From: Evan Hunt Date: Tue, 9 Jun 2009 01:47:19 +0000 (+0000) Subject: added "known bugs" section to dnssec-signzone man page, edited X-Git-Tag: v9.6.1^2~2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2d7fc2d5a67f408eacf702b4a7dc24bec2824339;p=thirdparty%2Fbind9.git added "known bugs" section to dnssec-signzone man page, edited KNOWN-DEFECTS a bit --- diff --git a/KNOWN-DEFECTS b/KNOWN-DEFECTS index 4ab10008fb5..83d71759740 100644 --- a/KNOWN-DEFECTS +++ b/KNOWN-DEFECTS @@ -6,8 +6,10 @@ machine, and sign it again with a second key. An unfortunate side-effect of this flexibility is that dnssec-signzone does not check to make sure it's signing a zone with any valid keys at -all; an attempt to sign a zone with no keys may appear to have succeeded. +all. An attempt to sign a zone without any keys will appear to succeed, +producing a "signed" zone with no signatures. There is no warning issued +when a zone is not signed. -This will be corrected in the next release. In the meantime, ISC +This will be corrected in a future release. In the meantime, ISC recommends examining the output of dnssec-signzone to confirm that -the zone is properly signed by all keys. +the zone is properly signed by all keys before using it. diff --git a/bin/dnssec/dnssec-signzone.8 b/bin/dnssec/dnssec-signzone.8 index a661841bd85..84e613f721b 100644 --- a/bin/dnssec/dnssec-signzone.8 +++ b/bin/dnssec/dnssec-signzone.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000-2003 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and distribute this software for any @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-signzone.8,v 1.47.44.3 2009/06/08 22:23:06 each Exp $ +.\" $Id: dnssec-signzone.8,v 1.47.44.4 2009/06/09 01:47:19 each Exp $ .\" .hy 0 .ad l @@ -36,7 +36,7 @@ .el .ne 3 .IP "\\$1" \\$2 .. -.TH "DNSSEC-SIGNZONE" 8 "June 05, 2009" "" "" +.TH "DNSSEC-SIGNZONE" 8 "June 08, 2009" "" "" .SH NAME dnssec-signzone \- DNSSEC zone signing tool .SH "SYNOPSIS" @@ -160,6 +160,13 @@ This example re\-signs a previously signed zone with default parameters\&. The p db\&.example\&.com\&.signed % .fi +.SH "KNOWN BUGS" +.PP + \fBdnssec\-signzone\fR was designed so that it could sign a zone partially, using only a subset of the DNSSEC keys needed to produce a fully\-signed zone\&. This permits a zone administrator, for example, to sign a zone with one key on one machine, move the resulting partially\-signed zone to a second machine, and sign it again with a second key\&. +.PP +An unfortunate side\-effect of this flexibility is that \fBdnssec\-signzone\fR does not check to make sure it's signing a zone with any valid keys at all\&. An attempt to sign a zone without any keys will appear to succeed, producing a "signed" zone with no signatures\&. There is no warning issued when a zone is not fully signed\&. +.PP +This will be corrected in a future release\&. In the meantime, ISC recommends examining the output of \fBdnssec\-signzone\fR to confirm that the zone is properly signed by all keys before using it\&. .SH "SEE ALSO" .PP \fBdnssec\-keygen\fR(8), BIND 9 Administrator Reference Manual, RFC 4033\&. diff --git a/bin/dnssec/dnssec-signzone.docbook b/bin/dnssec/dnssec-signzone.docbook index 6aaa43bb444..7ed320ad575 100644 --- a/bin/dnssec/dnssec-signzone.docbook +++ b/bin/dnssec/dnssec-signzone.docbook @@ -18,10 +18,10 @@ - PERFORMANCE OF THIS SOFTWARE. --> - + - June 05, 2009 + June 08, 2009 @@ -490,6 +490,33 @@ db.example.com.signed % + + KNOWN BUGS + + dnssec-signzone was designed so that it could + sign a zone partially, using only a subset of the DNSSEC keys + needed to produce a fully-signed zone. This permits a zone + administrator, for example, to sign a zone with one key on one + machine, move the resulting partially-signed zone to a second + machine, and sign it again with a second key. + + + An unfortunate side-effect of this flexibility is that + dnssec-signzone does not check to make sure + it's signing a zone with any valid keys at all. An attempt to + sign a zone without any keys will appear to succeed, producing + a "signed" zone with no signatures. There is no warning issued + when a zone is not fully signed. + + + + This will be corrected in a future release. In the meantime, ISC + recommends examining the output of dnssec-signzone + to confirm that the zone is properly signed by all keys before + using it. + + + SEE ALSO diff --git a/bin/dnssec/dnssec-signzone.html b/bin/dnssec/dnssec-signzone.html index 6ab1351eb6a..5eb8626e643 100644 --- a/bin/dnssec/dnssec-signzone.html +++ b/bin/dnssec/dnssec-signzone.html @@ -1,5 +1,5 @@ - + @@ -32,7 +32,7 @@

dnssec-signzone [-a] [-c class] [-d directory] [-e end-time] [-f output-file] [-g] [-h] [-k key] [-l domain] [-i interval] [-I input-format] [-j jitter] [-N soa-serial-format] [-o origin] [-O output-format] [-p] [-r randomdev] [-s start-time] [-t] [-v level] [-z] [-3 salt] [-H iterations] [-A] {zonefile} [key...]

-

DESCRIPTION

+

DESCRIPTION

dnssec-signzone signs a zone. It generates NSEC and RRSIG records and produces a signed version of the @@ -43,7 +43,7 @@

-

OPTIONS

+

OPTIONS

-a

@@ -258,7 +258,7 @@

-

EXAMPLE

+

EXAMPLE

The following command signs the example.com zone with the DSA key generated by dnssec-keygen @@ -287,14 +287,39 @@ db.example.com.signed %

-

SEE ALSO

+

KNOWN BUGS

+

+ dnssec-signzone was designed so that it could + sign a zone partially, using only a subset of the DNSSEC keys + needed to produce a fully-signed zone. This permits a zone + administrator, for example, to sign a zone with one key on one + machine, move the resulting partially-signed zone to a second + machine, and sign it again with a second key. +

+

+ An unfortunate side-effect of this flexibility is that + dnssec-signzone does not check to make sure + it's signing a zone with any valid keys at all. An attempt to + sign a zone without any keys will appear to succeed, producing + a "signed" zone with no signatures. There is no warning issued + when a zone is not fully signed. +

+

+ This will be corrected in a future release. In the meantime, ISC + recommends examining the output of dnssec-signzone + to confirm that the zone is properly signed by all keys before + using it. +

+
+
+

SEE ALSO

dnssec-keygen(8), BIND 9 Administrator Reference Manual, RFC 4033.

-

AUTHOR

+

AUTHOR

Internet Systems Consortium