mirror of
https://gitlab.isc.org/isc-projects/bind9
synced 2025-08-31 14:35:26 +00:00
fixed some brokwn .Ar macro calls that should have been .Fl calls
tidied up some clumsy English and missing option intros.
This commit is contained in:
Jim Reid
@@ -14,7 +14,7 @@
|
||||
.\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
|
||||
.\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
.\"
|
||||
.\" $Id: dnssec-keygen.8,v 1.2 2000/06/28 03:20:46 jim Exp $
|
||||
.\" $Id: dnssec-keygen.8,v 1.3 2000/06/28 23:40:58 jim Exp $
|
||||
.\"
|
||||
.Dd Jun 30, 2000
|
||||
.Dt DNSSEC-KEYGEN 8
|
||||
@@ -45,19 +45,19 @@ is defined in RFC2845.
|
||||
A short summary of the options and arguments to
|
||||
.Nm dnssec-keygen
|
||||
is printed by the
|
||||
.Ar h
|
||||
.Fl h
|
||||
(help) option.
|
||||
The
|
||||
.Ar a ,
|
||||
.Ar b ,
|
||||
.Fl a ,
|
||||
.Fl b ,
|
||||
and
|
||||
.Ar n
|
||||
.Fl n
|
||||
options and their arguments must be supplied when generating keys.
|
||||
The domain name that the key has to be generated for is given by
|
||||
.Ar name .
|
||||
.Pp
|
||||
The choice of encryption algorithm is selected by the
|
||||
.Ar a
|
||||
.Fl a
|
||||
option to
|
||||
.Nm dnssec-keygen .
|
||||
.Ar algorithm
|
||||
@@ -81,7 +81,7 @@ Implementations of TSIG must support HMAC-MD5.
|
||||
The number of bits in the key are determined by the
|
||||
.Ar keysize
|
||||
argument following the
|
||||
.Ar b
|
||||
.Fl b
|
||||
option.
|
||||
The choice of key size depends on the algorithm that is used.
|
||||
RSA keys must be between 512 and 2048 bits.
|
||||
@@ -91,7 +91,7 @@ of 64.
|
||||
The length of an HMAC-MD5 key can be between 1 and 512 bits.
|
||||
.Pp
|
||||
The
|
||||
.Ar -n
|
||||
.Fl n
|
||||
option specifies how the generated key will be used.
|
||||
.Ar nametype
|
||||
can be either
|
||||
@@ -111,13 +111,13 @@ are identical.
|
||||
is case-insensitive.
|
||||
.Pp
|
||||
The
|
||||
.Ar e
|
||||
.Fl e
|
||||
option can only be used when generating RSA keys.
|
||||
It tells
|
||||
.Nm dnssec-keygen
|
||||
to use a large exponent.
|
||||
When creating Diffie-Hellman keys, the
|
||||
.Ar g
|
||||
.Fl g
|
||||
option selects the Diffie-Hellman generator
|
||||
.Ar generator
|
||||
that is to be used.
|
||||
@@ -128,8 +128,10 @@ If no Diffie-Hellman generator is supplied a known prime
|
||||
from RFC2539 will be used if possible; otherwise 2 will be used as the
|
||||
generator.
|
||||
.Pp
|
||||
.Ar protocol-value
|
||||
sets the protocol value for the generated key.
|
||||
The
|
||||
.Fl p
|
||||
option sets the protocol value for the generated key to
|
||||
.Ar protocol-value .
|
||||
The default is 2 (email) for keys of type
|
||||
.Dv USER
|
||||
and 3 (DNSSEC) for all other key types.
|
||||
@@ -146,22 +148,25 @@ for generating random numbers,
|
||||
will prompt for some keyboard input and use the time intervals between
|
||||
keystrokes to provide some randomness.
|
||||
The
|
||||
.Ar r
|
||||
.Fl r
|
||||
option overrides this behaviour, making
|
||||
.Nm dnssec-keygen
|
||||
use
|
||||
.Ar randomdev
|
||||
as a source of random data.
