mirror of
https://gitlab.isc.org/isc-projects/bind9
synced 2025-08-31 14:35:26 +00:00
Update the generated files after the source manpages update
This commit is contained in:
Ondřej Surý
@@ -1,6 +1,6 @@
|
||||
.. highlight: console
|
||||
|
||||
named.conf - configuration file for ``named``
|
||||
named.conf - configuration file for **named**
|
||||
---------------------------------------------
|
||||
|
||||
Synopsis
|
||||
@@ -12,13 +12,13 @@ Description
|
||||
~~~~~~~~~~~
|
||||
|
||||
``named.conf`` is the configuration file for ``named``. Statements are
|
||||
enclosed in braces (``[ ]``) and terminated with a semi-colon (``;``). Clauses in the
|
||||
enclosed in braces and terminated with a semi-colon. Clauses in the
|
||||
statements are also semi-colon terminated. The usual comment styles are
|
||||
supported:
|
||||
|
||||
C style: /\* \*/
|
||||
|
||||
C++ style: // to end of line
|
||||
C++ style: // to end of line
|
||||
|
||||
Unix style: # to end of line
|
||||
|
||||
|
||||
@@ -43,57 +43,57 @@ can be used, for example, to secure dynamic DNS updates to a zone or for
|
||||
the \fBrndc\fP command channel.
|
||||
.sp
|
||||
When run as \fBtsig\-keygen\fP, a domain name can be specified on the
|
||||
command line which will be used as the name of the generated key. If no
|
||||
command line to be used as the name of the generated key. If no
|
||||
name is specified, the default is \fBtsig\-key\fP\&.
|
||||
.sp
|
||||
When run as \fBddns\-confgen\fP, the generated key is accompanied by
|
||||
configuration text and instructions that can be used with \fBnsupdate\fP
|
||||
and \fBnamed\fP when setting up dynamic DNS, including an example
|
||||
\fBupdate\-policy\fP statement. (This usage similar to the \fBrndc\-confgen\fP
|
||||
command for setting up command channel security.)
|
||||
\fBupdate\-policy\fP statement. (This usage is similar to the \fBrndc\-confgen\fP
|
||||
command for setting up command\-channel security.)
|
||||
.sp
|
||||
Note that \fBnamed\fP itself can configure a local DDNS key for use with
|
||||
\fBnsupdate \-l\fP: it does this when a zone is configured with
|
||||
\fBnsupdate \-l\fP; it does this when a zone is configured with
|
||||
\fBupdate\-policy local;\fP\&. \fBddns\-confgen\fP is only needed when a more
|
||||
elaborate configuration is required: for instance, if \fBnsupdate\fP is to
|
||||
be used from a remote system.
|
||||
.SH OPTIONS
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-a\fP algorithm
|
||||
Specifies the algorithm to use for the TSIG key. Available choices
|
||||
are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384 and
|
||||
.B \fB\-a algorithm\fP
|
||||
This option specifies the algorithm to use for the TSIG key. Available choices
|
||||
are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384, and
|
||||
hmac\-sha512. The default is hmac\-sha256. Options are
|
||||
case\-insensitive, and the "hmac\-" prefix may be omitted.
|
||||
.TP
|
||||
\fB\-h\fP
|
||||
Prints a short summary of options and arguments.
|
||||
.B \fB\-h\fP
|
||||
This option prints a short summary of options and arguments.
|
||||
.TP
|
||||
\fB\-k\fP keyname
|
||||
Specifies the key name of the DDNS authentication key. The default is
|
||||
.B \fB\-k keyname\fP
|
||||
This option specifies the key name of the DDNS authentication key. The default is
|
||||
\fBddns\-key\fP when neither the \fB\-s\fP nor \fB\-z\fP option is specified;
|
||||
otherwise, the default is \fBddns\-key\fP as a separate label followed
|
||||
by the argument of the option, e.g., \fBddns\-key.example.com.\fP The
|
||||
key name must have the format of a valid domain name, consisting of
|
||||
letters, digits, hyphens and periods.
|
||||
letters, digits, hyphens, and periods.
|
||||
.TP
|
||||
\fB\-q\fP
|
||||
(\fBddns\-confgen\fP only.) Quiet mode: Print only the key, with no
|
||||
explanatory text or usage examples; This is essentially identical to
|
||||
.B \fB\-q\fP (\fBddns\-confgen\fP only)
|
||||
This option enables quiet mode, which prints only the key, with no
|
||||
explanatory text or usage examples. This is essentially identical to
|
||||
\fBtsig\-keygen\fP\&.
|
||||
.TP
|
||||
\fB\-s\fP name
|
||||
(\fBddns\-confgen\fP only.) Generate configuration example to allow
|
||||
.B \fB\-s name\fP (\fBddns\-confgen\fP only)
|
||||
This option generates a configuration example to allow
|
||||
dynamic updates of a single hostname. The example \fBnamed.conf\fP text
|
||||
shows how to set an update policy for the specified name using the
|
||||
"name" nametype. The default key name is ddns\-key.name. Note that the
|
||||
"name" nametype. The default key name is \fBddns\-key.name\fP\&. Note that the
|
||||
"self" nametype cannot be used, since the name to be updated may
|
||||
differ from the key name. This option cannot be used with the \fB\-z\fP
|
||||
option.
|
||||
.TP
|
||||
\fB\-z\fP zone
|
||||
(\fBddns\-confgen\fP only.) Generate configuration example to allow
|
||||
dynamic updates of a zone: The example \fBnamed.conf\fP text shows how
|
||||
.B \fB\-z zone\fP (\fBddns\-confgen\fP only)
|
||||
This option generates a configuration example to allow
|
||||
dynamic updates of a zone. The example \fBnamed.conf\fP text shows how
|
||||
to set an update policy for the specified zone using the "zonesub"
|
||||
nametype, allowing updates to all subdomain names within that zone.
|
||||
This option cannot be used with the \fB\-s\fP option.
|
||||
|
||||
178
doc/man/delv.1in
178
doc/man/delv.1in
@@ -44,15 +44,15 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
||||
\fBdelv\fP is a tool for sending DNS queries and validating the results,
|
||||
using the same internal resolver and validator logic as \fBnamed\fP\&.
|
||||
.sp
|
||||
\fBdelv\fP will send to a specified name server all queries needed to
|
||||
\fBdelv\fP sends to a specified name server all queries needed to
|
||||
fetch and validate the requested data; this includes the original
|
||||
requested query, subsequent queries to follow CNAME or DNAME chains, and
|
||||
requested query, subsequent queries to follow CNAME or DNAME chains,
|
||||
queries for DNSKEY, and DS records to establish a chain of trust for
|
||||
DNSSEC validation. It does not perform iterative resolution, but
|
||||
simulates the behavior of a name server configured for DNSSEC validating
|
||||
and forwarding.
|
||||
.sp
|
||||
By default, responses are validated using built\-in DNSSEC trust anchor
|
||||
By default, responses are validated using the built\-in DNSSEC trust anchor
|
||||
for the root zone ("."). Records returned by \fBdelv\fP are either fully
|
||||
validated or were not signed. If validation fails, an explanation of the
|
||||
failure is included in the output; the validation process can be traced
|
||||
@@ -60,13 +60,13 @@ in detail. Because \fBdelv\fP does not rely on an external server to carry
|
||||
out validation, it can be used to check the validity of DNS responses in
|
||||
environments where local name servers may not be trustworthy.
|
||||
.sp
|
||||
Unless it is told to query a specific name server, \fBdelv\fP will try
|
||||
Unless it is told to query a specific name server, \fBdelv\fP tries
|
||||
each of the servers listed in \fB/etc/resolv.conf\fP\&. If no usable server
|
||||
addresses are found, \fBdelv\fP will send queries to the localhost
|
||||
addresses are found, \fBdelv\fP sends queries to the localhost
|
||||
addresses (127.0.0.1 for IPv4, ::1 for IPv6).
|
||||
.sp
|
||||
When no command line arguments or options are given, \fBdelv\fP will
|
||||
perform an NS query for "." (the root zone).
|
||||
When no command\-line arguments or options are given, \fBdelv\fP
|
||||
performs an NS query for "." (the root zone).
|
||||
.SH SIMPLE USAGE
|
||||
.sp
|
||||
A typical invocation of \fBdelv\fP looks like:
|
||||
@@ -95,109 +95,109 @@ DNSSEC).
|
||||
If no \fBserver\fP argument is provided, \fBdelv\fP consults
|
||||
\fB/etc/resolv.conf\fP; if an address is found there, it queries the
|
||||
name server at that address. If either of the \fB\-4\fP or \fB\-6\fP
|
||||
options are in use, then only addresses for the corresponding
|
||||
transport will be tried. If no usable addresses are found, \fBdelv\fP
|
||||
will send queries to the localhost addresses (127.0.0.1 for IPv4, ::1
|
||||
options is in use, then only addresses for the corresponding
|
||||
transport are tried. If no usable addresses are found, \fBdelv\fP
|
||||
sends queries to the localhost addresses (127.0.0.1 for IPv4, ::1
|
||||
for IPv6).
|
||||
.TP
|
||||
.B \fBname\fP
|
||||
is the domain name to be looked up.
|
||||
.TP
|
||||
.B \fBtype\fP
|
||||
indicates what type of query is required MDASH ANY, A, MX, etc.
|
||||
indicates what type of query is required \- ANY, A, MX, etc.
|
||||
\fBtype\fP can be any valid query type. If no \fBtype\fP argument is
|
||||
supplied, \fBdelv\fP will perform a lookup for an A record.
|
||||
supplied, \fBdelv\fP performs a lookup for an A record.
|
||||
.UNINDENT
|
||||
.SH OPTIONS
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-a\fP anchor\-file
|
||||
Specifies a file from which to read DNSSEC trust anchors. The default
|
||||
.B \fB\-a anchor\-file\fP
|
||||
This option specifies a file from which to read DNSSEC trust anchors. The default
|
||||
is \fB/etc/bind.keys\fP, which is included with BIND 9 and contains one
|
||||
or more trust anchors for the root zone (".").
|
||||
.sp
|
||||
Keys that do not match the root zone name are ignored. An alternate
|
||||
key name can be specified using the \fB+root=NAME\fP options.
|
||||
.sp
|
||||
Note: When reading the trust anchor file, \fBdelv\fP treat \fBtrust\-anchors\fP
|
||||
\fBinitial\-key\fP and \fBstatic\-key\fP identically. That is, for a managed key,
|
||||
Note: When reading the trust anchor file, \fBdelv\fP treats \fBtrust\-anchors\fP,
|
||||
\fBinitial\-key\fP, and \fBstatic\-key\fP identically. That is, for a managed key,
|
||||
it is the \fIinitial\fP key that is trusted; \fI\%RFC 5011\fP key management is not
|
||||
supported. \fBdelv\fP will not consult the managed\-keys database maintained by
|
||||
\fBnamed\fP\&. This means that if either of the keys in \fB/etc/bind.keys\fP is
|
||||
revoked and rolled over, it will be necessary to update \fB/etc/bind.keys\fP to
|
||||
supported. \fBdelv\fP does not consult the managed\-keys database maintained by
|
||||
\fBnamed\fP, which means that if either of the keys in \fB/etc/bind.keys\fP is
|
||||
revoked and rolled over, \fB/etc/bind.keys\fP must be updated to
|
||||
use DNSSEC validation in \fBdelv\fP\&.
|
||||
.TP
|
||||
\fB\-b\fP address
|
||||
Sets the source IP address of the query to \fBaddress\fP\&. This must be
|
||||
a valid address on one of the host\(aqs network interfaces or "0.0.0.0"
|
||||
or "::". An optional source port may be specified by appending
|
||||
"#<port>"
|
||||
.B \fB\-b address\fP
|
||||
This option sets the source IP address of the query to \fBaddress\fP\&. This must be
|
||||
a valid address on one of the host\(aqs network interfaces, or \fB0.0.0.0\fP,
|
||||
or \fB::\fP\&. An optional source port may be specified by appending
|
||||
\fB#<port>\fP
|
||||
.TP
|
||||
\fB\-c\fP class
|
||||
Sets the query class for the requested data. Currently, only class
|
||||
.B \fB\-c class\fP
|
||||
This option sets the query class for the requested data. Currently, only class
|
||||
"IN" is supported in \fBdelv\fP and any other value is ignored.
|
||||
.TP
|
||||
\fB\-d\fP level
|
||||
Set the systemwide debug level to \fBlevel\fP\&. The allowed range is
|
||||
.B \fB\-d level\fP
|
||||
This option sets the systemwide debug level to \fBlevel\fP\&. The allowed range is
|
||||
from 0 to 99. The default is 0 (no debugging). Debugging traces from
|
||||
\fBdelv\fP become more verbose as the debug level increases. See the
|
||||
\fB+mtrace\fP, \fB+rtrace\fP, and \fB+vtrace\fP options below for
|
||||
additional debugging details.
|
||||
.TP
|
||||
\fB\-h\fP
|
||||
Display the \fBdelv\fP help usage output and exit.
|
||||
.B \fB\-h\fP
|
||||
This option displays the \fBdelv\fP help usage output and exits.
|
||||
.TP
|
||||
\fB\-i\fP
|
||||
Insecure mode. This disables internal DNSSEC validation. (Note,
|
||||
however, this does not set the CD bit on upstream queries. If the
|
||||
server being queried is performing DNSSEC validation, then it will
|
||||
.B \fB\-i\fP
|
||||
This option sets insecure mode, which disables internal DNSSEC validation. (Note,
|
||||
however, that this does not set the CD bit on upstream queries. If the
|
||||
server being queried is performing DNSSEC validation, then it does
|
||||
not return invalid data; this can cause \fBdelv\fP to time out. When it
|
||||
is necessary to examine invalid data to debug a DNSSEC problem, use
|
||||
\fBdig +cd\fP\&.)
|
||||
.TP
|
||||
\fB\-m\fP
|
||||
Enables memory usage debugging.
|
||||
.B \fB\-m\fP
|
||||
This option enables memory usage debugging.
|
||||
.TP
|
||||
\fB\-p\fP port#
|
||||
Specifies a destination port to use for queries instead of the
|
||||
standard DNS port number 53. This option would be used with a name
|
||||
.B \fB\-p port#\fP
|
||||
This option specifies a destination port to use for queries, instead of the
|
||||
standard DNS port number 53. This option is used with a name
|
||||
server that has been configured to listen for queries on a
|
||||
non\-standard port number.
|
||||
.TP
|
||||
\fB\-q\fP name
|
||||
Sets the query name to \fBname\fP\&. While the query name can be
|
||||
specified without using the \fB\-q\fP, it is sometimes necessary to
|
||||
.B \fB\-q name\fP
|
||||
This option sets the query name to \fBname\fP\&. While the query name can be
|
||||
specified without using the \fB\-q\fP option, it is sometimes necessary to
|
||||
disambiguate names from types or classes (for example, when looking
|
||||
up the name "ns", which could be misinterpreted as the type NS, or
|
||||
"ch", which could be misinterpreted as class CH).
|
||||
.TP
|
||||
\fB\-t\fP type
|
||||
Sets the query type to \fBtype\fP, which can be any valid query type
|
||||
.B \fB\-t type\fP
|
||||
This option sets the query type to \fBtype\fP, which can be any valid query type
|
||||
supported in BIND 9 except for zone transfer types AXFR and IXFR. As
|
||||
with \fB\-q\fP, this is useful to distinguish query name type or class
|
||||
when they are ambiguous. it is sometimes necessary to disambiguate
|
||||
with \fB\-q\fP, this is useful to distinguish query\-name types or classes
|
||||
when they are ambiguous. It is sometimes necessary to disambiguate
|
||||
names from types.
|
||||
.sp
|
||||
The default query type is "A", unless the \fB\-x\fP option is supplied
|
||||
to indicate a reverse lookup, in which case it is "PTR".
|
||||
.TP
|
||||
\fB\-v\fP
|
||||
Print the \fBdelv\fP version and exit.
|
||||
.B \fB\-v\fP
|
||||
This option prints the \fBdelv\fP version and exits.
|
||||
.TP
|
||||
\fB\-x\fP addr
|
||||
Performs a reverse lookup, mapping an addresses to a name. \fBaddr\fP
|
||||
.B \fB\-x addr\fP
|
||||
This option performs a reverse lookup, mapping an address to a name. \fBaddr\fP
|
||||
is an IPv4 address in dotted\-decimal notation, or a colon\-delimited
|
||||
IPv6 address. When \fB\-x\fP is used, there is no need to provide the
|
||||
\fBname\fP or \fBtype\fP arguments. \fBdelv\fP automatically performs a
|
||||
\fBname\fP or \fBtype\fP arguments; \fBdelv\fP automatically performs a
|
||||
lookup for a name like \fB11.12.13.10.in\-addr.arpa\fP and sets the
|
||||
query type to PTR. IPv6 addresses are looked up using nibble format
|
||||
under the IP6.ARPA domain.
|
||||
.TP
|
||||
\fB\-4\fP
|
||||
Forces \fBdelv\fP to only use IPv4.
|
||||
.B \fB\-4\fP
|
||||
This option forces \fBdelv\fP to only use IPv4.
|
||||
.TP
|
||||
\fB\-6\fP
|
||||
Forces \fBdelv\fP to only use IPv6.
|
||||
.B \fB\-6\fP
|
||||
This option forces \fBdelv\fP to only use IPv6.
|
||||
.UNINDENT
|
||||
.SH QUERY OPTIONS
|
||||
.sp
|
||||
@@ -212,122 +212,122 @@ assign values to options like the timeout interval. They have the form
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
.B \fB+[no]cdflag\fP
|
||||
Controls whether to set the CD (checking disabled) bit in queries
|
||||
This option controls whether to set the CD (checking disabled) bit in queries
|
||||
sent by \fBdelv\fP\&. This may be useful when troubleshooting DNSSEC
|
||||
problems from behind a validating resolver. A validating resolver
|
||||
will block invalid responses, making it difficult to retrieve them
|
||||
for analysis. Setting the CD flag on queries will cause the resolver
|
||||
blocks invalid responses, making it difficult to retrieve them
|
||||
for analysis. Setting the CD flag on queries causes the resolver
|
||||
to return invalid responses, which \fBdelv\fP can then validate
|
||||
internally and report the errors in detail.
|
||||
.TP
|
||||
.B \fB+[no]class\fP
|
||||
Controls whether to display the CLASS when printing a record. The
|
||||
This option controls whether to display the CLASS when printing a record. The
|
||||
default is to display the CLASS.
|
||||
.TP
|
||||
.B \fB+[no]ttl\fP
|
||||
Controls whether to display the TTL when printing a record. The
|
||||
This option controls whether to display the TTL when printing a record. The
|
||||
default is to display the TTL.
|
||||
.TP
|
||||
.B \fB+[no]rtrace\fP
|
||||
Toggle resolver fetch logging. This reports the name and type of each
|
||||
This option toggles resolver fetch logging. This reports the name and type of each
|
||||
query sent by \fBdelv\fP in the process of carrying out the resolution
|
||||
and validation process: this includes including the original query
|
||||
and validation process, including the original query
|
||||
and all subsequent queries to follow CNAMEs and to establish a chain
|
||||
of trust for DNSSEC validation.
|
||||
.sp
|
||||
This is equivalent to setting the debug level to 1 in the "resolver"
|
||||
logging category. Setting the systemwide debug level to 1 using the
|
||||
\fB\-d\fP option will product the same output (but will affect other
|
||||
logging categories as well).
|
||||
\fB\-d\fP option produces the same output, but affects other
|
||||
logging categories as well.
|
||||
.TP
|
||||
.B \fB+[no]mtrace\fP
|
||||
Toggle message logging. This produces a detailed dump of the
|
||||
This option toggles message logging. This produces a detailed dump of the
|
||||
responses received by \fBdelv\fP in the process of carrying out the
|
||||
resolution and validation process.
|
||||
.sp
|
||||
This is equivalent to setting the debug level to 10 for the "packets"
|
||||
module of the "resolver" logging category. Setting the systemwide
|
||||
debug level to 10 using the \fB\-d\fP option will produce the same
|
||||
output (but will affect other logging categories as well).
|
||||
debug level to 10 using the \fB\-d\fP option produces the same
|
||||
output, but affects other logging categories as well.
|
||||
.TP
|
||||
.B \fB+[no]vtrace\fP
|
||||
Toggle validation logging. This shows the internal process of the
|
||||
This option toggles validation logging. This shows the internal process of the
|
||||
validator as it determines whether an answer is validly signed,
|
||||
unsigned, or invalid.
|
||||
.sp
|
||||
This is equivalent to setting the debug level to 3 for the
|
||||
"validator" module of the "dnssec" logging category. Setting the
|
||||
systemwide debug level to 3 using the \fB\-d\fP option will produce the
|
||||
same output (but will affect other logging categories as well).
|
||||
systemwide debug level to 3 using the \fB\-d\fP option produces the
|
||||
same output, but affects other logging categories as well.
|
||||
.TP
|
||||
.B \fB+[no]short\fP
|
||||
Provide a terse answer. The default is to print the answer in a
|
||||
This option toggles between verbose and terse answers. The default is to print the answer in a
|
||||
verbose form.
|
||||
.TP
|
||||
.B \fB+[no]comments\fP
|
||||
Toggle the display of comment lines in the output. The default is to
|
||||
This option toggles the display of comment lines in the output. The default is to
|
||||
print comments.
|
||||
.TP
|
||||
.B \fB+[no]rrcomments\fP
|
||||
Toggle the display of per\-record comments in the output (for example,
|
||||
This option toggles the display of per\-record comments in the output (for example,
|
||||
human\-readable key information about DNSKEY records). The default is
|
||||
to print per\-record comments.
|
||||
.TP
|
||||
.B \fB+[no]crypto\fP
|
||||
Toggle the display of cryptographic fields in DNSSEC records. The
|
||||
contents of these field are unnecessary to debug most DNSSEC
|
||||
This option toggles the display of cryptographic fields in DNSSEC records. The
|
||||
contents of these fields are unnecessary to debug most DNSSEC
|
||||
validation failures and removing them makes it easier to see the
|
||||
common failures. The default is to display the fields. When omitted
|
||||
they are replaced by the string "[omitted]" or in the DNSKEY case the
|
||||
key id is displayed as the replacement, e.g. "[ key id = value ]".
|
||||
common failures. The default is to display the fields. When omitted,
|
||||
they are replaced by the string \fB[omitted]\fP or, in the DNSKEY case, the
|
||||
key ID is displayed as the replacement, e.g. \fB[ key id = value ]\fP\&.
|
||||
.TP
|
||||
.B \fB+[no]trust\fP
|
||||
Controls whether to display the trust level when printing a record.
|
||||
This option controls whether to display the trust level when printing a record.
|
||||
The default is to display the trust level.
|
||||
.TP
|
||||
.B \fB+[no]split[=W]\fP
|
||||
Split long hex\- or base64\-formatted fields in resource records into
|
||||
This option splits long hex\- or base64\-formatted fields in resource records into
|
||||
chunks of \fBW\fP characters (where \fBW\fP is rounded up to the nearest
|
||||
multiple of 4). \fB+nosplit\fP or \fB+split=0\fP causes fields not to be
|
||||
split at all. The default is 56 characters, or 44 characters when
|
||||
multiline mode is active.
|
||||
.TP
|
||||
.B \fB+[no]all\fP
|
||||
Set or clear the display options \fB+[no]comments\fP,
|
||||
This option sets or clears the display options \fB+[no]comments\fP,
|
||||
\fB+[no]rrcomments\fP, and \fB+[no]trust\fP as a group.
|
||||
.TP
|
||||
.B \fB+[no]multiline\fP
|
||||
Print long records (such as RRSIG, DNSKEY, and SOA records) in a
|
||||
This option prints long records (such as RRSIG, DNSKEY, and SOA records) in a
|
||||
verbose multi\-line format with human\-readable comments. The default
|
||||
is to print each record on a single line, to facilitate machine
|
||||
parsing of the \fBdelv\fP output.
|
||||
.TP
|
||||
.B \fB+[no]dnssec\fP
|
||||
Indicates whether to display RRSIG records in the \fBdelv\fP output.
|
||||
This option indicates whether to display RRSIG records in the \fBdelv\fP output.
|
||||
The default is to do so. Note that (unlike in \fBdig\fP) this does
|
||||
\fInot\fP control whether to request DNSSEC records or whether to
|
||||
\fInot\fP control whether to request DNSSEC records or to
|
||||
validate them. DNSSEC records are always requested, and validation
|
||||
will always occur unless suppressed by the use of \fB\-i\fP or
|
||||
always occurs unless suppressed by the use of \fB\-i\fP or
|
||||
\fB+noroot\fP\&.
|
||||
.TP
|
||||
.B \fB+[no]root[=ROOT]\fP
|
||||
Indicates whether to perform conventional DNSSEC validation, and if so,
|
||||
This option indicates whether to perform conventional DNSSEC validation, and if so,
|
||||
specifies the name of a trust anchor. The default is to validate using a
|
||||
trust anchor of "." (the root zone), for which there is a built\-in key. If
|
||||
specifying a different trust anchor, then \fB\-a\fP must be used to specify a
|
||||
file containing the key.
|
||||
.TP
|
||||
.B \fB+[no]tcp\fP
|
||||
Controls whether to use TCP when sending queries. The default is to
|
||||
This option controls whether to use TCP when sending queries. The default is to
|
||||
use UDP unless a truncated response has been received.
|
||||
.TP
|
||||
.B \fB+[no]unknownformat\fP
|
||||
Print all RDATA in unknown RR type presentation format (\fI\%RFC 3597\fP).
|
||||
This option prints all RDATA in unknown RR\-type presentation format (\fI\%RFC 3597\fP).
|
||||
The default is to print RDATA for known types in the type\(aqs
|
||||
presentation format.
|
||||
.TP
|
||||
.B \fB+[no]yaml\fP
|
||||
Print response data in YAML format.
|
||||
This option prints response data in YAML format.
|
||||
.UNINDENT
|
||||
.SH FILES
|
||||
.sp
|
||||
|
||||
407
doc/man/dig.1in
407
doc/man/dig.1in
@@ -42,33 +42,33 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
||||
\fBdig\fP is a flexible tool for interrogating DNS name servers. It
|
||||
performs DNS lookups and displays the answers that are returned from the
|
||||
name server(s) that were queried. Most DNS administrators use \fBdig\fP to
|
||||
troubleshoot DNS problems because of its flexibility, ease of use and
|
||||
troubleshoot DNS problems because of its flexibility, ease of use, and
|
||||
clarity of output. Other lookup tools tend to have less functionality
|
||||
than \fBdig\fP\&.
|
||||
.sp
|
||||
Although \fBdig\fP is normally used with command\-line arguments, it also
|
||||
has a batch mode of operation for reading lookup requests from a file. A
|
||||
brief summary of its command\-line arguments and options is printed when
|
||||
the \fB\-h\fP option is given. Unlike earlier versions, the BIND 9
|
||||
the \fB\-h\fP option is given. The BIND 9
|
||||
implementation of \fBdig\fP allows multiple lookups to be issued from the
|
||||
command line.
|
||||
.sp
|
||||
Unless it is told to query a specific name server, \fBdig\fP will try each
|
||||
Unless it is told to query a specific name server, \fBdig\fP tries each
|
||||
of the servers listed in \fB/etc/resolv.conf\fP\&. If no usable server
|
||||
addresses are found, \fBdig\fP will send the query to the local host.
|
||||
addresses are found, \fBdig\fP sends the query to the local host.
|
||||
.sp
|
||||
When no command line arguments or options are given, \fBdig\fP will
|
||||
perform an NS query for "." (the root).
|
||||
When no command\-line arguments or options are given, \fBdig\fP
|
||||
performs an NS query for "." (the root).
|
||||
.sp
|
||||
It is possible to set per\-user defaults for \fBdig\fP via
|
||||
\fB${HOME}/.digrc\fP\&. This file is read and any options in it are applied
|
||||
before the command line arguments. The \fB\-r\fP option disables this
|
||||
feature, for scripts that need predictable behaviour.
|
||||
before the command\-line arguments. The \fB\-r\fP option disables this
|
||||
feature, for scripts that need predictable behavior.
|
||||
.sp
|
||||
The IN and CH class names overlap with the IN and CH top level domain
|
||||
The IN and CH class names overlap with the IN and CH top\-level domain
|
||||
names. Either use the \fB\-t\fP and \fB\-c\fP options to specify the type and
|
||||
class, use the \fB\-q\fP the specify the domain name, or use "IN." and
|
||||
"CH." when looking up these top level domains.
|
||||
class, use the \fB\-q\fP to specify the domain name, or use "IN." and
|
||||
"CH." when looking up these top\-level domains.
|
||||
.SH SIMPLE USAGE
|
||||
.sp
|
||||
A typical invocation of \fBdig\fP looks like:
|
||||
@@ -97,114 +97,114 @@ If no \fBserver\fP argument is provided, \fBdig\fP consults
|
||||
\fB/etc/resolv.conf\fP; if an address is found there, it queries the
|
||||
name server at that address. If either of the \fB\-4\fP or \fB\-6\fP
|
||||
options are in use, then only addresses for the corresponding
|
||||
transport will be tried. If no usable addresses are found, \fBdig\fP
|
||||
will send the query to the local host. The reply from the name server
|
||||
transport are tried. If no usable addresses are found, \fBdig\fP
|
||||
sends the query to the local host. The reply from the name server
|
||||
that responds is displayed.
|
||||
.TP
|
||||
.B \fBname\fP
|
||||
is the name of the resource record that is to be looked up.
|
||||
.TP
|
||||
.B \fBtype\fP
|
||||
indicates what type of query is required MDASH ANY, A, MX, SIG, etc.
|
||||
indicates what type of query is required \- ANY, A, MX, SIG, etc.
|
||||
\fBtype\fP can be any valid query type. If no \fBtype\fP argument is
|
||||
supplied, \fBdig\fP will perform a lookup for an A record.
|
||||
supplied, \fBdig\fP performs a lookup for an A record.
|
||||
.UNINDENT
|
||||
.SH OPTIONS
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-4\fP
|
||||
Use IPv4 only.
|
||||
.B \fB\-4\fP
|
||||
This option indicates that only IPv4 should be used.
|
||||
.TP
|
||||
\fB\-6\fP
|
||||
Use IPv6 only.
|
||||
.B \fB\-6\fP
|
||||
This option indicates that only IPv6 should be used.
|
||||
.TP
|
||||
\fB\-b\fP address[#port]
|
||||
Set the source IP address of the query. The \fBaddress\fP must be a
|
||||
.B \fB\-b address[#port]\fP
|
||||
This option sets the source IP address of the query. The \fBaddress\fP must be a
|
||||
valid address on one of the host\(aqs network interfaces, or "0.0.0.0"
|
||||
or "::". An optional port may be specified by appending "#<port>"
|
||||
or "::". An optional port may be specified by appending \fB#port\fP\&.
|
||||
.TP
|
||||
\fB\-c\fP class
|
||||
Set the query class. The default \fBclass\fP is IN; other classes are
|
||||
.B \fB\-c class\fP
|
||||
This option sets the query class. The default \fBclass\fP is IN; other classes are
|
||||
HS for Hesiod records or CH for Chaosnet records.
|
||||
.TP
|
||||
\fB\-f\fP file
|
||||
Batch mode: \fBdig\fP reads a list of lookup requests to process from
|
||||
.B \fB\-f file\fP
|
||||
This option sets batch mode, in which \fBdig\fP reads a list of lookup requests to process from
|
||||
the given \fBfile\fP\&. Each line in the file should be organized in the
|
||||
same way they would be presented as queries to \fBdig\fP using the
|
||||
same way it would be presented as a query to \fBdig\fP using the
|
||||
command\-line interface.
|
||||
.TP
|
||||
\fB\-k\fP keyfile
|
||||
Sign queries using TSIG using a key read from the given file. Key
|
||||
files can be generated using tsig\-keygen8. When using TSIG
|
||||
.B \fB\-k keyfile\fP
|
||||
This option tells \fBnamed\fP to sign queries using TSIG using a key read from the given file. Key
|
||||
files can be generated using \fBtsig\-keygen\fP\&. When using TSIG
|
||||
authentication with \fBdig\fP, the name server that is queried needs to
|
||||
know the key and algorithm that is being used. In BIND, this is done
|
||||
by providing appropriate \fBkey\fP and \fBserver\fP statements in
|
||||
\fBnamed.conf\fP\&.
|
||||
.TP
|
||||
\fB\-m\fP
|
||||
Enable memory usage debugging.
|
||||
.B \fB\-m\fP
|
||||
This option enables memory usage debugging.
|
||||
.TP
|
||||
\fB\-p\fP port
|
||||
Send the query to a non\-standard port on the server, instead of the
|
||||
default port 53. This option would be used to test a name server that
|
||||
.B \fB\-p port\fP
|
||||
This option sends the query to a non\-standard port on the server, instead of the
|
||||
default port 53. This option is used to test a name server that
|
||||
has been configured to listen for queries on a non\-standard port
|
||||
number.
|
||||
.TP
|
||||
\fB\-q\fP name
|
||||
The domain name to query. This is useful to distinguish the \fBname\fP
|
||||
.B \fB\-q name\fP
|
||||
This option specifies the domain name to query. This is useful to distinguish the \fBname\fP
|
||||
from other arguments.
|
||||
.TP
|
||||
\fB\-r\fP
|
||||
Do not read options from \fB${HOME}/.digrc\fP\&. This is useful for
|
||||
scripts that need predictable behaviour.
|
||||
.B \fB\-r\fP
|
||||
This option indicates that options from \fB${HOME}/.digrc\fP should not be read. This is useful for
|
||||
scripts that need predictable behavior.
|
||||
.TP
|
||||
\fB\-t\fP type
|
||||
The resource record type to query. It can be any valid query type. If
|
||||
.B \fB\-t type\fP
|
||||
This option indicates the resource record type to query, which can be any valid query type. If
|
||||
it is a resource record type supported in BIND 9, it can be given by
|
||||
the type mnemonic (such as "NS" or "AAAA"). The default query type is
|
||||
"A", unless the \fB\-x\fP option is supplied to indicate a reverse
|
||||
the type mnemonic (such as \fBNS\fP or \fBAAAA\fP). The default query type is
|
||||
\fBA\fP, unless the \fB\-x\fP option is supplied to indicate a reverse
|
||||
lookup. A zone transfer can be requested by specifying a type of
|
||||
AXFR. When an incremental zone transfer (IXFR) is required, set the
|
||||
\fBtype\fP to \fBixfr=N\fP\&. The incremental zone transfer will contain
|
||||
the changes made to the zone since the serial number in the zone\(aqs
|
||||
\fBtype\fP to \fBixfr=N\fP\&. The incremental zone transfer contains
|
||||
all changes made to the zone since the serial number in the zone\(aqs
|
||||
SOA record was \fBN\fP\&.
|
||||
.sp
|
||||
All resource record types can be expressed as "TYPEnn", where "nn" is
|
||||
All resource record types can be expressed as \fBTYPEnn\fP, where \fBnn\fP is
|
||||
the number of the type. If the resource record type is not supported
|
||||
in BIND 9, the result will be displayed as described in \fI\%RFC 3597\fP\&.
|
||||
in BIND 9, the result is displayed as described in \fI\%RFC 3597\fP\&.
|
||||
.TP
|
||||
\fB\-u\fP
|
||||
Print query times in microseconds instead of milliseconds.
|
||||
.B \fB\-u\fP
|
||||
This option indicates that print query times should be provided in microseconds instead of milliseconds.
|
||||
.TP
|
||||
\fB\-v\fP
|
||||
Print the version number and exit.
|
||||
.B \fB\-v\fP
|
||||
This option prints the version number and exits.
|
||||
.TP
|
||||
\fB\-x\fP addr
|
||||
Simplified reverse lookups, for mapping addresses to names. The
|
||||
.B \fB\-x addr\fP
|
||||
This option sets simplified reverse lookups, for mapping addresses to names. The
|
||||
\fBaddr\fP is an IPv4 address in dotted\-decimal notation, or a
|
||||
colon\-delimited IPv6 address. When the \fB\-x\fP is used, there is no
|
||||
need to provide the \fBname\fP, \fBclass\fP and \fBtype\fP arguments.
|
||||
colon\-delimited IPv6 address. When the \fB\-x\fP option is used, there is no
|
||||
need to provide the \fBname\fP, \fBclass\fP, and \fBtype\fP arguments.
|
||||
\fBdig\fP automatically performs a lookup for a name like
|
||||
\fB94.2.0.192.in\-addr.arpa\fP and sets the query type and class to PTR
|
||||
and IN respectively. IPv6 addresses are looked up using nibble format
|
||||
under the IP6.ARPA domain.
|
||||
.TP
|
||||
\fB\-y\fP [hmac:]keyname:secret
|
||||
Sign queries using TSIG with the given authentication key.
|
||||
\fBkeyname\fP is the name of the key, and \fBsecret\fP is the base64
|
||||
encoded shared secret. \fBhmac\fP is the name of the key algorithm;
|
||||
.B \fB\-y [hmac:]keyname:secret\fP
|
||||
This option signs queries using TSIG with the given authentication key.
|
||||
\fBkeyname\fP is the name of the key, and \fBsecret\fP is the
|
||||
base64\-encoded shared secret. \fBhmac\fP is the name of the key algorithm;
|
||||
valid choices are \fBhmac\-md5\fP, \fBhmac\-sha1\fP, \fBhmac\-sha224\fP,
|
||||
\fBhmac\-sha256\fP, \fBhmac\-sha384\fP, or \fBhmac\-sha512\fP\&. If \fBhmac\fP is
|
||||
not specified, the default is \fBhmac\-md5\fP or if MD5 was disabled
|
||||
not specified, the default is \fBhmac\-md5\fP; if MD5 was disabled, the default is
|
||||
\fBhmac\-sha256\fP\&.
|
||||
.UNINDENT
|
||||
.sp
|
||||
\fBNOTE:\fP
|
||||
.INDENT 0.0
|
||||
.INDENT 3.5
|
||||
You should use the \fB\-k\fP option and avoid the \fB\-y\fP option,
|
||||
because with \fB\-y\fP the shared secret is supplied as a command line
|
||||
argument in clear text. This may be visible in the output from ps1 or
|
||||
Only the \fB\-k\fP option should be used, rather than the \fB\-y\fP option,
|
||||
because with \fB\-y\fP the shared secret is supplied as a command\-line
|
||||
argument in clear text. This may be visible in the output from \fBps1\fP or
|
||||
in a history file maintained by the user\(aqs shell.
|
||||
.UNINDENT
|
||||
.UNINDENT
|
||||
@@ -217,303 +217,297 @@ answer get printed, and others determine the timeout and retry
|
||||
strategies.
|
||||
.sp
|
||||
Each query option is identified by a keyword preceded by a plus sign
|
||||
(\fB+\fP). Some keywords set or reset an option. These may be preceded by
|
||||
(\fB+\fP). Some keywords set or reset an option; these may be preceded by
|
||||
the string \fBno\fP to negate the meaning of that keyword. Other keywords
|
||||
assign values to options like the timeout interval. They have the form
|
||||
assign values to options, like the timeout interval. They have the form
|
||||
\fB+keyword=value\fP\&. Keywords may be abbreviated, provided the
|
||||
abbreviation is unambiguous; for example, \fB+cd\fP is equivalent to
|
||||
\fB+cdflag\fP\&. The query options are:
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
.B \fB+[no]aaflag\fP
|
||||
A synonym for \fB+[no]aaonly\fP\&.
|
||||
This option is a synonym for \fB+[no]aaonly\fP\&.
|
||||
.TP
|
||||
.B \fB+[no]aaonly\fP
|
||||
Sets the "aa" flag in the query.
|
||||
This option sets the \fBaa\fP flag in the query.
|
||||
.TP
|
||||
.B \fB+[no]additional\fP
|
||||
Display [do not display] the additional section of a reply. The
|
||||
This option displays [or does not display] the additional section of a reply. The
|
||||
default is to display it.
|
||||
.TP
|
||||
.B \fB+[no]adflag\fP
|
||||
Set [do not set] the AD (authentic data) bit in the query. This
|
||||
This option sets [or does not set] the AD (authentic data) bit in the query. This
|
||||
requests the server to return whether all of the answer and authority
|
||||
sections have all been validated as secure according to the security
|
||||
policy of the server. AD=1 indicates that all records have been
|
||||
validated as secure and the answer is not from a OPT\-OUT range. AD=0
|
||||
indicate that some part of the answer was insecure or not validated.
|
||||
sections have been validated as secure, according to the security
|
||||
policy of the server. \fBAD=1\fP indicates that all records have been
|
||||
validated as secure and the answer is not from a OPT\-OUT range. \fBAD=0\fP
|
||||
indicates that some part of the answer was insecure or not validated.
|
||||
This bit is set by default.
|
||||
.TP
|
||||
.B \fB+[no]all\fP
|
||||
Set or clear all display flags.
|
||||
This option sets or clears all display flags.
|
||||
.TP
|
||||
.B \fB+[no]answer\fP
|
||||
Display [do not display] the answer section of a reply. The default
|
||||
This option displays [or does not display] the answer section of a reply. The default
|
||||
is to display it.
|
||||
.TP
|
||||
.B \fB+[no]authority\fP
|
||||
Display [do not display] the authority section of a reply. The
|
||||
This option displays [or does not display] the authority section of a reply. The
|
||||
default is to display it.
|
||||
.TP
|
||||
.B \fB+[no]badcookie\fP
|
||||
Retry lookup with the new server cookie if a BADCOOKIE response is
|
||||
This option retries the lookup with a new server cookie if a BADCOOKIE response is
|
||||
received.
|
||||
.TP
|
||||
.B \fB+[no]besteffort\fP
|
||||
Attempt to display the contents of messages which are malformed. The
|
||||
This option attempts to display the contents of messages which are malformed. The
|
||||
default is to not display malformed answers.
|
||||
.TP
|
||||
.B \fB+bufsize=B\fP
|
||||
Set the UDP message buffer size advertised using EDNS0 to \fBB\fP
|
||||
bytes. The maximum and minimum sizes of this buffer are 65535 and 0
|
||||
This option sets the UDP message buffer size advertised using EDNS0 to \fBB\fP
|
||||
bytes. The maximum and minimum sizes of this buffer are 65535 and 0,
|
||||
respectively. Values outside this range are rounded up or down
|
||||
appropriately. Values other than zero will cause a EDNS query to be
|
||||
appropriately. Values other than zero cause an EDNS query to be
|
||||
sent.
|
||||
.TP
|
||||
.B \fB+[no]cdflag\fP
|
||||
Set [do not set] the CD (checking disabled) bit in the query. This
|
||||
This option sets [or does not set] the CD (checking disabled) bit in the query. This
|
||||
requests the server to not perform DNSSEC validation of responses.
|
||||
.TP
|
||||
.B \fB+[no]class\fP
|
||||
Display [do not display] the CLASS when printing the record.
|
||||
This option displays [or does not display] the CLASS when printing the record.
|
||||
.TP
|
||||
.B \fB+[no]cmd\fP
|
||||
Toggles the printing of the initial comment in the output, identifying the
|
||||
version of \fBdig\fP and the query options that have been applied. This option
|
||||
always has global effect; it cannot be set globally and then overridden on a
|
||||
per\-lookup basis. The default is to print this comment.
|
||||
This option toggles the printing of the initial comment in the output, identifying the
|
||||
version of \fBdig\fP and the query options that have been applied. This option
|
||||
always has a global effect; it cannot be set globally and then overridden on a
|
||||
per\-lookup basis. The default is to print this comment.
|
||||
.TP
|
||||
.B \fB+[no]comments\fP
|
||||
Toggles the display of some comment lines in the output, containing
|
||||
This option toggles the display of some comment lines in the output, with
|
||||
information about the packet header and OPT pseudosection, and the names of
|
||||
the response section. The default is to print these comments.
|
||||
the response section. The default is to print these comments.
|
||||
.sp
|
||||
Other types of comments in the output are not affected by this option, but
|
||||
can be controlled using other command line switches. These include
|
||||
can be controlled using other command\-line switches. These include
|
||||
\fB+[no]cmd\fP, \fB+[no]question\fP, \fB+[no]stats\fP, and \fB+[no]rrcomments\fP\&.
|
||||
.TP
|
||||
.B \fB+[no]cookie=####\fP
|
||||
Send a COOKIE EDNS option, with optional value. Replaying a COOKIE
|
||||
from a previous response will allow the server to identify a previous
|
||||
This option sends [or does not send] a COOKIE EDNS option, with an optional value. Replaying a COOKIE
|
||||
from a previous response allows the server to identify a previous
|
||||
client. The default is \fB+cookie\fP\&.
|
||||
.sp
|
||||
\fB+cookie\fP is also set when +trace is set to better emulate the
|
||||
\fB+cookie\fP is also set when \fB+trace\fP is set to better emulate the
|
||||
default queries from a nameserver.
|
||||
.TP
|
||||
.B \fB+[no]crypto\fP
|
||||
Toggle the display of cryptographic fields in DNSSEC records. The
|
||||
contents of these field are unnecessary to debug most DNSSEC
|
||||
This option toggles the display of cryptographic fields in DNSSEC records. The
|
||||
contents of these fields are unnecessary for debugging most DNSSEC
|
||||
validation failures and removing them makes it easier to see the
|
||||
common failures. The default is to display the fields. When omitted
|
||||
they are replaced by the string "[omitted]" or in the DNSKEY case the
|
||||
key id is displayed as the replacement, e.g. "[ key id = value ]".
|
||||
common failures. The default is to display the fields. When omitted,
|
||||
they are replaced by the string \fB[omitted]\fP or, in the DNSKEY case, the
|
||||
key ID is displayed as the replacement, e.g. \fB[ key id = value ]\fP\&.
|
||||
.TP
|
||||
.B \fB+[no]defname\fP
|
||||
Deprecated, treated as a synonym for \fB+[no]search\fP
|
||||
This option, which is deprecated, is treated as a synonym for \fB+[no]search\fP\&.
|
||||
.TP
|
||||
.B \fB+[no]dnssec\fP
|
||||
Requests DNSSEC records be sent by setting the DNSSEC OK bit (DO) in
|
||||
This option requests that DNSSEC records be sent by setting the DNSSEC OK (DO) bit in
|
||||
the OPT record in the additional section of the query.
|
||||
.TP
|
||||
.B \fB+domain=somename\fP
|
||||
Set the search list to contain the single domain \fBsomename\fP, as if
|
||||
This option sets the search list to contain the single domain \fBsomename\fP, as if
|
||||
specified in a \fBdomain\fP directive in \fB/etc/resolv.conf\fP, and
|
||||
enable search list processing as if the \fB+search\fP option were
|
||||
enables search list processing as if the \fB+search\fP option were
|
||||
given.
