mirror of
https://github.com/NLnetLabs/dnst.git
synced 2026-09-28 20:54:57 +02:00
Add manual pages (#26)
* Fix sphinx default language * Add ldns-nsec3-hash man page based on the original, and adjust the dnst-nsec3-hash page to match the current help output of the command. * Update dnst-nsec3-hash.rst * Add key2ds manual * Add dnst-keygen manual * Change dnst-keygen algorithms to list from table * Change dnst-keygen algorithms back to table * Add ldns-keygen manual * Add notify manuals * Add signzone manuals * Add subcommands to dnst manual and table of contents * Update dnst-nsec3-hash manual * Add update manual * Apply feedback * Apply further feedback * Move signzone date description into own section * Update signzone hash iterations manual text * Add Arguments sections * Add basic intro text for dnst * Fix ldns-signzone default nsec3 hash iterations * Update nse3-hash defaults and wording * Update dnst-key2ds ignore-sep and force * Update nse3-hash default to what it is currently in main --------- Co-authored-by: Ximon Eighteen <3304436+ximon18@users.noreply.github.com> Co-authored-by: Terts Diepraam <terts.diepraam@gmail.com>
This commit is contained in:
Jannik
co-authored by
Ximon Eighteen
Terts Diepraam
Ximon Eighteen
Terts Diepraam
parent
511c8f1f6a
commit
bfbf492e32
@@ -100,7 +100,7 @@ master_doc = 'index'
|
||||
#
|
||||
# This is also used if you do content translation via gettext catalogs.
|
||||
# Usually you set "language" from the command line for these cases.
|
||||
language = None
|
||||
language = 'en'
|
||||
|
||||
# List of patterns, relative to source directory, that match files and
|
||||
# directories to ignore when looking for source files.
|
||||
@@ -189,8 +189,18 @@ latex_documents = [
|
||||
# (source start file, name, description, authors, manual section).
|
||||
man_pages = [
|
||||
('man/dnst', 'dnst', 'DNS Management Tools', author, 1),
|
||||
('man/dnst-nsec3-hash', 'dnst-nsec3-hash', 'DNS Management Tools', author,
|
||||
1),
|
||||
('man/dnst-key2ds', 'dnst-key2ds', 'Generate DS RRs from the DNSKEYs in a keyfile', author, 1),
|
||||
('man/ldns-key2ds', 'ldns-key2ds', 'Generate DS RRs from the DNSKEYs in a keyfile', author, 1),
|
||||
('man/dnst-keygen', 'dnst-keygen', 'Generate a new key pair for a domain name', author, 1),
|
||||
('man/ldns-keygen', 'ldns-keygen', 'Generate a new key pair for a domain name', author, 1),
|
||||
('man/dnst-notify', 'dnst-notify', 'Send a NOTIFY message to a list of name servers', author, 1),
|
||||
('man/ldns-notify', 'ldns-notify', 'Send a NOTIFY message to a list of name servers', author, 1),
|
||||
('man/dnst-nsec3-hash', 'dnst-nsec3-hash', 'Print out the NSEC3 hash of a domain name', author, 1),
|
||||
('man/ldns-nsec3-hash', 'ldns-nsec3-hash', 'Print out the NSEC3 hash of a domain name', author, 1),
|
||||
('man/dnst-signzone', 'dnst-signzone', 'Sign the zone with the given key(s)', author, 1),
|
||||
('man/ldns-signzone', 'ldns-signzone', 'Sign the zone with the given key(s)', author, 1),
|
||||
('man/dnst-update', 'dnst-update', 'Send a dynamic update packet to update an IP (or delete all existing IPs) for a domain name', author, 1),
|
||||
('man/ldns-update', 'ldns-update', 'Send a dynamic update packet to update an IP (or delete all existing IPs) for a domain name', author, 1),
|
||||
]
|
||||
|
||||
|
||||
|
||||
@@ -1,7 +1,12 @@
|
||||
dnst |version|
|
||||
==============
|
||||
|
||||
The manual goes here ...
|
||||
**dnst** is a DNS administration toolbox. It offers DNS and DNSSEC related
|
||||
functions like key generation, zone signing, printing NSEC3 hashed domain
|
||||
names, and sending UPDATE or NOTIFY messages to your name servers. More is
|
||||
coming soon.
