LSKRF(1)

📦
version 2.2.3 · 2 versions
, in fedora 43

okay bestie, welcome to LSKRF(1) — the manual page you're literally about to devour 🎀

✨ NAME ✨

lskrf — list the keyrecs in a DNSSEC-Tools keyrec file 💅

🦋 SYNOPSIS 🦋

lskrf [options] <keyrec-files>

🌸 DESCRIPTION 🌸

So lskrf lists the contents of the keyrec files you point it at. Every single keyrec file gets loaded before any output shows up — no half-rendered nonsense, we wait for the whole vibe to arrive. And if some keyrecs have duplicated names? Whether that's inside one file or across multiple files, the later keyrec wins and it's the one whose data get displayed. no cap.

lskrf has three base output formats. In ascending levels of detail they go: terse output, default format, and long format. You get terse when you pass -terse, and you get long when you pass -long. easy.

The output shown for each record in a keyrec file depends on the selected records, the selected attributes, and the selected output format. Every option in those option groups gets a full breakdown in the OPTIONS section, and the three basic output formats get theirs in OUTPUT FORMATS. iykyk 💖

🔥 OUTPUT FORMATS 🔥

keyrec files hold three types of keyrec records: zone records, signing set records, and key records. Each type of keyrec record contains keyrec fields related to that type.

  • Zone keyrec records contain data about all the keys associated with a particular zone 🗺️
  • Set keyrec records contain data about all the keys associated with a particular signing set 🎀
  • Key keyrec records contain key lengths and algorithms for each particular key 🔑

(There is the case of subordinate revoked and obsolete signing sets. These are stored in key keyrec records, but they contain the set_type entry which key keyrecs do not.) not me remembering that edge case, but okay, it's important

The data to be printed must be specified by selecting some combination of the -zone, -sets, -keys, and -all options. There are also options for specifying specific types of keys to be printed.

The three base output formats are the default format, the terse format, and the long format. -terse means a minimal amount of output is desired; -long means a great deal of output is desired. The record-selection and attribute-selection options may be used in conjunction with -terse to display exactly the set of keyrec fields needed. The default output format is a middle ground between terse and long output, and it's the one used when neither -terse nor -long is given. the default is literally the main character 👑

🌈 Zone keyrec Output

The table below shows the zone keyrec fields displayed for each output format. (I turned it into a list bestie, same facts, cuter delivery.)

  • keyrec type — default: yes · terse: no · long: yes
  • zone name — default: yes · terse: yes · long: yes
  • zone file — default: yes · terse: no · long: yes
  • signed zonefile — default: yes · terse: no · long: yes
  • signing date — default: yes · terse: no · long: yes
  • expiration date — default: no · terse: no · long: yes
  • archive directory — default: no · terse: no · long: yes
  • KSK count — default: no · terse: no · long: yes
  • KSK directory — default: no · terse: no · long: yes
  • current KSK set — default: no · terse: no · long: yes
  • published KSK set — default: no · terse: no · long: yes
  • ZSK count — default: no · terse: no · long: yes
  • ZSK directory — default: no · terse: no · long: yes
  • current ZSK set — default: no · terse: no · long: yes
  • published ZSK set — default: no · terse: no · long: yes
  • new ZSK set — default: no · terse: no · long: yes

🦄 Set keyrec Output

The table below shows the signing set keyrec fields displayed for each output format.

  • keyrec type — default: yes · terse: no · long: yes
  • set name — default: yes · terse: yes · long: yes
  • zone name — default: yes · terse: no · long: yes
  • type — default: yes · terse: no · long: yes
  • keys — default: no · terse: no · long: yes
  • last modification date — default: no · terse: no · long: yes

🧚 Key keyrec Output

The table below shows the key keyrec fields displayed for each output format.