|
||||
.TP
|
||||
.B \fB+dscp=value\fP
|
||||
Set the DSCP code point to be used when sending the query. Valid DSCP
|
||||
code points are in the range [0..63]. By default no code point is
|
||||
This option sets the DSCP code point to be used when sending the query. Valid DSCP
|
||||
code points are in the range [0...63]. By default no code point is
|
||||
explicitly set.
|
||||
.TP
|
||||
.B \fB+[no]edns[=#]\fP
|
||||
Specify the EDNS version to query with. Valid values are 0 to 255.
|
||||
Setting the EDNS version will cause a EDNS query to be sent.
|
||||
This option specifies the EDNS version to query with. Valid values are 0 to 255.
|
||||
Setting the EDNS version causes an EDNS query to be sent.
|
||||
\fB+noedns\fP clears the remembered EDNS version. EDNS is set to 0 by
|
||||
default.
|
||||
.TP
|
||||
.B \fB+[no]ednsflags[=#]\fP
|
||||
Set the must\-be\-zero EDNS flags bits (Z bits) to the specified value.
|
||||
Decimal, hex and octal encodings are accepted. Setting a named flag
|
||||
(e.g. DO) will silently be ignored. By default, no Z bits are set.
|
||||
This option sets the must\-be\-zero EDNS flags bits (Z bits) to the specified value.
|
||||
Decimal, hex, and octal encodings are accepted. Setting a named flag
|
||||
(e.g., DO) is silently ignored. By default, no Z bits are set.
|
||||
.TP
|
||||
.B \fB+[no]ednsnegotiation\fP
|
||||
Enable / disable EDNS version negotiation. By default EDNS version
|
||||
This option enables/disables EDNS version negotiation. By default, EDNS version
|
||||
negotiation is enabled.
|
||||
.TP
|
||||
.B \fB+[no]ednsopt[=code[:value]]\fP
|
||||
Specify EDNS option with code point \fBcode\fP and optionally payload
|
||||
This option specifies the EDNS option with code point \fBcode\fP and an optional payload
|
||||
of \fBvalue\fP as a hexadecimal string. \fBcode\fP can be either an EDNS
|
||||
option name (for example, \fBNSID\fP or \fBECS\fP), or an arbitrary
|
||||
option name (for example, \fBNSID\fP or \fBECS\fP) or an arbitrary
|
||||
numeric value. \fB+noednsopt\fP clears the EDNS options to be sent.
|
||||
.TP
|
||||
.B \fB+[no]expire\fP
|
||||
Send an EDNS Expire option.
|
||||
This option sends an EDNS Expire option.
|
||||
.TP
|
||||
.B \fB+[no]fail\fP
|
||||
Do not try the next server if you receive a SERVFAIL. The default is
|
||||
to not try the next server which is the reverse of normal stub
|
||||
This option indicates that \fBnamed\fP should try [or not try] the next server if a SERVFAIL is received. The default is
|
||||
to not try the next server, which is the reverse of normal stub
|
||||
resolver behavior.
|
||||
.TP
|
||||
.B \fB+[no]header\-only\fP
|
||||
Send a query with a DNS header without a question section. The
|
||||
This option sends a query with a DNS header without a question section. The
|
||||
default is to add a question section. The query type and query name
|
||||
are ignored when this is set.
|
||||
.TP
|
||||
.B \fB+[no]identify\fP
|
||||
Show [or do not show] the IP address and port number that supplied
|
||||
the answer when the \fB+short\fP option is enabled. If short form
|
||||
This option shows [or does not show] the IP address and port number that supplied
|
||||
the answer, when the \fB+short\fP option is enabled. If short form
|
||||
answers are requested, the default is not to show the source address
|
||||
and port number of the server that provided the answer.
|
||||
.TP
|
||||
.B \fB+[no]idnin\fP
|
||||
Process [do not process] IDN domain names on input. This requires IDN
|
||||
SUPPORT to have been enabled at compile time.
|
||||
This option processes [or does not process] IDN domain names on input. This requires
|
||||
\fBIDN SUPPORT\fP to have been enabled at compile time.
|
||||
.sp
|
||||
The default is to process IDN input when standard output is a tty.
|
||||
The IDN processing on input is disabled when dig output is redirected
|
||||
The IDN processing on input is disabled when \fBdig\fP output is redirected
|
||||
to files, pipes, and other non\-tty file descriptors.
|
||||
.TP
|
||||
.B \fB+[no]idnout\fP
|
||||
Convert [do not convert] puny code on output. This requires IDN
|
||||
SUPPORT to have been enabled at compile time.
|
||||
This option converts [or does not convert] puny code on output. This requires
|
||||
\fBIDN SUPPORT\fP to have been enabled at compile time.
|
||||
.sp
|
||||
The default is to process puny code on output when standard output is
|
||||
a tty. The puny code processing on output is disabled when dig output
|
||||
a tty. The puny code processing on output is disabled when \fBdig\fP output
|
||||
is redirected to files, pipes, and other non\-tty file descriptors.
|
||||
.TP
|
||||
.B \fB+[no]ignore\fP
|
||||
Ignore truncation in UDP responses instead of retrying with TCP. By
|
||||
This option ignores [or does not ignore] truncation in UDP responses instead of retrying with TCP. By
|
||||
default, TCP retries are performed.
|
||||
.TP
|
||||
.B \fB+[no]keepalive\fP
|
||||
Send [or do not send] an EDNS Keepalive option.
|
||||
This option sends [or does not send] an EDNS Keepalive option.
|
||||
.TP
|
||||
.B \fB+[no]keepopen\fP
|
||||
Keep the TCP socket open between queries and reuse it rather than
|
||||
This option keeps [or does not keep] the TCP socket open between queries, and reuses it rather than
|
||||
creating a new TCP socket for each lookup. The default is
|
||||
\fB+nokeepopen\fP\&.
|
||||
.TP
|
||||
.B \fB+[no]mapped\fP
|
||||
Allow mapped IPv4 over IPv6 addresses to be used. The default is
|
||||
This option allows [or does not allow] mapped IPv4\-over\-IPv6 addresses to be used. The default is
|
||||
\fB+mapped\fP\&.
|
||||
.TP
|
||||
.B \fB+[no]multiline\fP
|
||||
Print records like the SOA records in a verbose multi\-line format
|
||||
This option prints [or does not print] records, like the SOA records, in a verbose multi\-line format
|
||||
with human\-readable comments. The default is to print each record on
|
||||
a single line, to facilitate machine parsing of the \fBdig\fP output.
|
||||
a single line to facilitate machine parsing of the \fBdig\fP output.
|
||||
.TP
|
||||
.B \fB+ndots=D\fP
|
||||
Set the number of dots that have to appear in \fBname\fP to \fBD\fP for
|
||||
This option sets the number of dots (\fBD\fP) that must appear in \fBname\fP for
|
||||
it to be considered absolute. The default value is that defined using
|
||||
the ndots statement in \fB/etc/resolv.conf\fP, or 1 if no ndots
|
||||
the \fBndots\fP statement in \fB/etc/resolv.conf\fP, or 1 if no \fBndots\fP
|
||||
statement is present. Names with fewer dots are interpreted as
|
||||
relative names and will be searched for in the domains listed in the
|
||||
relative names, and are searched for in the domains listed in the
|
||||
\fBsearch\fP or \fBdomain\fP directive in \fB/etc/resolv.conf\fP if
|
||||
\fB+search\fP is set.
|
||||
.TP
|
||||
.B \fB+[no]nsid\fP
|
||||
Include an EDNS name server ID request when sending a query.
|
||||
When enabled, this option includes an EDNS name server ID request when sending a query.
|
||||
.TP
|
||||
.B \fB+[no]nssearch\fP
|
||||
When this option is set, \fBdig\fP attempts to find the authoritative
|
||||
name servers for the zone containing the name being looked up and
|
||||
name servers for the zone containing the name being looked up, and
|
||||
display the SOA record that each name server has for the zone.
|
||||
Addresses of servers that that did not respond are also printed.
|
||||
Addresses of servers that did not respond are also printed.
|
||||
.TP
|
||||
.B \fB+[no]onesoa\fP
|
||||
Print only one (starting) SOA record when performing an AXFR. The
|
||||
When enabled, this option prints only one (starting) SOA record when performing an AXFR. The
|
||||
default is to print both the starting and ending SOA records.
|
||||
.TP
|
||||
.B \fB+[no]opcode=value\fP
|
||||
Set [restore] the DNS message opcode to the specified value. The
|
||||
When enabled, this option sets (restores) the DNS message opcode to the specified value. The
|
||||
default value is QUERY (0).
|
||||
.TP
|
||||
.B \fB+padding=value\fP
|
||||
Pad the size of the query packet using the EDNS Padding option to
|
||||
blocks of \fBvalue\fP bytes. For example, \fB+padding=32\fP would cause a
|
||||
This option pads the size of the query packet using the EDNS Padding option to
|
||||
blocks of \fBvalue\fP bytes. For example, \fB+padding=32\fP causes a
|
||||
48\-byte query to be padded to 64 bytes. The default block size is 0,
|
||||
which disables padding. The maximum is 512. Values are ordinarily
|
||||
which disables padding; the maximum is 512. Values are ordinarily
|
||||
expected to be powers of two, such as 128; however, this is not
|
||||
mandatory. Responses to padded queries may also be padded, but only
|
||||
if the query uses TCP or DNS COOKIE.
|
||||
.UNINDENT
|
||||
.sp
|
||||
\fB+qid=value\fP
|
||||
.INDENT 0.0
|
||||
.INDENT 3.5
|
||||
Specify the query ID to use when sending queries.
|
||||
.UNINDENT
|
||||
.UNINDENT
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
.B \fB+qid=value\fP
|
||||
This option specifies the query ID to use when sending queries.
|
||||
.TP
|
||||
.B \fB+[no]qr\fP
|
||||
Toggles the display of the query message as it is sent. By default, the query
|
||||
This option toggles the display of the query message as it is sent. By default, the query
|
||||
is not printed.
|
||||
.TP
|
||||
.B \fB+[no]question\fP
|
||||
Toggles the display of the question section of a query when an answer is
|
||||
returned. The default is to print the question section as a comment.
|
||||
This option toggles the display of the question section of a query when an answer is
|
||||
returned. The default is to print the question section as a comment.
|
||||
.TP
|
||||
.B \fB+[no]raflag\fP
|
||||
Set [do not set] the RA (Recursion Available) bit in the query. The
|
||||
default is +noraflag. This bit should be ignored by the server for
|
||||
This option sets [or does not set] the RA (Recursion Available) bit in the query. The
|
||||
default is \fB+noraflag\fP\&. This bit is ignored by the server for
|
||||
QUERY.
|
||||
.TP
|
||||
.B \fB+[no]rdflag\fP
|
||||
A synonym for \fB+[no]recurse\fP\&.
|
||||
This option is a synonym for \fB+[no]recurse\fP\&.
|
||||
.TP
|
||||
.B \fB+[no]recurse\fP
|
||||
Toggle the setting of the RD (recursion desired) bit in the query.
|
||||
This option toggles the setting of the RD (recursion desired) bit in the query.
|
||||
This bit is set by default, which means \fBdig\fP normally sends
|
||||
recursive queries. Recursion is automatically disabled when the
|
||||
\fB+nssearch\fP or \fB+trace\fP query options are used.
|
||||
\fB+nssearch\fP or \fB+trace\fP query option is used.
|
||||
.TP
|
||||
.B \fB+retry=T\fP
|
||||
Sets the number of times to retry UDP queries to server to \fBT\fP
|
||||
This option sets the number of times to retry UDP queries to server to \fBT\fP
|
||||
instead of the default, 2. Unlike \fB+tries\fP, this does not include
|
||||
the initial query.
|
||||
.TP
|
||||
.B \fB+[no]rrcomments\fP
|
||||
Toggle the display of per\-record comments in the output (for example,
|
||||
This option toggles the display of per\-record comments in the output (for example,
|
||||
human\-readable key information about DNSKEY records). The default is
|
||||
not to print record comments unless multiline mode is active.
|
||||
.TP
|
||||
.B \fB+[no]search\fP
|
||||
Use [do not use] the search list defined by the searchlist or domain
|
||||
directive in \fBresolv.conf\fP (if any). The search list is not used by
|
||||
This option uses [or does not use] the search list defined by the searchlist or domain
|
||||
directive in \fBresolv.conf\fP, if any. The search list is not used by
|
||||
default.
|
||||
.sp
|
||||
\(aqndots\(aq from \fBresolv.conf\fP (default 1) which may be overridden by
|
||||
\fB+ndots\fP determines if the name will be treated as relative or not
|
||||
and hence whether a search is eventually performed or not.
|
||||
\fBndots\fP from \fBresolv.conf\fP (default 1), which may be overridden by
|
||||
\fB+ndots\fP, determines whether the name is treated as relative
|
||||
and hence whether a search is eventually performed.
|
||||
.TP
|
||||
.B \fB+[no]short\fP
|
||||
Provide a terse answer. The default is to print the answer in a verbose
|
||||
form. This option always has global effect; it cannot be set globally and
|
||||
This option toggles whether a terse answer is provided. The default is to print the answer in a verbose
|
||||
form. This option always has a global effect; it cannot be set globally and
|
||||
then overridden on a per\-lookup basis.
|
||||
.TP
|
||||
.B \fB+[no]showsearch\fP
|
||||
Perform [do not perform] a search showing intermediate results.
|
||||
This option performs [or does not perform] a search showing intermediate results.
|
||||
.TP
|
||||
.B \fB+[no]sigchase\fP
|
||||
This feature is now obsolete and has been removed; use \fBdelv\fP
|
||||
instead.
|
||||
.TP
|
||||
.B \fB+split=W\fP
|
||||
Split long hex\- or base64\-formatted fields in resource records into
|
||||
This option splits long hex\- or base64\-formatted fields in resource records into
|
||||
chunks of \fBW\fP characters (where \fBW\fP is rounded up to the nearest
|
||||
multiple of 4). \fB+nosplit\fP or \fB+split=0\fP causes fields not to be
|
||||
split at all. The default is 56 characters, or 44 characters when
|
||||
multiline mode is active.
|
||||
.TP
|
||||
.B \fB+[no]stats\fP
|
||||
Toggles the printing of statistics: when the query was made, the size of the
|
||||
reply and so on. The default behavior is to print the query statistics as a
|
||||
This option toggles the printing of statistics: when the query was made, the size of the
|
||||
reply, etc. The default behavior is to print the query statistics as a
|
||||
comment after each lookup.
|
||||
.TP
|
||||
.B \fB+[no]subnet=addr[/prefix\-length]\fP
|
||||
Send (don\(aqt send) an EDNS Client Subnet option with the specified IP
|
||||
This option sends [or does not send] an EDNS CLIENT\-SUBNET option with the specified IP
|
||||
address or network prefix.
|
||||
.sp
|
||||
\fBdig +subnet=0.0.0.0/0\fP, or simply \fBdig +subnet=0\fP for short,
|
||||
@@ -522,75 +516,74 @@ prefix\-length of zero, which signals a resolver that the client\(aqs
|
||||
address information must \fInot\fP be used when resolving this query.
|
||||
.TP
|
||||
.B \fB+[no]tcflag\fP
|
||||
Set [do not set] the TC (TrunCation) bit in the query. The default is
|
||||
+notcflag. This bit should be ignored by the server for QUERY.
|
||||
This option sets [or does not set] the TC (TrunCation) bit in the query. The default is
|
||||
\fB+notcflag\fP\&. This bit is ignored by the server for QUERY.
|
||||
.TP
|
||||
.B \fB+[no]tcp\fP
|
||||
Use [do not use] TCP when querying name servers. The default behavior
|
||||
This option uses [or does not use] TCP when querying name servers. The default behavior
|
||||
is to use UDP unless a type \fBany\fP or \fBixfr=N\fP query is requested,
|
||||
in which case the default is TCP. AXFR queries always use TCP.
|
||||
.TP
|
||||
.B \fB+timeout=T\fP
|
||||
Sets the timeout for a query to \fBT\fP seconds. The default timeout is
|
||||
5 seconds. An attempt to set \fBT\fP to less than 1 will result in a
|
||||
query timeout of 1 second being applied.
|
||||
This option sets the timeout for a query to \fBT\fP seconds. The default timeout is
|
||||
5 seconds. An attempt to set \fBT\fP to less than 1 is silently set to 1.
|
||||
.TP
|
||||
.B \fB+[no]topdown\fP
|
||||
This feature is related to \fBdig +sigchase\fP, which is obsolete and
|
||||
has been removed. Use \fBdelv\fP instead.
|
||||
.TP
|
||||
.B \fB+[no]trace\fP
|
||||
Toggle tracing of the delegation path from the root name servers for
|
||||
This option toggles tracing of the delegation path from the root name servers for
|
||||
the name being looked up. Tracing is disabled by default. When
|
||||
tracing is enabled, \fBdig\fP makes iterative queries to resolve the
|
||||
name being looked up. It will follow referrals from the root servers,
|
||||
name being looked up. It follows referrals from the root servers,
|
||||
showing the answer from each server that was used to resolve the
|
||||
lookup.
|
||||
.sp
|
||||
If @server is also specified, it affects only the initial query for
|
||||
If \fB@server\fP is also specified, it affects only the initial query for
|
||||
the root zone name servers.
|
||||
.sp
|
||||
\fB+dnssec\fP is also set when +trace is set to better emulate the
|
||||
default queries from a nameserver.
|
||||
\fB+dnssec\fP is also set when \fB+trace\fP is set, to better emulate the
|
||||
default queries from a name server.
|
||||
.TP
|
||||
.B \fB+tries=T\fP
|
||||
Sets the number of times to try UDP queries to server to \fBT\fP
|
||||
This option sets the number of times to try UDP queries to server to \fBT\fP
|
||||
instead of the default, 3. If \fBT\fP is less than or equal to zero,
|
||||
the number of tries is silently rounded up to 1.
|
||||
.TP
|
||||
.B \fB+trusted\-key=####\fP
|
||||
Formerly specified trusted keys for use with \fBdig +sigchase\fP\&. This
|
||||
This option formerly specified trusted keys for use with \fBdig +sigchase\fP\&. This
|
||||
feature is now obsolete and has been removed; use \fBdelv\fP instead.
|
||||
.TP
|
||||
.B \fB+[no]ttlid\fP
|
||||
Display [do not display] the TTL when printing the record.
|
||||
This option displays [or does not display] the TTL when printing the record.
|
||||
.TP
|
||||
.B \fB+[no]ttlunits\fP
|
||||
Display [do not display] the TTL in friendly human\-readable time
|
||||
units of "s", "m", "h", "d", and "w", representing seconds, minutes,
|
||||
hours, days and weeks. Implies +ttlid.
|
||||
This option displays [or does not display] the TTL in friendly human\-readable time
|
||||
units of \fBs\fP, \fBm\fP, \fBh\fP, \fBd\fP, and \fBw\fP, representing seconds, minutes,
|
||||
hours, days, and weeks. This implies \fB+ttlid\fP\&.
|
||||
.TP
|
||||
.B \fB+[no]unexpected\fP
|
||||
Accept [do not accept] answers from unexpected sources. By default, \fBdig\fP
|
||||
won\(aqt accept a reply from a source other than the one to which it sent the
|
||||
This option accepts [or does not accept] answers from unexpected sources. By default, \fBdig\fP
|
||||
will not accept a reply from a source other than the one to which it sent the
|
||||
query.
|
||||
.TP
|
||||
.B \fB+[no]unknownformat\fP
|
||||
Print all RDATA in unknown RR type presentation format (\fI\%RFC 3597\fP).
|
||||
This option prints all RDATA in unknown RR type presentation format (\fI\%RFC 3597\fP).
|
||||
The default is to print RDATA for known types in the type\(aqs
|
||||
presentation format.
|
||||
.TP
|
||||
.B \fB+[no]vc\fP
|
||||
Use [do not use] TCP when querying name servers. This alternate
|
||||
This option uses [or does not use] TCP when querying name servers. This alternate
|
||||
syntax to \fB+[no]tcp\fP is provided for backwards compatibility. The
|
||||
"vc" stands for "virtual circuit".
|
||||
\fBvc\fP stands for "virtual circuit."
|
||||
.TP
|
||||
.B \fB+[no]yaml\fP
|
||||
Print the responses (and, if <option>+qr</option> is in use, also the
|
||||
When enabled, this option prints the responses (and, if \fB+qr\fP is in use, also the
|
||||
outgoing queries) in a detailed YAML format.
|
||||
.TP
|
||||
.B \fB+[no]zflag\fP
|
||||
Set [do not set] the last unassigned DNS header flag in a DNS query.
|
||||
This option sets [or does not set] the last unassigned DNS header flag in a DNS query.
|
||||
This flag is off by default.
|
||||
.UNINDENT
|
||||
.SH MULTIPLE QUERIES
|
||||
@@ -598,12 +591,12 @@ This flag is off by default.
|
||||
The BIND 9 implementation of \fBdig\fP supports specifying multiple
|
||||
queries on the command line (in addition to supporting the \fB\-f\fP batch
|
||||
file option). Each of those queries can be supplied with its own set of
|
||||
flags, options and query options.
|
||||
flags, options, and query options.
|
||||
.sp
|
||||
In this case, each \fBquery\fP argument represent an individual query in
|
||||
In this case, each \fBquery\fP argument represents an individual query in
|
||||
the command\-line syntax described above. Each consists of any of the
|
||||
standard options and flags, the name to be looked up, an optional query
|
||||
type and class and any query options that should be applied to that
|
||||
type and class, and any query options that should be applied to that
|
||||
query.
|
||||
.sp
|
||||
A global set of query options, which should be applied to all queries,
|
||||
@@ -623,21 +616,21 @@ dig +qr www.isc.org any \-x 127.0.0.1 isc.org ns +noqr
|
||||
.UNINDENT
|
||||
.UNINDENT
|
||||
.sp
|
||||
shows how \fBdig\fP could be used from the command line to make three
|
||||
lookups: an ANY query for \fBwww.isc.org\fP, a reverse lookup of 127.0.0.1
|
||||
shows how \fBdig\fP can be used from the command line to make three
|
||||
lookups: an ANY query for \fBwww.isc.org\fP, a reverse lookup of 127.0.0.1,
|
||||
and a query for the NS records of \fBisc.org\fP\&. A global query option of
|
||||
\fB+qr\fP is applied, so that \fBdig\fP shows the initial query it made for
|
||||
each lookup. The final query has a local query option of \fB+noqr\fP which
|
||||
means that \fBdig\fP will not print the initial query when it looks up the
|
||||
means that \fBdig\fP does not print the initial query when it looks up the
|
||||
NS records for \fBisc.org\fP\&.
|
||||
.SH IDN SUPPORT
|
||||
.sp
|
||||
If \fBdig\fP has been built with IDN (internationalized domain name)
|
||||
support, it can accept and display non\-ASCII domain names. \fBdig\fP
|
||||
appropriately converts character encoding of domain name before sending
|
||||
a request to DNS server or displaying a reply from the server. If you\(aqd
|
||||
like to turn off the IDN support for some reason, use parameters
|
||||
\fB+noidnin\fP and \fB+noidnout\fP or define the IDN_DISABLE environment
|
||||
appropriately converts character encoding of a domain name before sending
|
||||
a request to a DNS server or displaying a reply from the server.
|
||||
To turn off IDN support, use the parameters
|
||||
\fB+noidnin\fP and \fB+noidnout\fP, or define the \fBIDN_DISABLE\fP environment
|
||||
variable.
|
||||
.SH FILES
|
||||
.sp
|
||||
|
||||
@@ -32,15 +32,15 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
||||
..
|
||||
.SH SYNOPSIS
|
||||
.sp
|
||||
\fBdnssec\-cds\fP [\fB\-a\fP alg...] [\fB\-c\fP class] [\fB\-D\fP] {\fB\-d\fP dsset\-file} {\fB\-f\fP child\-file} [\fB\-i\fP [extension]] [\fB\-s\fP start\-time] [\fB\-T\fP ttl] [\fB\-u\fP] [\fB\-v\fP level] [\fB\-V\fP] {domain}
|
||||
\fBdnssec\-cds\fP [\fB\-a\fP alg...] [\fB\-c\fP class] [\fB\-D\fP] {\fB\-d\fP dsset\-file} {\fB\-f\fP child\-file} [\fB\-i**[extension]] [\fP\-s** start\-time] [\fB\-T\fP ttl] [\fB\-u\fP] [\fB\-v\fP level] [\fB\-V\fP] {domain}
|
||||
.SH DESCRIPTION
|
||||
.sp
|
||||
The \fBdnssec\-cds\fP command changes DS records at a delegation point
|
||||
based on CDS or CDNSKEY records published in the child zone. If both CDS
|
||||
and CDNSKEY records are present in the child zone, the CDS is preferred.
|
||||
This enables a child zone to inform its parent of upcoming changes to
|
||||
its key\-signing keys; by polling periodically with \fBdnssec\-cds\fP, the
|
||||
parent can keep the DS records up to date and enable automatic rolling
|
||||
its key\-signing keys (KSKs); by polling periodically with \fBdnssec\-cds\fP, the
|
||||
parent can keep the DS records up\-to\-date and enable automatic rolling
|
||||
of KSKs.
|
||||
.sp
|
||||
Two input files are required. The \fB\-f child\-file\fP option specifies a
|
||||
@@ -53,12 +53,12 @@ output of a previous run of \fBdnssec\-cds\fP\&.
|
||||
.sp
|
||||
The \fBdnssec\-cds\fP command uses special DNSSEC validation logic
|
||||
specified by \fI\%RFC 7344\fP\&. It requires that the CDS and/or CDNSKEY records
|
||||
are validly signed by a key represented in the existing DS records. This
|
||||
will typically be the pre\-existing key\-signing key (KSK).
|
||||
be validly signed by a key represented in the existing DS records. This
|
||||
is typically the pre\-existing KSK.
|
||||
.sp
|
||||
For protection against replay attacks, the signatures on the child
|
||||
records must not be older than they were on a previous run of
|
||||
\fBdnssec\-cds\fP\&. This time is obtained from the modification time of the
|
||||
\fBdnssec\-cds\fP\&. Their age is obtained from the modification time of the
|
||||
\fBdsset\-\fP file, or from the \fB\-s\fP option.
|
||||
.sp
|
||||
To protect against breaking the delegation, \fBdnssec\-cds\fP ensures that
|
||||
@@ -68,117 +68,121 @@ type.
|
||||
.sp
|
||||
By default, replacement DS records are written to the standard output;
|
||||
with the \fB\-i\fP option the input file is overwritten in place. The
|
||||
replacement DS records will be the same as the existing records when no
|
||||
change is required. The output can be empty if the CDS / CDNSKEY records
|
||||
specify that the child zone wants to go insecure.
|
||||
replacement DS records are the same as the existing records, when no
|
||||
change is required. The output can be empty if the CDS/CDNSKEY records
|
||||
specify that the child zone wants to be insecure.
|
||||
.sp
|
||||
Warning: Be careful not to delete the DS records when \fBdnssec\-cds\fP
|
||||
fails!
|
||||
\fBWARNING:\fP
|
||||
.INDENT 0.0
|
||||
.INDENT 3.5
|
||||
Be careful not to delete the DS records when \fBdnssec\-cds\fP fails!
|
||||
.UNINDENT
|
||||
.UNINDENT
|
||||
.sp
|
||||
Alternatively, \fBdnssec\-cds \-u\fP writes an \fBnsupdate\fP script to the
|
||||
standard output. You can use the \fB\-u\fP and \fB\-i\fP options together to
|
||||
standard output. The \fB\-u\fP and \fB\-i\fP options can be used together to
|
||||
maintain a \fBdsset\-\fP file as well as emit an \fBnsupdate\fP script.
|
||||
.SH OPTIONS
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-a\fP algorithm
|
||||
Specify a digest algorithm to use when converting CDNSKEY records to
|
||||
.B \fB\-a algorithm\fP
|
||||
This option specifies a digest algorithm to use when converting CDNSKEY records to
|
||||
DS records. This option can be repeated, so that multiple DS records
|
||||
are created for each CDNSKEY record. This option has no effect when
|
||||
using CDS records.
|
||||
.sp
|
||||
The algorithm must be one of SHA\-1, SHA\-256, or SHA\-384. These values
|
||||
are case insensitive, and the hyphen may be omitted. If no algorithm
|
||||
are case\-insensitive, and the hyphen may be omitted. If no algorithm
|
||||
is specified, the default is SHA\-256.
|
||||
.TP
|
||||
\fB\-c\fP class
|
||||
Specifies the DNS class of the zones.
|
||||
.B \fB\-c class\fP
|
||||
This option specifies the DNS class of the zones.
|
||||
.TP
|
||||
\fB\-D\fP
|
||||
Generate DS records from CDNSKEY records if both CDS and CDNSKEY
|
||||
.B \fB\-D\fP
|
||||
This option generates DS records from CDNSKEY records if both CDS and CDNSKEY
|
||||
records are present in the child zone. By default CDS records are
|
||||
preferred.
|
||||
.TP
|
||||
\fB\-d\fP path
|
||||
Location of the parent DS records. The path can be the name of a file
|
||||
containing the DS records, or if it is a directory, \fBdnssec\-cds\fP
|
||||
.B \fB\-d path\fP
|
||||
This specifies the location of the parent DS records. The path can be the name of a file
|
||||
containing the DS records; if it is a directory, \fBdnssec\-cds\fP
|
||||
looks for a \fBdsset\-\fP file for the domain inside the directory.
|
||||
.sp
|
||||
To protect against replay attacks, child records are rejected if they
|
||||
were signed earlier than the modification time of the \fBdsset\-\fP
|
||||
file. This can be adjusted with the \fB\-s\fP option.
|
||||
.TP
|
||||
\fB\-f\fP child\-file
|
||||
File containing the child\(aqs CDS and/or CDNSKEY records, plus its
|
||||
DNSKEY records and the covering RRSIG records so that they can be
|
||||
.B \fB\-f child\-file\fP
|
||||
This option specifies the file containing the child\(aqs CDS and/or CDNSKEY records, plus its
|
||||
DNSKEY records and the covering RRSIG records, so that they can be
|
||||
authenticated.
|
||||
.sp
|
||||
The EXAMPLES below describe how to generate this file.
|
||||
The examples below describe how to generate this file.
|
||||
.TP
|
||||
\fB\-iextension\fP
|
||||
Update the \fBdsset\-\fP file in place, instead of writing DS records to
|
||||
.B \fB\-iextension\fP
|
||||
This option updates the \fBdsset\-\fP file in place, instead of writing DS records to
|
||||
the standard output.
|
||||
.sp
|
||||
There must be no space between the \fB\-i\fP and the extension. If you
|
||||
provide no extension then the old \fBdsset\-\fP is discarded. If an
|
||||
There must be no space between the \fB\-i\fP and the extension. If
|
||||
no extension is provided, the old \fBdsset\-\fP is discarded. If an
|
||||
extension is present, a backup of the old \fBdsset\-\fP file is kept
|
||||
with the extension appended to its filename.
|
||||
.sp
|
||||
To protect against replay attacks, the modification time of the
|
||||
\fBdsset\-\fP file is set to match the signature inception time of the
|
||||
child records, provided that is later than the file\(aqs current
|
||||
child records, provided that it is later than the file\(aqs current
|
||||
modification time.
|
||||
.TP
|
||||
\fB\-s\fP start\-time
|
||||
Specify the date and time after which RRSIG records become
|
||||
acceptable. This can be either an absolute or relative time. An
|
||||
.B \fB\-s start\-time\fP
|
||||
This option specifies the date and time after which RRSIG records become
|
||||
acceptable. This can be either an absolute or a relative time. An
|
||||
absolute start time is indicated by a number in YYYYMMDDHHMMSS
|
||||
notation; 20170827133700 denotes 13:37:00 UTC on August 27th, 2017. A
|
||||
time relative to the \fBdsset\-\fP file is indicated with \-N, which is N
|
||||
time relative to the \fBdsset\-\fP file is indicated with \fB\-N\fP, which is N
|
||||
seconds before the file modification time. A time relative to the
|
||||
current time is indicated with now+N.
|
||||
current time is indicated with \fBnow+N\fP\&.
|
||||
.sp
|
||||
If no start\-time is specified, the modification time of the
|
||||
\fBdsset\-\fP file is used.
|
||||
.TP
|
||||
\fB\-T\fP ttl
|
||||
Specifies a TTL to be used for new DS records. If not specified, the
|
||||
default is the TTL of the old DS records. If they had no explicit TTL
|
||||
then the new DS records also have no explicit TTL.
|
||||
.B \fB\-T ttl\fP
|
||||
This option specifies a TTL to be used for new DS records. If not specified, the
|
||||
default is the TTL of the old DS records. If they had no explicit TTL,
|
||||
the new DS records also have no explicit TTL.
|
||||
.TP
|
||||
\fB\-u\fP
|
||||
Write an \fBnsupdate\fP script to the standard output, instead of
|
||||
printing the new DS reords. The output will be empty if no change is
|
||||
.B \fB\-u\fP
|
||||
This option writes an \fBnsupdate\fP script to the standard output, instead of
|
||||
printing the new DS reords. The output is empty if no change is
|
||||
needed.
|
||||
.sp
|
||||
Note: The TTL of new records needs to be specified, either in the
|
||||
original \fBdsset\-\fP file, or with the \fB\-T\fP option, or using the
|
||||
Note: The TTL of new records needs to be specified: it can be done in the
|
||||
original \fBdsset\-\fP file, with the \fB\-T\fP option, or using the
|
||||
\fBnsupdate\fP \fBttl\fP command.
|
||||
.TP
|
||||
\fB\-V\fP
|
||||
Print version information.
|
||||
.B \fB\-V\fP
|
||||
This option prints version information.
|
||||
.TP
|
||||
\fB\-v\fP level
|
||||
Sets the debugging level. Level 1 is intended to be usefully verbose
|
||||
.B \fB\-v level\fP
|
||||
This option sets the debugging level. Level 1 is intended to be usefully verbose
|
||||
for general users; higher levels are intended for developers.
|
||||
.TP
|
||||
.B domain
|
||||
The name of the delegation point / child zone apex.
|
||||
.B \fBdomain\fP
|
||||
This indicates the name of the delegation point/child zone apex.
|
||||
.UNINDENT
|
||||
.SH EXIT STATUS
|
||||
.sp
|
||||
The \fBdnssec\-cds\fP command exits 0 on success, or non\-zero if an error
|
||||
occurred.
|
||||
.sp
|
||||
In the success case, the DS records might or might not need to be
|
||||
If successful, the DS records may or may not need to be
|
||||
changed.
|
||||
.SH EXAMPLES
|
||||
.sp
|
||||
Before running \fBdnssec\-signzone\fP, you can ensure that the delegations
|
||||
Before running \fBdnssec\-signzone\fP, ensure that the delegations
|
||||
are up\-to\-date by running \fBdnssec\-cds\fP on every \fBdsset\-\fP file.
|
||||
.sp
|
||||
To fetch the child records required by \fBdnssec\-cds\fP you can invoke
|
||||
\fBdig\fP as in the script below. It\(aqs okay if the \fBdig\fP fails since
|
||||
To fetch the child records required by \fBdnssec\-cds\fP, invoke
|
||||
\fBdig\fP as in the script below. It is acceptable if the \fBdig\fP fails, since
|
||||
\fBdnssec\-cds\fP performs all the necessary checking.
|
||||
.INDENT 0.0
|
||||
.INDENT 3.5
|
||||
@@ -196,10 +200,10 @@ done
|
||||
.UNINDENT
|
||||
.UNINDENT
|
||||
.sp
|
||||
When the parent zone is automatically signed by \fBnamed\fP, you can use
|
||||
\fBdnssec\-cds\fP with \fBnsupdate\fP to maintain a delegation as follows.
|
||||
When the parent zone is automatically signed by \fBnamed\fP,
|
||||
\fBdnssec\-cds\fP can be used with \fBnsupdate\fP to maintain a delegation as follows.
|
||||
The \fBdsset\-\fP file allows the script to avoid having to fetch and
|
||||
validate the parent DS records, and it keeps the replay attack
|
||||
validate the parent DS records, and it maintains the replay attack
|
||||
protection time.
|
||||
.INDENT 0.0
|
||||
.INDENT 3.5
|
||||
|
||||
@@ -46,7 +46,7 @@ The \fBdnssec\-dsfromkey\fP command outputs DS (Delegation Signer) resource reco
|
||||
.sp
|
||||
The input keys can be specified in a number of ways:
|
||||
.sp
|
||||
By default, \fBdnssec\-dsfromkey\fP reads a key file named like
|
||||
By default, \fBdnssec\-dsfromkey\fP reads a key file named in the format
|
||||
\fBKnnnn.+aaa+iiiii.key\fP, as generated by \fBdnssec\-keygen\fP\&.
|
||||
.sp
|
||||
With the \fB\-f file\fP option, \fBdnssec\-dsfromkey\fP reads keys from a zone
|
||||
@@ -57,85 +57,85 @@ as generated by \fBdnssec\-keygen\fP \fB\-C\fP\&.
|
||||
.SH OPTIONS
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-1\fP
|
||||
An abbreviation for \fB\-a SHA1\fP
|
||||
.B \fB\-1\fP
|
||||
This option is an abbreviation for \fB\-a SHA1\fP\&.
|
||||
.TP
|
||||
\fB\-2\fP
|
||||
An abbreviation for \fB\-a SHA\-256\fP
|
||||
.B \fB\-2\fP
|
||||
This option is an abbreviation for \fB\-a SHA\-256\fP\&.
|
||||
.TP
|
||||
\fB\-a\fP algorithm
|
||||
Specify a digest algorithm to use when converting DNSKEY records to
|
||||
.B \fB\-a algorithm\fP
|
||||
This option specifies a digest algorithm to use when converting DNSKEY records to
|
||||
DS records. This option can be repeated, so that multiple DS records
|
||||
are created for each DNSKEY record.
|
||||
.sp
|
||||
The algorithm must be one of SHA\-1, SHA\-256, or SHA\-384. These values
|
||||
are case insensitive, and the hyphen may be omitted. If no algorithm
|
||||
are case\-insensitive, and the hyphen may be omitted. If no algorithm
|
||||
is specified, the default is SHA\-256.
|
||||
.TP
|
||||
\fB\-A\fP
|
||||
Include ZSKs when generating DS records. Without this option, only
|
||||
keys which have the KSK flag set will be converted to DS records and
|
||||
printed. Useful only in \fB\-f\fP zone file mode.
|
||||
.B \fB\-A\fP
|
||||
This option indicates that ZSKs are to be included when generating DS records. Without this option, only
|
||||
keys which have the KSK flag set are converted to DS records and
|
||||
printed. This option is only useful in \fB\-f\fP zone file mode.
|
||||
.TP
|
||||
\fB\-c\fP class
|
||||
Specifies the DNS class (default is IN). Useful only in \fB\-s\fP keyset
|
||||
.B \fB\-c class\fP
|
||||
This option specifies the DNS class; the default is IN. This option is only useful in \fB\-s\fP keyset
|
||||
or \fB\-f\fP zone file mode.
|
||||
.TP
|
||||
\fB\-C\fP
|
||||
Generate CDS records rather than DS records.
|
||||
.B \fB\-C\fP
|
||||
This option generates CDS records rather than DS records.
|
||||
.TP
|
||||
\fB\-f\fP file
|
||||
Zone file mode: \fBdnssec\-dsfromkey\fP\(aqs final dnsname argument is the
|
||||
.B \fB\-f file\fP
|
||||
This option sets zone file mode, in which the final dnsname argument of \fBdnssec\-dsfromkey\fP is the
|
||||
DNS domain name of a zone whose master file can be read from
|
||||
\fBfile\fP\&. If the zone name is the same as \fBfile\fP, then it may be
|
||||
omitted.
|
||||
.sp
|
||||
If file is \fB"\-"\fP, then the zone data is read from the standard
|
||||
If \fBfile\fP is \fB\-\fP, then the zone data is read from the standard
|
||||
input. This makes it possible to use the output of the \fBdig\fP
|
||||
command as input, as in:
|
||||
.sp
|
||||
\fBdig dnskey example.com | dnssec\-dsfromkey \-f \- example.com\fP
|
||||
.TP
|
||||
\fB\-h\fP
|
||||
Prints usage information.
|
||||
.B \fB\-h\fP
|
||||
This option prints usage information.
|
||||
.TP
|
||||
\fB\-K\fP directory
|
||||
Look for key files or \fBkeyset\-\fP files in \fBdirectory\fP\&.
|
||||
.B \fB\-K directory\fP
|
||||
This option tells BIND 9 to look for key files or \fBkeyset\-\fP files in \fBdirectory\fP\&.
|
||||
.TP
|
||||
\fB\-s\fP
|
||||
Keyset mode: \fBdnssec\-dsfromkey\fP\(aqs final dnsname argument is the DNS
|
||||
.B \fB\-s\fP
|
||||
This option enables keyset mode, in which the final dnsname argument from \fBdnssec\-dsfromkey\fP is the DNS
|
||||
domain name used to locate a \fBkeyset\-\fP file.
|
||||
.TP
|
||||
\fB\-T\fP TTL
|
||||
Specifies the TTL of the DS records. By default the TTL is omitted.
|
||||
.B \fB\-T TTL\fP
|
||||
This option specifies the TTL of the DS records. By default the TTL is omitted.
|
||||
.TP
|
||||
\fB\-v\fP level
|
||||
Sets the debugging level.
|
||||
.B \fB\-v level\fP
|
||||
This option sets the debugging level.
|
||||
.TP
|
||||
\fB\-V\fP
|
||||
Prints version information.
|
||||
.B \fB\-V\fP
|
||||
This option prints version information.
|
||||
.UNINDENT
|
||||
.SH EXAMPLE
|
||||
.sp
|
||||
To build the SHA\-256 DS RR from the \fBKexample.com.+003+26160\fP keyfile
|
||||
name, you can issue the following command:
|
||||
To build the SHA\-256 DS RR from the \fBKexample.com.+003+26160\fP keyfile,
|
||||
issue the following command:
|
||||
.sp
|
||||
\fBdnssec\-dsfromkey \-2 Kexample.com.+003+26160\fP
|
||||
.sp
|
||||
The command would print something like:
|
||||
The command returns something similar to:
|
||||
.sp
|
||||
\fBexample.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0C5EA0B94\fP
|
||||
.SH FILES
|
||||
.sp
|
||||
The keyfile can be designated by the key identification
|
||||
\fBKnnnn.+aaa+iiiii\fP or the full file name \fBKnnnn.+aaa+iiiii.key\fP as
|
||||
generated by dnssec\-keygen8.
|
||||
\fBKnnnn.+aaa+iiiii\fP or the full file name \fBKnnnn.+aaa+iiiii.key\fP, as
|
||||
generated by \fBdnssec\-keygen\fP\&.
|
||||
.sp
|
||||
The keyset file name is built from the \fBdirectory\fP, the string
|
||||
\fBkeyset\-\fP and the \fBdnsname\fP\&.
|
||||
\fBkeyset\-\fP, and the \fBdnsname\fP\&.
|
||||
.SH CAVEAT
|
||||
.sp
|
||||
A keyfile error can give a "file not found" even if the file exists.
|
||||
A keyfile error may return "file not found," even if the file exists.
|
||||
.SH SEE ALSO
|
||||
.sp
|
||||
\fBdnssec\-keygen(8)\fP, \fBdnssec\-signzone(8)\fP, BIND 9 Administrator Reference Manual,
|
||||
|
||||
@@ -39,11 +39,11 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
||||
.sp
|
||||
\fBdnssec\-importkey\fP reads a public DNSKEY record and generates a pair
|
||||
of .key/.private files. The DNSKEY record may be read from an existing
|
||||
\&.key file, in which case a corresponding .private file will be
|
||||
\&.key file, in which case a corresponding .private file is
|
||||
generated, or it may be read from any other file or from the standard
|
||||
input, in which case both .key and .private files will be generated.
|
||||
input, in which case both .key and .private files are generated.
|
||||
.sp
|
||||
The newly\-created .private file does \fInot\fP contain private key data, and
|
||||
The newly created .private file does \fInot\fP contain private key data, and
|
||||
cannot be used for signing. However, having a .private file makes it
|
||||
possible to set publication (\fB\-P\fP) and deletion (\fB\-D\fP) times for the
|
||||
key, which means the public key can be added to and removed from the
|
||||
@@ -51,69 +51,69 @@ DNSKEY RRset on schedule even if the true private key is stored offline.
|
||||
.SH OPTIONS
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-f\fP filename
|
||||
Zone file mode: instead of a public keyfile name, the argument is the
|
||||
.B \fB\-f filename\fP
|
||||
This option indicates the zone file mode. Instead of a public keyfile name, the argument is the
|
||||
DNS domain name of a zone master file, which can be read from
|
||||
\fBfile\fP\&. If the domain name is the same as \fBfile\fP, then it may be
|
||||
\fBfilename\fP\&. If the domain name is the same as \fBfilename\fP, then it may be
|
||||
omitted.
|
||||
.sp
|
||||
If \fBfile\fP is set to \fB"\-"\fP, then the zone data is read from the
|
||||
If \fBfilename\fP is set to \fB"\-"\fP, then the zone data is read from the
|
||||
standard input.
|
||||
.TP
|
||||
\fB\-K\fP directory
|
||||
Sets the directory in which the key files are to reside.
|
||||
.B \fB\-K directory\fP
|
||||
This option sets the directory in which the key files are to reside.
|
||||
.TP
|
||||
\fB\-L\fP ttl
|
||||
Sets the default TTL to use for this key when it is converted into a
|
||||
DNSKEY RR. If the key is imported into a zone, this is the TTL that
|
||||
will be used for it, unless there was already a DNSKEY RRset in
|
||||
place, in which case the existing TTL would take precedence. Setting
|
||||
the default TTL to \fB0\fP or \fBnone\fP removes it.
|
||||
.B \fB\-L ttl\fP
|
||||
This option sets the default TTL to use for this key when it is converted into a
|
||||
DNSKEY RR. This is the TTL used when the key is imported into a zone,
|
||||
unless there was already a DNSKEY RRset in
|
||||
place, in which case the existing TTL takes precedence. Setting the default TTL to \fB0\fP or \fBnone\fP
|
||||
removes it from the key.
|
||||
.TP
|
||||
\fB\-h\fP
|
||||
Emit usage message and exit.
|
||||
.B \fB\-h\fP
|
||||
This option emits a usage message and exits.
|
||||
.TP
|
||||
\fB\-v\fP level
|
||||
Sets the debugging level.
|
||||
.B \fB\-v level\fP
|
||||
This option sets the debugging level.
|
||||
.TP
|
||||
\fB\-V\fP
|
||||
Prints version information.
|
||||
.B \fB\-V\fP
|
||||
This option prints version information.
|
||||
.UNINDENT
|
||||
.SH TIMING OPTIONS
|
||||
.sp
|
||||
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
|
||||
argument begins with a \(aq+\(aq or \(aq\-\(aq, it is interpreted as an offset from
|
||||
argument begins with a \fB+\fP or \fB\-\fP, it is interpreted as an offset from
|
||||
the present time. For convenience, if such an offset is followed by one
|
||||
of the suffixes \(aqy\(aq, \(aqmo\(aq, \(aqw\(aq, \(aqd\(aq, \(aqh\(aq, or \(aqmi\(aq, then the offset is
|
||||
of the suffixes \fBy\fP, \fBmo\fP, \fBw\fP, \fBd\fP, \fBh\fP, or \fBmi\fP, then the offset is
|
||||
computed in years (defined as 365 24\-hour days, ignoring leap years),
|
||||
months (defined as 30 24\-hour days), weeks, days, hours, or minutes,
|
||||
respectively. Without a suffix, the offset is computed in seconds. To
|
||||
explicitly prevent a date from being set, use \(aqnone\(aq or \(aqnever\(aq.
|
||||
explicitly prevent a date from being set, use \fBnone\fP or \fBnever\fP\&.
