| blob | e9f20776c31caf8f6e577be4d04013831c238cd6 |
1 .\" $NetBSD: dnssec-zkt.8,v 1.1.1.1 2015/07/08 15:37:49 christos Exp $
2 .\"
3 .TH dnssec-zkt 8 "August 1, 2009" "ZKT 0.99b" ""
4 \" turn off hyphenation
5 .\" if n .nh
6 .nh
7 .SH NAME
8 dnssec-zkt \(em Secure DNS zone key tool
10 .SH SYNOPSYS
11 .na
12 .B dnssec-zkt
13 .RB [ \-V|--view
14 .IR "view" ]
15 .RB [ \-c
16 .IR "file" ]
17 .RB [ \-l
18 .IR "list" ]
19 .RB [ \-adefhkLrptz ]
20 .RI [{ keyfile | dir }
21 .RI "" ... ]
23 .B dnssec-zkt
24 .BR \-C <label>
25 .RB [ \-V|--view
26 .IR "view" ]
27 .RB [ \-c
28 .IR "file" ]
29 .RB [ \-krpz ]
30 .RI [{ keyfile | dir }
31 .RI "" ... ]
32 .br
33 .B dnssec-zkt
34 .BR \-\-create= <label>
35 .RB [ \-V|--view
36 .IR "view" ]
37 .RB [ \-c
38 .IR "file" ]
39 .RB [ \-krpz ]
40 .RI [{ keyfile | dir }
41 .RI "" ... ]
43 .B dnssec-zkt
44 .BR \- { P | A | D | R } <keytag>
45 .RB [ \-V|--view
46 .IR "view" ]
47 .RB [ \-c
48 .IR "file" ]
49 .RB [ \-r ]
50 .RI [{ keyfile | dir }
51 .RI "" ... ]
52 .br
53 .B dnssec-zkt
54 .BR \-\-published= <keytag>
55 .RB [ \-V|--view
56 .IR "view" ]
57 .RB [ \-c
58 .IR "file" ]
59 .RB [ \-r ]
60 .RI [{ keyfile | dir }
61 .RI "" ... ]
62 .br
63 .B dnssec-zkt
64 .BR \-\-active= <keytag>
65 .RB [ \-V|--view
66 .IR "view" ]
67 .RB [ \-c
68 .IR "file" ]
69 .RB [ \-r ]
70 .RI [{ keyfile | dir }
71 .RI "" ... ]
72 .br
73 .B dnssec-zkt
74 .BR \-\-depreciate= <keytag>
75 .RB [ \-V|--view
76 .IR "view" ]
77 .RB [ \-c
78 .IR "file" ]
79 .RB [ \-r ]
80 .RI [{ keyfile | dir }
81 .RI "" ... ]
82 .br
83 .B dnssec-zkt
84 .BR \-\-rename= <keytag>
85 .RB [ \-V|--view
86 .IR "view" ]
87 .RB [ \-c
88 .IR "file" ]
89 .RB [ \-r ]
90 .RI [{ keyfile | dir }
91 .RI "" ... ]
93 .B dnssec-zkt
94 .BR \-\-destroy= <keytag>
95 .RB [ \-V|--view
96 .IR "view" ]
97 .RB [ \-c
98 .IR "file" ]
99 .RB [ \-r ]
100 .RI [{ keyfile | dir }
101 .RI "" ... ]
103 .B dnssec-zkt
104 .B \-T
105 .RB [ \-V|--view
106 .IR "view" ]
107 .RB [ \-c
108 .IR "file" ]
109 .RB [ \-l
110 .IR "list" ]
111 .RB [ \-hr ]
112 .RI [{ keyfile | dir }
113 .RI "" ... ]
114 .br
115 .B dnssec-zkt
116 .B \-\-list-trustedkeys
117 .RB [ \-V|--view
118 .IR "view" ]
119 .RB [ \-c
120 .IR "file" ]
121 .RB [ \-l
122 .IR "list" ]
123 .RB [ \-hr ]
124 .RI [{ keyfile | dir }
125 .RI "" ... ]
127 .B dnssec-zkt
128 .B \-K
129 .RB [ \-V|--view
130 .IR "view" ]
131 .RB [ \-c
132 .IR "file" ]
133 .RB [ \-l
134 .IR "list" ]
135 .RB [ \-hkzr ]
136 .RI [{ keyfile | dir }
137 .RI "" ... ]
138 .br
139 .B dnssec-zkt
140 .B \-\-list-dnskeys
141 .RB [ \-V|--view
142 .IR "view" ]
143 .RB [ \-c
144 .IR "file" ]
145 .RB [ \-l
146 .IR "list" ]
147 .RB [ \-hkzr ]
148 .RI [{ keyfile | dir }
149 .RI "" ... ]
151 .B dnssec-zkt
152 .B \-Z
153 .RB [ \-V|--view
154 .IR "view" ]
155 .RB [ \-c
156 .IR "file" ]
157 .br
158 .B dnssec-zkt
159 .B \-\-zone-config
160 .RB [ \-V|--view
161 .IR "view" ]
162 .RB [ \-c
163 .IR "file" ]
165 .B dnssec-zkt
166 .B \-9 | \-\-ksk-rollover
167 .br
168 .B dnssec-zkt
169 .B \-1 | \-\-ksk-roll-phase1
170 .I "do.ma.in."
