KRFCHECK(1)           User Contributed Perl Documentation          KRFCHECK(1)


NAME
       krfcheck - Check a DNSSEC-Tools keyrec file for problems and
       inconsistencies

SYNOPSIS
         krfcheck [-zone | -set | -key] [-count] [-quiet]
                  [-verbose] [-Version] [-help] keyrec-file

DESCRIPTION
       This script checks a keyrec file for problems, potential problems, and
       inconsistencies.

       Recognized problems include:

       o   no zones defined

           The keyrec file does not contain any zone keyrecs.

       o   no sets defined

           The keyrec file does not contain any set keyrecs.

       o   no keys defined

           The keyrec file does not contain any key keyrecs.

       o   unknown zone keyrecs

           A set keyrec or a key keyrec references a non-existent zone keyrec.

       o   missing key from zone keyrec

           A zone keyrec does not have both a KSK key and a ZSK key.

       o   missing key from set keyrec

           A key listed in a set keyrec does not have a key keyrec.

       o   expired zone keyrecs

           A zone has expired.

       o   mislabeled key

           A key is labeled as a KSK (or ZSK) and its owner zone has it
           labeled as the opposite.

       o   invalid zone data values

           A zone's keyrec data are checked to ensure that they are valid.
           The following conditions are checked:  existence of the zone file,
           existence of the KSK file, existence of the KSK and ZSK
           directories, the end-time is greater than one day, and the seconds-
           count and date string match.

       o   invalid key data values

           A key's keyrec data are checked to ensure that they are valid.  The
           following conditions are checked:  valid encryption algorithm, key
           length falls within algorithm's size range, random generator file
           exists, and the seconds-count and date string match.

       Recognized potential problems include:

       o   imminent zone expiration

           A zone will expire within one week.

       o   odd zone-signing date

           A zone's recorded signing date is later than the current system
           clock.

       o   orphaned keys

           A key keyrec is unreferenced by any set keyrec.

       o   missing key directories

           A zone keyrec's key directories (kskdirectory or zskdirectory) does
           not exist.

       Recognized inconsistencies include:

       o   key-specific fields in a zone keyrec

           A zone keyrec contains key-specific entries.  To allow for site-
           specific extensibility, krfcheck does not check for undefined
           keyrec fields.

       o   zone-specific fields in a key keyrec

           A key keyrec contains zone-specific entries.  To allow for site-
           specific extensibility, krfcheck does not check for undefined
           keyrec fields.

       o   mismatched zone timestamp

           A zone's seconds-count timestamp does not match its textual
           timestamp.

       o   mismatched set timestamp

           A set's seconds-count timestamp does not match its textual
           timestamp.

       o   mismatched key timestamp

           A key's seconds-count timestamp does not match its textual
           timestamp.

OPTIONS
       -zone
           Only perform checks of zone keyrecs.  This option may not be
           combined with the -set or -key options.

       -set
           Only perform checks of set keyrecs.  This option may not be
           combined with the -zone or -key options.

       -key
           Only perform checks of key keyrecs.  This option may not be
           combined with the -set or -zone options.

       -count
           Display a final count of errors.

       -quiet
           Do not display messages.  This option supersedes the setting of the
           -verbose option.

       -verbose
           Display many messages.  This option is subordinate to the -quiet
           option.

       -Version
           Displays the version information for krfcheck and the DNSSEC-Tools
           package.

       -help
           Display a usage message.

COPYRIGHT
       Copyright 2004-2014 SPARTA, Inc.  All rights reserved.  See the COPYING
       file included with the DNSSEC-Tools package for details.

AUTHOR
       Wayne Morrison, tewok@tislabs.com

SEE ALSO
       cleankrf(8), fixkrf(8), lskrf(1), zonesigner(8)

       Net::DNS::SEC::Tools::keyrec.pm(3)

       file-keyrec(5)

perl v5.38.0                      2023-07-29                       KRFCHECK(1)