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-P\fP date/offset
|
||||
Sets the date on which a key is to be published to the zone. After
|
||||
that date, the key will be included in the zone but will not be used
|
||||
.B \fB\-P date/offset\fP
|
||||
This option sets the date on which a key is to be published to the zone. After
|
||||
that date, the key is included in the zone but is not used
|
||||
to sign it.
|
||||
.TP
|
||||
\fB\-P\fP sync date/offset
|
||||
Sets the date on which CDS and CDNSKEY records that match this key
|
||||
.B \fB\-P sync date/offset\fP
|
||||
This option sets the date on which CDS and CDNSKEY records that match this key
|
||||
are to be published to the zone.
|
||||
.TP
|
||||
\fB\-D\fP date/offset
|
||||
Sets the date on which the key is to be deleted. After that date, the
|
||||
key will no longer be included in the zone. (It may remain in the key
|
||||
repository, however.)
|
||||
.B \fB\-D date/offset\fP
|
||||
This option sets the date on which the key is to be deleted. After that date, the
|
||||
key is no longer included in the zone. (However, it may remain in the key
|
||||
repository.)
|
||||
.TP
|
||||
\fB\-D\fP sync date/offset
|
||||
Sets the date on which the CDS and CDNSKEY records that match this
|
||||
.B \fB\-D sync date/offset\fP
|
||||
This option sets the date on which the CDS and CDNSKEY records that match this
|
||||
key are to be deleted.
|
||||
.UNINDENT
|
||||
.SH FILES
|
||||
.sp
|
||||
A keyfile can be designed by the key identification \fBKnnnn.+aaa+iiiii\fP
|
||||
or the full file name \fBKnnnn.+aaa+iiiii.key\fP as generated by
|
||||
dnssec\-keygen8.
|
||||
or the full file name \fBKnnnn.+aaa+iiiii.key\fP, as generated by
|
||||
\fBdnssec\-keygen\fP\&.
|
||||
.SH SEE ALSO
|
||||
.sp
|
||||
\fBdnssec\-keygen(8)\fP, \fBdnssec\-signzone(8)\fP, BIND 9 Administrator Reference Manual,
|
||||
|
||||
@@ -35,11 +35,11 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
||||
\fBdnssec\-keyfromlabel\fP {\fB\-l\fP label} [\fB\-3\fP] [\fB\-a\fP algorithm] [\fB\-A\fP date/offset] [\fB\-c\fP class] [\fB\-D\fP date/offset] [\fB\-D\fP sync date/offset] [\fB\-E\fP engine] [\fB\-f\fP flag] [\fB\-G\fP] [\fB\-I\fP date/offset] [\fB\-i\fP interval] [\fB\-k\fP] [\fB\-K\fP directory] [\fB\-L\fP ttl] [\fB\-n\fP nametype] [\fB\-P\fP date/offset] [\fB\-P\fP sync date/offset] [\fB\-p\fP protocol] [\fB\-R\fP date/offset] [\fB\-S\fP key] [\fB\-t\fP type] [\fB\-v\fP level] [\fB\-V\fP] [\fB\-y\fP] {name}
|
||||
.SH DESCRIPTION
|
||||
.sp
|
||||
\fBdnssec\-keyfromlabel\fP generates a key pair of files that referencing a
|
||||
\fBdnssec\-keyfromlabel\fP generates a pair of key files that reference a
|
||||
key object stored in a cryptographic hardware service module (HSM). The
|
||||
private key file can be used for DNSSEC signing of zone data as if it
|
||||
were a conventional signing key created by \fBdnssec\-keygen\fP, but the
|
||||
key material is stored within the HSM, and the actual signing takes
|
||||
key material is stored within the HSM and the actual signing takes
|
||||
place there.
|
||||
.sp
|
||||
The \fBname\fP of the key is specified on the command line. This must
|
||||
@@ -47,194 +47,194 @@ match the name of the zone for which the key is being generated.
|
||||
.SH OPTIONS
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-a\fP algorithm
|
||||
Selects the cryptographic algorithm. The value of \fBalgorithm\fP must
|
||||
.B \fB\-a algorithm\fP
|
||||
This option selects the cryptographic algorithm. The value of \fBalgorithm\fP must
|
||||
be one of RSASHA1, NSEC3RSASHA1, RSASHA256, RSASHA512,
|
||||
ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.
|
||||
ECDSAP256SHA256, ECDSAP384SHA384, ED25519, or ED448.
|
||||
.sp
|
||||
If no algorithm is specified, then RSASHA1 will be used by default,
|
||||
If no algorithm is specified, RSASHA1 is used by default
|
||||
unless the \fB\-3\fP option is specified, in which case NSEC3RSASHA1
|
||||
will be used instead. (If \fB\-3\fP is used and an algorithm is
|
||||
specified, that algorithm will be checked for compatibility with
|
||||
is used instead. (If \fB\-3\fP is used and an algorithm is
|
||||
specified, that algorithm is checked for compatibility with
|
||||
NSEC3.)
|
||||
.sp
|
||||
These values are case insensitive. In some cases, abbreviations are
|
||||
These values are case\-insensitive. In some cases, abbreviations are
|
||||
supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for
|
||||
ECDSAP384SHA384. If RSASHA1 is specified along with the \fB\-3\fP
|
||||
option, then NSEC3RSASHA1 will be used instead.
|
||||
option, then NSEC3RSASHA1 is used instead.
|
||||
.sp
|
||||
As of BIND 9.12.0, this option is mandatory except when using the
|
||||
\fB\-S\fP option (which copies the algorithm from the predecessory key).
|
||||
Since BIND 9.12.0, this option is mandatory except when using the
|
||||
\fB\-S\fP option, which copies the algorithm from the predecessory key.
|
||||
Previously, the default for newly generated keys was RSASHA1.
|
||||
.TP
|
||||
\fB\-3\fP
|
||||
Use an NSEC3\-capable algorithm to generate a DNSSEC key. If this
|
||||
.B \fB\-3\fP
|
||||
This option uses an NSEC3\-capable algorithm to generate a DNSSEC key. If this
|
||||
option is used with an algorithm that has both NSEC and NSEC3
|
||||
versions, then the NSEC3 version will be used; for example,
|
||||
versions, then the NSEC3 version is used; for example,
|
||||
\fBdnssec\-keygen \-3a RSASHA1\fP specifies the NSEC3RSASHA1 algorithm.
|
||||
.TP
|
||||
\fB\-E\fP engine
|
||||
Specifies the cryptographic hardware to use.
|
||||
.B \fB\-E engine\fP
|
||||
This option specifies the cryptographic hardware to use.
|
||||
.sp
|
||||
When BIND is built with OpenSSL PKCS#11 support, this defaults to the
|
||||
string "pkcs11", which identifies an OpenSSL engine that can drive a
|
||||
When BIND 9 is built with OpenSSL PKCS#11 support, this defaults to the
|
||||
string \fBpkcs11\fP, which identifies an OpenSSL engine that can drive a
|
||||
cryptographic accelerator or hardware service module. When BIND is
|
||||
built with native PKCS#11 cryptography (\-\-enable\-native\-pkcs11), it
|
||||
built with native PKCS#11 cryptography (\fB\-\-enable\-native\-pkcs11\fP), it
|
||||
defaults to the path of the PKCS#11 provider library specified via
|
||||
"\-\-with\-pkcs11".
|
||||
\fB\-\-with\-pkcs11\fP\&.
|
||||
.TP
|
||||
\fB\-l\fP label
|
||||
Specifies the label for a key pair in the crypto hardware.
|
||||
.B \fB\-l label\fP
|
||||
This option specifies the label for a key pair in the crypto hardware.
|
||||
.sp
|
||||
When BIND 9 is built with OpenSSL\-based PKCS#11 support, the label is
|
||||
an arbitrary string that identifies a particular key. It may be
|
||||
preceded by an optional OpenSSL engine name, followed by a colon, as
|
||||
in "pkcs11:keylabel".
|
||||
in \fBpkcs11:keylabel\fP\&.
|
||||
.sp
|
||||
When BIND 9 is built with native PKCS#11 support, the label is a
|
||||
PKCS#11 URI string in the format
|
||||
"pkcs11:\fBkeyword\fP=value[;\fBkeyword\fP=value;...]" Keywords
|
||||
include "token", which identifies the HSM; "object", which identifies
|
||||
the key; and "pin\-source", which identifies a file from which the
|
||||
HSM\(aqs PIN code can be obtained. The label will be stored in the
|
||||
on\-disk "private" file.
|
||||
\fBpkcs11:keyword\e =value[;\e keyword\e =value;...]\fP\&. Keywords
|
||||
include \fBtoken\fP, which identifies the HSM; \fBobject\fP, which identifies
|
||||
the key; and \fBpin\-source\fP, which identifies a file from which the
|
||||
HSM\(aqs PIN code can be obtained. The label is stored in the
|
||||
on\-disk \fBprivate\fP file.
|
||||
.sp
|
||||
If the label contains a \fBpin\-source\fP field, tools using the
|
||||
generated key files will be able to use the HSM for signing and other
|
||||
generated key files are able to use the HSM for signing and other
|
||||
operations without any need for an operator to manually enter a PIN.
|
||||
Note: Making the HSM\(aqs PIN accessible in this manner may reduce the
|
||||
security advantage of using an HSM; be sure this is what you want to
|
||||
do before making use of this feature.
|
||||
security advantage of using an HSM; use caution
|
||||
with this feature.
|
||||
.TP
|
||||
\fB\-n\fP nametype
|
||||
Specifies the owner type of the key. The value of \fBnametype\fP must
|
||||
.B \fB\-n nametype\fP
|
||||
This option specifies the owner type of the key. The value of \fBnametype\fP must
|
||||
either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY
|
||||
(for a key associated with a host (KEY)), USER (for a key associated
|
||||
with a user(KEY)) or OTHER (DNSKEY). These values are case
|
||||
insensitive.
|
||||
with a user (KEY)), or OTHER (DNSKEY). These values are
|
||||
case\-insensitive.
|
||||
.TP
|
||||
\fB\-C\fP
|
||||
Compatibility mode: generates an old\-style key, without any metadata.
|
||||
By default, \fBdnssec\-keyfromlabel\fP will include the key\(aqs creation
|
||||
date in the metadata stored with the private key, and other dates may
|
||||
be set there as well (publication date, activation date, etc). Keys
|
||||
.B \fB\-C\fP
|
||||
This option enables compatibility mode, which generates an old\-style key, without any metadata.
|
||||
By default, \fBdnssec\-keyfromlabel\fP includes the key\(aqs creation
|
||||
date in the metadata stored with the private key; other dates may
|
||||
be set there as well, including publication date, activation date, etc. Keys
|
||||
that include this data may be incompatible with older versions of
|
||||
BIND; the \fB\-C\fP option suppresses them.
|
||||
.TP
|
||||
\fB\-c\fP class
|
||||
Indicates that the DNS record containing the key should have the
|
||||
.B \fB\-c class\fP
|
||||
This option indicates that the DNS record containing the key should have the
|
||||
specified class. If not specified, class IN is used.
|
||||
.TP
|
||||
\fB\-f\fP flag
|
||||
Set the specified flag in the flag field of the KEY/DNSKEY record.
|
||||
The only recognized flags are KSK (Key Signing Key) and REVOKE.
|
||||
.B \fB\-f flag\fP
|
||||
This option sets the specified flag in the \fBflag\fP field of the KEY/DNSKEY record.
|
||||
The only recognized flags are KSK (Key\-Signing Key) and REVOKE.
|
||||
.TP
|
||||
\fB\-G\fP
|
||||
Generate a key, but do not publish it or sign with it. This option is
|
||||
incompatible with \-P and \-A.
|
||||
.B \fB\-G\fP
|
||||
This option generates a key, but does not publish it or sign with it. This option is
|
||||
incompatible with \fB\-P\fP and \fB\-A\fP\&.
|
||||
.TP
|
||||
\fB\-h\fP
|
||||
Prints a short summary of the options and arguments to
|
||||
.B \fB\-h\fP
|
||||
This option prints a short summary of the options and arguments to
|
||||
\fBdnssec\-keyfromlabel\fP\&.
|
||||
.TP
|
||||
\fB\-K\fP directory
|
||||
Sets the directory in which the key files are to be written.
|
||||
.B \fB\-K directory\fP
|
||||
This option sets the directory in which the key files are to be written.
|
||||
.TP
|
||||
\fB\-k\fP
|
||||
Generate KEY records rather than DNSKEY records.
|
||||
.B \fB\-k\fP
|
||||
This option generates KEY records rather than DNSKEY records.
|
||||
.TP
|
||||
\fB\-L\fP ttl
|
||||
Sets the default TTL to use for this key when it is converted into a
|
||||
DNSKEY RR. If the key is imported into a zone, this is the TTL that
|
||||
will be used for it, unless there was already a DNSKEY RRset in
|
||||
.B \fB\-L\fP ttl
|
||||
This option sets the default TTL to use for this key when it is converted into a
|
||||
DNSKEY RR. This is the TTL used when the key is imported into a zone,
|
||||
unless there was already a DNSKEY RRset in
|
||||
place, in which case the existing TTL would take precedence. Setting
|
||||
the default TTL to \fB0\fP or \fBnone\fP removes it.
|
||||
.TP
|
||||
\fB\-p\fP protocol
|
||||
Sets the protocol value for the key. The protocol is a number between
|
||||
.B \fB\-p protocol\fP
|
||||
This option sets the protocol value for the key. The protocol is a number between
|
||||
0 and 255. The default is 3 (DNSSEC). Other possible values for this
|
||||
argument are listed in \fI\%RFC 2535\fP and its successors.
|
||||
.TP
|
||||
\fB\-S\fP key
|
||||
Generate a key as an explicit successor to an existing key. The name,
|
||||
algorithm, size, and type of the key will be set to match the
|
||||
predecessor. The activation date of the new key will be set to the
|
||||
inactivation date of the existing one. The publication date will be
|
||||
.B \fB\-S key\fP
|
||||
This option generates a key as an explicit successor to an existing key. The name,
|
||||
algorithm, size, and type of the key are set to match the
|
||||
predecessor. The activation date of the new key is set to the
|
||||
inactivation date of the existing one. The publication date is
|
||||
set to the activation date minus the prepublication interval, which
|
||||
defaults to 30 days.
|
||||
.TP
|
||||
\fB\-t\fP type
|
||||
Indicates the use of the key. \fBtype\fP must be one of AUTHCONF,
|
||||
.B \fB\-t type\fP
|
||||
This option indicates the type of the key. \fBtype\fP must be one of AUTHCONF,
|
||||
NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH refers
|
||||
to the ability to authenticate data, and CONF the ability to encrypt
|
||||
to the ability to authenticate data, and CONF to the ability to encrypt
|
||||
data.
|
||||
.TP
|
||||
\fB\-v\fP level
|
||||
Sets the debugging level.
|
||||
.B \fB\-v level\fP
|
||||
This option sets the debugging level.
|
||||
.TP
|
||||
\fB\-V\fP
|
||||
Prints version information.
|
||||
.B \fB\-V\fP
|
||||
This option prints version information.
|
||||
.TP
|
||||
\fB\-y\fP
|
||||
Allows DNSSEC key files to be generated even if the key ID would
|
||||
.B \fB\-y\fP
|
||||
This option allows DNSSEC key files to be generated even if the key ID would
|
||||
collide with that of an existing key, in the event of either key
|
||||
being revoked. (This is only safe to use if you are sure you won\(aqt be
|
||||
using \fI\%RFC 5011\fP trust anchor maintenance with either of the keys
|
||||
being revoked. (This is only safe to enable if
|
||||
\fI\%RFC 5011\fP trust anchor maintenance is not used with either of the keys
|
||||
involved.)
|
||||
.UNINDENT
|
||||
.SH TIMING OPTIONS
|
||||
.sp
|
||||
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
|
||||
argument begins with a \(aq+\(aq or \(aq\-\(aq, it is interpreted as an offset from
|
||||
argument begins with a \fB+\fP or \fB\-\fP, it is interpreted as an offset from
|
||||
the present time. For convenience, if such an offset is followed by one
|
||||
of the suffixes \(aqy\(aq, \(aqmo\(aq, \(aqw\(aq, \(aqd\(aq, \(aqh\(aq, or \(aqmi\(aq, then the offset is
|
||||
of the suffixes \fBy\fP, \fBmo\fP, \fBw\fP, \fBd\fP, \fBh\fP, or \fBmi\fP, then the offset is
|
||||
computed in years (defined as 365 24\-hour days, ignoring leap years),
|
||||
months (defined as 30 24\-hour days), weeks, days, hours, or minutes,
|
||||
respectively. Without a suffix, the offset is computed in seconds. To
|
||||
explicitly prevent a date from being set, use \(aqnone\(aq or \(aqnever\(aq.
|
||||
explicitly prevent a date from being set, use \fBnone\fP or \fBnever\fP\&.
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-P\fP date/offset
|
||||
Sets the date on which a key is to be published to the zone. After
|
||||
that date, the key will be included in the zone but will not be used
|
||||
to sign it. If not set, and if the \-G option has not been used, the
|
||||
default is "now".
|
||||
.B \fB\-P date/offset\fP
|
||||
This option sets the date on which a key is to be published to the zone. After
|
||||
that date, the key is included in the zone but is not used
|
||||
to sign it. If not set, and if the \fB\-G\fP option has not been used, the
|
||||
default is the current date.
|
||||
.TP
|
||||
\fB\-P\fP sync date/offset
|
||||
Sets the date on which the CDS and CDNSKEY records which match this
|
||||
key are to be published to the zone.
|
||||
.B \fB\-P sync date/offset\fP
|
||||
This option sets the date on which CDS and CDNSKEY records that match this key
|
||||
are to be published to the zone.
|
||||
.TP
|
||||
\fB\-A\fP date/offset
|
||||
Sets the date on which the key is to be activated. After that date,
|
||||
the key will be included in the zone and used to sign it. If not set,
|
||||
and if the \-G option has not been used, the default is "now".
|
||||
.B \fB\-A date/offset\fP
|
||||
This option sets the date on which the key is to be activated. After that date,
|
||||
the key is included in the zone and used to sign it. If not set,
|
||||
and if the \fB\-G\fP option has not been used, the default is the current date.
|
||||
.TP
|
||||
\fB\-R\fP date/offset
|
||||
Sets the date on which the key is to be revoked. After that date, the
|
||||
key will be flagged as revoked. It will be included in the zone and
|
||||
will be used to sign it.
|
||||
.B \fB\-R date/offset\fP
|
||||
This option sets the date on which the key is to be revoked. After that date, the
|
||||
key is flagged as revoked. It is included in the zone and
|
||||
is used to sign it.
|
||||
.TP
|
||||
\fB\-I\fP date/offset
|
||||
Sets the date on which the key is to be retired. After that date, the
|
||||
key will still be included in the zone, but it will not be used to
|
||||
.B \fB\-I date/offset\fP
|
||||
This option sets the date on which the key is to be retired. After that date, the
|
||||
key is still included in the zone, but it is not used to
|
||||
sign it.
|
||||
.TP
|
||||
\fB\-D\fP date/offset
|
||||
Sets the date on which the key is to be deleted. After that date, the
|
||||
key will no longer be included in the zone. (It may remain in the key
|
||||
repository, however.)
|
||||
.B \fB\-D date/offset\fP
|
||||
This option sets the date on which the key is to be deleted. After that date, the
|
||||
key is no longer included in the zone. (However, it may remain in the key
|
||||
repository.)
|
||||
.TP
|
||||
\fB\-D\fP sync date/offset
|
||||
Sets the date on which the CDS and CDNSKEY records which match this
|
||||
.B \fB\-D sync date/offset\fP
|
||||
This option sets the date on which the CDS and CDNSKEY records that match this
|
||||
key are to be deleted.
|
||||
.TP
|
||||
\fB\-i\fP interval
|
||||
Sets the prepublication interval for a key. If set, then the
|
||||
.B \fB\-i interval\fP
|
||||
This option sets the prepublication interval for a key. If set, then the
|
||||
publication and activation dates must be separated by at least this
|
||||
much time. If the activation date is specified but the publication
|
||||
date isn\(aqt, then the publication date will default to this much time
|
||||
date is not, the publication date defaults to this much time
|
||||
before the activation date; conversely, if the publication date is
|
||||
specified but activation date isn\(aqt, then activation will be set to
|
||||
specified but not the activation date, activation is set to
|
||||
this much time after publication.
|
||||
.sp
|
||||
If the key is being created as an explicit successor to another key,
|
||||
@@ -242,7 +242,7 @@ then the default prepublication interval is 30 days; otherwise it is
|
||||
zero.
|
||||
.sp
|
||||
As with date offsets, if the argument is followed by one of the
|
||||
suffixes \(aqy\(aq, \(aqmo\(aq, \(aqw\(aq, \(aqd\(aq, \(aqh\(aq, or \(aqmi\(aq, then the interval is
|
||||
suffixes \fBy\fP, \fBmo\fP, \fBw\fP, \fBd\fP, \fBh\fP, or \fBmi\fP, the interval is
|
||||
measured in years, months, weeks, days, hours, or minutes,
|
||||
respectively. Without a suffix, the interval is measured in seconds.
|
||||
.UNINDENT
|
||||
@@ -265,14 +265,14 @@ printed string. \fBKnnnn.+aaa+iiiii.key\fP contains the public key, and
|
||||
\fBKnnnn.+aaa+iiiii.private\fP contains the private key.
|
||||
.sp
|
||||
The \fB\&.key\fP file contains a DNS KEY record that can be inserted into a
|
||||
zone file (directly or with a $INCLUDE statement).
|
||||
zone file (directly or with an $INCLUDE statement).
|
||||
.sp
|
||||
The \fB\&.private\fP file contains algorithm\-specific fields. For obvious
|
||||
security reasons, this file does not have general read permission.
|
||||
.SH SEE ALSO
|
||||
.sp
|
||||
\fBdnssec\-keygen(8)\fP, \fBdnssec\-signzone(8)\fP, BIND 9 Administrator Reference Manual,
|
||||
\fI\%RFC 4034\fP, The PKCS#11 URI Scheme (draft\-pechanec\-pkcs11uri\-13).
|
||||
\fI\%RFC 4034\fP, \fI\%RFC 7512\fP\&.
|
||||
.SH AUTHOR
|
||||
Internet Systems Consortium
|
||||
.SH COPYRIGHT
|
||||
|
||||
@@ -46,220 +46,220 @@ generated.
|
||||
.SH OPTIONS
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-3\fP
|
||||
Use an NSEC3\-capable algorithm to generate a DNSSEC key. If this
|
||||
.B \fB\-3\fP
|
||||
This option uses an NSEC3\-capable algorithm to generate a DNSSEC key. If this
|
||||
option is used with an algorithm that has both NSEC and NSEC3
|
||||
versions, then the NSEC3 version will be used; for example,
|
||||
versions, then the NSEC3 version is selected; for example,
|
||||
\fBdnssec\-keygen \-3a RSASHA1\fP specifies the NSEC3RSASHA1 algorithm.
|
||||
.TP
|
||||
\fB\-a\fP algorithm
|
||||
Selects the cryptographic algorithm. For DNSSEC keys, the value of
|
||||
.B \fB\-a algorithm\fP
|
||||
This option selects the cryptographic algorithm. For DNSSEC keys, the value of
|
||||
\fBalgorithm\fP must be one of RSASHA1, NSEC3RSASHA1, RSASHA256,
|
||||
RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448. For
|
||||
TKEY, the value must be DH (Diffie Hellman); specifying his value
|
||||
will automatically set the \fB\-T KEY\fP option as well.
|
||||
RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519, or ED448. For
|
||||
TKEY, the value must be DH (Diffie\-Hellman); specifying this value
|
||||
automatically sets the \fB\-T KEY\fP option as well.
|
||||
.sp
|
||||
These values are case insensitive. In some cases, abbreviations are
|
||||
These values are case\-insensitive. In some cases, abbreviations are
|
||||
supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for
|
||||
ECDSAP384SHA384. If RSASHA1 is specified along with the \fB\-3\fP
|
||||
option, then NSEC3RSASHA1 will be used instead.
|
||||
option, NSEC3RSASHA1 is used instead.
|
||||
.sp
|
||||
This parameter \fImust\fP be specified except when using the \fB\-S\fP
|
||||
option, which copies the algorithm from the predecessor key.
|
||||
.sp
|
||||
In prior releases, HMAC algorithms could be generated for use as TSIG
|
||||
keys, but that feature has been removed as of BIND 9.13.0. Use
|
||||
keys, but that feature was removed in BIND 9.13.0. Use
|
||||
\fBtsig\-keygen\fP to generate TSIG keys.
|
||||
.TP
|
||||
\fB\-b\fP keysize
|
||||
Specifies the number of bits in the key. The choice of key size
|
||||
depends on the algorithm used. RSA keys must be between 1024 and 4096
|
||||
bits. Diffie Hellman keys must be between 128 and 4096 bits. Elliptic
|
||||
curve algorithms don\(aqt need this parameter.
|
||||
.B \fB\-b keysize\fP
|
||||
This option specifies the number of bits in the key. The choice of key size
|
||||
depends on the algorithm used: RSA keys must be between 1024 and 4096
|
||||
bits; Diffie\-Hellman keys must be between 128 and 4096 bits. Elliptic
|
||||
curve algorithms do not need this parameter.
|
||||
.sp
|
||||
If the key size is not specified, some algorithms have pre\-defined
|
||||
defaults. For example, RSA keys for use as DNSSEC zone signing keys
|
||||
have a default size of 1024 bits; RSA keys for use as key signing
|
||||
defaults. For example, RSA keys for use as DNSSEC zone\-signing keys
|
||||
have a default size of 1024 bits; RSA keys for use as key\-signing
|
||||
keys (KSKs, generated with \fB\-f KSK\fP) default to 2048 bits.
|
||||
.TP
|
||||
\fB\-C\fP
|
||||
Compatibility mode: generates an old\-style key, without any timing
|
||||
metadata. By default, \fBdnssec\-keygen\fP will include the key\(aqs
|
||||
creation date in the metadata stored with the private key, and other
|
||||
dates may be set there as well (publication date, activation date,
|
||||
etc). Keys that include this data may be incompatible with older
|
||||
.B \fB\-C\fP
|
||||
This option enables compatibility mode, which generates an old\-style key, without any timing
|
||||
metadata. By default, \fBdnssec\-keygen\fP includes the key\(aqs
|
||||
creation date in the metadata stored with the private key; other
|
||||
dates may be set there as well, including publication date, activation date,
|
||||
etc. Keys that include this data may be incompatible with older
|
||||
versions of BIND; the \fB\-C\fP option suppresses them.
|
||||
.TP
|
||||
\fB\-c\fP class
|
||||
Indicates that the DNS record containing the key should have the
|
||||
.B \fB\-c class\fP
|
||||
This option indicates that the DNS record containing the key should have the
|
||||
specified class. If not specified, class IN is used.
|
||||
.TP
|
||||
\fB\-d\fP bits
|
||||
Key size in bits. For the algorithms RSASHA1, NSEC3RSASA1, RSASHA256 and
|
||||
RSASHA512 the key size must be in range 1024\-4096. DH size is between 128
|
||||
and 4096. This option is ignored for algorithms ECDSAP256SHA256,
|
||||
ECDSAP384SHA384, ED25519 and ED448.
|
||||
.B \fB\-d bits\fP
|
||||
This option specifies the key size in bits. For the algorithms RSASHA1, NSEC3RSASA1, RSASHA256, and
|
||||
RSASHA512 the key size must be between 1024 and 4096 bits; DH size is between 128
|
||||
and 4096 bits. This option is ignored for algorithms ECDSAP256SHA256,
|
||||
ECDSAP384SHA384, ED25519, and ED448.
|
||||
.TP
|
||||
\fB\-E\fP engine
|
||||
Specifies the cryptographic hardware to use, when applicable.
|
||||
.B \fB\-E engine\fP
|
||||
This option specifies the cryptographic hardware to use, when applicable.
|
||||
.sp
|
||||
When BIND is built with OpenSSL PKCS#11 support, this defaults to the
|
||||
string "pkcs11", which identifies an OpenSSL engine that can drive a
|
||||
string \fBpkcs11\fP, which identifies an OpenSSL engine that can drive a
|
||||
cryptographic accelerator or hardware service module. When BIND is
|
||||
built with native PKCS#11 cryptography (\-\-enable\-native\-pkcs11), it
|
||||
built with native PKCS#11 cryptography (\fB\-\-enable\-native\-pkcs11\fP), it
|
||||
defaults to the path of the PKCS#11 provider library specified via
|
||||
"\-\-with\-pkcs11".
|
||||
\fB\-\-with\-pkcs11\fP\&.
|
||||
.TP
|
||||
\fB\-f\fP flag
|
||||
Set the specified flag in the flag field of the KEY/DNSKEY record.
|
||||
The only recognized flags are KSK (Key Signing Key) and REVOKE.
|
||||
.B \fB\-f flag\fP
|
||||
This option sets the specified flag in the flag field of the KEY/DNSKEY record.
|
||||
The only recognized flags are KSK (Key\-Signing Key) and REVOKE.
|
||||
.TP
|
||||
\fB\-G\fP
|
||||
Generate a key, but do not publish it or sign with it. This option is
|
||||
incompatible with \-P and \-A.
|
||||
.B \fB\-G\fP
|
||||
This option generates a key, but does not publish it or sign with it. This option is
|
||||
incompatible with \fB\-P\fP and \fB\-A\fP\&.
|
||||
.TP
|
||||
\fB\-g\fP generator
|
||||
If generating a Diffie Hellman key, use this generator. Allowed
|
||||
.B \fB\-g generator\fP
|
||||
This option indicates the generator to use if generating a Diffie\-Hellman key. Allowed
|
||||
values are 2 and 5. If no generator is specified, a known prime from
|
||||
\fI\%RFC 2539\fP will be used if possible; otherwise the default is 2.
|
||||
\fI\%RFC 2539\fP is used if possible; otherwise the default is 2.
|
||||
.TP
|
||||
\fB\-h\fP
|
||||
Prints a short summary of the options and arguments to
|
||||
.B \fB\-h\fP
|
||||
This option prints a short summary of the options and arguments to
|
||||
\fBdnssec\-keygen\fP\&.
|
||||
.TP
|
||||
\fB\-K\fP directory
|
||||
Sets the directory in which the key files are to be written.
|
||||
.B \fB\-K directory\fP
|
||||
This option sets the directory in which the key files are to be written.
|
||||
.TP
|
||||
\fB\-k\fP policy
|
||||
Create keys for a specific dnssec\-policy. If a policy uses multiple keys,
|
||||
\fBdnssec\-keygen\fP will generate multiple keys. This will also
|
||||
create a ".state" file to keep track of the key state.
|
||||
.B \fB\-k policy\fP
|
||||
This option creates keys for a specific \fBdnssec\-policy\fP\&. If a policy uses multiple keys,
|
||||
\fBdnssec\-keygen\fP generates multiple keys. This also
|
||||
creates a ".state" file to keep track of the key state.
|
||||
.sp
|
||||
This option creates keys according to the dnssec\-policy configuration, hence
|
||||
it cannot be used together with many of the other options that
|
||||
This option creates keys according to the \fBdnssec\-policy\fP configuration, hence
|
||||
it cannot be used at the same time as many of the other options that
|
||||
\fBdnssec\-keygen\fP provides.
|
||||
.TP
|
||||
\fB\-L\fP ttl
|
||||
Sets the default TTL to use for this key when it is converted into a
|
||||
DNSKEY RR. If the key is imported into a zone, this is the TTL that
|
||||
will be used for it, unless there was already a DNSKEY RRset in
|
||||
place, in which case the existing TTL would take precedence. If this
|
||||
value is not set and there is no existing DNSKEY RRset, the TTL will
|
||||
default to the SOA TTL. Setting the default TTL to \fB0\fP or \fBnone\fP
|
||||
.B \fB\-L ttl\fP
|
||||
This option sets the default TTL to use for this key when it is converted into a
|
||||
DNSKEY RR. This is the TTL used when the key is imported into a zone,
|
||||
unless there was already a DNSKEY RRset in
|
||||
place, in which case the existing TTL takes precedence. If this
|
||||
value is not set and there is no existing DNSKEY RRset, the TTL
|
||||
defaults to the SOA TTL. Setting the default TTL to \fB0\fP or \fBnone\fP
|
||||
is the same as leaving it unset.
|
||||
.TP
|
||||
\fB\-l\fP file
|
||||
Provide a configuration file that contains a dnssec\-policy statement
|
||||
.B \fB\-l file\fP
|
||||
This option provides a configuration file that contains a \fBdnssec\-policy\fP statement
|
||||
(matching the policy set with \fB\-k\fP).
|
||||
.TP
|
||||
\fB\-n\fP nametype
|
||||
Specifies the owner type of the key. The value of \fBnametype\fP must
|
||||
.B \fB\-n nametype\fP
|
||||
This option specifies the owner type of the key. The value of \fBnametype\fP must
|
||||
either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY
|
||||
(for a key associated with a host (KEY)), USER (for a key associated
|
||||
with a user(KEY)) or OTHER (DNSKEY). These values are case
|
||||
insensitive. Defaults to ZONE for DNSKEY generation.
|
||||
with a user (KEY)), or OTHER (DNSKEY). These values are
|
||||
case\-insensitive. The default is ZONE for DNSKEY generation.
|
||||
.TP
|
||||
\fB\-p\fP protocol
|
||||
Sets the protocol value for the generated key, for use with
|
||||
.B \fB\-p protocol\fP
|
||||
This option sets the protocol value for the generated key, for use with
|
||||
\fB\-T KEY\fP\&. The protocol is a number between 0 and 255. The default
|
||||
is 3 (DNSSEC). Other possible values for this argument are listed in
|
||||
\fI\%RFC 2535\fP and its successors.
|
||||
.TP
|
||||
\fB\-q\fP
|
||||
Quiet mode: Suppresses unnecessary output, including progress
|
||||
.B \fB\-q\fP
|
||||
This option sets quiet mode, which suppresses unnecessary output, including progress
|
||||
indication. Without this option, when \fBdnssec\-keygen\fP is run
|
||||
interactively to generate an RSA or DSA key pair, it will print a
|
||||
interactively to generate an RSA or DSA key pair, it prints a
|
||||
string of symbols to \fBstderr\fP indicating the progress of the key
|
||||
generation. A \(aq.\(aq indicates that a random number has been found which
|
||||
passed an initial sieve test; \(aq+\(aq means a number has passed a single
|
||||
round of the Miller\-Rabin primality test; a space means that the
|
||||
generation. A \fB\&.\fP indicates that a random number has been found which
|
||||
passed an initial sieve test; \fB+\fP means a number has passed a single
|
||||
round of the Miller\-Rabin primality test; and a space ( ) means that the
|
||||
number has passed all the tests and is a satisfactory key.
|
||||
.TP
|
||||
\fB\-S\fP key
|
||||
Create a new key which is an explicit successor to an existing key.
|
||||
The name, algorithm, size, and type of the key will be set to match
|
||||
the existing key. The activation date of the new key will be set to
|
||||
the inactivation date of the existing one. The publication date will
|
||||
be set to the activation date minus the prepublication interval,
|
||||
.B \fB\-S key\fP
|
||||
This option creates a new key which is an explicit successor to an existing key.
|
||||
The name, algorithm, size, and type of the key are set to match
|
||||
the existing key. The activation date of the new key is set to
|
||||
the inactivation date of the existing one. The publication date is
|
||||
set to the activation date minus the prepublication interval,
|
||||
which defaults to 30 days.
|
||||
.TP
|
||||
\fB\-s\fP strength
|
||||
Specifies the strength value of the key. The strength is a number
|
||||
.B \fB\-s strength\fP
|
||||
This option specifies the strength value of the key. The strength is a number
|
||||
between 0 and 15, and currently has no defined purpose in DNSSEC.
|
||||
.TP
|
||||
\fB\-T\fP rrtype
|
||||
Specifies the resource record type to use for the key. \fBrrtype\fP
|
||||
.B \fB\-T rrtype\fP
|
||||
This option specifies the resource record type to use for the key. \fBrrtype\fP
|
||||
must be either DNSKEY or KEY. The default is DNSKEY when using a
|
||||
DNSSEC algorithm, but it can be overridden to KEY for use with
|
||||
SIG(0).
|
||||
.TP
|
||||
\fB\-t\fP type
|
||||
Indicates the use of the key, for use with \fB\-T KEY\fP\&. \fBtype\fP
|
||||
.B \fB\-t type\fP
|
||||
This option indicates the type of the key for use with \fB\-T KEY\fP\&. \fBtype\fP
|
||||
must be one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
|
||||
is AUTHCONF. AUTH refers to the ability to authenticate data, and
|
||||
CONF the ability to encrypt data.
|
||||
CONF to the ability to encrypt data.
|
||||
.TP
|
||||
\fB\-V\fP
|
||||
Prints version information.
|
||||
.B \fB\-V\fP
|
||||
This option prints version information.
|
||||
.TP
|
||||
\fB\-v\fP level
|
||||
Sets the debugging level.
|
||||
.B \fB\-v level\fP
|
||||
This option sets the debugging level.
|
||||
.UNINDENT
|
||||
.SH TIMING OPTIONS
|
||||
.sp
|
||||
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
|
||||
argument begins with a \(aq+\(aq or \(aq\-\(aq, it is interpreted as an offset from
|
||||
argument begins with a \fB+\fP or \fB\-\fP, it is interpreted as an offset from
|
||||
the present time. For convenience, if such an offset is followed by one
|
||||
of the suffixes \(aqy\(aq, \(aqmo\(aq, \(aqw\(aq, \(aqd\(aq, \(aqh\(aq, or \(aqmi\(aq, then the offset is
|
||||
of the suffixes \fBy\fP, \fBmo\fP, \fBw\fP, \fBd\fP, \fBh\fP, or \fBmi\fP, then the offset is
|
||||
computed in years (defined as 365 24\-hour days, ignoring leap years),
|
||||
months (defined as 30 24\-hour days), weeks, days, hours, or minutes,
|
||||
respectively. Without a suffix, the offset is computed in seconds. To
|
||||
explicitly prevent a date from being set, use \(aqnone\(aq or \(aqnever\(aq.
|
||||
explicitly prevent a date from being set, use \fBnone\fP or \fBnever\fP\&.
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-P\fP date/offset
|
||||
Sets the date on which a key is to be published to the zone. After
|
||||
that date, the key will be included in the zone but will not be used
|
||||
to sign it. If not set, and if the \-G option has not been used, the
|
||||
default is "now".
|
||||
.B \fB\-P date/offset\fP
|
||||
This option sets the date on which a key is to be published to the zone. After
|
||||
that date, the key is included in the zone but is not used
|
||||
to sign it. If not set, and if the \fB\-G\fP option has not been used, the
|
||||
default is the current date.
|
||||
.TP
|
||||
\fB\-P\fP sync date/offset
|
||||
Sets the date on which CDS and CDNSKEY records that match this key
|
||||
.B \fB\-P sync date/offset\fP
|
||||
This option sets the date on which CDS and CDNSKEY records that match this key
|
||||
are to be published to the zone.
|
||||
.TP
|
||||
\fB\-A\fP date/offset
|
||||
Sets the date on which the key is to be activated. After that date,
|
||||
the key will be included in the zone and used to sign it. If not set,
|
||||
and if the \-G option has not been used, the default is "now". If set,
|
||||
if and \-P is not set, then the publication date will be set to the
|
||||
.B \fB\-A date/offset\fP
|
||||
This option sets the date on which the key is to be activated. After that date,
|
||||
the key is included in the zone and used to sign it. If not set,
|
||||
and if the \fB\-G\fP option has not been used, the default is the current date. If set,
|
||||
and \fB\-P\fP is not set, the publication date is set to the
|
||||
activation date minus the prepublication interval.
|
||||
.TP
|
||||
\fB\-R\fP date/offset
|
||||
Sets the date on which the key is to be revoked. After that date, the
|
||||
key will be flagged as revoked. It will be included in the zone and
|
||||
will be used to sign it.
|
||||
.B \fB\-R date/offset\fP
|
||||
This option sets the date on which the key is to be revoked. After that date, the
|
||||
key is flagged as revoked. It is included in the zone and
|
||||
is used to sign it.
|
||||
.TP
|
||||
\fB\-I\fP date/offset
|
||||
Sets the date on which the key is to be retired. After that date, the
|
||||
key will still be included in the zone, but it will not be used to
|
||||
.B \fB\-I date/offset\fP
|
||||
This option sets the date on which the key is to be retired. After that date, the
|
||||
key is still included in the zone, but it is not used to
|
||||
sign it.
|
||||
.TP
|
||||
\fB\-D\fP date/offset
|
||||
Sets the date on which the key is to be deleted. After that date, the
|
||||
key will no longer be included in the zone. (It may remain in the key
|
||||
repository, however.)
|
||||
.B \fB\-D date/offset\fP
|
||||
This option sets the date on which the key is to be deleted. After that date, the
|
||||
key is no longer included in the zone. (However, it may remain in the key
|
||||
repository.)
|
||||
.TP
|
||||
\fB\-D\fP sync date/offset
|
||||
Sets the date on which the CDS and CDNSKEY records that match this
|
||||
.B \fB\-D sync date/offset\fP
|
||||
This option sets the date on which the CDS and CDNSKEY records that match this
|
||||
key are to be deleted.
|
||||
.TP
|
||||
\fB\-i\fP interval
|
||||
Sets the prepublication interval for a key. If set, then the
|
||||
.B \fB\-i interval\fP
|
||||
This option sets the prepublication interval for a key. If set, then the
|
||||
publication and activation dates must be separated by at least this
|
||||
much time. If the activation date is specified but the publication
|
||||
date isn\(aqt, then the publication date will default to this much time
|
||||
date is not, the publication date defaults to this much time
|
||||
before the activation date; conversely, if the publication date is
|
||||
specified but activation date isn\(aqt, then activation will be set to
|
||||
specified but not the activation date, activation is set to
|
||||
this much time after publication.
|
||||
.sp
|
||||
If the key is being created as an explicit successor to another key,
|
||||
@@ -267,7 +267,7 @@ then the default prepublication interval is 30 days; otherwise it is
|
||||
zero.
|
||||
.sp
|
||||
As with date offsets, if the argument is followed by one of the
|
||||
suffixes \(aqy\(aq, \(aqmo\(aq, \(aqw\(aq, \(aqd\(aq, \(aqh\(aq, or \(aqmi\(aq, then the interval is
|
||||
suffixes \fBy\fP, \fBmo\fP, \fBw\fP, \fBd\fP, \fBh\fP, or \fBmi\fP, the interval is
|
||||
measured in years, months, weeks, days, hours, or minutes,
|
||||
respectively. Without a suffix, the interval is measured in seconds.
|
||||
.UNINDENT
|
||||
@@ -290,9 +290,9 @@ string. \fBKnnnn.+aaa+iiiii.key\fP contains the public key, and
|
||||
\fBKnnnn.+aaa+iiiii.private\fP contains the private key.
|
||||
.sp
|
||||
The \fB\&.key\fP file contains a DNSKEY or KEY record. When a zone is being
|
||||
signed by \fBnamed\fP or \fBdnssec\-signzone\fP \fB\-S\fP, DNSKEY records are
|
||||
signed by \fBnamed\fP or \fBdnssec\-signzone \-S\fP, DNSKEY records are
|
||||
included automatically. In other cases, the \fB\&.key\fP file can be
|
||||
inserted into a zone file manually or with a \fB$INCLUDE\fP statement.
|
||||
inserted into a zone file manually or with an \fB$INCLUDE\fP statement.
|
||||
.sp
|
||||
The \fB\&.private\fP file contains algorithm\-specific fields. For obvious
|
||||
security reasons, this file does not have general read permission.
|
||||
@@ -303,7 +303,7 @@ To generate an ECDSAP256SHA256 zone\-signing key for the zone
|
||||
.sp
|
||||
\fBdnssec\-keygen \-a ECDSAP256SHA256 example.com\fP
|
||||
.sp
|
||||
The command would print a string of the form:
|
||||
The command prints a string of the form:
|
||||
.sp
|
||||
\fBKexample.com.+013+26160\fP
|
||||
.sp
|
||||
|
||||
@@ -41,38 +41,38 @@ containing the now\-revoked key.
|
||||
.SH OPTIONS
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-h\fP
|
||||
Emit usage message and exit.
|
||||
.B \fB\-h\fP
|
||||
This option emits a usage message and exits.
|
||||
.TP
|
||||
\fB\-K\fP directory
|
||||
Sets the directory in which the key files are to reside.
|
||||
.B \fB\-K directory\fP
|
||||
This option sets the directory in which the key files are to reside.
|
||||
.TP
|
||||
\fB\-r\fP
|
||||
After writing the new keyset files remove the original keyset files.
|
||||
.B \fB\-r\fP
|
||||
This option indicates to remove the original keyset files after writing the new keyset files.
|
||||
.TP
|
||||
\fB\-v\fP level
|
||||
Sets the debugging level.
|
||||
.B \fB\-v level\fP
|
||||
This option sets the debugging level.
|
||||
.TP
|
||||
\fB\-V\fP
|
||||
Prints version information.
|
||||
.B \fB\-V\fP
|
||||
This option prints version information.
|
||||
.TP
|
||||
\fB\-E\fP engine
|
||||
Specifies the cryptographic hardware to use, when applicable.
|
||||
.B \fB\-E engine\fP
|
||||
This option specifies the cryptographic hardware to use, when applicable.
