" SOFTWARE.
.\"
.\" $Id: rndc.8,v 1.6 2000/07/12 16:48:19 gson Exp $
.\"
.Dd Jun 30, 2000
.Dt RDNC 8
.Os BIND9 9
.ds vT BIND9 Programmer's Manual
.Sh NAME
.Nm rdnc
.Nd name server control utility
.Sh SYNOPSIS
.Nm rndc
.Op Fl c Ar config-file
.Op Fl M
.Op Fl m
.Op Fl p Ar port#
.Op Fl s Ar server
.Op Fl v
.Op Fl y Ar key_id
.Ar command ....
.Sh DESCRIPTION
This command allows the system administrator to control the operation
of a name server.
It supersedes the
.Xr ndc 8
utility that was provided in old BIND releases.
If
.Nm rndc
is invoked with no command line options or arguments, it
prints a short summary of the supported commands and the available
options and their arguments.
.Pp
.Nm rndc
communicates with the name server over a TCP connection,
sending commands authenticated with digital signatures.
In the current versions of
.Nm rndc
and
.Xr named 8
the only supported encryption algorithm is HMAC-MD5, which uses a
shared secret on each end of the connection.
This provides TSIG-style authentication for the command request
and the name server's response.
All commands sent over the channel
must be signed by a key_id known to the server.
.Pp
.Nm rndc
reads its default configuration file,
.Pa /etc/rndc.conf
to determine how to contact the name server and decide what algorithm
and keys is should use.
The
.Fl c
option can be used to specify an alternate configuration file.
.Pp
.Ar server
is the name or address of the server which matches a
.Dv server{}
statement in the configuration file for
.Nm rndc .
If no
.Ar server
is supplied on the command line, the host named by the
.Dv default-server
clause in the
.Dv options{}
statement of the configuration file will be used.
.Pp
The
.Fl p
option can be used to make
.Nm rndc
send commands to TCP port number
.Ar port#
on the system running the name server instead of BIND 9's
default control channel port of 953.
.Pp
The
.Fl y
option identifies the
.Ar key_id
to use from the configuration file.
.Ar key_id
must be known by
.Xr named
with the same algorithm and secret string in order for
control message validation to succeed.
If no
.Fl y
option is provided,
.Nm rndc
will first look for a
.Dv key
clause in the
.Dv server{}
statement of the server being used, or if no
.Dv server{}
statement is present for that host, then the
.Dv default-key
clause of the
.Dv options{}
statement.
Note that the configuration file for
.Nm rdnc
contains shared secrets which are used to send authenticated
control commands to name servers.
It should therefore not have general read or write access.
.Pp
The
.Fl M ,
.Fl m ,
and
.Fl v
options provided debugging information and are primarily of interest
only to the BIND 9 developers.
They might be changed or removed in future releases.
.Pp
The only valid value for
.Ar command
is \*qreload\*q, which forces the name server to reload its configuation
file and zones.
Further commands will be provided in future releases as the management
capabilities of
.Nm rndc
are extended.
.Sh LIMITATIONS
.Nm rndc
currently only supports the
.Dv reload
command.
Future releases will provide more commands so that
.Nm rndc
offers at least as many management capabilities as the old
.Xr ndc
utility.
.Pp
There is currently no way to provide the shared secret for a key_id
without using the configuration file.
.Pp
Several error messages could be clearer.
For example, trying to connect
from an address that is not in the list of acceptable addresses
configured into
.Xr named
will result in the error message "end of file" when the server
unceremoniously closes the connection.
.Sh SEE ALSO
.Xr rndc.conf 5 ,
.Xr named 8 ,
.Xr named.conf 5 ,
.Xr RFC2845 ,
.Xr ndc 8 .
doc/man/bin/rndc.conf.5
+202
View File
@@ -0,0 +1,202 @@
.\" Copyright (C) @YEARS@ Internet Software Consortium.
.\"
.\" Permission to use, copy, modify, and distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
.\" copyright notice and this permission notice appear in all copies.
.\"
.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
.\" ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
.\" OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
.\" CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
.\" DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
.\" PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
.\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
.\" SOFTWARE.
.\"
.\" $Id: rndc.conf.5,v 1.4 2000/07/12 17:37:57 gson Exp $
.\"
.Dd Jun 30, 2000
.Dt RDNC.CONF 5
.Os BIND9 9
.ds vT BIND9 Programmer's Manual
.Sh NAME
.Nm rdnc.conf
.Nd rdnc configuration file
.Sh SYNOPSIS
.Nm rdnc.conf
.Sh DESCRIPTION
The BIND9 utility for controlling the name server,
.Nm rndc ,
has its own configuration file
.Pa /etc/rndc.conf .