  • keyrec type — default: yes · terse: no · long: yes
  • key name — default: yes · terse: yes · long: yes
  • algorithm — default: no · terse: no · long: yes
  • end date — default: no · terse: no · long: yes
  • generation date — default: yes · terse: no · long: yes
  • key length — default: no · terse: no · long: yes
  • key life — default: no · terse: no · long: yes
  • key path — default: no · terse: no · long: yes
  • keys — default: no · terse: no · long: yes
  • random number generator — default: no · terse: no · long: yes
  • zone name — default: yes · terse: no · long: yes

💜 OPTIONS 💜

lskrf takes three types of options: record-selection options, record-attribute options, and output-style options. All detailed below, mwah 🫶

⚠️ Record-selection options are required. At least one record-selection option must be selected, fr fr. Record-attribute options and output-style options are optional — pick any number of them you want, it's your world.

🎀 Record-Selection Options

These options select the types of keyrec that will be displayed.

  • -all — displays all the records in a keyrec file. everything, the whole buffet
  • -zones — displays the zones in a keyrec file.
  • -sets — displays the signing sets in a keyrec file.
  • -keys — displays the keys in a keyrec file.

The key data are sorted by key type in this order: Current KSKs, Published KSKs, Current ZSKs, Published ZSKs, New ZSKs, Obsolete KSKs, and Obsolete ZSKs. a whole lineup, very curated

  • -ksk — displays the KSK keys in a keyrec file.
  • -kcur — displays the Current KSK keys in a keyrec file.
  • -kpub — displays the Published KSK keys in a keyrec file.
  • -kobs — displays the obsolete KSK keys in a keyrec file. This option must be give if obsolete KSK keys are to be displayed.
  • -krev — displays the revoked KSK keys in a keyrec file. This option must be give if revoked KSK keys are to be displayed.
  • -zsk — displays the ZSK keys in a keyrec file. It does not include obsolete ZSK keys; the -obs option must be specified to display obsolete keys. don't forget that part bestie
  • -cur — displays the Current ZSK keys in a keyrec file.
  • -new — displays the New ZSK keys in a keyrec file. ✨
  • -pub — displays the Published ZSK keys in a keyrec file.
  • -zobs — displays the obsolete ZSK keys in a keyrec file. This option must be give if obsolete ZSK keys are to be displayed.
  • -zrev — displays the revoked ZSK keys in a keyrec file. This option must be give if revoked ZSK keys are to be displayed.
  • -obs — displays the obsolete KSK and ZSK keys in a keyrec file. This option is a shorthand method specifying the -kobs and -zobs options. 🎯
  • -rev — displays the revoked KSK and ZSK keys in a keyrec file. This option is a shorthand method specifying the -krev and -zrev options. 🎯
  • -invalid — displays the obsolete and revoked KSK and ZSK keys in a keyrec file. This option is a shorthand method specifying the -obs and -rev options. 🎯

🦋 Record-Attribute Options

These options select subsets of the keyrecs chosen by the record-selection options. yes, they're the picky little filter besties

  • -valid — displays the valid zones in a keyrec file. It implies the -zones option.
  • -expired> — displays the expired zones in a keyrec file. It implies the -zones option.
  • -ref — displays the referenced signing set keyrecs and the referenced key keyrecs in a keyrec file, depending upon other selected options.

Referenced state depends on the following:

  • Signing sets are considered to be referenced if they are listed in a zone keyrec.
  • KSKs are considered to be referenced if they are listed in a signing set keyrec that is listed in a zone keyrec.
  • ZSKs are considered to be referenced if they are listed in a signing set keyrec that is listed in a zone keyrec.

This option may be used with either the -sets or -keys options. If it isn't used with any record-selection options, then it is assumed that both -sets and -keys have been specified.

  • -unref — displays the unreferenced signing set keyrecs or the unreferenced key keyrecs in a keyrec file, depending upon other selected options.

