831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.1//EN">

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<refentry>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<refentryinfo>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<date>Jun 30, 2000</date>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt</refentryinfo>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<refmeta>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<refentrytitle>nsupdate</refentrytitle>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<manvolnum>8</manvolnum>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<refmiscinfo>BIND9</refmiscinfo>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt</refmeta>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<refnamediv>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<refname>nsupdate</refname>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<refpurpose>Dynamic DNS update utility</refpurpose>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt</refnamediv>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<refsynopsisdiv>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<cmdsynopsis>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<command>nsupdate</command>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<arg><option>-d</option></arg>

f9aef05653eeb454c489d5bd2bde6daab774ad4aTinderbox User<group>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <arg><option>-y <replaceable class="parameter">keyname:secret</replaceable></option></arg>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt <arg><option>-k <replaceable class="parameter">keyfile</replaceable></option></arg>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt</group>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<arg><option>-t <replaceable class="parameter">timeout</replaceable></option></arg>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<arg><option>-u <replaceable class="parameter">udptimeout</replaceable></option></arg>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<arg><option>-r <replaceable class="parameter">udpretries</replaceable></option></arg>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<arg><option>-v</option></arg>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<arg>filename</arg>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt</cmdsynopsis>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt</refsynopsisdiv>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<refsect1>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<title>DESCRIPTION</title>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<para>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt<command>nsupdate</command>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Huntis used to submit Dynamic DNS Update requests as defined in RFC2136

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntto a name server.

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntThis allows resource records to be added or removed from a zone

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntwithout manually editing the zone file.

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntA single update request can contain requests to add or remove more than one

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntresource record.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt</para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<para>

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntZones that are under dynamic control via

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<command>nsupdate</command>

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntor a DHCP server should not be edited by hand.

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntManual edits could

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntconflict with dynamic updates and cause data to be lost.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt</para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<para>

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntThe resource records that are dynamically added or removed with

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<command>nsupdate</command>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunthave to be in the same zone.

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntRequests are sent to the zone's master server.

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntThis is identified by the MNAME field of the zone's SOA record.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt</para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<para>

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntThe

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<option>-d</option>

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntoption makes

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<command>nsupdate</command>

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntoperate in debug mode.

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntThis provides tracing information about the update requests that are

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntmade and the replies received from the name server.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt</para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<para>

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntTransaction signatures can be used to authenticate the Dynamic DNS

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntupdates.

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntThese use the TSIG resource record type described in RFC2845 or the

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntSIG(0) record described in RFC3535 and RFC2931.

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntTSIG relies on a shared secret that should only be known to

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<command>nsupdate</command> and the name server.

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntCurrently, the only supported encryption algorithm for TSIG is

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan HuntHMAC-MD5, which is defined in RFC 2104.

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan HuntOnce other algorithms are defined for TSIG, applications will need to

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Huntensure they select the appropriate algorithm as well as the key when

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Huntauthenticating each other.

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan HuntFor instance suitable

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt<type>key</type>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Huntand

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt<type>server</type>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Huntstatements would be added to

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt<filename>/etc/named.conf</filename>

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntso that the name server can associate the appropriate secret key

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntand algorithm with the IP address of the

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntclient application that will be using TSIG authentication.

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntSIG(0) uses public key cryptography. To use a SIG(0) key, the public

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntkey must be stored in a KEY record in a zone served by the name server.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<command>nsupdate</command>

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntdoes not read

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<filename>/etc/named.conf</filename>.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt</para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<command>nsupdate</command>

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntuses the

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<option>-y</option>

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntor

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt<option>-k</option>

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntoption (with an HMAC-MD5 key) to provide the shared secret needed to generate

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunta TSIG record for authenticating Dynamic DNS update requests.

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan HuntThese options are mutually exclusive.

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan HuntWith the

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt<option>-k</option>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Huntoption,

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt<command>nsupdate</command>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Huntreads the shared secret from the file

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt<parameter>keyfile</parameter>,

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Huntwhose name is of the form

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt<filename>K{name}.+157.+{random}.private</filename>.