|
||||
.sp
|
||||
When BIND is built with OpenSSL PKCS#11 support, this defaults to the
|
||||
string "pkcs11", which identifies an OpenSSL engine that can drive a
|
||||
When BIND 9 is built with OpenSSL PKCS#11 support, this defaults to the
|
||||
string \fBpkcs11\fP, which identifies an OpenSSL engine that can drive a
|
||||
cryptographic accelerator or hardware service module. When BIND is
|
||||
built with native PKCS#11 cryptography (\-\-enable\-native\-pkcs11), it
|
||||
built with native PKCS#11 cryptography (\fB\-\-enable\-native\-pkcs11\fP), it
|
||||
defaults to the path of the PKCS#11 provider library specified via
|
||||
"\-\-with\-pkcs11".
|
||||
\fB\-\-with\-pkcs11\fP\&.
|
||||
.TP
|
||||
\fB\-f\fP
|
||||
Force overwrite: Causes \fBdnssec\-revoke\fP to write the new key pair
|
||||
.B \fB\-f\fP
|
||||
This option indicates a forced overwrite and causes \fBdnssec\-revoke\fP to write the new key pair,
|
||||
even if a file already exists matching the algorithm and key ID of
|
||||
the revoked key.
|
||||
.TP
|
||||
\fB\-R\fP
|
||||
Print the key tag of the key with the REVOKE bit set but do not
|
||||
.B \fB\-R\fP
|
||||
This option prints the key tag of the key with the REVOKE bit set, but does not
|
||||
revoke the key.
|
||||
.UNINDENT
|
||||
.SH SEE ALSO
|
||||
|
||||
@@ -41,7 +41,7 @@ timing metadata as specified by the \fB\-P\fP, \fB\-A\fP, \fB\-R\fP, \fB\-I\fP,
|
||||
other signing software to determine when a key is to be published,
|
||||
whether it should be used for signing a zone, etc.
|
||||
.sp
|
||||
If none of these options is set on the command line, then
|
||||
If none of these options is set on the command line,
|
||||
\fBdnssec\-settime\fP simply prints the key timing metadata already stored
|
||||
in the key.
|
||||
.sp
|
||||
@@ -55,157 +55,156 @@ the key file. The private file\(aqs permissions are always set to be
|
||||
inaccessible to anyone other than the owner (mode 0600).
|
||||
.sp
|
||||
When working with state files, it is possible to update the timing metadata in
|
||||
those files as well with \fB\-s\fP\&. If this option is used you can also update key
|
||||
those files as well with \fB\-s\fP\&. With this option, it is also possible to update key
|
||||
states with \fB\-d\fP (DS), \fB\-k\fP (DNSKEY), \fB\-r\fP (RRSIG of KSK), or \fB\-z\fP
|
||||
(RRSIG of ZSK). Allowed states are HIDDEN, RUMOURED, OMNIPRESENT, and
|
||||
UNRETENTIVE.
|
||||
.sp
|
||||
You can also set the goal state of the key with \fB\-g\fP\&. This should be either
|
||||
HIDDEN or OMNIPRESENT (representing whether the key should be removed from the
|
||||
zone, or published).
|
||||
The goal state of the key can also be set with \fB\-g\fP\&. This should be either
|
||||
HIDDEN or OMNIPRESENT, representing whether the key should be removed from the
|
||||
zone or published.
|
||||
.sp
|
||||
It is NOT RECOMMENDED to manipulate state files manually except for testing
|
||||
It is NOT RECOMMENDED to manipulate state files manually, except for testing
|
||||
purposes.
|
||||
.SH OPTIONS
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-f\fP
|
||||
Force an update of an old\-format key with no metadata fields. Without
|
||||
this option, \fBdnssec\-settime\fP will fail when attempting to update a
|
||||
legacy key. With this option, the key will be recreated in the new
|
||||
.B \fB\-f\fP
|
||||
This option forces an update of an old\-format key with no metadata fields. Without
|
||||
this option, \fBdnssec\-settime\fP fails when attempting to update a
|
||||
legacy key. With this option, the key is recreated in the new
|
||||
format, but with the original key data retained. The key\(aqs creation
|
||||
date will be set to the present time. If no other values are
|
||||
specified, then the key\(aqs publication and activation dates will also
|
||||
be set to the present time.
|
||||
date is set to the present time. If no other values are
|
||||
specified, then the key\(aqs publication and activation dates are also
|
||||
set to the present time.
|
||||
.TP
|
||||
\fB\-K\fP directory
|
||||
Sets the directory in which the key files are to reside.
|
||||
.B \fB\-K directory\fP
|
||||
This option sets the directory in which the key files are to reside.
|
||||
.TP
|
||||
\fB\-L\fP ttl
|
||||
Sets the default TTL to use for this key when it is converted into a
|
||||
DNSKEY RR. If the key is imported into a zone, this is the TTL that
|
||||
will be used for it, unless there was already a DNSKEY RRset in
|
||||
place, in which case the existing TTL would take precedence. If this
|
||||
value is not set and there is no existing DNSKEY RRset, the TTL will
|
||||
default to the SOA TTL. Setting the default TTL to \fB0\fP or \fBnone\fP
|
||||
.B \fB\-L ttl\fP
|
||||
This option sets the default TTL to use for this key when it is converted into a
|
||||
DNSKEY RR. This is the TTL used when the key is imported into a zone,
|
||||
unless there was already a DNSKEY RRset in
|
||||
place, in which case the existing TTL takes precedence. If this
|
||||
value is not set and there is no existing DNSKEY RRset, the TTL
|
||||
defaults to the SOA TTL. Setting the default TTL to \fB0\fP or \fBnone\fP
|
||||
removes it from the key.
|
||||
.TP
|
||||
\fB\-h\fP
|
||||
Emit usage message and exit.
|
||||
.B \fB\-h\fP
|
||||
This option emits a usage message and exits.
|
||||
.TP
|
||||
\fB\-V\fP
|
||||
Prints version information.
|
||||
.B \fB\-V\fP
|
||||
This option prints version information.
|
||||
.TP
|
||||
\fB\-v\fP level
|
||||
Sets the debugging level.
|
||||
.B \fB\-v level\fP
|
||||
This option sets the debugging level.
|
||||
.TP
|
||||
\fB\-E\fP engine
|
||||
Specifies the cryptographic hardware to use, when applicable.
|
||||
.B \fB\-E engine\fP
|
||||
This option specifies the cryptographic hardware to use, when applicable.
|
||||
.sp
|
||||
When BIND is built with OpenSSL PKCS#11 support, this defaults to the
|
||||
string "pkcs11", which identifies an OpenSSL engine that can drive a
|
||||
string \fBpkcs11\fP, which identifies an OpenSSL engine that can drive a
|
||||
cryptographic accelerator or hardware service module. When BIND is
|
||||
built with native PKCS#11 cryptography (\-\-enable\-native\-pkcs11), it
|
||||
built with native PKCS#11 cryptography (\fB\-\-enable\-native\-pkcs11\fP), it
|
||||
defaults to the path of the PKCS#11 provider library specified via
|
||||
"\-\-with\-pkcs11".
|
||||
\fB\-\-with\-pkcs11\fP\&.
|
||||
.UNINDENT
|
||||
.SH TIMING OPTIONS
|
||||
.sp
|
||||
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
|
||||
argument begins with a \(aq+\(aq or \(aq\-\(aq, it is interpreted as an offset from
|
||||
argument begins with a \fB+\fP or \fB\-\fP, it is interpreted as an offset from
|
||||
the present time. For convenience, if such an offset is followed by one
|
||||
of the suffixes \(aqy\(aq, \(aqmo\(aq, \(aqw\(aq, \(aqd\(aq, \(aqh\(aq, or \(aqmi\(aq, then the offset is
|
||||
of the suffixes \fBy\fP, \fBmo\fP, \fBw\fP, \fBd\fP, \fBh\fP, or \fBmi\fP, then the offset is
|
||||
computed in years (defined as 365 24\-hour days, ignoring leap years),
|
||||
months (defined as 30 24\-hour days), weeks, days, hours, or minutes,
|
||||
respectively. Without a suffix, the offset is computed in seconds. To
|
||||
unset a date, use \(aqnone\(aq or \(aqnever\(aq.
|
||||
explicitly prevent a date from being set, use \fBnone\fP or \fBnever\fP\&.
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-P\fP date/offset
|
||||
Sets the date on which a key is to be published to the zone. After
|
||||
that date, the key will be included in the zone but will not be used
|
||||
.B \fB\-P date/offset\fP
|
||||
This option sets the date on which a key is to be published to the zone. After
|
||||
that date, the key is included in the zone but is not used
|
||||
to sign it.
|
||||
.TP
|
||||
\fB\-P\fP sync date/offset
|
||||
Sets the date on which CDS and CDNSKEY records that match this key
|
||||
.B \fB\-P sync date/offset\fP
|
||||
This option sets the date on which CDS and CDNSKEY records that match this key
|
||||
are to be published to the zone.
|
||||
.TP
|
||||
\fB\-A\fP date/offset
|
||||
Sets the date on which the key is to be activated. After that date,
|
||||
the key will be included in the zone and used to sign it.
|
||||
.B \fB\-A date/offset\fP
|
||||
This option sets the date on which the key is to be activated. After that date,
|
||||
the key is included in the zone and used to sign it.
|
||||
.TP
|
||||
\fB\-R\fP date/offset
|
||||
Sets the date on which the key is to be revoked. After that date, the
|
||||
key will be flagged as revoked. It will be included in the zone and
|
||||
will be used to sign it.
|
||||
.B \fB\-R date/offset\fP
|
||||
This option sets the date on which the key is to be revoked. After that date, the
|
||||
key is flagged as revoked. It is included in the zone and
|
||||
is used to sign it.
|
||||
.TP
|
||||
\fB\-I\fP date/offset
|
||||
Sets the date on which the key is to be retired. After that date, the
|
||||
key will still be included in the zone, but it will not be used to
|
||||
.B \fB\-I date/offset\fP
|
||||
This option sets the date on which the key is to be retired. After that date, the
|
||||
key is still included in the zone, but it is not used to
|
||||
sign it.
|
||||
.TP
|
||||
\fB\-D\fP date/offset
|
||||
Sets the date on which the key is to be deleted. After that date, the
|
||||
key will no longer be included in the zone. (It may remain in the key
|
||||
repository, however.)
|
||||
.B \fB\-D date/offset\fP
|
||||
This option sets the date on which the key is to be deleted. After that date, the
|
||||
key is no longer included in the zone. (However, it may remain in the key
|
||||
repository.)
|
||||
.TP
|
||||
\fB\-D\fP sync date/offset
|
||||
Sets the date on which the CDS and CDNSKEY records that match this
|
||||
.B \fB\-D sync date/offset\fP
|
||||
This option sets the date on which the CDS and CDNSKEY records that match this
|
||||
key are to be deleted.
|
||||
.TP
|
||||
\fB\-S\fP predecessor key
|
||||
Select a key for which the key being modified will be an explicit
|
||||
.B \fB\-S predecessor key\fP
|
||||
This option selects a key for which the key being modified is an explicit
|
||||
successor. The name, algorithm, size, and type of the predecessor key
|
||||
must exactly match those of the key being modified. The activation
|
||||
date of the successor key will be set to the inactivation date of the
|
||||
predecessor. The publication date will be set to the activation date
|
||||
date of the successor key is set to the inactivation date of the
|
||||
predecessor. The publication date is set to the activation date
|
||||
minus the prepublication interval, which defaults to 30 days.
|
||||
.TP
|
||||
\fB\-i\fP interval
|
||||
Sets the prepublication interval for a key. If set, then the
|
||||
.B \fB\-i interval\fP
|
||||
This option sets the prepublication interval for a key. If set, then the
|
||||
publication and activation dates must be separated by at least this
|
||||
much time. If the activation date is specified but the publication
|
||||
date isn\(aqt, then the publication date will default to this much time
|
||||
date is not, the publication date defaults to this much time
|
||||
before the activation date; conversely, if the publication date is
|
||||
specified but activation date isn\(aqt, then activation will be set to
|
||||
specified but not the activation date, activation is set to
|
||||
this much time after publication.
|
||||
.sp
|
||||
If the key is being set to be an explicit successor to another key,
|
||||
If the key is being created as an explicit successor to another key,
|
||||
then the default prepublication interval is 30 days; otherwise it is
|
||||
zero.
|
||||
.sp
|
||||
As with date offsets, if the argument is followed by one of the
|
||||
suffixes \(aqy\(aq, \(aqmo\(aq, \(aqw\(aq, \(aqd\(aq, \(aqh\(aq, or \(aqmi\(aq, then the interval is
|
||||
suffixes \fBy\fP, \fBmo\fP, \fBw\fP, \fBd\fP, \fBh\fP, or \fBmi\fP, the interval is
|
||||
measured in years, months, weeks, days, hours, or minutes,
|
||||
respectively. Without a suffix, the interval is measured in seconds.
|
||||
.UNINDENT
|
||||
.SH KEY STATE OPTIONS
|
||||
.sp
|
||||
Known key states are HIDDEN, RUMOURED, OMNIPRESENT and UNRETENTIVE. These should
|
||||
not be set manually except for testing purposes.
|
||||
To test dnssec\-policy it may be necessary to construct keys with artificial
|
||||
state information; these options are used by the testing framework for that
|
||||
purpose, but should never be used in production.
|
||||
.sp
|
||||
Known key states are HIDDEN, RUMOURED, OMNIPRESENT, and UNRETENTIVE.
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
.B \fB\-s\fP
|
||||
When setting key timing data, also update the state file.
|
||||
This option indicates that when setting key timing data, the state file should also be updated.
|
||||
.TP
|
||||
.B \fB\-g\fP
|
||||
Set the goal state for this key. Must be HIDDEN or OMNIPRESENT.
|
||||
.B \fB\-g state\fP
|
||||
This option sets the goal state for this key. Must be HIDDEN or OMNIPRESENT.
|
||||
.TP
|
||||
.B \fB\-d\fP
|
||||
Set the DS state for this key, and when it was last changed.
|
||||
.B \fB\-d state date/offset\fP
|
||||
This option sets the DS state for this key as of the specified date, offset from the current date.
|
||||
.TP
|
||||
.B \fB\-k\fP
|
||||
Set the DNSKEY state for this key, and when it was last changed.
|
||||
.B \fB\-k state date/offset\fP
|
||||
This option sets the DNSKEY state for this key as of the specified date, offset from the current date.
|
||||
.TP
|
||||
.B \fB\-r\fP
|
||||
Set the RRSIG (KSK) state for this key, and when it was last changed.
|
||||
.UNINDENT
|
||||
.sp
|
||||
\fB\-z\fP
|
||||
.INDENT 0.0
|
||||
.INDENT 3.5
|
||||
Set the RRSIG (ZSK) state for this key, and when it was last changed.
|
||||
.UNINDENT
|
||||
.B \fB\-r state date/offset\fP
|
||||
This option sets the RRSIG (KSK) state for this key as of the specified date, offset from the current date.
|
||||
.TP
|
||||
.B \fB\-z state date/offset\fP
|
||||
This option sets the RRSIG (ZSK) state for this key as of the specified date, offset from the current date.
|
||||
.UNINDENT
|
||||
.SH PRINTING OPTIONS
|
||||
.sp
|
||||
@@ -213,18 +212,18 @@ Set the RRSIG (ZSK) state for this key, and when it was last changed.
|
||||
associated with a key.
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-u\fP
|
||||
Print times in UNIX epoch format.
|
||||
.B \fB\-u\fP
|
||||
This option indicates that times should be printed in Unix epoch format.
|
||||
.TP
|
||||
\fB\-p\fP C/P/Psync/A/R/I/D/Dsync/all
|
||||
Print a specific metadata value or set of metadata values. The \fB\-p\fP
|
||||
.B \fB\-p C/P/Psync/A/R/I/D/Dsync/all\fP
|
||||
This option prints a specific metadata value or set of metadata values. The \fB\-p\fP
|
||||
option may be followed by one or more of the following letters or
|
||||
strings to indicate which value or values to print: \fBC\fP for the
|
||||
creation date, \fBP\fP for the publication date, \fBPsync\fP for the CDS
|
||||
and CDNSKEY publication date, \fBA\fP for the activation date, \fBR\fP
|
||||
for the revocation date, \fBI\fP for the inactivation date, \fBD\fP for
|
||||
the deletion date, and \fBDsync\fP for the CDS and CDNSKEY deletion
|
||||
date To print all of the metadata, use \fB\-p all\fP\&.
|
||||
date. To print all of the metadata, use \fBall\fP\&.
|
||||
.UNINDENT
|
||||
.SH SEE ALSO
|
||||
.sp
|
||||
|
||||
@@ -35,234 +35,233 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
||||
\fBdnssec\-signzone\fP [\fB\-a\fP] [\fB\-c\fP class] [\fB\-d\fP directory] [\fB\-D\fP] [\fB\-E\fP engine] [\fB\-e\fP end\-time] [\fB\-f\fP output\-file] [\fB\-g\fP] [\fB\-h\fP] [\fB\-i\fP interval] [\fB\-I\fP input\-format] [\fB\-j\fP jitter] [\fB\-K\fP directory] [\fB\-k\fP key] [\fB\-L\fP serial] [\fB\-M\fP maxttl] [\fB\-N\fP soa\-serial\-format] [\fB\-o\fP origin] [\fB\-O\fP output\-format] [\fB\-P\fP] [\fB\-Q\fP] [\fB\-q\fP] [\fB\-R\fP] [\fB\-S\fP] [\fB\-s\fP start\-time] [\fB\-T\fP ttl] [\fB\-t\fP] [\fB\-u\fP] [\fB\-v\fP level] [\fB\-V\fP] [\fB\-X\fP extended end\-time] [\fB\-x\fP] [\fB\-z\fP] [\fB\-3\fP salt] [\fB\-H\fP iterations] [\fB\-A\fP] {zonefile} [key...]
|
||||
.SH DESCRIPTION
|
||||
.sp
|
||||
\fBdnssec\-signzone\fP signs a zone. It generates NSEC and RRSIG records
|
||||
\fBdnssec\-signzone\fP signs a zone; it generates NSEC and RRSIG records
|
||||
and produces a signed version of the zone. The security status of
|
||||
delegations from the signed zone (that is, whether the child zones are
|
||||
secure or not) is determined by the presence or absence of a \fBkeyset\fP
|
||||
secure) is determined by the presence or absence of a \fBkeyset\fP
|
||||
file for each child zone.
|
||||
.SH OPTIONS
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-a\fP
|
||||
Verify all generated signatures.
|
||||
.B \fB\-a\fP
|
||||
This option verifies all generated signatures.
|
||||
.TP
|
||||
\fB\-c\fP class
|
||||
Specifies the DNS class of the zone.
|
||||
.B \fB\-c class\fP
|
||||
This option specifies the DNS class of the zone.
|
||||
.TP
|
||||
\fB\-C\fP
|
||||
Compatibility mode: Generate a \fBkeyset\-zonename\fP file in addition
|
||||
.B \fB\-C\fP
|
||||
This option sets compatibility mode, in which a \fBkeyset\-zonename\fP file is generated in addition
|
||||
to \fBdsset\-zonename\fP when signing a zone, for use by older versions
|
||||
of \fBdnssec\-signzone\fP\&.
|
||||
.TP
|
||||
\fB\-d\fP directory
|
||||
Look for \fBdsset\-\fP or \fBkeyset\-\fP files in \fBdirectory\fP\&.
|
||||
.B \fB\-d directory\fP
|
||||
This option indicates the directory where BIND 9 should look for \fBdsset\-\fP or \fBkeyset\-\fP files.
|
||||
.TP
|
||||
\fB\-D\fP
|
||||
Output only those record types automatically managed by
|
||||
\fBdnssec\-signzone\fP, i.e. RRSIG, NSEC, NSEC3 and NSEC3PARAM records.
|
||||
.B \fB\-D\fP
|
||||
This option indicates that only those record types automatically managed by
|
||||
\fBdnssec\-signzone\fP, i.e., RRSIG, NSEC, NSEC3 and NSEC3PARAM records, should be included in the output.
|
||||
If smart signing (\fB\-S\fP) is used, DNSKEY records are also included.
|
||||
The resulting file can be included in the original zone file with
|
||||
\fB$INCLUDE\fP\&. This option cannot be combined with \fB\-O raw\fP,
|
||||
\fB\-O map\fP, or serial number updating.
|
||||
\fB\-O map\fP, or serial\-number updating.
|
||||
.TP
|
||||
\fB\-E\fP engine
|
||||
When applicable, specifies the hardware to use for cryptographic
|
||||
operations, such as a secure key store used for signing.
|
||||
.B \fB\-E engine\fP
|
||||
This option specifies the hardware to use for cryptographic
|
||||
operations, such as a secure key store used for signing, when applicable.
|
||||
.sp
|
||||
When BIND is built with OpenSSL PKCS#11 support, this defaults to the
|
||||
string "pkcs11", which identifies an OpenSSL engine that can drive a
|
||||
string \fBpkcs11\fP, which identifies an OpenSSL engine that can drive a
|
||||
cryptographic accelerator or hardware service module. When BIND is
|
||||
built with native PKCS#11 cryptography (\-\-enable\-native\-pkcs11), it
|
||||
built with native PKCS#11 cryptography (\fB\-\-enable\-native\-pkcs11\fP), it
|
||||
defaults to the path of the PKCS#11 provider library specified via
|
||||
"\-\-with\-pkcs11".
|
||||
\fB\-\-with\-pkcs11\fP\&.
|
||||
.TP
|
||||
\fB\-g\fP
|
||||
Generate DS records for child zones from \fBdsset\-\fP or \fBkeyset\-\fP
|
||||
file. Existing DS records will be removed.
|
||||
.B \fB\-g\fP
|
||||
This option indicates that DS records for child zones should be generated from a \fBdsset\-\fP or \fBkeyset\-\fP
|
||||
file. Existing DS records are removed.
|
||||
.TP
|
||||
\fB\-K\fP directory
|
||||
Key repository: Specify a directory to search for DNSSEC keys. If not
|
||||
specified, defaults to the current directory.
|
||||
.B \fB\-K directory\fP
|
||||
This option specifies the directory to search for DNSSEC keys. If not
|
||||
specified, it defaults to the current directory.
|
||||
.TP
|
||||
\fB\-k\fP key
|
||||
Treat specified key as a key signing key ignoring any key flags. This
|
||||
.B \fB\-k key\fP
|
||||
This option tells BIND 9 to treat the specified key as a key\-signing key, ignoring any key flags. This
|
||||
option may be specified multiple times.
|
||||
.TP
|
||||
\fB\-M\fP maxttl
|
||||
Sets the maximum TTL for the signed zone. Any TTL higher than maxttl
|
||||
in the input zone will be reduced to maxttl in the output. This
|
||||
.B \fB\-M maxttl\fP
|
||||
This option sets the maximum TTL for the signed zone. Any TTL higher than \fBmaxttl\fP
|
||||
in the input zone is reduced to \fBmaxttl\fP in the output. This
|
||||
provides certainty as to the largest possible TTL in the signed zone,
|
||||
which is useful to know when rolling keys because it is the longest
|
||||
which is useful to know when rolling keys. The maxttl is the longest
|
||||
possible time before signatures that have been retrieved by resolvers
|
||||
will expire from resolver caches. Zones that are signed with this
|
||||
expire from resolver caches. Zones that are signed with this
|
||||
option should be configured to use a matching \fBmax\-zone\-ttl\fP in
|
||||
\fBnamed.conf\fP\&. (Note: This option is incompatible with \fB\-D\fP,
|
||||
because it modifies non\-DNSSEC data in the output zone.)
|
||||
.TP
|
||||
\fB\-s\fP start\-time
|
||||
Specify the date and time when the generated RRSIG records become
|
||||
.B \fB\-s start\-time\fP
|
||||
This option specifies the date and time when the generated RRSIG records become
|
||||
valid. This can be either an absolute or relative time. An absolute
|
||||
start time is indicated by a number in YYYYMMDDHHMMSS notation;
|
||||
20000530144500 denotes 14:45:00 UTC on May 30th, 2000. A relative
|
||||
start time is indicated by +N, which is N seconds from the current
|
||||
start time is indicated by \fB+N\fP, which is N seconds from the current
|
||||
time. If no \fBstart\-time\fP is specified, the current time minus 1
|
||||
hour (to allow for clock skew) is used.
|
||||
.TP
|
||||
\fB\-e\fP end\-time
|
||||
Specify the date and time when the generated RRSIG records expire. As
|
||||
.B \fB\-e end\-time\fP
|
||||
This option specifies the date and time when the generated RRSIG records expire. As
|
||||
with \fBstart\-time\fP, an absolute time is indicated in YYYYMMDDHHMMSS
|
||||
notation. A time relative to the start time is indicated with +N,
|
||||
notation. A time relative to the start time is indicated with \fB+N\fP,
|
||||
which is N seconds from the start time. A time relative to the
|
||||
current time is indicated with now+N. If no \fBend\-time\fP is
|
||||
specified, 30 days from the start time is used as a default.
|
||||
current time is indicated with \fBnow+N\fP\&. If no \fBend\-time\fP is
|
||||
specified, 30 days from the start time is the default.
|
||||
\fBend\-time\fP must be later than \fBstart\-time\fP\&.
|
||||
.TP
|
||||
\fB\-X\fP extended end\-time
|
||||
Specify the date and time when the generated RRSIG records for the
|
||||
DNSKEY RRset will expire. This is to be used in cases when the DNSKEY
|
||||
.B \fB\-X extended end\-time\fP
|
||||
This option specifies the date and time when the generated RRSIG records for the
|
||||
DNSKEY RRset expire. This is to be used in cases when the DNSKEY
|
||||
signatures need to persist longer than signatures on other records;
|
||||
e.g., when the private component of the KSK is kept offline and the
|
||||
KSK signature is to be refreshed manually.
|
||||
.sp
|
||||
As with \fBstart\-time\fP, an absolute time is indicated in
|
||||
As with \fBend\-time\fP, an absolute time is indicated in
|
||||
YYYYMMDDHHMMSS notation. A time relative to the start time is
|
||||
indicated with +N, which is N seconds from the start time. A time
|
||||
relative to the current time is indicated with now+N. If no
|
||||
indicated with \fB+N\fP, which is N seconds from the start time. A time
|
||||
relative to the current time is indicated with \fBnow+N\fP\&. If no
|
||||
\fBextended end\-time\fP is specified, the value of \fBend\-time\fP is used
|
||||
as the default. (\fBend\-time\fP, in turn, defaults to 30 days from the
|
||||
start time.) \fBextended end\-time\fP must be later than \fBstart\-time\fP\&.
|
||||
.TP
|
||||
\fB\-f\fP output\-file
|
||||
The name of the output file containing the signed zone. The default
|
||||
.B \fB\-f output\-file\fP
|
||||
This option indicates the name of the output file containing the signed zone. The default
|
||||
is to append \fB\&.signed\fP to the input filename. If \fBoutput\-file\fP is
|
||||
set to \fB"\-"\fP, then the signed zone is written to the standard
|
||||
output, with a default output format of "full".
|
||||
set to \fB\-\fP, then the signed zone is written to the standard
|
||||
output, with a default output format of \fBfull\fP\&.
|
||||
.TP
|
||||
\fB\-h\fP
|
||||
Prints a short summary of the options and arguments to
|
||||
.B \fB\-h\fP
|
||||
This option prints a short summary of the options and arguments to
|
||||
\fBdnssec\-signzone\fP\&.
|
||||
.TP
|
||||
\fB\-V\fP
|
||||
Prints version information.
|
||||
.B \fB\-V\fP
|
||||
This option prints version information.
|
||||
.TP
|
||||
\fB\-i\fP interval
|
||||
When a previously\-signed zone is passed as input, records may be
|
||||
resigned. The \fBinterval\fP option specifies the cycle interval as an
|
||||
offset from the current time (in seconds). If a RRSIG record expires
|
||||
after the cycle interval, it is retained. Otherwise, it is considered
|
||||
to be expiring soon, and it will be replaced.
|
||||
.B \fB\-i interval\fP
|
||||
This option indicates that, when a previously signed zone is passed as input, records may be
|
||||
re\-signed. The \fBinterval\fP option specifies the cycle interval as an
|
||||
offset from the current time, in seconds. If a RRSIG record expires
|
||||
after the cycle interval, it is retained; otherwise, it is considered
|
||||
to be expiring soon and it is replaced.
|
||||
.sp
|
||||
The default cycle interval is one quarter of the difference between
|
||||
the signature end and start times. So if neither \fBend\-time\fP or
|
||||
\fBstart\-time\fP are specified, \fBdnssec\-signzone\fP generates
|
||||
the signature end and start times. So if neither \fBend\-time\fP nor
|
||||
\fBstart\-time\fP is specified, \fBdnssec\-signzone\fP generates
|
||||
signatures that are valid for 30 days, with a cycle interval of 7.5
|
||||
days. Therefore, if any existing RRSIG records are due to expire in
|
||||
less than 7.5 days, they would be replaced.
|
||||
less than 7.5 days, they are replaced.
|
||||
.TP
|
||||
\fB\-I\fP input\-format
|
||||
The format of the input zone file. Possible formats are \fB"text"\fP
|
||||
(default), \fB"raw"\fP, and \fB"map"\fP\&. This option is primarily
|
||||
intended to be used for dynamic signed zones so that the dumped zone
|
||||
.B \fB\-I input\-format\fP
|
||||
This option sets the format of the input zone file. Possible formats are \fBtext\fP
|
||||
(the default), \fBraw\fP, and \fBmap\fP\&. This option is primarily
|
||||
intended to be used for dynamic signed zones, so that the dumped zone
|
||||
file in a non\-text format containing updates can be signed directly.
|
||||
The use of this option does not make much sense for non\-dynamic
|
||||
zones.
|
||||
This option is not useful for non\-dynamic zones.
|
||||
.TP
|
||||
\fB\-j\fP jitter
|
||||
.B \fB\-j jitter\fP
|
||||
When signing a zone with a fixed signature lifetime, all RRSIG
|
||||
records issued at the time of signing expires simultaneously. If the
|
||||
zone is incrementally signed, i.e. a previously\-signed zone is passed
|
||||
as input to the signer, all expired signatures have to be regenerated
|
||||
at about the same time. The \fBjitter\fP option specifies a jitter
|
||||
window that will be used to randomize the signature expire time, thus
|
||||
records issued at the time of signing expire simultaneously. If the
|
||||
zone is incrementally signed, i.e., a previously signed zone is passed
|
||||
as input to the signer, all expired signatures must be regenerated
|
||||
at approximately the same time. The \fBjitter\fP option specifies a jitter
|
||||
window that is used to randomize the signature expire time, thus
|
||||
spreading incremental signature regeneration over time.
|
||||
.sp
|
||||
Signature lifetime jitter also to some extent benefits validators and
|
||||
servers by spreading out cache expiration, i.e. if large numbers of
|
||||
RRSIGs don\(aqt expire at the same time from all caches there will be
|
||||
less congestion than if all validators need to refetch at mostly the
|
||||
Signature lifetime jitter also, to some extent, benefits validators and
|
||||
servers by spreading out cache expiration, i.e., if large numbers of
|
||||
RRSIGs do not expire at the same time from all caches, there is
|
||||
less congestion than if all validators need to refetch at around the
|
||||
same time.
|
||||
.TP
|
||||
\fB\-L\fP serial
|
||||
When writing a signed zone to "raw" or "map" format, set the "source
|
||||
serial" value in the header to the specified serial number. (This is
|
||||
.B \fB\-L serial\fP
|
||||
When writing a signed zone to "raw" or "map" format, this option sets the "source
|
||||
serial" value in the header to the specified \fBserial\fP number. (This is
|
||||
expected to be used primarily for testing purposes.)
|
||||
.TP
|
||||
\fB\-n\fP ncpus
|
||||
Specifies the number of threads to use. By default, one thread is
|
||||
.B \fB\-n ncpus\fP
|
||||
This option specifies the number of threads to use. By default, one thread is
|
||||
started for each detected CPU.
|
||||
.TP
|
||||
\fB\-N\fP soa\-serial\-format
|
||||
The SOA serial number format of the signed zone. Possible formats are
|
||||
\fB"keep"\fP (default), \fB"increment"\fP, \fB"unixtime"\fP, and
|
||||
\fB"date"\fP\&.
|
||||
.B \fB\-N soa\-serial\-format\fP
|
||||
This option sets the SOA serial number format of the signed zone. Possible formats are
|
||||
\fBkeep\fP (the default), \fBincrement\fP, \fBunixtime\fP, and
|
||||
\fBdate\fP\&.
|
||||
.INDENT 7.0
|
||||
.TP
|
||||
.B \fB"keep"\fP
|
||||
Do not modify the SOA serial number.
|
||||
\fBkeep\fP
|
||||
This format indicates that the SOA serial number should not be modified.
|
||||
.TP
|
||||
.B \fB"increment"\fP
|
||||
Increment the SOA serial number using \fI\%RFC 1982\fP arithmetic.
|
||||
\fBincrement\fP
|
||||
This format increments the SOA serial number using \fI\%RFC 1982\fP arithmetic.
|
||||
.TP
|
||||
.B \fB"unixtime"\fP
|
||||
Set the SOA serial number to the number of seconds since epoch.
|
||||
\fBunixtime\fP
|
||||
This format sets the SOA serial number to the number of seconds since the beginning of the Unix epoch.
|
||||
.TP
|
||||
.B \fB"date"\fP
|
||||
Set the SOA serial number to today\(aqs date in YYYYMMDDNN format.
|
||||
\fBdate\fP
|
||||
This format sets the SOA serial number to today\(aqs date, in YYYYMMDDNN format.
|
||||
.UNINDENT
|
||||
.TP
|
||||
\fB\-o\fP origin
|
||||
The zone origin. If not specified, the name of the zone file is
|
||||
.B \fB\-o origin\fP
|
||||
This option sets the zone origin. If not specified, the name of the zone file is
|
||||
assumed to be the origin.
|
||||
.TP
|
||||
\fB\-O\fP output\-format
|
||||
The format of the output file containing the signed zone. Possible
|
||||
formats are \fB"text"\fP (default), which is the standard textual
|
||||
representation of the zone; \fB"full"\fP, which is text output in a
|
||||
format suitable for processing by external scripts; and \fB"map"\fP,
|
||||
\fB"raw"\fP, and \fB"raw=N"\fP, which store the zone in binary formats
|
||||
for rapid loading by \fBnamed\fP\&. \fB"raw=N"\fP specifies the format
|
||||
.B \fB\-O output\-format\fP
|
||||
This option sets the format of the output file containing the signed zone. Possible
|
||||
formats are \fBtext\fP (the default), which is the standard textual
|
||||
representation of the zone; \fBfull\fP, which is text output in a
|
||||
format suitable for processing by external scripts; and \fBmap\fP,
|
||||
\fBraw\fP, and \fBraw=N\fP, which store the zone in binary formats
|
||||
for rapid loading by \fBnamed\fP\&. \fBraw=N\fP specifies the format
|
||||
version of the raw zone file: if N is 0, the raw file can be read by
|
||||
any version of \fBnamed\fP; if N is 1, the file can be read by release
|
||||
9.9.0 or higher; the default is 1.
|
||||
9.9.0 or higher. The default is 1.
|
||||
.TP
|
||||
\fB\-P\fP
|
||||
Disable post sign verification tests.
|
||||
.B \fB\-P\fP
|
||||
This option disables post\-sign verification tests.
|
||||
.sp
|
||||
The post sign verification test ensures that for each algorithm in
|
||||
use there is at least one non revoked self signed KSK key, that all
|
||||
revoked KSK keys are self signed, and that all records in the zone
|
||||
The post\-sign verification tests ensure that for each algorithm in
|
||||
use there is at least one non\-revoked self\-signed KSK key, that all
|
||||
revoked KSK keys are self\-signed, and that all records in the zone
|
||||
are signed by the algorithm. This option skips these tests.
|
||||
.TP
|
||||
\fB\-Q\fP
|
||||
Remove signatures from keys that are no longer active.
|
||||
.B \fB\-Q\fP
|
||||
This option removes signatures from keys that are no longer active.
|
||||
.sp
|
||||
Normally, when a previously\-signed zone is passed as input to the
|
||||
Normally, when a previously signed zone is passed as input to the
|
||||
signer, and a DNSKEY record has been removed and replaced with a new
|
||||
one, signatures from the old key that are still within their validity
|
||||
period are retained. This allows the zone to continue to validate
|
||||
with cached copies of the old DNSKEY RRset. The \fB\-Q\fP forces
|
||||
with cached copies of the old DNSKEY RRset. The \fB\-Q\fP option forces
|
||||
\fBdnssec\-signzone\fP to remove signatures from keys that are no longer
|
||||
active. This enables ZSK rollover using the procedure described in
|
||||
\fI\%RFC 4641#4.2.1.1\fP ("Pre\-Publish Key Rollover").
|
||||
.TP
|
||||
.B \fB\-q\fP
|
||||
Quiet mode: Suppresses unnecessary output. Without this option, when
|
||||
\fBdnssec\-signzone\fP is run it will print to standard output the number of
|
||||
keys in use, the algorithms used to verify the zone was signed correctly and
|
||||
other status information, and finally the filename containing the signed
|
||||
zone. With it, that output is suppressed, leaving only the filename.
|
||||
This option enables quiet mode, which suppresses unnecessary output. Without this option, when
|
||||
\fBdnssec\-signzone\fP is run it prints three pieces of information to standard output: the number of
|
||||
keys in use; the algorithms used to verify the zone was signed correctly and
|
||||
other status information; and the filename containing the signed
|
||||
zone. With the option that output is suppressed, leaving only the filename.
|
||||
.TP
|
||||
\fB\-R\fP
|
||||
Remove signatures from keys that are no longer published.
|
||||
.B \fB\-R\fP
|
||||
This option removes signatures from keys that are no longer published.
|
||||
.sp
|
||||
This option is similar to \fB\-Q\fP, except it forces
|
||||
\fBdnssec\-signzone\fP to signatures from keys that are no longer
|
||||
\fBdnssec\-signzone\fP to remove signatures from keys that are no longer
|
||||
published. This enables ZSK rollover using the procedure described in
|
||||
\fI\%RFC 4641#4.2.1.2\fP ("Double Signature Zone Signing Key
|
||||
Rollover").
|
||||
.TP
|
||||
\fB\-S\fP
|
||||
Smart signing: Instructs \fBdnssec\-signzone\fP to search the key
|
||||
.B \fB\-S\fP
|
||||
This option enables smart signing, which instructs \fBdnssec\-signzone\fP to search the key
|
||||
repository for keys that match the zone being signed, and to include
|
||||
them in the zone if appropriate.
|
||||
.sp
|
||||
@@ -277,95 +276,95 @@ published in the zone and used to sign the zone.
|
||||
If the key\(aqs publication date is set and is in the past, the key
|
||||
is published in the zone.
|
||||
.sp
|
||||
If the key\(aqs activation date is set and in the past, the key is
|
||||
If the key\(aqs activation date is set and is in the past, the key is
|
||||
published (regardless of publication date) and used to sign the
|
||||
zone.
|
||||
.sp
|
||||
If the key\(aqs revocation date is set and in the past, and the key
|
||||
If the key\(aqs revocation date is set and is in the past, and the key
|
||||
is published, then the key is revoked, and the revoked key is used
|
||||
to sign the zone.
|
||||
.sp
|
||||
If either of the key\(aqs unpublication or deletion dates are set and
|
||||
If either the key\(aqs unpublication or deletion date is set and
|
||||
in the past, the key is NOT published or used to sign the zone,
|
||||
regardless of any other metadata.
|
||||
.sp
|
||||
If key\(aqs sync publication date is set and in the past,
|
||||
If the key\(aqs sync publication date is set and is in the past,
|
||||
synchronization records (type CDS and/or CDNSKEY) are created.
|
||||
.sp
|
||||
If key\(aqs sync deletion date is set and in the past,
|
||||
If the key\(aqs sync deletion date is set and is in the past,
|
||||
synchronization records (type CDS and/or CDNSKEY) are removed.
|
||||
.UNINDENT
|
||||
.UNINDENT
|
||||
.TP
|
||||
\fB\-T\fP ttl
|
||||
Specifies a TTL to be used for new DNSKEY records imported into the
|
||||
.B \fB\-T ttl\fP
|
||||
This option specifies a TTL to be used for new DNSKEY records imported into the
|
||||
zone from the key repository. If not specified, the default is the
|
||||
TTL value from the zone\(aqs SOA record. This option is ignored when
|
||||
signing without \fB\-S\fP, since DNSKEY records are not imported from
|
||||
the key repository in that case. It is also ignored if there are any
|
||||
pre\-existing DNSKEY records at the zone apex, in which case new
|
||||
records\(aq TTL values will be set to match them, or if any of the
|
||||
imported DNSKEY records had a default TTL value. In the event of a a
|
||||
records\(aq TTL values are set to match them, or if any of the
|
||||
imported DNSKEY records had a default TTL value. In the event of a
|
||||
conflict between TTL values in imported keys, the shortest one is
|
||||
used.
|
||||
.TP
|
||||
\fB\-t\fP
|
||||
Print statistics at completion.
|
||||
.B \fB\-t\fP
|
||||
This option prints statistics at completion.
|
||||
.TP
|
||||
\fB\-u\fP
|
||||
Update NSEC/NSEC3 chain when re\-signing a previously signed zone.
|
||||
.B \fB\-u\fP
|
||||
This option updates the NSEC/NSEC3 chain when re\-signing a previously signed zone.
|
||||
With this option, a zone signed with NSEC can be switched to NSEC3,
|
||||
or a zone signed with NSEC3 can be switch to NSEC or to NSEC3 with
|
||||
different parameters. Without this option, \fBdnssec\-signzone\fP will
|
||||
retain the existing chain when re\-signing.
|
||||
or a zone signed with NSEC3 can be switched to NSEC or to NSEC3 with
|
||||
different parameters. Without this option, \fBdnssec\-signzone\fP
|
||||
retains the existing chain when re\-signing.
|
||||
.TP
|
||||
\fB\-v\fP level
|
||||
Sets the debugging level.
|
||||
.B \fB\-v level\fP
|
||||
This option sets the debugging level.
|
||||
.TP
|
||||
\fB\-x\fP
|
||||
Only sign the DNSKEY, CDNSKEY, and CDS RRsets with key\-signing keys,
|
||||
and omit signatures from zone\-signing keys. (This is similar to the
|
||||
.B \fB\-x\fP
|
||||
This option indicates that BIND 9 should only sign the DNSKEY, CDNSKEY, and CDS RRsets with key\-signing keys,
|
||||
and should omit signatures from zone\-signing keys. (This is similar to the
|
||||
\fBdnssec\-dnskey\-kskonly yes;\fP zone option in \fBnamed\fP\&.)
|
||||
.TP
|
||||
\fB\-z\fP
|
||||
Ignore KSK flag on key when determining what to sign. This causes
|
||||
.B \fB\-z\fP
|
||||
This option indicates that BIND 9 should ignore the KSK flag on keys when determining what to sign. This causes
|
||||
KSK\-flagged keys to sign all records, not just the DNSKEY RRset.
|
||||
(This is similar to the \fBupdate\-check\-ksk no;\fP zone option in
|
||||
\fBnamed\fP\&.)
|
||||
.TP
|
||||
\fB\-3\fP salt
|
||||
Generate an NSEC3 chain with the given hex encoded salt. A dash
|
||||
(salt) can be used to indicate that no salt is to be used when
|
||||
.B \fB\-3 salt\fP
|
||||
This option generates an NSEC3 chain with the given hex\-encoded salt. A dash
|
||||
(\-) can be used to indicate that no salt is to be used when
|
||||
generating the NSEC3 chain.
|
||||
.TP
|
||||
\fB\-H\fP iterations
|
||||
When generating an NSEC3 chain, use this many iterations. The default
|
||||
.B \fB\-H iterations\fP
|
||||
This option indicates that, when generating an NSEC3 chain, BIND 9 should use this many iterations. The default
|
||||
is 10.
|
||||
.TP
|
||||
\fB\-A\fP
|
||||
When generating an NSEC3 chain set the OPTOUT flag on all NSEC3
|
||||
records and do not generate NSEC3 records for insecure delegations.
|
||||
.B \fB\-A\fP
|
||||
This option indicates that, when generating an NSEC3 chain, BIND 9 should set the OPTOUT flag on all NSEC3
|
||||
records and should not generate NSEC3 records for insecure delegations.
|
||||
.sp
|
||||
Using this option twice (i.e., \fB\-AA\fP) turns the OPTOUT flag off for
|
||||
all records. This is useful when using the \fB\-u\fP option to modify an
|
||||
NSEC3 chain which previously had OPTOUT set.
|
||||
.TP
|
||||
\fBzonefile\fP
|
||||
The file containing the zone to be signed.
|
||||
.B \fBzonefile\fP
|
||||
This option sets the file containing the zone to be signed.
|
||||
.TP
|
||||
\fBkey\fP
|
||||
Specify which keys should be used to sign the zone. If no keys are
|
||||
specified, then the zone will be examined for DNSKEY records at the
|
||||
zone apex. If these are found and there are matching private keys, in
|
||||
the current directory, then these will be used for signing.
|
||||
.B \fBkey\fP
|
||||
This option specifies which keys should be used to sign the zone. If no keys are
|
||||
specified, the zone is examined for DNSKEY records at the
|
||||
zone apex. If these records are found and there are matching private keys in
|
||||
the current directory, they are used for signing.
|
||||
.UNINDENT
|
||||
.SH EXAMPLE
|
||||
.sp
|
||||
The following command signs the \fBexample.com\fP zone with the
|
||||
ECDSAP256SHA256 key generated by key generated by \fBdnssec\-keygen\fP
|
||||
ECDSAP256SHA256 key generated by \fBdnssec\-keygen\fP
|
||||
(Kexample.com.+013+17247). Because the \fB\-S\fP option is not being used,
|
||||
the zone\(aqs keys must be in the master file (\fBdb.example.com\fP). This
|
||||
invocation looks for \fBdsset\fP files, in the current directory, so that
|
||||
invocation looks for \fBdsset\fP files in the current directory, so that
|
||||
DS records can be imported from them (\fB\-g\fP).
|
||||
.INDENT 0.0
|
||||
.INDENT 3.5
|
||||
@@ -383,7 +382,7 @@ db.example.com.signed
|
||||
.sp
|
||||
In the above example, \fBdnssec\-signzone\fP creates the file
|
||||
\fBdb.example.com.signed\fP\&. This file should be referenced in a zone
|
||||
statement in a \fBnamed.conf\fP file.
|
||||
statement in the \fBnamed.conf\fP file.
|
||||
.sp
|
||||
This example re\-signs a previously signed zone with default parameters.
|
||||
The private keys are assumed to be in the current directory.
|
||||
|
||||
@@ -36,71 +36,71 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
||||
.SH DESCRIPTION
|
||||
.sp
|
||||
\fBdnssec\-verify\fP verifies that a zone is fully signed for each
|
||||
algorithm found in the DNSKEY RRset for the zone, and that the NSEC /
|
||||
NSEC3 chains are complete.