This file has a similar structure and syntax to
.Pa named.conf ,
the file used to configure the name server.
Statements are enclosed in braces and terminated with a semi-colon.
Clauses in the statements are also semi-colon terminated.
The usual comment styles are supported:
.Bl -tag -width UNIX-style:
.It C style: /* */
.It C++ style: // to end of line
.It Unix style: # to end of line
.El
.Pp
.Pa rndc.conf
is much simpler than
.Pa named.conf .
The file uses three statements: an
.Dv options{}
statement, a
.Dv server{}
statement and a
.Dv key{}
statement.
.Pp
The
.Dv options{}
statement contains two clauses.
The
.Dv default-server
clause
is followed by the name or address of a name server.
This host will
be used when no name server is given as an argument to
.Nm rndc .
The
.Dv default-key
clause
is followed by the name of a key which is identified by a
.Dv key{}
statement.
If no
.Fl y
option is provided on the
.Xr rndc
command line, and no
.Dv key
clause is found in a a matching
.Dv server{}
statement, this default key will be used to authenticate the server's
commands and responses.
.Pp
After the keyword
.Dv server ,
the
.Dv server{}
statement is followed by a string which is the hostname or address for a
name server.
The statement has a single clause,
.Dv key .
The key name must match the name of a
.Dv key{}
statement in the file.
.Pp
The
.Dv key{}
statement begins with an identifying string, the name of the key.
The statement has two clauses.
.Dv algorithm
identifies the encryption algorithm for
.Nm rndc
to use; currently only HMAC-MD5 is supported.
This is followed by a
.Dv secret
clause which contains the base-64 encoding of the
algorithm's encryption key.
The base-64 string is enclosed in double quotes.
.Pp
There are two common ways to generate the base-64 string for the
.Dv secret .
The BIND 9 program
.Xr dnssec-keygen 8
can be used to generate a random key, or the
.Xr mmencode 1
program, also known as
.Xr mimencode 1 ,
can be used to generate a base-64 string from known input.
.Xr mmencode
does not ship with BIND 9 but is available on many systems.
See the
.Sx EXAMPLES
section for sample command lines for each.
.Pp
Host and key names must be quoted using double quotes if they
match a keyword, such as having a key named "key".
.Sh EXAMPLE
.Bd -literal indent
options {
default-server localhost;
default-key samplekey;
};
server localhost {
key samplekey;
};
key samplekey {
algorithm hmac-md5;
secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K";
};
.Ed
.Pp
In the above example,
.Nm rndc
will by default use the server at localhost (127.0.0.1) and the key called
.Dv samplekey .
Commands to the localhost server will use the
.Dv samplekey
key.
The
.Dv key{}
statement indicates that
.Dv samplekey
uses the HMAC-MD5 algorithm and its
.Dv secret
clause contains the base-64 encoding of the HMAC-MD5 secret enclosed
in double quotes.
.Pp
To generate a random secret with
.Xr dnssec-keygen :
.Bd -literal indent
$ dnssec-keygen -a hmac-md5 -b 128 -n user rndc
.Ed
.Pp
The base-64 string will appear in two files,
.Pa Krndc.+157.+{random}.key
and
.Pa Krndc.+157.+{random}.private .
After extracting the key to be
placed in the
.Nm rndc.conf
and
.Xr named.conf
.Dv key{}
statements, the
.Pa .key
and
.Pa .private
files can be removed.
.Pp
To generate a secret from known input with
.Xr mmenode :
.Bd -literal indent
$ echo "known plaintext for a secret" | mmencode
.Ed
.Sh LIMITATIONS
There is currently no way to specify the port for
.Xr rndc
to use. This will be remedied in future releases by allowing a
.Dv port
clause to the
.Dv server{}
statement and a
.Dv default-port
clause to the
.Dv options{}
statement.
.Sh SEE ALSO
.Xr rndc 8 ,
.Xr named.conf 8 ,
.Xr dnssec-keygen 8 ,
.Xr mmencode 1 ,
"BIND9 Administrators Manual".
doc/man/dnssec/dnssec-keygen.8
+304
View File
@@ -0,0 +1,304 @@
.\"
.\" Copyright (C) 2000 Internet Software Consortium.
.\"
.\" Permission to use, copy, modify, and distribute this document for any
.\" purpose with or without fee is hereby granted, provided that the above
.\" copyright notice and this permission notice appear in all copies.