Unreferenced state depends on the following:

  • Signing sets are considered to be unreferenced if they are not listed in a zone keyrec.
  • KSKs are considered to be unreferenced if they are not listed in a signing set keyrec that is listed in a zone keyrec.
  • ZSKs are considered to be unreferenced if they are not listed in a signing set keyrec that is listed in a zone keyrec.
  • Obsolete ZSKs are checked, whether or not the -obs flag was specified.

This option may be used with either the -sets or -keys options. If it isn't used with any record-selection options, then it is assumed that both -sets and -keys have been specified.

🌸 Zone-Attribute Options

These options allow specific zone fields to be included in the output. If combined with the -terse option, only those fields specifically desired will be printed. so like, terse + these = exactly the vibes you asked for, nothing more

⚠️ These options must be used with the -zone option. periodt.
  • -z-archdir — Display the zone's archive directory. If an archive directory is not explicitly set for the zone, the default directory will be listed.
  • -z-dates — Display the zone's time-stamps. These are the signing date and the expiration date. 🗓️
  • -z-dirs — Display the zone's directories. These directories are the KSK directory, the ZSK directory, and the key archive directory.
  • -z-expdate — Display the zone's expiration date.
  • -z-ksk — Display the zone's KSK data. This is the equivalent of specifying the -z-kskcount, -z-kskcur, -z-kskdir, and -z-kskpub options. 🎯
  • -z-kskcount — Display the zone's KSK count.
  • -z-kskcur — Display the zone's Current KSK signing set. If this is not defined, then "<unset>" will be given. literally prints that, quotes and all
  • -z-kskdir — shows the zone's KSK directory. if that's not defined, bestie, you just get . 💅
  • -z-kskpub — shows the zone's Published KSK signing set. not defined? you get <unset> 🫶
  • -z-sets — shows the zone's signing sets. this is literally the same as asking for -z-kskcur, -z-kskpub, -z-zskcur, -z-zsknew, and -z-zskpub all at once. the way she does everything in one go 😌✨
  • -z-signdate — shows the zone's signing date 📅
  • -z-signfile — shows the zone's signed zonefile 📄
  • -z-zonefile — shows the zone's zonefile 🗂️
  • -z-zsk — shows the zone's ZSK data. equivalent to specifying -z-zskcount, -z-zskcur, -z-zskdir, -z-zsknew, and -z-zskpub together. combo meal 🍓
  • -z-zskcount — shows the zone's ZSK count 🔢
  • -z-zskcur — shows the zone's Current ZSK signing set. if it's not defined, you get <unset> 🙈
  • -z-zskdir — shows the zone's ZSK directory. undefined? . it is, no cap ✨
  • -z-zsknew — shows the zone's New ZSK signing set. undefined → <unset> 💖
  • -z-zskpub — shows the zone's Published ZSK signing set. undefined → <unset> 🌸

🎀 Set-Attribute Options 🎀

these options let you pull specific set fields into the output. pair them with -terse and only the fields you actually asked for get printed — very only what i ordered of you 💅

⚠️ these options must be used with the -sets option. no -sets, no set fields, that's the rule 🫶

okay so now the RFC5011 tea, because it's a whole situation. if RFC5011 processing is enabled, there's special handling of the zone's set keyrec of revoked KSK keys. the kskrev field in the zone's keyrec points to a set keyrec, marked as being of type kskrev. that set keyrec then points to a bunch of other set keyrecs, and all of them are also marked as being of type kskrev. the group of all revoked KSK keys is found by consulting that subsidiary set of kskrev set keyrecs. 👑

when the ages of these revoked keys exceeds their revocation periods, they get marked as being obsolete (kskobs). if this happens as part of normal rollover, these revoked key and set keyrecs are all removed from the chain of active, revoked keyrecs. and if this happens to a key that's part of a larger set of keys, it's removed from that signing set and put in its own new signing set. very i'm my own person now energy 🦋

lskrf displays the type of the kskrev set (listed in the zone keyrec) as KSK-REV, and all other revoked KSK keyrecs are listed as KSK-rev. case matters, don't come for me 😭

