4419606c9d
Move BIND binaries which are neither daemons nor administrative programs to $bindir. This results in only the following binaries being left in $sbindir: - ddns-confgen - named - rndc - rndc-confgen - tsig-confgen
282 lines
11 KiB
Plaintext
282 lines
11 KiB
Plaintext
.\" Man page generated from reStructuredText.
|
|
.
|
|
.TH "DNSSEC-KEYFROMLABEL" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
|
|
.SH NAME
|
|
dnssec-keyfromlabel \- DNSSEC key generation tool
|
|
.
|
|
.nr rst2man-indent-level 0
|
|
.
|
|
.de1 rstReportMargin
|
|
\\$1 \\n[an-margin]
|
|
level \\n[rst2man-indent-level]
|
|
level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
|
-
|
|
\\n[rst2man-indent0]
|
|
\\n[rst2man-indent1]
|
|
\\n[rst2man-indent2]
|
|
..
|
|
.de1 INDENT
|
|
.\" .rstReportMargin pre:
|
|
. RS \\$1
|
|
. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
|
|
. nr rst2man-indent-level +1
|
|
.\" .rstReportMargin post:
|
|
..
|
|
.de UNINDENT
|
|
. RE
|
|
.\" indent \\n[an-margin]
|
|
.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
|
.nr rst2man-indent-level -1
|
|
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
|
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
|
|
..
|
|
.SH SYNOPSIS
|
|
.sp
|
|
\fBdnssec\-keyfromlabel\fP {\fB\-l\fP label} [\fB\-3\fP] [\fB\-a\fP algorithm] [\fB\-A\fP date/offset] [\fB\-c\fP class] [\fB\-D\fP date/offset] [\fB\-D\fP sync date/offset] [\fB\-E\fP engine] [\fB\-f\fP flag] [\fB\-G\fP] [\fB\-I\fP date/offset] [\fB\-i\fP interval] [\fB\-k\fP] [\fB\-K\fP directory] [\fB\-L\fP ttl] [\fB\-n\fP nametype] [\fB\-P\fP date/offset] [\fB\-P\fP sync date/offset] [\fB\-p\fP protocol] [\fB\-R\fP date/offset] [\fB\-S\fP key] [\fB\-t\fP type] [\fB\-v\fP level] [\fB\-V\fP] [\fB\-y\fP] {name}
|
|
.SH DESCRIPTION
|
|
.sp
|
|
\fBdnssec\-keyfromlabel\fP generates a key pair of files that referencing a
|
|
key object stored in a cryptographic hardware service module (HSM). The
|
|
private key file can be used for DNSSEC signing of zone data as if it
|
|
were a conventional signing key created by \fBdnssec\-keygen\fP, but the
|
|
key material is stored within the HSM, and the actual signing takes
|
|
place there.
|
|
.sp
|
|
The \fBname\fP of the key is specified on the command line. This must
|
|
match the name of the zone for which the key is being generated.
|
|
.SH OPTIONS
|
|
.INDENT 0.0
|
|
.TP
|
|
\fB\-a\fP algorithm
|
|
Selects the cryptographic algorithm. The value of \fBalgorithm\fP must
|
|
be one of RSASHA1, NSEC3RSASHA1, RSASHA256, RSASHA512,
|
|
ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.
|
|
.sp
|
|
If no algorithm is specified, then RSASHA1 will be used by default,
|
|
unless the \fB\-3\fP option is specified, in which case NSEC3RSASHA1
|
|
will be used instead. (If \fB\-3\fP is used and an algorithm is
|
|
specified, that algorithm will be checked for compatibility with
|
|
NSEC3.)
|
|
.sp
|
|
These values are case insensitive. In some cases, abbreviations are
|
|
supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for
|
|
ECDSAP384SHA384. If RSASHA1 is specified along with the \fB\-3\fP
|
|
option, then NSEC3RSASHA1 will be used instead.
|
|
.sp
|
|
As of BIND 9.12.0, this option is mandatory except when using the
|
|
\fB\-S\fP option (which copies the algorithm from the predecessory key).
|
|
Previously, the default for newly generated keys was RSASHA1.
|
|
.TP
|
|
\fB\-3\fP
|
|
Use an NSEC3\-capable algorithm to generate a DNSSEC key. If this
|
|
option is used with an algorithm that has both NSEC and NSEC3
|
|
versions, then the NSEC3 version will be used; for example,
|
|
\fBdnssec\-keygen \-3a RSASHA1\fP specifies the NSEC3RSASHA1 algorithm.
|
|
.TP
|
|
\fB\-E\fP engine
|
|
Specifies the cryptographic hardware to use.
|
|
.sp
|
|
When BIND is built with OpenSSL PKCS#11 support, this defaults to the
|
|
string "pkcs11", which identifies an OpenSSL engine that can drive a
|
|
cryptographic accelerator or hardware service module. When BIND is
|
|
built with native PKCS#11 cryptography (\-\-enable\-native\-pkcs11), it
|
|
defaults to the path of the PKCS#11 provider library specified via
|
|
"\-\-with\-pkcs11".