.\"
.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
.\" DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
.\" INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
.\" FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
.\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
.\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\"
.\" $Id: dnssec-keygen.8,v 1.5 2000/07/26 18:52:05 gson Exp $
.\"
.Dd Jun 30, 2000
.Dt DNSSEC-KEYGEN 8
.Os BIND9 9
.ds vT BIND9 Programmer's Manual
.Sh NAME
.Nm dnssec-keygen
.Nd key generation tool for DNSSEC
.Sh SYNOPSIS
.Nm dnssec-keygen
.Fl a Ar algorithm
.Fl b Ar keysize
.Op Fl e
.Op Fl g Ar generator
.Op Fl h
.Fl n Ar nametype
.Op Fl p Ar protocol-value
.Op Fl r Ar randomdev
.Op Fl s Ar strength-value
.Op Fl t Ar type
.Op Fl v Ar level
.Ar name
.Sh DESCRIPTION
.Nm dnssec-keygen
generates keys for DNSSEC, Secure DNS, as defined in RFC2535.
It also generates keys for use in Transaction Signatures, TSIG, which
is defined in RFC2845.
.Pp
A short summary of the options and arguments to
.Nm dnssec-keygen
is printed by the
.Fl h
(help) option.
.Pp
The
.Fl a ,
.Fl b ,
and
.Fl n
options and their arguments must be supplied when generating keys.
The domain name that the key has to be generated for is given by
.Ar name .
.Pp
The choice of encryption algorithm is selected by the
.Fl a
option to
.Nm dnssec-keygen .
.Ar algorithm
must be one of
.Dv RSAMD5 ,
.Dv DH ,
.Dv DSA
or
.Dv HMAC-MD5
to indicate that an RSA, Diffie-Hellman, Digital Signature
Algorithm or HMAC-MD5 key is required.
An argument of
.Dv RSA
can also be given, which is equivalent to
.Dv RSAMD5 .
The argument identifying the encryption algorithm is case-insensitive.
DNSSEC specifies DSA as a mandatory algorithm and RSA as a recommended one.
Implementations of TSIG must support HMAC-MD5.
.Pp
The number of bits in the key is determined by the
.Ar keysize
argument following the
.Fl b
option.
The choice of key size depends on the algorithm that is used.
RSA keys must be between 512 and 2048 bits.
Diffie-Hellman keys must be between 128 and 4096 bits.
For DSA, the key size must be between 512 and 1024 bits and a multiple
of 64.
The length of an HMAC-MD5 key can be between 1 and 512 bits.
.Pp
The
.Fl n
option specifies how the generated key will be used.
.Ar nametype
can be either
.Dv ZONE ,
.Dv HOST ,
.Dv ENTITY ,
or
.Dv USER
to indicate that the key will be used for signing a zone, host,
entity or user respectively.
In this context
.Dv HOST
and
.Dv ENTITY
are identical.
.Ar nametype
is case-insensitive.
.Pp
The
.Fl e
option can only be used when generating RSA keys.
It tells
.Nm dnssec-keygen
to use a large exponent.
When creating Diffie-Hellman keys, the
.Fl g
option selects the Diffie-Hellman generator
.Ar generator
that is to be used.
The only supported values value of
.Ar generator
are 2 and 5.
If no Diffie-Hellman generator is supplied, a known prime
from RFC2539 will be used if possible; otherwise 2 will be used as the
generator.
.Pp
The
.Fl p
option sets the protocol value for the generated key to
.Ar protocol-value .
The default is 2 (email) for keys of type
.Dv USER
and 3 (DNSSEC) for all other key types.
Other possible values for this argument are listed in RFC2535 and its
successors.
.Pp
.Nm dnssec-keygen
uses random numbers to seed the process
of generating keys.
If the system does not have a
.Pa /dev/random
device that can be used for generating random numbers,
.Nm dnssec-keygen
will prompt for keyboard input and use the time intervals between
keystrokes to provide randomness.
The
.Fl r
option overrides this behaviour, making
.Nm dnssec-keygen
use
.Ar randomdev
as a source of random data.
.Pp
The key's strength value can be set with the
.Fl s
option.
The generated key will sign DNS resource records
with a strength value of
.Ar strength-value .
It should be a number between 0 and 15.
The default strength is zero.
The key strength field currently has no defined purpose in DNSSEC.
.Pp
The
.Fl t
option indicates if the key is to be used for authentication or
confidentiality.
.Ar type
can be one of
.Dv AUTHCONF ,
.Dv NOAUTHCONF ,
.Dv NOAUTH
or
.Dv NOCONF .
The default is
.Dv AUTHCONF .
If type is
.Dv AUTHCONF
the key can be used for authentication and confidentialty.
Setting
.Ar type
to
.Dv NOAUTHCONF
indicates that the key cannot be used for authentication or confidentialty.