|
||||
|
||||
It depends on OpenSSL for its cryptography related functions.
|
||||
|
||||
.. toctree::
|
||||
:maxdepth: 2
|
||||
@@ -10,5 +15,22 @@ The manual goes here ...
|
||||
:name: toc-reference
|
||||
|
||||
man/dnst
|
||||
man/dnst-key2ds
|
||||
man/dnst-keygen
|
||||
man/dnst-notify
|
||||
man/dnst-nsec3-hash
|
||||
man/dnst-signzone
|
||||
man/dnst-update
|
||||
|
||||
.. toctree::
|
||||
:maxdepth: 2
|
||||
:hidden:
|
||||
:caption: LDNS Tools reference
|
||||
:name: toc-reference-ldns
|
||||
|
||||
man/ldns-key2ds
|
||||
man/ldns-keygen
|
||||
man/ldns-notify
|
||||
man/ldns-nsec3-hash
|
||||
man/ldns-signzone
|
||||
man/ldns-update
|
||||
|
||||
@@ -0,0 +1,45 @@
|
||||
dnst key2ds
|
||||
===============
|
||||
|
||||
Synopsis
|
||||
--------
|
||||
|
||||
:program:`dnst key2ds` ``[OPTIONS]`` ``<KEYFILE>``
|
||||
|
||||
Description
|
||||
-----------
|
||||
|
||||
**dnst key2ds** generates a DS RR for each DNSKEY in ``<KEYFILE>``.
|
||||
|
||||
The following file will be created for each key: ``K<name>+<alg>+<id>.ds``. The
|
||||
base name ``K<name>+<alg>+<id>`` will be printed to stdout.
|
||||
|
||||
|
||||
Options
|
||||
-------
|
||||
|
||||
.. option:: -a <NUMBER OR MNEMONIC>, --algorithm <NUMBER OR MNEMONIC>
|
||||
|
||||
Use the given algorithm for the digest. Defaults to the digest algorithm
|
||||
used for the DNSKEY, and if it can't be determined SHA-1.
|
||||
|
||||
.. option:: -f, --force
|
||||
|
||||
Overwrite existing ``.ds`` files.
|
||||
|
||||
.. option:: --ignore-sep
|
||||
|
||||
Ignore the SEP flag and make DS records for any key.
|
||||
|
||||
.. option:: -n
|
||||
|
||||
Write the generated DS records to stdout instead of a file.
|
||||
|
||||
.. option:: -h, --help
|
||||
|
||||
Print the help text (short summary with ``-h``, long help with
|
||||
``--help``).
|
||||
|
||||
.. option:: -V, --version
|
||||
|
||||
Print the version.
|
||||
@@ -0,0 +1,74 @@
|
||||
dnst keygen
|
||||
===============
|
||||
|
||||
Synopsis
|
||||
--------
|
||||
|
||||
:program:`dnst keygen` ``[OPTIONS]`` ``-a <ALGORITHM>`` ``<DOMAIN NAME>``
|
||||
|
||||
Description
|
||||
-----------
|
||||
|
||||
**dnst keygen** generates a new key pair for a given domain name.
|
||||
|
||||
The following files will be created:
|
||||
|
||||
- ``K<name>+<alg>+<tag>.key``: The public key file containing a DNSKEY RR in
|
||||
zone file format.
|
||||
|
||||
- ``K<name>+<alg>+<tag>.private``: The private key file containing the private
|
||||
key data fields in BIND's *Private-key-format*.
|
||||
|
||||
- ``K<name>+<alg>+<tag>.ds``: The public key digest file containing the DS RR
|
||||
in zone file format. It is only created for key signing keys.
|
||||
|
||||
| ``<name>`` is the fully-qualified owner name for the key (with a trailing dot).
|
||||
| ``<alg>`` is the algorithm number of the key, zero-padded to 3 digits.
|
||||
| ``<tag>`` is the 16-bit tag of the key, zero-padded to 5 digits.
|
||||
|
||||
Upon completion, ``K<name>+<alg>+<tag>`` will be printed.
|
||||
|
||||
Options
|
||||
-------
|
||||
|
||||
.. option:: -a <NUMBER OR MNEMONIC>
|
||||
|
||||
Use the given signing algorithm.
