35a06c476d
The handling of . (dot) characted at the beginning of the line has
changed between the sphinx-doc versions, and it was constantly giving us
trouble when generating man pages when using different sphinx-doc. This
commit just changes the source rst file, so there's no more . (dot) the
beginning of the line.
(cherry picked from commit a00ca65ae6)
124 lines
4.4 KiB
ReStructuredText
124 lines
4.4 KiB
ReStructuredText
..
|
|
Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
|
|
This Source Code Form is subject to the terms of the Mozilla Public
|
|
License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
|
|
|
See the COPYRIGHT file distributed with this work for additional
|
|
information regarding copyright ownership.
|
|
|
|
..
|
|
Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
|
|
This Source Code Form is subject to the terms of the Mozilla Public
|
|
License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
|
|
See the COPYRIGHT file distributed with this work for additional
|
|
information regarding copyright ownership.
|
|
|
|
|
|
.. highlight: console
|
|
|
|
.. _man_dnssec-importkey:
|
|
|
|
dnssec-importkey - import DNSKEY records from external systems so they can be managed
|
|
-------------------------------------------------------------------------------------
|
|
|
|
Synopsis
|
|
~~~~~~~~
|
|
|
|
:program:`dnssec-importkey` [**-K** directory] [**-L** ttl] [**-P** date/offset] [**-P** sync date/offset] [**-D** date/offset] [**-D** sync date/offset] [**-h**] [**-v** level] [**-V**] {keyfile}
|
|
|
|
:program:`dnssec-importkey` {**-f** filename} [**-K** directory] [**-L** ttl] [**-P** date/offset] [**-P** sync date/offset] [**-D** date/offset] [**-D** sync date/offset] [**-h**] [**-v** level] [**-V**] [dnsname]
|
|
|
|
Description
|
|
~~~~~~~~~~~
|
|
|
|
``dnssec-importkey`` reads a public DNSKEY record and generates a pair
|
|
of .key/.private files. The DNSKEY record may be read from an
|
|
existing .key file, in which case a corresponding .private file will be
|
|
generated, or it may be read from any other file or from the standard
|
|
input, in which case both .key and .private files will be generated.
|
|
|
|
The newly-created .private file does *not* contain private key data, and
|
|
cannot be used for signing. However, having a .private file makes it
|
|
possible to set publication (``-P``) and deletion (``-D``) times for the
|
|
key, which means the public key can be added to and removed from the
|
|
DNSKEY RRset on schedule even if the true private key is stored offline.
|
|
|
|
Options
|
|
~~~~~~~
|
|
|
|
**-f** filename
|
|
Zone file mode: instead of a public keyfile name, the argument is the
|
|
DNS domain name of a zone master file, which can be read from
|
|
``file``. If the domain name is the same as ``file``, then it may be
|
|
omitted.
|
|
|
|
If ``file`` is set to ``"-"``, then the zone data is read from the
|
|
standard input.
|
|
|
|
**-K** directory
|
|
Sets the directory in which the key files are to reside.
|
|
|
|
**-L** ttl
|
|
Sets the default TTL to use for this key when it is converted into a
|
|
DNSKEY RR. If the key is imported into a zone, this is the TTL that
|
|
will be used for it, unless there was already a DNSKEY RRset in
|
|
place, in which case the existing TTL would take precedence. Setting
|
|
the default TTL to ``0`` or ``none`` removes it.
|
|
|
|
**-h**
|
|
Emit usage message and exit.
|
|
|
|
**-v** level
|
|
Sets the debugging level.
|
|
|
|
**-V**
|
|
Prints version information.
|
|
|
|
Timing Options
|
|
~~~~~~~~~~~~~~
|
|
|
|
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
|
|
argument begins with a '+' or '-', it is interpreted as an offset from
|
|
the present time. For convenience, if such an offset is followed by one
|
|
of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the offset is
|
|
computed in years (defined as 365 24-hour days, ignoring leap years),
|
|
months (defined as 30 24-hour days), weeks, days, hours, or minutes,
|
|
respectively. Without a suffix, the offset is computed in seconds. To
|
|
explicitly prevent a date from being set, use 'none' or 'never'.
|
|
|
|
**-P** date/offset
|
|
Sets the date on which a key is to be published to the zone. After
|
|
that date, the key will be included in the zone but will not be used
|
|
to sign it.
|
|
|
|
**-P** sync date/offset
|
|
Sets the date on which CDS and CDNSKEY records that match this key
|
|
are to be published to the zone.
|
|
|
|
**-D** date/offset
|
|
Sets the date on which the key is to be deleted. After that date, the
|
|
key will no longer be included in the zone. (It may remain in the key
|
|
repository, however.)
|
|
|
|
**-D** sync date/offset
|
|
Sets the date on which the CDS and CDNSKEY records that match this
|
|
key are to be deleted.
|
|
|
|
Files
|
|
~~~~~
|
|
|
|
A keyfile can be designed by the key identification ``Knnnn.+aaa+iiiii``
|
|
or the full file name ``Knnnn.+aaa+iiiii.key`` as generated by
|
|
dnssec-keygen8.
|
|
|
|
See Also
|
|
~~~~~~~~
|
|
|
|
:manpage:`dnssec-keygen(8)`, :manpage:`dnssec-signzone(8)`, BIND 9 Administrator Reference Manual,
|
|
:rfc:`5011`.
|