A value of
.Dv NOAUTH
means the key can be used for confidentiality but not for
authentication.
Similarly,
.Dv NOCONF
defines that the key cannot be used for confidentiality though it can
be used for authentication.
.Pp
The
.Fl v
option can be used to make
.Nm dnssec-keygen
more verbose.
As the debugging/tracing level
.Ar level
increases,
.Nm dnssec-keygen
generates increasingly detailed reports about what it is doing.
The default level is zero.
.Sh GENERATED KEYS
When
.Nm dnssec-keygen
completes it prints a string of the form
.Ar Knnnn.+aaa+iiiii
on the standard output.
This is an identification string for the key it has generated.
These strings can be supplied as arguments to
.Xr dnssec-makekeyset 8 .
.Pp
The
.Ar nnnn.
part is the dot-terminated domain name given by
.Ar name .
The DNSSEC algorithm identifier is indicated by
.Ar aaa -
001 for RSA, 002 for Diffie-Hellman, 003 for DSA or 157 for HMAC-MD5.
.Ar iiiii
is a five-digit number identifying the key.
.Pp
.Nm dnssec-keygen
creates two files.
The file names are adapted from the key identification string above.
They have names of the form:
.Ar Knnnn.+aaa+iiiii.key
and
.Ar Knnnn.+aaa+iiiii.private .
These contain the public and private parts of the key respectively.
The files generated by
.Nm dnssec-keygen
obey this naming convention to
make it easy for the signing tool
.Xr dnssec-signzone 8
to identify which file(s) have to be read to find the necessary
key(s) for generating or validating signatures.
.Pp
The
.Ar .key
file contains a KEY resource record that can be inserted into a zone file
with a
.Dv $INCLUDE
statement.
The private part of the key is in the
.Ar .private
file.
It contains details of the encryption algorithm that was used and any
relevant parameters: prime number, exponent, modulus, subprime, etc.
For obvious security reasons, this file does not have general read
permission.
The private part of the key is used by
.Xr dnssec-signzone 8
to generate signatures and the public part is used to verify the
signatures.
Both
.Ar .key
and
.Ar .private
key files are generated for symmetric encryption algorithm such as
HMAC-MD5, even though the public and private key are equivalent.
.Sh EXAMPLE
To generate a 768-bit DSA key for the domain
.Dv example.com ,
the following command would be issued:
.Pp
.Dl # dnssec-keygen -a DSA -b 768 -n ZONE example.com
.Dl Kexample.com.+003+26160
.Pp
.Nm dnssec-keygen
has printed the key identification string
.Dv Kexample.com.+003+26160 ,
indicating a DSA key with identifier 26160.
It will also have created the files
.Pa Kexample.com.+003+26160.key
and
.Pa Kexample.com.+003+26160.private
containing respectively the public and private keys for the generated
DSA key.
.Sh FILES
.Pa /dev/random
.Sh SEE ALSO
.Xr RFC2535,
.Xr RFC2845,
.Xr RFC2539,
.Xr dnssec-makekeyset 8 ,
.Xr dnssec-signkey 8 ,
.Xr dnssec-signzone 8 .
.Sh BUGS
The naming convention for the public and private key files is a little
clumsy.
It won't work for domain names that are longer than 236 characters
because of the
.Ar .+aaa+iiiii.private
suffix results in filenames that are too long for most
.Ux
systems.
doc/man/dnssec/dnssec-makekeyset.8
+202
View File
@@ -0,0 +1,202 @@
.\"
.\" Copyright (C) 2000 Internet Software Consortium.
.\"
.\" Permission to use, copy, modify, and distribute this document for any
.\" purpose with or without fee is hereby granted, provided that the above
.\" copyright notice and this permission notice appear in all copies.
.\"
.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
.\" DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
.\" INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
.\" FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
.\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
.\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\"
.\" $Id: dnssec-makekeyset.8,v 1.4 2000/07/26 00:47:14 bwelling Exp $
.\"
.Dd Jun 30, 2000
.Dt DNSSEC-MAKEKEYSET 8
.Os BIND9 9
.ds vT BIND9 Programmer's Manual
.Sh NAME
.Nm dnssec-makekeyset
.Nd produce a set of DNSSEC keys
.Sh SYNOPSIS
.Nm dnssec-makekeyset
.Op Fl h
.Op Fl s Ar start-time
.Op Fl e Ar end-time
.Op Fl t Ar TTL
.Op Fl r Ar randomdev
.Op Fl v Ar level
.Ar keyfile ....
.Sh DESCRIPTION
.Nm dnssec-makekeyset
generates a key set from one or more keys created by
.Xr dnssec-keygen 8 .
