ldnssec-keygen: add manpage
This commit is contained in:
parent
46ff06341b
commit
98e5fcd07b
177
ldnssec-keygen.1
Normal file
177
ldnssec-keygen.1
Normal file
@ -0,0 +1,177 @@
|
||||
.\"
|
||||
.\" ldnssec-keygen.1
|
||||
.\" Written in 2021 by Lucas
|
||||
.\" CC0 1.0 Universal/Public domain - No rights reserved
|
||||
.\"
|
||||
.\" To the extent possible under law, the author(s) have dedicated all
|
||||
.\" copyright and related and neighboring rights to this software to the
|
||||
.\" public domain worldwide. This software is distributed without any
|
||||
.\" warranty. You should have received a copy of the CC0 Public Domain
|
||||
.\" Dedication along with this software. If not, see
|
||||
.\" <http://creativecommons.org/publicdomain/zero/1.0/>.
|
||||
.\"
|
||||
.Dd December 14, 2021
|
||||
.Dt LDNSSEC-KEYGEN 1
|
||||
.Os
|
||||
.Sh NAME
|
||||
.Nm ldnssec-keygen
|
||||
.Nd DNSSEC key management utility
|
||||
.Sh SYNOPSIS
|
||||
.Nm
|
||||
.Cm dnskey
|
||||
.Op Fl d Ar domain
|
||||
.Op Fl k
|
||||
.Nm
|
||||
.Cm ds
|
||||
.Op Fl a Ar algorithm
|
||||
.Op Fl d Ar domain
|
||||
.Nm
|
||||
.Cm filename
|
||||
.Op Fl d Ar domain
|
||||
.Nm
|
||||
.Cm gen
|
||||
.Op Fl a Ar algorithm
|
||||
.Op Fl b Ar bits
|
||||
.Sh DESCRIPTION
|
||||
.Nm
|
||||
is a utiility for managing DNSSEC signing keys.
|
||||
It allows for generating private keys,
|
||||
printing the corresponding DS or DNSKEY records for those keys,
|
||||
and printing a BIND / LDNS filename.
|
||||
.Bl -tag -width Ds
|
||||
.It Nm Cm dnskey Oo Fl d Ar domain Oc Oo Fl k Oc
|
||||
Read a private key from
|
||||
.Em stdin
|
||||
and print the corresponding DNSKEY resource record.
|
||||
If
|
||||
.Fl d Ar domain
|
||||
is provided, use
|
||||
.Ar domain
|
||||
as the owner name for the resource record.
|
||||
If
|
||||
.Fl k
|
||||
is provided, set the
|
||||
.Em SEP
|
||||
flag in the resource record, signalling the key should be used as a
|
||||
.Em KSK .
|
||||
.It Nm Cm ds Oo Fl a Ar algorithm Oc Oo Fl d Ar domain Oc
|
||||
Read a private key from
|
||||
.Em stdin
|
||||
and print the corresponding DS resource record.
|
||||
If
|
||||
.Fl a Ar algorithm
|
||||
is provided, use that algorithm for the fingerprint, instead of the default
|
||||
.Em SHA-256 .
|
||||
If
|
||||
.Fl d Ar domain
|
||||
is provided, use
|
||||
.Ar domain
|
||||
as the owner name for the resource record.
|
||||
.Nm
|
||||
.Cm ds
|
||||
will unconditionally treat the provided key as a
|
||||
.Em KSK .
|
||||
.It Nm Cm filename Op Fl d Ar domain
|
||||
Read a private key from
|
||||
.Em stdin
|
||||
and print the corresponding base filename for it,
|
||||
in the same fashion as BIND or LDNS:
|
||||
.Em K<domain>+<algorithm_id>+<keytag> .
|
||||
If
|
||||
.Fl d Ar domain
|
||||
is provided, use
|
||||
.Ar domain
|
||||
as the domain name.
|
||||
.It Nm Cm gen Oo Fl a Ar algorithm Oc Oo Fl b Ar bits Oc
|
||||
Generate a private key and print it to
|
||||
.Em stdout .
|
||||
If
|
||||
.Fl a Ar algorithm
|
||||
is provided, generate a key for
|
||||
.Ar algorithm
|
||||
instead of the default of
|
||||
.Em ECDSAP256SHA256 .
|
||||
If
|
||||
.Fl b Ar bits
|
||||
is provided, generate a key of size
|
||||
.Ar bits .
|
||||
Do note that not all the supported algorithms support specifying a key size.