|
|
.TP
|
|
\fB\-l\fP label
|
|
Specifies the label for a key pair in the crypto hardware.
|
|
.sp
|
|
When BIND 9 is built with OpenSSL\-based PKCS#11 support, the label is
|
|
an arbitrary string that identifies a particular key. It may be
|
|
preceded by an optional OpenSSL engine name, followed by a colon, as
|
|
in "pkcs11:keylabel".
|
|
.sp
|
|
When BIND 9 is built with native PKCS#11 support, the label is a
|
|
PKCS#11 URI string in the format
|
|
"pkcs11:\fBkeyword\fP=value[;\fBkeyword\fP=value;...]" Keywords
|
|
include "token", which identifies the HSM; "object", which identifies
|
|
the key; and "pin\-source", which identifies a file from which the
|
|
HSM\(aqs PIN code can be obtained. The label will be stored in the
|
|
on\-disk "private" file.
|
|
.sp
|
|
If the label contains a \fBpin\-source\fP field, tools using the
|
|
generated key files will be able to use the HSM for signing and other
|
|
operations without any need for an operator to manually enter a PIN.
|
|
Note: Making the HSM\(aqs PIN accessible in this manner may reduce the
|
|
security advantage of using an HSM; be sure this is what you want to
|
|
do before making use of this feature.
|
|
.TP
|
|
\fB\-n\fP nametype
|
|
Specifies the owner type of the key. The value of \fBnametype\fP must
|
|
either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY
|
|
(for a key associated with a host (KEY)), USER (for a key associated
|
|
with a user(KEY)) or OTHER (DNSKEY). These values are case
|
|
insensitive.
|
|
.TP
|
|
\fB\-C\fP
|
|
Compatibility mode: generates an old\-style key, without any metadata.
|
|
By default, \fBdnssec\-keyfromlabel\fP will include the key\(aqs creation
|
|
date in the metadata stored with the private key, and other dates may
|
|
be set there as well (publication date, activation date, etc). Keys
|
|
that include this data may be incompatible with older versions of
|
|
BIND; the \fB\-C\fP option suppresses them.
|
|
.TP
|
|
\fB\-c\fP class
|
|
Indicates that the DNS record containing the key should have the
|
|
specified class. If not specified, class IN is used.
|
|
.TP
|
|
\fB\-f\fP flag
|
|
Set the specified flag in the flag field of the KEY/DNSKEY record.
|
|
The only recognized flags are KSK (Key Signing Key) and REVOKE.
|
|
.TP
|
|
\fB\-G\fP
|
|
Generate a key, but do not publish it or sign with it. This option is
|
|
incompatible with \-P and \-A.
|
|
.TP
|
|
\fB\-h\fP
|
|
Prints a short summary of the options and arguments to
|
|
\fBdnssec\-keyfromlabel\fP\&.
|
|
.TP
|
|
\fB\-K\fP directory
|
|
Sets the directory in which the key files are to be written.
|
|
.TP
|
|
\fB\-k\fP
|
|
Generate KEY records rather than DNSKEY records.
|
|
.TP
|
|
\fB\-L\fP ttl
|
|
Sets the default TTL to use for this key when it is converted into a
|
|
DNSKEY RR. If the key is imported into a zone, this is the TTL that
|
|
will be used for it, unless there was already a DNSKEY RRset in
|
|
place, in which case the existing TTL would take precedence. Setting
|
|
the default TTL to \fB0\fP or \fBnone\fP removes it.
|
|
.TP
|
|
\fB\-p\fP protocol
|
|
Sets the protocol value for the key. The protocol is a number between
|
|
0 and 255. The default is 3 (DNSSEC). Other possible values for this
|
|
argument are listed in \fI\%RFC 2535\fP and its successors.
|
|
.TP
|
|
\fB\-S\fP key
|
|
Generate a key as an explicit successor to an existing key. The name,
|
|
algorithm, size, and type of the key will be set to match the
|
|
predecessor. The activation date of the new key will be set to the
|
|
inactivation date of the existing one. The publication date will be
|
|
set to the activation date minus the prepublication interval, which
|
|
defaults to 30 days.
|
|
.TP
|
|
\fB\-t\fP type
|
|
Indicates the use of the key. \fBtype\fP must be one of AUTHCONF,
|
|
NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH refers
|
|
to the ability to authenticate data, and CONF the ability to encrypt
|
|
data.
|
|
.TP
|
|
\fB\-v\fP level
|
|
Sets the debugging level.
|
|
.TP
|
|
\fB\-V\fP
|
|
Prints version information.
|
|
.TP
|
|
\fB\-y\fP
|
|
Allows DNSSEC key files to be generated even if the key ID would
|
|
collide with that of an existing key, in the event of either key
|
|
being revoked. (This is only safe to use if you are sure you won\(aqt be
|
|
using \fI\%RFC 5011\fP trust anchor maintenance with either of the keys
|
|
involved.)