|
||||
|
||||
Possible values are:
|
||||
|
||||
=================== ========== =========================
|
||||
**Mnemonic** **Number** **Description**
|
||||
=================== ========== =========================
|
||||
``list`` List available algorithms
|
||||
``RSASHA256`` 8 RSA with SHA-256
|
||||
``ECDSAP256SHA256`` 13 ECDSA P-256 with SHA-256
|
||||
``ECDSAP384SHA384`` 14 ECDSA P-384 with SHA-384
|
||||
``ED25519`` 15 ED25519
|
||||
``ED448`` 16 ED448
|
||||
=================== ========== =========================
|
||||
|
||||
.. option:: -k
|
||||
|
||||
Generate a key signing key (KSK) instead of a zone signing key (ZSK).
|
||||
|
||||
.. option:: -b <BITS>
|
||||
|
||||
The length of the key (for RSA keys only). Defaults to 2048.
|
||||
|
||||
.. option:: -r <DEVICE>
|
||||
|
||||
The randomness source to use for generation. Defaults to ``/dev/urandom``.
|
||||
|
||||
.. option:: -s
|
||||
|
||||
Create symlinks ``.key`` and ``.private`` to the generated keys.
|
||||
|
||||
.. option:: -f
|
||||
|
||||
Overwrite existing symlinks (for use with ``-s``).
|
||||
|
||||
.. option:: -h, --help
|
||||
|
||||
Print the help text (short summary with ``-h``, long help with
|
||||
``--help``).
|
||||
@@ -0,0 +1,50 @@
|
||||
dnst notify
|
||||
===============
|
||||
|
||||
Synopsis
|
||||
--------
|
||||
|
||||
:program:`dnst notify` ``[OPTIONS]`` ``-z <ZONE>`` ``<SERVERS>...``
|
||||
|
||||
Description
|
||||
-----------
|
||||
|
||||
**dnst notify** sends a NOTIFY message to the specified name servers. A name
|
||||
server can be specified as a domain name or IP address.
|
||||
|
||||
This tells them that an updated zone is available at the primaries. It can
|
||||
perform TSIG signatures, and it can add a SOA serial number of the updated
|
||||
zone. If a server already has that serial number it will disregard the message.
|
||||
|
||||
Options
|
||||
-------
|
||||
|
||||
.. option:: -z <ZONE>
|
||||
|
||||
The zone to send the NOTIFY for.
|
||||
|
||||
.. option:: -s <SOA VERSION>
|
||||
|
||||
SOA version number to include in the NOTIFY message.
|
||||
|
||||
.. option:: -y, --tsig <NAME:KEY[:ALGO]>
|
||||
|
||||
A base64 TSIG key and optional algorithm to use for the NOTIFY message.
|
||||
The algorithm defaults to **hmac-sha512**.
|
||||
|
||||
.. option:: -p, --port <PORT>
|
||||
|
||||
Destination port to send the UDP packet to. Defaults to 53.
|
||||
|
||||
.. option:: -d, --debug
|
||||
|
||||
Print debug information.
|
||||
|
||||
.. option:: -r, --retries <RETRIES>
|
||||
|
||||
Max number of retries. Defaults to 15.
|
||||
|
||||
.. option:: -h, --help
|
||||
|
||||
Print the help text (short summary with ``-h``, long help with
|
||||
``--help``).
|
||||
@@ -1,30 +1,39 @@
|
||||
dnst-nsec3-hash
|
||||
dnst nsec3-hash
|
||||
===============
|
||||
|
||||
Synopsis
|
||||
--------
|
||||
|
||||
:program:`dnst nsec3-hash` [``options``] :samp:`domain-name`
|
||||
:program:`dnst nsec3-hash` ``[OPTIONS]`` ``<DOMAIN NAME>``
|
||||
|
||||
Description
|
||||
-----------
|
||||
|
||||
**dnst nsec3-hash** prints the NSEC3 hash for the given domain name.
|
||||
**dnst nsec3-hash** prints the NSEC3 hash of a given domain name.
|
||||
|
||||
Options
|
||||
-------
|
||||
|
||||
.. option:: -a number-or-mnemonic, --algorithm=number-or-mnemonic
|
||||
.. option:: -a <NUMBER OR MNEMONIC>, --algorithm <NUMBER OR MNEMONIC>
|
||||
|
||||
Use the given algorithm number for the hash calculation. Defaults to
|
||||
``sha1``.
