From: Tony Finch Date: Thu, 21 Feb 2019 18:54:16 +0000 (+0000) Subject: cleanup dnssec-keygen manual page X-Git-Tag: v9.11.7~78^2 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=0f8351b282d4b90993b84ce74cf04c3c2aeb99d2;p=thirdparty%2Fbind9.git cleanup dnssec-keygen manual page Alphabetize options and synopsis; remove spurious -z from synopsis; refer to -T KEY in options that are only relevant to pre-RFC3755 DNSSEC, and add a -f KSK example. (cherry picked from commit 1954f8d2bf92ab19efa20eed12ba986ae2988222) --- diff --git a/CHANGES b/CHANGES index 99c9da3704d..4da678feb74 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,8 @@ 5176. [tests] Remove a dependency on libxml in statschannel system test. [GL #926] +5174. [doc] Tidy dnssec-keygen manual. [GL !1557] + 5172. [bug] nsupdate now honors the operating system's preferred ephemeral port range. [GL #905] diff --git a/bin/dnssec/dnssec-keygen.docbook b/bin/dnssec/dnssec-keygen.docbook index ee6a48936ca..0ae6b41ac61 100644 --- a/bin/dnssec/dnssec-keygen.docbook +++ b/bin/dnssec/dnssec-keygen.docbook @@ -58,11 +58,10 @@ dnssec-keygen - - - + + @@ -77,6 +76,7 @@ + @@ -88,7 +88,6 @@ - name @@ -112,6 +111,20 @@ + + + -3 + + + Use an NSEC3-capable algorithm to generate a DNSSEC key. + If this option is used with an algorithm that has both + NSEC and NSEC3 versions, then the NSEC3 version will be + used; for example, dnssec-keygen -3a RSASHA1 + specifies the NSEC3RSASHA1 algorithm. + + + + -a algorithm @@ -168,45 +181,16 @@ - - -n nametype - - - Specifies the owner type of the key. The value of - must either be ZONE (for a DNSSEC - zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with - a host (KEY)), - USER (for a key associated with a user(KEY)) or OTHER (DNSKEY). - These values are case insensitive. Defaults to ZONE for DNSKEY - generation. - - - - - - -3 - - - Use an NSEC3-capable algorithm to generate a DNSSEC key. - If this option is used and no algorithm is explicitly - set on the command line, NSEC3RSASHA1 will be used by - default. Note that RSASHA256, RSASHA512, ECCGOST, - ECDSAP256SHA256, ECDSAP384SHA384, ED25519 and ED448 - algorithms are NSEC3-capable. - - - - -C - Compatibility mode: generates an old-style key, without - any metadata. By default, dnssec-keygen - will include the key's creation date in the metadata stored - with the private key, and other dates may be set there as well - (publication date, activation date, etc). Keys that include - this data may be incompatible with older versions of BIND; the + Compatibility mode: generates an old-style key, without any + timing metadata. By default, dnssec-keygen + will include the key's creation date in the metadata stored with + the private key, and other dates may be set there as well + (publication date, activation date, etc). Keys that include this + data may be incompatible with older versions of BIND; the option suppresses them. @@ -315,14 +299,28 @@ + + -n nametype + + + Specifies the owner type of the key. The value of + must either be ZONE (for a DNSSEC + zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated + with a host (KEY)), USER (for a key associated with a + user(KEY)) or OTHER (DNSKEY). These values are case + insensitive. Defaults to ZONE for DNSKEY generation. + + + + -p protocol - Sets the protocol value for the generated key. The protocol - is a number between 0 and 255. The default is 3 (DNSSEC). - Other possible values for this argument are listed in - RFC 2535 and its successors. + Sets the protocol value for the generated key, for use + with . The protocol is a number between 0 + and 255. The default is 3 (DNSSEC). Other possible values for + this argument are listed in RFC 2535 and its successors. @@ -409,28 +407,29 @@ -t type - Indicates the use of the key. must be - one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default - is AUTHCONF. AUTH refers to the ability to authenticate - data, and CONF the ability to encrypt data. + Indicates the use of the key, for use with . must be one of AUTHCONF, + NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH + refers to the ability to authenticate data, and CONF the ability + to encrypt data. - -v level + -V - Sets the debugging level. + Prints version information. - -V + -v level - Prints version information. + Sets the debugging level. @@ -637,6 +636,12 @@ and Kexample.com.+003+26160.private. + + To generate a matching key-signing key, issue the command: + + + dnssec-keygen -a DSA -b 768 -n ZONE -f KSK example.com + SEE ALSO