From da1c645ba38f02e18e75423e591abb7ea95f2de9 Mon Sep 17 00:00:00 2001 From: Rob Austein Date: Tue, 3 May 2005 22:51:21 +0000 Subject: [PATCH] 1852. [cleanup] Remove dnssec-signkey and dnssec-makekeyset --- CHANGES | 3 + bin/dnssec/dnssec-makekeyset.8 | 113 ------- bin/dnssec/dnssec-makekeyset.c | 401 ------------------------ bin/dnssec/dnssec-makekeyset.docbook | 233 -------------- bin/dnssec/dnssec-makekeyset.html | 407 ------------------------ bin/dnssec/dnssec-signkey.8 | 108 ------- bin/dnssec/dnssec-signkey.c | 448 --------------------------- bin/dnssec/dnssec-signkey.docbook | 237 -------------- bin/dnssec/dnssec-signkey.html | 407 ------------------------ 9 files changed, 3 insertions(+), 2354 deletions(-) delete mode 100644 bin/dnssec/dnssec-makekeyset.8 delete mode 100644 bin/dnssec/dnssec-makekeyset.c delete mode 100644 bin/dnssec/dnssec-makekeyset.docbook delete mode 100644 bin/dnssec/dnssec-makekeyset.html delete mode 100644 bin/dnssec/dnssec-signkey.8 delete mode 100644 bin/dnssec/dnssec-signkey.c delete mode 100644 bin/dnssec/dnssec-signkey.docbook delete mode 100644 bin/dnssec/dnssec-signkey.html diff --git a/CHANGES b/CHANGES index 60cf7aa9d8..fc85df6a65 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,6 @@ +1852. [cleanup] Remove last vestiges of dnssec-signkey and + dnssec-makekeyset (removed from Makefile years ago). + 1850. [bug] Memory leak in lwres_getipnodebyaddr(). [RT #14591] 1849. [doc] All forms of the man pages (docbook, man, html) should diff --git a/bin/dnssec/dnssec-makekeyset.8 b/bin/dnssec/dnssec-makekeyset.8 deleted file mode 100644 index b3deccdf8d..0000000000 --- a/bin/dnssec/dnssec-makekeyset.8 +++ /dev/null @@ -1,113 +0,0 @@ -.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC") -.\" Copyright (C) 2000, 2001, 2003 Internet Software Consortium. -.\" -.\" Permission to use, copy, modify, and distribute this software for any -.\" purpose with or without fee is hereby granted, provided that the above -.\" copyright notice and this permission notice appear in all copies. -.\" -.\" THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH -.\" REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -.\" AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, -.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM -.\" LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE -.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR -.\" PERFORMANCE OF THIS SOFTWARE. -.\" -.\" $Id: dnssec-makekeyset.8,v 1.16.2.2.4.2 2005/04/07 03:22:21 marka Exp $ -.\" -.TH "DNSSEC-MAKEKEYSET" "8" "June 30, 2000" "BIND9" "" -.SH NAME -dnssec-makekeyset \- DNSSEC zone signing tool -.SH SYNOPSIS -.sp -\fBdnssec-makekeyset\fR [ \fB-a\fR ] [ \fB-s \fIstart-time\fB\fR ] [ \fB-e \fIend-time\fB\fR ] [ \fB-h\fR ] [ \fB-p\fR ] [ \fB-r \fIrandomdev\fB\fR ] [ \fB-t\fIttl\fB\fR ] [ \fB-v \fIlevel\fB\fR ] \fBkey\fR\fI...\fR -.SH "DESCRIPTION" -.PP -\fBdnssec-makekeyset\fR generates a key set from one -or more keys created by \fBdnssec-keygen\fR. It creates -a file containing a KEY record for each key, and self-signs the key -set with each zone key. The output file is of the form -\fIkeyset-nnnn.\fR, where \fInnnn\fR -is the zone name. -.SH "OPTIONS" -.TP -\fB-a\fR -Verify all generated signatures. -.TP -\fB-s \fIstart-time\fB\fR -Specify the date and time when the generated SIG records -become valid. This can be either an absolute or relative -time. An absolute start time is indicated by a number -in YYYYMMDDHHMMSS notation; 20000530144500 denotes -14:45:00 UTC on May 30th, 2000. A relative start time is -indicated by +N, which is N seconds from the current time. -If no \fBstart-time\fR is specified, the current -time is used. -.TP -\fB-e \fIend-time\fB\fR -Specify the date and time when the generated SIG records -expire. As with \fBstart-time\fR, an absolute -time is indicated in YYYYMMDDHHMMSS notation. A time relative -to the start time is indicated with +N, which is N seconds from -the start time. A time relative to the current time is -indicated with now+N. If no \fBend-time\fR is -specified, 30 days from the start time is used as a default. -.TP -\fB-h\fR -Prints a short summary of the options and arguments to -\fBdnssec-makekeyset\fR. -.TP -\fB-p\fR -Use pseudo-random data when signing the zone. This is faster, -but less secure, than using real random data. This option -may be useful when signing large zones or when the entropy -source is limited. -.TP -\fB-r \fIrandomdev\fB\fR -Specifies the source of randomness. If the operating -system does not provide a \fI/dev/random\fR -or equivalent device, the default source of randomness -is keyboard input. \fIrandomdev\fR specifies -the name of a character device or file containing random -data to be used instead of the default. The special value -\fIkeyboard\fR indicates that keyboard -input should be used. -.TP -\fB-t \fIttl\fB\fR -Specify the TTL (time to live) of the KEY and SIG records. -The default is 3600 seconds. -.TP -\fB-v \fIlevel\fB\fR -Sets the debugging level. -.TP -\fBkey\fR -The list of keys to be included in the keyset file. These keys -are expressed in the form \fIKnnnn.+aaa+iiiii\fR -as generated by \fBdnssec-keygen\fR. -.SH "EXAMPLE" -.PP -The following command generates a keyset containing the DSA key for -\fBexample.com\fR generated in the -\fBdnssec-keygen\fR man page. -.PP -\fBdnssec-makekeyset -t 86400 -s 20000701120000 -e +2592000 Kexample.com.+003+26160\fR -.PP -In this example, \fBdnssec-makekeyset\fR creates -the file \fIkeyset-example.com.\fR. This file -contains the specified key and a self-generated signature. -.PP -The DNS administrator for \fBexample.com\fR could -send \fIkeyset-example.com.\fR to the DNS -administrator for \fB.com\fR for signing, if the -\&.com zone is DNSSEC-aware and the administrators of the two zones -have some mechanism for authenticating each other and exchanging -the keys and signatures securely. -.SH "SEE ALSO" -.PP -\fBdnssec-keygen\fR(8), -\fBdnssec-signkey\fR(8), -\fIBIND 9 Administrator Reference Manual\fR, -\fIRFC 2535\fR. -.SH "AUTHOR" -.PP -Internet Software Consortium diff --git a/bin/dnssec/dnssec-makekeyset.c b/bin/dnssec/dnssec-makekeyset.c deleted file mode 100644 index c8224ed388..0000000000 --- a/bin/dnssec/dnssec-makekeyset.c +++ /dev/null @@ -1,401 +0,0 @@ -/* - * Portions Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") - * Portions Copyright (C) 2000-2003 Internet Software Consortium. - * Portions Copyright (C) 1995-2000 by Network Associates, Inc. - * - * Permission to use, copy, modify, and distribute this software for any - * purpose with or without fee is hereby granted, provided that the above - * copyright notice and this permission notice appear in all copies. - * - * THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NETWORK