|
||||
1 (SHA-1).
|
||||
|
||||
.. option:: -s salt, --salt=count
|
||||
.. option:: -i <NUMBER>, -t <NUMBER>, --iterations <NUMBER>
|
||||
|
||||
Use the given number of additional iterations for the hash
|
||||
calculation. Defaults to 1.
|
||||
|
||||
.. option:: -s <HEX STRING>, --salt <HEX STRING>
|
||||
|
||||
Use the given salt for the hash calculation. The salt value should be
|
||||
in hexadecimal format.
|
||||
in hexadecimal format. Defaults to an empty salt.
|
||||
|
||||
.. option:: -i count, -t count, --iterations=count
|
||||
.. option:: -h, --help
|
||||
|
||||
Use *count* iterations for the hash calculation.
|
||||
Print the help text (short summary with ``-h``, long help with
|
||||
``--help``).
|
||||
|
||||
.. option:: -V, --version
|
||||
|
||||
Print the version.
|
||||
|
||||
@@ -0,0 +1,118 @@
|
||||
dnst signzone
|
||||
===============
|
||||
|
||||
Synopsis
|
||||
--------
|
||||
|
||||
:program:`dnst signzone` ``[OPTIONS]`` ``<ZONEFILE>`` ``<KEY>...``
|
||||
|
||||
Description
|
||||
-----------
|
||||
|
||||
**dnst signzone** signs the zonefile with the given key(s).
|
||||
|
||||
Keys must be specified by their base name (usually ``K<name>+<alg>+<id>``),
|
||||
i.e. WITHOUT the ``.private`` or ``.key`` extension. Both ``.private`` and
|
||||
``.key`` files are required.
|
||||
|
||||
Arguments
|
||||
---------
|
||||
|
||||
.. option:: <ZONEFILE>
|
||||
|
||||
The zonefile to sign.
|
||||
|
||||
.. option:: <KEY>...
|
||||
|
||||
The keys to sign the zonefile with.
|
||||
|
||||
Options
|
||||
-------
|
||||
|
||||
.. option:: -b
|
||||
|
||||
Add comments on DNSSEC records. Without this option only DNSKEY RRs
|
||||
will have their key tag annotated in the comment.
|
||||
|
||||
.. option:: -d
|
||||
|
||||
Do not add used keys to the resulting zonefile.
|
||||
|
||||
.. option:: -e <DATE>
|
||||
|
||||
Set the expiration date of signatures to this date (see
|
||||
:ref:`dnst-signzone-dates`). Defaults to 4 weeks from now.
|
||||
|
||||
.. option:: -f <FILE>
|
||||
|
||||
Write signed zone to file. Use ``-f -`` to output to stdout. Defaults to
|
||||
``<ZONEFILE>.signed``.
|
||||
|
||||
.. option:: -i <DATE>
|
||||
|
||||
Set the inception date of signatures to this date (see
|
||||
:ref:`dnst-signzone-dates`). Defaults to now.
|
||||
|
||||
.. option:: -o <DOMAIN>
|
||||
|
||||
Set the origin for the zone (only necessary for zonefiles with relative
|
||||
names and no $ORIGIN).
|
||||
|
||||
.. option:: -u
|
||||
|
||||
Set SOA serial to the number of seconds since Jan 1st 1970.
|
||||
|
||||
If this would NOT result in the SOA serial increasing it will be
|
||||
incremented instead.
|
||||
|
||||
.. option:: -n
|
||||
|
||||
Use NSEC3 instead of NSEC. By default, RFC 9276 best practice settings
|
||||
are used: SHA-1, no extra iterations, empty salt. To use different NSEC3
|
||||
settings see :ref:`dnst-signzone-nsec3-options`.
|
||||
|
||||
.. option:: -H
|
||||
|
||||
Hash only, don't sign.
|
||||
|
||||
.. option:: -h, --help
|
||||
|
||||
Print the help text (short summary with ``-h``, long help with
|
||||
``--help``).
|
||||
|
||||
|
||||
.. _dnst-signzone-nsec3-options:
|
||||
|
||||
NSEC3 options
|
||||
--------------------------------
|
||||
|
||||
The following options can be used with ``-n`` to override the default NSEC3
|
||||
settings used.
|
||||
|
||||
.. option:: -a <ALGORITHM NUMBER OR MNEMONIC>
|
||||
|
||||
Specify the hashing algorithm. Defaults to SHA-1.