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntFor historical

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntreasons, the file

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<filename>K{name}.+157.+{random}.key</filename>

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntmust also be present. When the

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<option>-y</option>

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntoption is used, a signature is generated from

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<parameter>keyname:secret.</parameter>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<parameter>keyname</parameter>

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntis the name of the key,

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntand

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<parameter>secret</parameter>

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntis the base64 encoded shared secret.

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntUse of the

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<option>-y</option>

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntoption is discouraged because the shared secret is supplied as a command

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntline argument in clear text.

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntThis may be visible in the output from

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<citerefentry>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<refentrytitle>ps</refentrytitle><manvolnum>1

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt</manvolnum>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt</citerefentry>

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntor in a history file maintained by the user's shell.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt</para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<para>

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntThe <option>-k</option> may also be used to specify a SIG(0) key used

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntto authenticate Dynamic DNS update requests. In this case, the key

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntspecified is not an HMAC-MD5 key.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt</para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<para>

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntBy default

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<command>nsupdate</command>

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntuses UDP to send update requests to the name server unless they are too

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntlarge to fit in a UDP request in which case TCP will be used.

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntThe

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<option>-v</option>

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntoption makes

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<command>nsupdate</command>

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntuse a TCP connection.

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntThis may be preferable when a batch of update requests is made.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt</para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<para>The <option>-t</option> option sets the maximum time a update request can

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunttake before it is aborted. The default is 300 seconds. Zero can be used

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntto disable the timeout.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt</para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<para>The <option>-u</option> option sets the UDP retry interval. The default is

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt3 seconds. If zero the interval will be computed from the timeout interval

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntand number of UDP retries.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt</para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<para>The <option>-r</option> option sets the number of UDP retries. The default is

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt3. If zero only one update request will be made.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt</para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt</refsect1>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<refsect1>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<title>INPUT FORMAT</title>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<command>nsupdate</command>

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntreads input from

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<parameter>filename</parameter>

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntor standard input.

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntEach command is supplied on exactly one line of input.

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntSome commands are for administrative purposes.

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntThe others are either update instructions or prerequisite checks on the

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntcontents of the zone.

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntThese checks set conditions that some name or set of

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntresource records (RRset) either exists or is absent from the zone.

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntThese conditions must be met if the entire update request is to succeed.

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntUpdates will be rejected if the tests for the prerequisite conditions fail.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt</para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<para>

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntEvery update request consists of zero or more prerequisites

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntand zero or more updates.

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntThis allows a suitably authenticated update request to proceed if some

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntspecified resource records are present or missing from the zone.

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntA blank input line (or the <command>send</command> command) causes the

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntaccumulated commands to be sent as one Dynamic DNS update request to the

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntname server.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt</para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<para>

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntThe command formats and their meaning are as follows:

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt<variablelist>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt<varlistentry><term>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt<cmdsynopsis>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt<command>server</command>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt<arg choice="req">servername</arg>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt<arg choice="opt">port</arg>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt</cmdsynopsis>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt</term>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt<listitem>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt<para>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan HuntSends all dynamic update requests to the name server

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt<parameter>servername</parameter>.

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan HuntWhen no server statement is provided,

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt<command>nsupdate</command>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Huntwill send updates to the master server of the correct zone.

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan HuntThe MNAME field of that zone's SOA record will identify the master

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Huntserver for that zone.

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt<parameter>port</parameter>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Huntis the port number on

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Hunt<parameter>servername</parameter>

7d2b185f16b165e311e5b451324fe9ab9898dcedEvan Huntwhere the dynamic update requests get sent.

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntIf no port number is specified, the default DNS port number of 53 is

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntused.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt</para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<varlistentry><term>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<cmdsynopsis>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<command>local</command>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<arg choice="req">address</arg>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<arg choice="opt">port</arg>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt</cmdsynopsis>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt</term>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<listitem>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<para>

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntSends all dynamic update requests using the local

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<parameter>address</parameter>.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntWhen no local statement is provided,

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<command>nsupdate</command>

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntwill send updates using an address and port choosen by the system.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<parameter>port</parameter>

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntcan additionally be used to make requests come from a specific port.

