248 lines
9.5 KiB
Plaintext
248 lines
9.5 KiB
Plaintext
.\" Man page generated from reStructuredText.
|
|
.
|
|
.TH "DNSSEC-SETTIME" "8" "@RELEASE_DATE@" "@BIND9_VERSION@" "BIND 9"
|
|
.SH NAME
|
|
dnssec-settime \- set the key timing metadata for a DNSSEC key
|
|
.
|
|
.nr rst2man-indent-level 0
|
|
.
|
|
.de1 rstReportMargin
|
|
\\$1 \\n[an-margin]
|
|
level \\n[rst2man-indent-level]
|
|
level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
|
-
|
|
\\n[rst2man-indent0]
|
|
\\n[rst2man-indent1]
|
|
\\n[rst2man-indent2]
|
|
..
|
|
.de1 INDENT
|
|
.\" .rstReportMargin pre:
|
|
. RS \\$1
|
|
. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
|
|
. nr rst2man-indent-level +1
|
|
.\" .rstReportMargin post:
|
|
..
|
|
.de UNINDENT
|
|
. RE
|
|
.\" indent \\n[an-margin]
|
|
.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
|
.nr rst2man-indent-level -1
|
|
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
|
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
|
|
..
|
|
.SH SYNOPSIS
|
|
.sp
|
|
\fBdnssec\-settime\fP [\fB\-f\fP] [\fB\-K\fP directory] [\fB\-L\fP ttl] [\fB\-P\fP date/offset] [\fB\-P\fP ds date/offset] [\fB\-P\fP sync date/offset] [\fB\-A\fP date/offset] [\fB\-R\fP date/offset] [\fB\-I\fP date/offset] [\fB\-D\fP date/offset] [\fB\-D\fP ds date/offset] [\fB\-D\fP sync date/offset] [\fB\-S\fP key] [\fB\-i\fP interval] [\fB\-h\fP] [\fB\-V\fP] [\fB\-v\fP level] [\fB\-E\fP engine] {keyfile} [\fB\-s\fP] [\fB\-g\fP state] [\fB\-d\fP state date/offset] [\fB\-k\fP state date/offset] [\fB\-r\fP state date/offset] [\fB\-z\fP state date/offset]
|
|
.SH DESCRIPTION
|
|
.sp
|
|
\fBdnssec\-settime\fP reads a DNSSEC private key file and sets the key
|
|
timing metadata as specified by the \fB\-P\fP, \fB\-A\fP, \fB\-R\fP, \fB\-I\fP, and
|
|
\fB\-D\fP options. The metadata can then be used by \fBdnssec\-signzone\fP or
|
|
other signing software to determine when a key is to be published,
|
|
whether it should be used for signing a zone, etc.
|
|
.sp
|
|
If none of these options is set on the command line, then
|
|
\fBdnssec\-settime\fP simply prints the key timing metadata already stored
|
|
in the key.
|
|
.sp
|
|
When key metadata fields are changed, both files of a key pair
|
|
(\fBKnnnn.+aaa+iiiii.key\fP and \fBKnnnn.+aaa+iiiii.private\fP) are
|
|
regenerated.
|
|
.sp
|
|
Metadata fields are stored in the private file. A
|
|
human\-readable description of the metadata is also placed in comments in
|
|
the key file. The private file\(aqs permissions are always set to be
|
|
inaccessible to anyone other than the owner (mode 0600).
|
|
.sp
|
|
When working with state files, it is possible to update the timing metadata in
|
|
those files as well with \fB\-s\fP\&. If this option is used you can also update key
|
|
states with \fB\-d\fP (DS), \fB\-k\fP (DNSKEY), \fB\-r\fP (RRSIG of KSK), or \fB\-z\fP
|
|
(RRSIG of ZSK). Allowed states are HIDDEN, RUMOURED, OMNIPRESENT, and
|
|
UNRETENTIVE.
|
|
.sp
|
|
You can also set the goal state of the key with \fB\-g\fP\&. This should be either
|
|
HIDDEN or OMNIPRESENT (representing whether the key should be removed from the
|
|
zone, or published).
|
|
.sp
|
|
It is NOT RECOMMENDED to manipulate state files manually except for testing
|
|
purposes.