|
||||
.Pp
|
||||
The strength value that the key will sign DNS resource records with is
|
||||
given by
|
||||
The key's strength value can be set with the
|
||||
.Fl s
|
||||
option.
|
||||
The generated key will sign DNS resource records
|
||||
with a strength value of
|
||||
.Ar strength-value .
|
||||
It should be a number between 0 and 15.
|
||||
The default strength is zero.
|
||||
The key strength field currently has no defined purpose in DNSSEC.
|
||||
.Pp
|
||||
The
|
||||
.Ar t
|
||||
.Fl t
|
||||
option indicates if the key is to be used for authentication or
|
||||
confidentiality.
|
||||
.Ar type
|
||||
@@ -191,7 +196,7 @@ defines that the key cannot be used for confidentiality though it can
|
||||
be used for authentication.
|
||||
.Pp
|
||||
The
|
||||
.Ar v
|
||||
.Fl v
|
||||
option can be used to make
|
||||
.Nm dnssec-keygen
|
||||
more verbose.
|
||||
|
||||
@@ -14,7 +14,7 @@
|
||||
.\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
|
||||
.\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
.\"
|
||||
.\" $Id: dnssec-makekeyset.8,v 1.2 2000/06/28 03:20:47 jim Exp $
|
||||
.\" $Id: dnssec-makekeyset.8,v 1.3 2000/06/28 23:40:59 jim Exp $
|
||||
.\"
|
||||
.Dd Jun 30, 2000
|
||||
.Dt DNSSEC-MAKEKEYSET 8
|
||||
@@ -60,7 +60,7 @@ into a key set.
|
||||
.Pp
|
||||
For any SIG records that are in the key set, the start time when the
|
||||
SIG records become valid is specified with the
|
||||
.Ar s
|
||||
.Fl s
|
||||
option.
|
||||
.Ar start-time
|
||||
can either be an absolute or relative date.
|
||||
@@ -70,12 +70,12 @@ A relative start time is supplied when
|
||||
.Ar start-time
|
||||
is given as +N: N seconds from the current time.
|
||||
If no
|
||||
.Ar s
|
||||
.Fl s
|
||||
option is supplied, the current date and time is used for the start
|
||||
time of the SIG records.
|
||||
.Pp
|
||||
The expiry date for the SIG records can be set by the
|
||||
.Ar e
|
||||
.Fl e
|
||||
option.
|
||||
Note that in this context, the expiry date specifies when the SIG
|
||||
records are no longer valid, not when they are deleted from caches on name
|
||||
@@ -99,7 +99,7 @@ defaults to an expire time of 30 days from the start time of the SIG
|
||||
records.
|
||||
.Pp
|
||||
An alternate source of random data can be specified with the
|
||||
.Ar r
|
||||
.Fl r
|
||||
option.
|
||||
.Ar randomdev
|
||||
is the name of the file to use to obtain random data.
|
||||
@@ -107,14 +107,14 @@ By default
|
||||
.Pa /dev/random
|
||||
is used if this device is available.
|
||||
If it is not provided by the operating system and no
|
||||
.Ar r
|
||||
.Fl r
|
||||
option is used,
|
||||
.Nm dnssec-makekeyset
|
||||
will prompt the user for input from the keyboard and use the time
|
||||
between keystrokes to derive some random data.
|
||||
.Pp
|
||||
The
|
||||
.Ar t
|
||||
.Fl t
|
||||
option is followed by a time-to-live argument
|
||||
.Ar TTL
|
||||
which indicates the TTL value that will be assigned to the assembled KEY
|
||||
@@ -122,14 +122,14 @@ and SIG records in the output file.
|
||||
.Ar TTL
|
||||
is expressed in seconds.
|
||||
If no
|
||||
.Ar t
|
||||
.Fl t
|
||||
option is provided,
|
||||
.Nm dnssec-makekeyset
|
||||
prints a warning and assumes that a default TTL of
|
||||
3600 seconds was required.