ASSOCIATES DISCLAIMS - * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED - * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE - * FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES - * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN - * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR - * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. - */ - -/* $Id: dnssec-makekeyset.c,v 1.52.2.1.10.7 2004/08/28 06:25:27 marka Exp $ */ - -#include - -#include - -#include -#include -#include -#include -#include -#include - -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - -#include - -#include "dnssectool.h" - -const char *program = "dnssec-makekeyset"; -int verbose; - -typedef struct keynode keynode_t; -struct keynode { - dst_key_t *key; - ISC_LINK(keynode_t) link; -}; -typedef ISC_LIST(keynode_t) keylist_t; - -static isc_stdtime_t starttime = 0, endtime = 0, now; -static int ttl = -1; - -static isc_mem_t *mctx = NULL; -static isc_entropy_t *ectx = NULL; - -static keylist_t keylist; - -static void -usage(void) { - fprintf(stderr, "Usage:\n"); - fprintf(stderr, "\t%s [options] keys\n", program); - - fprintf(stderr, "\n"); - - fprintf(stderr, "Version: %s\n", VERSION); - - fprintf(stderr, "Options: (default value in parenthesis) \n"); - fprintf(stderr, "\t-a\n"); - fprintf(stderr, "\t\tverify generated signatures\n"); - fprintf(stderr, "\t-s YYYYMMDDHHMMSS|+offset:\n"); - fprintf(stderr, "\t\tSIG start time - absolute|offset (now)\n"); - fprintf(stderr, "\t-e YYYYMMDDHHMMSS|+offset|\"now\"+offset]:\n"); - fprintf(stderr, "\t\tSIG end time - " - "absolute|from start|from now (now + 30 days)\n"); - fprintf(stderr, "\t-t ttl\n"); - fprintf(stderr, "\t-p\n"); - fprintf(stderr, "\t\tuse pseudorandom data (faster but less secure)\n"); - fprintf(stderr, "\t-r randomdev:\n"); - fprintf(stderr, "\t\ta file containing random data\n"); - fprintf(stderr, "\t-v level:\n"); - fprintf(stderr, "\t\tverbose level (0)\n"); - - fprintf(stderr, "\n"); - - fprintf(stderr, "keys:\n"); - fprintf(stderr, "\tkeyfile (Kname+alg+tag)\n"); - - fprintf(stderr, "\n"); - - fprintf(stderr, "Output:\n"); - fprintf(stderr, "\tkeyset (keyset-)\n"); - exit(0); -} - -static isc_boolean_t -zonekey_on_list(dst_key_t *key) { - keynode_t *keynode; - for (keynode = ISC_LIST_HEAD(keylist); - keynode != NULL; - keynode = ISC_LIST_NEXT(keynode, link)) - { - if (dst_key_compare(keynode->key, key)) - return (ISC_TRUE); - } - return (ISC_FALSE); -} - -int -main(int argc, char *argv[]) { - int i, ch; - char *startstr = NULL, *endstr = NULL; - dns_fixedname_t fdomain; - dns_name_t *domain = NULL; - char *output = NULL; - char *endp; - unsigned char data[65536]; - dns_db_t *db; - dns_dbversion_t *version; - dns_diff_t diff; - dns_difftuple_t *tuple; - dns_fixedname_t tname; - dst_key_t *key = NULL; - dns_rdata_t rdata = DNS_RDATA_INIT; - dns_rdataset_t rdataset; - dns_rdataclass_t rdclass; - isc_result_t result; - isc_buffer_t b; - isc_region_t r; - isc_log_t *log = NULL; - keynode_t *keynode; - unsigned int eflags; - isc_boolean_t pseudorandom = ISC_FALSE; - isc_boolean_t tryverify = ISC_FALSE; - - result = isc_mem_create(0, 0, &mctx); - if (result != ISC_R_SUCCESS) - fatal("failed to create memory context: %s", - isc_result_totext(result)); - - dns_result_register(); - - while ((ch = isc_commandline_parse(argc, argv, "as:e:t:r:v:ph")) != -1) - { - switch (ch) { - case 'a': - tryverify = ISC_TRUE; - break; - case 's': - startstr = isc_commandline_argument; - break; - - case 'e': - endstr = isc_commandline_argument; - break; - - case 't': - endp = NULL; - ttl = strtol(isc_commandline_argument, &endp, 0); - if (*endp != '\0') - fatal("TTL must be numeric"); - break; - - case 'r': - setup_entropy(mctx, isc_commandline_argument, &ectx); - break; - - case 'v': - endp = NULL; - verbose = strtol(isc_commandline_argument, &endp, 0); - if (*endp != '\0') - fatal("verbose level must be numeric"); - break; - - case 'p': - pseudorandom = ISC_TRUE; - break; - - case 'h': - default: - usage(); - - } - } - - argc -= isc_commandline_index; - argv += isc_commandline_index; - - if (argc < 1) - usage(); - - if (ectx == NULL) - setup_entropy(mctx, NULL, &ectx); - eflags = ISC_ENTROPY_BLOCKING; - if (!pseudorandom) - eflags |= ISC_ENTROPY_GOODONLY; - result = dst_lib_init(mctx, ectx, eflags); - if (result != ISC_R_SUCCESS) - fatal("could not initialize dst: %s", - isc_result_totext(result)); - - isc_stdtime_get(&now); - - if (startstr != NULL) - starttime = strtotime(startstr, now, now); - else - starttime = now; - - if (endstr != NULL) - endtime = strtotime(endstr, now, starttime); - else - endtime = starttime + (30 * 24 * 60 * 60); - - if (ttl == -1) { - ttl = 3600; - fprintf(stderr, "%s: TTL not specified, assuming 3600\n", - program); - } - - setup_logging(verbose, mctx, &log); - - dns_diff_init(mctx, &diff); - rdclass = 0; - - ISC_LIST_INIT(keylist); - - for (i = 0; i < argc; i++) { - char namestr[DNS_NAME_FORMATSIZE]; - isc_buffer_t namebuf; - - key = NULL; - result = dst_key_fromnamedfile(argv[i], DST_TYPE_PUBLIC, - mctx, &key); - if (result != ISC_R_SUCCESS) - fatal("error loading key from %s: %s", argv[i], - isc_result_totext(result)); - if (rdclass == 0) - rdclass = dst_key_class(key); - - isc_buffer_init(&namebuf, namestr, sizeof(namestr)); - result = dns_name_tofilenametext(dst_key_name(key), - ISC_FALSE, - &namebuf); - check_result(result, "dns_name_tofilenametext"); - isc_buffer_putuint8(&namebuf, 0); - - if (domain == NULL) { - dns_fixedname_init(&fdomain); - domain = dns_fixedname_name(&fdomain); - dns_name_copy(dst_key_name(key), domain, NULL); - } else if (!dns_name_equal(domain, dst_key_name(key))) { - char str[DNS_NAME_FORMATSIZE]; - dns_name_format(domain, str, sizeof(str)); - fatal("all keys must have the same owner - %s " - "and %s do not match", str, namestr); - } - - if (output == NULL) { - output = isc_mem_allocate(mctx, - strlen("keyset-") + - strlen(namestr) + 1); - if (output == NULL) - fatal("out of memory"); - sprintf(output, "keyset-%s", namestr); - } - - if (dst_key_iszonekey(key)) { - dst_key_t *zonekey = NULL; - result = dst_key_fromnamedfile(argv[i], - DST_TYPE_PUBLIC | - DST_TYPE_PRIVATE, - mctx, &zonekey); - if (result != ISC_R_SUCCESS) - fatal("failed to read private key %s: %s", - argv[i], isc_result_totext(result)); - if (!zonekey_on_list(zonekey)) { - keynode = isc_mem_get(mctx, sizeof(keynode_t)); - if (keynode == NULL) - fatal("out of memory"); - keynode->key = zonekey; - ISC_LIST_INITANDAPPEND(keylist, keynode, link); - } else - dst_key_free(&zonekey); - } - dns_rdata_reset(&rdata); - isc_buffer_init(&b, data, sizeof(data)); - result = dst_key_todns(key, &b); - dst_key_free(&key); - if (result != ISC_R_SUCCESS) - fatal("failed to convert