Only sign the DNSKEY RRset with key-signing keys, and omit - signatures from zone-signing keys. + signatures from zone-signing keys. (This is similar to the + dnskey-ksk-only yes; zone option in + named.)
Ignore KSK flag on key when determining what to sign. This causes KSK-flagged keys to sign all records, not just the - DNSKEY RRset. + DNSKEY RRset. (This is similar to the + update-check-ksk no; zone option in + named.)
salt@@ -375,14 +379,15 @@
The following command signs the example.com
zone with the DSA key generated by dnssec-keygen
- (Kexample.com.+003+17247). The zone's keys must be in the master
- file (db.example.com). This invocation looks
- for keyset files, in the current directory,
- so that DS records can be generated from them (-g).
+ (Kexample.com.+003+17247). Because the -S option
+ is not being used, the zone's keys must be in the master file
+ (db.example.com). This invocation looks
+ for dsset files, in the current directory,
+ so that DS records can be imported from them (-g).
% dnssec-signzone -g -o example.com db.example.com \ Kexample.com.+003+17247 @@ -404,14 +409,14 @@ db.example.com.signed %
Retransfer the given zone from the master.
sign zone
+ [class
+ [view]]+ Fetch all DNSSEC keys for the given zone + from the key directory (see + key-directory in + the section called “options Statement Definition and + Usage”), and merge them + into the zone's DNSKEY RRset. If the DNSKEY RRset + is changed as a result of this, then the zone is + automatically re-signed with the new key set. +
+
+ This command requires that the
+ auto-dnssec zone option to be set
+ to allow,
+ maintain, or
+ create, and also requires
+ the zone to be configured to allow dynamic DNS.
+ See the section called “Dynamic Update Policies” for
+ more details.
+
freeze
[zone
[class
@@ -760,7 +786,7 @@ controls {
Certain UNIX signals cause the name server to take specific
actions, as described in the following table. These signals can
diff --git a/doc/arm/Bv9ARM.ch04.html b/doc/arm/Bv9ARM.ch04.html
index 8bfc4cf8f9..f49bff7b43 100644
--- a/doc/arm/Bv9ARM.ch04.html
+++ b/doc/arm/Bv9ARM.ch04.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -49,29 +49,29 @@
Dynamic Update
Incremental Zone Transfers (IXFR)
-Split DNS
-Split DNS
+TSIG
-- Generate Shared Keys for Each Pair of Hosts
-- Copying the Shared Secret to Both Machines
-- Informing the Servers of the Key's Existence
-- Instructing the Server to Use the Key
-- TSIG Key Based Access Control
-- Errors
+- Generate Shared Keys for Each Pair of Hosts
+- Copying the Shared Secret to Both Machines
+- Informing the Servers of the Key's Existence
+- Instructing the Server to Use the Key
+- TSIG Key Based Access Control
+- Errors
TKEY
-SIG(0)
+TKEY
+SIG(0)
DNSSEC
IPv6 Support in BIND 9
+IPv6 Support in BIND 9
Setting up different views, or visibility, of the DNS space to
internal and external resolvers is usually referred to as a
@@ -249,7 +249,7 @@
Let's say a company named Example, Inc.
(example.com)
@@ -506,7 +506,7 @@ nameserver 172.16.72.4
A shared secret is generated to be shared between host1 and host2.
An arbitrary key name is chosen: "host1-host2.". The key name must
@@ -514,7 +514,7 @@ nameserver 172.16.72.4
The following command will generate a 128-bit (16 byte) HMAC-SHA256
key as described above. Longer keys are better, but shorter keys
@@ -538,7 +538,7 @@ nameserver 172.16.72.4
The shared secret is simply a random sequence of bits, encoded
in base-64. Most ASCII strings are valid base-64 strings (assuming
@@ -553,7 +553,7 @@ nameserver 172.16.72.4
This is beyond the scope of DNS. A secure transport mechanism
should be used. This could be secure FTP, ssh, telephone, etc.
@@ -561,7 +561,7 @@ nameserver 172.16.72.4
Imagine host1 and host 2
are
@@ -588,7 +588,7 @@ key host1-host2. {
Since keys are shared between two hosts only, the server must
be told when keys are to be used. The following is added to the named.conf file
@@ -620,7 +620,7 @@ server 10.1.2.3 {
BIND allows IP addresses and ranges
to be specified in ACL
@@ -647,7 +647,7 @@ allow-update { key host1-host2. ;};
The processing of TSIG signed messages can result in
several errors. If a signed message is sent to a non-TSIG aware
@@ -673,7 +673,7 @@ allow-update { key host1-host2. ;};
TKEY
is a mechanism for automatically generating a shared secret
between two hosts. There are several "modes" of
@@ -709,7 +709,7 @@ allow-update { key host1-host2. ;};
BIND 9 partially supports DNSSEC SIG(0)
transaction signatures as specified in RFC 2535 and RFC 2931.
@@ -770,7 +770,7 @@ allow-update { key host1-host2. ;};
The dnssec-keygen program is used to
generate keys.