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntIf no port number is specified, the system will assign one.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<varlistentry><term>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<cmdsynopsis>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<command>zone</command>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<arg choice="req">zonename</arg>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt</cmdsynopsis>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt</term>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<listitem>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<para>

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntSpecifies that all updates are to be made to the zone

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<parameter>zonename</parameter>.

831f59eb43b56642b00f82e07722836d2f9593abEvan HuntIf no

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<parameter>zone</parameter>

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntstatement is provided,

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<command>nsupdate</command>

831f59eb43b56642b00f82e07722836d2f9593abEvan Huntwill attempt determine the correct zone to update based on the rest of the input.

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt</para>

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt

831f59eb43b56642b00f82e07722836d2f9593abEvan Hunt<varlistentry><term>

<cmdsynopsis>

<command>key</command>

<arg choice="req">name</arg>

<arg choice="req">secret</arg>

</cmdsynopsis>

</term>

<listitem>

<para>

Specifies that all updates are to be TSIG signed using the

<parameter>keyname</parameter> <parameter>keysecret</parameter> pair.

The <command>key</command> command

overrides any key specified on the command line via

<option>-y</option> or <option>-k</option>.

</para>

<varlistentry><term>

<cmdsynopsis>

<command>prereq nxdomain</command>

<arg choice="req">domain-name</arg>

</cmdsynopsis>

</term>

<listitem>

<para>

Requires that no resource record of any type exists with name

<parameter>domain-name</parameter>.

</para>

<varlistentry><term>

<cmdsynopsis>

<command>prereq yxdomain</command>

<arg choice="req">domain-name</arg>

</cmdsynopsis>

</term>

<listitem>

<para>

Requires that

<parameter>domain-name</parameter>

exists (has as at least one resource record, of any type).

</para>

<varlistentry><term>

<cmdsynopsis>

<command>prereq nxrrset</command>

<arg choice="req">domain-name</arg>

<arg choice="opt">class</arg>

<arg choice="req">type</arg>

</cmdsynopsis>

</term>

<listitem>

<para>

Requires that no resource record exists of the specified

<parameter>type</parameter>,

<parameter>class</parameter>

and

<parameter>domain-name</parameter>.

If

<parameter>class</parameter>

is omitted, IN (internet) is assumed.

<varlistentry><term>

<cmdsynopsis>

<command>prereq yxrrset</command>

<arg choice="req">domain-name</arg>

<arg choice="opt">class</arg>

<arg choice="req">type</arg>

</cmdsynopsis>

</term>

<listitem>

<para>

This requires that a resource record of the specified

<parameter>type</parameter>,

<parameter>class</parameter>

and

<parameter>domain-name</parameter>

must exist.

If

<parameter>class</parameter>

is omitted, IN (internet) is assumed.

</para>

<varlistentry><term>

<cmdsynopsis>

<command>prereq yxrrset</command>

<arg choice="req">domain-name</arg>

<arg choice="opt">class</arg>

<arg choice="req">type</arg>

<arg choice="req" rep="repeat">data</arg>

</cmdsynopsis>

</term>

<listitem>

<para>

The

<parameter>data</parameter>

from each set of prerequisites of this form

sharing a common

<parameter>type</parameter>,

<parameter>class</parameter>,

and

<parameter>domain-name</parameter>

are combined to form a set of RRs. This set of RRs must

exactly match the set of RRs existing in the zone at the

given

<parameter>type</parameter>,

<parameter>class</parameter>,

and

<parameter>domain-name</parameter>.

The

<parameter>data</parameter>

are written in the standard text representation of the resource record's

RDATA.

</para>

<varlistentry><term>

<cmdsynopsis>

<command>update delete</command>

<arg choice="req">domain-name</arg>

<arg choice="opt">ttl</arg>

<arg choice="opt">class</arg>

<arg choice="opt">type <arg choice="opt" rep="repeat">data</arg></arg>

</cmdsynopsis>

</term>

<listitem>

<para>

Deletes any resource records named

<parameter>domain-name</parameter>.

If

<parameter>type</parameter>

and

<parameter>data</parameter>

is provided, only matching resource records will be removed.

The internet class is assumed if

<parameter>class</parameter>

is not supplied. The

<parameter>ttl</parameter>

is ignored, and is only allowed for compatibility.

