pdnssec (1) Linux Manual Page
NAME
pdnssec – PowerDNSSEC command and control
SYNOPSIS
pdnssec [options] command
DESCRIPTION
pdnssec is a powerful command that is the operator-friendly gateway into PowerDNSSEC configuration. Behind the scenes, pdnssec manipulates a PowerDNS backend database, which also means that for many databases, pdnssec can be run remotely, and can configure key material on different servers.
OPTIONS
A summary of options is included below.
-h [ –help ]- Show summary of options.
-v [ –verbose ]- Be more verbose.
–force- force an action
–config-name arg- Virtual configuration name
–config-dir arg (=/etc/powerdns)- Location of pdns.conf
–commands arg- Commands given as an argument
COMMANDS
activate-zone-key ZONE KEY-ID- Activate a key with id KEY-ID within a zone called ZONE.
add-zone-key ZONE [zsk|ksk] [bits] [rsasha1|rsasha256|rsasha512|gost|ecdsa256|ecdsa384]- Create a new key for zone ZONE, and make it a KSK or a ZSK, with the specified algorithm.
check-zone ZONE- Check a zone for correctness
deactivate-zone-key ZONE KEY-ID- Deactivate a key with id KEY-ID within a zone called ZONE.
disable-dnssec ZONE- Deactivate all keys and unset PRESIGNED in ZONE
export-zone-dnskey ZONE KEY-ID- Export to standard output DNSKEY and DS of key with key id KEY-ID within zone called ZONE.
export-zone-key ZONE KEY-ID- Export to standard output full (private) key with key id KEY-ID within zone called ZONE. The format used is compatible with BIND and NSD/LDNS.
hash-zone-record ZONE RNAME- This convenience command hashes the name ‘recordname’ according to the NSEC3 settings of ZONE. Refuses to hash for zones with no NSEC3 settings.
import-zone-key ZONE FILE [ksk|zsk]- Import from ‘filename’ a full (private) key for zone called ZONE. The format used is compatible with BIND and NSD/LDNS. KSK or ZSK specifies the flags this key should have on import.
rectify-zone ZONE- Calculates the ‘ordername’ and ‘auth’ fields for a zone called ZONE so they comply with DNSSEC settings. Can be used to fix up migrated data. Can always safely be run, it does no harm.
remove-zone-key ZONE KEY-ID- Remove a key with id KEY-ID from a zone called ZONE.
secure-zone ZONE- Configures a zone called ZONE with reasonable DNSSEC settings. You should manually run ‘pdnssec rectify-zone’ afterwards.
set-nsec3 ZONE ‘params’ [narrow]- Sets NSEC3 parameters for this zone. A sample commandline is: "pdnssec set-nsec3 powerdnssec.org ‘1 1 1 ab’ narrow". The NSEC3 parameters must be quoted on the command line.
WARNING:
If running in RSASHA1 mode (algorithm 5 or 7), switching from NSEC to NSEC3 will require a DS update at the parent zone! set-presigned ZONE- Switches zone to presigned operation, utilizing in-zone RRSIGs.
show-zone ZONE- Shows all DNSSEC related settings of a zone called ZONE.
unset-nsec3 ZONE- Converts a zone to NSEC operations.
WARNING:
If running in RSASHA1 mode (algorithm 5 or 7), switching from NSEC to NSEC3 will require a DS update at the parent zone! unset-presigned ZONE- Disables presigned operation for ZONE.
AUTHOR
This manual page was written by Matthijs Möhlmann <matthijs [at] cacholong.nl> for the Debian Project (but may be used by others)
SEE ALSO
pdns_server(8),pdns_control(8)