|
||||
|
||||
.. option:: -t <NUMBER>
|
||||
|
||||
Set the number of extra hash iterations. Defaults to 0.
|
||||
|
||||
.. option:: -s <STRING>
|
||||
|
||||
Specify the salt as a hex string. Defaults to ``-``, meaning empty salt.
|
||||
|
||||
.. option:: -p
|
||||
|
||||
Set the opt-out flag on all NSEC3 RRs.
|
||||
|
||||
.. option:: -A
|
||||
|
||||
Set the opt-out flag on all NSEC3 RRs and skip unsigned delegations.
|
||||
|
||||
.. _dnst-signzone-dates:
|
||||
|
||||
DATES
|
||||
-----
|
||||
|
||||
A date can be a UNIX timestamp as seconds since the Epoch (1970-01-01
|
||||
00:00 UTC), or of the form ``<YYYYMMdd[hhmmss]>``.
|
||||
@@ -0,0 +1,46 @@
|
||||
dnst update
|
||||
===============
|
||||
|
||||
Synopsis
|
||||
--------
|
||||
|
||||
:program:`dnst update` ``<DOMAIN NAME>`` ``[ZONE]`` ``<IP>``
|
||||
``[<TSIG KEY NAME> <TSIG ALGORITHM> <TSIG KEY DATA>]``
|
||||
|
||||
Description
|
||||
-----------
|
||||
|
||||
**dnst update** sends a dynamic update packet to update an IP (or delete all
|
||||
existing IPs) for a domain name.
|
||||
|
||||
Arguments
|
||||
---------
|
||||
|
||||
.. option:: <DOMAIN NAME>
|
||||
|
||||
The domain name to update the IP address of
|
||||
|
||||
.. option:: <ZONE>
|
||||
|
||||
The zone to send the update to (if omitted, derived from SOA record)
|
||||
|
||||
.. option:: <IP>
|
||||
|
||||
The IP to update the domain with (``none`` to remove any existing IPs)
|
||||
|
||||
.. option:: <TSIG KEY NAME>
|
||||
|
||||
TSIG key name
|
||||
|
||||
.. option:: <TSIG ALGORITHM>
|
||||
|
||||
TSIG algorithm (e.g. "hmac-sha256")
|
||||
|
||||
.. option:: <TSIG KEY DATA>
|
||||
|
||||
Base64 encoded TSIG key data.
|
||||
|
||||
.. option:: -h, --help
|
||||
|
||||
Print the help text (short summary with ``-h``, long help with
|
||||
``--help``).
|
||||
@@ -4,15 +4,15 @@ dnst
|
||||
Synopsis
|
||||
--------
|
||||
|
||||
:program:`dnst` [``options``] ``command`` [``args``]
|
||||
:program:`dnst` ``[OPTIONS]`` ``<COMMAND>`` ``[ARGS]``
|
||||
|
||||
Description
|
||||
-----------
|
||||
|
||||
Manage various aspects of the Domain Name System (DNS).
|
||||
|
||||
dnst provides a number of commands that perform various tasks related
|
||||
managing DNS server and DNS zones.
|
||||
**dnst** provides a number of commands that perform various tasks related to
|
||||
managing DNS servers and DNS zones.
|
||||
|
||||
Please consult the manual pages for these individual commands for more
|
||||
information.
|
||||
@@ -22,7 +22,26 @@ dnst Commands
|
||||
|
||||
.. glossary::
|
||||
|
||||
:doc:`dnst-key2ds <dnst-key2ds>` (1)
|
||||
|
||||
Generate DS RRs from the DNSKEYs in a keyfile.
|
||||
|
||||
:doc:`dnst-keygen <dnst-keygen>` (1)
|
||||
|
||||
Generate a new key pair for a domain name.
|
||||
|
||||
:doc:`dnst-notify <dnst-notify>` (1)
|
||||
|
||||
Send a NOTIFY message to a list of name servers.
|
||||
|
||||
:doc:`dnst-nsec3-hash <dnst-nsec3-hash>` (1)
|
||||
|
||||
Prints the NSEC3 hash for a domain name.
|
||||
Print out the NSEC3 hash of a domain name.
|
||||
|
||||
:doc:`dnst-signzone <dnst-signzone>` (1)
|
||||
|
||||
Sign the zone with the given key(s).