key %s to a DNS KEY: %s", - argv[i], isc_result_totext(result)); - isc_buffer_usedregion(&b, &r); - dns_rdata_fromregion(&rdata, rdclass, dns_rdatatype_dnskey, &r); - tuple = NULL; - result = dns_difftuple_create(mctx, DNS_DIFFOP_ADD, - domain, ttl, &rdata, &tuple); - check_result(result, "dns_difftuple_create"); - dns_diff_append(&diff, &tuple); - } - - db = NULL; - result = dns_db_create(mctx, "rbt", dns_rootname, dns_dbtype_zone, - rdclass, 0, NULL, &db); - if (result != ISC_R_SUCCESS) - fatal("failed to create a database"); - - version = NULL; - dns_db_newversion(db, &version); - - result = dns_diff_apply(&diff, db, version); - check_result(result, "dns_diff_apply"); - dns_diff_clear(&diff); - - dns_fixedname_init(&tname); - dns_rdataset_init(&rdataset); - result = dns_db_find(db, domain, version, dns_rdatatype_dnskey, 0, 0, - NULL, dns_fixedname_name(&tname), &rdataset, - NULL); - check_result(result, "dns_db_find"); - - if (ISC_LIST_EMPTY(keylist)) - fprintf(stderr, - "%s: no private zone key found; not self-signing\n", - program); - for (keynode = ISC_LIST_HEAD(keylist); - keynode != NULL; - keynode = ISC_LIST_NEXT(keynode, link)) - { - dns_rdata_reset(&rdata); - isc_buffer_init(&b, data, sizeof(data)); - result = dns_dnssec_sign(domain, &rdataset, keynode->key, - &starttime, &endtime, mctx, &b, - &rdata); - isc_entropy_stopcallbacksources(ectx); - if (result != ISC_R_SUCCESS) { - char keystr[KEY_FORMATSIZE]; - key_format(keynode->key, keystr, sizeof(keystr)); - fatal("failed to sign keyset with key %s: %s", - keystr, isc_result_totext(result)); - } - if (tryverify) { - result = dns_dnssec_verify(domain, &rdataset, - keynode->key, ISC_TRUE, - mctx, &rdata); - if (result != ISC_R_SUCCESS) { - char keystr[KEY_FORMATSIZE]; - key_format(keynode->key, keystr, sizeof(keystr)); - fatal("signature from key '%s' failed to " - "verify: %s", - keystr, isc_result_totext(result)); - } - } - tuple = NULL; - result = dns_difftuple_create(mctx, DNS_DIFFOP_ADD, - domain, ttl, &rdata, &tuple); - check_result(result, "dns_difftuple_create"); - dns_diff_append(&diff, &tuple); - } - - result = dns_diff_apply(&diff, db, version); - check_result(result, "dns_diff_apply"); - dns_diff_clear(&diff); - - dns_rdataset_disassociate(&rdataset); - - dns_db_closeversion(db, &version, ISC_TRUE); - result = dns_db_dump(db, version, output); - if (result != ISC_R_SUCCESS) { - char domainstr[DNS_NAME_FORMATSIZE]; - dns_name_format(domain, domainstr, sizeof(domainstr)); - fatal("failed to write database for %s to %s", - domainstr, output); - } - - printf("%s\n", output); - - dns_db_detach(&db); - - while (!ISC_LIST_EMPTY(keylist)) { - keynode = ISC_LIST_HEAD(keylist); - ISC_LIST_UNLINK(keylist, keynode, link); - dst_key_free(&keynode->key); - isc_mem_put(mctx, keynode, sizeof(keynode_t)); - } - - cleanup_logging(&log); - cleanup_entropy(&ectx); - - isc_mem_free(mctx, output); - dst_lib_destroy(); - if (verbose > 10) - isc_mem_stats(mctx, stdout); - isc_mem_destroy(&mctx); - return (0); -} diff --git a/bin/dnssec/dnssec-makekeyset.docbook b/bin/dnssec/dnssec-makekeyset.docbook deleted file mode 100644 index 6ed358e996..0000000000 --- a/bin/dnssec/dnssec-makekeyset.docbook +++ /dev/null @@ -1,233 +0,0 @@ - - - - - - - - June 30, 2000 - - - - dnssec-makekeyset - 8 - BIND9 - - - - dnssec-makekeyset - DNSSEC zone signing tool - - - - - dnssec-makekeyset - - - - - - - ttl - - key - - - - - DESCRIPTION - - dnssec-makekeyset generates a key set from one - or more keys created by dnssec-keygen. It creates - a file containing a KEY record for each key, and self-signs the key - set with each zone key. The output file is of the form - keyset-nnnn., where nnnn - is the zone name. - - - - - OPTIONS - - - - -a - - - Verify all generated signatures. - - - - - - -s start-time - - - Specify the date and time when the generated SIG records - become valid. This can be either an absolute or relative - time. An absolute start time is indicated by a number - in YYYYMMDDHHMMSS notation; 20000530144500 denotes - 14:45:00 UTC on May 30th, 2000. A relative start time is - indicated by +N, which is N seconds from the current time. - If no is specified, the current - time is used. - - - - - - -e end-time - - - Specify the date and time when the generated SIG records - expire. As with , an absolute - time is indicated in YYYYMMDDHHMMSS notation. A time relative - to the start time is indicated with +N, which is N seconds from - the start time. A time relative to the current time is - indicated with now+N. If no is - specified, 30 days from the start time is used as a default. - - - - - - -h - - - Prints a short summary of the options and arguments to - dnssec-makekeyset. - - - - - - -p - - - Use pseudo-random data when signing the zone. This is faster, - but less secure, than using real random data. This option - may be useful when signing large zones or when the entropy - source is limited. - - - - - - -r randomdev - - - Specifies the source of randomness. If the operating - system does not provide a /dev/random - or equivalent device, the default source of randomness - is keyboard input. randomdev specifies - the name of a character device or file containing random - data to be used instead of the default. The special value - keyboard indicates that keyboard - input should be used. - - - - - - -t ttl - - - Specify the TTL (time to live) of the KEY and SIG records. - The default is 3600 seconds. - - - - - - -v level - - - Sets the debugging level. - - - - - - key - - - The list of keys to be included in the keyset file. These keys - are expressed in the form Knnnn.+aaa+iiiii - as generated by dnssec-keygen. - - - - - - - - - EXAMPLE - - The following command generates a keyset containing the DSA key for - example.com generated in the - dnssec-keygen man page. - - - dnssec-makekeyset -t 86400 -s 20000701120000 -e +2592000 Kexample.com.+003+26160 - - - In this example, dnssec-makekeyset creates - the file keyset-example.com.. This file - contains the specified key and a self-generated signature. - - - The DNS administrator for example.com could - send keyset-example.com. to the DNS - administrator for .com for signing, if the - .com zone is DNSSEC-aware and the administrators of the two zones - have some mechanism for authenticating each other and exchanging - the keys and signatures securely. - - - - - SEE ALSO - - - dnssec-keygen - 8 - , - - dnssec-signkey - 8 - , - BIND 9 Administrator Reference Manual, - RFC 2535. - - - - - AUTHOR - - Internet Systems Consortium - - - - - - diff --git a/bin/dnssec/dnssec-makekeyset.html b/bin/dnssec/dnssec-makekeyset.html deleted file mode 100644 index 44f1f0aaf3..0000000000 --- a/bin/dnssec/dnssec-makekeyset.html +++ /dev/null @@ -1,407 +0,0 @@ - - - - -dnssec-makekeyset