It creates a file containing KEY and SIG records for some zone which
can then be signed by the zone's parent if the parent zone is
DNSSEC-aware.
.Ar keyfile
should be a key identification string as reported by
.Xr dnssec-keygen 8 :
i.e.
.Ar Knnnn.+aaa+iiiii
where
.Ar nnnn
is the name of the key,
.Ar aaa
is the encryption algorithm and
.Ar iiiii
is the key identifier.
Multiple
.Ar keyfile
arguments can be supplied when there are several keys to be combined
by
.Nm dnssec-makekeyset
into a key set.
.Pp
For any SIG records that are in the key set, the start time when the
SIG records become valid is specified with the
.Fl s
option.
.Ar start-time
can either be an absolute or relative date.
An absolute start time is indicated by a number in YYYYMMDDHHMMSS
notation: 20000530144500 denotes 14:45:00 UTC on May 30th, 2000.
A relative start time is supplied when
.Ar start-time
is given as +N: N seconds from the current time.
If no
.Fl s
option is supplied, the current date and time is used for the start
time of the SIG records.
.Pp
The expiry date for the SIG records can be set by the
.Fl e
option.
Note that in this context, the expiry date specifies when the SIG
records are no longer valid, not when they are deleted from caches on name
servers.
.Ar end-date
also represents an absolute or relative date.
YYYYMMDDHHMMSS notation is used as before to indicate an absolute date
and time.
When
.Ar end-date
is +N,
it indicates that the SIG records will expire in N seconds after their
start date.
If
.Ar end-date
is written as now+N,
the SIG records will expire in N seconds after the current time.
When no expiry date is set for the SIG records,
.Nm dnssec-makekeyset
defaults to an expire time of 30 days from the start time of the SIG
records.
.Pp
An alternate source of random data can be specified with the
.Fl r
option.
.Ar randomdev
is the name of the file to use to obtain random data.
By default
.Pa /dev/random
is used if this device is available.
If it is not provided by the operating system and no
.Fl r
option is used,
.Nm dnssec-makekeyset
will prompt the user for input from the keyboard and use the time
between keystrokes to derive some random data.
.Pp
The
.Fl t
option is followed by a time-to-live argument
.Ar TTL
which indicates the TTL value that will be assigned to the assembled KEY
and SIG records in the output file.
.Ar TTL
is expressed in seconds.
If no
.Fl t
option is provided,
.Nm dnssec-makekeyset
prints a warning and uses a default TTL of 3600 seconds.
.Pp
The
.Fl v
option can be used to make
.Nm dnssec-makekeyset
more verbose.
As the debugging/tracing level
.Ar level
increases,
.Nm dnssec-makekeyset
generates increasingly detailed reports about what it is doing.
The default level is zero.
.Pp
The
.Fl h
option makes
.Nm dnssec-makekeyset
to print a short summary of its options and arguments.
.Pp
If
.Nm dnssec-makekeyset
is successful, it creates a file name of the form
.Ar nnnn.keyset .
This file contains the KEY and SIG records for domain
.Dv nnnn ,
the domain name part from the key file identifier produced when
.Nm dnssec-keygen
created the domain's public and private keys.
The
.Ar .keyset
file can then be transferred to the DNS administrator of the parent
zone for them to sign the contents with
.Xr dnssec-signkey 8 .
.Sh EXAMPLE
The following command generates a key set for the DSA key for
.Dv example.com
that was shown in the
.Xr dnssec-keygen 8
man page.
The backslash is for typographic reasons and would not be provided on
the command line when running
.Nm dnssec-makekeyset .
.nf
.Dl # dnssec-makekeyset -t 86400 -s 20000701120000 \e\p
.Dl -e +2592000 Kexample.com.+003+26160
.fi
.Pp
.Nm dnssec-makekeyset
will create a file called
.Pa example.com.keyset
containing a SIG and KEY record for
.Dv example.com.
These records will have a TTL of 86400 seconds (1 day).
The SIG record becomes valid at noon UTC on July 1st 2000 and expires
30 days (2592000 seconds) later.
.Pp
The DNS administrator for
.Dv example.com
could then send
.Pa example.com.keyset
to the DNS administrator for
.Dv .com
so that they could sign the resource records in the file.
This assumes that the
.Dv .com
zone is DNSSEC-aware and the administrators of the two zones have some
mechanism for authenticating each other and exchanging the keys and
signatures securely.
.Sh FILES
.Pa /dev/random .
.Sh SEE ALSO
.Xr RFC2535 ,
.Xr dnssec-keygen 8 ,
.Xr dnssec-signkey 8 .
doc/man/dnssec/dnssec-signkey.8
+159
View File
@@ -0,0 +1,159 @@
.\"
.\" Copyright (C) 2000 Internet Software Consortium.