|
|
.SH OPTIONS
|
|
.INDENT 0.0
|
|
.TP
|
|
\fB\-f\fP
|
|
Force an update of an old\-format key with no metadata fields. Without
|
|
this option, \fBdnssec\-settime\fP will fail when attempting to update a
|
|
legacy key. With this option, the key will be recreated in the new
|
|
format, but with the original key data retained. The key\(aqs creation
|
|
date will be set to the present time. If no other values are
|
|
specified, then the key\(aqs publication and activation dates will also
|
|
be set to the present time.
|
|
.TP
|
|
\fB\-K\fP directory
|
|
Sets the directory in which the key files are to reside.
|
|
.TP
|
|
\fB\-L\fP ttl
|
|
Sets the default TTL to use for this key when it is converted into a
|
|
DNSKEY RR. If the key is imported into a zone, this is the TTL that
|
|
will be used for it, unless there was already a DNSKEY RRset in
|
|
place, in which case the existing TTL would take precedence. If this
|
|
value is not set and there is no existing DNSKEY RRset, the TTL will
|
|
default to the SOA TTL. Setting the default TTL to \fB0\fP or \fBnone\fP
|
|
removes it from the key.
|
|
.TP
|
|
\fB\-h\fP
|
|
Emit usage message and exit.
|
|
.TP
|
|
\fB\-V\fP
|
|
Prints version information.
|
|
.TP
|
|
\fB\-v\fP level
|
|
Sets the debugging level.
|
|
.TP
|
|
\fB\-E\fP engine
|
|
Specifies the cryptographic hardware to use, when applicable.
|
|
.sp
|
|
When BIND is built with OpenSSL PKCS#11 support, this defaults to the
|
|
string "pkcs11", which identifies an OpenSSL engine that can drive a
|
|
cryptographic accelerator or hardware service module. When BIND is
|
|
built with native PKCS#11 cryptography (\-\-enable\-native\-pkcs11), it
|
|
defaults to the path of the PKCS#11 provider library specified via
|
|
"\-\-with\-pkcs11".
|
|
.UNINDENT
|
|
.SH TIMING OPTIONS
|
|
.sp
|
|
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
|
|
argument begins with a \(aq+\(aq or \(aq\-\(aq, it is interpreted as an offset from
|
|
the present time. For convenience, if such an offset is followed by one
|
|
of the suffixes \(aqy\(aq, \(aqmo\(aq, \(aqw\(aq, \(aqd\(aq, \(aqh\(aq, or \(aqmi\(aq, then the offset is
|
|
computed in years (defined as 365 24\-hour days, ignoring leap years),
|
|
months (defined as 30 24\-hour days), weeks, days, hours, or minutes,
|
|
respectively. Without a suffix, the offset is computed in seconds. To
|
|
unset a date, use \(aqnone\(aq or \(aqnever\(aq.
|
|
.INDENT 0.0
|
|
.TP
|
|
\fB\-P\fP date/offset
|
|
Sets the date on which a key is to be published to the zone. After
|
|
that date, the key will be included in the zone but will not be used
|
|
to sign it.
|
|
.TP
|
|
\fB\-P\fP ds date/offset
|
|
Sets the date on which DS records that match this key have been
|
|
seen in the parent zone.
|
|
.TP
|
|
\fB\-P\fP sync date/offset
|
|
Sets the date on which CDS and CDNSKEY records that match this key
|
|
are to be published to the zone.
|
|
.TP
|
|
\fB\-A\fP date/offset
|
|
Sets the date on which the key is to be activated. After that date,
|
|
the key will be included in the zone and used to sign it.
|
|
.TP
|
|
\fB\-R\fP date/offset
|
|
Sets the date on which the key is to be revoked. After that date, the
|
|
key will be flagged as revoked. It will be included in the zone and
|
|
will be used to sign it.
|
|
.TP
|
|
\fB\-I\fP date/offset
|
|
Sets the date on which the key is to be retired. After that date, the
|
|
key will still be included in the zone, but it will not be used to
|
|
sign it.
|
|
.TP
|
|
\fB\-D\fP date/offset
|
|
Sets the date on which the key is to be deleted. After that date, the
|
|
key will no longer be included in the zone. (It may remain in the key
|
|
repository, however.)
|
|
.TP
|
|
\fB\-D\fP ds date/offset
|
|
Sets the date on which the DS records that match this key have
|
|
been seen removed from the parent zone.
|
|
.TP
|
|
\fB\-D\fP sync date/offset
|
|
Sets the date on which the CDS and CDNSKEY records that match this
|
|
key are to be deleted.