|
||||
algorithm found in the DNSKEY RRset for the zone, and that the
|
||||
NSEC/NSEC3 chains are complete.
|
||||
.SH OPTIONS
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-c\fP class
|
||||
Specifies the DNS class of the zone.
|
||||
.B \fB\-c class\fP
|
||||
This option specifies the DNS class of the zone.
|
||||
.TP
|
||||
\fB\-E\fP engine
|
||||
Specifies the cryptographic hardware to use, when applicable.
|
||||
.B \fB\-E engine\fP
|
||||
This option specifies the cryptographic hardware to use, when applicable.
|
||||
.sp
|
||||
When BIND is built with OpenSSL PKCS#11 support, this defaults to the
|
||||
string "pkcs11", which identifies an OpenSSL engine that can drive a
|
||||
string \fBpkcs11\fP, which identifies an OpenSSL engine that can drive a
|
||||
cryptographic accelerator or hardware service module. When BIND is
|
||||
built with native PKCS#11 cryptography (\-\-enable\-native\-pkcs11), it
|
||||
built with native PKCS#11 cryptography (\fB\-\-enable\-native\-pkcs11\fP), it
|
||||
defaults to the path of the PKCS#11 provider library specified via
|
||||
"\-\-with\-pkcs11".
|
||||
\fB\-\-with\-pkcs11\fP\&.
|
||||
.TP
|
||||
\fB\-I\fP input\-format
|
||||
The format of the input zone file. Possible formats are \fB"text"\fP
|
||||
(default) and \fB"raw"\fP\&. This option is primarily intended to be used
|
||||
for dynamic signed zones so that the dumped zone file in a non\-text
|
||||
format containing updates can be verified independently. The use of
|
||||
this option does not make much sense for non\-dynamic zones.
|
||||
.B \fB\-I input\-format\fP
|
||||
This option sets the format of the input zone file. Possible formats are \fBtext\fP
|
||||
(the default) and \fBraw\fP\&. This option is primarily intended to be used
|
||||
for dynamic signed zones, so that the dumped zone file in a non\-text
|
||||
format containing updates can be verified independently.
|
||||
This option is not useful for non\-dynamic zones.
|
||||
.TP
|
||||
\fB\-o\fP origin
|
||||
The zone origin. If not specified, the name of the zone file is
|
||||
.B \fB\-o origin\fP
|
||||
This option indicates the zone origin. If not specified, the name of the zone file is
|
||||
assumed to be the origin.
|
||||
.TP
|
||||
\fB\-v\fP level
|
||||
Sets the debugging level.
|
||||
.B \fB\-v level\fP
|
||||
This option sets the debugging level.
|
||||
.TP
|
||||
\fB\-V\fP
|
||||
Prints version information.
|
||||
.B \fB\-V\fP
|
||||
This option prints version information.
|
||||
.TP
|
||||
.B \fB\-q\fP
|
||||
Quiet mode: Suppresses output. Without this option, when \fBdnssec\-verify\fP
|
||||
is run it will print to standard output the number of keys in use, the
|
||||
algorithms used to verify the zone was signed correctly and other status
|
||||
information. With it, all non\-error output is suppressed, and only the exit
|
||||
code will indicate success.
|
||||
This option sets quiet mode, which suppresses output. Without this option, when \fBdnssec\-verify\fP
|
||||
is run it prints to standard output the number of keys in use, the
|
||||
algorithms used to verify the zone was signed correctly, and other status
|
||||
information. With this option, all non\-error output is suppressed, and only the exit
|
||||
code indicates success.
|
||||
.TP
|
||||
\fB\-x\fP
|
||||
Only verify that the DNSKEY RRset is signed with key\-signing keys.
|
||||
Without this flag, it is assumed that the DNSKEY RRset will be signed
|
||||
by all active keys. When this flag is set, it will not be an error if
|
||||
.B \fB\-x\fP
|
||||
This option verifies only that the DNSKEY RRset is signed with key\-signing keys.
|
||||
Without this flag, it is assumed that the DNSKEY RRset is signed
|
||||
by all active keys. When this flag is set, it is not an error if
|
||||
the DNSKEY RRset is not signed by zone\-signing keys. This corresponds
|
||||
to the \fB\-x\fP option in \fBdnssec\-signzone\fP\&.
|
||||
.TP
|
||||
\fB\-z\fP
|
||||
Ignore the KSK flag on the keys when determining whether the zone if
|
||||
correctly signed. Without this flag it is assumed that there will be
|
||||
.B \fB\-z\fP
|
||||
This option indicates that the KSK flag on the keys should be ignored when determining whether the zone is
|
||||
correctly signed. Without this flag, it is assumed that there is
|
||||
a non\-revoked, self\-signed DNSKEY with the KSK flag set for each
|
||||
algorithm and that RRsets other than DNSKEY RRset will be signed with
|
||||
algorithm, and that RRsets other than DNSKEY RRset are signed with
|
||||
a different DNSKEY without the KSK flag set.
|
||||
.sp
|
||||
With this flag set, we only require that for each algorithm, there
|
||||
will be at least one non\-revoked, self\-signed DNSKEY, regardless of
|
||||
the KSK flag state, and that other RRsets will be signed by a
|
||||
With this flag set, BIND 9 only requires that for each algorithm, there
|
||||
be at least one non\-revoked, self\-signed DNSKEY, regardless of
|
||||
the KSK flag state, and that other RRsets be signed by a
|
||||
non\-revoked key for the same algorithm that includes the self\-signed
|
||||
key; the same key may be used for both purposes. This corresponds to
|
||||
the \fB\-z\fP option in \fBdnssec\-signzone\fP\&.
|
||||
.TP
|
||||
\fBzonefile\fP
|
||||
The file containing the zone to be signed.
|
||||
.B \fBzonefile\fP
|
||||
This option indicates the file containing the zone to be signed.
|
||||
.UNINDENT
|
||||
.SH SEE ALSO
|
||||
.sp
|
||||
|
||||
@@ -37,24 +37,24 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
||||
.sp
|
||||
\fBdnstap\-read\fP reads \fBdnstap\fP data from a specified file and prints
|
||||
it in a human\-readable format. By default, \fBdnstap\fP data is printed in
|
||||
a short summary format, but if the \fB\-y\fP option is specified, then a
|
||||
longer and more detailed YAML format is used instead.
|
||||
a short summary format, but if the \fB\-y\fP option is specified, a
|
||||
longer and more detailed YAML format is used.
|
||||
.SH OPTIONS
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-m\fP
|
||||
Trace memory allocations; used for debugging memory leaks.
|
||||
.B \fB\-m\fP
|
||||
This option indicates trace memory allocations, and is used for debugging memory leaks.
|
||||
.TP
|
||||
\fB\-p\fP
|
||||
After printing the \fBdnstap\fP data, print the text form of the DNS
|
||||
message that was encapsulated in the \fBdnstap\fP frame.
|
||||
.B \fB\-p\fP
|
||||
This option prints the text form of the DNS
|
||||
message that was encapsulated in the \fBdnstap\fP frame, after printing the \fBdnstap\fP data.
|
||||
.TP
|
||||
\fB\-x\fP
|
||||
After printing the \fBdnstap\fP data, print a hex dump of the wire form
|
||||
of the DNS message that was encapsulated in the \fBdnstap\fP frame.
|
||||
.B \fB\-x\fP
|
||||
This option prints a hex dump of the wire form
|
||||
of the DNS message that was encapsulated in the \fBdnstap\fP frame, after printing the \fBdnstap\fP data.
|
||||
.TP
|
||||
\fB\-y\fP
|
||||
Print \fBdnstap\fP data in a detailed YAML format.
|
||||
.B \fB\-y\fP
|
||||
This option prints \fBdnstap\fP data in a detailed YAML format.
|
||||
.UNINDENT
|
||||
.SH SEE ALSO
|
||||
.sp
|
||||
|
||||
@@ -41,7 +41,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
||||
Until BIND 9.12, this feature was implemented natively in \fBnamed\fP and
|
||||
enabled with the \fBfilter\-aaaa\fP ACL and the \fBfilter\-aaaa\-on\-v4\fP and
|
||||
\fBfilter\-aaaa\-on\-v6\fP options. These options are now deprecated in
|
||||
\fBnamed.conf\fP, but can be passed as parameters to the
|
||||
\fBnamed.conf\fP but can be passed as parameters to the
|
||||
\fBfilter\-aaaa.so\fP plugin, for example:
|
||||
.INDENT 0.0
|
||||
.INDENT 3.5
|
||||
@@ -67,21 +67,21 @@ necessary.
|
||||
Note: This mechanism can erroneously cause other servers not to give
|
||||
AAAA records to their clients. If a recursing server with both IPv6 and
|
||||
IPv4 network connections queries an authoritative server using this
|
||||
mechanism via IPv4, it will be denied AAAA records even if its client is
|
||||
mechanism via IPv4, it is denied AAAA records even if its client is
|
||||
using IPv6.
|
||||
.SH OPTIONS
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
.B \fBfilter\-aaaa\fP
|
||||
Specifies a list of client addresses for which AAAA filtering is to
|
||||
This option specifies a list of client addresses for which AAAA filtering is to
|
||||
be applied. The default is \fBany\fP\&.
|
||||
.TP
|
||||
.B \fBfilter\-aaaa\-on\-v4\fP
|
||||
If set to \fByes\fP, the DNS client is at an IPv4 address, in
|
||||
\fBfilter\-aaaa\fP, and if the response does not include DNSSEC
|
||||
If set to \fByes\fP, this option indicates that the DNS client is at an IPv4 address, in
|
||||
\fBfilter\-aaaa\fP\&. If the response does not include DNSSEC
|
||||
signatures, then all AAAA records are deleted from the response. This
|
||||
filtering applies to all responses and not only authoritative
|
||||
responses.
|
||||
filtering applies to all responses, not only authoritative
|
||||
ones.
|
||||
.sp
|
||||
If set to \fBbreak\-dnssec\fP, then AAAA records are deleted even when
|
||||
DNSSEC is enabled. As suggested by the name, this causes the response
|
||||
@@ -89,13 +89,13 @@ to fail to verify, because the DNSSEC protocol is designed to detect
|
||||
deletions.
|
||||
.sp
|
||||
This mechanism can erroneously cause other servers not to give AAAA
|
||||
records to their clients. A recursing server with both IPv6 and IPv4
|
||||
network connections that queries an authoritative server using this
|
||||
mechanism via IPv4 will be denied AAAA records even if its client is
|
||||
records to their clients. If a recursing server with both IPv6 and IPv4
|
||||
network connections queries an authoritative server using this
|
||||
mechanism via IPv4, it is denied AAAA records even if its client is
|
||||
using IPv6.
|
||||
.TP
|
||||
.B \fBfilter\-aaaa\-on\-v6\fP
|
||||
Identical to \fBfilter\-aaaa\-on\-v4\fP, except it filters AAAA responses
|
||||
This option is identical to \fBfilter\-aaaa\-on\-v4\fP, except that it filters AAAA responses
|
||||
to queries from IPv6 clients instead of IPv4 clients. To filter all
|
||||
responses, set both options to \fByes\fP\&.
|
||||
.UNINDENT
|
||||
|
||||
134
doc/man/host.1in
134
doc/man/host.1in
@@ -37,123 +37,123 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
||||
.sp
|
||||
\fBhost\fP is a simple utility for performing DNS lookups. It is normally
|
||||
used to convert names to IP addresses and vice versa. When no arguments
|
||||
or options are given, \fBhost\fP prints a short summary of its command
|
||||
line arguments and options.
|
||||
or options are given, \fBhost\fP prints a short summary of its
|
||||
command\-line arguments and options.
|
||||
.sp
|
||||
\fBname\fP is the domain name that is to be looked up. It can also be a
|
||||
dotted\-decimal IPv4 address or a colon\-delimited IPv6 address, in which
|
||||
case \fBhost\fP will by default perform a reverse lookup for that address.
|
||||
case \fBhost\fP by default performs a reverse lookup for that address.
|
||||
\fBserver\fP is an optional argument which is either the name or IP
|
||||
address of the name server that \fBhost\fP should query instead of the
|
||||
server or servers listed in \fB/etc/resolv.conf\fP\&.
|
||||
.SH OPTIONS
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-4\fP
|
||||
Use IPv4 only for query transport. See also the \fB\-6\fP option.
|
||||
.B \fB\-4\fP
|
||||
This option specifies that only IPv4 should be used for query transport. See also the \fB\-6\fP option.
|
||||
.TP
|
||||
\fB\-6\fP
|
||||
Use IPv6 only for query transport. See also the \fB\-4\fP option.
|
||||
.B \fB\-6\fP
|
||||
This option specifies that only IPv6 should be used for query transport. See also the \fB\-4\fP option.
|
||||
.TP
|
||||
\fB\-a\fP
|
||||
"All". The \fB\-a\fP option is normally equivalent to \fB\-v \-t ANY\fP\&. It
|
||||
also affects the behaviour of the \fB\-l\fP list zone option.
|
||||
.B \fB\-a\fP
|
||||
The \fB\-a\fP ("all") option is normally equivalent to \fB\-v \-t ANY\fP\&. It
|
||||
also affects the behavior of the \fB\-l\fP list zone option.
|
||||
.TP
|
||||
\fB\-A\fP
|
||||
"Almost all". The \fB\-A\fP option is equivalent to \fB\-a\fP except RRSIG,
|
||||
.B \fB\-A\fP
|
||||
The \fB\-A\fP ("almost all") option is equivalent to \fB\-a\fP, except that RRSIG,
|
||||
NSEC, and NSEC3 records are omitted from the output.
|
||||
.TP
|
||||
\fB\-c\fP class
|
||||
Query class: This can be used to lookup HS (Hesiod) or CH (Chaosnet)
|
||||
.B \fB\-c class\fP
|
||||
This option specifies the query class, which can be used to lookup HS (Hesiod) or CH (Chaosnet)
|
||||
class resource records. The default class is IN (Internet).
|
||||
.TP
|
||||
\fB\-C\fP
|
||||
Check consistency: \fBhost\fP will query the SOA records for zone
|
||||
.B \fB\-C\fP
|
||||
This option indicates that \fBnamed\fP should check consistency, meaning that \fBhost\fP queries the SOA records for zone
|
||||
\fBname\fP from all the listed authoritative name servers for that
|
||||
zone. The list of name servers is defined by the NS records that are
|
||||
found for the zone.
|
||||
.TP
|
||||
\fB\-d\fP
|
||||
Print debugging traces. Equivalent to the \fB\-v\fP verbose option.
|
||||
.B \fB\-d\fP
|
||||
This option prints debugging traces, and is equivalent to the \fB\-v\fP verbose option.
|
||||
.TP
|
||||
\fB\-l\fP
|
||||
List zone: The \fBhost\fP command performs a zone transfer of zone
|
||||
\fBname\fP and prints out the NS, PTR and address records (A/AAAA).
|
||||
.B \fB\-l\fP
|
||||
This option tells \fBnamed\(ga to list the zone, meaning the \(ga\(gahost\fP command performs a zone transfer of zone
|
||||
\fBname\fP and prints out the NS, PTR, and address records (A/AAAA).
|
||||
.sp
|
||||
Together, the \fB\-l \-a\fP options print all records in the zone.
|
||||
.TP
|
||||
\fB\-N\fP ndots
|
||||
The number of dots that have to be in \fBname\fP for it to be
|
||||
.B \fB\-N ndots\fP
|
||||
This option specifies the number of dots (\fBndots\fP) that have to be in \fBname\fP for it to be
|
||||
considered absolute. The default value is that defined using the
|
||||
ndots statement in \fB/etc/resolv.conf\fP, or 1 if no ndots statement
|
||||
is present. Names with fewer dots are interpreted as relative names
|
||||
and will be searched for in the domains listed in the \fBsearch\fP or
|
||||
\fBndots\fP statement in \fB/etc/resolv.conf\fP, or 1 if no \fBndots\fP statement
|
||||
is present. Names with fewer dots are interpreted as relative names,
|
||||
and are searched for in the domains listed in the \fBsearch\fP or
|
||||
\fBdomain\fP directive in \fB/etc/resolv.conf\fP\&.
|
||||
.TP
|
||||
\fB\-p\fP port
|
||||
Specify the port on the server to query. The default is 53.
|
||||
.B \fB\-p port\fP
|
||||
This option specifies the port to query on the server. The default is 53.
|
||||
.TP
|
||||
\fB\-r\fP
|
||||
Non\-recursive query: Setting this option clears the RD (recursion
|
||||
desired) bit in the query. This should mean that the name server
|
||||
receiving the query will not attempt to resolve \fBname\fP\&. The \fB\-r\fP
|
||||
.B \fB\-r\fP
|
||||
This option specifies a non\-recursive query; setting this option clears the RD (recursion
|
||||
desired) bit in the query. This means that the name server
|
||||
receiving the query does not attempt to resolve \fBname\fP\&. The \fB\-r\fP
|
||||
option enables \fBhost\fP to mimic the behavior of a name server by
|
||||
making non\-recursive queries and expecting to receive answers to
|
||||
making non\-recursive queries, and expecting to receive answers to
|
||||
those queries that can be referrals to other name servers.
|
||||
.TP
|
||||
\fB\-R\fP number
|
||||
Number of retries for UDP queries: If \fBnumber\fP is negative or zero,
|
||||
the number of retries will default to 1. The default value is 1, or
|
||||
.B \fB\-R number\fP
|
||||
This option specifies the number of retries for UDP queries. If \fBnumber\fP is negative or zero,
|
||||
the number of retries is silently set to 1. The default value is 1, or
|
||||
the value of the \fBattempts\fP option in \fB/etc/resolv.conf\fP, if set.
|
||||
.TP
|
||||
\fB\-s\fP
|
||||
Do \fInot\fP send the query to the next nameserver if any server responds
|
||||
.B \fB\-s\fP
|
||||
This option tells \fBnamed\fP \fInot\fP to send the query to the next nameserver if any server responds
|
||||
with a SERVFAIL response, which is the reverse of normal stub
|
||||
resolver behavior.
|
||||
.TP
|
||||
\fB\-t\fP type
|
||||
Query type: The \fBtype\fP argument can be any recognized query type:
|
||||
.B \fB\-t type\fP
|
||||
This option specifies the query type. The \fBtype\fP argument can be any recognized query type:
|
||||
CNAME, NS, SOA, TXT, DNSKEY, AXFR, etc.
|
||||
.sp
|
||||
When no query type is specified, \fBhost\fP automatically selects an
|
||||
appropriate query type. By default, it looks for A, AAAA, and MX
|
||||
records. If the \fB\-C\fP option is given, queries will be made for SOA
|
||||
records. If the \fB\-C\fP option is given, queries are made for SOA
|
||||
records. If \fBname\fP is a dotted\-decimal IPv4 address or
|
||||
colon\-delimited IPv6 address, \fBhost\fP will query for PTR records.
|
||||
colon\-delimited IPv6 address, \fBhost\fP queries for PTR records.
|
||||
.sp
|
||||
If a query type of IXFR is chosen the starting serial number can be
|
||||
specified by appending an equal followed by the starting serial
|
||||
number (like \fB\-t IXFR=12345678\fP).
|
||||
If a query type of IXFR is chosen, the starting serial number can be
|
||||
specified by appending an equals sign (=), followed by the starting serial
|
||||
number, e.g., \fB\-t IXFR=12345678\fP\&.
|
||||
.TP
|
||||
\fB\-T\fP; \fB\-U\fP
|
||||
TCP/UDP: By default, \fBhost\fP uses UDP when making queries. The
|
||||
.B \fB\-T\fP; \fB\-U\fP
|
||||
This option specifies TCP or UDP. By default, \fBhost\fP uses UDP when making queries; the
|
||||
\fB\-T\fP option makes it use a TCP connection when querying the name
|
||||
server. TCP will be automatically selected for queries that require
|
||||
it, such as zone transfer (AXFR) requests. Type ANY queries default
|
||||
to TCP but can be forced to UDP initially using \fB\-U\fP\&.
|
||||
server. TCP is automatically selected for queries that require
|
||||
it, such as zone transfer (AXFR) requests. Type \fBANY\fP queries default
|
||||
to TCP, but can be forced to use UDP initially via \fB\-U\fP\&.
|
||||
.TP
|
||||
\fB\-m\fP flag
|
||||
Memory usage debugging: the flag can be \fBrecord\fP, \fBusage\fP, or
|
||||
\fBtrace\fP\&. You can specify the \fB\-m\fP option more than once to set
|
||||
.B \fB\-m flag\fP
|
||||
This option sets memory usage debugging: the flag can be \fBrecord\fP, \fBusage\fP, or
|
||||
\fBtrace\fP\&. The \fB\-m\fP option can be specified more than once to set
|
||||
multiple flags.
|
||||
.TP
|
||||
\fB\-v\fP
|
||||
Verbose output. Equivalent to the \fB\-d\fP debug option. Verbose output
|
||||
.B \fB\-v\fP
|
||||
This option sets verbose output, and is equivalent to the \fB\-d\fP debug option. Verbose output
|
||||
can also be enabled by setting the \fBdebug\fP option in
|
||||
\fB/etc/resolv.conf\fP\&.
|
||||
.TP
|
||||
\fB\-V\fP
|
||||
Print the version number and exit.
|
||||
.B \fB\-V\fP
|
||||
This option prints the version number and exits.
|
||||
.TP
|
||||
\fB\-w\fP
|
||||
Wait forever: The query timeout is set to the maximum possible. See
|
||||
.B \fB\-w\fP
|
||||
This option sets "wait forever": the query timeout is set to the maximum possible. See
|
||||
also the \fB\-W\fP option.
|
||||
.TP
|
||||
\fB\-W\fP wait
|
||||
Timeout: Wait for up to \fBwait\fP seconds for a reply. If \fBwait\fP is
|
||||
less than one, the wait interval is set to one second.
|
||||
.B \fB\-W wait\fP
|
||||
This options sets the length of the wait timeout, indicating that \fBnamed\fP should wait for up to \fBwait\fP seconds for a reply. If \fBwait\fP is
|
||||
less than 1, the wait interval is set to 1 second.
|
||||
.sp
|
||||
By default, \fBhost\fP will wait for 5 seconds for UDP responses and 10
|
||||
By default, \fBhost\fP waits for 5 seconds for UDP responses and 10
|
||||
seconds for TCP connections. These defaults can be overridden by the
|
||||
\fBtimeout\fP option in \fB/etc/resolv.conf\fP\&.
|
||||
.sp
|
||||
@@ -163,10 +163,10 @@ See also the \fB\-w\fP option.
|
||||
.sp
|
||||
If \fBhost\fP has been built with IDN (internationalized domain name)
|
||||
support, it can accept and display non\-ASCII domain names. \fBhost\fP
|
||||
appropriately converts character encoding of domain name before sending
|
||||
a request to DNS server or displaying a reply from the server. If you\(aqd
|
||||
like to turn off the IDN support for some reason, define the IDN_DISABLE
|
||||
environment variable. The IDN support is disabled if the variable is set
|
||||
appropriately converts character encoding of a domain name before sending
|
||||
a request to a DNS server or displaying a reply from the server.
|
||||
To turn off IDN support, define the \fBIDN_DISABLE\fP
|
||||
environment variable. IDN support is disabled if the variable is set
|
||||
when \fBhost\fP runs.
|
||||
.SH FILES
|
||||
.sp
|
||||
|
||||
193
doc/man/mdig.1in
193
doc/man/mdig.1in
@@ -45,11 +45,11 @@ all queries. Responses are displayed in the order in which they are
|
||||
received, not in the order the corresponding queries were sent.
|
||||
.sp
|
||||
\fBmdig\fP options are a subset of the \fBdig\fP options, and are divided
|
||||
into "anywhere options" which can occur anywhere, "global options" which
|
||||
into "anywhere options," which can occur anywhere, "global options," which
|
||||
must occur before the query name (or they are ignored with a warning),
|
||||
and "local options" which apply to the next query on the command line.
|
||||
and "local options," which apply to the next query on the command line.
|
||||
.sp
|
||||
The @server option is a mandatory global option. It is the name or IP
|
||||
The \fB@server\fP option is a mandatory global option. It is the name or IP
|
||||
address of the name server to query. (Unlike \fBdig\fP, this value is not
|
||||
retrieved from \fB/etc/resolv.conf\fP\&.) It can be an IPv4 address in
|
||||
dotted\-decimal notation, an IPv6 address in colon\-delimited notation, or
|
||||
@@ -68,246 +68,263 @@ the string \fBno\fP to negate the meaning of that keyword. Other keywords
|
||||
assign values to options like the timeout interval. They have the form
|
||||
\fB+keyword=value\fP\&.
|
||||
.SH ANYWHERE OPTIONS
|
||||
.sp
|
||||
The \fB\-f\fP option makes \fBmdig\fP operate in batch mode by reading a list
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
.B \fB\-f\fP
|
||||
This option makes \fBmdig\fP operate in batch mode by reading a list
|
||||
of lookup requests to process from the file \fBfilename\fP\&. The file
|
||||
contains a number of queries, one per line. Each entry in the file
|
||||
should be organized in the same way they would be presented as queries
|
||||
to \fBmdig\fP using the command\-line interface.
|
||||
.sp
|
||||
The \fB\-h\fP causes \fBmdig\fP to print the detailed help with the full list
|
||||
of options and exit.
|
||||
.sp
|
||||
The \fB\-v\fP causes \fBmdig\fP to print the version number and exit.
|
||||
.TP
|
||||
.B \fB\-h\fP
|
||||
This option causes \fBmdig\fP to print detailed help information, with the full list
|
||||
of options, and exit.
|
||||
.TP
|
||||
.B \fB\-v\fP
|
||||
This option causes \fBmdig\fP to print the version number and exit.
|
||||
.UNINDENT
|
||||
.SH GLOBAL OPTIONS
|
||||
.sp
|
||||
The \fB\-4\fP option forces \fBmdig\fP to only use IPv4 query transport.
|
||||
.sp
|
||||
The \fB\-6\fP option forces \fBmdig\fP to only use IPv6 query transport.
|
||||
.sp
|
||||
The \fB\-b\fP option sets the source IP address of the query to
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
.B \fB\-4\fP
|
||||
This option forces \fBmdig\fP to only use IPv4 query transport.
|
||||
.TP
|
||||
.B \fB\-6\fP
|
||||
This option forces \fBmdig\fP to only use IPv6 query transport.
|
||||
.TP
|
||||
.B \fB\-b address\fP
|
||||
This option sets the source IP address of the query to
|
||||
\fBaddress\fP\&. This must be a valid address on one of the host\(aqs network
|
||||
interfaces or "0.0.0.0" or "::". An optional port may be specified by
|
||||
appending "#<port>"
|
||||
.sp
|
||||
The \fB\-m\fP option enables memory usage debugging.
|
||||
.sp
|
||||
The \fB\-p\fP option is used when a non\-standard port number is to be
|
||||
queried. \fBport#\fP is the port number that \fBmdig\fP will send its
|
||||
queries instead of the standard DNS port number 53. This option would be
|
||||
.TP
|
||||
.B \fB\-m\fP
|
||||
This option enables memory usage debugging.
|
||||
.TP
|
||||
.B \fB\-p port#\fP
|
||||
This option is used when a non\-standard port number is to be
|
||||
queried. \fBport#\fP is the port number that \fBmdig\fP sends its
|
||||
queries to, instead of the standard DNS port number 53. This option is
|
||||
used to test a name server that has been configured to listen for
|
||||
queries on a non\-standard port number.
|
||||
.UNINDENT
|
||||
.sp
|
||||
The global query options are:
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
.B \fB+[no]additional\fP
|
||||
Display [do not display] the additional section of a reply. The
|
||||
This option displays [or does not display] the additional section of a reply. The
|
||||
default is to display it.
|
||||
.TP
|
||||
.B \fB+[no]all\fP
|
||||
Set or clear all display flags.
|
||||
This option sets or clears all display flags.
|
||||
.TP
|
||||
.B \fB+[no]answer\fP
|
||||
Display [do not display] the answer section of a reply. The default
|
||||
This option displays [or does not display] the answer section of a reply. The default
|
||||
is to display it.
|
||||
.TP
|
||||
.B \fB+[no]authority\fP
|
||||
Display [do not display] the authority section of a reply. The
|
||||
This option displays [or does not display] the authority section of a reply. The
|
||||
default is to display it.
|
||||
.TP
|
||||
.B \fB+[no]besteffort\fP
|
||||
Attempt to display the contents of messages which are malformed. The
|
||||
This option attempts to display [or does not display] the contents of messages which are malformed. The
|
||||
default is to not display malformed answers.
|
||||
.TP
|
||||
.B \fB+[no]cl\fP
|
||||
Display [do not display] the CLASS when printing the record.
|
||||
This option displays [or does not display] the CLASS when printing the record.
|
||||
.TP
|
||||
.B \fB+[no]comments\fP
|
||||
Toggle the display of comment lines in the output. The default is to
|
||||
This option toggles the display of comment lines in the output. The default is to
|
||||
print comments.
|
||||
.TP
|
||||
.B \fB+[no]continue\fP
|
||||
Continue on errors (e.g. timeouts).
|
||||
This option toggles continuation on errors (e.g. timeouts).
|
||||
.TP
|
||||
.B \fB+[no]crypto\fP
|
||||
Toggle the display of cryptographic fields in DNSSEC records. The
|
||||
contents of these field are unnecessary to debug most DNSSEC
|
||||
This option toggles the display of cryptographic fields in DNSSEC records. The
|
||||
contents of these fields are unnecessary to debug most DNSSEC
|
||||
validation failures and removing them makes it easier to see the
|
||||
common failures. The default is to display the fields. When omitted
|
||||
they are replaced by the string "[omitted]" or in the DNSKEY case the
|
||||
key id is displayed as the replacement, e.g. "[ key id = value ]".
|
||||
common failures. The default is to display the fields. When omitted,
|
||||
they are replaced by the string "[omitted]"; in the DNSKEY case, the
|
||||
key ID is displayed as the replacement, e.g., \fB[ key id = value ]\fP\&.
|
||||
.TP
|
||||
.B \fB+dscp[=value]\fP
|
||||
Set the DSCP code point to be used when sending the query. Valid DSCP
|
||||
code points are in the range [0..63]. By default no code point is
|
||||
This option sets the DSCP code point to be used when sending the query. Valid DSCP
|
||||
code points are in the range [0...63]. By default no code point is
|
||||
explicitly set.
|
||||
.TP
|
||||
.B \fB+[no]multiline\fP
|
||||
Print records like the SOA records in a verbose multi\-line format
|
||||
This option toggles printing of records, like the SOA records, in a verbose multi\-line format
|
||||
with human\-readable comments. The default is to print each record on
|
||||
a single line, to facilitate machine parsing of the \fBmdig\fP output.
|
||||
.TP
|
||||
.B \fB+[no]question\fP
|
||||
Print [do not print] the question section of a query when an answer
|
||||
This option prints [or does not print] the question section of a query when an answer
|
||||
is returned. The default is to print the question section as a
|
||||
comment.
|
||||
.TP
|
||||
.B \fB+[no]rrcomments\fP
|
||||
Toggle the display of per\-record comments in the output (for example,
|
||||
This option toggles the display of per\-record comments in the output (for example,
|
||||
human\-readable key information about DNSKEY records). The default is
|
||||
not to print record comments unless multiline mode is active.
|
||||
.TP
|
||||
.B \fB+[no]short\fP
|
||||
Provide a terse answer. The default is to print the answer in a
|
||||
This option provides [or does not provide] a terse answer. The default is to print the answer in a
|
||||
verbose form.
|
||||
.TP
|
||||
.B \fB+split=W\fP
|
||||
Split long hex\- or base64\-formatted fields in resource records into
|
||||
This option splits long hex\- or base64\-formatted fields in resource records into
|
||||
chunks of \fBW\fP characters (where \fBW\fP is rounded up to the nearest
|
||||
multiple of 4). \fB+nosplit\fP or \fB+split=0\fP causes fields not to be
|
||||
split at all. The default is 56 characters, or 44 characters when
|
||||
split. The default is 56 characters, or 44 characters when
|
||||
multiline mode is active.
|
||||
.TP
|
||||
.B \fB+[no]tcp\fP
|
||||
Use [do not use] TCP when querying name servers. The default behavior
|
||||
This option uses [or does not use] TCP when querying name servers. The default behavior
|
||||
is to use UDP.
|
||||
.TP
|
||||
.B \fB+[no]ttlid\fP
|
||||
Display [do not display] the TTL when printing the record.
|
||||
This option displays [or does not display] the TTL when printing the record.
|
||||
.TP
|
||||
.B \fB+[no]ttlunits\fP
|
||||
Display [do not display] the TTL in friendly human\-readable time
|
||||
This option displays [or does not display] the TTL in friendly human\-readable time
|
||||
units of "s", "m", "h", "d", and "w", representing seconds, minutes,
|
||||
hours, days and weeks. Implies +ttlid.
|
||||
hours, days, and weeks. This implies +ttlid.
|
||||
.TP
|
||||
.B \fB+[no]vc\fP
|
||||
Use [do not use] TCP when querying name servers. This alternate
|
||||
This option uses [or does not use] TCP when querying name servers. This alternate
|
||||
syntax to \fB+[no]tcp\fP is provided for backwards compatibility. The
|
||||
"vc" stands for "virtual circuit".
|
||||
\fBvc\fP stands for "virtual circuit".
|
||||
.UNINDENT
|
||||
.SH LOCAL OPTIONS
|
||||
.sp
|
||||
The \fB\-c\fP option sets the query class to \fBclass\fP\&. It can be any valid
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
.B \fB\-c class\fP
|
||||
This option sets the query class to \fBclass\fP\&. It can be any valid
|
||||
query class which is supported in BIND 9. The default query class is
|
||||
"IN".
|
||||
.sp
|
||||
The \fB\-t\fP option sets the query type to \fBtype\fP\&. It can be any valid
|
||||
.TP
|
||||
.B \fB\-t type\fP
|
||||
This option sets the query type to \fBtype\fP\&. It can be any valid
|
||||
query type which is supported in BIND 9. The default query type is "A",
|
||||
unless the \fB\-x\fP option is supplied to indicate a reverse lookup with
|
||||
the "PTR" query type.
|
||||
.sp
|
||||
Reverse lookups MDASH mapping addresses to names MDASH are simplified by
|
||||
the \fB\-x\fP option. \fBaddr\fP is an IPv4 address in dotted\-decimal
|
||||
.TP
|
||||
.B \fB\-x addr\fP
|
||||
Reverse lookups \- mapping addresses to names \- are simplified by
|
||||
this option. \fBaddr\fP is an IPv4 address in dotted\-decimal
|
||||
notation, or a colon\-delimited IPv6 address. \fBmdig\fP automatically
|
||||
performs a lookup for a query name like \fB11.12.13.10.in\-addr.arpa\fP and
|
||||
sets the query type and class to PTR and IN respectively. By default,
|
||||
IPv6 addresses are looked up using nibble format under the IP6.ARPA
|
||||
domain.
|
||||
.UNINDENT
|
||||
.sp
|
||||
The local query options are:
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
.B \fB+[no]aaflag\fP
|
||||
A synonym for \fB+[no]aaonly\fP\&.
|
||||
This is a synonym for \fB+[no]aaonly\fP\&.
|
||||
.TP
|
||||
.B \fB+[no]aaonly\fP
|
||||
Sets the "aa" flag in the query.
|
||||
This sets the \fBaa\fP flag in the query.
|
||||
.TP
|
||||
.B \fB+[no]adflag\fP
|
||||
Set [do not set] the AD (authentic data) bit in the query. This
|
||||
This sets [or does not set] the AD (authentic data) bit in the query. This
|
||||
requests the server to return whether all of the answer and authority
|
||||
sections have all been validated as secure according to the security
|
||||
sections have all been validated as secure, according to the security
|
||||
policy of the server. AD=1 indicates that all records have been
|
||||
validated as secure and the answer is not from a OPT\-OUT range. AD=0
|
||||
indicate that some part of the answer was insecure or not validated.
|
||||
indicates that some part of the answer was insecure or not validated.
|
||||
This bit is set by default.
|
||||
.TP
|
||||
.B \fB+bufsize=B\fP
|
||||
Set the UDP message buffer size advertised using EDNS0 to \fBB\fP
|
||||
This sets the UDP message buffer size advertised using EDNS0 to \fBB\fP
|
||||
bytes. The maximum and minimum sizes of this buffer are 65535 and 0
|
||||
respectively. Values outside this range are rounded up or down
|
||||
appropriately. Values other than zero will cause a EDNS query to be
|
||||
appropriately. Values other than zero cause a EDNS query to be
|
||||
sent.
|
||||
.TP
|
||||
.B \fB+[no]cdflag\fP
|
||||
Set [do not set] the CD (checking disabled) bit in the query. This
|
||||
This sets [or does not set] the CD (checking disabled) bit in the query. This
|
||||
requests the server to not perform DNSSEC validation of responses.
|
||||
.TP
|
||||
.B \fB+[no]cookie=####\fP
|
||||
Send a COOKIE EDNS option, with optional value. Replaying a COOKIE
|
||||
from a previous response will allow the server to identify a previous
|
||||
This sends [or does not send] a COOKIE EDNS option, with an optional value. Replaying a COOKIE
|
||||
from a previous response allows the server to identify a previous
|
||||
client. The default is \fB+nocookie\fP\&.
|
||||
.TP
|
||||
.B \fB+[no]dnssec\fP
|
||||
Requests DNSSEC records be sent by setting the DNSSEC OK bit (DO) in
|
||||
This requests that DNSSEC records be sent by setting the DNSSEC OK (DO) bit in
|
||||
the OPT record in the additional section of the query.
|
||||
.TP
|
||||
.B \fB+[no]edns[=#]\fP
|
||||
Specify the EDNS version to query with. Valid values are 0 to 255.
|
||||
Setting the EDNS version will cause a EDNS query to be sent.
|
||||
This specifies [or does not specify] the EDNS version to query with. Valid values are 0 to 255.
|
||||
Setting the EDNS version causes an EDNS query to be sent.
|
||||
\fB+noedns\fP clears the remembered EDNS version. EDNS is set to 0 by
|
||||
default.
|
||||
.TP
|
||||
.B \fB+[no]ednsflags[=#]\fP
|
||||
Set the must\-be\-zero EDNS flags bits (Z bits) to the specified value.
|
||||
Decimal, hex and octal encodings are accepted. Setting a named flag
|
||||
(e.g. DO) will silently be ignored. By default, no Z bits are set.
|
||||
This sets the must\-be\-zero EDNS flag bits (Z bits) to the specified value.
|
||||
Decimal, hex, and octal encodings are accepted. Setting a named flag
|
||||
(e.g. DO) is silently ignored. By default, no Z bits are set.
|
||||
.TP
|
||||
.B \fB+[no]ednsopt[=code[:value]]\fP
|
||||
Specify EDNS option with code point \fBcode\fP and optionally payload
|
||||
This specifies [or does not specify] an EDNS option with code point \fBcode\fP and an optional payload
|
||||
of \fBvalue\fP as a hexadecimal string. \fB+noednsopt\fP clears the EDNS
|
||||
options to be sent.
|
||||
.TP
|
||||
.B \fB+[no]expire\fP
|
||||
Send an EDNS Expire option.
|
||||
This toggles sending of an EDNS Expire option.
|
||||
.TP
|
||||
.B \fB+[no]nsid\fP
|
||||
Include an EDNS name server ID request when sending a query.
|
||||
This toggles inclusion of an EDNS name server ID request when sending a query.
|
||||
.TP
|
||||
.B \fB+[no]recurse\fP
|
||||
Toggle the setting of the RD (recursion desired) bit in the query.
|
||||
This toggles the setting of the RD (recursion desired) bit in the query.
|
||||
This bit is set by default, which means \fBmdig\fP normally sends
|
||||
recursive queries.
|
||||
.TP
|
||||
.B \fB+retry=T\fP
|
||||
Sets the number of times to retry UDP queries to server to \fBT\fP
|
||||
This sets the number of times to retry UDP queries to server to \fBT\fP
|
||||
instead of the default, 2. Unlike \fB+tries\fP, this does not include
|
||||
the initial query.
|
||||
.TP
|
||||
.B \fB+[no]subnet=addr[/prefix\-length]\fP
|
||||
Send (don\(aqt send) an EDNS Client Subnet option with the specified IP
|
||||
This sends [or does not send] an EDNS Client Subnet option with the specified IP
|
||||
address or network prefix.
|
||||
.sp
|
||||
\fBmdig +subnet=0.0.0.0/0\fP, or simply \fBmdig +subnet=0\fP for short,
|
||||
sends an EDNS client\-subnet option with an empty address and a source
|
||||
.TP
|
||||
.B \fBmdig +subnet=0.0.0.0/0\fP, or simply \fBmdig +subnet=0\fP
|
||||
This sends an EDNS client\-subnet option with an empty address and a source
|
||||
prefix\-length of zero, which signals a resolver that the client\(aqs
|
||||
address information must \fInot\fP be used when resolving this query.
|
||||
.TP
|
||||
.B \fB+timeout=T\fP
|
||||
Sets the timeout for a query to \fBT\fP seconds. The default timeout is
|
||||
This sets the timeout for a query to \fBT\fP seconds. The default timeout is
|
||||
5 seconds for UDP transport and 10 for TCP. An attempt to set \fBT\fP
|
||||
to less than 1 will result in a query timeout of 1 second being
|
||||
to less than 1 results in a query timeout of 1 second being
|
||||
applied.
|
||||
.TP
|
||||
.B \fB+tries=T\fP
|
||||
Sets the number of times to try UDP queries to server to \fBT\fP
|
||||
This sets the number of times to try UDP queries to server to \fBT\fP
|
||||
instead of the default, 3. If \fBT\fP is less than or equal to zero,
|
||||
the number of tries is silently rounded up to 1.
|
||||
.TP
|
||||
.B \fB+udptimeout=T\fP
|
||||
Sets the timeout between UDP query retries.
|
||||
This sets the timeout between UDP query retries to \fBT\fP\&.
|
||||
.TP
|
||||
.B \fB+[no]unknownformat\fP
|
||||
Print all RDATA in unknown RR type presentation format (\fI\%RFC 3597\fP).
|
||||
This prints [or does not print] all RDATA in unknown RR\-type presentation format (see \fI\%RFC 3597\fP).
|
||||
The default is to print RDATA for known types in the type\(aqs
|
||||
presentation format.
|
||||
.TP
|
||||
.B \fB+[no]yaml\fP
|
||||
Print the responses in a detailed YAML format.
|
||||
This toggles printing of the responses in a detailed YAML format.
|
||||
.TP
|
||||
.B \fB+[no]zflag\fP
|
||||
Set [do not set] the last unassigned DNS header flag in a DNS query.
|
||||
This sets [or does not set] the last unassigned DNS header flag in a DNS query.
|
||||
This flag is off by default.
|
||||
.UNINDENT
|
||||
.SH SEE ALSO
|
||||
|
||||
@@ -36,61 +36,61 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
||||
.SH DESCRIPTION
|
||||
.sp
|
||||
\fBnamed\-checkconf\fP checks the syntax, but not the semantics, of a
|
||||
\fBnamed\fP configuration file. The file is parsed and checked for syntax
|
||||
errors, along with all files included by it. If no file is specified,
|
||||
\fBnamed\fP configuration file. The file, along with all files included by it, is parsed and checked for syntax
|
||||
errors. If no file is specified,
|
||||
\fB/etc/named.conf\fP is read by default.
|
||||
.sp
|
||||
Note: files that \fBnamed\fP reads in separate parser contexts, such as
|
||||
\fBrndc.key\fP and \fBbind.keys\fP, are not automatically read by
|
||||
\fBnamed\-checkconf\fP\&. Configuration errors in these files may cause
|
||||
\fBnamed\fP to fail to run, even if \fBnamed\-checkconf\fP was successful.
|
||||
\fBnamed\-checkconf\fP can be run on these files explicitly, however.
|
||||
However, \fBnamed\-checkconf\fP can be run on these files explicitly.
|
||||
.SH OPTIONS
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-h\fP
|
||||
Print the usage summary and exit.
|
||||
.B \fB\-h\fP
|
||||
This option prints the usage summary and exits.
|
||||
.TP
|
||||
\fB\-j\fP
|
||||
When loading a zonefile read the journal if it exists.
|
||||
.B \fB\-j\fP
|
||||
When loading a zonefile, this option instructs \fBnamed\fP to read the journal if it exists.
|
||||
.TP
|
||||
\fB\-l\fP
|
||||
List all the configured zones. Each line of output contains the zone
|
||||
name, class (e.g. IN), view, and type (e.g. master or slave).
|
||||
.B \fB\-l\fP
|
||||
This option lists all the configured zones. Each line of output contains the zone
|
||||
name, class (e.g. IN), view, and type (e.g. primary or secondary).
|
||||
.TP
|
||||
\fB\-c\fP
|
||||
Check "core" configuration only. This suppresses the loading of
|
||||
.B \fB\-c\fP
|
||||
This option specifies that only the "core" configuration should be checked. This suppresses the loading of
|
||||
plugin modules, and causes all parameters to \fBplugin\fP statements to
|
||||
be ignored.
|
||||
.TP
|
||||
\fB\-i\fP
|
||||
Ignore warnings on deprecated options.
|
||||
.B \fB\-i\fP
|
||||
This option ignores warnings on deprecated options.
|
||||
.TP
|
||||
\fB\-p\fP
|
||||
Print out the \fBnamed.conf\fP and included files in canonical form if
|
||||
.B \fB\-p\fP
|
||||
This option prints out the \fBnamed.conf\fP and included files in canonical form if
|
||||
no errors were detected. See also the \fB\-x\fP option.
|
||||
.TP
|
||||
\fB\-t\fP directory
|
||||
Chroot to \fBdirectory\fP so that include directives in the
|
||||
.B \fB\-t directory\fP
|
||||
This option instructs \fBnamed\fP to chroot to \fBdirectory\fP, so that \fBinclude\fP directives in the
|
||||
configuration file are processed as if run by a similarly chrooted
|
||||
\fBnamed\fP\&.
|
||||
.TP
|
||||
\fB\-v\fP
|
||||
Print the version of the \fBnamed\-checkconf\fP program and exit.
|
||||
.B \fB\-v\fP
|
||||
This option prints the version of the \fBnamed\-checkconf\fP program and exits.
|
||||
.TP
|
||||
\fB\-x\fP
|
||||
When printing the configuration files in canonical form, obscure
|
||||
.B \fB\-x\fP
|
||||
When printing the configuration files in canonical form, this option obscures
|
||||
shared secrets by replacing them with strings of question marks
|
||||
(\(aq?\(aq). This allows the contents of \fBnamed.conf\fP and related files
|
||||
to be shared MDASH for example, when submitting bug reports MDASH
|
||||
(\fB?\fP). This allows the contents of \fBnamed.conf\fP and related files
|
||||
to be shared \- for example, when submitting bug reports \-
|
||||
without compromising private data. This option cannot be used without
|
||||
\fB\-p\fP\&.
