Skip to content
Snippets Groups Projects
Commit e7cb3e38 authored by David Vasek's avatar David Vasek
Browse files

doc: make some links to utilities

parent 277242ec
No related branches found
No related tags found
No related merge requests found
...@@ -90,7 +90,7 @@ Access control list (ACL) ...@@ -90,7 +90,7 @@ Access control list (ACL)
The Access control list is a list of rules specifying remotes which are allowed to send certain types of requests to the server. The Access control list is a list of rules specifying remotes which are allowed to send certain types of requests to the server.
Remotes can be specified by a single IP address or a network subnet. A TSIG Remotes can be specified by a single IP address or a network subnet. A TSIG
key can also be assigned (see :doc:`keymgr <man_keymgr>` on how to generate a TSIG key). key can also be assigned (see :doc:`keymgr<man_keymgr>` on how to generate a TSIG key).
Without any ACL rules, all the actions are denied for the zone. Each ACL rule Without any ACL rules, all the actions are denied for the zone. Each ACL rule
can allow one or more actions for a given address/subnet/TSIG, or deny them. can allow one or more actions for a given address/subnet/TSIG, or deny them.
...@@ -464,7 +464,7 @@ with manual key management flag has to be set:: ...@@ -464,7 +464,7 @@ with manual key management flag has to be set::
dnssec-signing: on dnssec-signing: on
dnssec-policy: manual dnssec-policy: manual
To generate signing keys, use the :doc:`keymgr <man_keymgr>` utility. To generate signing keys, use the :doc:`keymgr<man_keymgr>` utility.
Let's use the Single-Type Signing scheme with two algorithms. Run: Let's use the Single-Type Signing scheme with two algorithms. Run:
.. code-block:: console .. code-block:: console
...@@ -508,7 +508,7 @@ go. ...@@ -508,7 +508,7 @@ go.
options to schedule key rollovers and it internally uses timestamps of keys differently options to schedule key rollovers and it internally uses timestamps of keys differently
than in the manual case. As a consequence it might break if the ``retire`` or ``remove`` timestamps than in the manual case. As a consequence it might break if the ``retire`` or ``remove`` timestamps
are set for the manually generated keys currently in use. Make sure to set these timestamps are set for the manually generated keys currently in use. Make sure to set these timestamps
to zero using :doc:`keymgr <man_keymgr>`: to zero using :doc:`keymgr<man_keymgr>`:
.. code-block:: console .. code-block:: console
......
...@@ -77,9 +77,9 @@ Use specified KASP database path and default configuration. ...@@ -77,9 +77,9 @@ Use specified KASP database path and default configuration.
\fBNOTE:\fP \fBNOTE:\fP
.INDENT 0.0 .INDENT 0.0
.INDENT 3.5 .INDENT 3.5
Keymgr runs with the same user privileges as configured for knotd. For example, Keymgr runs with the same user privileges as configured for knotd\&.
if keymgr is run as root, but the configured user is knot, For example, if keymgr is run as root, but the configured user
it won\(aqt be able to read files (PEM files, KASP db, ...) readable only by root. is knot, it won\(aqt be able to read files (PEM files, KASP db, ...) readable only by root.
.UNINDENT .UNINDENT
.UNINDENT .UNINDENT
.SS Commands .SS Commands
......
...@@ -51,9 +51,9 @@ Config options ...@@ -51,9 +51,9 @@ Config options
Use specified KASP database path and default configuration. Use specified KASP database path and default configuration.
.. NOTE:: .. NOTE::
Keymgr runs with the same user privileges as configured for knotd. For example, Keymgr runs with the same user privileges as configured for :doc:`knotd<man_knotd>`.
if keymgr is run as root, but the configured :ref:`user<server_user>` is knot, For example, if keymgr is run as root, but the configured :ref:`user<server_user>`
it won't be able to read files (PEM files, KASP db, ...) readable only by root. is knot, it won't be able to read files (PEM files, KASP db, ...) readable only by root.
Commands Commands
........ ........
......
...@@ -19,8 +19,8 @@ Building changes ...@@ -19,8 +19,8 @@ Building changes
---------------- ----------------
The ``--enable-dnstap`` configure option now enables the dnstap support in The ``--enable-dnstap`` configure option now enables the dnstap support in
kdig only! To build the dnstap query module, ``--with-module-dnstap`` have :doc:`kdig<man_kdig>` only! To build the dnstap query module, ``--with-module-dnstap``
to be used. have to be used.
Since Knot DNS version 2.5.0 each query module can be configured to be: Since Knot DNS version 2.5.0 each query module can be configured to be:
...@@ -217,7 +217,7 @@ server configuration: ...@@ -217,7 +217,7 @@ server configuration:
.. NOTE:: .. NOTE::
If the server configuration file or database is not at the default location, If the server configuration file or database is not at the default location,
add a configuration parameter (-c or -C). See :doc:`keymgr <man_keymgr>` add a configuration parameter (-c or -C). See :doc:`keymgr<man_keymgr>`
for more info about required access rights to the key files. for more info about required access rights to the key files.