|
||||
|
||||
:doc:`dnst-update <dnst-update>` (1)
|
||||
|
||||
Send a dynamic update packet to update an IP (or delete all existing IPs) for a domain name.
|
||||
|
||||
@@ -0,0 +1,43 @@
|
||||
ldns-key2ds
|
||||
===============
|
||||
|
||||
Synopsis
|
||||
--------
|
||||
|
||||
:program:`ldns-key2ds` ``[OPTIONS]`` ``<KEYFILE>``
|
||||
|
||||
Description
|
||||
-----------
|
||||
|
||||
**ldns-key2ds** is used to transform a public DNSKEY RR to a DS RR. When run
|
||||
it will read ``<KEYFILE>`` with a DNSKEY RR in it, and it will create a .ds
|
||||
file with the DS RR in it.
|
||||
|
||||
It prints out the basename for this file (``K<name>+<alg>+<id>``).
|
||||
|
||||
By default, it takes a pick of algorithm similar to the key algorithm,
|
||||
SHA1 for RSASHA1, and so on.
|
||||
|
||||
|
||||
Options
|
||||
-------
|
||||
|
||||
.. option:: -f
|
||||
|
||||
Ignore SEP flag (i.e. make DS records for any key)
|
||||
|
||||
.. option:: -n
|
||||
|
||||
Write the result DS Resource Record to stdout instead of a file
|
||||
|
||||
.. option:: -1
|
||||
|
||||
Use SHA1 as the hash function.
|
||||
|
||||
.. option:: -2
|
||||
|
||||
Use SHA256 as the hash function
|
||||
|
||||
.. option:: -4
|
||||
|
||||
Use SHA383 as the hash function
|
||||
@@ -0,0 +1,60 @@
|
||||
ldns-keygen
|
||||
===============
|
||||
|
||||
Synopsis
|
||||
--------
|
||||
|
||||
:program:`ldns-keygen` ``[OPTIONS]`` ``<DOMAIN NAME>``
|
||||
|
||||
Description
|
||||
-----------
|
||||
|
||||
**ldns-keygen** is used to generate a private/public keypair. When run, it will
|
||||
create 3 files; a ``.key`` file with the public DNSKEY, a ``.private`` file
|
||||
with the private keydata and a ``.ds`` file with the DS record of the DNSKEY
|
||||
record.
|
||||
|
||||
.. **ldns-keygen** can also be used to create symmetric keys (for TSIG) by
|
||||
.. selecting the appropriate algorithm: hmac-md5.sig-alg.reg.int, hmac-sha1,
|
||||
.. hmac-sha224, hmac-sha256, hmac-sha384 or hmac-sha512. In that case no DS record
|
||||
.. will be created and no .ds file.
|
||||
|
||||
ldns-keygen prints the basename for the key files: ``K<name>+<alg>+<id>``
|
||||
|
||||
Options
|
||||
-------
|
||||
|
||||
.. option:: -a <ALGORITHM>
|
||||
|
||||
Create a key with this algorithm. Specifying 'list' here gives a list of
|
||||
supported algorithms. Several alias names are also accepted (from older
|
||||
versions and other software), the list gives names from the RFC. Also the
|
||||
plain algorithm number is accepted.
|
||||
|
||||
.. option:: -b <BITS>
|
||||
|
||||
Use this many bits for the key length.
|
||||
|
||||
.. option:: -k
|
||||
|
||||
When given, generate a key signing key. This just sets the flag field to
|
||||
257 instead of 256 in the DNSKEY RR in the .key file.
|
||||
|
||||
.. option:: -r <DEVICE>
|
||||
|
||||
Make ldns-keygen use this file to seed the random generator with. This
|
||||
will default to /dev/random.
|
||||
|
||||
.. option:: -s
|
||||
|
||||
ldns-keygen will create symbolic links named ``.private`` to the new
|
||||
generated private key, ``.key`` to the public DNSKEY and ``.ds`` to the
|
||||
file containing DS record data.
|
||||
|
||||
.. option:: -f
|
||||
|
||||
Force symlinks to be overwritten if they exist.
