ods-hsmutil(1)

💖 ods-hsmutil — the OpenDNSSEC HSM utility (section 1 of the manual, bestie)

okay so. gather round. this is ods-hsmutil, the OpenDNSSEC HSM utility, and she is that girl — the little tool you reach for when you need to talk directly to your Hardware Security Module. manual section 1, in case the vibe check needed numbers. 💅

✨ SYNOPSIS ✨

ods-hsmutil [-c config] [-v] command [options]

🦋 DESCRIPTION 🦋

so ods-hsmutil is mostly a debugging/testing bestie. that's her whole thing. she's built to interact directly with your HSM, no middleman, no filter, and you can use her to manually list, create or delete keys. she can also run a little set of basic HSM tests, like a self-care routine but for hardware. 🌸

🚨 okay listen. be careful before you create or delete keys with ods-hsmutil, because those changes are not synchronized with the KASP Enforcer. it's giving "I edited the doc and nobody else knows". no cap. 😭

the repositories are configured by you, the user, in the OpenDNSSEC configuration file. that config holds the name of the repository, the token label, the user PIN, and the path to its shared library. all the little identifying details. 💖

👑 COMMANDS 👑

• login — if there's no PIN in conf.xml, this command will ask you for it and log in. the PINs get stored in shared memory and are accessible to the other daemons. it's giving communal notes app. 🔐
• logout — erases the semaphore and the shared memory holding any credentials. but heads up: authenticated processes will still be able to interact with the HSM. she logs out but the group chat stays open. 🙈
• list [repository] — lists the keys available in all repositories, or in just one repository if you name it. window shopping. 🛍️
• generate repository rsa|dsa|gost|ecdsa [keysize] — generates a new key with the given keysize in the repository. note that GOST has a fixed key size, and ECDSA has two supported curves: P-256 and P-384. for ECDSA, use 256 or 384 as the keysize. manifesting a key. ✨
• remove id — deletes the key with the given id. bye bestie 💀
• purge repository — deletes all keys in one repository. nuclear. absolutely nuclear. 🧨
• dnskey id name type algo — creates a DNSKEY RR for the given owner name, based on the key with this id. the type tells it whether it's a KSK (257) or a ZSK (256) — please use the numerical value, not the vibe. the algo, a value from the IANA repository, must match the algorithm of the key. matching energy only. 🎀
• test repository — performs a number of tests on a repository. her lil checkup. 🩺
• info — shows detailed information about all repositories. the full tea. ☕

🌈 OPTIONS 🌈

• -c config — path to an OpenDNSSEC configuration file.
  • defaults to /etc/opendnssec/conf.xml 🗂️
• -h — show the help screen. she'll explain herself. 🫶
• -v — output more information by increasing the verbosity level. the more -vs, the more she yaps. 🗣️

🔥 SEE ALSO 🔥

ods-control(8), ods-enforcerd(8), ods-hsmspeed(1), ods-kaspcheck(1), ods-signer(8), ods-signerd(8), ods-enforcer(8), ods-timing(5), ods-kasp(5), opendnssec(7), http://www.opendnssec.org/

go read those too. iykyk. 📚

💜 AUTHORS 💜

ods-hsmutil was written by Jakob Schlyter as part of the OpenDNSSEC project. iconic behaviour, honestly. 👑

and that's the whole page, bestie — OpenDNSSEC, February 2010, ods-hsmutil(1). slay, stay safe with those keys, and remember: purge responsibly. periodt. 💅✨