|
||||
.El
|
||||
.Sh EXIT STATUS
|
||||
.Ex -std
|
||||
.Sh EXAMPLES
|
||||
To create a private key suitable for DNSSEC signing
|
||||
.Bd -literal -offset indent
|
||||
$ ldnssec-keygen gen | tee sk
|
||||
Private-key-format: v1.2
|
||||
Algorithm: 13 (ECDSAP256SHA256)
|
||||
PrivateKey: ET6oewFD3NSZ+mKMgN9rWHKRZc9ULiGpILVjrUr+vko=
|
||||
.Ed
|
||||
.Pp
|
||||
Do note that this command doesn't specify the domain the key will be used for,
|
||||
nor the use for the generated key:
|
||||
it can be used either as a KSK or a ZSK.
|
||||
The following commands will define its use.
|
||||
.Pp
|
||||
If the generated key will be used as a
|
||||
.Em ZSK
|
||||
for the zone
|
||||
.Em zsk.example. ,
|
||||
then
|
||||
.Bd -literal -offset indent
|
||||
$ ldnssec-keygen filename -d zsk.example. <sk
|
||||
Kzsk.example.+013+53821
|
||||
.Ed
|
||||
.Pp
|
||||
After checking that there is no colliding keytag between the existing keys,
|
||||
it can be renamed with
|
||||
.Bd -literal -offset indent
|
||||
$ mv sk "$(ldnssec-keygen filename -d zsk.example. <sk).private"
|
||||
.Ed
|
||||
.Pp
|
||||
and the corresponding DNSKEY record can be generated with
|
||||
.Bd -literal -offset indent
|
||||
$ ldnssec-keygen dnskey -d zsk.example. <Kzsk.example.+013+53821.private
|
||||
ksk.example. 3600 IN DNSKEY 256 3 13 g02jgUGsc01VjH2bUM9Dob5ulaA+BuS6krmrXCmI6buHp8+eFESwIGO+m/Vv3WC7pllgyKCCS5Ve9U07QD/3Ag== ;{id = 53821 (zsk), size = 256b}
|
||||
.Ed
|
||||
.Pp
|
||||
If instead the key was intended to be used as a
|
||||
.Em KSK
|
||||
for the zone
|
||||
.Em ksk.example. ,
|
||||
then
|
||||
.Bd -literal -offset indent
|
||||
$ ldnssec-keygen filename -d ksk.example. -k <sk
|
||||
Kksk.example.+013+53822
|
||||
.Ed
|
||||
.Pp
|
||||
Again,
|
||||
after checking that there is no colliding keytag between the existing keys,
|
||||
it can be renamed with
|
||||
.Bd -literal -offset indent
|
||||
$ mv sk "$(ldnssec-keygen filename -d ksk.example. -k <sk).private"
|
||||
.Ed
|
||||
.Pp
|
||||
The corresponding DNSKEY record can be generated with
|
||||
.Bd -literal -offset indent
|
||||
$ ldnssec-keygen dnskey -d ksk.example. -k <Kksk.example.+013+53822.private
|
||||
ksk.example. 3600 IN DNSKEY 257 3 13 g02jgUGsc01VjH2bUM9Dob5ulaA+BuS6krmrXCmI6buHp8+eFESwIGO+m/Vv3WC7pllgyKCCS5Ve9U07QD/3Ag== ;{id = 53822 (ksk), size = 256b}
|
||||
.Ed
|
||||
.Pp
|
||||
(notice that the flags field is now 257 instead of 256),
|
||||
and the DS record can be generated with
|
||||
.Bd -literal -offset indent
|
||||
$ ldnssec-keygen ds -d ksk.example. <Kksk.example.+013+53822.private
|
||||
ksk.example. 3600 IN DS 53822 13 2 a48dcfa340625b26d428c6034d5e679c28ae1ccfcc7cd8b4649287e15306cb7b
|
||||
.Ed
|
||||
.Sh AUTHORS
|
||||
.An Lucas
|
||||
.Sh LICENSE
|
||||
.Nm
|
||||
is in the public domain.
|
||||
.Pp
|
||||
To the extent possible under law, the author(s) have dedicated all
|
||||
copyright and related and neighboring rights to this software to the
|
||||
public domain worldwide.
|
||||
.Pp
|
||||
.Lk http://creativecommons.org/publicdomain/zero/1.0/
|
||||
Loading…
Reference in New Issue
Block a user