|
||||
.TP
|
||||
\fB\-z\fP
|
||||
Perform a test load of all master zones found in \fBnamed.conf\fP\&.
|
||||
.B \fB\-z\fP
|
||||
This option performs a test load of all zones of type \fBprimary\fP found in \fBnamed.conf\fP\&.
|
||||
.TP
|
||||
.B filename
|
||||
The name of the configuration file to be checked. If not specified,
|
||||
.B \fBfilename\fP
|
||||
This indicates the name of the configuration file to be checked. If not specified,
|
||||
it defaults to \fB/etc/named.conf\fP\&.
|
||||
.UNINDENT
|
||||
.SH RETURN VALUES
|
||||
|
||||
@@ -44,162 +44,163 @@ configuring them into a name server.
|
||||
.sp
|
||||
\fBnamed\-compilezone\fP is similar to \fBnamed\-checkzone\fP, but it always
|
||||
dumps the zone contents to a specified file in a specified format.
|
||||
Additionally, it applies stricter check levels by default, since the
|
||||
dump output will be used as an actual zone file loaded by \fBnamed\fP\&.
|
||||
It also applies stricter check levels by default, since the
|
||||
dump output is used as an actual zone file loaded by \fBnamed\fP\&.
|
||||
When manually specified otherwise, the check levels must at least be as
|
||||
strict as those specified in the \fBnamed\fP configuration file.
|
||||
.SH OPTIONS
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-d\fP
|
||||
Enable debugging.
|
||||
.B \fB\-d\fP
|
||||
This option enables debugging.
|
||||
.TP
|
||||
\fB\-h\fP
|
||||
Print the usage summary and exit.
|
||||
.B \fB\-h\fP
|
||||
This option prints the usage summary and exits.
|
||||
.TP
|
||||
\fB\-q\fP
|
||||
Quiet mode \- exit code only.
|
||||
.B \fB\-q\fP
|
||||
This option sets quiet mode, which only sets an exit code to indicate
|
||||
successful or failed completion.
|
||||
.TP
|
||||
\fB\-v\fP
|
||||
Print the version of the \fBnamed\-checkzone\fP program and exit.
|
||||
.B \fB\-v\fP
|
||||
This option prints the version of the \fBnamed\-checkzone\fP program and exits.
|
||||
.TP
|
||||
\fB\-j\fP
|
||||
When loading a zone file, read the journal if it exists. The journal
|
||||
file name is assumed to be the zone file name appended with the
|
||||
string \fB\&.jnl\fP\&.
|
||||
.B \fB\-j\fP
|
||||
When loading a zone file, this option tells \fBnamed\fP to read the journal if it exists. The journal
|
||||
file name is assumed to be the zone file name with the
|
||||
string \fB\&.jnl\fP appended.
|
||||
.TP
|
||||
\fB\-J\fP filename
|
||||
When loading the zone file read the journal from the given file, if
|
||||
it exists. (Implies \-j.)
|
||||
.B \fB\-J filename\fP
|
||||
When loading the zone file, this option tells \fBnamed\fP to read the journal from the given file, if
|
||||
it exists. This implies \fB\-j\fP\&.
|
||||
.TP
|
||||
\fB\-c\fP class
|
||||
Specify the class of the zone. If not specified, "IN" is assumed.
|
||||
.B \fB\-c class\fP
|
||||
This option specifies the class of the zone. If not specified, \fBIN\fP is assumed.
|
||||
.TP
|
||||
\fB\-i\fP mode
|
||||
Perform post\-load zone integrity checks. Possible modes are
|
||||
\fB"full"\fP (default), \fB"full\-sibling"\fP, \fB"local"\fP,
|
||||
\fB"local\-sibling"\fP and \fB"none"\fP\&.
|
||||
.B \fB\-i mode\fP
|
||||
This option performs post\-load zone integrity checks. Possible modes are
|
||||
\fBfull\fP (the default), \fBfull\-sibling\fP, \fBlocal\fP,
|
||||
\fBlocal\-sibling\fP, and \fBnone\fP\&.
|
||||
.sp
|
||||
Mode \fB"full"\fP checks that MX records refer to A or AAAA record
|
||||
(both in\-zone and out\-of\-zone hostnames). Mode \fB"local"\fP only
|
||||
Mode \fBfull\fP checks that MX records refer to A or AAAA records
|
||||
(both in\-zone and out\-of\-zone hostnames). Mode \fBlocal\fP only
|
||||
checks MX records which refer to in\-zone hostnames.
|
||||
.sp
|
||||
Mode \fB"full"\fP checks that SRV records refer to A or AAAA record
|
||||
(both in\-zone and out\-of\-zone hostnames). Mode \fB"local"\fP only
|
||||
Mode \fBfull\fP checks that SRV records refer to A or AAAA records
|
||||
(both in\-zone and out\-of\-zone hostnames). Mode \fBlocal\fP only
|
||||
checks SRV records which refer to in\-zone hostnames.
|
||||
.sp
|
||||
Mode \fB"full"\fP checks that delegation NS records refer to A or AAAA
|
||||
record (both in\-zone and out\-of\-zone hostnames). It also checks that
|
||||
Mode \fBfull\fP checks that delegation NS records refer to A or AAAA
|
||||
records (both in\-zone and out\-of\-zone hostnames). It also checks that
|
||||
glue address records in the zone match those advertised by the child.
|
||||
Mode \fB"local"\fP only checks NS records which refer to in\-zone
|
||||
hostnames or that some required glue exists, that is when the
|
||||
nameserver is in a child zone.
|
||||
Mode \fBlocal\fP only checks NS records which refer to in\-zone
|
||||
hostnames or verifies that some required glue exists, i.e., when the
|
||||
name server is in a child zone.
|
||||
.sp
|
||||
Mode \fB"full\-sibling"\fP and \fB"local\-sibling"\fP disable sibling glue
|
||||
checks but are otherwise the same as \fB"full"\fP and \fB"local"\fP
|
||||
Modes \fBfull\-sibling\fP and \fBlocal\-sibling\fP disable sibling glue
|
||||
checks, but are otherwise the same as \fBfull\fP and \fBlocal\fP,
|
||||
respectively.
|
||||
.sp
|
||||
Mode \fB"none"\fP disables the checks.
|
||||
Mode \fBnone\fP disables the checks.
|
||||
.TP
|
||||
\fB\-f\fP format
|
||||
Specify the format of the zone file. Possible formats are \fB"text"\fP
|
||||
(default), \fB"raw"\fP, and \fB"map"\fP\&.
|
||||
.B \fB\-f format\fP
|
||||
This option specifies the format of the zone file. Possible formats are \fBtext\fP
|
||||
(the default), \fBraw\fP, and \fBmap\fP\&.
|
||||
.TP
|
||||
\fB\-F\fP format
|
||||
Specify the format of the output file specified. For
|
||||
\fBnamed\-checkzone\fP, this does not cause any effects unless it dumps
|
||||
.B \fB\-F format\fP
|
||||
This option specifies the format of the output file specified. For
|
||||
\fBnamed\-checkzone\fP, this does not have any effect unless it dumps
|
||||
the zone contents.
|
||||
.sp
|
||||
Possible formats are \fB"text"\fP (default), which is the standard
|
||||
textual representation of the zone, and \fB"map"\fP, \fB"raw"\fP, and
|
||||
\fB"raw=N"\fP, which store the zone in a binary format for rapid
|
||||
loading by \fBnamed\fP\&. \fB"raw=N"\fP specifies the format version of the
|
||||
raw zone file: if N is 0, the raw file can be read by any version of
|
||||
\fBnamed\fP; if N is 1, the file can be read by release 9.9.0 or
|
||||
higher; the default is 1.
|
||||
Possible formats are \fBtext\fP (the default), which is the standard
|
||||
textual representation of the zone, and \fBmap\fP, \fBraw\fP, and
|
||||
\fBraw=N\fP, which store the zone in a binary format for rapid
|
||||
loading by \fBnamed\fP\&. \fBraw=N\fP specifies the format version of the
|
||||
raw zone file: if \fBN\fP is 0, the raw file can be read by any version of
|
||||
\fBnamed\fP; if N is 1, the file can only be read by release 9.9.0 or
|
||||
higher. The default is 1.
|
||||
.TP
|
||||
\fB\-k\fP mode
|
||||
Perform \fB"check\-names"\fP checks with the specified failure mode.
|
||||
Possible modes are \fB"fail"\fP (default for \fBnamed\-compilezone\fP),
|
||||
\fB"warn"\fP (default for \fBnamed\-checkzone\fP) and \fB"ignore"\fP\&.
|
||||
.B \fB\-k mode\fP
|
||||
This option performs \fBcheck\-names\fP checks with the specified failure mode.
|
||||
Possible modes are \fBfail\fP (the default for \fBnamed\-compilezone\fP),
|
||||
\fBwarn\fP (the default for \fBnamed\-checkzone\fP), and \fBignore\fP\&.
|
||||
.TP
|
||||
\fB\-l\fP ttl
|
||||
Sets a maximum permissible TTL for the input file. Any record with a
|
||||
TTL higher than this value will cause the zone to be rejected. This
|
||||
.B \fB\-l ttl\fP
|
||||
This option sets a maximum permissible TTL for the input file. Any record with a
|
||||
TTL higher than this value causes the zone to be rejected. This
|
||||
is similar to using the \fBmax\-zone\-ttl\fP option in \fBnamed.conf\fP\&.
|
||||
.TP
|
||||
\fB\-L\fP serial
|
||||
When compiling a zone to "raw" or "map" format, set the "source
|
||||
serial" value in the header to the specified serial number. (This is
|
||||
expected to be used primarily for testing purposes.)
|
||||
.B \fB\-L serial\fP
|
||||
When compiling a zone to \fBraw\fP or \fBmap\fP format, this option sets the "source
|
||||
serial" value in the header to the specified serial number. This is
|
||||
expected to be used primarily for testing purposes.
|
||||
.TP
|
||||
\fB\-m\fP mode
|
||||
Specify whether MX records should be checked to see if they are
|
||||
addresses. Possible modes are \fB"fail"\fP, \fB"warn"\fP (default) and
|
||||
\fB"ignore"\fP\&.
|
||||
.B \fB\-m mode\fP
|
||||
This option specifies whether MX records should be checked to see if they are
|
||||
addresses. Possible modes are \fBfail\fP, \fBwarn\fP (the default), and
|
||||
\fBignore\fP\&.
|
||||
.TP
|
||||
\fB\-M\fP mode
|
||||
Check if a MX record refers to a CNAME. Possible modes are
|
||||
\fB"fail"\fP, \fB"warn"\fP (default) and \fB"ignore"\fP\&.
|
||||
.B \fB\-M mode\fP
|
||||
This option checks whether a MX record refers to a CNAME. Possible modes are
|
||||
\fBfail\fP, \fBwarn\fP (the default), and \fBignore\fP\&.
|
||||
.TP
|
||||
\fB\-n\fP mode
|
||||
Specify whether NS records should be checked to see if they are
|
||||
addresses. Possible modes are \fB"fail"\fP (default for
|
||||
\fBnamed\-compilezone\fP), \fB"warn"\fP (default for \fBnamed\-checkzone\fP)
|
||||
and \fB"ignore"\fP\&.
|
||||
.B \fB\-n mode\fP
|
||||
This option specifies whether NS records should be checked to see if they are
|
||||
addresses. Possible modes are \fBfail\fP (the default for
|
||||
\fBnamed\-compilezone\fP), \fBwarn\fP (the default for \fBnamed\-checkzone\fP),
|
||||
and \fBignore\fP\&.
|
||||
.TP
|
||||
\fB\-o\fP filename
|
||||
Write zone output to \fBfilename\fP\&. If \fBfilename\fP is \fB\-\fP then
|
||||
write to standard out. This is mandatory for \fBnamed\-compilezone\fP\&.
|
||||
.B \fB\-o filename\fP
|
||||
This option writes the zone output to \fBfilename\fP\&. If \fBfilename\fP is \fB\-\fP, then
|
||||
the zone output is written to standard output. This is mandatory for \fBnamed\-compilezone\fP\&.
|
||||
.TP
|
||||
\fB\-r\fP mode
|
||||
Check for records that are treated as different by DNSSEC but are
|
||||
semantically equal in plain DNS. Possible modes are \fB"fail"\fP,
|
||||
\fB"warn"\fP (default) and \fB"ignore"\fP\&.
|
||||
.B \fB\-r mode\fP
|
||||
This option checks for records that are treated as different by DNSSEC but are
|
||||
semantically equal in plain DNS. Possible modes are \fBfail\fP,
|
||||
\fBwarn\fP (the default), and \fBignore\fP\&.
|
||||
.TP
|
||||
\fB\-s\fP style
|
||||
Specify the style of the dumped zone file. Possible styles are
|
||||
\fB"full"\fP (default) and \fB"relative"\fP\&. The full format is most
|
||||
suitable for processing automatically by a separate script. On the
|
||||
other hand, the relative format is more human\-readable and is thus
|
||||
suitable for editing by hand. For \fBnamed\-checkzone\fP this does not
|
||||
cause any effects unless it dumps the zone contents. It also does not
|
||||
.B \fB\-s style\fP
|
||||
This option specifies the style of the dumped zone file. Possible styles are
|
||||
\fBfull\fP (the default) and \fBrelative\fP\&. The \fBfull\fP format is most
|
||||
suitable for processing automatically by a separate script.
|
||||
The relative format is more human\-readable and is thus
|
||||
suitable for editing by hand. For \fBnamed\-checkzone\fP, this does not
|
||||
have any effect unless it dumps the zone contents. It also does not
|
||||
have any meaning if the output format is not text.
|
||||
.TP
|
||||
\fB\-S\fP mode
|
||||
Check if a SRV record refers to a CNAME. Possible modes are
|
||||
\fB"fail"\fP, \fB"warn"\fP (default) and \fB"ignore"\fP\&.
|
||||
.B \fB\-S mode\fP
|
||||
This option checks whether an SRV record refers to a CNAME. Possible modes are
|
||||
\fBfail\fP, \fBwarn\fP (the default), and \fBignore\fP\&.
|
||||
.TP
|
||||
\fB\-t\fP directory
|
||||
Chroot to \fBdirectory\fP so that include directives in the
|
||||
.B \fB\-t directory\fP
|
||||
This option tells \fBnamed\fP to chroot to \fBdirectory\fP, so that \fBinclude\fP directives in the
|
||||
configuration file are processed as if run by a similarly chrooted
|
||||
\fBnamed\fP\&.
|
||||
.TP
|
||||
\fB\-T\fP mode
|
||||
Check if Sender Policy Framework (SPF) records exist and issues a
|
||||
.B \fB\-T mode\fP
|
||||
This option checks whether Sender Policy Framework (SPF) records exist and issues a
|
||||
warning if an SPF\-formatted TXT record is not also present. Possible
|
||||
modes are \fB"warn"\fP (default), \fB"ignore"\fP\&.
|
||||
modes are \fBwarn\fP (the default) and \fBignore\fP\&.
|
||||
.TP
|
||||
\fB\-w\fP directory
|
||||
chdir to \fBdirectory\fP so that relative filenames in master file
|
||||
$INCLUDE directives work. This is similar to the directory clause in
|
||||
.B \fB\-w directory\fP
|
||||
This option instructs \fBnamed\fP to chdir to \fBdirectory\fP, so that relative filenames in master file
|
||||
\fB$INCLUDE\fP directives work. This is similar to the directory clause in
|
||||
\fBnamed.conf\fP\&.
|
||||
.TP
|
||||
\fB\-D\fP
|
||||
Dump zone file in canonical format. This is always enabled for
|
||||
.B \fB\-D\fP
|
||||
This option dumps the zone file in canonical format. This is always enabled for
|
||||
\fBnamed\-compilezone\fP\&.
|
||||
.TP
|
||||
\fB\-W\fP mode
|
||||
Specify whether to check for non\-terminal wildcards. Non\-terminal
|
||||
.B \fB\-W mode\fP
|
||||
This option specifies whether to check for non\-terminal wildcards. Non\-terminal
|
||||
wildcards are almost always the result of a failure to understand the
|
||||
wildcard matching algorithm (\fI\%RFC 1034\fP). Possible modes are \fB"warn"\fP
|
||||
(default) and \fB"ignore"\fP\&.
|
||||
wildcard matching algorithm (\fI\%RFC 1034\fP). Possible modes are \fBwarn\fP
|
||||
(the default) and \fBignore\fP\&.
|
||||
.TP
|
||||
.B zonename
|
||||
The domain name of the zone being checked.
|
||||
.B \fBzonename\fP
|
||||
This indicates the domain name of the zone being checked.
|
||||
.TP
|
||||
.B filename
|
||||
The name of the zone file.
|
||||
.B \fBfilename\fP
|
||||
This is the name of the zone file.
|
||||
.UNINDENT
|
||||
.SH RETURN VALUES
|
||||
.sp
|
||||
|
||||
@@ -47,7 +47,7 @@ appending the extension \fB\&.jnl\fP to the name of the corresponding zone
|
||||
file.
|
||||
.sp
|
||||
\fBnamed\-journalprint\fP converts the contents of a given journal file
|
||||
into a human\-readable text format. Each line begins with "add" or "del",
|
||||
into a human\-readable text format. Each line begins with \fBadd\fP or \fBdel\fP,
|
||||
to indicate whether the record was added or deleted, and continues with
|
||||
the resource record in master\-file format.
|
||||
.SH SEE ALSO
|
||||
|
||||
@@ -43,8 +43,8 @@ version of BIND to an older version.
|
||||
.SH ARGUMENTS
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
.B filename
|
||||
The name of the \fB\&.nzd\fP file whose contents should be printed.
|
||||
.B \fBfilename\fP
|
||||
This is the name of the \fB\&.nzd\fP file whose contents should be printed.
|
||||
.UNINDENT
|
||||
.SH SEE ALSO
|
||||
.sp
|
||||
|
||||
@@ -35,22 +35,30 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
||||
\fBnamed\-rrchecker\fP [\fB\-h\fP] [\fB\-o\fP origin] [\fB\-p\fP] [\fB\-u\fP] [\fB\-C\fP] [\fB\-T\fP] [\fB\-P\fP]
|
||||
.SH DESCRIPTION
|
||||
.sp
|
||||
\fBnamed\-rrchecker\fP read a individual DNS resource record from standard
|
||||
input and checks if it is syntactically correct.
|
||||
.sp
|
||||
The \fB\-h\fP prints out the help menu.
|
||||
.sp
|
||||
The \fB\-o origin\fP option specifies a origin to be used when interpreting
|
||||
\fBnamed\-rrchecker\fP reads a individual DNS resource record from standard
|
||||
input and checks whether it is syntactically correct.
|
||||
.SH OPTIONS
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
.B \fB\-h\fP
|
||||
This option prints out the help menu.
|
||||
.TP
|
||||
.B \fB\-o origin\fP
|
||||
This option specifies the origin to be used when interpreting
|
||||
the record.
|
||||
.sp
|
||||
The \fB\-p\fP prints out the resulting record in canonical form. If there
|
||||
is no canonical form defined then the record will be printed in unknown
|
||||
.TP
|
||||
.B \fB\-p\fP
|
||||
This option prints out the resulting record in canonical form. If there
|
||||
is no canonical form defined, the record is printed in unknown
|
||||
record format.
|
||||
.sp
|
||||
The \fB\-u\fP prints out the resulting record in unknown record form.
|
||||
.sp
|
||||
The \fB\-C\fP, \fB\-T\fP and \fB\-P\fP print out the known class, standard type
|
||||
and private type mnemonics respectively.
|
||||
.TP
|
||||
.B \fB\-u\fP
|
||||
This option prints out the resulting record in unknown record form.
|
||||
.TP
|
||||
.B \fB\-C\fP, \fB\-T\fP, and \fB\-P\fP
|
||||
These options print out the known class, standard type,
|
||||
and private type mnemonics, respectively.
|
||||
.UNINDENT
|
||||
.SH SEE ALSO
|
||||
.sp
|
||||
\fI\%RFC 1034\fP, \fI\%RFC 1035\fP, \fBnamed(8)\fP\&.
|
||||
|
||||
@@ -39,81 +39,81 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
||||
distribution from ISC. For more information on the DNS, see \fI\%RFC 1033\fP,
|
||||
\fI\%RFC 1034\fP, and \fI\%RFC 1035\fP\&.
|
||||
.sp
|
||||
When invoked without arguments, \fBnamed\fP will read the default
|
||||
configuration file \fB/etc/named.conf\fP, read any initial data, and
|
||||
listen for queries.
|
||||
When invoked without arguments, \fBnamed\fP reads the default
|
||||
configuration file \fB/etc/named.conf\fP, reads any initial data, and
|
||||
listens for queries.
|
||||
.SH OPTIONS
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-4\fP
|
||||
Use IPv4 only even if the host machine is capable of IPv6. \fB\-4\fP and
|
||||
.B \fB\-4\fP
|
||||
This option tells \fBnamed\fP to use only IPv4, even if the host machine is capable of IPv6. \fB\-4\fP and
|
||||
\fB\-6\fP are mutually exclusive.
|
||||
.TP
|
||||
\fB\-6\fP
|
||||
Use IPv6 only even if the host machine is capable of IPv4. \fB\-4\fP and
|
||||
.B \fB\-6\fP
|
||||
This option tells \fBnamed\fP to use only IPv6, even if the host machine is capable of IPv4. \fB\-4\fP and
|
||||
\fB\-6\fP are mutually exclusive.
|
||||
.TP
|
||||
\fB\-c\fP config\-file
|
||||
Use config\-file as the configuration file instead of the default,
|
||||
\fB/etc/named.conf\fP\&. To ensure that reloading the configuration file
|
||||
continues to work after the server has changed its working directory
|
||||
.B \fB\-c config\-file\fP
|
||||
This option tells \fBnamed\fP to use \fBconfig\-file\fP as its configuration file instead of the default,
|
||||
\fB/etc/named.conf\fP\&. To ensure that the configuration file
|
||||
can be reloaded after the server has changed its working directory
|
||||
due to to a possible \fBdirectory\fP option in the configuration file,
|
||||
config\-file should be an absolute pathname.
|
||||
\fBconfig\-file\fP should be an absolute pathname.
|
||||
.TP
|
||||
\fB\-d\fP debug\-level
|
||||
Set the daemon\(aqs debug level to debug\-level. Debugging traces from
|
||||
.B \fB\-d debug\-level\fP
|
||||
This option sets the daemon\(aqs debug level to \fBdebug\-level\fP\&. Debugging traces from
|
||||
\fBnamed\fP become more verbose as the debug level increases.
|
||||
.TP
|
||||
\fB\-D\fP string
|
||||
Specifies a string that is used to identify a instance of \fBnamed\fP
|
||||
in a process listing. The contents of string are not examined.
|
||||
.B \fB\-D string\fP
|
||||
This option specifies a string that is used to identify a instance of \fBnamed\fP
|
||||
in a process listing. The contents of \fBstring\fP are not examined.
|
||||
.TP
|
||||
\fB\-E\fP engine\-name
|
||||
When applicable, specifies the hardware to use for cryptographic
|
||||
.B \fB\-E engine\-name\fP
|
||||
When applicable, this option specifies the hardware to use for cryptographic
|
||||
operations, such as a secure key store used for signing.
|
||||
.sp
|
||||
When BIND is built with OpenSSL PKCS#11 support, this defaults to the
|
||||
string "pkcs11", which identifies an OpenSSL engine that can drive a
|
||||
string \fBpkcs11\fP, which identifies an OpenSSL engine that can drive a
|
||||
cryptographic accelerator or hardware service module. When BIND is
|
||||
built with native PKCS#11 cryptography (\-\-enable\-native\-pkcs11), it
|
||||
built with native PKCS#11 cryptography (\fB\-\-enable\-native\-pkcs11\fP), it
|
||||
defaults to the path of the PKCS#11 provider library specified via
|
||||
"\-\-with\-pkcs11".
|
||||
\fB\-\-with\-pkcs11\fP\&.
|
||||
.TP
|
||||
\fB\-f\fP
|
||||
Run the server in the foreground (i.e. do not daemonize).
|
||||
.B \fB\-f\fP
|
||||
This option runs the server in the foreground (i.e., do not daemonize).
|
||||
.TP
|
||||
\fB\-g\fP
|
||||
Run the server in the foreground and force all logging to \fBstderr\fP\&.
|
||||
.B \fB\-g\fP
|
||||
This option runs the server in the foreground and forces all logging to \fBstderr\fP\&.
|
||||
.TP
|
||||
\fB\-L\fP logfile
|
||||
Log to the file \fBlogfile\fP by default instead of the system log.
|
||||
.B \fB\-L logfile\fP
|
||||
This option sets the log to the file \fBlogfile\fP by default, instead of the system log.
|
||||
.TP
|
||||
\fB\-M\fP option
|
||||
Sets the default memory context options. If set to external, this
|
||||
causes the internal memory manager to be bypassed in favor of
|
||||
system\-provided memory allocation functions. If set to fill, blocks
|
||||
of memory will be filled with tag values when allocated or freed, to
|
||||
assist debugging of memory problems. (nofill disables this behavior,
|
||||
.B \fB\-M option\fP
|
||||
This option sets the default memory context options. If set to \fBexternal\fP,
|
||||
the internal memory manager is bypassed in favor of
|
||||
system\-provided memory allocation functions. If set to \fBfill\fP, blocks
|
||||
of memory are filled with tag values when allocated or freed, to
|
||||
assist debugging of memory problems. \fBnofill\fP disables this behavior,
|
||||
and is the default unless \fBnamed\fP has been compiled with developer
|
||||
options.)
|
||||
options.
|
||||
.TP
|
||||
\fB\-m\fP flag
|
||||
Turn on memory usage debugging flags. Possible flags are usage,
|
||||
trace, record, size, and mctx. These correspond to the
|
||||
ISC_MEM_DEBUGXXXX flags described in \fB<isc/mem.h>\fP\&.
|
||||
.B \fB\-m flag\fP
|
||||
This option turns on memory usage debugging flags. Possible flags are \fBusage\fP,
|
||||
\fBtrace\fP, \fBrecord\fP, \fBsize\fP, and \fBmctx\fP\&. These correspond to the
|
||||
\fBISC_MEM_DEBUGXXXX\fP flags described in \fB<isc/mem.h>\fP\&.
|
||||
.TP
|
||||
\fB\-n\fP #cpus
|
||||
Create #cpus worker threads to take advantage of multiple CPUs. If
|
||||
not specified, \fBnamed\fP will try to determine the number of CPUs
|
||||
present and create one thread per CPU. If it is unable to determine
|
||||
the number of CPUs, a single worker thread will be created.
|
||||
.B \fB\-n #cpus\fP
|
||||
This option creates \fB#cpus\fP worker threads to take advantage of multiple CPUs. If
|
||||
not specified, \fBnamed\fP tries to determine the number of CPUs
|
||||
present and creates one thread per CPU. If it is unable to determine
|
||||
the number of CPUs, a single worker thread is created.
|
||||
.TP
|
||||
\fB\-p\fP port
|
||||
Listen for queries on port port. If not specified, the default is
|
||||
.B \fB\-p port\fP
|
||||
This option listens for queries on \fBport\fP\&. If not specified, the default is
|
||||
port 53.
|
||||
.TP
|
||||
\fB\-s\fP
|
||||
Write memory usage statistics to \fBstdout\fP on exit.
|
||||
.B \fB\-s\fP
|
||||
This option writes memory usage statistics to \fBstdout\fP on exit.
|
||||
.UNINDENT
|
||||
.sp
|
||||
\fBNOTE:\fP
|
||||
@@ -125,30 +125,30 @@ removed or changed in a future release.
|
||||
.UNINDENT
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-S\fP #max\-socks
|
||||
Allow \fBnamed\fP to use up to #max\-socks sockets. The default value is
|
||||
.B \fB\-S #max\-socks\fP
|
||||
This option allows \fBnamed\fP to use up to \fB#max\-socks\fP sockets. The default value is
|
||||
21000 on systems built with default configuration options, and 4096
|
||||
on systems built with "configure \-\-with\-tuning=small".
|
||||
on systems built with \fBconfigure \-\-with\-tuning=small\fP\&.
|
||||
.UNINDENT
|
||||
.sp
|
||||
\fBWARNING:\fP
|
||||
.INDENT 0.0
|
||||
.INDENT 3.5
|
||||
This option should be unnecessary for the vast majority of users.
|
||||
The use of this option could even be harmful because the specified
|
||||
The use of this option could even be harmful, because the specified
|
||||
value may exceed the limitation of the underlying system API. It
|
||||
is therefore set only when the default configuration causes
|
||||
exhaustion of file descriptors and the operational environment is
|
||||
known to support the specified number of sockets. Note also that
|
||||
the actual maximum number is normally a little fewer than the
|
||||
specified value because \fBnamed\fP reserves some file descriptors
|
||||
the actual maximum number is normally slightly fewer than the
|
||||
specified value, because \fBnamed\fP reserves some file descriptors
|
||||
for its internal use.
|
||||
.UNINDENT
|
||||
.UNINDENT
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-t\fP directory
|
||||
Chroot to directory after processing the command line arguments, but
|
||||
.B \fB\-t directory\fP
|
||||
This option tells \fBnamed\fP to chroot to \fBdirectory\fP after processing the command\-line arguments, but
|
||||
before reading the configuration file.
|
||||
.UNINDENT
|
||||
.sp
|
||||
@@ -157,15 +157,15 @@ before reading the configuration file.
|
||||
.INDENT 3.5
|
||||
This option should be used in conjunction with the \fB\-u\fP option,
|
||||
as chrooting a process running as root doesn\(aqt enhance security on
|
||||
most systems; the way \fBchroot(2)\fP is defined allows a process
|
||||
most systems; the way \fBchroot\fP is defined allows a process
|
||||
with root privileges to escape a chroot jail.
|
||||
.UNINDENT
|
||||
.UNINDENT
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-U\fP #listeners
|
||||
Use #listeners worker threads to listen for incoming UDP packets on
|
||||
each address. If not specified, \fBnamed\fP will calculate a default
|
||||
.B \fB\-U #listeners\fP
|
||||
This option tells \fBnamed\fP the number of \fB#listeners\fP worker threads to listen on, for incoming UDP packets on
|
||||
each address. If not specified, \fBnamed\fP calculates a default
|
||||
value based on the number of detected CPUs: 1 for 1 CPU, and the
|
||||
number of detected CPUs minus one for machines with more than 1 CPU.
|
||||
This cannot be increased to a value higher than the number of CPUs.
|
||||
@@ -174,8 +174,8 @@ CPUs, then \fB\-U\fP may be increased as high as that value, but no
|
||||
higher. On Windows, the number of UDP listeners is hardwired to 1 and
|
||||
this option has no effect.
|
||||
.TP
|
||||
\fB\-u\fP user
|
||||
Setuid to user after completing privileged operations, such as
|
||||
.B \fB\-u user\fP
|
||||
This option sets the setuid to \fBuser\fP after completing privileged operations, such as
|
||||
creating sockets that listen on privileged ports.
|
||||
.UNINDENT
|
||||
.sp
|
||||
@@ -183,36 +183,36 @@ creating sockets that listen on privileged ports.
|
||||
.INDENT 0.0
|
||||
.INDENT 3.5
|
||||
On Linux, \fBnamed\fP uses the kernel\(aqs capability mechanism to drop
|
||||
all root privileges except the ability to \fBbind(2)\fP to a
|
||||
all root privileges except the ability to \fBbind\fP to a
|
||||
privileged port and set process resource limits. Unfortunately,
|
||||
this means that the \fB\-u\fP option only works when \fBnamed\fP is run
|
||||
on kernel 2.2.18 or later, or kernel 2.3.99\-pre3 or later, since
|
||||
previous kernels did not allow privileges to be retained after
|
||||
\fBsetuid(2)\fP\&.
|
||||
\fBsetuid\fP\&.
|
||||
.UNINDENT
|
||||
.UNINDENT
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-v\fP
|
||||
Report the version number and exit.
|
||||
.B \fB\-v\fP
|
||||
This option reports the version number and exits.
|
||||
.TP
|
||||
\fB\-V\fP
|
||||
Report the version number and build options, and exit.
|
||||
.B \fB\-V\fP
|
||||
This option reports the version number and build options, and exits.
|
||||
.TP
|
||||
\fB\-X\fP lock\-file
|
||||
Acquire a lock on the specified file at runtime; this helps to
|
||||
.B \fB\-X lock\-file\fP
|
||||
This option acquires a lock on the specified file at runtime; this helps to
|
||||
prevent duplicate \fBnamed\fP instances from running simultaneously.
|
||||
Use of this option overrides the \fBlock\-file\fP option in
|
||||
\fBnamed.conf\fP\&. If set to \fBnone\fP, the lock file check is disabled.
|
||||
.TP
|
||||
\fB\-x\fP cache\-file
|
||||
Load data from cache\-file into the cache of the default view.
|
||||
.B \fB\-x cache\-file\fP
|
||||
This option loads data from \fBcache\-file\fP into the cache of the default view.
|
||||
.UNINDENT
|
||||
.sp
|
||||
\fBWARNING:\fP
|
||||
.INDENT 0.0
|
||||
.INDENT 3.5
|
||||
This option must not be used. It is only of interest to BIND 9
|
||||
This option must not be used in normal operations. It is only of interest to BIND 9
|
||||
developers and may be removed or changed in a future release.
|
||||
.UNINDENT
|
||||
.UNINDENT
|
||||
@@ -223,10 +223,10 @@ nameserver; \fBrndc\fP should be used instead.
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
.B SIGHUP
|
||||
Force a reload of the server.
|
||||
This signal forces a reload of the server.
|
||||
.TP
|
||||
.B SIGINT, SIGTERM
|
||||
Shut down the server.
|
||||
These signals shut down the server.
|
||||
.UNINDENT
|
||||
.sp
|
||||
The result of sending any other signals to the server is undefined.
|
||||
|
||||
@@ -41,31 +41,31 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
||||
parameters. This can be used to check the validity of NSEC3 records in a
|
||||
signed zone.
|
||||
.sp
|
||||
If this command is invoked as \fBnsec3hash \-r\fP, it takes arguments in an
|
||||
order matching the first four fields of an NSEC3 record, followed by the
|
||||
domain name: algorithm, flags, iterations, salt, domain. This makes it
|
||||
If this command is invoked as \fBnsec3hash \-r\fP, it takes arguments in
|
||||
order, matching the first four fields of an NSEC3 record followed by the
|
||||
domain name: \fBalgorithm\fP, \fBflags\fP, \fBiterations\fP, \fBsalt\fP, \fBdomain\fP\&. This makes it
|
||||
convenient to copy and paste a portion of an NSEC3 or NSEC3PARAM record
|
||||
into a command line to confirm the correctness of an NSEC3 hash.
|
||||
.SH ARGUMENTS
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
.B \fBsalt\fP
|
||||
The salt provided to the hash algorithm.
|
||||
This is the salt provided to the hash algorithm.
|
||||
.TP
|
||||
.B \fBalgorithm\fP
|
||||
A number indicating the hash algorithm. Currently the only supported
|
||||
This is a number indicating the hash algorithm. Currently the only supported
|
||||
hash algorithm for NSEC3 is SHA\-1, which is indicated by the number
|
||||
1; consequently "1" is the only useful value for this argument.
|
||||
.TP
|
||||
.B \fBflags\fP
|
||||
Provided for compatibility with NSEC3 record presentation format, but
|
||||
ignored since the flags do not affect the hash.
|
||||
This is provided for compatibility with NSEC3 record presentation format, but
|
||||
is ignored since the flags do not affect the hash.
|
||||
.TP
|
||||
.B \fBiterations\fP
|
||||
The number of additional times the hash should be performed.
|
||||
This is the number of additional times the hash should be performed.
|
||||
.TP
|
||||
.B \fBdomain\fP
|
||||
The domain name to be hashed.
|
||||
This is the domain name to be hashed.
|
||||
.UNINDENT
|
||||
.SH SEE ALSO
|
||||
.sp
|
||||
|
||||
@@ -35,18 +35,18 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
||||
\fBnslookup\fP [\-option] [name | \-] [server]
|
||||
.SH DESCRIPTION
|
||||
.sp
|
||||
\fBNslookup\fP is a program to query Internet domain name servers.
|
||||
\fBNslookup\fP has two modes: interactive and non\-interactive. Interactive
|
||||
\fBnslookup\fP is a program to query Internet domain name servers.
|
||||
\fBnslookup\fP has two modes: interactive and non\-interactive. Interactive
|
||||
mode allows the user to query name servers for information about various
|
||||
hosts and domains or to print a list of hosts in a domain.
|
||||
Non\-interactive mode is used to print just the name and requested
|
||||
Non\-interactive mode prints just the name and requested
|
||||
information for a host or domain.
|
||||
.SH ARGUMENTS
|
||||
.sp
|
||||
Interactive mode is entered in the following cases:
|
||||
.INDENT 0.0
|
||||
.IP a. 3
|
||||
when no arguments are given (the default name server will be used)
|
||||
when no arguments are given (the default name server is used);
|
||||
.IP b. 3
|
||||
when the first argument is a hyphen (\-) and the second argument is
|
||||
the host name or Internet address of a name server.
|
||||
@@ -58,7 +58,7 @@ argument specifies the host name or address of a name server.
|
||||
.sp
|
||||
Options can also be specified on the command line if they precede the
|
||||
arguments and are prefixed with a hyphen. For example, to change the
|
||||
default query type to host information, and the initial timeout to 10
|
||||
default query type to host information, with an initial timeout of 10
|
||||
seconds, type:
|
||||
.INDENT 0.0
|
||||
.INDENT 3.5
|
||||
@@ -72,59 +72,59 @@ nslookup \-query=hinfo \-timeout=10
|
||||
.UNINDENT
|
||||
.sp
|
||||
The \fB\-version\fP option causes \fBnslookup\fP to print the version number
|
||||
and immediately exits.
|
||||
and immediately exit.
|
||||
.SH INTERACTIVE COMMANDS
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
.B \fBhost\fP [server]
|
||||
Look up information for host using the current default server or
|
||||
using server, if specified. If host is an Internet address and the
|
||||
query type is A or PTR, the name of the host is returned. If host is
|
||||
a name and does not have a trailing period, the search list is used
|
||||
.B \fBhost [server]\fP
|
||||
This command looks up information for \fBhost\fP using the current default server or
|
||||
using \fBserver\fP, if specified. If \fBhost\fP is an Internet address and the
|
||||
query type is A or PTR, the name of the host is returned. If \fBhost\fP is
|
||||
a name and does not have a trailing period (\fB\&.\fP), the search list is used
|
||||
to qualify the name.
|
||||
.sp
|
||||
To look up a host not in the current domain, append a period to the
|
||||
name.
|
||||
.TP
|
||||
.B \fBserver\fP domain | \fBlserver\fP domain
|
||||
Change the default server to domain; \fBlserver\fP uses the initial
|
||||
server to look up information about domain, while \fBserver\fP uses the
|
||||
current default server. If an authoritative answer can\(aqt be found,
|
||||
.B \fBserver domain\fP | \fBlserver domain\fP
|
||||
These commands change the default server to \fBdomain\fP; \fBlserver\fP uses the initial
|
||||
server to look up information about \fBdomain\fP, while \fBserver\fP uses the
|
||||
current default server. If an authoritative answer cannot be found,
|
||||
the names of servers that might have the answer are returned.
|
||||
.TP
|
||||
.B \fBroot\fP
|
||||
not implemented
|
||||
This command is not implemented.
|
||||
.TP
|
||||
.B \fBfinger\fP
|
||||
not implemented
|
||||
This command is not implemented.
|
||||
.TP
|
||||
.B \fBls\fP
|
||||
not implemented
|
||||
This command is not implemented.
|
||||
.TP
|
||||
.B \fBview\fP
|
||||
not implemented
|
||||
This command is not implemented.
|
||||
.TP
|
||||
.B \fBhelp\fP
|
||||
not implemented
|
||||
This command is not implemented.
|
||||
.TP
|
||||
.B \fB?\fP
|
||||
not implemented
|
||||
This command is not implemented.
|
||||
.TP
|
||||
.B \fBexit\fP
|
||||
Exits the program.
|
||||
This command exits the program.
|
||||
.TP
|
||||
.B \fBset\fP keyword[=value]
|
||||
.B \fBset keyword[=value]\fP
|
||||
This command is used to change state information that affects the
|
||||
lookups. Valid keywords are:
|
||||
.INDENT 7.0
|
||||
.TP
|
||||
.B \fBall\fP
|
||||
Prints the current values of the frequently used options to
|
||||
This keyword prints the current values of the frequently used options to
|
||||
\fBset\fP\&. Information about the current default server and host is
|
||||
also printed.
|
||||
.TP
|
||||
.B \fBclass=\fPvalue
|
||||
Change the query class to one of:
|
||||
.B \fBclass=value\fP
|
||||
This keyword changes the query class to one of:
|
||||
.INDENT 7.0
|
||||
.TP
|
||||
.B \fBIN\fP
|
||||
@@ -140,74 +140,62 @@ the Hesiod class
|
||||
wildcard
|
||||
.UNINDENT
|
||||
.sp
|
||||
The class specifies the protocol group of the information.
|
||||
.sp
|
||||
(Default = IN; abbreviation = cl)
|
||||
The class specifies the protocol group of the information. The default
|
||||
is \fBIN\fP; the abbreviation for this keyword is \fBcl\fP\&.
|
||||
.TP
|
||||
.B \fBnodebug\fP
|
||||
Turn on or off the display of the full response packet and any
|
||||
intermediate response packets when searching.
|
||||
.sp
|
||||
(Default = nodebug; abbreviation = [no]deb)
|
||||
This keyword turns on or off the display of the full response packet, and any
|
||||
intermediate response packets, when searching. The default for this keyword is
|
||||
\fBnodebug\fP; the abbreviation for this keyword is \fB[no]deb\fP\&.
|
||||
.TP
|
||||
.B \fBnod2\fP
|
||||
Turn debugging mode on or off. This displays more about what
|
||||
nslookup is doing.
|
||||
.sp
|
||||
(Default = nod2)
|
||||
This keyword turns debugging mode on or off. This displays more about what
|
||||
nslookup is doing. The default is \fBnod2\fP\&.
|
||||
.TP
|
||||
.B \fBdomain=\fPname
|
||||
Sets the search list to name.
|
||||
.B \fBdomain=name\fP
|
||||
This keyword sets the search list to \fBname\fP\&.
|
||||
.TP
|
||||
.B \fBnosearch\fP
|
||||
If the lookup request contains at least one period but doesn\(aqt end
|
||||
with a trailing period, append the domain names in the domain
|
||||
search list to the request until an answer is received.
|
||||
.sp
|
||||
(Default = search)
|
||||
If the lookup request contains at least one period, but does not end
|
||||
with a trailing period, this keyword appends the domain names in the domain
|
||||
search list to the request until an answer is received. The default is \fBsearch\fP\&.
|
||||
.TP
|
||||
.B \fBport=\fPvalue
|
||||
Change the default TCP/UDP name server port to value.
|
||||
.sp
|
||||
(Default = 53; abbreviation = po)
|
||||
.B \fBport=value\fP
|
||||
This keyword changes the default TCP/UDP name server port to \fBvalue\fP from
|
||||
its default, port 53. The abbreviation for this keyword is \fBpo\fP\&.
|
||||
.TP
|
||||
.B \fBquerytype=\fPvalue | \fBtype=\fPvalue
|
||||
Change the type of the information query.
|
||||
.B \fBquerytype=value\fP | \fBtype=value\fP
|
||||
This keyword changes the type of the information query to \fBvalue\fP\&. The
|
||||
defaults are A and then AAAA; the abbreviations for these keywords are
|
||||
\fBq\fP and \fBty\fP\&.
|
||||
.sp
|
||||
(Default = A and then AAAA; abbreviations = q, ty)
|
||||
.INDENT 7.0
|
||||
.TP
|
||||
\fBNote:\fP It is only possible to specify one query type, only the default
|
||||
Please note that it is only possible to specify one query type. Only the default
|
||||
behavior looks up both when an alternative is not specified.
|
||||
.UNINDENT
|
||||
.TP
|
||||
.B \fBnorecurse\fP
|
||||
Tell the name server to query other servers if it does not have
|
||||
the information.
|
||||
.sp
|
||||
(Default = recurse; abbreviation = [no]rec)
|
||||
This keyword tells the name server to query other servers if it does not have
|
||||
the information. The default is \fBrecurse\fP; the abbreviation for this
|
||||
keyword is \fB[no]rec\fP\&.
|
||||
.TP
|
||||
.B \fBndots=\fPnumber
|
||||
Set the number of dots (label separators) in a domain that will
|
||||
disable searching. Absolute names always stop searching.
|
||||
.B \fBndots=number\fP
|
||||
This keyword sets the number of dots (label separators) in a domain that
|
||||
disables searching. Absolute names always stop searching.
|
||||
.TP
|
||||
.B \fBretry=\fPnumber
|
||||
Set the number of retries to number.
|
||||
.B \fBretry=number\fP
|
||||
This keyword sets the number of retries to \fBnumber\fP\&.
|
||||
.TP
|
||||
.B \fBtimeout=\fPnumber
|
||||
Change the initial timeout interval for waiting for a reply to
|
||||
number seconds.
|
||||
.B \fBtimeout=number\fP
|
||||
This keyword changes the initial timeout interval to wait for a reply to
|
||||
\fBnumber\fP, in seconds.
|
||||
.TP
|
||||
.B \fBnovc\fP
|
||||
Always use a virtual circuit when sending requests to the server.
|
||||
.sp
|
||||
(Default = novc)
|
||||
This keyword indicates that a virtual circuit should always be used when sending requests to the server.
|
||||
\fBnovc\fP is the default.
|
||||
.TP
|
||||
.B \fBnofail\fP
|
||||
Try the next nameserver if a nameserver responds with SERVFAIL or
|
||||
a referral (nofail) or terminate query (fail) on such a response.
|
||||
.sp
|
||||
(Default = nofail)
|
||||
This keyword tries the next nameserver if a nameserver responds with SERVFAIL or
|
||||
a referral (nofail), or terminates the query (fail) on such a response. The
|
||||
default is \fBnofail\fP\&.
|
||||
.UNINDENT
|
||||
.UNINDENT
|
||||
.SH RETURN VALUES
|
||||
@@ -218,11 +206,11 @@ otherwise.
|
||||
.sp
|
||||
If \fBnslookup\fP has been built with IDN (internationalized domain name)
|
||||
support, it can accept and display non\-ASCII domain names. \fBnslookup\fP
|
||||
appropriately converts character encoding of domain name before sending
|
||||
a request to DNS server or displaying a reply from the server. If you\(aqd
|
||||
like to turn off the IDN support for some reason, define the IDN_DISABLE
|
||||
environment variable. The IDN support is disabled if the variable is set
|
||||
when \fBnslookup\fP runs or when the standard output is not a tty.