4. Follow :ref:`Automatic DNSSEC signing` steps to configure DNSSEC signing. 4. Follow :ref:`Automatic DNSSEC signing` steps to configure DNSSEC signing.
...@@ -5,13 +5,14 @@ ...@@ -5,13 +5,14 @@
Operation Operation
********* *********
The Knot DNS server part ``knotd`` can run either in the foreground, or in the background The Knot DNS server part :doc:`knotd<man_knotd>` can run either in the foreground,
using the ``-d`` option. When run in the foreground, it doesn't create a PID file. or in the background using the ``-d`` option. When run in the foreground, it
Other than that, there are no differences and you can control both the same way. doesn't create a PID file. Other than that, there are no differences and you
can control both the same way.
The tool ``knotc`` is designed as a user front-end, making it easier to control running The tool :doc:`knotc<man_knotc>` is designed as a user front-end, making it easier
server daemon. If you want to control the daemon directly, use ``SIGINT`` to quit to control running server daemon. If you want to control the daemon directly,
the process or ``SIGHUP`` to reload the configuration. use ``SIGINT`` to quit the process or ``SIGHUP`` to reload the configuration.
If you pass neither configuration file (``-c`` parameter) nor configuration If you pass neither configuration file (``-c`` parameter) nor configuration
database (``-C`` parameter), the server will first attempt to use the default database (``-C`` parameter), the server will first attempt to use the default
...@@ -306,9 +307,9 @@ The process how the server loads a zone is influenced by the configuration of th ...@@ -306,9 +307,9 @@ The process how the server loads a zone is influenced by the configuration of th
:ref:`zonefile-load <zone_zonefile-load>` and :ref:`journal-content <zone_journal-content>` :ref:`zonefile-load <zone_zonefile-load>` and :ref:`journal-content <zone_journal-content>`
parameters (also DNSSEC signing applies), the existence of a zone file and journal parameters (also DNSSEC signing applies), the existence of a zone file and journal
(and their relative out-of-dateness), and whether it is a cold start of the server (and their relative out-of-dateness), and whether it is a cold start of the server
or a zone reload (e.g. invoked by the knotc interface). Please note that zone transfers or a zone reload (e.g. invoked by the :doc:`knotc<man_knotc>` interface). Please note
are not taken into account here – they are planned after the zone is loaded that zone transfers are not taken into account here – they are planned after the zone
(including AXFR bootstrap). is loaded (including AXFR bootstrap).
If the zone file exists and is not excluded by the configuration, it is first loaded If the zone file exists and is not excluded by the configuration, it is first loaded
and according to its SOA serial number relevant journal changesets are applied. and according to its SOA serial number relevant journal changesets are applied.
...@@ -472,7 +473,7 @@ Special states for algorithm rollover: ...@@ -472,7 +473,7 @@ Special states for algorithm rollover:
- ``post-active`` — The key is no longer published in the zone, but still used for signing. - ``post-active`` — The key is no longer published in the zone, but still used for signing.
The states listed above are relevant for :doc:`keymgr <man_keymgr>` operations like generating The states listed above are relevant for :doc:`keymgr<man_keymgr>` operations like generating
a key, setting its timers and listing KASP database. a key, setting its timers and listing KASP database.
On the other hand, the key "states" displayed in the server log lines while zone signing On the other hand, the key "states" displayed in the server log lines while zone signing
...@@ -736,7 +737,7 @@ The Zone Signing Key is always fully available to the daemon in order to sign co ...@@ -736,7 +737,7 @@ The Zone Signing Key is always fully available to the daemon in order to sign co
The server (or the "ZSK side") only uses ZSK to sign zone contents and its changes. Before The server (or the "ZSK side") only uses ZSK to sign zone contents and its changes. Before
performing a ZSK rollover, the DNSKEY records will be pre-generated and signed by the performing a ZSK rollover, the DNSKEY records will be pre-generated and signed by the
signer (the "KSK side"). Both sides exchange keys in the form of human-readable messages with the help signer (the "KSK side"). Both sides exchange keys in the form of human-readable messages with the help
of :doc:`keymgr <man_keymgr>` utility. of :doc:`keymgr<man_keymgr>` utility.
Pre-requisites Pre-requisites
-------------- --------------
......
...@@ -29,7 +29,7 @@ which can be either a file or a UNIX socket:: ...@@ -29,7 +29,7 @@ which can be either a file or a UNIX socket::
more details. more details.
.. NOTE:: .. NOTE::
Dnstap log files can also be created or read using ``kdig``. Dnstap log files can also be created or read using :doc:`kdig<man_kdig>`.
.. _dnstap: http://dnstap.info/ .. _dnstap: http://dnstap.info/
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment