Document TSIG commands in pdnsutil

diff --git a/docs/manpages/pdnsutil.1.md b/docs/manpages/pdnsutil.1.md
index 621bf1b2249c74b33ea38e24a58ba942d2cce481..c6ea0090017fbe7db9d10cba91a115289ddcd8bc 100644 (file)
--- a/docs/manpages/pdnsutil.1.md
+++ b/docs/manpages/pdnsutil.1.md
@@ -146,6 +146,9 @@ delete-tsig-key *NAME*
 generate-tsig-key *NAME* *ALGORITHM*
 :    Generate new TSIG key with name *NAME* and the specified algorithm.
 
+import-tsig-key *NAME* *ALGORITHM* *KEY*
+:    Import *KEY* of the specified algorithm as *NAME*.
+
 ## ZONE MANIPULATION COMMANDS
 create-zone *ZONE*
 :    Create an empty zone named *ZONE*.

diff --git a/docs/markdown/authoritative/tsig.md b/docs/markdown/authoritative/tsig.md
index fd487707f72f07fad680c62121df1ccbd458abf6..2ecacefa63886da1dffdaa3a613e2f58513dd354 100644 (file)
--- a/docs/markdown/authoritative/tsig.md
+++ b/docs/markdown/authoritative/tsig.md
@@ -12,7 +12,7 @@ where X is 224, 256, 384 or 512. The content is a Base64-encoded secret.
 
 **Note**: Most backends require DNSSEC support enabled to support TSIG. For the
 Generic SQL Backend make sure to use the DNSSEC enabled schema and to turn on
-the relevant '-dnssec' flag (for example, gmysql-dnssec)!
+the relevant '-dnssec' flag (for example, `gmysql-dnssec`)!
 
 ## Provisioning outbound AXFR access
 To actually provision a named secret permission to AXFR a zone, set a metadata
@@ -28,6 +28,13 @@ insert into domainmetadata (domain_id, kind, content) values (5, 'TSIG-ALLOW-AXF
 $ dig -t axfr powerdnssec.org @127.0.0.1 -y 'test:kp4/24gyYsEzbuTVJRUMoqGFmN3LYgVDzJ/3oRSP7ys='
 ```
 
+Another of importing and activating TSIG keys into the database is using [`pdnsutil`](../manpages/pdnsutil.1.md):
+
+```
+pdnsutil import-tsig-key test hmac-md5 'kp4/24gyYsEzbuTVJRUMoqGFmN3LYgVDzJ/3oRSP7ys='
+pdnsutil activate-tsig-key powerdnssec.org test master
+```
+
 To ease interoperability, the equivalent configuration above in BIND would look like this:
 
 ```
@@ -63,6 +70,13 @@ select id from domains where name='powerdnssec.org';
 insert into domainmetadata (domain_id, kind, content) values (5, 'AXFR-MASTER-TSIG', 'test');
 ```
 
+This can also be done using [`pdnsutil`](../manpages/pdnsutil.1.md):
+
+```
+pdnsutil import-tsig-key test hmac-md5 'kp4/24gyYsEzbuTVJRUMoqGFmN3LYgVDzJ/3oRSP7ys='
+pdnsutil activate-tsig-key powerdnssec.org test slave
+```
+
 This setup corresponds to the `TSIG-ALLOW-AXFR` access rule defined in the previous section.
 
 In the interest of interoperability, the configuration above is (not quite)