@@ -826,7 +826,7 @@ allow-update { key host1-host2. ;};
The dnssec-signzone program is used
to sign a zone.
@@ -868,7 +868,7 @@ allow-update { key host1-host2. ;};
To enable named to respond appropriately
to DNS requests from DNSSEC aware clients,
@@ -1014,7 +1014,7 @@ options {
BIND 9 fully supports all currently
defined forms of IPv6 name to address and address to name
@@ -1052,7 +1052,7 @@ options {
The IPv6 AAAA record is a parallel to the IPv4 A record,
and, unlike the deprecated A6 record, specifies the entire
@@ -1071,7 +1071,7 @@ host 3600 IN AAAA 2001:db8::1
When looking up an address in nibble format, the address
components are simply reversed, just as in IPv4, and
diff --git a/doc/arm/Bv9ARM.ch05.html b/doc/arm/Bv9ARM.ch05.html
index 23817c79e5..cc6bc909f9 100644
--- a/doc/arm/Bv9ARM.ch05.html
+++ b/doc/arm/Bv9ARM.ch05.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -45,13 +45,13 @@
Table of Contents
Traditionally applications have been linked with a stub resolver
library that sends recursive DNS queries to a local caching name
diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html
index 4fcdfee9f7..330bebcb93 100644
--- a/doc/arm/Bv9ARM.ch06.html
+++ b/doc/arm/Bv9ARM.ch06.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -48,58 +48,58 @@
Configuration File Elements
Configuration File Grammar
-- acl Statement Grammar
+- acl Statement Grammar
- acl Statement Definition and
Usage
-- controls Statement Grammar
+- controls Statement Grammar
- controls Statement Definition and
Usage
-- include Statement Grammar
-- include Statement Definition and
+
- include Statement Grammar
+- include Statement Definition and
Usage
-- key Statement Grammar
-- key Statement Definition and Usage
-- logging Statement Grammar
-- logging Statement Definition and
+
- key Statement Grammar
+- key Statement Definition and Usage
+- logging Statement Grammar
+- logging Statement Definition and
Usage
-- lwres Statement Grammar
-- lwres Statement Definition and Usage
-- masters Statement Grammar
-- masters Statement Definition and
+
- lwres Statement Grammar
+- lwres Statement Definition and Usage
+- masters Statement Grammar
+- masters Statement Definition and
Usage
-- options Statement Grammar
+- options Statement Grammar
- options Statement Definition and
Usage
- server Statement Grammar
- server Statement Definition and
Usage
- statistics-channels Statement Grammar
-- statistics-channels Statement Definition and
+
- statistics-channels Statement Definition and
Usage
-- trusted-keys Statement Grammar
-- trusted-keys Statement Definition
+
- trusted-keys Statement Grammar
+- trusted-keys Statement Definition
and Usage
-- managed-keys Statement Grammar
-- managed-keys Statement Definition
+
- managed-keys Statement Grammar
+- managed-keys Statement Definition
and Usage
- view Statement Grammar
-- view Statement Definition and Usage
+- view Statement Definition and Usage
- zone
Statement Grammar
-- zone Statement Definition and Usage
+- zone Statement Definition and Usage
Zone File
+Zone File
- Types of Resource Records and When to Use Them
-- Discussion of MX Records
+- Discussion of MX Records
- Setting TTLs
-- Inverse Mapping in IPv4
-- Other Zone File Directives
-- BIND Master File Extension: the $GENERATE Directive
+- Inverse Mapping in IPv4
+- Other Zone File Directives
+- BIND Master File Extension: the $GENERATE Directive
- Additional File Formats
BIND9 Statistics
@@ -477,7 +477,7 @@
Address Match Lists
address_match_list = address_match_list_element ;
[ address_match_list_element; ... ]
address_match_list_element = [ ! ] (ip_address [/length] |
@@ -486,7 +486,7 @@
Address match lists are primarily used to determine access
control for various server operations. They are also used in
@@ -570,7 +570,7 @@
The BIND 9 comment syntax allows for
comments to appear
@@ -580,7 +580,7 @@
/* This is a BIND comment as in C */
@@ -596,7 +596,7 @@
Comments may appear anywhere that whitespace may appear in
a BIND configuration file.
@@ -848,7 +848,7 @@
acl acl-name {
address_match_list
};
@@ -930,7 +930,7 @@
controls {
[ inet ( ip_addr | * ) [ port ip_port ]
allow { address_match_list }
@@ -1054,12 +1054,12 @@
include filename;
The include statement inserts the
@@ -1074,7 +1074,7 @@
key key_id {
algorithm string;
secret string;
@@ -1083,7 +1083,7 @@
The key statement defines a shared
secret key for use with TSIG (see the section called “TSIG”)
@@ -1130,7 +1130,7 @@
logging {
[ channel channel_name {
( file path_name
@@ -1154,7 +1154,7 @@
The logging statement configures a
@@ -1188,7 +1188,7 @@
All log output goes to one or more channels;
you can make as many of them as you want.
