577N/A - Copyright (C) 2009, 2014-2016 Internet Systems Consortium, Inc. ("ISC") 577N/A - Permission to use, copy, modify, and/or distribute this software for any 1072N/A - purpose with or without fee is hereby granted, provided that the above 577N/A - copyright notice and this permission notice appear in all copies. 919N/A - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH 919N/A - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY 919N/A - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, 919N/A - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM 919N/A - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE 919N/A - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 919N/A - PERFORMANCE OF THIS SOFTWARE. 919N/A<
meta http-
equiv="Content-Type" content="text/html; charset=ISO-8859-1">
919N/A<
title>ddns-confgen</
title>
919N/A<
meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
919N/A<
body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><
div class="refentry">
919N/A<
div class="refnamediv">
577N/A<
p><
span class="application">ddns-confgen</
span> — ddns key generation tool</
p>
577N/A<
div class="refsynopsisdiv">
577N/A<
div class="cmdsynopsis"><
p><
code class="command">tsig-keygen</
code> [<
code class="option">-a <
em class="replaceable"><
code>algorithm</
code></
em></
code>] [<
code class="option">-h</
code>] [<
code class="option">-r <
em class="replaceable"><
code>randomfile</
code></
em></
code>] [name]</
p></
div>
1072N/A<
div class="cmdsynopsis"><
p><
code class="command">ddns-confgen</
code> [<
code class="option">-a <
em class="replaceable"><
code>algorithm</
code></
em></
code>] [<
code class="option">-h</
code>] [<
code class="option">-k <
em class="replaceable"><
code>keyname</
code></
em></
code>] [<
code class="option">-q</
code>] [<
code class="option">-r <
em class="replaceable"><
code>randomfile</
code></
em></
code>] [ -s <
em class="replaceable"><
code>name</
code></
em> | -z <
em class="replaceable"><
code>zone</
code></
em> ]</
p></
div>
911N/A<
div class="refsection">
1072N/A<
a name="id-1.7"></
a><
h2>DESCRIPTION</
h2>
911N/A <
span class="command"><
strong>tsig-keygen</
strong></
span> and <
span class="command"><
strong>ddns-confgen</
strong></
span>
577N/A are invocation methods for a utility that generates keys for use
606N/A in TSIG signing. The resulting keys can be used, for example,
829N/A to secure dynamic DNS updates to a zone or for the
829N/A <
span class="command"><
strong>rndc</
strong></
span> command channel.
1177N/A When run as <
span class="command"><
strong>tsig-keygen</
strong></
span>, a domain name
577N/A can be specified on the command line which will be used as
577N/A the name of the generated key. If no name is specified,
577N/A the default is <
code class="constant">tsig-key</
code>.
577N/A When run as <
span class="command"><
strong>ddns-confgen</
strong></
span>, the generated
577N/A key is accompanied by configuration text and instructions
577N/A that can be used with <
span class="command"><
strong>nsupdate</
strong></
span> and
970N/A <
span class="command"><
strong>named</
strong></
span> when setting up dynamic DNS,
970N/A including an example <
span class="command"><
strong>update-policy</
strong></
span>
970N/A statement. (This usage similar to the
970N/A <
span class="command"><
strong>rndc-confgen</
strong></
span> command for setting
970N/A up command channel security.)
970N/A Note that <
span class="command"><
strong>named</
strong></
span> itself can configure a
970N/A local DDNS key for use with <
span class="command"><
strong>nsupdate -l</
strong></
span>:
970N/A it does this when a zone is configured with
970N/A <
span class="command"><
strong>update-policy local;</
strong></
span>.
577N/A <
span class="command"><
strong>ddns-confgen</
strong></
span> is only needed when a
1072N/A more elaborate configuration is required: for instance,
577N/A if <
span class="command"><
strong>nsupdate</
strong></
span> is to be used from a remote
1124N/A<
a name="id-1.8"></
a><
h2>OPTIONS</
h2>
1072N/A<
div class="variablelist"><
dl class="variablelist">
1072N/A<
dt><
span class="term">-a <
em class="replaceable"><
code>algorithm</
code></
em></
span></
dt>
577N/A Specifies the algorithm to use for the TSIG key. Available
577N/A choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256,
615N/A hmac-sha384 and hmac-sha512. The default is hmac-sha256.
615N/A Options are case-insensitive, and the "hmac-" prefix
1196N/A<
dt><
span class="term">-h</
span></
dt>
1196N/A Prints a short summary of options and arguments.
1196N/A<
dt><
span class="term">-k <
em class="replaceable"><
code>keyname</
code></
em></
span></
dt>
1097N/A Specifies the key name of the DDNS authentication key.
935N/A The default is <
code class="constant">ddns-key</
code> when neither
810N/A the <
code class="option">-s</
code> nor <
code class="option">-z</
code> option is
970N/A specified; otherwise, the default
970N/A is <
code class="constant">ddns-key</
code> as a separate label
970N/A followed by the argument of the option,
e.g.,
577N/A The key name must have the format of a valid domain name,
577N/A consisting of letters, digits, hyphens and periods.
1097N/A<
dt><
span class="term">-q</
span></
dt>
577N/A (<
span class="command"><
strong>ddns-confgen</
strong></
span> only.) Quiet mode: Print
1072N/A only the key, with no explanatory text or usage examples;
1097N/A This is essentially identical to <
span class="command"><
strong>tsig-keygen</
strong></
span>.
577N/A<
dt><
span class="term">-r <
em class="replaceable"><
code>randomfile</
code></
em></
span></
dt>
970N/A Specifies a source of random data for generating the
authorization. If the operating system does not provide a
<
code class="filename">/
dev/
random</
code> or equivalent device, the
default source of randomness is keyboard input.
<
code class="filename">randomdev</
code> specifies the name of a
character device or file containing random data to be used
instead of the default. The special value
<
code class="filename">keyboard</
code> indicates that keyboard input
<
dt><
span class="term">-s <
em class="replaceable"><
code>name</
code></
em></
span></
dt>
(<
span class="command"><
strong>ddns-confgen</
strong></
span> only.)
Generate configuration example to allow dynamic updates
of a single hostname. The example <
span class="command"><
strong>
named.conf</
strong></
span>
text shows how to set an update policy for the specified
<
em class="replaceable"><
code>name</
code></
em>
using the "name" nametype. The default key name is
ddns-key.<
em class="replaceable"><
code>name</
code></
em>.
Note that the "self" nametype cannot be used, since
the name to be updated may differ from the key name.
This option cannot be used with the <
code class="option">-z</
code> option.
<
dt><
span class="term">-z <
em class="replaceable"><
code>zone</
code></
em></
span></
dt>
(<
span class="command"><
strong>ddns-confgen</
strong></
span> only.)
Generate configuration example to allow dynamic updates
of a zone: The example <
span class="command"><
strong>
named.conf</
strong></
span> text
shows how to set an update policy for the specified
<
em class="replaceable"><
code>zone</
code></
em>
using the "zonesub" nametype, allowing updates to
all subdomain names within that
<
em class="replaceable"><
code>zone</
code></
em>.
This option cannot be used with the <
code class="option">-s</
code> option.
<
a name="id-1.9"></
a><
h2>SEE ALSO</
h2>
<
p><
span class="citerefentry"><
span class="refentrytitle">nsupdate</
span>(1)</
span>,
<
span class="citerefentry"><
span class="refentrytitle">
named.conf</
span>(5)</
span>,
<
span class="citerefentry"><
span class="refentrytitle">named</
span>(8)</
span>,
<
em class="citetitle">BIND 9 Administrator Reference Manual</
em>.