  • -s-keys — shows the set's keys 🔑
  • -s-lastmod — shows the set's date of last modification 🕰️
  • -s-type — shows the set's type 🏷️
  • -s-zone — shows the set's zone name 🌍
  • -s-ksk — shows KSK signing sets. this option implies the -sets option 👑
  • -s-kcur — shows current KSK signing sets. this option implies the -sets option ⭐
  • -s-kobs — shows obsolete KSK signing sets. this option implies the -sets option 💀
  • -s-kpub — shows published KSK signing sets. this option implies the -sets option 📣
  • -s-krev — shows revoked KSK signing sets. this option implies the -sets option 🚫
  • -s-zsk — shows ZSK signing sets. this option implies the -sets option 🎀
  • -s-zcur — shows current ZSK signing sets. this option implies the -sets option ✨
  • -s-znew — shows new ZSK signing sets. this option implies the -sets option 🌱
  • -s-zobs — shows obsolete ZSK signing sets. this option implies the -sets option 💀
  • -s-zpub — shows published ZSK signing sets. this option implies the -sets option 📣
  • -s-zrev — shows revoked ZSK signing sets. this option implies the -sets option 🚫

🔑 Key-Attribute Options 🔑

these let you pull specific key fields into the output. combine with -terse and only the fields you specifically wanted get printed. so precise of you 💅

⚠️ these options must be used with the -key option. periodt 🫶
  • -k-algorithm — shows the key's encryption algorithm 🔐
  • -k-enddate — shows the key's end-date, calculated by adding the key's lifespan to its signing date 📅
  • -k-length — shows the key's length 📏
  • -k-lifespan — shows the key's lifespan (in seconds.) this lifespan is only related to the time between key rollover. there is no other lifespan associated with a key. that's it, that's the whole lifespan lore ⏳
  • -k-path — shows the key's path 🛣️
  • -k-random — shows the key's random number generator 🎲
  • -k-signdate — shows the key's signing date ✍️
  • -k-zone — shows the key's zonefile 📄

🌈 Output-Format Options 🌈

these options define how the keyrec information gets displayed. the aesthetic choices, if you will ✨

so with none of these options given: for zones, the zone name, zone file, zone-signing date, and a label get displayed. for types, the key name, the key's zone, the key's generation date, and a label get displayed if these options aren't given. default vibe check passed 🫶

  • -count — the count of matching records gets displayed, but the matching records themselves will not be. just the number, bestie 🔢
  • -nodate — the key's generation date will not be printed if this flag is given 🙈
  • -headers — display explanatory column headers. if this flag is given, then entry labels will not be printed unless explicitly requested by use of the -label option 📊
  • -label — a label for the keyrec's type will be given 🏷️
  • -long — the long form of output will be given. see the OUTPUT FORMATS section for details on data printed for each type of keyrec record 📜
⚠️ long zone output can get very wide, depending on the data. she does not do subtle 💀
  • -terse — this option displays only the name of the zones or keys selected by other options. minimalism, we love her 💅
  • -Version — displays the version information for lskrf and the DNSSEC-Tools package 🧚
  • -help — display a usage message and exit 🆘
  • -h-zones — display the zone-attribute options and exit 🌍
  • -h-sets — display the set-attribute options and exit 🎀
  • -h-keys — display the key-attribute options and exit 🔑

Copyright 2005-2014 SPARTA, Inc. All rights reserved. See the COPYING file included with the DNSSEC-Tools package for details. 📜✨

👑 AUTHOR 👑

Wayne Morrison, tewok@tislabs.com 💌

🦋 SEE ALSO 🦋

  • zonesigner(8)
  • Net::DNS::SEC::Tools::keyrec.pm(3)
  • file-keyrec(5)

and that's the whole page, bestie, you made it 🥳 this was lskrf from perl v5.42.0, dated 2025-07-23, living in section LSKRF(1) of the manual. go forth and list those keyrecs, you absolute icon 💖🎀🦋

📦 where this page comes from