</para>

<varlistentry><term>

<cmdsynopsis>

<command>update add</command>

<arg choice="req">domain-name</arg>

<arg choice="req">ttl</arg>

<arg choice="opt">class</arg>

<arg choice="req">type</arg>

<arg choice="req" rep="repeat">data</arg>

</cmdsynopsis>

</term>

<listitem>

<para>

Adds a new resource record with the specified

<parameter>ttl</parameter>,

<parameter>class</parameter>

and

<parameter>data</parameter>.

</para>

<varlistentry><term>

<cmdsynopsis>

<command>show</command>

</cmdsynopsis>

</term>

<listitem>

<para>

Displays the current message, containing all of the prerequisites and

updates specified since the last send.

</para>

<varlistentry><term>

<cmdsynopsis>

<command>send</command>

</cmdsynopsis>

</term>

<listitem>

<para>

Sends the current message. This is equivalent to entering a blank line.

</para>

</listitem>

</variablelist>

<para>

Lines beginning with a semicolon are comments, and are ignored.

</para>

</refsect1>

<refsect1>

<title>EXAMPLES</title>

<para>

The examples below show how

<command>nsupdate</command>

could be used to insert and delete resource records from the

<type>example.com</type>

zone.

Notice that the input in each example contains a trailing blank line so that

a group of commands are sent as one dynamic update request to the

master name server for

<type>example.com</type>.

<programlisting>

# nsupdate

> update delete oldhost.example.com A

> update add newhost.example.com 86400 A 172.16.1.1

>

</programlisting>

</para>

<para>

Any A records for

<type>oldhost.example.com</type>

are deleted.

and an A record for

<type>newhost.example.com</type>

it IP address 172.16.1.1 is added.

The newly-added record has a 1 day TTL (86400 seconds)

<programlisting>

# nsupdate

> prereq nxdomain nickname.example.com

> update add nickname.example.com 86400 CNAME somehost.example.com

>

</programlisting>

</para>

<para>

The prerequisite condition gets the name server to check that there

are no resource records of any type for

<type>nickname.example.com</type>.

If there are, the update request fails.

If this name does not exist, a CNAME for it is added.

This ensures that when the CNAME is added, it cannot conflict with the

long-standing rule in RFC1034 that a name must not exist as any other

record type if it exists as a CNAME.

(The rule has been updated for DNSSEC in RFC2535 to allow CNAMEs to have

SIG, KEY and NXT records.)

</para>

</refsect1>

<refsect1>

<title>FILES</title>

<variablelist>

<varlistentry><term><constant>/etc/resolv.conf</constant></term>

<listitem>

<para>

used to identify default name server

</para>

</listitem>

<varlistentry><term><constant>K{name}.+157.+{random}.key</constant></term>

<listitem>

<para>

base-64 encoding of HMAC-MD5 key created by

<citerefentry>

<refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>

</citerefentry>.

</para>

</listitem>

<varlistentry><term><constant>K{name}.+157.+{random}.private</constant></term>

<listitem>

<para>

base-64 encoding of HMAC-MD5 key created by

<citerefentry>

<refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>

</citerefentry>.

</para>

</listitem>

</variablelist>

</refsect1>

<refsect1>

<title>SEE ALSO</title>

<para>

<citerefentry>

<refentrytitle>RFC2136</refentrytitle>

</citerefentry>,

<citerefentry>

<refentrytitle>RFC3007</refentrytitle>

</citerefentry>,

<citerefentry>

<refentrytitle>RFC2104</refentrytitle>

</citerefentry>,

<citerefentry>

<refentrytitle>RFC2845</refentrytitle>

</citerefentry>,

<citerefentry>

<refentrytitle>RFC1034</refentrytitle>

</citerefentry>,

<citerefentry>

<refentrytitle>RFC2535</refentrytitle>

</citerefentry>,

<citerefentry>

<refentrytitle>RFC2931</refentrytitle>

</citerefentry>,

<citerefentry>

<refentrytitle>named</refentrytitle><manvolnum>8</manvolnum>

</citerefentry>,

<citerefentry>

<refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>

</citerefentry>.

</refsect1>

<refsect1>

<title>BUGS</title>

<para>

The TSIG key is redundantly stored in two separate files.

This is a consequence of nsupdate using the DST library

for its cryptographic operations, and may change in future

releases.

</para>

</refsect1>

</refentry>