|
|
.UNINDENT
|
|
.SH TIMING OPTIONS
|
|
.sp
|
|
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
|
|
argument begins with a \(aq+\(aq or \(aq\-\(aq, it is interpreted as an offset from
|
|
the present time. For convenience, if such an offset is followed by one
|
|
of the suffixes \(aqy\(aq, \(aqmo\(aq, \(aqw\(aq, \(aqd\(aq, \(aqh\(aq, or \(aqmi\(aq, then the offset is
|
|
computed in years (defined as 365 24\-hour days, ignoring leap years),
|
|
months (defined as 30 24\-hour days), weeks, days, hours, or minutes,
|
|
respectively. Without a suffix, the offset is computed in seconds. To
|
|
explicitly prevent a date from being set, use \(aqnone\(aq or \(aqnever\(aq.
|
|
.INDENT 0.0
|
|
.TP
|
|
\fB\-P\fP date/offset
|
|
Sets the date on which a key is to be published to the zone. After
|
|
that date, the key will be included in the zone but will not be used
|
|
to sign it. If not set, and if the \-G option has not been used, the
|
|
default is "now".
|
|
.TP
|
|
\fB\-P\fP sync date/offset
|
|
Sets the date on which the CDS and CDNSKEY records which match this
|
|
key are to be published to the zone.
|
|
.TP
|
|
\fB\-A\fP date/offset
|
|
Sets the date on which the key is to be activated. After that date,
|
|
the key will be included in the zone and used to sign it. If not set,
|
|
and if the \-G option has not been used, the default is "now".
|
|
.TP
|
|
\fB\-R\fP date/offset
|
|
Sets the date on which the key is to be revoked. After that date, the
|
|
key will be flagged as revoked. It will be included in the zone and
|
|
will be used to sign it.
|
|
.TP
|
|
\fB\-I\fP date/offset
|
|
Sets the date on which the key is to be retired. After that date, the
|
|
key will still be included in the zone, but it will not be used to
|
|
sign it.
|
|
.TP
|
|
\fB\-D\fP date/offset
|
|
Sets the date on which the key is to be deleted. After that date, the
|
|
key will no longer be included in the zone. (It may remain in the key
|
|
repository, however.)
|
|
.TP
|
|
\fB\-D\fP sync date/offset
|
|
Sets the date on which the CDS and CDNSKEY records which match this
|
|
key are to be deleted.
|
|
.TP
|
|
\fB\-i\fP interval
|
|
Sets the prepublication interval for a key. If set, then the
|
|
publication and activation dates must be separated by at least this
|
|
much time. If the activation date is specified but the publication
|
|
date isn\(aqt, then the publication date will default to this much time
|
|
before the activation date; conversely, if the publication date is
|
|
specified but activation date isn\(aqt, then activation will be set to
|
|
this much time after publication.
|
|
.sp
|
|
If the key is being created as an explicit successor to another key,
|
|
then the default prepublication interval is 30 days; otherwise it is
|
|
zero.
|
|
.sp
|
|
As with date offsets, if the argument is followed by one of the
|
|
suffixes \(aqy\(aq, \(aqmo\(aq, \(aqw\(aq, \(aqd\(aq, \(aqh\(aq, or \(aqmi\(aq, then the interval is
|
|
measured in years, months, weeks, days, hours, or minutes,
|
|
respectively. Without a suffix, the interval is measured in seconds.
|
|
.UNINDENT
|
|
.SH GENERATED KEY FILES
|
|
.sp
|
|
When \fBdnssec\-keyfromlabel\fP completes successfully, it prints a string
|
|
of the form \fBKnnnn.+aaa+iiiii\fP to the standard output. This is an
|
|
identification string for the key files it has generated.
|
|
.INDENT 0.0
|
|
.IP \(bu 2
|
|
\fBnnnn\fP is the key name.
|
|
.IP \(bu 2
|
|
\fBaaa\fP is the numeric representation of the algorithm.
|
|
.IP \(bu 2
|
|
\fBiiiii\fP is the key identifier (or footprint).
|
|
.UNINDENT
|
|
.sp
|
|
\fBdnssec\-keyfromlabel\fP creates two files, with names based on the
|
|
printed string. \fBKnnnn.+aaa+iiiii.key\fP contains the public key, and
|
|
\fBKnnnn.+aaa+iiiii.private\fP contains the private key.
|
|
.sp
|
|
The \fB\&.key\fP file contains a DNS KEY record that can be inserted into a
|
|
zone file (directly or with a $INCLUDE statement).
|
|
.sp
|
|
The \fB\&.private\fP file contains algorithm\-specific fields. For obvious
|
|
security reasons, this file does not have general read permission.
|
|
.SH SEE ALSO
|
|
.sp
|
|
\fBdnssec\-keygen(8)\fP, \fBdnssec\-signzone(8)\fP, BIND 9 Administrator Reference Manual,
|
|
\fI\%RFC 4034\fP, The PKCS#11 URI Scheme (draft\-pechanec\-pkcs11uri\-13).
|
|
.SH AUTHOR
|
|
Internet Systems Consortium
|
|
.SH COPYRIGHT
|
|
2020, Internet Systems Consortium
|
|
.\" Generated by docutils manpage writer.
|
|
.
|