dnssec-makekeyset

Name

dnssec-makekeyset -- DNSSEC zone signing tool

Synopsis

dnssec-makekeyset [-a] [-s start-time] [-e end-time] [-h] [-p] [-r randomdev] [-tttl] [-v level] {key...}

DESCRIPTION

dnssec-makekeyset generates a key set from one - or more keys created by dnssec-keygen. It creates - a file containing a KEY record for each key, and self-signs the key - set with each zone key. The output file is of the form - keyset-nnnn., where nnnn - is the zone name. -

OPTIONS

-a

Verify all generated signatures. -

-s start-time

Specify the date and time when the generated SIG records - become valid. This can be either an absolute or relative - time. An absolute start time is indicated by a number - in YYYYMMDDHHMMSS notation; 20000530144500 denotes - 14:45:00 UTC on May 30th, 2000. A relative start time is - indicated by +N, which is N seconds from the current time. - If no start-time is specified, the current - time is used. -

-e end-time

Specify the date and time when the generated SIG records - expire. As with start-time, an absolute - time is indicated in YYYYMMDDHHMMSS notation. A time relative - to the start time is indicated with +N, which is N seconds from - the start time. A time relative to the current time is - indicated with now+N. If no end-time is - specified, 30 days from the start time is used as a default. -

-h

Prints a short summary of the options and arguments to - dnssec-makekeyset. -

-p

Use pseudo-random data when signing the zone. This is faster, - but less secure, than using real random data. This option - may be useful when signing large zones or when the entropy - source is limited. -

-r randomdev

Specifies the source of randomness. If the operating - system does not provide a /dev/random - or equivalent device, the default source of randomness - is keyboard input. randomdev specifies - the name of a character device or file containing random - data to be used instead of the default. The special value - keyboard indicates that keyboard - input should be used. -

-t ttl

Specify the TTL (time to live) of the KEY and SIG records. - The default is 3600 seconds. -

-v level

Sets the debugging level. -

key

The list of keys to be included in the keyset file. These keys - are expressed in the form Knnnn.+aaa+iiiii - as generated by dnssec-keygen. -

EXAMPLE

The following command generates a keyset containing the DSA key for - example.com generated in the - dnssec-keygen man page. -

dnssec-makekeyset -t 86400 -s 20000701120000 -e +2592000 Kexample.com.+003+26160 -

In this example, dnssec-makekeyset creates - the file keyset-example.com.. This file - contains the specified key and a self-generated signature. -