|
||||
appropriately converts character encoding of a domain name before sending
|
||||
a request to a DNS server or displaying a reply from the server.
|
||||
To turn off IDN support, define the \fBIDN_DISABLE\fP
|
||||
environment variable. IDN support is disabled if the variable is set
|
||||
when \fBnslookup\fP runs, or when the standard output is not a tty.
|
||||
.SH FILES
|
||||
.sp
|
||||
\fB/etc/resolv.conf\fP
|
||||
|
||||
@@ -35,8 +35,8 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
||||
\fBnsupdate\fP [\fB\-d\fP] [\fB\-D\fP] [\fB\-i\fP] [\fB\-L\fP level] [ [\fB\-g\fP] | [\fB\-o\fP] | [\fB\-l\fP] | [\fB\-y\fP [hmac:]keyname:secret] | [\fB\-k\fP keyfile] ] [\fB\-t\fP timeout] [\fB\-u\fP udptimeout] [\fB\-r\fP udpretries] [\fB\-v\fP] [\fB\-T\fP] [\fB\-P\fP] [\fB\-V\fP] [ [\fB\-4\fP] | [\fB\-6\fP] ] [filename]
|
||||
.SH DESCRIPTION
|
||||
.sp
|
||||
\fBnsupdate\fP is used to submit Dynamic DNS Update requests as defined in
|
||||
\fI\%RFC 2136\fP to a name server. This allows resource records to be added or
|
||||
\fBnsupdate\fP is used to submit Dynamic DNS Update requests, as defined in
|
||||
\fI\%RFC 2136\fP, to a name server. This allows resource records to be added or
|
||||
removed from a zone without manually editing the zone file. A single
|
||||
update request can contain requests to add or remove more than one
|
||||
resource record.
|
||||
@@ -46,23 +46,23 @@ should not be edited by hand. Manual edits could conflict with dynamic
|
||||
updates and cause data to be lost.
|
||||
.sp
|
||||
The resource records that are dynamically added or removed with
|
||||
\fBnsupdate\fP have to be in the same zone. Requests are sent to the
|
||||
zone\(aqs master server. This is identified by the MNAME field of the
|
||||
\fBnsupdate\fP must be in the same zone. Requests are sent to the
|
||||
zone\(aqs primary server, which is identified by the MNAME field of the
|
||||
zone\(aqs SOA record.
|
||||
.sp
|
||||
Transaction signatures can be used to authenticate the Dynamic DNS
|
||||
updates. These use the TSIG resource record type described in \fI\%RFC 2845\fP
|
||||
or the SIG(0) record described in \fI\%RFC 2535\fP and \fI\%RFC 2931\fP or GSS\-TSIG as
|
||||
updates. These use the TSIG resource record type described in \fI\%RFC 2845\fP,
|
||||
the SIG(0) record described in \fI\%RFC 2535\fP and \fI\%RFC 2931\fP, or GSS\-TSIG as
|
||||
described in \fI\%RFC 3645\fP\&.
|
||||
.sp
|
||||
TSIG relies on a shared secret that should only be known to \fBnsupdate\fP
|
||||
and the name server. For instance, suitable \fBkey\fP and \fBserver\fP
|
||||
statements would be added to \fB/etc/named.conf\fP so that the name server
|
||||
statements are added to \fB/etc/named.conf\fP so that the name server
|
||||
can associate the appropriate secret key and algorithm with the IP
|
||||
address of the client application that will be using TSIG
|
||||
authentication. You can use \fBddns\-confgen\fP to generate suitable
|
||||
address of the client application that is using TSIG
|
||||
authentication. \fBddns\-confgen\fP can generate suitable
|
||||
configuration fragments. \fBnsupdate\fP uses the \fB\-y\fP or \fB\-k\fP options
|
||||
to provide the TSIG shared secret. These options are mutually exclusive.
|
||||
to provide the TSIG shared secret; these options are mutually exclusive.
|
||||
.sp
|
||||
SIG(0) uses public key cryptography. To use a SIG(0) key, the public key
|
||||
must be stored in a KEY record in a zone served by the name server.
|
||||
@@ -73,96 +73,96 @@ used by Windows 2000 can be switched on with the \fB\-o\fP flag.
|
||||
.SH OPTIONS
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-4\fP
|
||||
Use IPv4 only.
|
||||
.B \fB\-4\fP
|
||||
This option sets use of IPv4 only.
|
||||
.TP
|
||||
\fB\-6\fP
|
||||
Use IPv6 only.
|
||||
.B \fB\-6\fP
|
||||
This option sets use of IPv6 only.
|
||||
.TP
|
||||
\fB\-d\fP
|
||||
Debug mode. This provides tracing information about the update
|
||||
.B \fB\-d\fP
|
||||
This option sets debug mode, which provides tracing information about the update
|
||||
requests that are made and the replies received from the name server.
|
||||
.TP
|
||||
\fB\-D\fP
|
||||
Extra debug mode.
|
||||
.B \fB\-D\fP
|
||||
This option sets extra debug mode.
|
||||
.TP
|
||||
\fB\-i\fP
|
||||
Force interactive mode, even when standard input is not a terminal.
|
||||
.B \fB\-i\fP
|
||||
This option forces interactive mode, even when standard input is not a terminal.
|
||||
.TP
|
||||
\fB\-k\fP keyfile
|
||||
The file containing the TSIG authentication key. Keyfiles may be in
|
||||
.B \fB\-k keyfile\fP
|
||||
This option indicates the file containing the TSIG authentication key. Keyfiles may be in
|
||||
two formats: a single file containing a \fBnamed.conf\fP\-format \fBkey\fP
|
||||
statement, which may be generated automatically by \fBddns\-confgen\fP,
|
||||
statement, which may be generated automatically by \fBddns\-confgen\fP;
|
||||
or a pair of files whose names are of the format
|
||||
\fBK{name}.+157.+{random}.key\fP and
|
||||
\fBK{name}.+157.+{random}.private\fP, which can be generated by
|
||||
\fBdnssec\-keygen\fP\&. The \fB\-k\fP may also be used to specify a SIG(0)
|
||||
\fBdnssec\-keygen\fP\&. The \fB\-k\fP option can also be used to specify a SIG(0)
|
||||
key used to authenticate Dynamic DNS update requests. In this case,
|
||||
the key specified is not an HMAC\-MD5 key.
|
||||
.TP
|
||||
\fB\-l\fP
|
||||
Local\-host only mode. This sets the server address to localhost
|
||||
.B \fB\-l\fP
|
||||
This option sets local\-host only mode, which sets the server address to localhost
|
||||
(disabling the \fBserver\fP so that the server address cannot be
|
||||
overridden). Connections to the local server will use a TSIG key
|
||||
overridden). Connections to the local server use a TSIG key
|
||||
found in \fB/var/run/named/session.key\fP, which is automatically
|
||||
generated by \fBnamed\fP if any local master zone has set
|
||||
generated by \fBnamed\fP if any local \fBprimary\fP zone has set
|
||||
\fBupdate\-policy\fP to \fBlocal\fP\&. The location of this key file can be
|
||||
overridden with the \fB\-k\fP option.
|
||||
.TP
|
||||
\fB\-L\fP level
|
||||
Set the logging debug level. If zero, logging is disabled.
|
||||
.B \fB\-L level\fP
|
||||
This option sets the logging debug level. If zero, logging is disabled.
|
||||
.TP
|
||||
\fB\-p\fP port
|
||||
Set the port to use for connections to a name server. The default is
|
||||
.B \fB\-p port\fP
|
||||
This option sets the port to use for connections to a name server. The default is
|
||||
53.
|
||||
.TP
|
||||
\fB\-P\fP
|
||||
Print the list of private BIND\-specific resource record types whose
|
||||
.B \fB\-P\fP
|
||||
This option prints the list of private BIND\-specific resource record types whose
|
||||
format is understood by \fBnsupdate\fP\&. See also the \fB\-T\fP option.
|
||||
.TP
|
||||
\fB\-r\fP udpretries
|
||||
The number of UDP retries. The default is 3. If zero, only one update
|
||||
request will be made.
|
||||
.B \fB\-r udpretries\fP
|
||||
This option sets the number of UDP retries. The default is 3. If zero, only one update
|
||||
request is made.
|
||||
.TP
|
||||
\fB\-t\fP timeout
|
||||
The maximum time an update request can take before it is aborted. The
|
||||
default is 300 seconds. Zero can be used to disable the timeout.
|
||||
.B \fB\-t timeout\fP
|
||||
This option sets the maximum time an update request can take before it is aborted. The
|
||||
default is 300 seconds. If zero, the timeout is disabled.
|
||||
.TP
|
||||
\fB\-T\fP
|
||||
Print the list of IANA standard resource record types whose format is
|
||||
understood by \fBnsupdate\fP\&. \fBnsupdate\fP will exit after the lists
|
||||
.B \fB\-T\fP
|
||||
This option prints the list of IANA standard resource record types whose format is
|
||||
understood by \fBnsupdate\fP\&. \fBnsupdate\fP exits after the lists
|
||||
are printed. The \fB\-T\fP option can be combined with the \fB\-P\fP
|
||||
option.
|
||||
.sp
|
||||
Other types can be entered using "TYPEXXXXX" where "XXXXX" is the
|
||||
Other types can be entered using \fBTYPEXXXXX\fP where \fBXXXXX\fP is the
|
||||
decimal value of the type with no leading zeros. The rdata, if
|
||||
present, will be parsed using the UNKNOWN rdata format, (<backslash>
|
||||
present, is parsed using the UNKNOWN rdata format, (<backslash>
|
||||
<hash> <space> <length> <space> <hexstring>).
|
||||
.TP
|
||||
\fB\-u\fP udptimeout
|
||||
The UDP retry interval. The default is 3 seconds. If zero, the
|
||||
interval will be computed from the timeout interval and number of UDP
|
||||
.B \fB\-u udptimeout\fP
|
||||
This option sets the UDP retry interval. The default is 3 seconds. If zero, the
|
||||
interval is computed from the timeout interval and number of UDP
|
||||
retries.
|
||||
.TP
|
||||
\fB\-v\fP
|
||||
Use TCP even for small update requests. By default, \fBnsupdate\fP uses
|
||||
.B \fB\-v\fP
|
||||
This option specifies that TCP should be used even for small update requests. By default, \fBnsupdate\fP uses
|
||||
UDP to send update requests to the name server unless they are too
|
||||
large to fit in a UDP request in which case TCP will be used. TCP may
|
||||
large to fit in a UDP request, in which case TCP is used. TCP may
|
||||
be preferable when a batch of update requests is made.
|
||||
.TP
|
||||
\fB\-V\fP
|
||||
Print the version number and exit.
|
||||
.B \fB\-V\fP
|
||||
This option prints the version number and exits.
|
||||
.TP
|
||||
\fB\-y\fP [hmac:]keyname:secret
|
||||
Literal TSIG authentication key. \fBkeyname\fP is the name of the key,
|
||||
.B \fB\-y [hmac:]keyname:secret\fP
|
||||
This option sets the literal TSIG authentication key. \fBkeyname\fP is the name of the key,
|
||||
and \fBsecret\fP is the base64 encoded shared secret. \fBhmac\fP is the
|
||||
name of the key algorithm; valid choices are \fBhmac\-md5\fP,
|
||||
\fBhmac\-sha1\fP, \fBhmac\-sha224\fP, \fBhmac\-sha256\fP, \fBhmac\-sha384\fP, or
|
||||
\fBhmac\-sha512\fP\&. If \fBhmac\fP is not specified, the default is
|
||||
\fBhmac\-md5\fP or if MD5 was disabled \fBhmac\-sha256\fP\&.
|
||||
\fBhmac\-md5\fP, or if MD5 was disabled, \fBhmac\-sha256\fP\&.
|
||||
.sp
|
||||
NOTE: Use of the \fB\-y\fP option is discouraged because the shared
|
||||
secret is supplied as a command line argument in clear text. This may
|
||||
secret is supplied as a command\-line argument in clear text. This may
|
||||
be visible in the output from ps1 or in a history file maintained by
|
||||
the user\(aqs shell.
|
||||
.UNINDENT
|
||||
@@ -170,142 +170,142 @@ the user\(aqs shell.
|
||||
.sp
|
||||
\fBnsupdate\fP reads input from \fBfilename\fP or standard input. Each
|
||||
command is supplied on exactly one line of input. Some commands are for
|
||||
administrative purposes. The others are either update instructions or
|
||||
administrative purposes; others are either update instructions or
|
||||
prerequisite checks on the contents of the zone. These checks set
|
||||
conditions that some name or set of resource records (RRset) either
|
||||
exists or is absent from the zone. These conditions must be met if the
|
||||
entire update request is to succeed. Updates will be rejected if the
|
||||
entire update request is to succeed. Updates are rejected if the
|
||||
tests for the prerequisite conditions fail.
|
||||
.sp
|
||||
Every update request consists of zero or more prerequisites and zero or
|
||||
more updates. This allows a suitably authenticated update request to
|
||||
proceed if some specified resource records are present or missing from
|
||||
proceed if some specified resource records are either present or missing from
|
||||
the zone. A blank input line (or the \fBsend\fP command) causes the
|
||||
accumulated commands to be sent as one Dynamic DNS update request to the
|
||||
name server.
|
||||
.sp
|
||||
The command formats and their meaning are as follows:
|
||||
The command formats and their meanings are as follows:
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
.B \fBserver\fP servername port
|
||||
Sends all dynamic update requests to the name server \fBservername\fP\&.
|
||||
When no server statement is provided, \fBnsupdate\fP will send updates
|
||||
to the master server of the correct zone. The MNAME field of that
|
||||
zone\(aqs SOA record will identify the master server for that zone.
|
||||
.B \fBserver servername port\fP
|
||||
This command sends all dynamic update requests to the name server \fBservername\fP\&.
|
||||
When no server statement is provided, \fBnsupdate\fP sends updates
|
||||
to the primary server of the correct zone. The MNAME field of that
|
||||
zone\(aqs SOA record identify the primary server for that zone.
|
||||
\fBport\fP is the port number on \fBservername\fP where the dynamic
|
||||
update requests get sent. If no port number is specified, the default
|
||||
update requests are sent. If no port number is specified, the default
|
||||
DNS port number of 53 is used.
|
||||
.TP
|
||||
.B \fBlocal\fP address port
|
||||
Sends all dynamic update requests using the local \fBaddress\fP\&. When
|
||||
no local statement is provided, \fBnsupdate\fP will send updates using
|
||||
an address and port chosen by the system. \fBport\fP can additionally
|
||||
be used to make requests come from a specific port. If no port number
|
||||
is specified, the system will assign one.
|
||||
.B \fBlocal address port\fP
|
||||
This command sends all dynamic update requests using the local \fBaddress\fP\&. When
|
||||
no local statement is provided, \fBnsupdate\fP sends updates using
|
||||
an address and port chosen by the system. \fBport\fP can also
|
||||
be used to force requests to come from a specific port. If no port number
|
||||
is specified, the system assigns one.
|
||||
.TP
|
||||
.B \fBzone\fP zonename
|
||||
Specifies that all updates are to be made to the zone \fBzonename\fP\&.
|
||||
If no \fBzone\fP statement is provided, \fBnsupdate\fP will attempt
|
||||
.B \fBzone zonename\fP
|
||||
This command specifies that all updates are to be made to the zone \fBzonename\fP\&.
|
||||
If no \fBzone\fP statement is provided, \fBnsupdate\fP attempts to
|
||||
determine the correct zone to update based on the rest of the input.
|
||||
.TP
|
||||
.B \fBclass\fP classname
|
||||
Specify the default class. If no \fBclass\fP is specified, the default
|
||||
.B \fBclass classname\fP
|
||||
This command specifies the default class. If no \fBclass\fP is specified, the default
|
||||
class is \fBIN\fP\&.
|
||||
.TP
|
||||
.B \fBttl\fP seconds
|
||||
Specify the default time to live for records to be added. The value
|
||||
\fBnone\fP will clear the default ttl.
|
||||
.B \fBttl seconds\fP
|
||||
This command specifies the default time\-to\-live, in seconds, for records to be added. The value
|
||||
\fBnone\fP clears the default TTL.
|
||||
.TP
|
||||
.B \fBkey\fP hmac:keyname secret
|
||||
Specifies that all updates are to be TSIG\-signed using the
|
||||
\fBkeyname\fP \fBsecret\fP pair. If \fBhmac\fP is specified, then it sets
|
||||
the signing algorithm in use; the default is \fBhmac\-md5\fP or if MD5
|
||||
was disabled \fBhmac\-sha256\fP\&. The \fBkey\fP command overrides any key
|
||||
.B \fBkey hmac:keyname secret\fP
|
||||
This command specifies that all updates are to be TSIG\-signed using the
|
||||
\fBkeyname\fP\-\fBsecret\fP pair. If \fBhmac\fP is specified, it sets
|
||||
the signing algorithm in use. The default is \fBhmac\-md5\fP; if MD5
|
||||
was disabled, the default is \fBhmac\-sha256\fP\&. The \fBkey\fP command overrides any key
|
||||
specified on the command line via \fB\-y\fP or \fB\-k\fP\&.
|
||||
.TP
|
||||
.B \fBgsstsig\fP
|
||||
Use GSS\-TSIG to sign the updated. This is equivalent to specifying
|
||||
This command uses GSS\-TSIG to sign the updates. This is equivalent to specifying
|
||||
\fB\-g\fP on the command line.
|
||||
.TP
|
||||
.B \fBoldgsstsig\fP
|
||||
Use the Windows 2000 version of GSS\-TSIG to sign the updated. This is
|
||||
This command uses the Windows 2000 version of GSS\-TSIG to sign the updates. This is
|
||||
equivalent to specifying \fB\-o\fP on the command line.
|
||||
.TP
|
||||
.B \fBrealm\fP [realm_name]
|
||||
When using GSS\-TSIG use \fBrealm_name\fP rather than the default realm
|
||||
in \fBkrb5.conf\fP\&. If no realm is specified the saved realm is
|
||||
.B \fBrealm [realm_name]\fP
|
||||
When using GSS\-TSIG, this command specifies the use of \fBrealm_name\fP rather than the default realm
|
||||
in \fBkrb5.conf\fP\&. If no realm is specified, the saved realm is
|
||||
cleared.
|
||||
.TP
|
||||
.B \fBcheck\-names\fP [yes_or_no]
|
||||
Turn on or off check\-names processing on records to be added.
|
||||
.B \fBcheck\-names [yes_or_no]\fP
|
||||
This command turns on or off check\-names processing on records to be added.
|
||||
Check\-names has no effect on prerequisites or records to be deleted.
|
||||
By default check\-names processing is on. If check\-names processing
|
||||
fails the record will not be added to the UPDATE message.
|
||||
fails, the record is not added to the UPDATE message.
|
||||
.TP
|
||||
.B \fBprereq nxdomain\fP domain\-name
|
||||
Requires that no resource record of any type exists with name
|
||||
.B \fBprereq nxdomain domain\-name\fP
|
||||
This command requires that no resource record of any type exist with the name
|
||||
\fBdomain\-name\fP\&.
|
||||
.TP
|
||||
.B \fBprereq yxdomain\fP domain\-name
|
||||
Requires that \fBdomain\-name\fP exists (has as at least one resource
|
||||
.B \fBprereq yxdomain domain\-name\fP
|
||||
This command requires that \fBdomain\-name\fP exist (as at least one resource
|
||||
record, of any type).
|
||||
.TP
|
||||
.B \fBprereq nxrrset\fP domain\-name class type
|
||||
Requires that no resource record exists of the specified \fBtype\fP,
|
||||
\fBclass\fP and \fBdomain\-name\fP\&. If \fBclass\fP is omitted, IN (internet)
|
||||
.B \fBprereq nxrrset domain\-name class type\fP
|
||||
This command requires that no resource record exist of the specified \fBtype\fP,
|
||||
\fBclass\fP, and \fBdomain\-name\fP\&. If \fBclass\fP is omitted, IN (Internet)
|
||||
is assumed.
|
||||
.TP
|
||||
.B \fBprereq yxrrset\fP domain\-name class type
|
||||
This requires that a resource record of the specified \fBtype\fP,
|
||||
\fBclass\fP and \fBdomain\-name\fP must exist. If \fBclass\fP is omitted, IN
|
||||
.B \fBprereq yxrrset domain\-name class type\fP
|
||||
This command requires that a resource record of the specified \fBtype\fP,
|
||||
\fBclass\fP and \fBdomain\-name\fP exist. If \fBclass\fP is omitted, IN
|
||||
(internet) is assumed.
|
||||
.TP
|
||||
.B \fBprereq yxrrset\fP domain\-name class type data
|
||||
The \fBdata\fP from each set of prerequisites of this form sharing a
|
||||
.B \fBprereq yxrrset domain\-name class type data\fP
|
||||
With this command, the \fBdata\fP from each set of prerequisites of this form sharing a
|
||||
common \fBtype\fP, \fBclass\fP, and \fBdomain\-name\fP are combined to form
|
||||
a set of RRs. This set of RRs must exactly match the set of RRs
|
||||
existing in the zone at the given \fBtype\fP, \fBclass\fP, and
|
||||
\fBdomain\-name\fP\&. The \fBdata\fP are written in the standard text
|
||||
representation of the resource record\(aqs RDATA.
|
||||
.TP
|
||||
.B \fBupdate delete\fP domain\-name ttl class type data
|
||||
Deletes any resource records named \fBdomain\-name\fP\&. If \fBtype\fP and
|
||||
\fBdata\fP is provided, only matching resource records will be removed.
|
||||
The internet class is assumed if \fBclass\fP is not supplied. The
|
||||
.B \fBupdate delete domain\-name ttl class type data\fP
|
||||
This command deletes any resource records named \fBdomain\-name\fP\&. If \fBtype\fP and
|
||||
\fBdata\fP are provided, only matching resource records are removed.
|
||||
The Internet class is assumed if \fBclass\fP is not supplied. The
|
||||
\fBttl\fP is ignored, and is only allowed for compatibility.
|
||||
.TP
|
||||
.B \fBupdate add\fP domain\-name ttl class type data
|
||||
Adds a new resource record with the specified \fBttl\fP, \fBclass\fP and
|
||||
.B \fBupdate add domain\-name ttl class type data\fP
|
||||
This command adds a new resource record with the specified \fBttl\fP, \fBclass\fP, and
|
||||
\fBdata\fP\&.
|
||||
.TP
|
||||
.B \fBshow\fP
|
||||
Displays the current message, containing all of the prerequisites and
|
||||
This command displays the current message, containing all of the prerequisites and
|
||||
updates specified since the last send.
|
||||
.TP
|
||||
.B \fBsend\fP
|
||||
Sends the current message. This is equivalent to entering a blank
|
||||
This command sends the current message. This is equivalent to entering a blank
|
||||
line.
|
||||
.TP
|
||||
.B \fBanswer\fP
|
||||
Displays the answer.
|
||||
This command displays the answer.
|
||||
.TP
|
||||
.B \fBdebug\fP
|
||||
Turn on debugging.
|
||||
This command turns on debugging.
|
||||
.TP
|
||||
.B \fBversion\fP
|
||||
Print version number.
|
||||
This command prints the version number.
|
||||
.TP
|
||||
.B \fBhelp\fP
|
||||
Print a list of commands.
|
||||
This command prints a list of commands.
|
||||
.UNINDENT
|
||||
.sp
|
||||
Lines beginning with a semicolon are comments and are ignored.
|
||||
Lines beginning with a semicolon (;) are comments and are ignored.
|
||||
.SH EXAMPLES
|
||||
.sp
|
||||
The examples below show how \fBnsupdate\fP could be used to insert and
|
||||
The examples below show how \fBnsupdate\fP can be used to insert and
|
||||
delete resource records from the \fBexample.com\fP zone. Notice that the
|
||||
input in each example contains a trailing blank line so that a group of
|
||||
commands are sent as one dynamic update request to the master name
|
||||
input in each example contains a trailing blank line, so that a group of
|
||||
commands is sent as one dynamic update request to the primary name
|
||||
server for \fBexample.com\fP\&.
|
||||
.INDENT 0.0
|
||||
.INDENT 3.5
|
||||
@@ -321,9 +321,9 @@ server for \fBexample.com\fP\&.
|
||||
.UNINDENT
|
||||
.UNINDENT
|
||||
.sp
|
||||
Any A records for \fBoldhost.example.com\fP are deleted. And an A record
|
||||
Any A records for \fBoldhost.example.com\fP are deleted, and an A record
|
||||
for \fBnewhost.example.com\fP with IP address 172.16.1.1 is added. The
|
||||
newly\-added record has a 1 day TTL (86400 seconds).
|
||||
newly added record has a TTL of 1 day (86400 seconds).
|
||||
.INDENT 0.0
|
||||
.INDENT 3.5
|
||||
.sp
|
||||
@@ -338,28 +338,28 @@ newly\-added record has a 1 day TTL (86400 seconds).
|
||||
.UNINDENT
|
||||
.UNINDENT
|
||||
.sp
|
||||
The prerequisite condition gets the name server to check that there are
|
||||
The prerequisite condition tells the name server to verify that there are
|
||||
no resource records of any type for \fBnickname.example.com\fP\&. If there
|
||||
are, the update request fails. If this name does not exist, a CNAME for
|
||||
it is added. This ensures that when the CNAME is added, it cannot
|
||||
conflict with the long\-standing rule in \fI\%RFC 1034\fP that a name must not
|
||||
exist as any other record type if it exists as a CNAME. (The rule has
|
||||
been updated for DNSSEC in \fI\%RFC 2535\fP to allow CNAMEs to have RRSIG,
|
||||
DNSKEY and NSEC records.)
|
||||
DNSKEY, and NSEC records.)
|
||||
.SH FILES
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
.B \fB/etc/resolv.conf\fP
|
||||
used to identify default name server
|
||||
Used to identify the default name server
|
||||
.TP
|
||||
.B \fB/var/run/named/session.key\fP
|
||||
sets the default TSIG key for use in local\-only mode
|
||||
Sets the default TSIG key for use in local\-only mode
|
||||
.TP
|
||||
.B \fBK{name}.+157.+{random}.key\fP
|
||||
base\-64 encoding of HMAC\-MD5 key created by dnssec\-keygen8.
|
||||
Base\-64 encoding of the HMAC\-MD5 key created by \fBdnssec\-keygen\fP\&.
|
||||
.TP
|
||||
.B \fBK{name}.+157.+{random}.private\fP
|
||||
base\-64 encoding of HMAC\-MD5 key created by dnssec\-keygen8.
|
||||
Base\-64 encoding of the HMAC\-MD5 key created by \fBdnssec\-keygen\fP\&.
|
||||
.UNINDENT
|
||||
.SH SEE ALSO
|
||||
.sp
|
||||
@@ -368,7 +368,7 @@ base\-64 encoding of HMAC\-MD5 key created by dnssec\-keygen8.
|
||||
.SH BUGS
|
||||
.sp
|
||||
The TSIG key is redundantly stored in two separate files. This is a
|
||||
consequence of nsupdate using the DST library for its cryptographic
|
||||
consequence of \fBnsupdate\fP using the DST library for its cryptographic
|
||||
operations, and may change in future releases.
|
||||
.SH AUTHOR
|
||||
Internet Systems Consortium
|
||||
|
||||
@@ -38,30 +38,30 @@ pkcs11\-destroy \- destroy PKCS#11 objects
|
||||
by their \fBID\fP or \fBlabel\fP\&.
|
||||
.sp
|
||||
Matching keys are displayed before being destroyed. By default, there is
|
||||
a five second delay to allow the user to interrupt the process before
|
||||
a five\-second delay to allow the user to interrupt the process before
|
||||
the destruction takes place.
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-m\fP module
|
||||
Specify the PKCS#11 provider module. This must be the full path to a
|
||||
.B \fB\-m module\fP
|
||||
This option specifies the PKCS#11 provider module. This must be the full path to a
|
||||
shared library object implementing the PKCS#11 API for the device.
|
||||
.TP
|
||||
\fB\-s\fP slot
|
||||
Open the session with the given PKCS#11 slot. The default is slot 0.
|
||||
.B \fB\-s slot\fP
|
||||
This option opens the session with the given PKCS#11 slot. The default is slot 0.
|
||||
.TP
|
||||
\fB\-i\fP ID
|
||||
Destroy keys with the given object ID.
|
||||
.B \fB\-i ID\fP
|
||||
This option destroys keys with the given object ID.
|
||||
.TP
|
||||
\fB\-l\fP label
|
||||
Destroy keys with the given label.
|
||||
.B \fB\-l label\fP
|
||||
This option destroys keys with the given label.
|
||||
.TP
|
||||
\fB\-p\fP PIN
|
||||
Specify the PIN for the device. If no PIN is provided on the command
|
||||
line, \fBpkcs11\-destroy\fP will prompt for it.
|
||||
.B \fB\-p PIN\fP
|
||||
This option specifies the \fBPIN\fP for the device. If no \fBPIN\fP is provided on the command
|
||||
line, \fBpkcs11\-destroy\fP prompts for it.
|
||||
.TP
|
||||
\fB\-w\fP seconds
|
||||
Specify how long to pause before carrying out key destruction. The
|
||||
default is five seconds. If set to \fB0\fP, destruction will be
|
||||
.B \fB\-w seconds\fP
|
||||
This option specifies how long, in seconds, to pause before carrying out key destruction. The
|
||||
default is 5 seconds. If set to \fB0\fP, destruction is
|
||||
immediate.
|
||||
.UNINDENT
|
||||
.sp
|
||||
|
||||
@@ -38,51 +38,51 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
||||
\fBpkcs11\-keygen\fP causes a PKCS#11 device to generate a new key pair
|
||||
with the given \fBlabel\fP (which must be unique) and with \fBkeysize\fP
|
||||
bits of prime.
|
||||
.SH ARGUMENTS
|
||||
.SH OPTIONS
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-a\fP algorithm
|
||||
Specify the key algorithm class: Supported classes are RSA, DSA, DH,
|
||||
ECC and ECX. In addition to these strings, the \fBalgorithm\fP can be
|
||||
specified as a DNSSEC signing algorithm that will be used with this
|
||||
.B \fB\-a algorithm\fP
|
||||
This option specifies the key algorithm class: supported classes are RSA, DSA, DH,
|
||||
ECC, and ECX. In addition to these strings, the \fBalgorithm\fP can be
|
||||
specified as a DNSSEC signing algorithm to be used with this
|
||||
key; for example, NSEC3RSASHA1 maps to RSA, ECDSAP256SHA256 maps to
|
||||
ECC, and ED25519 to ECX. The default class is "RSA".
|
||||
ECC, and ED25519 to ECX. The default class is \fBRSA\fP\&.
|
||||
.TP
|
||||
\fB\-b\fP keysize
|
||||
Create the key pair with \fBkeysize\fP bits of prime. For ECC keys, the
|
||||
.B \fB\-b keysize\fP
|
||||
This option creates the key pair with \fBkeysize\fP bits of prime. For ECC keys, the
|
||||
only valid values are 256 and 384, and the default is 256. For ECX
|
||||
keys, the only valid values are 256 and 456, and the default is 256.
|
||||
.TP
|
||||
\fB\-e\fP
|
||||
For RSA keys only, use a large exponent.
|
||||
.B \fB\-e\fP
|
||||
For RSA keys only, this option specifies use of a large exponent.
|
||||
.TP
|
||||
\fB\-i\fP id
|
||||
Create key objects with id. The id is either an unsigned short 2 byte
|
||||
or an unsigned long 4 byte number.
|
||||
.B \fB\-i id\fP
|
||||
This option creates key objects with \fBid\fP\&. The ID is either an unsigned short 2\-byte
|
||||
or an unsigned long 4\-byte number.
|
||||
.TP
|
||||
\fB\-m\fP module
|
||||
Specify the PKCS#11 provider module. This must be the full path to a
|
||||
.B \fB\-m module\fP
|
||||
This option specifies the PKCS#11 provider module. This must be the full path to a
|
||||
shared library object implementing the PKCS#11 API for the device.
|
||||
.TP
|
||||
\fB\-P\fP
|
||||
Set the new private key to be non\-sensitive and extractable. The
|
||||
.B \fB\-P\fP
|
||||
This option sets the new private key to be non\-sensitive and extractable, and
|
||||
allows the private key data to be read from the PKCS#11 device. The
|
||||
default is for private keys to be sensitive and non\-extractable.
|
||||
.TP
|
||||
\fB\-p\fP PIN
|
||||
Specify the PIN for the device. If no PIN is provided on the command
|
||||
line, \fBpkcs11\-keygen\fP will prompt for it.
|
||||
.B \fB\-p PIN\fP
|
||||
This option specifies the \fBPIN\fP for the device. If no \fBPIN\fP is provided on the command
|
||||
line, \fBpkcs11\-keygen\fP prompts for it.
|
||||
.TP
|
||||
\fB\-q\fP
|
||||
Quiet mode: suppress unnecessary output.
|
||||
.B \fB\-q\fP
|
||||
This option sets quiet mode, which suppresses unnecessary output.
|
||||
.TP
|
||||
\fB\-S\fP
|
||||
For Diffie\-Hellman (DH) keys only, use a special prime of 768, 1024
|
||||
or 1536 bit size and base (aka generator) 2. If not specified, bit
|
||||
size will default to 1024.
|
||||
.B \fB\-S\fP
|
||||
For Diffie\-Hellman (DH) keys only, this option specifies use of a special prime of 768\-, 1024\-,
|
||||
or 1536\-bit size and base (AKA generator) 2. If not specified, bit
|
||||
size defaults to 1024.
|
||||
.TP
|
||||
\fB\-s\fP slot
|
||||
Open the session with the given PKCS#11 slot. The default is slot 0.
|
||||
.B \fB\-s slot\fP
|
||||
This option opens the session with the given PKCS#11 slot. The default is slot 0.
|
||||
.UNINDENT
|
||||
.SH SEE ALSO
|
||||
.sp
|
||||
|
||||
@@ -34,33 +34,33 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
||||
\fBpkcs11\-list\fP [\fB\-P\fP] [\fB\-m\fP module] [\fB\-s\fP slot] [\fB\-i\fP ID \fB] [\-l\fP label] [\fB\-p\fP PIN]
|
||||
.SH DESCRIPTION
|
||||
.sp
|
||||
\fBpkcs11\-list\fP lists the PKCS#11 objects with \fBID\fP or \fBlabel\fP or by
|
||||
default all objects. The object class, label, and ID are displayed for
|
||||
\fBpkcs11\-list\fP lists the PKCS#11 objects with \fBID\fP or \fBlabel\fP or, by
|
||||
default, all objects. The object class, label, and ID are displayed for
|
||||
all keys. For private or secret keys, the extractability attribute is
|
||||
also displayed, as either \fBtrue\fP, \fBfalse\fP, or \fBnever\fP\&.
|
||||
.SH ARGUMENTS
|
||||
.SH OPTIONS
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-P\fP
|
||||
List only the public objects. (Note that on some PKCS#11 devices, all
|
||||
.B \fB\-P\fP
|
||||
This option lists only the public objects. (Note that on some PKCS#11 devices, all
|
||||
objects are private.)
|
||||
.TP
|
||||
\fB\-m\fP module
|
||||
Specify the PKCS#11 provider module. This must be the full path to a
|
||||
.B \fB\-m module\fP
|
||||
This option specifies the PKCS#11 provider module. This must be the full path to a
|
||||
shared library object implementing the PKCS#11 API for the device.
|
||||
.TP
|
||||
\fB\-s\fP slot
|
||||
Open the session with the given PKCS#11 slot. The default is slot 0.
|
||||
.B \fB\-s slot\fP
|
||||
This option opens the session with the given PKCS#11 slot. The default is slot 0.
|
||||
.TP
|
||||
\fB\-i\fP ID
|
||||
List only key objects with the given object ID.
|
||||
.B \fB\-i ID\fP
|
||||
This option lists only key objects with the given object ID.
|
||||
.TP
|
||||
\fB\-l\fP label
|
||||
List only key objects with the given label.
|
||||
.B \fB\-l label\fP
|
||||
This option lists only key objects with the given label.
|
||||
.TP
|
||||
\fB\-p\fP PIN
|
||||
Specify the PIN for the device. If no PIN is provided on the command
|
||||
line, \fBpkcs11\-list\fP will prompt for it.
|
||||
.B \fB\-p PIN\fP
|
||||
This option specifies the \fBPIN\fP for the device. If no \fBPIN\fP is provided on the command
|
||||
line, \fBpkcs11\-list\fP prompts for it.
|
||||
.UNINDENT
|
||||
.SH SEE ALSO
|
||||
.sp
|
||||
|
||||
@@ -37,15 +37,15 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
||||
.sp
|
||||
\fBpkcs11\-tokens\fP lists the PKCS#11 available tokens with defaults from
|
||||
the slot/token scan performed at application initialization.
|
||||
.SH ARGUMENTS
|
||||
.SH OPTIONS
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-m\fP module
|
||||
Specify the PKCS#11 provider module. This must be the full path to a
|
||||
.B \fB\-m module\fP
|
||||
This option specifies the PKCS#11 provider module. This must be the full path to a
|
||||
shared library object implementing the PKCS#11 API for the device.
|
||||
.TP
|
||||
\fB\-v\fP
|
||||
Make the PKCS#11 libisc initialization verbose.
|
||||
.B \fB\-v\fP
|
||||
This option makes the PKCS#11 libisc initialization verbose.
|
||||
.UNINDENT
|
||||
.SH SEE ALSO
|
||||
.sp
|
||||
|
||||
@@ -41,78 +41,74 @@ the corresponding \fBcontrols\fP and \fBkey\fP statements in \fBnamed.conf\fP
|
||||
by hand. Alternatively, it can be run with the \fB\-a\fP option to set up a
|
||||
\fBrndc.key\fP file and avoid the need for a \fBrndc.conf\fP file and a
|
||||
\fBcontrols\fP statement altogether.
|
||||
.SH ARGUMENTS
|
||||
.SH OPTIONS
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-a\fP
|
||||
Do automatic \fBrndc\fP configuration. This creates a file \fBrndc.key\fP
|
||||
in \fB/etc\fP (or whatever \fBsysconfdir\fP was specified as when BIND
|
||||
.B \fB\-a\fP
|
||||
This option sets automatic \fBrndc\fP configuration, which creates a file \fBrndc.key\fP
|
||||
in \fB/etc\fP (or a different \fBsysconfdir\fP specified when BIND
|
||||
was built) that is read by both \fBrndc\fP and \fBnamed\fP on startup.
|
||||
The \fBrndc.key\fP file defines a default command channel and
|
||||
authentication key allowing \fBrndc\fP to communicate with \fBnamed\fP on
|
||||
the local host with no further configuration.
|
||||
.sp
|
||||
Running \fBrndc\-confgen \-a\fP allows BIND 9 and \fBrndc\fP to be used as
|
||||
drop\-in replacements for BIND 8 and \fBndc\fP, with no changes to the
|
||||
existing BIND 8 \fBnamed.conf\fP file.
|
||||
.sp
|
||||
If a more elaborate configuration than that generated by
|
||||
\fBrndc\-confgen \-a\fP is required, for example if rndc is to be used
|
||||
remotely, you should run \fBrndc\-confgen\fP without the \fB\-a\fP option
|
||||
and set up a \fBrndc.conf\fP and \fBnamed.conf\fP as directed.
|
||||
remotely, run \fBrndc\-confgen\fP without the \fB\-a\fP option
|
||||
and set up \fBrndc.conf\fP and \fBnamed.conf\fP as directed.
|
||||
.TP
|
||||
\fB\-A\fP algorithm
|
||||
Specifies the algorithm to use for the TSIG key. Available choices
|
||||
are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384 and
|
||||
.B \fB\-A algorithm\fP
|
||||
This option specifies the algorithm to use for the TSIG key. Available choices
|
||||
are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384, and
|
||||
hmac\-sha512. The default is hmac\-sha256.
|
||||
.TP
|
||||
\fB\-b\fP keysize
|
||||
Specifies the size of the authentication key in bits. Must be between
|
||||
.B \fB\-b keysize\fP
|
||||
This option specifies the size of the authentication key in bits. The size must be between
|
||||
1 and 512 bits; the default is the hash size.
|
||||
.TP
|
||||
\fB\-c\fP keyfile
|
||||
Used with the \fB\-a\fP option to specify an alternate location for
|
||||
.B \fB\-c keyfile\fP
|
||||
This option is used with the \fB\-a\fP option to specify an alternate location for
|
||||
\fBrndc.key\fP\&.
|
||||
.TP
|
||||
\fB\-h\fP
|
||||
Prints a short summary of the options and arguments to
|
||||
.B \fB\-h\fP
|
||||
This option prints a short summary of the options and arguments to
|
||||
\fBrndc\-confgen\fP\&.
|
||||
.TP
|
||||
\fB\-k\fP keyname
|
||||
Specifies the key name of the rndc authentication key. This must be a
|
||||
.B \fB\-k keyname\fP
|
||||
This option specifies the key name of the \fBrndc\fP authentication key. This must be a
|
||||
valid domain name. The default is \fBrndc\-key\fP\&.
|
||||
.TP
|
||||
\fB\-p\fP port
|
||||
Specifies the command channel port where \fBnamed\fP listens for
|
||||
.B \fB\-p port\fP
|
||||
This option specifies the command channel port where \fBnamed\fP listens for
|
||||
connections from \fBrndc\fP\&. The default is 953.
|
||||
.TP
|
||||
\fB\-q\fP
|
||||
Omits printing written path in automatic configuration mode.
|
||||
.B \fB\-q\fP
|
||||
This option prevets printing the written path in automatic configuration mode.
|
||||
.TP
|
||||
\fB\-s\fP address
|
||||
Specifies the IP address where \fBnamed\fP listens for command channel
|
||||
.B \fB\-s address\fP
|
||||
This option specifies the IP address where \fBnamed\fP listens for command\-channel
|
||||
connections from \fBrndc\fP\&. The default is the loopback address
|
||||
127.0.0.1.
|
||||
.TP
|
||||
\fB\-t\fP chrootdir
|
||||
Used with the \fB\-a\fP option to specify a directory where \fBnamed\fP
|
||||
will run chrooted. An additional copy of the \fBrndc.key\fP will be
|
||||
written relative to this directory so that it will be found by the
|
||||
.B \fB\-t chrootdir\fP
|
||||
This option is used with the \fB\-a\fP option to specify a directory where \fBnamed\fP
|
||||
runs chrooted. An additional copy of the \fBrndc.key\fP is
|
||||
written relative to this directory, so that it is found by the
|
||||
chrooted \fBnamed\fP\&.
|
||||
.TP
|
||||
\fB\-u\fP user
|
||||
Used with the \fB\-a\fP option to set the owner of the \fBrndc.key\fP file
|
||||
generated. If \fB\-t\fP is also specified only the file in the chroot
|
||||
.B \fB\-u user\fP
|
||||
This option is used with the \fB\-a\fP option to set the owner of the generated \fBrndc.key\fP file.
|
||||
If \fB\-t\fP is also specified, only the file in the chroot
|
||||
area has its owner changed.
|
||||
.UNINDENT
|
||||
.SH EXAMPLES
|
||||
.sp
|
||||
To allow \fBrndc\fP to be used with no manual configuration, run
|
||||
To allow \fBrndc\fP to be used with no manual configuration, run:
|
||||
.sp
|
||||
\fBrndc\-confgen \-a\fP
|
||||
.sp
|
||||
To print a sample \fBrndc.conf\fP file and corresponding \fBcontrols\fP and
|
||||
\fBkey\fP statements to be manually inserted into \fBnamed.conf\fP, run
|
||||
To print a sample \fBrndc.conf\fP file and the corresponding \fBcontrols\fP and
|
||||
\fBkey\fP statements to be manually inserted into \fBnamed.conf\fP, run:
|
||||
.sp
|
||||
\fBrndc\-confgen\fP
|
||||
.SH SEE ALSO
|
||||
|
||||
357
doc/man/rndc.8in
357
doc/man/rndc.8in
@@ -35,8 +35,8 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
||||
\fBrndc\fP [\fB\-b\fP source\-address] [\fB\-c\fP config\-file] [\fB\-k\fP key\-file] [\fB\-s\fP server] [\fB\-p\fP port] [\fB\-q\fP] [\fB\-r\fP] [\fB\-V\fP] [\fB\-y\fP key_id] [[\fB\-4\fP] | [\fB\-6\fP]] {command}
|
||||
.SH DESCRIPTION
|
||||
.sp
|
||||
\fBrndc\fP controls the operation of a name server. It supersedes the
|
||||
\fBndc\fP utility that was provided in old BIND releases. If \fBrndc\fP is
|
||||
\fBrndc\fP controls the operation of a name server; it supersedes the
|
||||
\fBndc\fP utility. If \fBrndc\fP is
|
||||
invoked with no command line options or arguments, it prints a short
|
||||
summary of the supported commands and the available options and their
|
||||
arguments.
|
||||
@@ -45,8 +45,8 @@ arguments.
|
||||
sending commands authenticated with digital signatures. In the current
|
||||
versions of \fBrndc\fP and \fBnamed\fP, the only supported authentication
|
||||
algorithms are HMAC\-MD5 (for compatibility), HMAC\-SHA1, HMAC\-SHA224,
|
||||
HMAC\-SHA256 (default), HMAC\-SHA384 and HMAC\-SHA512. They use a shared
|
||||
secret on each end of the connection. This provides TSIG\-style
|
||||
HMAC\-SHA256 (default), HMAC\-SHA384, and HMAC\-SHA512. They use a shared
|
||||
secret on each end of the connection, which provides TSIG\-style
|
||||
authentication for the command request and the name server\(aqs response.
|
||||
All commands sent over the channel must be signed by a key_id known to
|
||||
the server.
|
||||
@@ -56,59 +56,58 @@ server and decide what algorithm and key it should use.
|
||||
.SH OPTIONS
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
\fB\-4\fP
|
||||
Use IPv4 only.
|
||||
.B \fB\-4\fP
|
||||
This option indicates use of IPv4 only.
|
||||
.TP
|
||||
\fB\-6\fP
|
||||
Use IPv6 only.
|
||||
.B \fB\-6\fP
|
||||
This option indicates use of IPv6 only.
|
||||
.TP
|
||||
\fB\-b\fP source\-address
|
||||
Use source\-address as the source address for the connection to the
|
||||
server. Multiple instances are permitted to allow setting of both the
|
||||
.B \fB\-b source\-address\fP
|
||||
This option indicates \fBsource\-address\fP as the source address for the connection to the
|
||||
server. Multiple instances are permitted, to allow setting of both the
|
||||
IPv4 and IPv6 source addresses.