|
||||
.Pp
|
||||
The
|
||||
.Ar v
|
||||
.Fl v
|
||||
option can be used to make
|
||||
.Nm dnssec-makekeyset
|
||||
more verbose.
|
||||
@@ -140,7 +140,7 @@ increases,
|
||||
generates increasingly detailed reports about what it is doing.
|
||||
The default level is zero.
|
||||
An option of
|
||||
.Ar h
|
||||
.Fl h
|
||||
gets
|
||||
.Nm dnssec-makekeyset
|
||||
to print a short summary of its options and arguments.
|
||||
|
||||
@@ -14,7 +14,7 @@
|
||||
.\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
|
||||
.\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
.\"
|
||||
.\" $Id: dnssec-signkey.8,v 1.2 2000/06/28 03:20:48 jim Exp $
|
||||
.\" $Id: dnssec-signkey.8,v 1.3 2000/06/28 23:41:00 jim Exp $
|
||||
.\"
|
||||
.Dd Jun 30, 2000
|
||||
.Dt DNSSEC-SIGNKEY 8
|
||||
@@ -55,24 +55,24 @@ This allows the child's keys to be signed by more than 1 parent zone
|
||||
key if these exist.
|
||||
.Pp
|
||||
The
|
||||
.Ar p
|
||||
.Fl p
|
||||
option instructs
|
||||
.Nm dnssec-signkey
|
||||
to use pseudo-random data when signing the keys which is faster, but
|
||||
less secure, than using genuinely random data for signing.
|
||||
This option may be useful when there are many child zone keysets to
|
||||
sign and CPU resources are limited.
|
||||
sign of if the entropy source is limited.
|
||||
It could also be used for short-lived keys and signatures that don't
|
||||
require strengthening against cryptanalysis: for instance when the key
|
||||
will be discarded long before it could be compromised.
|
||||
.Pp
|
||||
An alternate file for obtaining random data can be used with the
|
||||
.Ar r
|
||||
.Fl r
|
||||
option.
|
||||
.Ar filename
|
||||
is the name of the file to use.
|
||||
If no
|
||||
.Ar r
|
||||
.Fl r
|
||||
option is used and the default file for random data
|
||||
.Pa /dev/random
|
||||
does not exist,
|
||||
@@ -82,7 +82,7 @@ The time between keystrokes will be measured and used to derive random
|
||||
data.
|
||||
.Pp
|
||||
The
|
||||
.Ar v
|
||||
.Fl v
|
||||
option can be used to make
|
||||
.Nm dnssec-signkey
|
||||
more verbose.
|
||||
@@ -94,7 +94,7 @@ generates increasingly detailed reports about what it is doing.
|
||||
The default level is zero.
|
||||
.Pp
|
||||
An option of
|
||||
.Ar h
|
||||
.Fl h
|
||||
makes
|
||||
.Nm dnssec-signkey
|
||||
print a short summary of its command line options
|
||||
|
||||
@@ -14,7 +14,7 @@
|
||||
.\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
|
||||
.\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
.\"
|
||||
.\" $Id: dnssec-signzone.8,v 1.2 2000/06/28 03:20:49 jim Exp $
|
||||
.\" $Id: dnssec-signzone.8,v 1.3 2000/06/28 23:41:01 jim Exp $
|
||||
.\"
|
||||
.Dd Jun 30, 2000
|
||||
.Dt DNSSEC-SIGNZONE 8
|
||||
@@ -66,7 +66,7 @@ current working directory used by
|
||||
.Ar zonefile
|
||||
is the name of the unsigned zone file.
|
||||
Unless the file name is the same as the name of the zone, the
|
||||
.Ar o
|
||||
.Fl o
|
||||
option should be given.
|
||||
.Ar origin
|
||||
will be the fully qualified domain origin for the zone.
|
||||
@@ -87,7 +87,7 @@ generates a file called
|
||||
.Ar zonefile.signed
|
||||
containing the signed zone file.
|
||||
This can be overridden by the
|
||||
.Ar f
|
||||
.Fl f
|
||||
option.
