dnssec-signzone.docbook

非常好的dns解析软件

        <term>-I <replaceable class="parameter">input-format</replaceable></term>
        <listitem>
          <para>
            The format of the input zone file.
	    Possible formats are <command>"text"</command> (default)
	    and <command>"raw"</command>.
	    This option is primarily intended to be used for dynamic
            signed zones so that the dumped zone file in a non-text
            format containing updates can be signed directly.
	    The use of this option does not make much sense for
	    non-dynamic zones.
          </para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>-j <replaceable class="parameter">jitter</replaceable></term>
        <listitem>
          <para>
            When signing a zone with a fixed signature lifetime, all
            RRSIG records issued at the time of signing expires
            simultaneously.  If the zone is incrementally signed, i.e.
            a previously signed zone is passed as input to the signer,
            all expired signatures has to be regenerated at about the
            same time.  The <option>jitter</option> option specifies a
            jitter window that will be used to randomize the signature
            expire time, thus spreading incremental signature
            regeneration over time.
          </para>
          <para>
            Signature lifetime jitter also to some extent benefits
            validators and servers by spreading out cache expiration,
            i.e. if large numbers of RRSIGs don't expire at the same time
            from all caches there will be less congestion than if all
            validators need to refetch at mostly the same time.
          </para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>-n <replaceable class="parameter">ncpus</replaceable></term>
        <listitem>
          <para>
            Specifies the number of threads to use.  By default, one
            thread is started for each detected CPU.
          </para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>-N <replaceable class="parameter">soa-serial-format</replaceable></term>
        <listitem>
          <para>
            The SOA serial number format of the signed zone.
	    Possible formats are <command>"keep"</command> (default),
            <command>"increment"</command> and
	    <command>"unixtime"</command>.
          </para>

          <variablelist>
	    <varlistentry>
	      <term><command>"keep"</command></term>
              <listitem>
                <para>Do not modify the SOA serial number.</para>
	      </listitem>
            </varlistentry>

	    <varlistentry>
	      <term><command>"increment"</command></term>
              <listitem>
                <para>Increment the SOA serial number using RFC 1982
                      arithmetics.</para>
	      </listitem>
            </varlistentry>

	    <varlistentry>
	      <term><command>"unixtime"</command></term>
              <listitem>
                <para>Set the SOA serial number to the number of seconds
	        since epoch.</para>
	      </listitem>
            </varlistentry>
	 </variablelist>

        </listitem>
      </varlistentry>

      <varlistentry>
        <term>-o <replaceable class="parameter">origin</replaceable></term>
        <listitem>
          <para>
            The zone origin.  If not specified, the name of the zone file
            is assumed to be the origin.
          </para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>-O <replaceable class="parameter">output-format</replaceable></term>
        <listitem>
          <para>
            The format of the output file containing the signed zone.
	    Possible formats are <command>"text"</command> (default)
	    and <command>"raw"</command>.
          </para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>-p</term>
        <listitem>
          <para>
            Use pseudo-random data when signing the zone.  This is faster,
            but less secure, than using real random data.  This option
            may be useful when signing large zones or when the entropy
            source is limited.
          </para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>-r <replaceable class="parameter">randomdev</replaceable></term>
        <listitem>
          <para>
            Specifies the source of randomness.  If the operating
            system does not provide a <filename>/dev/random</filename>
            or equivalent device, the default source of randomness
            is keyboard input.  <filename>randomdev</filename>
            specifies
            the name of a character device or file containing random
            data to be used instead of the default.  The special value
            <filename>keyboard</filename> indicates that keyboard
            input should be used.
          </para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>-t</term>
        <listitem>
          <para>
            Print statistics at completion.
          </para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>-v <replaceable class="parameter">level</replaceable></term>
        <listitem>
          <para>
            Sets the debugging level.
          </para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>-z</term>
        <listitem>
          <para>
            Ignore KSK flag on key when determining what to sign.
          </para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>zonefile</term>
        <listitem>
          <para>
            The file containing the zone to be signed.
          </para>
        </listitem>
      </varlistentry>

      <varlistentry>
        <term>key</term>
        <listitem>
          <para>
            The keys used to sign the zone.  If no keys are specified, the
            default all zone keys that have private key files in the
            current directory.
          </para>
        </listitem>
      </varlistentry>

    </variablelist>
  </refsect1>

  <refsect1>
    <title>EXAMPLE</title>
    <para>
      The following command signs the <userinput>example.com</userinput>
      zone with the DSA key generated in the <command>dnssec-keygen</command>
      man page.  The zone's keys must be in the zone.  If there are
      <filename>keyset</filename> files associated with child
      zones,
      they must be in the current directory.
      <userinput>example.com</userinput>, the following command would be
      issued:
    </para>
    <para><userinput>dnssec-signzone -o example.com db.example.com
        Kexample.com.+003+26160</userinput>
    </para>
    <para>
      The command would print a string of the form:
    </para>
    <para>
      In this example, <command>dnssec-signzone</command> creates
      the file <filename>db.example.com.signed</filename>.  This
      file
      should be referenced in a zone statement in a
      <filename>named.conf</filename> file.
    </para>
  </refsect1>

  <refsect1>
    <title>SEE ALSO</title>
    <para><citerefentry>
        <refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>
      </citerefentry>,
      <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
      <citetitle>RFC 2535</citetitle>.
    </para>
  </refsect1>

  <refsect1>
    <title>AUTHOR</title>
    <para><corpauthor>Internet Systems Consortium</corpauthor>
    </para>
  </refsect1>

</refentry><!--
 - Local variables:
 - mode: sgml
 - End:
-->