.\"
.\" Permission to use, copy, modify, and distribute this document for any
.\" purpose with or without fee is hereby granted, provided that the above
.\" copyright notice and this permission notice appear in all copies.
.\"
.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
.\" DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
.\" INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
.\" FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
.\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
.\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\"
.\" $Id: dnssec-signkey.8,v 1.5 2000/07/26 19:13:18 gson Exp $
.\"
.Dd Jun 30, 2000
.Dt DNSSEC-SIGNKEY 8
.Os BIND9 9
.ds vT BIND9 Programmer's Manual
.Sh NAME
.Nm dnssec-signkey
.Nd DNSSEC keyset signing tool
.Sh SYNOPSIS
.Nm dnssec-signkey
.Op Fl h
.Op Fl p
.Op Fl r Ar randomdev
.Op Fl v Ar level
.Ar keyset
.Ar keyfile ...
.Sh DESCRIPTION
.Nm dnssec-signkey
is used to sign a key set for a child zone.
Typically this would be provided by a
.Ar .keyset
file generated by
.Xr dnssec-makekeyset 8 .
This provides a mechanism for a DNSSEC-aware zone to sign the keys of
any DNSSEC-aware child zones.
The child zone's key set gets signed with the zone keys for its parent
zone.
.Ar keyset
will be the pathname of the child zone's
.Ar .keyset
file.
Each
.Ar keyfile
argument will be a key identification string as reported by
.Xr dnssec-keygen 8
for the parent zone.
This allows the child's keys to be signed by more than one
parent zone key.
.Pp
The
.Fl h
option makes
.Nm dnssec-signkey
print a short summary of its command line options
and arguments.
.Pp
The
.Fl p
option instructs
.Nm dnssec-signkey
to use pseudo-random data when signing the keys. This is faster, but
less secure, than using genuinely random data for signing.
This option may be useful when there are many child zone keysets to
sign or if the entropy source is limited.
It could also be used for short-lived keys and signatures that don't
require as much protection against cryptanalysis, such as when the key
will be discarded long before it could be compromised.
.Nm dnssec-signkey
may need random numbers in the process of generating keys.
If the system does not have a
.Pa /dev/random
device that can be used for generating random numbers,
.Nm dnssec-signkey
will prompt for keyboard input and use the time intervals between
keystrokes to provide randomness.
The
.Fl r
option overrides this behaviour, making
.Nm dnssec-signkey
use
.Ar randomdev
as a source of random data.
.Pp
The
.Fl v
option can be used to make
.Nm dnssec-signkey
more verbose.
As the debugging/tracing level
.Ar level
increases,
.Nm dnssec-signkey
generates increasingly detailed reports about what it is doing.
The default level is zero.
.Pp
When
.Nm dnssec-signkey
completes successfully, it generates a file called
.Ar nnnn.signedkey
containing the signed keys for child zone
.Ar nnnn .
The keys from the
.Ar keyset
file will have been signed by the parent zone's key or keys which were
supplied as
.Ar keyfile
arguments.
This file should be sent to the DNS administrator of the child zone.
They arrange for its contents to be incorporated into the zone file
when it next gets signed with
.Xr dnssec-signzone 8 .
A copy of the generated
.Ar signedkey
file should be kept by the parent zone's DNS administrator, since
it will be needed when signing the parent zone.
.Sh EXAMPLE
The DNS administrator for a DNSSEC-aware
.Dv .com
zone would use the following command to make
.Nm dnssec-signkey
sign the
.Ar .keyset
file for
.Dv example.com
created in the example shown in the man page for
.Xr dnssec-makekeyset 8 :
.Pp
.Dl # dnssec-signkey example.com.keyset Kcom.+003+51944
.Pp
where
.Dv Kcom.+003+51944
was a key file identifier that was produced when
.Xr dnssec-keygen 8
generated a key for the
.Dv .com
zone.
.Pp
.Nm dnssec-signkey
will produce a file called
.Dv example.com.signedkey
which has the keys for
.Dv example.com
signed by the
.Dv com
zone's zone key.
.Sh FILES
.Pa /dev/random
.Sh SEE ALSO
.Xr RFC2535,
.Xr dnssec-keygen 8 ,
.Xr dnssec-makekeyset 8 ,
.Xr dnssec-signzone 8 .
doc/man/dnssec/dnssec-signzone.8
+263
View File
@@ -0,0 +1,263 @@
.\"
.\" Copyright (C) 2000 Internet Software Consortium.
.\"
.\" Permission to use, copy, modify, and distribute this document for any
.\" purpose with or without fee is hereby granted, provided that the above
.\" copyright notice and this permission notice appear in all copies.