|
||||
Instead of this default file name, the signed zone file will be
|
||||
written to
|
||||
@@ -98,12 +98,12 @@ written to
|
||||
.Nm dnssec-signzone
|
||||
does not verify the signatures by default.
|
||||
The
|
||||
.Ar a
|
||||
.Fl a
|
||||
option makes it verify the signatures it generated.
|
||||
.Pp
|
||||
The date and time when the generated
|
||||
SIG records become valid can be specified with the
|
||||
.Ar s
|
||||
.Fl s
|
||||
option.
|
||||
.Ar start-time
|
||||
can either be an absolute or relative date.
|
||||
@@ -113,12 +113,12 @@ A relative start time is supplied when
|
||||
.Ar start-time
|
||||
is given as +N: N seconds from the current time.
|
||||
If no
|
||||
.Ar s
|
||||
.Fl s
|
||||
option is supplied, the current date and time is used for the start
|
||||
time of the SIG records.
|
||||
.Pp
|
||||
The expiry date for the SIG records can be set by the
|
||||
.Ar e
|
||||
.Fl e
|
||||
option.
|
||||
Note that in this context, the expiry date specifies when the SIG
|
||||
records are no longer valid, not when they are deleted from caches on name
|
||||
@@ -159,9 +159,9 @@ The default cycle time is quarter of the difference between the
|
||||
signature end and start dates for the current invocation of
|
||||
.Nm dnssec-signzone .
|
||||
So if the
|
||||
.Ar e
|
||||
.Fl e
|
||||
and
|
||||
.Ar s
|
||||
.Fl s
|
||||
options are not specified,
|
||||
.Nm dnssec-signzone
|
||||
generates signatures that are valid for 30 days from the current
|
||||
@@ -171,7 +171,7 @@ Therefore any SIG records that
|
||||
were due to expire in that time would be replaced with new ones.
|
||||
.Pp
|
||||
The
|
||||
.Ar c
|
||||
.Fl c
|
||||
option can be used to change the cycle time.
|
||||
.Ar cycle-time
|
||||
indicates the number of seconds from the current time that should be
|
||||
@@ -180,7 +180,7 @@ set the cycle time and
|
||||
determine when fresh SIG records should be generated.
|
||||
.Pp
|
||||
The
|
||||
.Ar p
|
||||
.Fl p
|
||||
option instructs
|
||||
.Nm dnssec-signzone
|
||||
to use pseudo-random data when signing the zone's resource records.
|
||||
@@ -192,7 +192,7 @@ require strengthening against cryptanalysis: for instance when the signatures
|
||||
will be discarded long before the signed data could be compromised.
|
||||
.Pp
|
||||
An alternate source of random data can be specified with the
|
||||
.Ar r
|
||||
.Fl r
|
||||
option.
|
||||
.Ar randomdev
|
||||
is the name of the file to use to obtain random data.
|
||||
@@ -200,21 +200,21 @@ By default
|
||||
.Pa /dev/random
|
||||
is used if this device is available.
|
||||
If it is not provided by the operating system and no
|
||||
.Ar r
|
||||
.Fl r
|
||||
option is used,
|
||||
.Nm dnssec-signzone
|
||||
will prompt the user for input from the keyboard and use the time
|
||||
between keystrokes to derive some random data.
|
||||
.Pp
|
||||
An option of
|
||||
.Ar h
|
||||
.Fl h
|
||||
makes
|
||||
.Nm dnssec-signzone
|
||||
print a short summary of its command line options
|
||||
and arguments.
|
||||
.Pp
|
||||
The
|
||||
.Ar v
|
||||
.Fl v
|
||||
option can be used to make
|
||||
.Nm dnssec-signzone
|
||||
more verbose.
|
||||
@@ -236,7 +236,7 @@ The zone file for this zone is
|
||||
.Dv example.com
|
||||
and it can be assumed to contain fully qualified domain names which
|
||||
means there is no need to use the
|
||||
.Ar o
|
||||
.Fl o
|
||||
option to set the domain origin.