|
|
.TP
|
|
\fB\-S\fP predecessor key
|
|
Select a key for which the key being modified will be an explicit
|
|
successor. The name, algorithm, size, and type of the predecessor key
|
|
must exactly match those of the key being modified. The activation
|
|
date of the successor key will be set to the inactivation date of the
|
|
predecessor. The publication date will be set to the activation date
|
|
minus the prepublication interval, which defaults to 30 days.
|
|
.TP
|
|
\fB\-i\fP interval
|
|
Sets the prepublication interval for a key. If set, then the
|
|
publication and activation dates must be separated by at least this
|
|
much time. If the activation date is specified but the publication
|
|
date isn\(aqt, then the publication date will default to this much time
|
|
before the activation date; conversely, if the publication date is
|
|
specified but activation date isn\(aqt, then activation will be set to
|
|
this much time after publication.
|
|
.sp
|
|
If the key is being set to be an explicit successor to another key,
|
|
then the default prepublication interval is 30 days; otherwise it is
|
|
zero.
|
|
.sp
|
|
As with date offsets, if the argument is followed by one of the
|
|
suffixes \(aqy\(aq, \(aqmo\(aq, \(aqw\(aq, \(aqd\(aq, \(aqh\(aq, or \(aqmi\(aq, then the interval is
|
|
measured in years, months, weeks, days, hours, or minutes,
|
|
respectively. Without a suffix, the interval is measured in seconds.
|
|
.UNINDENT
|
|
.SH KEY STATE OPTIONS
|
|
.sp
|
|
Known key states are HIDDEN, RUMOURED, OMNIPRESENT and UNRETENTIVE. These should
|
|
not be set manually except for testing purposes.
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \fB\-s\fP
|
|
When setting key timing data, also update the state file.
|
|
.TP
|
|
.B \fB\-g\fP
|
|
Set the goal state for this key. Must be HIDDEN or OMNIPRESENT.
|
|
.TP
|
|
.B \fB\-d\fP
|
|
Set the DS state for this key, and when it was last changed.
|
|
.TP
|
|
.B \fB\-k\fP
|
|
Set the DNSKEY state for this key, and when it was last changed.
|
|
.TP
|
|
.B \fB\-r\fP
|
|
Set the RRSIG (KSK) state for this key, and when it was last changed.
|
|
.UNINDENT
|
|
.sp
|
|
\fB\-z\fP
|
|
.INDENT 0.0
|
|
.INDENT 3.5
|
|
Set the RRSIG (ZSK) state for this key, and when it was last changed.
|
|
.UNINDENT
|
|
.UNINDENT
|
|
.SH PRINTING OPTIONS
|
|
.sp
|
|
\fBdnssec\-settime\fP can also be used to print the timing metadata
|
|
associated with a key.
|
|
.INDENT 0.0
|
|
.TP
|
|
\fB\-u\fP
|
|
Print times in UNIX epoch format.
|
|
.TP
|
|
\fB\-p\fP C/P/Pds/Psync/A/R/I/D/Dds/Dsync/all
|
|
Prints a specific metadata value or set of metadata values. The \fB\-p\fP
|
|
option may be followed by one or more of the following letters or strings
|
|
to indicate which value or values to print: \fBC\fP for the creation date,
|
|
\fBP\fP for the publication date, \fBPds\(ga for the DS publication date,
|
|
\(ga\(gaPsync\fP for the CDS and CDNSKEY publication date, \fBA\fP for the
|
|
activation date, \fBR\fP for the revocation date, \fBI\fP for the inactivation
|
|
date, \fBD\fP for the deletion date, \fBDds\fP for the DS deletion date,
|
|
and \fBDsync\fP for the CDS and CDNSKEY deletion date. To print all of the
|
|
metadata, use \fBall\fP\&.
|
|
.UNINDENT
|
|
.SH SEE ALSO
|
|
.sp
|
|
\fBdnssec\-keygen(8)\fP, \fBdnssec\-signzone(8)\fP, BIND 9 Administrator Reference Manual,
|
|
\fI\%RFC 5011\fP\&.
|
|
.SH AUTHOR
|
|
Internet Systems Consortium
|
|
.SH COPYRIGHT
|
|
2020, Internet Systems Consortium
|
|
.\" Generated by docutils manpage writer.
|
|
.
|