.\"
.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
.\" DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
.\" INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
.\" FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
.\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
.\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\"
.\" $Id: dnssec-signzone.8,v 1.7 2000/07/26 21:36:43 gson Exp $
.\"
.Dd Jun 30, 2000
.Dt DNSSEC-SIGNZONE 8
.Os BIND9 9
.ds vT BIND9 Programmer's Manual
.Sh NAME
.Nm dnssec-signzone
.Nd DNSSEC zone signing tool
.Sh SYNOPSIS
.Nm dnssec-signzone
.Op Fl a
.Op Fl c Ar cycle-time
.Op Fl s Ar start-time
.Op Fl e Ar end-time
.Op Fl o Ar origin
.Op Fl f Ar output-file
.Op Fl p
.Op Fl r Ar randomdev
.Op Fl v Ar level
.Ar zonefile
.Op keyfile ....
.Sh DESCRIPTION
.Pp
.Nm dnssec-signzone
is used to sign a zone.
Any
.Ar .signedkey
files for the zone to be signed should be present in the current
directory, along with the keys that will be used to sign the zone.
If no
.Ar keyfile
arguments are supplied, the default behaviour is to use all of the zone's
keys that are present in the current directory.
Providing specific
.Ar keyfile
arguments constrains
.Nm dnssec-signzone
to only use those keys for signing the zone.
Each
.Ar keyfile
argument would be an identification string for a key created with
.Xr dnssec-keygen 8 .
If the zone to be signed has any secure subzones, the
.Ar .signedkey
files for those subzones need to be available in the
current working directory used by
.Nm dnssec-signzone .
.Pp
.Ar zonefile
is the name of the unsigned zone file.
Unless the file name is the same as the name of the zone, the
.Fl o
option should be given.
.Ar origin
will be the fully qualified domain origin for the zone.
.Pp
.Nm dnssec-signzone
will generate NXT and SIG records for the zone and produce a signed
version of the zone.
If there is a
.Ar signedkey
file from the zone's parent, the parent's signatures will be
incorporated into the generated signed zone file.
The security status of delegations from the the signed zone
- i.e. whether the child zones are DNSSEC-aware or not - is
set according to the presence or absence of a
.Ar signedkey
file for the child in case.
.Pp
By default,
.Nm dnssec-signzone
generates a file called
.Ar zonefile.signed
containing the signed zone file.
The output file name can be overridden usign the
.Fl f
option.
.\" Don't hyphenate YYYYMMDDHHMMSS
.nh YYYYMMDDHHMMSS
.Pp
.Nm dnssec-signzone
does not verify the signatures by default.
The
.Fl a
option makes it verify the signatures it generated.
.Pp
The date and time when the generated
SIG records become valid can be specified with the
.Fl s
option.
.Ar start-time
can either be an absolute or relative date.
An absolute start time is indicated by a number in YYYYMMDDHHMMSS
notation: 20000530144500 denotes 14:45:00 UTC on May 30th, 2000.
A relative start time is supplied when
.Ar start-time
is given as +N: N seconds from the current time.
If no
.Fl s
option is supplied, the current date and time is used for the start
time of the SIG records.
.Pp
The expiry date for the SIG records can be set by the
.Fl e
option.
Note that in this context, the expiry date specifies when the SIG
records are no longer valid, not when they are deleted from caches on name
servers.
.Ar end-date
also represents an absolute or relative date.
YYYYMMDDHHMMSS notation is used as before to indicate an absolute date
and time.
When
.Ar end-date
is +N,
it indicates that the SIG records will expire in N seconds after their
start date.
If
.Ar end-date
is supplied as now+N,
the SIG records will expire in N seconds after the current time.
When no expiry date is set for the SIG records,
.Nm dnssec-signzone
defaults to an expire time of 30 days from the start time of the SIG
records.
.Pp
When a previously signed zone is passed as input to
.Nm dnssec-signzone ,
records may be resigned. Whether or not to resign records is configurable
by using the
.Fl c
option, which specifies the cycle period as an offset from the current time
(in seconds). If a SIG record expires after the cycle period, it is retained.
Otherwise, it is considered to be expiring soon, and
.Nm dnssec-signzone
will remove it and generate a new SIG record to replace it.
.Pp
The default cycle period is one quarter of the difference between the
specified signature end and start dates. So if the
.Fl e
and
.Fl s
options are not specified,
.Nm dnssec-signzone
generates signatures that are valid for 30 days from the current date
by default, with a cycle period of 7.5 days. Therefore, if any SIG records
are due to expire in less than 7.5 days, they would be replaced
with new ones.