|
||||
This zone file contains the keyset for
|
||||
.Dv example.com
|
||||
|
||||
@@ -14,7 +14,7 @@
|
||||
.\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
|
||||
.\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
.\"
|
||||
.\" $Id: dnssec-keygen.8,v 1.2 2000/06/28 03:20:46 jim Exp $
|
||||
.\" $Id: dnssec-keygen.8,v 1.3 2000/06/28 23:40:58 jim Exp $
|
||||
.\"
|
||||
.Dd Jun 30, 2000
|
||||
.Dt DNSSEC-KEYGEN 8
|
||||
@@ -45,19 +45,19 @@ is defined in RFC2845.
|
||||
A short summary of the options and arguments to
|
||||
.Nm dnssec-keygen
|
||||
is printed by the
|
||||
.Ar h
|
||||
.Fl h
|
||||
(help) option.
|
||||
The
|
||||
.Ar a ,
|
||||
.Ar b ,
|
||||
.Fl a ,
|
||||
.Fl b ,
|
||||
and
|
||||
.Ar n
|
||||
.Fl n
|
||||
options and their arguments must be supplied when generating keys.
|
||||
The domain name that the key has to be generated for is given by
|
||||
.Ar name .
|
||||
.Pp
|
||||
The choice of encryption algorithm is selected by the
|
||||
.Ar a
|
||||
.Fl a
|
||||
option to
|
||||
.Nm dnssec-keygen .
|
||||
.Ar algorithm
|
||||
@@ -81,7 +81,7 @@ Implementations of TSIG must support HMAC-MD5.
|
||||
The number of bits in the key are determined by the
|
||||
.Ar keysize
|
||||
argument following the
|
||||
.Ar b
|
||||
.Fl b
|
||||
option.
|
||||
The choice of key size depends on the algorithm that is used.
|
||||
RSA keys must be between 512 and 2048 bits.
|
||||
@@ -91,7 +91,7 @@ of 64.
|
||||
The length of an HMAC-MD5 key can be between 1 and 512 bits.
|
||||
.Pp
|
||||
The
|
||||
.Ar -n
|
||||
.Fl n
|
||||
option specifies how the generated key will be used.
|
||||
.Ar nametype
|
||||
can be either
|
||||
@@ -111,13 +111,13 @@ are identical.
|
||||
is case-insensitive.
|
||||
.Pp
|
||||
The
|
||||
.Ar e
|
||||
.Fl e
|
||||
option can only be used when generating RSA keys.
|
||||
It tells
|
||||
.Nm dnssec-keygen
|
||||
to use a large exponent.
|
||||
When creating Diffie-Hellman keys, the
|
||||
.Ar g
|
||||
.Fl g
|
||||
option selects the Diffie-Hellman generator
|
||||
.Ar generator
|
||||
that is to be used.
|
||||
@@ -128,8 +128,10 @@ If no Diffie-Hellman generator is supplied a known prime
|
||||
from RFC2539 will be used if possible; otherwise 2 will be used as the
|
||||
generator.
|
||||
.Pp
|
||||
.Ar protocol-value
|
||||
sets the protocol value for the generated key.
|
||||
The
|
||||
.Fl p
|
||||
option sets the protocol value for the generated key to
|
||||
.Ar protocol-value .
|
||||
The default is 2 (email) for keys of type
|
||||
.Dv USER
|
||||
and 3 (DNSSEC) for all other key types.
|
||||
@@ -146,22 +148,25 @@ for generating random numbers,
|
||||
will prompt for some keyboard input and use the time intervals between
|
||||
keystrokes to provide some randomness.
|
||||
The
|
||||
.Ar r
|
||||
.Fl r
|
||||
option overrides this behaviour, making
|
||||
.Nm dnssec-keygen
|
||||
use
|
||||
.Ar randomdev
|
||||
as a source of random data.
|
||||
.Pp
|
||||
The strength value that the key will sign DNS resource records with is
|
||||
given by
|
||||
The key's strength value can be set with the
|
||||
.Fl s
|
||||
option.