171 .RB [ \-V|--view
172 .IR "view" ]
173 .RB [ \-c
174 .IR "file" ]
175 .br
176 .B dnssec-zkt
177 .B \-2 | \-\-ksk-roll-phase2
178 .I "do.ma.in."
179 .RB [ \-V|--view
180 .IR "view" ]
181 .RB [ \-c
182 .IR "file" ]
183 .br
184 .B dnssec-zkt
185 .B \-3 | \-\-ksk-roll-phase3
186 .I do.ma.in.
187 .RB [ \-V|--view
188 .IR "view" ]
189 .RB [ \-c
190 .IR "file" ]
191 .br
192 .B dnssec-zkt
193 .B \-0 | \-\-ksk-roll-stat
194 .I do.ma.in.
195 .RB [ \-V|--view
196 .IR "view" ]
197 .RB [ \-c
198 .IR "file" ]
199 .br
200 .ad
202 .SH DESCRIPTION
203 The
204 .I dnssec-zkt
205 command is a wrapper around
206 .I dnssec-keygen(8)
207 to assist in dnssec zone key management.
208 .PP
209 In the common usage the command prints out information about
210 all dnssec (zone) keys found in the given (or predefined default) directory.
211 It is also possible to specify keyfiles (K*.key) as arguments.
212 With option
213 .B \-r
214 subdirectories will be searched recursively, and all dnssec keys found
215 will be listed sorted by domain name, key type and generation time.
216 In that mode the use of the
217 .B \-p
218 option may be helpful to find the location of the keyfile in the directory tree.
219 .PP
220 Other forms of the command print out keys in a format suitable for
221 a trusted-key section or as a DNSKEY resource record.
222 .PP
223 The command is also useful in dns key management.
224 It offers monitoring of key lifetime and modification of key status.
226 .SH GENERAL OPTIONS
227 .TP
228 .BI \-V " view" ", \-\-view=" view
229 Try to read the default configuration out of a file named
230 .I dnssec-<view>.conf .
231 Instead of specifying the \-V or --view option every time,
232 it is also possible to create a hard or softlink to the
233 executable file to give it an additional name like
234 .I dnssec-zkt-<view> .
235 .TP
236 .BI \-c " file" ", \-\-config=" file
237 Read default values from the specified config file.
238 Otherwise the default config file is read or build in defaults
239 will be used.
240 .TP
241 .BI \-O " optstr" ", \-\-config-option=" optstr
242 Set any config file option via the commandline.
243 Several config file options could be specified at the argument string
244 but have to be delimited by semicolon (or newline).
245 .TP
246 .BI \-l " list"
247 Print out information solely about domains given in the comma or space separated
248 list.
249 Take care of, that every domain name has a trailing dot.
250 .TP
251 .BR \-d ", " \-\-directory
252 Skip directory arguments.
253 This will be useful in combination with wildcard arguments
254 to prevent dnsssec-zkt to list all keys found in subdirectories.
255 For example "dnssec-zkt -d *" will print out a list of all keys only found in
256 the current directory.
257 Maybe it is easier to use "dnssec-zkt ." instead (without -r set).
258 The option works similar to the \-d option of
259 .IR ls(1) .
260 .TP
261 .BR \-L ", " \-\-left-justify
262 Print out the domain name left justified.
263 .TP
264 .BR \-k ", " \-\-ksk
265 Select and print key signing keys only (default depends on command mode).
266 .TP
267 .BR \-z ", " \-\-zsk
268 Select and print zone signing keys only (default depends on command mode).
269 .TP
270 .BR \-r ", " \-\-recursive
271 Recursive mode (default is off).
272 .br
273 Also settable in the dnssec.conf file (Parameter: Recursive).
274 .TP
275 .BR \-p ", " \-\-path
276 Print pathname in listing mode.
277 In -C mode, don't create the new key in the same directory as (already existing)
278 keys with the same label.
279 .TP
280 .BR \-a ", " \-\-age
281 Print age of key in weeks, days, hours, minutes and seconds (default is off).
282 .br
283 Also settable in the dnssec.conf file (Parameter: PrintAge).
284 .TP
285 .BR \-f ", " \-\-lifetime
286 Print the key lifetime.
287 .TP
288 .BR \-F ", " \-\-setlifetime
289 Set the key lifetime of all the selected keys.
290 Use option -k, -z, -l or the file and dir argument for key selection.
291 .TP
292 .BR \-e ", " \-\-exptime
293 Print the key expiration time.
294 .TP
295 .BR \-t ", " \-\-time
296 Print the key generation time (default is on).
297 .br
298 Also settable in the dnssec.conf file (Parameter: PrintTime).
299 .TP
300 .B \-h
301 No header or trusted-key section header and trailer in -T mode
302 .PP
304 .SH COMMAND OPTIONS
305 .TP
306 .BR \-H ", " \-\-help
307 Print out the online help.
308 .TP
309 .BR \-T ", " \-\-list-trustedkeys
310 List all key signing keys as a
311 .I named.conf
312 trusted-key section.
313 Use
314 .B \-h
315 to supress the section header/trailer.
316 .TP
317 .BR \-K ", " \-\-list-dnskeys
318 List the public part of all the keys in DNSKEY resource record format.
319 Use
320 .B \-h
321 to suppress comment lines.
322 .TP
323 .BI \-C " zone" ", \-\-create=" zone
324 Create a new zone signing key for the given zone.
325 Add option
326 .B \-k
327 to create a key signing key.
328 The key algorithm and key length will be examined from built-in default values
329 or from the parameter settings in the
330 .I dnssec.conf
331 file.
332 .br
333 The keyfile will be created in the current directory if
334 the
335 .B \-p
336 option is specified.
337 .TP
338 .BI \-R " keyid" ", \-\-revoke=" keyid
339 Revoke the key signing key with the given keyid.
340 A revoked key has bit 8 in the flags filed set (see RFC5011).
341 The keyid is the numeric keytag with an optionally added zone name separated by a colon.
342 .TP
343 .BI \-\-rename=" keyid
344 Rename the key files of the key with the given keyid
345 (Look at key file names starting with an lower 'k').
346 The keyid is the numeric keytag with an optionally added zone name separated by a colon.
347 .TP
348 .BI \-\-destroy= keyid
349 Deletes the key with the given keyid.
350 The keyid is the numeric keytag with an optionally added zone name separated by a colon.
351 Beware that this deletes both private and public keyfiles, thus the key is
352 unrecoverable lost.
353 .TP
354 .BI \-P|A|D " keyid," " \-\-published=" keyid, " \-\-active=" keyid, " \-\-depreciated=" keyid
355 Change the status of the given dnssec key to
356 published
357 .RB ( \-P ),
358 active
359 .RB ( \-A )
360 or depreciated
361 .RB ( \-D ).
362 The
363 .I keyid
364 is the numeric keytag with an optionally added zone name separated by a colon.
365 Setting the status to "published" or "depreciate" will change the filename
366 of the private key file to ".published" or ".depreciated" respectivly.