The DNS administrator for example.com could - send keyset-example.com. to the DNS - administrator for .com for signing, if the - .com zone is DNSSEC-aware and the administrators of the two zones - have some mechanism for authenticating each other and exchanging - the keys and signatures securely. -

SEE ALSO

dnssec-keygen(8), - dnssec-signkey(8), - BIND 9 Administrator Reference Manual, - RFC 2535. -

AUTHOR

Internet Software Consortium -

diff --git a/bin/dnssec/dnssec-signkey.8 b/bin/dnssec/dnssec-signkey.8 deleted file mode 100644 index c35df6aa76..0000000000 --- a/bin/dnssec/dnssec-signkey.8 +++ /dev/null @@ -1,108 +0,0 @@ -.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC") -.\" Copyright (C) 2000, 2001, 2003 Internet Software Consortium. -.\" -.\" Permission to use, copy, modify, and distribute this software for any -.\" purpose with or without fee is hereby granted, provided that the above -.\" copyright notice and this permission notice appear in all copies. -.\" -.\" THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH -.\" REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -.\" AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, -.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM -.\" LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE -.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR -.\" PERFORMANCE OF THIS SOFTWARE. -.\" -.\" $Id: dnssec-signkey.8,v 1.18.2.1.4.2 2005/04/07 03:22:22 marka Exp $ -.\" -.TH "DNSSEC-SIGNKEY" "8" "June 30, 2000" "BIND9" "" -.SH NAME -dnssec-signkey \- DNSSEC key set signing tool -.SH SYNOPSIS -.sp -\fBdnssec-signkey\fR [ \fB-a\fR ] [ \fB-c \fIclass\fB\fR ] [ \fB-s \fIstart-time\fB\fR ] [ \fB-e \fIend-time\fB\fR ] [ \fB-h\fR ] [ \fB-p\fR ] [ \fB-r \fIrandomdev\fB\fR ] [ \fB-v \fIlevel\fB\fR ] \fBkeyset\fR \fBkey\fR\fI...\fR -.SH "DESCRIPTION" -.PP -\fBdnssec-signkey\fR signs a keyset. Typically -the keyset will be for a child zone, and will have been generated -by \fBdnssec-makekeyset\fR. The child zone's keyset -is signed with the zone keys for its parent zone. The output file -is of the form \fIsignedkey-nnnn.\fR, where -\fInnnn\fR is the zone name. -.SH "OPTIONS" -.TP -\fB-a\fR -Verify all generated signatures. -.TP -\fB-c \fIclass\fB\fR -Specifies the DNS class of the key sets. -.TP -\fB-s \fIstart-time\fB\fR -Specify the date and time when the generated SIG records -become valid. This can be either an absolute or relative -time. An absolute start time is indicated by a number -in YYYYMMDDHHMMSS notation; 20000530144500 denotes -14:45:00 UTC on May 30th, 2000. A relative start time is -indicated by +N, which is N seconds from the current time. -If no \fBstart-time\fR is specified, the current -time is used. -.TP -\fB-e \fIend-time\fB\fR -Specify the date and time when the generated SIG records -expire. As with \fBstart-time\fR, an absolute -time is indicated in YYYYMMDDHHMMSS notation. A time relative -to the start time is indicated with +N, which is N seconds from -the start time. A time relative to the current time is -indicated with now+N. If no \fBend-time\fR is -specified, 30 days from the start time is used as a default. -.TP -\fB-h\fR -Prints a short summary of the options and arguments to -\fBdnssec-signkey\fR. -.TP -\fB-p\fR -Use pseudo-random data when signing the zone. This is faster, -but less secure, than using real random data. This option -may be useful when signing large zones or when the entropy -source is limited. -.TP -\fB-r \fIrandomdev\fB\fR -Specifies the source of randomness. If the operating -system does not provide a \fI/dev/random\fR -or equivalent device, the default source of randomness -is keyboard input. \fIrandomdev\fR specifies -the name of a character device or file containing random -data to be used instead of the default. The special value -\fIkeyboard\fR indicates that keyboard -input should be used. -.TP -\fB-v \fIlevel\fB\fR -Sets the debugging level. -.TP -\fBkeyset\fR -The file containing the child's keyset. -.TP -\fBkey\fR -The keys used to sign the child's keyset. -.SH "EXAMPLE" -.PP -The DNS administrator for a DNSSEC-aware \fB.com\fR -zone would use the following command to sign the -\fIkeyset\fR file for \fBexample.com\fR -created by \fBdnssec-makekeyset\fR with a key generated -by \fBdnssec-keygen\fR: -.PP -\fBdnssec-signkey keyset-example.com. Kcom.+003+51944\fR -.PP -In this example, \fBdnssec-signkey\fR creates -the file \fIsignedkey-example.com.\fR, which -contains the \fBexample.com\fR keys and the -signatures by the \fB.com\fR keys. -.SH "SEE ALSO" -.PP -\fBdnssec-keygen\fR(8), -\fBdnssec-makekeyset\fR(8), -\fBdnssec-signzone\fR(8). -.SH "AUTHOR" -.PP -Internet Software Consortium diff --git a/bin/dnssec/dnssec-signkey.c b/bin/dnssec/dnssec-signkey.c deleted file mode 100644 index fd8b0fd322..0000000000 --- a/bin/dnssec/dnssec-signkey.c +++ /dev/null @@ -1,448 +0,0 @@ -/* - * Portions Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") - * Portions Copyright (C) 2000-2003 Internet Software Consortium. - * Portions Copyright (C) 1995-2000 by Network Associates, Inc. - * - * Permission to use, copy, modify, and distribute this software for any - * purpose with or without fee is hereby granted, provided that the above - * copyright notice and this permission notice appear in all copies. - * - * THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NETWORK ASSOCIATES DISCLAIMS - * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED - * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE - * FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES - * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN - * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR - * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. - */ - -/* $Id: dnssec-signkey.c,v 1.50.2.2.2.7 2004/08/28 06:25:28 marka Exp $ */ - -#include - -#include - -#include -#include -#include -#include -#include -#include - -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - -#include - -#include "dnssectool.h" - -const char *program = "dnssec-signkey"; -int verbose; - -typedef struct keynode keynode_t; -struct keynode { - dst_key_t *key; - isc_boolean_t verified; - ISC_LINK(keynode_t) link; -}; -typedef ISC_LIST(keynode_t) keylist_t; - -static isc_stdtime_t starttime = 0, endtime = 0, now; - -static isc_mem_t *mctx = NULL; -static isc_entropy_t *ectx = NULL; -static keylist_t keylist; - -static void -usage(void) { - fprintf(stderr, "Usage:\n"); - fprintf(stderr, "\t%s [options] keyset keys\n", program); - - fprintf(stderr, "\n"); - - fprintf(stderr, "Version: %s\n", VERSION); - - fprintf(stderr, "Options: (default value in parenthesis) \n"); - fprintf(stderr, "\t-a\n"); - fprintf(stderr, "\t\tverify generated signatures\n"); - fprintf(stderr, "\t-c class (IN)\n"); - fprintf(stderr, "\t-s YYYYMMDDHHMMSS|+offset:\n"); - fprintf(stderr, "\t\tSIG start time - absolute|offset (from keyset)\n"); - fprintf(stderr, "\t-e YYYYMMDDHHMMSS|+offset|\"now\"+offset]:\n"); - fprintf(stderr, "\t\tSIG end time - absolute|from start|from now " - "(from keyset)\n"); - fprintf(stderr, "\t-v level:\n"); - fprintf(stderr, "\t\tverbose level (0)\n"); - fprintf(stderr, "\t-p\n"); - fprintf(stderr, "\t\tuse pseudorandom data (faster but less secure)\n"); - fprintf(stderr, "\t-r randomdev:\n"); - fprintf(stderr, "\t\ta file containing random data\n"); - - fprintf(stderr, "\n"); - - fprintf(stderr, "keyset:\n"); - fprintf(stderr, "\tfile with keyset to be signed (keyset-)\n"); - fprintf(stderr, "keys:\n"); - fprintf(stderr, "\tkeyfile (Kname+alg+tag)\n"); - - fprintf(stderr, "\n"); - fprintf(stderr, "Output:\n"); - fprintf(stderr, "\tsigned keyset (signedkey-)\n"); - exit(0); -} - -static void -loadkeys(dns_name_t *name, dns_rdataset_t *rdataset) { - dst_key_t *key; - dns_rdata_t rdata = DNS_RDATA_INIT; - keynode_t *keynode; - isc_result_t result; - - ISC_LIST_INIT(keylist); - result = dns_rdataset_first(rdataset); - check_result(result, "dns_rdataset_first"); - for (; result == ISC_R_SUCCESS; result = dns_rdataset_next(rdataset)) { - dns_rdata_reset(&rdata); - dns_rdataset_current(rdataset, &rdata); - key = NULL; - result = dns_dnssec_keyfromrdata(name, &rdata, mctx, &key); - if (result != ISC_R_SUCCESS) - continue; - if (!dst_key_iszonekey(key)) { - dst_key_free(&key); - continue; - } - keynode = isc_mem_get(mctx, sizeof(keynode_t)); - if (keynode == NULL) - fatal("out of memory"); - keynode->key = key; - keynode->verified = ISC_FALSE; - ISC_LIST_INITANDAPPEND(keylist, keynode, link); - } - if (result != ISC_R_NOMORE) - fatal("failure traversing key list"); -} - -static dst_key_t * -findkey(dns_rdata_rrsig_t *sig) { - keynode_t *keynode; - for (keynode = ISC_LIST_HEAD(keylist); - keynode != NULL; - keynode = ISC_LIST_NEXT(keynode, link)) - { - if (dst_key_id(keynode->key) == sig->keyid && - dst_key_alg(keynode->key) == sig->algorithm) { - keynode->verified = ISC_TRUE; - return (keynode->key); - } - } - fatal("signature generated by non-zone or missing key"); - return (NULL); -} - -int -main(int argc, char *argv[]) { - int i, ch; - char *startstr = NULL, *endstr = NULL, *classname = NULL; - char tdomain[1025]; - dns_fixedname_t fdomain; - dns_name_t *domain; - char *output = NULL; - char *endp; - unsigned char data[65536]; - dns_db_t *db; - dns_dbnode_t *node; - dns_dbversion_t *version; - dns_diff_t diff; - dns_difftuple_t *tuple; - dns_dbiterator_t *dbiter; - dns_rdatasetiter_t *rdsiter; - dst_key_t *key = NULL; - dns_rdata_t rdata = DNS_RDATA_INIT; - dns_rdata_t sigrdata = DNS_RDATA_INIT; - dns_rdataset_t rdataset, sigrdataset; - dns_rdata_rrsig_t sig; - isc_result_t result; - isc_buffer_t b; - isc_log_t *log = NULL; - keynode_t *keynode; - isc_boolean_t pseudorandom = ISC_FALSE; - unsigned int eflags; - dns_rdataclass_t rdclass; - isc_boolean_t tryverify = ISC_FALSE; - isc_boolean_t settime = ISC_FALSE; - - result = isc_mem_create(0, 0, &mctx); - check_result(result, "isc_mem_create()"); - - dns_result_register(); - - while ((ch = isc_commandline_parse(argc, argv, "ac:s:e:pr:v:h")) != -1) - { - switch (ch) { - case 'a': - tryverify = ISC_TRUE; - break; - case 'c': - classname = isc_commandline_argument; - break; - - case 's': - startstr = isc_commandline_argument; - break; - - case 'e': - endstr = isc_commandline_argument; - break; - - case 'p': - pseudorandom = ISC_TRUE; - break; - - case 'r': - setup_entropy(mctx, isc_commandline_argument, &ectx); - break; - - case 'v': - endp = NULL; - verbose = strtol(isc_commandline_argument, &endp, 0); - if (*endp != '\0') - fatal("verbose level must be numeric"); - break; - - case 'h': - default: - usage(); - - } - } - - argc -= isc_commandline_index; - argv += isc_commandline_index; - - if (argc < 2) - usage(); - - rdclass = strtoclass(classname); - - if (ectx == NULL) - setup_entropy(mctx, NULL, &ectx); - eflags = ISC_ENTROPY_BLOCKING; - if (!pseudorandom) - eflags |= ISC_ENTROPY_GOODONLY; - result = dst_lib_init(mctx, ectx, eflags); - if (result != ISC_R_SUCCESS) - fatal("could not initialize dst: %s", - isc_result_totext(result)); - - isc_stdtime_get(&now); - - if ((startstr == NULL || endstr == NULL) && - !(startstr == NULL && endstr == NULL)) - fatal("if -s or -e is specified, both must be"); - - if (startstr != NULL) { - starttime = strtotime(startstr, now, now); - endtime = strtotime(endstr, now, starttime); - settime = ISC_TRUE; - } - - setup_logging(verbose, mctx, &log); - - if (strlen(argv[0]) < 8U || strncmp(argv[0], "keyset-", 7) != 0) - fatal("keyset file '%s' must start with keyset-", argv[0]); - - db = NULL; - result = dns_db_create(mctx, "rbt", dns_rootname, dns_dbtype_zone, - rdclass, 0, NULL, &db); - check_result(result, "dns_db_create()"); - - result = dns_db_load(db, argv[0]); - if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE) - fatal("failed to load database from '%s': %s", argv[0], - isc_result_totext(result)); - - dns_fixedname_init(&fdomain); - domain = dns_fixedname_name(&fdomain); - - dbiter = NULL; - result = dns_db_createiterator(db, ISC_FALSE, &dbiter); - check_result(result, "dns_db_createiterator()"); - - result = dns_dbiterator_first(dbiter); - check_result(result, "dns_dbiterator_first()"); - while (result == ISC_R_SUCCESS) { - node = NULL; - dns_dbiterator_current(dbiter, &node, domain); - rdsiter = NULL; - result = dns_db_allrdatasets(db, node, NULL, 0, &rdsiter); - check_result(result, "dns_db_allrdatasets()"); - result = dns_rdatasetiter_first(rdsiter); - dns_rdatasetiter_destroy(&rdsiter); - if (result == ISC_R_SUCCESS) - break; - dns_db_detachnode(db, &node); - result = dns_dbiterator_next(dbiter); - } - dns_dbiterator_destroy(&dbiter); - if (result != ISC_R_SUCCESS) - fatal("failed to find data in keyset file"); - - isc_buffer_init(&b, tdomain, sizeof(tdomain) - 1); - result = dns_name_tofilenametext(domain, ISC_FALSE, &b); - check_result(result, "dns_name_tofilenametext()"); - isc_buffer_putuint8(&b, 0); - - output = isc_mem_allocate(mctx, - strlen("signedkey-") + strlen(tdomain) + 1); - if (output == NULL) - fatal("out of memory"); - sprintf(output, "signedkey-%s", tdomain); - - version = NULL; - dns_db_newversion(db, &version); - - dns_rdataset_init(&rdataset); - dns_rdataset_init(&sigrdataset); - result = dns_db_findrdataset(db, node, version, dns_rdatatype_dnskey, 0, - 0, &rdataset, &sigrdataset); - if (result != ISC_R_SUCCESS) { - char domainstr[DNS_NAME_FORMATSIZE]; - dns_name_format(domain, domainstr, sizeof(domainstr)); - fatal("failed to find rdataset '%s KEY': %s", - domainstr, isc_result_totext(result)); - } - - loadkeys(domain, &rdataset); - - dns_diff_init(mctx, &diff); - - if (!dns_rdataset_isassociated(&sigrdataset)) - fatal("no SIG KEY set present"); - - result = dns_rdataset_first(&sigrdataset); - check_result(result, "dns_rdataset_first()"); - do { - dns_rdataset_current(&sigrdataset, &sigrdata); - result = dns_rdata_tostruct(&sigrdata, &sig, mctx); - check_result(result, "dns_rdata_tostruct()"); - key = findkey(&sig); - result = dns_dnssec_verify(domain, &rdataset, key, - ISC_TRUE, mctx, &sigrdata); - if (result != ISC_R_SUCCESS) { - char keystr[KEY_FORMATSIZE]; - key_format(key, keystr, sizeof(keystr)); - fatal("signature by key '%s' did not verify: %s", - keystr, isc_result_totext(result)); - } - if (!settime) { - starttime = sig.timesigned; - endtime = sig.timeexpire; - settime = ISC_TRUE; - } - dns_rdata_freestruct(&sig); - dns_rdata_reset(&sigrdata); - result = dns_rdataset_next(&sigrdataset); - } while (result == ISC_R_SUCCESS); - - for (keynode = ISC_LIST_HEAD(keylist); - keynode != NULL; - keynode = ISC_LIST_NEXT(keynode, link)) - if (!keynode->verified) - fatal("not all zone keys self signed the key set"); - - argc -= 1; - argv += 1; - - for (i = 0; i < argc; i++) { - key = NULL; - result = dst_key_fromnamedfile(argv[i], - DST_TYPE_PUBLIC | - DST_TYPE_PRIVATE, - mctx, &key); - if (result != ISC_R_SUCCESS) - fatal("failed to read key %s from disk: %s", - argv[i], isc_result_totext(result)); - - dns_rdata_reset(&rdata); - isc_buffer_init(&b, data, sizeof(data)); - result = dns_dnssec_sign(domain, &rdataset, key, - &starttime, &endtime, - mctx, &b, &rdata); - isc_entropy_stopcallbacksources(ectx); - if (result != ISC_R_SUCCESS) { - char keystr[KEY_FORMATSIZE]; - key_format(key, keystr, sizeof(keystr)); - fatal("key '%s' failed to sign data: %s", - keystr, isc_result_totext(result)); - } - if (tryverify) { - result = dns_dnssec_verify(domain, &rdataset, key, - ISC_TRUE, mctx, &rdata); - if (result != ISC_R_SUCCESS) { - char keystr[KEY_FORMATSIZE]; - key_format(key, keystr, sizeof(keystr)); - fatal("signature from key '%s' failed to " - "verify: %s", - keystr, isc_result_totext(result)); - } - } - tuple = NULL; - result = dns_difftuple_create(mctx, DNS_DIFFOP_ADD, - domain, rdataset.ttl, - &rdata, &tuple); - check_result(result, "dns_difftuple_create"); - dns_diff_append(&diff, &tuple); - dst_key_free(&key); - } - - result = dns_db_deleterdataset(db, node, version, dns_rdatatype_rrsig, - dns_rdatatype_dnskey); - check_result(result, "dns_db_deleterdataset"); - - result = dns_diff_apply(&diff, db, version); - check_result(result, "dns_diff_apply"); - dns_diff_clear(&diff); - - dns_db_detachnode(db, &node); - dns_db_closeversion(db, &version, ISC_TRUE); - result = dns_db_dump(db, version, output); - if (result != ISC_R_SUCCESS) - fatal("failed to write database to '%s': %s", - output, isc_result_totext(result)); - - printf("%s\n", output); - - dns_rdataset_disassociate(&rdataset); - dns_rdataset_disassociate(&sigrdataset); - - dns_db_detach(&db); - - while (!ISC_LIST_EMPTY(keylist)) { - keynode = ISC_LIST_HEAD(keylist); - ISC_LIST_UNLINK(keylist, keynode, link); - dst_key_free(&keynode->key); - isc_mem_put(mctx, keynode, sizeof(keynode_t)); - } - - cleanup_logging(&log); - - isc_mem_free(mctx, output); - cleanup_entropy(&ectx); - dst_lib_destroy(); - if (verbose > 10) - isc_mem_stats(mctx, stdout); - isc_mem_destroy(&mctx); - return (0); -} diff --git a/bin/dnssec/dnssec-signkey.docbook b/bin/dnssec/dnssec-signkey.docbook deleted file mode 100644 index 8c00f3620d..0000000000 --- a/bin/dnssec/dnssec-signkey.docbook +++ /dev/null @@ -1,237 +0,0 @@ - - - - - - - - June 30, 2000 - - - - dnssec-signkey - 8 - BIND9 - - - - dnssec-signkey - DNSSEC key set signing tool - - - - - dnssec-signkey - - - - - - - - - keyset - key - - - - - DESCRIPTION - - dnssec-signkey signs a keyset. Typically - the keyset will be for a child zone, and will have been generated - by dnssec-makekeyset. The child zone's keyset - is signed with the zone keys for its parent zone. The output file - is of the form signedkey-nnnn., where - nnnn is the zone name. - - - - - OPTIONS - - - - -a - - - Verify all generated signatures. - - - - - - -c class - - - Specifies the DNS class of the key sets. - - - - - - -s start-time - - - Specify the date and time when the generated SIG records - become valid. This can be either an absolute or relative - time. An absolute start time is indicated by a number - in YYYYMMDDHHMMSS notation; 20000530144500 denotes - 14:45:00 UTC on May 30th, 2000. A relative start time is - indicated by +N, which is N seconds from the current time. - If no is specified, the current - time is used. - - - - - - -e end-time - - - Specify the date and time when the generated SIG records - expire. As with , an absolute - time is indicated in YYYYMMDDHHMMSS notation. A time relative - to the start time is indicated with +N, which is N seconds from - the start time. A time relative to the current time is - indicated with now+N. If no is - specified, 30 days from the start time is used as a default. - - - - - - -h - - - Prints a short summary of the options and arguments to - dnssec-signkey. - - - - - - -p - - - Use pseudo-random data when signing the zone. This is faster, - but less secure, than using real random data. This option - may be useful when signing large zones or when the entropy - source is limited. - - - - - - -r randomdev - - - Specifies the source of randomness. If the operating - system does not provide a /dev/random - or equivalent device, the default source of randomness - is keyboard input. randomdev specifies - the name of a character device or file containing random - data to be used instead of the default. The special value - keyboard indicates that keyboard - input should be used. - - - - - - -v level - - - Sets the debugging level. - - - - - - keyset - - - The file containing the child's keyset. - - - - - - key - - - The keys used to sign the child's keyset. - - - - - - - - - EXAMPLE - - The DNS administrator for a DNSSEC-aware .com - zone would use the following command to sign the - keyset file for example.com - created by dnssec-makekeyset with a key generated - by dnssec-keygen: - - - dnssec-signkey keyset-example.com. Kcom.+003+51944 - - - In this example, dnssec-signkey creates - the file signedkey-example.com., which - contains the example.com keys and the - signatures by the .com keys. - - - - - SEE ALSO - - - dnssec-keygen - 8 - , - - dnssec-makekeyset - 8 - , - - dnssec-signzone - 8 - . - - - - - AUTHOR - - Internet Systems Consortium - - - - - - diff --git a/bin/dnssec/dnssec-signkey.html b/bin/dnssec/dnssec-signkey.html deleted file mode 100644 index c25aa08687..0000000000 --- a/bin/dnssec/dnssec-signkey.html +++ /dev/null @@ -1,407 +0,0 @@ - - - - -dnssec-signkey