.Pp
The
.Fl p
option instructs
.Nm dnssec-signkey
to use pseudo-random data when signing the keys. This is faster, but
less secure, than using genuinely random data for signing.
This option may be useful when there are many child zone keysets to
sign or if the entropy source is limited.
It could also be used for short-lived keys and signatures that don't
require as much protection against cryptanalysis, such as when the key
will be discarded long before it could be compromised.
.Pp
.Nm dnssec-signzone
may need random numbers in the process of signing the zone.
If the system does not have a
.Pa /dev/random
device that can be used for generating random numbers,
.Nm dnssec-signzone
will prompt for keyboard input and use the time intervals between
keystrokes to provide randomness.
The
.Fl r
option overrides this behaviour, making
.Nm dnssec-signzone
use
.Ar randomdev
as a source of random data.
.Pp
An option of
.Fl h
makes
.Nm dnssec-signzone
print a short summary of its command line options
and arguments.
.Pp
The
.Fl v
option can be used to make
.Nm dnssec-signzone
more verbose.
As the debugging/tracing level
.Ar level
increases,
.Nm dnssec-signzone
generates increasingly detailed reports about what it is doing.
The default level is zero.
.Sh EXAMPLE
The example below shows how
.Nm dnssec-signzone
could be used to sign the
.Dv example.com
zone with the key that was generated in the example given in the
man page for
.Xr dnssec-keygen 8 .
The zone file for this zone is
.Dv example.com ,
which is the same as the origin, so there is no need to use the
.Fl o
option to set the origin.
This zone file contains the keyset for
.Dv example.com
that was created by
.Xr dnssec-makekeyset 8 .
The zone's keys were either appended to the zone file or
incorporated using a
.Dv $INCLUDE
statement.
If there was a
.Ar .signedkey
file from the parent zone - i.e.
.Dv example.com.signedkey
- it should be present in the current directory.
This allows the parent zone's signature to be included in the signed
version of the
.Dv example.com
zone.
.Pp
.Dl # dnssec-signzone example.com Kexample.com.+003+26160
.Pp
.Nm dnssec-signzone
will create a file called
.Dv example.com.signed ,
the signed version of the
.Dv example.com
zone.
This file can then be referenced in a
.Dv zone{}
statement in
.Pa /etc/named.conf
so that it can be loaded by the name server.
.Sh FILES
.Pa /dev/random
.Sh SEE ALSO
.Xr RFC2535,
.Xr dnssec-keygen 8 ,
.Xr dnssec-makekeyset 8 ,
.Xr dnssec-signkey 8 .
lib/dns/sec/dnssafe/LICENSE_RSA
+43
View File
@@ -0,0 +1,43 @@
DNSSAFE LICENSE TERMS
This BIND software includes the DNSsafe software from RSA Data
Security, Inc., which is copyrighted software that can only be
distributed under the terms of this license agreement.
The DNSsafe software cannot be used or distributed separately from the
BIND software. You only have the right to use it or distribute it as
a bundled, integrated product.
The DNSsafe software can ONLY be used to provide authentication for
resource records in the Domain Name System, as specified in RFC 2065
and successors. You cannot modify the BIND software to use the
DNSsafe software for other purposes, or to make its cryptographic
functions available to end-users for other uses.
If you modify the DNSsafe software itself, you cannot modify its
documented API, and you must grant RSA Data Security the right to use,
modify, and distribute your modifications, including the right to use
any patents or other intellectual property that your modifications
depend upon.
You must not remove, alter, or destroy any of RSA's copyright notices
or license information. When distributing the software to the Federal
Government, it must be licensed to them as "commercial computer
software" protected under 48 CFR 12.212 of the FAR, or 48 CFR
227.7202.1 of the DFARS.
You must not violate United States export control laws by distributing
the DNSsafe software or information about it, when such distribution
is prohibited by law.
THE DNSSAFE SOFTWARE IS PROVIDED "AS IS" WITHOUT ANY WARRANTY
WHATSOEVER. RSA HAS NO OBLIGATION TO SUPPORT, CORRECT, UPDATE OR
MAINTAIN THE RSA SOFTWARE. RSA DISCLAIMS ALL WARRANTIES, EXPRESS,
IMPLIED OR STATUTORY, AS TO ANY MATTER WHATSOEVER, INCLUDING ALL
IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
PURPOSE AND NON-INFRINGEMENT OF THIRD PARTY RIGHTS.
If you desire to use DNSsafe in ways that these terms do not permit,
please contact RSA Data Security, Inc., 100 Marine Parkway, Redwood
City, California 94065, USA, to discuss alternate licensing
arrangements.