|
||||
The generated key will sign DNS resource records
|
||||
with a strength value of
|
||||
.Ar strength-value .
|
||||
It should be a number between 0 and 15.
|
||||
The default strength is zero.
|
||||
The key strength field currently has no defined purpose in DNSSEC.
|
||||
.Pp
|
||||
The
|
||||
.Ar t
|
||||
.Fl t
|
||||
option indicates if the key is to be used for authentication or
|
||||
confidentiality.
|
||||
.Ar type
|
||||
@@ -191,7 +196,7 @@ defines that the key cannot be used for confidentiality though it can
|
||||
be used for authentication.
|
||||
.Pp
|
||||
The
|
||||
.Ar v
|
||||
.Fl v
|
||||
option can be used to make
|
||||
.Nm dnssec-keygen
|
||||
more verbose.
|
||||
|
||||
@@ -14,7 +14,7 @@
|
||||
.\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
|
||||
.\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
.\"
|
||||
.\" $Id: dnssec-makekeyset.8,v 1.2 2000/06/28 03:20:47 jim Exp $
|
||||
.\" $Id: dnssec-makekeyset.8,v 1.3 2000/06/28 23:40:59 jim Exp $
|
||||
.\"
|
||||
.Dd Jun 30, 2000
|
||||
.Dt DNSSEC-MAKEKEYSET 8
|
||||
@@ -60,7 +60,7 @@ into a key set.
|
||||
.Pp
|
||||
For any SIG records that are in the key set, the start time when the
|
||||
SIG records become valid is specified with the
|
||||
.Ar s
|
||||
.Fl s
|
||||
option.
|
||||
.Ar start-time
|
||||
can either be an absolute or relative date.
|
||||
@@ -70,12 +70,12 @@ A relative start time is supplied when
|
||||
.Ar start-time
|
||||
is given as +N: N seconds from the current time.
|
||||
If no
|
||||
.Ar s
|
||||
.Fl s
|
||||
option is supplied, the current date and time is used for the start
|
||||
time of the SIG records.
|
||||
.Pp
|
||||
The expiry date for the SIG records can be set by the
|
||||
.Ar e
|
||||
.Fl e
|
||||
option.
|
||||
Note that in this context, the expiry date specifies when the SIG
|
||||
records are no longer valid, not when they are deleted from caches on name
|
||||
@@ -99,7 +99,7 @@ defaults to an expire time of 30 days from the start time of the SIG
|
||||
records.
|
||||
.Pp
|
||||
An alternate source of random data can be specified with the
|
||||
.Ar r
|
||||
.Fl r
|
||||
option.
|
||||
.Ar randomdev
|
||||
is the name of the file to use to obtain random data.
|
||||
@@ -107,14 +107,14 @@ By default
|
||||
.Pa /dev/random
|
||||
is used if this device is available.
|
||||
If it is not provided by the operating system and no
|
||||
.Ar r
|
||||
.Fl r
|
||||
option is used,
|
||||
.Nm dnssec-makekeyset
|
||||
will prompt the user for input from the keyboard and use the time
|
||||
between keystrokes to derive some random data.
|
||||
.Pp
|
||||
The
|
||||
.Ar t
|
||||
.Fl t
|
||||
option is followed by a time-to-live argument
|
||||
.Ar TTL
|
||||
which indicates the TTL value that will be assigned to the assembled KEY
|
||||
@@ -122,14 +122,14 @@ and SIG records in the output file.
|
||||
.Ar TTL
|
||||
is expressed in seconds.
|
||||
If no
|
||||
.Ar t
|
||||
.Fl t
|
||||
option is provided,
|
||||
.Nm dnssec-makekeyset
|
||||
prints a warning and assumes that a default TTL of
|
||||
3600 seconds was required.
|
||||
.Pp
|
||||
The
|
||||
.Ar v
|
||||
.Fl v
|
||||
option can be used to make
|
||||
.Nm dnssec-makekeyset
|
||||
more verbose.