dnssec-signkey

Name

dnssec-signkey -- DNSSEC key set signing tool

Synopsis

dnssec-signkey [-a] [-c class] [-s start-time] [-e end-time] [-h] [-p] [-r randomdev] [-v level] {keyset} {key...}

DESCRIPTION

dnssec-signkey signs a keyset. Typically - the keyset will be for a child zone, and will have been generated - by dnssec-makekeyset. The child zone's keyset - is signed with the zone keys for its parent zone. The output file - is of the form signedkey-nnnn., where - nnnn is the zone name. -

OPTIONS

-a

Verify all generated signatures. -

-c class

Specifies the DNS class of the key sets. -

-s start-time

Specify the date and time when the generated SIG records - become valid. This can be either an absolute or relative - time. An absolute start time is indicated by a number - in YYYYMMDDHHMMSS notation; 20000530144500 denotes - 14:45:00 UTC on May 30th, 2000. A relative start time is - indicated by +N, which is N seconds from the current time. - If no start-time is specified, the current - time is used. -

-e end-time

Specify the date and time when the generated SIG records - expire. As with start-time, an absolute - time is indicated in YYYYMMDDHHMMSS notation. A time relative - to the start time is indicated with +N, which is N seconds from - the start time. A time relative to the current time is - indicated with now+N. If no end-time is - specified, 30 days from the start time is used as a default. -

-h

Prints a short summary of the options and arguments to - dnssec-signkey. -

-p

Use pseudo-random data when signing the zone. This is faster, - but less secure, than using real random data. This option - may be useful when signing large zones or when the entropy - source is limited. -

-r randomdev

Specifies the source of randomness. If the operating - system does not provide a /dev/random - or equivalent device, the default source of randomness - is keyboard input. randomdev specifies - the name of a character device or file containing random - data to be used instead of the default. The special value - keyboard indicates that keyboard - input should be used. -

-v level

Sets the debugging level. -

keyset

The file containing the child's keyset. -

key

The keys used to sign the child's keyset. -

EXAMPLE

The DNS administrator for a DNSSEC-aware .com - zone would use the following command to sign the - keyset file for example.com - created by dnssec-makekeyset with a key generated - by dnssec-keygen: -

dnssec-signkey keyset-example.com. Kcom.+003+51944 -

In this example, dnssec-signkey creates - the file signedkey-example.com., which - contains the example.com keys and the - signatures by the .com keys. -

SEE ALSO

dnssec-keygen(8), - dnssec-makekeyset(8), - dnssec-signzone(8). -

AUTHOR

Internet Software Consortium -