|
||||
.TP
|
||||
\fB\-c\fP config\-file
|
||||
Use config\-file as the configuration file instead of the default,
|
||||
.B \fB\-c config\-file\fP
|
||||
This option indicates \fBconfig\-file\fP as the configuration file instead of the default,
|
||||
\fB/etc/rndc.conf\fP\&.
|
||||
.TP
|
||||
\fB\-k\fP key\-file
|
||||
Use key\-file as the key file instead of the default,
|
||||
\fB/etc/rndc.key\fP\&. The key in \fB/etc/rndc.key\fP will be used to
|
||||
.B \fB\-k key\-file\fP
|
||||
This option indicates \fBkey\-file\fP as the key file instead of the default,
|
||||
\fB/etc/rndc.key\fP\&. The key in \fB/etc/rndc.key\fP is used to
|
||||
authenticate commands sent to the server if the config\-file does not
|
||||
exist.
|
||||
.TP
|
||||
\fB\-s\fP server
|
||||
server is the name or address of the server which matches a server
|
||||
.B \fB\-s server\fP
|
||||
\fBserver\fP is the name or address of the server which matches a server
|
||||
statement in the configuration file for \fBrndc\fP\&. If no server is
|
||||
supplied on the command line, the host named by the default\-server
|
||||
clause in the options statement of the \fBrndc\fP configuration file
|
||||
will be used.
|
||||
is used.
|
||||
.TP
|
||||
\fB\-p\fP port
|
||||
Send commands to TCP port port instead of BIND 9\(aqs default control
|
||||
.B \fB\-p port\fP
|
||||
This option instructs BIND 9 to send commands to TCP port \fBport\fP instead of its default control
|
||||
channel port, 953.
|
||||
.TP
|
||||
\fB\-q\fP
|
||||
Quiet mode: Message text returned by the server will not be printed
|
||||
except when there is an error.
|
||||
.B \fB\-q\fP
|
||||
This option sets quiet mode, where message text returned by the server is not printed
|
||||
unless there is an error.
|
||||
.TP
|
||||
\fB\-r\fP
|
||||
Instructs \fBrndc\fP to print the result code returned by \fBnamed\fP
|
||||
.B \fB\-r\fP
|
||||
This option instructs \fBrndc\fP to print the result code returned by \fBnamed\fP
|
||||
after executing the requested command (e.g., ISC_R_SUCCESS,
|
||||
ISC_R_FAILURE, etc).
|
||||
ISC_R_FAILURE, etc.).
|
||||
.TP
|
||||
\fB\-V\fP
|
||||
Enable verbose logging.
|
||||
.B \fB\-V\fP
|
||||
This option enables verbose logging.
|
||||
.TP
|
||||
\fB\-y\fP key_id
|
||||
Use the key key_id from the configuration file. key_id must be known
|
||||
by \fBnamed\fP with the same algorithm and secret string in order for
|
||||
control message validation to succeed. If no key_id is specified,
|
||||
\fBrndc\fP will first look for a key clause in the server statement of
|
||||
.B \fB\-y key_id\fP
|
||||
This option indicates use of the key \fBkey_id\fP from the configuration file. For control message validation to succeed, \fBkey_id\fP must be known
|
||||
by \fBnamed\fP with the same algorithm and secret string. If no \fBkey_id\fP is specified,
|
||||
\fBrndc\fP first looks for a key clause in the server statement of
|
||||
the server being used, or if no server statement is present for that
|
||||
host, then the default\-key clause of the options statement. Note that
|
||||
host, then in the default\-key clause of the options statement. Note that
|
||||
the configuration file contains shared secrets which are used to send
|
||||
authenticated control commands to name servers. It should therefore
|
||||
authenticated control commands to name servers, and should therefore
|
||||
not have general read or write access.
|
||||
.UNINDENT
|
||||
.SH COMMANDS
|
||||
@@ -120,45 +119,45 @@ Currently supported commands are:
|
||||
.INDENT 0.0
|
||||
.TP
|
||||
.B \fBaddzone\fP \fIzone\fP [\fIclass\fP [\fIview\fP]] \fIconfiguration\fP
|
||||
Add a zone while the server is running. This command requires the
|
||||
This command adds a zone while the server is running. This command requires the
|
||||
\fBallow\-new\-zones\fP option to be set to \fByes\fP\&. The configuration
|
||||
string specified on the command line is the zone configuration text
|
||||
that would ordinarily be placed in \fBnamed.conf(5)\fP\&.
|
||||
that would ordinarily be placed in \fBnamed.conf\fP\&.
|
||||
.sp
|
||||
The configuration is saved in a file called \fBviewname.nzf\fP (or, if
|
||||
\fBnamed(8)\fP is compiled with liblmdb, an LMDB database file called
|
||||
\fBviewname.nzd\fP). viewname is the name of the view, unless the view
|
||||
\fBnamed\fP is compiled with liblmdb, an LMDB database file called
|
||||
\fBviewname.nzd\fP). \fBviewname\fP is the name of the view, unless the view
|
||||
name contains characters that are incompatible with use as a file
|
||||
name, in which case a cryptographic hash of the view name is used
|
||||
instead. When \fBnamed(8)\fP is restarted, the file will be loaded into
|
||||
the view configuration, so that zones that were added can persist
|
||||
instead. When \fBnamed\fP is restarted, the file is loaded into
|
||||
the view configuration so that zones that were added can persist
|
||||
after a restart.
|
||||
.sp
|
||||
This sample \fBaddzone\fP command would add the zone \fBexample.com\fP to
|
||||
This sample \fBaddzone\fP command adds the zone \fBexample.com\fP to
|
||||
the default view:
|
||||
.sp
|
||||
\fB$\fP\fBrndc addzone example.com \(aq{ type master; file "example.com.db"; };\(aq\fP
|
||||
\fB$ \e rndc addzone example.com \(aq{ type master; file "example.com.db"; };\(aq\fP
|
||||
.sp
|
||||
(Note the brackets and semi\-colon around the zone configuration
|
||||
(Note the brackets around and semi\-colon after the zone configuration
|
||||
text.)
|
||||
.sp
|
||||
See also \fBrndc delzone\fP and \fBrndc modzone\fP\&.
|
||||
.TP
|
||||
\fBdelzone\fP [\fB\-clean\fP] \fIzone\fP [\fIclass\fP [\fIview\fP]]
|
||||
Delete a zone while the server is running.
|
||||
This command deletes a zone while the server is running.
|
||||
.sp
|
||||
If the \fB\-clean\fP argument is specified, the zone\(aqs master file (and
|
||||
journal file, if any) will be deleted along with the zone. Without
|
||||
the \fB\-clean\fP option, zone files must be cleaned up by hand. (If the
|
||||
zone is of type "slave" or "stub", the files needing to be cleaned up
|
||||
will be reported in the output of the \fBrndc delzone\fP command.)
|
||||
journal file, if any) are deleted along with the zone. Without
|
||||
the \fB\-clean\fP option, zone files must be deleted manually. (If the
|
||||
zone is of type \fBsecondary\fP or \fBstub\fP, the files needing to be removed
|
||||
are reported in the output of the \fBrndc delzone\fP command.)
|
||||
.sp
|
||||
If the zone was originally added via \fBrndc addzone\fP, then it will
|
||||
be removed permanently. However, if it was originally configured in
|
||||
\fBnamed.conf\fP, then that original configuration is still in place;
|
||||
when the server is restarted or reconfigured, the zone will come
|
||||
back. To remove it permanently, it must also be removed from
|
||||
\fBnamed.conf\fP
|
||||
If the zone was originally added via \fBrndc addzone\fP, then it is
|
||||
removed permanently. However, if it was originally configured in
|
||||
\fBnamed.conf\fP, then that original configuration remains in place;
|
||||
when the server is restarted or reconfigured, the zone is
|
||||
recreated. To remove it permanently, it must also be removed from
|
||||
\fBnamed.conf\fP\&.
|
||||
.sp
|
||||
See also \fBrndc addzone\fP and \fBrndc modzone\fP\&.
|
||||
.TP
|
||||
@@ -167,79 +166,79 @@ Show the DNSSEC signing state for the specified zone. Requires the
|
||||
zone to have a "dnssec\-policy".
|
||||
.TP
|
||||
\fBdnstap\fP ( \fB\-reopen\fP | \fB\-roll\fP [\fInumber\fP] )
|
||||
Close and re\-open DNSTAP output files. \fBrndc dnstap \-reopen\fP allows
|
||||
the output file to be renamed externally, so that \fBnamed(8)\fP can
|
||||
This command closes and re\-opens DNSTAP output files. \fBrndc dnstap \-reopen\fP allows
|
||||
the output file to be renamed externally, so that \fBnamed\fP can
|
||||
truncate and re\-open it. \fBrndc dnstap \-roll\fP causes the output file
|
||||
to be rolled automatically, similar to log files; the most recent
|
||||
to be rolled automatically, similar to log files. The most recent
|
||||
output file has ".0" appended to its name; the previous most recent
|
||||
output file is moved to ".1", and so on. If number is specified, then
|
||||
output file is moved to ".1", and so on. If \fBnumber\fP is specified, then
|
||||
the number of backup log files is limited to that number.
|
||||
.TP
|
||||
\fBdumpdb\fP [\fB\-all\fP | \fB\-cache\fP | \fB\-zones\fP | \fB\-adb\fP | \fB\-bad\fP | \fB\-fail\fP] [\fIview ...\fP]
|
||||
Dump the server\(aqs caches (default) and/or zones to the dump file for
|
||||
This command dumps the server\(aqs caches (default) and/or zones to the dump file for
|
||||
the specified views. If no view is specified, all views are dumped.
|
||||
(See the \fBdump\-file\fP option in the BIND 9 Administrator Reference
|
||||
Manual.)
|
||||
.TP
|
||||
.B \fBflush\fP
|
||||
Flushes the server\(aqs cache.
|
||||
This command flushes the server\(aqs cache.
|
||||
.TP
|
||||
.B \fBflushname\fP \fIname\fP [\fIview\fP]
|
||||
Flushes the given name from the view\(aqs DNS cache and, if applicable,
|
||||
from the view\(aqs nameserver address database, bad server cache and
|
||||
This command flushes the given name from the view\(aqs DNS cache and, if applicable,
|
||||
from the view\(aqs nameserver address database, bad server cache, and
|
||||
SERVFAIL cache.
|
||||
.TP
|
||||
.B \fBflushtree\fP \fIname\fP [\fIview\fP]
|
||||
Flushes the given name, and all of its subdomains, from the view\(aqs
|
||||
This command flushes the given name, and all of its subdomains, from the view\(aqs
|
||||
DNS cache, address database, bad server cache, and SERVFAIL cache.
|
||||
.TP
|
||||
.B \fBfreeze\fP [\fIzone\fP [\fIclass\fP [\fIview\fP]]]
|
||||
Suspend updates to a dynamic zone. If no zone is specified, then all
|
||||
This command suspends updates to a dynamic zone. If no zone is specified, then all
|
||||
zones are suspended. This allows manual edits to be made to a zone
|
||||
normally updated by dynamic update. It also causes changes in the
|
||||
normally updated by dynamic update, and causes changes in the
|
||||
journal file to be synced into the master file. All dynamic update
|
||||
attempts will be refused while the zone is frozen.
|
||||
attempts are refused while the zone is frozen.
|
||||
.sp
|
||||
See also \fBrndc thaw\fP\&.
|
||||
.TP
|
||||
\fBhalt\fP [\fB\-p\fP]
|
||||
Stop the server immediately. Recent changes made through dynamic
|
||||
update or IXFR are not saved to the master files, but will be rolled
|
||||
This command stops the server immediately. Recent changes made through dynamic
|
||||
update or IXFR are not saved to the master files, but are rolled
|
||||
forward from the journal files when the server is restarted. If
|
||||
\fB\-p\fP is specified \fBnamed(8)\fP\(aqs process id is returned. This allows
|
||||
an external process to determine when \fBnamed(8)\fP had completed
|
||||
\fB\-p\fP is specified, \fBnamed\fP\(aqs process ID is returned. This allows
|
||||
an external process to determine when \fBnamed\fP has completed
|
||||
halting.
|
||||
.sp
|
||||
See also \fBrndc stop\fP\&.
|
||||
.TP
|
||||
.B \fBloadkeys\fP [\fIzone\fP [\fIclass\fP [\fIview\fP]]]
|
||||
Fetch all DNSSEC keys for the given zone from the key directory. If
|
||||
they are within their publication period, merge them into the
|
||||
This command fetches all DNSSEC keys for the given zone from the key directory. If
|
||||
they are within their publication period, they are merged into the
|
||||
zone\(aqs DNSKEY RRset. Unlike \fBrndc sign\fP, however, the zone is not
|
||||
immediately re\-signed by the new keys, but is allowed to
|
||||
incrementally re\-sign over time.
|
||||
.sp
|
||||
This command requires that zone is configured with a \fBdnssec\-policy\fP, or
|
||||
the \fBauto\-dnssec\fP zone option be set to \fBmaintain\fP, and also requires the
|
||||
This command requires that the zone be configured with a \fBdnssec\-policy\fP, or
|
||||
that the \fBauto\-dnssec\fP zone option be set to \fBmaintain\fP, and also requires the
|
||||
zone to be configured to allow dynamic DNS. (See "Dynamic Update Policies" in
|
||||
the Administrator Reference Manual for more details.)
|
||||
.TP
|
||||
.B \fBmanaged\-keys\fP (\fIstatus\fP | \fIrefresh\fP | \fIsync\fP | \fIdestroy\fP) [\fIclass\fP [\fIview\fP]]
|
||||
Inspect and control the "managed\-keys" database which handles
|
||||
This command inspects and controls the "managed\-keys" database which handles
|
||||
\fI\%RFC 5011\fP DNSSEC trust anchor maintenance. If a view is specified, these
|
||||
commands are applied to that view; otherwise they are applied to all
|
||||
commands are applied to that view; otherwise, they are applied to all
|
||||
views.
|
||||
.INDENT 7.0
|
||||
.IP \(bu 2
|
||||
When run with the \fBstatus\fP keyword, prints the current status of
|
||||
When run with the \fBstatus\fP keyword, this prints the current status of
|
||||
the managed\-keys database.
|
||||
.IP \(bu 2
|
||||
When run with the \fBrefresh\fP keyword, forces an immediate refresh
|
||||
When run with the \fBrefresh\fP keyword, this forces an immediate refresh
|
||||
query to be sent for all the managed keys, updating the
|
||||
managed\-keys database if any new keys are found, without waiting
|
||||
the normal refresh interval.
|
||||
.IP \(bu 2
|
||||
When run with the \fBsync\fP keyword, forces an immediate dump of
|
||||
When run with the \fBsync\fP keyword, this forces an immediate dump of
|
||||
the managed\-keys database to disk (in the file
|
||||
\fBmanaged\-keys.bind\fP or (\fBviewname.mkeys\fP). This synchronizes
|
||||
the database with its journal file, so that the database\(aqs current
|
||||
@@ -251,12 +250,12 @@ This command should be used only with extreme caution.
|
||||
.sp
|
||||
Existing keys that are already trusted are not deleted from
|
||||
memory; DNSSEC validation can continue after this command is used.
|
||||
However, key maintenance operations will cease until \fBnamed(8)\fP is
|
||||
restarted or reconfigured, and all existing key maintenance state
|
||||
will be deleted.
|
||||
However, key maintenance operations cease until \fBnamed\fP is
|
||||
restarted or reconfigured, and all existing key maintenance states
|
||||
are deleted.
|
||||
.sp
|
||||
Running \fBrndc reconfig\fP or restarting \fBnamed(8)\fP immediately
|
||||
after this command will cause key maintenance to be reinitialized
|
||||
Running \fBrndc reconfig\fP or restarting \fBnamed\fP immediately
|
||||
after this command causes key maintenance to be reinitialized
|
||||
from scratch, just as if the server were being started for the
|
||||
first time. This is primarily intended for testing, but it may
|
||||
also be used, for example, to jumpstart the acquisition of new
|
||||
@@ -265,33 +264,33 @@ repair for key maintenance problems.
|
||||
.UNINDENT
|
||||
.TP
|
||||
.B \fBmodzone\fP \fIzone\fP [\fIclass\fP [\fIview\fP]] \fIconfiguration\fP
|
||||
Modify the configuration of a zone while the server is running. This
|
||||
This command modifies the configuration of a zone while the server is running. This
|
||||
command requires the \fBallow\-new\-zones\fP option to be set to \fByes\fP\&.
|
||||
As with \fBaddzone\fP, the configuration string specified on the
|
||||
command line is the zone configuration text that would ordinarily be
|
||||
placed in \fBnamed.conf\fP\&.
|
||||
.sp
|
||||
If the zone was originally added via \fBrndc addzone\fP, the
|
||||
configuration changes will be recorded permanently and will still be
|
||||
configuration changes are recorded permanently and are still
|
||||
in effect after the server is restarted or reconfigured. However, if
|
||||
it was originally configured in \fBnamed.conf\fP, then that original
|
||||
configuration is still in place; when the server is restarted or
|
||||
reconfigured, the zone will revert to its original configuration. To
|
||||
configuration remains in place; when the server is restarted or
|
||||
reconfigured, the zone reverts to its original configuration. To
|
||||
make the changes permanent, it must also be modified in
|
||||
\fBnamed.conf\fP
|
||||
\fBnamed.conf\fP\&.
|
||||
.sp
|
||||
See also \fBrndc addzone\fP and \fBrndc delzone\fP\&.
|
||||
.TP
|
||||
.B \fBnotify\fP \fIzone\fP [\fIclass\fP [\fIview\fP]]
|
||||
Resend NOTIFY messages for the zone.
|
||||
This command resends NOTIFY messages for the zone.
|
||||
.TP
|
||||
.B \fBnotrace\fP
|
||||
Sets the server\(aqs debugging level to 0.
|
||||
This command sets the server\(aqs debugging level to 0.
|
||||
.sp
|
||||
See also \fBrndc trace\fP\&.
|
||||
.TP
|
||||
\fBnta\fP [( \fB\-class\fP \fIclass\fP | \fB\-dump\fP | \fB\-force\fP | \fB\-remove\fP | \fB\-lifetime\fP \fIduration\fP)] \fIdomain\fP [\fIview\fP]
|
||||
Sets a DNSSEC negative trust anchor (NTA) for \fBdomain\fP, with a
|
||||
This command sets a DNSSEC negative trust anchor (NTA) for \fBdomain\fP, with a
|
||||
lifetime of \fBduration\fP\&. The default lifetime is configured in
|
||||
\fBnamed.conf\fP via the \fBnta\-lifetime\fP option, and defaults to one
|
||||
hour. The lifetime cannot exceed one week.
|
||||
@@ -299,15 +298,15 @@ hour. The lifetime cannot exceed one week.
|
||||
A negative trust anchor selectively disables DNSSEC validation for
|
||||
zones that are known to be failing because of misconfiguration rather
|
||||
than an attack. When data to be validated is at or below an active
|
||||
NTA (and above any other configured trust anchors), \fBnamed(8)\fP will
|
||||
abort the DNSSEC validation process and treat the data as insecure
|
||||
rather than bogus. This continues until the NTA\(aqs lifetime is
|
||||
NTA (and above any other configured trust anchors), \fBnamed\fP
|
||||
aborts the DNSSEC validation process and treats the data as insecure
|
||||
rather than bogus. This continues until the NTA\(aqs lifetime has
|
||||
elapsed.
|
||||
.sp
|
||||
NTAs persist across restarts of the \fBnamed(8)\fP server. The NTAs for a
|
||||
view are saved in a file called \fBname.nta\fP, where name is the name
|
||||
of the view, or if it contains characters that are incompatible with
|
||||
use as a file name, a cryptographic hash generated from the name of
|
||||
NTAs persist across restarts of the \fBnamed\fP server. The NTAs for a
|
||||
view are saved in a file called \fBname.nta\fP, where \fBname\fP is the name
|
||||
of the view; if it contains characters that are incompatible with
|
||||
use as a file name, a cryptographic hash is generated from the name of
|
||||
the view.
|
||||
.sp
|
||||
An existing NTA can be removed by using the \fB\-remove\fP option.
|
||||
@@ -315,18 +314,18 @@ An existing NTA can be removed by using the \fB\-remove\fP option.
|
||||
An NTA\(aqs lifetime can be specified with the \fB\-lifetime\fP option.
|
||||
TTL\-style suffixes can be used to specify the lifetime in seconds,
|
||||
minutes, or hours. If the specified NTA already exists, its lifetime
|
||||
will be updated to the new value. Setting \fBlifetime\fP to zero is
|
||||
is updated to the new value. Setting \fBlifetime\fP to zero is
|
||||
equivalent to \fB\-remove\fP\&.
|
||||
.sp
|
||||
If the \fB\-dump\fP is used, any other arguments are ignored, and a list
|
||||
of existing NTAs is printed (note that this may include NTAs that are
|
||||
expired but have not yet been cleaned up).
|
||||
If \fB\-dump\fP is used, any other arguments are ignored and a list
|
||||
of existing NTAs is printed. Note that this may include NTAs that are
|
||||
expired but have not yet been cleaned up.
|
||||
.sp
|
||||
Normally, \fBnamed(8)\fP will periodically test to see whether data below
|
||||
Normally, \fBnamed\fP periodically tests to see whether data below
|
||||
an NTA can now be validated (see the \fBnta\-recheck\fP option in the
|
||||
Administrator Reference Manual for details). If data can be
|
||||
validated, then the NTA is regarded as no longer necessary, and will
|
||||
be allowed to expire early. The \fB\-force\fP overrides this behavior
|
||||
validated, then the NTA is regarded as no longer necessary and is
|
||||
allowed to expire early. The \fB\-force\fP parameter overrides this behavior
|
||||
and forces an NTA to persist for its entire lifetime, regardless of
|
||||
whether data could be validated if the NTA were not present.
|
||||
.sp
|
||||
@@ -337,65 +336,65 @@ supported.
|
||||
All of these options can be shortened, i.e., to \fB\-l\fP, \fB\-r\fP,
|
||||
\fB\-d\fP, \fB\-f\fP, and \fB\-c\fP\&.
|
||||
.sp
|
||||
Unrecognized options are treated as errors. To reference a domain or
|
||||
view name that begins with a hyphen, use a double\-hyphen on the
|
||||
Unrecognized options are treated as errors. To refer to a domain or
|
||||
view name that begins with a hyphen, use a double\-hyphen (\-\-) on the
|
||||
command line to indicate the end of options.
|
||||
.TP
|
||||
.B \fBquerylog\fP [(\fIon\fP | \fIoff\fP)]
|
||||
Enable or disable query logging. (For backward compatibility, this
|
||||
This command enables or disables query logging. For backward compatibility, this
|
||||
command can also be used without an argument to toggle query logging
|
||||
on and off.)
|
||||
on and off.
|
||||
.sp
|
||||
Query logging can also be enabled by explicitly directing the
|
||||
\fBqueries\fP \fBcategory\fP to a \fBchannel\fP in the \fBlogging\fP section
|
||||
of \fBnamed.conf\fP or by specifying \fBquerylog yes;\fP in the
|
||||
of \fBnamed.conf\fP, or by specifying \fBquerylog yes;\fP in the
|
||||
\fBoptions\fP section of \fBnamed.conf\fP\&.
|
||||
.TP
|
||||
.B \fBreconfig\fP
|
||||
Reload the configuration file and load new zones, but do not reload
|
||||
This command reloads the configuration file and loads new zones, but does not reload
|
||||
existing zone files even if they have changed. This is faster than a
|
||||
full \fBreload\fP when there is a large number of zones because it
|
||||
avoids the need to examine the modification times of the zones files.
|
||||
full \fBreload\fP when there is a large number of zones, because it
|
||||
avoids the need to examine the modification times of the zone files.
|
||||
.TP
|
||||
.B \fBrecursing\fP
|
||||
Dump the list of queries \fBnamed(8)\fP is currently recursing on, and the
|
||||
This command dumps the list of queries \fBnamed\fP is currently recursing on, and the
|
||||
list of domains to which iterative queries are currently being sent.
|
||||
(The second list includes the number of fetches currently active for
|
||||
The second list includes the number of fetches currently active for
|
||||
the given domain, and how many have been passed or dropped because of
|
||||
the \fBfetches\-per\-zone\fP option.)
|
||||
the \fBfetches\-per\-zone\fP option.
|
||||
.TP
|
||||
.B \fBrefresh\fP \fIzone\fP [\fIclass\fP [\fIview\fP]]
|
||||
Schedule zone maintenance for the given zone.
|
||||
This command schedules zone maintenance for the given zone.
|
||||
.TP
|
||||
.B \fBreload\fP
|
||||
Reload configuration file and zones.
|
||||
This command reloads the configuration file and zones.
|
||||
.TP
|
||||
.B \fBreload\fP \fIzone\fP [\fIclass\fP [\fIview\fP]]
|
||||
Reload the given zone.
|
||||
This command reloads the given zone.
|
||||
.TP
|
||||
.B \fBretransfer\fP \fIzone\fP [\fIclass\fP [\fIview\fP]]
|
||||
Retransfer the given slave zone from the master server.
|
||||
This command retransfers the given secondary zone from the primary server.
|
||||
.sp
|
||||
If the zone is configured to use \fBinline\-signing\fP, the signed
|
||||
version of the zone is discarded; after the retransfer of the
|
||||
unsigned version is complete, the signed version will be regenerated
|
||||
with all new signatures.
|
||||
unsigned version is complete, the signed version is regenerated
|
||||
with new signatures.
|
||||
.TP
|
||||
.B \fBscan\fP
|
||||
Scan the list of available network interfaces for changes, without
|
||||
This command scans the list of available network interfaces for changes, without
|
||||
performing a full \fBreconfig\fP or waiting for the
|
||||
\fBinterface\-interval\fP timer.
|
||||
.TP
|
||||
\fBsecroots\fP [\fB\-\fP] [\fIview\fP ...]
|
||||
Dump the security roots (i.e., trust anchors configured via
|
||||
This command dumps the security roots (i.e., trust anchors configured via
|
||||
\fBtrust\-anchors\fP, or the \fBmanaged\-keys\fP or \fBtrusted\-keys\fP statements
|
||||
(both deprecated), or \fBdnssec\-validation auto\fP) and negative trust anchors
|
||||
[both deprecated], or \fBdnssec\-validation auto\fP) and negative trust anchors
|
||||
for the specified views. If no view is specified, all views are
|
||||
dumped. Security roots will indicate whether they are configured as trusted
|
||||
dumped. Security roots indicate whether they are configured as trusted
|
||||
keys, managed keys, or initializing managed keys (managed keys that have not
|
||||
yet been updated by a successful key refresh query).
|
||||
.sp
|
||||
If the first argument is "\-", then the output is returned via the
|
||||
If the first argument is \fB\-\fP, then the output is returned via the
|
||||
\fBrndc\fP response channel and printed to the standard output.
|
||||
Otherwise, it is written to the secroots dump file, which defaults to
|
||||
\fBnamed.secroots\fP, but can be overridden via the \fBsecroots\-file\fP
|
||||
@@ -404,43 +403,43 @@ option in \fBnamed.conf\fP\&.
|
||||
See also \fBrndc managed\-keys\fP\&.
|
||||
.TP
|
||||
\fBserve\-stale\fP (\fBon\fP | \fBoff\fP | \fBreset\fP | \fBstatus\fP) [\fIclass\fP [\fIview\fP]]
|
||||
Enable, disable, reset, or report the current status of the serving
|
||||
This command enables, disables, resets, or reports the current status of the serving
|
||||
of stale answers as configured in \fBnamed.conf\fP\&.
|
||||
.sp
|
||||
If serving of stale answers is disabled by \fBrndc\-serve\-stale off\fP,
|
||||
then it will remain disabled even if \fBnamed(8)\fP is reloaded or
|
||||
then it remains disabled even if \fBnamed\fP is reloaded or
|
||||
reconfigured. \fBrndc serve\-stale reset\fP restores the setting as
|
||||
configured in \fBnamed.conf\fP\&.
|
||||
.sp
|
||||
\fBrndc serve\-stale status\fP will report whether serving of stale
|
||||
\fBrndc serve\-stale status\fP reports whether serving of stale
|
||||
answers is currently enabled, disabled by the configuration, or
|
||||
disabled by \fBrndc\fP\&. It will also report the values of
|
||||
disabled by \fBrndc\fP\&. It also reports the values of
|
||||
\fBstale\-answer\-ttl\fP and \fBmax\-stale\-ttl\fP\&.
|
||||
.TP
|
||||
.B \fBshowzone\fP \fIzone\fP [\fIclass\fP [\fIview\fP]]
|
||||
Print the configuration of a running zone.
|
||||
This command prints the configuration of a running zone.
|
||||
.sp
|
||||
See also \fBrndc zonestatus\fP\&.
|
||||
.TP
|
||||
.B \fBsign\fP \fIzone\fP [\fIclass\fP [\fIview\fP]]
|
||||
Fetch all DNSSEC keys for the given zone from the key directory (see
|
||||
This command fetches all DNSSEC keys for the given zone from the key directory (see
|
||||
the \fBkey\-directory\fP option in the BIND 9 Administrator Reference
|
||||
Manual). If they are within their publication period, merge them into
|
||||
Manual). If they are within their publication period, they are merged into
|
||||
the zone\(aqs DNSKEY RRset. If the DNSKEY RRset is changed, then the
|
||||
zone is automatically re\-signed with the new key set.
|
||||
.sp
|
||||
This command requires that the zone is configure with a \fBdnssec\-policy\fP, or
|
||||
This command requires that the zone be configured with a \fBdnssec\-policy\fP, or
|
||||
that the \fBauto\-dnssec\fP zone option be set to \fBallow\fP or \fBmaintain\fP,
|
||||
and also requires the zone to be configured to allow dynamic DNS. (See
|
||||
"Dynamic Update Policies" in the Administrator Reference Manual for more
|
||||
"Dynamic Update Policies" in the BIND 9 Administrator Reference Manual for more
|
||||
details.)
|
||||
.sp
|
||||
See also \fBrndc loadkeys\fP\&.
|
||||
.TP
|
||||
\fBsigning\fP [(\fB\-list\fP | \fB\-clear\fP \fIkeyid/algorithm\fP | \fB\-clear\fP \fIall\fP | \fB\-nsec3param\fP ( \fIparameters\fP | none ) | \fB\-serial\fP \fIvalue\fP ) \fIzone\fP [\fIclass\fP [\fIview\fP]]
|
||||
List, edit, or remove the DNSSEC signing state records for the
|
||||
specified zone. The status of ongoing DNSSEC operations (such as
|
||||
signing or generating NSEC3 chains) is stored in the zone in the form
|
||||
This command lists, edits, or removes the DNSSEC signing\-state records for the
|
||||
specified zone. The status of ongoing DNSSEC operations, such as
|
||||
signing or generating NSEC3 chains, is stored in the zone in the form
|
||||
of DNS resource records of type \fBsig\-signing\-type\fP\&.
|
||||
\fBrndc signing \-list\fP converts these records into a human\-readable
|
||||
form, indicating which keys are currently signing or have finished
|
||||
@@ -450,22 +449,22 @@ removed.
|
||||
\fBrndc signing \-clear\fP can remove a single key (specified in the
|
||||
same format that \fBrndc signing \-list\fP uses to display it), or all
|
||||
keys. In either case, only completed keys are removed; any record
|
||||
indicating that a key has not yet finished signing the zone will be
|
||||
indicating that a key has not yet finished signing the zone is
|
||||
retained.
|
||||
.sp
|
||||
\fBrndc signing \-nsec3param\fP sets the NSEC3 parameters for a zone.
|
||||
This is the only supported mechanism for using NSEC3 with
|
||||
\fBinline\-signing\fP zones. Parameters are specified in the same format
|
||||
as an NSEC3PARAM resource record: hash algorithm, flags, iterations,
|
||||
and salt, in that order.
|
||||
as an NSEC3PARAM resource record: \fBhash algorithm\fP, \fBflags\fP, \fBiterations\fP,
|
||||
and \fBsalt\fP, in that order.
|
||||
.sp
|
||||
Currently, the only defined value for hash algorithm is \fB1\fP,
|
||||
Currently, the only defined value for \fBhash algorithm\fP is \fB1\fP,
|
||||
representing SHA\-1. The \fBflags\fP may be set to \fB0\fP or \fB1\fP,
|
||||
depending on whether you wish to set the opt\-out bit in the NSEC3
|
||||
chain. \fBiterations\fP defines the number of additional times to apply
|
||||
depending on whether the opt\-out bit in the NSEC3
|
||||
chain should be set. \fBiterations\fP defines the number of additional times to apply
|
||||
the algorithm when generating an NSEC3 hash. The \fBsalt\fP is a string
|
||||
of data expressed in hexadecimal, a hyphen (\fI\-\(aq) if no salt is to be
|
||||
used, or the keyword \(ga\(gaauto\(ga\fP, which causes \fBnamed(8)\fP to generate a
|
||||
used, or the keyword \(ga\(gaauto\(ga\fP, which causes \fBnamed\fP to generate a
|
||||
random 64\-bit salt.
|
||||
.sp
|
||||
So, for example, to create an NSEC3 chain using the SHA\-1 hash
|
||||
@@ -478,81 +477,81 @@ the opt\-out flag, 15 iterations, and no salt, use:
|
||||
replaces it with NSEC.
|
||||
.sp
|
||||
\fBrndc signing \-serial value\fP sets the serial number of the zone to
|
||||
value. If the value would cause the serial number to go backwards it
|
||||
will be rejected. The primary use is to set the serial on inline
|
||||
\fBvalue\fP\&. If the value would cause the serial number to go backwards, it
|
||||
is rejected. The primary use of this parameter is to set the serial number on inline
|
||||
signed zones.
|
||||
.TP
|
||||
.B \fBstats\fP
|
||||
Write server statistics to the statistics file. (See the
|
||||
This command writes server statistics to the statistics file. (See the
|
||||
\fBstatistics\-file\fP option in the BIND 9 Administrator Reference
|
||||
Manual.)
|
||||
.TP
|
||||
.B \fBstatus\fP
|
||||
Display status of the server. Note that the number of zones includes
|
||||
the internal \fBbind/CH\fP zone and the default \fB\&./IN\fP hint zone if
|
||||
there is not an explicit root zone configured.
|
||||
This command displays the status of the server. Note that the number of zones includes
|
||||
the internal \fBbind/CH\fP zone and the default \fB\&./IN\fP hint zone, if
|
||||
there is no explicit root zone configured.
|
||||
.TP
|
||||
\fBstop\fP \fB\-p\fP
|
||||
Stop the server, making sure any recent changes made through dynamic
|
||||
This command stops the server, making sure any recent changes made through dynamic
|
||||
update or IXFR are first saved to the master files of the updated
|
||||
zones. If \fB\-p\fP is specified \fBnamed(8)\fP\(aqs process id is returned.
|
||||
This allows an external process to determine when \fBnamed(8)\fP had
|
||||
zones. If \fB\-p\fP is specified, \fBnamed(8)\(ga\(aqs process ID is returned.
|
||||
This allows an external process to determine when \(ga\(ganamed\fP has
|
||||
completed stopping.
|
||||
.sp
|
||||
See also \fBrndc halt\fP\&.
|
||||
.TP
|
||||
\fBsync\fP \fB\-clean\fP [\fIzone\fP [\fIclass\fP [\fIview\fP]]]
|
||||
Sync changes in the journal file for a dynamic zone to the master
|
||||
This command syncs changes in the journal file for a dynamic zone to the master
|
||||
file. If the "\-clean" option is specified, the journal file is also
|
||||
removed. If no zone is specified, then all zones are synced.
|
||||
.TP
|
||||
.B \fBtcp\-timeouts\fP [\fIinitial\fP \fIidle\fP \fIkeepalive\fP \fIadvertised\fP]
|
||||
When called without arguments, display the current values of the
|
||||
When called without arguments, this command displays the current values of the
|
||||
\fBtcp\-initial\-timeout\fP, \fBtcp\-idle\-timeout\fP,
|
||||
\fBtcp\-keepalive\-timeout\fP and \fBtcp\-advertised\-timeout\fP options.
|
||||
When called with arguments, update these values. This allows an
|
||||
administrator to make rapid adjustments when under a denial of
|
||||
service attack. See the descriptions of these options in the BIND 9
|
||||
\fBtcp\-keepalive\-timeout\fP, and \fBtcp\-advertised\-timeout\fP options.
|
||||
When called with arguments, these values are updated. This allows an
|
||||
administrator to make rapid adjustments when under a
|
||||
denial\-of\-service (DoS) attack. See the descriptions of these options in the BIND 9
|
||||
Administrator Reference Manual for details of their use.
|
||||
.TP
|
||||
.B \fBthaw\fP [\fIzone\fP [\fIclass\fP [\fIview\fP]]]
|
||||
Enable updates to a frozen dynamic zone. If no zone is specified,
|
||||
This command enables updates to a frozen dynamic zone. If no zone is specified,
|
||||
then all frozen zones are enabled. This causes the server to reload
|
||||
the zone from disk, and re\-enables dynamic updates after the load has
|
||||
completed. After a zone is thawed, dynamic updates will no longer be
|
||||
completed. After a zone is thawed, dynamic updates are no longer
|
||||
refused. If the zone has changed and the \fBixfr\-from\-differences\fP
|
||||
option is in use, then the journal file will be updated to reflect
|
||||
option is in use, the journal file is updated to reflect
|
||||
changes in the zone. Otherwise, if the zone has changed, any existing
|
||||
journal file will be removed.
|
||||
journal file is removed.
|
||||
.sp
|
||||
See also \fBrndc freeze\fP\&.
|
||||
.TP
|
||||
.B \fBtrace\fP
|
||||
Increment the servers debugging level by one.
|
||||
This command increments the server\(aqs debugging level by one.
|
||||
.TP
|
||||
.B \fBtrace\fP \fIlevel\fP
|
||||
Sets the server\(aqs debugging level to an explicit value.
|
||||
This command sets the server\(aqs debugging level to an explicit value.
|
||||
.sp
|
||||
See also \fBrndc notrace\fP\&.
|
||||
.TP
|
||||
.B \fBtsig\-delete\fP \fIkeyname\fP [\fIview\fP]
|
||||
Delete a given TKEY\-negotiated key from the server. (This does not
|
||||
apply to statically configured TSIG keys.)
|
||||
This command deletes a given TKEY\-negotiated key from the server. This does not
|
||||
apply to statically configured TSIG keys.
|
||||
.TP
|
||||
.B \fBtsig\-list\fP
|
||||
List the names of all TSIG keys currently configured for use by
|
||||
\fBnamed(8)\fP in each view. The list both statically configured keys and
|
||||
This command lists the names of all TSIG keys currently configured for use by
|
||||
\fBnamed\fP in each view. The list includes both statically configured keys and
|
||||
dynamic TKEY\-negotiated keys.
|
||||
.TP
|
||||
\fBvalidation\fP (\fBon\fP | \fBoff\fP | \fBstatus\fP) [\fIview\fP ...]\(ga\(ga
|
||||
Enable, disable, or check the current status of DNSSEC validation. By
|
||||
This command enables, disables, or checks the current status of DNSSEC validation. By
|
||||
default, validation is enabled.
|
||||
.sp
|
||||
The cache is flushed when validation is turned on or off to avoid using data
|
||||
that might differ between states.
|
||||
.TP
|
||||
.B \fBzonestatus\fP \fIzone\fP [\fIclass\fP [\fIview\fP]]
|
||||
Displays the current status of the given zone, including the master
|
||||
This command displays the current status of the given zone, including the master
|
||||
file name and any include files from which it was loaded, when it was
|
||||
most recently loaded, the current serial number, the number of nodes,
|
||||
whether the zone supports dynamic updates, whether the zone is DNSSEC
|
||||
@@ -563,9 +562,9 @@ See also \fBrndc showzone\fP\&.
|
||||
.UNINDENT
|
||||
.sp
|
||||
\fBrndc\fP commands that specify zone names, such as \fBreload\fP,
|
||||
\fBretransfer\fP or \fBzonestatus\fP, can be ambiguous when applied to zones
|
||||
of type \fBredirect\fP\&. Redirect zones are always called ".", and can be
|
||||
confused with zones of type \fBhint\fP or with slaved copies of the root
|
||||
\fBretransfer\fP, or \fBzonestatus\fP, can be ambiguous when applied to zones
|
||||
of type \fBredirect\fP\&. Redirect zones are always called \fB\&.\fP, and can be
|
||||
confused with zones of type \fBhint\fP or with secondary copies of the root
|
||||
zone. To specify a redirect zone, use the special zone name
|
||||
\fB\-redirect\fP, without a trailing period. (With a trailing period, this
|
||||
would specify a zone called "\-redirect".)
|
||||
|
||||
@@ -48,39 +48,39 @@ C++ style: // to end of line
|
||||
Unix style: # to end of line
|
||||
.sp
|
||||
\fBrndc.conf\fP is much simpler than \fBnamed.conf\fP\&. The file uses three
|
||||
statements: an options statement, a server statement and a key
|
||||
statements: an options statement, a server statement, and a key
|
||||
statement.
|
||||
.sp
|
||||
The \fBoptions\fP statement contains five clauses. The \fBdefault\-server\fP
|
||||
clause is followed by the name or address of a name server. This host
|
||||
will be used when no name server is given as an argument to \fBrndc\fP\&.
|
||||
The \fBdefault\-key\fP clause is followed by the name of a key which is
|
||||
is used when no name server is given as an argument to \fBrndc\fP\&.
|
||||
The \fBdefault\-key\fP clause is followed by the name of a key, which is
|
||||
identified by a \fBkey\fP statement. If no \fBkeyid\fP is provided on the
|
||||
rndc command line, and no \fBkey\fP clause is found in a matching
|
||||
\fBserver\fP statement, this default key will be used to authenticate the
|
||||
\fBserver\fP statement, this default key is used to authenticate the
|
||||
server\(aqs commands and responses. The \fBdefault\-port\fP clause is followed
|
||||
by the port to connect to on the remote name server. If no \fBport\fP
|
||||
option is provided on the rndc command line, and no \fBport\fP clause is
|
||||
found in a matching \fBserver\fP statement, this default port will be used
|
||||
found in a matching \fBserver\fP statement, this default port is used
|
||||
to connect. The \fBdefault\-source\-address\fP and
|
||||
\fBdefault\-source\-address\-v6\fP clauses which can be used to set the IPv4
|
||||
\fBdefault\-source\-address\-v6\fP clauses can be used to set the IPv4
|
||||
and IPv6 source addresses respectively.
|
||||
.sp
|
||||
After the \fBserver\fP keyword, the server statement includes a string
|
||||
which is the hostname or address for a name server. The statement has
|
||||
three possible clauses: \fBkey\fP, \fBport\fP and \fBaddresses\fP\&. The key
|
||||
three possible clauses: \fBkey\fP, \fBport\fP, and \fBaddresses\fP\&. The key
|
||||
name must match the name of a key statement in the file. The port number
|
||||
specifies the port to connect to. If an \fBaddresses\fP clause is supplied
|
||||
these addresses will be used instead of the server name. Each address
|
||||
specifies the port to connect to. If an \fBaddresses\fP clause is supplied,
|
||||
these addresses are used instead of the server name. Each address
|
||||
can take an optional port. If an \fBsource\-address\fP or
|
||||
\fBsource\-address\-v6\fP of supplied then these will be used to specify the
|
||||
IPv4 and IPv6 source addresses respectively.
|
||||
\fBsource\-address\-v6\fP is supplied, it is used to specify the
|
||||
IPv4 and IPv6 source address, respectively.
|
||||
.sp
|
||||
The \fBkey\fP statement begins with an identifying string, the name of the
|
||||
key. The statement has two clauses. \fBalgorithm\fP identifies the
|
||||
authentication algorithm for \fBrndc\fP to use; currently only HMAC\-MD5
|
||||
(for compatibility), HMAC\-SHA1, HMAC\-SHA224, HMAC\-SHA256 (default),
|
||||
HMAC\-SHA384 and HMAC\-SHA512 are supported. This is followed by a secret
|
||||
HMAC\-SHA384, and HMAC\-SHA512 are supported. This is followed by a secret
|
||||
clause which contains the base\-64 encoding of the algorithm\(aqs
|
||||
authentication key. The base\-64 string is enclosed in double quotes.
|
||||
.sp
|
||||
@@ -88,7 +88,7 @@ There are two common ways to generate the base\-64 string for the secret.
|
||||
The BIND 9 program \fBrndc\-confgen\fP can be used to generate a random
|
||||
key, or the \fBmmencode\fP program, also known as \fBmimencode\fP, can be
|
||||
used to generate a base\-64 string from known input. \fBmmencode\fP does
|
||||
not ship with BIND 9 but is available on many systems. See the EXAMPLE
|
||||
not ship with BIND 9 but is available on many systems. See the Example
|
||||
section for sample command lines for each.
|
||||
.SH EXAMPLE
|
||||
.INDENT 0.0
|
||||
@@ -156,23 +156,23 @@ key testkey {
|
||||
.UNINDENT
|
||||
.UNINDENT
|
||||
.sp
|
||||
In the above example, \fBrndc\fP will by default use the server at
|
||||
localhost (127.0.0.1) and the key called samplekey. Commands to the
|
||||
localhost server will use the samplekey key, which must also be defined
|
||||
In the above example, \fBrndc\fP by default uses the server at
|
||||
localhost (127.0.0.1) and the key called "samplekey". Commands to the
|
||||
localhost server use the "samplekey" key, which must also be defined
|
||||
in the server\(aqs configuration file with the same name and secret. The
|
||||
key statement indicates that samplekey uses the HMAC\-SHA256 algorithm
|
||||
key statement indicates that "samplekey" uses the HMAC\-SHA256 algorithm
|
||||
and its secret clause contains the base\-64 encoding of the HMAC\-SHA256
|
||||
secret enclosed in double quotes.
|
||||
.sp
|
||||
If \fBrndc \-s testserver\fP is used then \fBrndc\fP will connect to server
|
||||
on localhost port 5353 using the key testkey.
|
||||
If \fBrndc \-s testserver\fP is used, then \fBrndc\fP connects to the server
|
||||
on localhost port 5353 using the key "testkey".
|
||||
.sp
|
||||
To generate a random secret with \fBrndc\-confgen\fP:
|
||||
.sp
|
||||
\fBrndc\-confgen\fP
|
||||
.sp
|
||||
A complete \fBrndc.conf\fP file, including the randomly generated key,
|
||||
will be written to the standard output. Commented\-out \fBkey\fP and
|
||||
is written to the standard output. Commented\-out \fBkey\fP and
|
||||
\fBcontrols\fP statements for \fBnamed.conf\fP are also printed.
|
||||
.sp
|
||||
To generate a base\-64 secret with \fBmmencode\fP:
|
||||
|
||||
Reference in New Issue
Block a user