|
||||
@@ -140,7 +140,7 @@ increases,
|
||||
generates increasingly detailed reports about what it is doing.
|
||||
The default level is zero.
|
||||
An option of
|
||||
.Ar h
|
||||
.Fl h
|
||||
gets
|
||||
.Nm dnssec-makekeyset
|
||||
to print a short summary of its options and arguments.
|
||||
|
||||
@@ -14,7 +14,7 @@
|
||||
.\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
|
||||
.\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
.\"
|
||||
.\" $Id: dnssec-signkey.8,v 1.2 2000/06/28 03:20:48 jim Exp $
|
||||
.\" $Id: dnssec-signkey.8,v 1.3 2000/06/28 23:41:00 jim Exp $
|
||||
.\"
|
||||
.Dd Jun 30, 2000
|
||||
.Dt DNSSEC-SIGNKEY 8
|
||||
@@ -55,24 +55,24 @@ This allows the child's keys to be signed by more than 1 parent zone
|
||||
key if these exist.
|
||||
.Pp
|
||||
The
|
||||
.Ar p
|
||||
.Fl p
|
||||
option instructs
|
||||
.Nm dnssec-signkey
|
||||
to use pseudo-random data when signing the keys which is faster, but
|
||||
less secure, than using genuinely random data for signing.
|
||||
This option may be useful when there are many child zone keysets to
|
||||
sign and CPU resources are limited.
|
||||
sign of if the entropy source is limited.
|
||||
It could also be used for short-lived keys and signatures that don't
|
||||
require strengthening against cryptanalysis: for instance when the key
|
||||
will be discarded long before it could be compromised.
|
||||
.Pp
|
||||
An alternate file for obtaining random data can be used with the
|
||||
.Ar r
|
||||
.Fl r
|
||||
option.
|
||||
.Ar filename
|
||||
is the name of the file to use.
|
||||
If no
|
||||
.Ar r
|
||||
.Fl r
|
||||
option is used and the default file for random data
|
||||
.Pa /dev/random
|
||||
does not exist,
|
||||
@@ -82,7 +82,7 @@ The time between keystrokes will be measured and used to derive random
|
||||
data.
|
||||
.Pp
|
||||
The
|
||||
.Ar v
|
||||
.Fl v
|
||||
option can be used to make
|
||||
.Nm dnssec-signkey
|
||||
more verbose.
|
||||
@@ -94,7 +94,7 @@ generates increasingly detailed reports about what it is doing.
|
||||
The default level is zero.
|
||||
.Pp
|
||||
An option of
|
||||
.Ar h
|
||||
.Fl h
|
||||
makes
|
||||
.Nm dnssec-signkey
|
||||
print a short summary of its command line options
|
||||
|
||||
@@ -14,7 +14,7 @@
|
||||
.\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
|
||||
.\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
.\"
|
||||
.\" $Id: dnssec-signzone.8,v 1.2 2000/06/28 03:20:49 jim Exp $
|
||||
.\" $Id: dnssec-signzone.8,v 1.3 2000/06/28 23:41:01 jim Exp $
|
||||
.\"
|
||||
.Dd Jun 30, 2000
|
||||
.Dt DNSSEC-SIGNZONE 8
|
||||
@@ -66,7 +66,7 @@ current working directory used by
|
||||
.Ar zonefile
|
||||
is the name of the unsigned zone file.
|
||||
Unless the file name is the same as the name of the zone, the
|
||||
.Ar o
|
||||
.Fl o
|
||||
option should be given.
|
||||
.Ar origin
|
||||
will be the fully qualified domain origin for the zone.
|
||||
@@ -87,7 +87,7 @@ generates a file called
|
||||
.Ar zonefile.signed
|
||||
containing the signed zone file.
|
||||
This can be overridden by the
|
||||
.Ar f
|
||||
.Fl f
|
||||
option.
|
||||
Instead of this default file name, the signed zone file will be
|
||||
written to
|
||||
@@ -98,12 +98,12 @@ written to
|
||||
.Nm dnssec-signzone
|
||||
does not verify the signatures by default.