@@ -1752,7 +1752,7 @@ category notify { null; };
The query-errors category is
specifically intended for debugging purposes: To identify
@@ -1980,7 +1980,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
This is the grammar of the lwres
statement in the named.conf file:
@@ -1996,7 +1996,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
The lwres statement configures the
name
@@ -2047,7 +2047,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
masters name [port ip_port] { ( masters_list |
ip_addr [port ip_port] [key key] ) ; [...] };
@@ -2055,7 +2055,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
masters
lists allow for a common set of masters to be easily used by
@@ -2064,7 +2064,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
This is the grammar of the options
statement in the named.conf file:
@@ -3349,26 +3349,50 @@ options {
The default is no.
update-check-ksk
-
- When regenerating the RRSIGs following a UPDATE
- request to a secure zone, check the KSK flag on
- the DNSKEY RR to determine if this key should be
- used to generate the RRSIG. This flag is ignored
- if there are not non-revoked DNSKEY RRs both with
- and without a KSK for the algorithm.
- The default is yes.
-
+
+ When set to the default value of yes,
+ check the KSK bit in each key to determine how the key
+ should be used when generating RRSIGs for a secure zone.
+
+
+ Ordinarily, zone-signing keys (that is, keys without the
+ KSK bit set) are used to sign the entire zone, while
+ key-signing keys (keys with the KSK bit set) are only
+ used to sign the DNSKEY RRset at the zone apex.
+ However, if this option is set to no,
+ then the KSK bit is ignored; KSKs are treated as if they
+ were ZSKs and are used to sign the entire zone. This is
+ similar to the dnssec-signzone -z
+ command line option.
+
+
+ When this option is set to yes, there
+ must be at least two active keys for every algorithm
+ represented in the DNSKEY RRset: at least one KSK and one
+ ZSK per algorithm. If there is any algorithm for which
+ this requirement is not met, this option will be ignored
+ for that algorithm.
+
+
dnskey-ksk-only
-
- When regenerating the RRSIGs following a UPDATE
- request to a secure zone and
- update-check-ksk is true then
- only generate signatures DNSKEY RRSIG using DNSKEY's
- with the KSK bit set. This flag is ignored if there
- are not non-revoked DNSKEY RRs both with and without
- a KSK for the algorithm.
- The default is no.
-
+
+ When this option and update-check-ksk
+ are both set to yes, only key-signing
+ keys (that is, keys with the KSK bit set) will be used
+ to sign the DNSKEY RRset at the zone apex. Zone-signing
+ keys (keys without the KSK bit set) will be used to sign
+ the remainder of the zone, but not the DNSKEY RRset.
+ This is similar to the
+ dnssec-signzone -x command line option.
+
+
+ The default is no. If
+ update-check-ksk is set to
+ no, this option is ignored.
+
+
try-tcp-refresh
Try to refresh the zone using TCP if UDP queries fail.
@@ -3385,7 +3409,7 @@ options {
The forwarding facility can be used to create a large site-wide
cache on a few servers, reducing traffic over links to external
@@ -3429,7 +3453,7 @@ options {
Dual-stack servers are used as servers of last resort to work
around
@@ -3626,7 +3650,7 @@ options {
The interfaces and ports that the server will answer queries
from may be specified using the listen-on option. listen-on takes
@@ -4078,7 +4102,7 @@ avoid-v6-udp-ports {};
use-v4-udp-ports,
avoid-v4-udp-ports,
@@ -4120,7 +4144,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
The server's usage of many system resources can be limited.
Scaled values are allowed when specifying resource limits. For
@@ -4282,7 +4306,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
- cleaning-interval
@@ -5078,7 +5102,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
BIND 9 provides the ability to filter
out DNS responses from external DNS servers containing
@@ -5408,7 +5432,7 @@ deny-answer-aliases { "example.net"; };
The statistics-channels statement
@@ -5459,7 +5483,7 @@ deny-answer-aliases { "example.net"; };
trusted-keys {
string number number number string ;
[ string number number number string ; [...]]
@@ -5468,7 +5492,7 @@ deny-answer-aliases { "example.net"; };
The trusted-keys statement defines
@@ -5508,7 +5532,7 @@ deny-answer-aliases { "example.net"; };
managed-keys {
string initial-key number number number string ;
[ string initial-key number number number string ; [...]]
@@ -5517,7 +5541,7 @@ deny-answer-aliases { "example.net"; };
The managed-keys statement, like
@@ -5627,7 +5651,7 @@ deny-answer-aliases { "example.net"; };
The view statement is a powerful
feature
@@ -5793,6 +5817,7 @@ view "external" {
[ min-retry-time number ; ]
[ max-retry-time number ; ]
[ key-directory path_name; ]
+ [ auto-dnssec allow|maintain|create|off; ]
[ zero-no-soa-ttl yes_or_no ; ]
};
@@ -5906,10 +5931,10 @@ zone zone_name [