|
||||
|
||||
.. option:: -v
|
||||
|
||||
Show the version and exit
|
||||
@@ -0,0 +1,60 @@
|
||||
ldns-notify
|
||||
===============
|
||||
|
||||
Synopsis
|
||||
--------
|
||||
|
||||
:program:`ldns-notify` ``[OPTIONS]`` ``-z <ZONE>`` ``<SERVERS>...``
|
||||
|
||||
Description
|
||||
-----------
|
||||
|
||||
**ldns-notify** sends a NOTIFY packet to the specified name servers. A name
|
||||
server can be specified as a domain name or IP address.
|
||||
|
||||
This tells them that an updated zone is available at the primaries. It can
|
||||
perform TSIG signatures, and it can add a SOA serial number of the updated
|
||||
zone. If a server already has that serial number it will disregard the message.
|
||||
|
||||
Options
|
||||
-------
|
||||
|
||||
.. option:: -z <ZONE>
|
||||
|
||||
The zone that is updated.
|
||||
|
||||
.. ..option:: -I <ADDRESS>
|
||||
..
|
||||
.. Source IP to send the message from.
|
||||
|
||||
.. option:: -s <SOA VERSION>
|
||||
|
||||
Append a SOA record indicating the serial number of the updated zone.
|
||||
|
||||
.. option:: -p <PORT>
|
||||
|
||||
Destination port to send the UDP packet to. Defaults to 53.
|
||||
|
||||
.. option:: -y <NAME:KEY[:ALGO]>
|
||||
|
||||
A base64 TSIG key and optional algorithm to use for the NOTIFY message.
|
||||
The algorithm defaults to hmac-sha512.
|
||||
|
||||
.. option:: -d
|
||||
|
||||
Print verbose debug information. The query that is sent and the query
|
||||
that is received.
|
||||
|
||||
.. option:: -r <RETRIES>
|
||||
|
||||
Specify the maximum number of retries before notify gives up trying to
|
||||
send the UDP packet.
|
||||
|
||||
.. option:: -h
|
||||
|
||||
Print the help text and exit.
|
||||
|
||||
.. option:: -v
|
||||
|
||||
Print the version and exit.
|
||||
|
||||
@@ -0,0 +1,30 @@
|
||||
ldns-nsec3-hash
|
||||
===============
|
||||
|
||||
Synopsis
|
||||
--------
|
||||
|
||||
:program:`ldns-nsec3-hash` ``[OPTIONS]`` ``<DOMAIN NAME>``
|
||||
|
||||
Description
|
||||
-----------
|
||||
|
||||
**ldns-nsec3-hash** is used to print out the NSEC3 hash for the given domain name.
|
||||
|
||||
Options
|
||||
-------
|
||||
|
||||
.. option:: -a <NUMBER>
|
||||
|
||||
Use the given algorithm number for the hash calculation. Defaults to
|
||||
1 (SHA-1).
|
||||
|
||||
.. option:: -s <SALT>
|
||||
|
||||
Use the given salt for the hash calculation. The salt value should be
|
||||
in hexadecimal format. Defaults to an empty salt.
|
||||
|
||||
.. option:: -t <COUNT>
|
||||
|
||||
Use the given number of additional iterations for the hash
|
||||
calculation. Defaults to 1.
|
||||
@@ -0,0 +1,109 @@
|
||||
ldns-signzone
|
||||
===============
|
||||
|
||||
Synopsis
|
||||
--------
|
||||
|
||||
:program:`ldns-signzone` ``[OPTIONS]`` ``<ZONEFILE>`` ``<KEY>...``
|
||||
|
||||
Description
|
||||
-----------
|
||||
|
||||
**ldns-signzone** signs the zone with the given key(s).
|
||||
|
||||
Keys must be specified by their base name (usually ``K<name>+<alg>+<id>``),
|
||||
i.e. WITHOUT the ``.private`` or ``.key`` extension. Both ``.private`` and
|
||||
``.key`` files are required.
|
||||
|
||||
Arguments
|
||||
---------
|
||||
|
||||
.. option:: <ZONEFILE>
|
||||
|
||||
The zonefile to sign.
|
||||
|
||||
.. option:: <KEY>...
|
||||
|
||||
The keys to sign the zonefile with.
|
||||
|
||||
Options
|
||||
-------
|
||||
|
||||
.. option:: -b
|
||||
|
||||
Add comments on DNSSEC records. Without this option only DNSKEY RRs
|
||||
will have their key tag annotated in the comment.