367 This prevents the usage of the key as a signing key by the use of
368 .IR dnssec-signzone(8) .
369 The time of status change will be stored in the 'mtime' field of the corresponding
370 ".key" file.
371 Key activation via option
372 .B \-A
373 will restore the original timestamp and file name (".private").
374 .TP
375 .BR \-Z ", " \-\-zone-config
376 Write all config parameters to stdout.
377 The output is suitable as a template for the
378 .I dnssec.conf
379 file, so the easiest way to create a
380 .I dnssec.conf
381 file is to redirect the standard output of the above command.
382 Pay attention not to overwrite an existing file.
383 .TP
384 .BI \-\-ksk-roll-phase[123] " do.ma.in."
385 Initiate a key signing key rollover of the specified domain.
386 This feature is currently in experimental status and is mainly for the use
387 in an hierachical environment.
388 Use --ksk-rollover for a little more detailed description.
391 .SH SAMPLE USAGE
392 .TP
393 .fam C
394 .B "dnssec-zkt \-r .
395 .fam T
396 Print out a list of all zone keys found below the current directory.
397 .TP
398 .fam C
399 .B "dnssec-zkt \-Z \-c """"
400 .fam T
401 Print out the compiled in default parameters.
402 .TP
403 .fam C
404 .B "dnssec-zkt \-C example.net \-k \-r ./zonedir
405 .fam T
406 Create a new key signing key for the zone "example.net".
407 Store the key in the same directory below "zonedir" where the other
408 "example.net" keys live.
409 .TP
410 .fam C
411 .B "dnssec-zkt \-T ./zonedir/example.net
412 .fam T
413 Print out a trusted-key section containing the key signing keys of "example.net".
414 .TP
415 .fam C
416 .B "dnssec-zkt \-D 123245 \-r .
417 .fam T
418 Depreciate the key with tag "12345" below the current directory,
419 .TP
420 .fam C
421 .B "dnssec-zkt --view intern
422 .fam T
423 Print out a list of all zone keys found below the directory where all
424 the zones of view intern live.
425 There should be a seperate dnssec config file
426 .I dnssec-intern.conf
427 with a directory option to take affect of this.
428 .TP
429 .fam C
430 .B "dnssec-zkt-intern
431 .fam T
432 Same as above.
433 The binary file
434 .I dnssec-zkt
435 has another link, named
436 .I dnssec-zkt-intern
437 made, and
438 .I dnssec-zkt
439 examines argv[0] to find a view whose zones it proceeds to process.
441 .SH ENVIRONMENT VARIABLES
442 .TP
443 ZKT_CONFFILE
444 Specifies the name of the default global configuration files.
446 .SH FILES
447 .TP
448 .I /var/named/dnssec.conf
449 Built-in default global configuration file.
450 The name of the default global config file is settable via
451 the environment variable ZKT_CONFFILE.
452 .TP
453 .I /var/named/dnssec-<view>.conf
454 View specific global configuration file.
455 .TP
456 .I ./dnssec.conf
457 Local configuration file (only used in
458 .B \-C
459 mode).
461 .SH BUGS
462 .PP
463 Some of the general options will not be meaningful in all of the command modes.
464 .br
465 The option
466 .B \-l
467 and the ksk rollover options
468 insist on domain names ending with a dot.
469 .PP
471 .SH AUTHORS
472 Holger Zuleger, Mans Nilsson
474 .SH COPYRIGHT
475 Copyright (c) 2005 \- 2008 by Holger Zuleger.
476 Licensed under the BSD Licences. There is NO warranty; not even for MERCHANTABILITY or
477 FITNESS FOR A PARTICULAR PURPOSE.
478 .\"--------------------------------------------------
479 .SH SEE ALSO
480 dnssec-keygen(8), dnssec-signzone(8), rndc(8), named.conf(5), dnssec-signer(8),
481 .br
482 RFC4641
483 "DNSSEC Operational Practices" by Miek Gieben and Olaf Kolkman,
484 .br
485 DNSSEC HOWTO Tutorial by Olaf Kolkman, RIPE NCC
486 .br
487 (http://www.nlnetlabs.nl/dnssec_howto/)