|
||||
The
|
||||
.Ar a
|
||||
.Fl a
|
||||
option makes it verify the signatures it generated.
|
||||
.Pp
|
||||
The date and time when the generated
|
||||
SIG records become valid can be specified with the
|
||||
.Ar s
|
||||
.Fl s
|
||||
option.
|
||||
.Ar start-time
|
||||
can either be an absolute or relative date.
|
||||
@@ -113,12 +113,12 @@ A relative start time is supplied when
|
||||
.Ar start-time
|
||||
is given as +N: N seconds from the current time.
|
||||
If no
|
||||
.Ar s
|
||||
.Fl s
|
||||
option is supplied, the current date and time is used for the start
|
||||
time of the SIG records.
|
||||
.Pp
|
||||
The expiry date for the SIG records can be set by the
|
||||
.Ar e
|
||||
.Fl e
|
||||
option.
|
||||
Note that in this context, the expiry date specifies when the SIG
|
||||
records are no longer valid, not when they are deleted from caches on name
|
||||
@@ -159,9 +159,9 @@ The default cycle time is quarter of the difference between the
|
||||
signature end and start dates for the current invocation of
|
||||
.Nm dnssec-signzone .
|
||||
So if the
|
||||
.Ar e
|
||||
.Fl e
|
||||
and
|
||||
.Ar s
|
||||
.Fl s
|
||||
options are not specified,
|
||||
.Nm dnssec-signzone
|
||||
generates signatures that are valid for 30 days from the current
|
||||
@@ -171,7 +171,7 @@ Therefore any SIG records that
|
||||
were due to expire in that time would be replaced with new ones.
|
||||
.Pp
|
||||
The
|
||||
.Ar c
|
||||
.Fl c
|
||||
option can be used to change the cycle time.
|
||||
.Ar cycle-time
|
||||
indicates the number of seconds from the current time that should be
|
||||
@@ -180,7 +180,7 @@ set the cycle time and
|
||||
determine when fresh SIG records should be generated.
|
||||
.Pp
|
||||
The
|
||||
.Ar p
|
||||
.Fl p
|
||||
option instructs
|
||||
.Nm dnssec-signzone
|
||||
to use pseudo-random data when signing the zone's resource records.
|
||||
@@ -192,7 +192,7 @@ require strengthening against cryptanalysis: for instance when the signatures
|
||||
will be discarded long before the signed data could be compromised.
|
||||
.Pp
|
||||
An alternate source of random data can be specified with the
|
||||
.Ar r
|
||||
.Fl r
|
||||
option.
|
||||
.Ar randomdev
|
||||
is the name of the file to use to obtain random data.
|
||||
@@ -200,21 +200,21 @@ By default
|
||||
.Pa /dev/random
|
||||
is used if this device is available.
|
||||
If it is not provided by the operating system and no
|
||||
.Ar r
|
||||
.Fl r
|
||||
option is used,
|
||||
.Nm dnssec-signzone
|
||||
will prompt the user for input from the keyboard and use the time
|
||||
between keystrokes to derive some random data.
|
||||
.Pp
|
||||
An option of
|
||||
.Ar h
|
||||
.Fl h
|
||||
makes
|
||||
.Nm dnssec-signzone
|
||||
print a short summary of its command line options
|
||||
and arguments.
|
||||
.Pp
|
||||
The
|
||||
.Ar v
|
||||
.Fl v
|
||||
option can be used to make
|
||||
.Nm dnssec-signzone
|
||||
more verbose.
|
||||
@@ -236,7 +236,7 @@ The zone file for this zone is
|
||||
.Dv example.com
|
||||
and it can be assumed to contain fully qualified domain names which
|
||||
means there is no need to use the
|
||||
.Ar o
|
||||
.Fl o
|
||||
option to set the domain origin.
|
||||
This zone file contains the keyset for
|
||||
.Dv example.com
|
||||
|
||||
Reference in New Issue
Block a user