|
||||
|
||||
.. option:: -d
|
||||
|
||||
Do not add used keys to the resulting zonefile.
|
||||
|
||||
.. option:: -e <DATE>
|
||||
|
||||
Set the expiration date of signatures to this date (see
|
||||
:ref:`ldns-signzone-dates`). Defaults to 4 weeks from now.
|
||||
|
||||
.. option:: -f <FILE>
|
||||
|
||||
Write signed zone to file. Use ``-f -`` to output to stdout. Defaults to
|
||||
``<ZONEFILE>.signed``.
|
||||
|
||||
.. option:: -i <DATE>
|
||||
|
||||
Set the inception date of signatures to this date (see
|
||||
:ref:`ldns-signzone-dates`). Defaults to now.
|
||||
|
||||
.. option:: -o <DOMAIN>
|
||||
|
||||
Set the origin for the zone (only necessary for zonefiles with
|
||||
relative names and no $ORIGIN).
|
||||
|
||||
.. option:: -u
|
||||
|
||||
Set SOA serial to the number of seconds since Jan 1st 1970.
|
||||
|
||||
.. option:: -n
|
||||
|
||||
Use NSEC3 instead of NSEC. If specified, you can use extra options (see
|
||||
:ref:`ldns-signzone-nsec3-options`).
|
||||
|
||||
.. option:: -h
|
||||
|
||||
Print the help text.
|
||||
|
||||
.. option:: -v
|
||||
|
||||
Print the version and exit.
|
||||
|
||||
|
||||
.. _ldns-signzone-nsec3-options:
|
||||
|
||||
NSEC3 options
|
||||
--------------------------------
|
||||
|
||||
The following options can be used with ``-n`` to override the default NSEC3
|
||||
settings used.
|
||||
|
||||
.. option:: -a <ALGORITHM>
|
||||
|
||||
Specify the hashing algorithm. Defaults to SHA-1.
|
||||
|
||||
.. option:: -t <NUMBER>
|
||||
|
||||
Set the number of extra hash iterations. Defaults to 1.
|
||||
|
||||
.. option:: -s <STRING>
|
||||
|
||||
Specify the salt as a hex string. Defaults to ``-``, meaning empty salt.
|
||||
|
||||
.. option:: -p
|
||||
|
||||
Set the opt-out flag on all NSEC3 RRs.
|
||||
|
||||
.. _ldns-signzone-dates:
|
||||
|
||||
DATES
|
||||
-----
|
||||
|
||||
A date can be a UNIX timestamp as seconds since the Epoch (1970-01-01
|
||||
00:00 UTC), or of the form ``<YYYYMMdd[hhmmss]>``.
|
||||
@@ -0,0 +1,46 @@
|
||||
ldns-update
|
||||
===============
|
||||
|
||||
Synopsis
|
||||
--------
|
||||
|
||||
:program:`ldns-update` ``<DOMAIN NAME>`` ``[ZONE]`` ``<IP>``
|
||||
``[<TSIG KEY NAME> <TSIG ALGORITHM> <TSIG KEY DATA>]``
|
||||
|
||||
Description
|
||||
-----------
|
||||
|
||||
**ldns-update** sends a dynamic update packet to update an IP (or delete all
|
||||
existing IPs) for a domain name.
|
||||
|
||||
Options
|
||||
-------
|
||||
|
||||
.. option:: <DOMAIN NAME>
|
||||
|
||||
The domain name to update the IP address of
|
||||
|
||||
.. option:: <ZONE>
|
||||
|
||||
The zone to send the update to (if omitted, derived from SOA record)
|
||||
|
||||
.. option:: <IP>
|
||||
|
||||
The IP to update the domain with (``none`` to remove any existing IPs)
|
||||
|
||||
.. option:: <TSIG KEY NAME>
|
||||
|
||||
TSIG key name
|
||||
|
||||
.. option:: <TSIG ALGORITHM>
|
||||
|
||||
TSIG algorithm (e.g. "hmac-sha256")
|
||||
|
||||
.. option:: <TSIG KEY DATA>
|
||||
|
||||
Base64 encoded TSIG key data.
|
||||
|
||||
.. option:: -h, --help
|
||||
|
||||
Print the help text (short summary with ``-h``, long help with
|
||||
``--help``).
|
||||
Reference in New Issue
Block a user