nsupdate.html revision 548a24c3d36837aa5f0e64f7bb8c7308909ffa89
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater - Copyright (C) 2004-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
c7ef13f6c9ef4436bc804b150e0a93307b11fa27Tinderbox User - Copyright (C) 2000-2003 Internet Software Consortium.
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews - Permission to use, copy, modify, and/or distribute this software for any
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User - purpose with or without fee is hereby granted, provided that the above
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User - copyright notice and this permission notice appear in all copies.
5e047890ac9b745db060d95f7d1b4f876511240dTinderbox User - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
137fdbc214e99c4cbe57551e9e14f2015c2e42aeTinderbox User - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
02b47c5d62e1e827743684c28a08e871da454a2dMark Andrews - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User - PERFORMANCE OF THIS SOFTWARE.
3cc98b8ecedcbc8465f1cf2740b966b315662430Automatic Updater<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
e20309353e6246485c521278131d3fced73d7957Tinderbox User<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<a name="man.nsupdate"></a><div class="titlepage"></div>
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater<p><span class="application">nsupdate</span> — Dynamic DNS update utility</p>
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson<div class="cmdsynopsis"><p><code class="command">nsupdate</code> [<code class="option">-d</code>] [<code class="option">-D</code>] [<code class="option">-L <em class="replaceable"><code>level</code></em></code>] [[<code class="option">-g</code>] | [<code class="option">-o</code>] | [<code class="option">-l</code>] | [<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></code>] | [<code class="option">-k <em class="replaceable"><code>keyfile</code></em></code>]] [<code class="option">-t <em class="replaceable"><code>timeout</code></em></code>] [<code class="option">-u <em class="replaceable"><code>udptimeout</code></em></code>] [<code class="option">-r <em class="replaceable"><code>udpretries</code></em></code>] [<code class="option">-R <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-v</code>] [<code class="option">-T</code>] [<code class="option">-P</code>] [<code class="option">-V</code>] [filename]</p></div>
aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt<p><span><strong class="command">nsupdate</strong></span>
e130ab53e992670e2a2ecf043976ac09f21358d1Automatic Updater is used to submit Dynamic DNS Update requests as defined in RFC 2136
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater to a name server.
aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt This allows resource records to be added or removed from a zone
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater without manually editing the zone file.
24934f08b9ff81c2be711e566e8002d145573031Tinderbox User A single update request can contain requests to add or remove more than
aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt resource record.
aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt Zones that are under dynamic control via
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">nsupdate</strong></span>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater or a DHCP server should not be edited by hand.
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater Manual edits could
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater conflict with dynamic updates and cause data to be lost.
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater The resource records that are dynamically added or removed with
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater <span><strong class="command">nsupdate</strong></span>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater have to be in the same zone.
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater Requests are sent to the zone's master server.
eabc9c3c07cd956d3c436bd7614cb162dabdda76Mark Andrews This is identified by the MNAME field of the zone's SOA record.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User Transaction signatures can be used to authenticate the Dynamic
e20309353e6246485c521278131d3fced73d7957Tinderbox User DNS updates. These use the TSIG resource record type described
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews in RFC 2845 or the SIG(0) record described in RFC 2535 and
24934f08b9ff81c2be711e566e8002d145573031Tinderbox User RFC 2931 or GSS-TSIG as described in RFC 3645.
7feccf248d2a20a2ae48b290f58ded5abc853e9aTinderbox User TSIG relies on
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews a shared secret that should only be known to
c59750de3ea3c7d5890000fb4606e8f5835a52aaTinderbox User <span><strong class="command">nsupdate</strong></span> and the name server.
80faf1588895fd26490f82f95a7a1b771df1c324Automatic Updater For instance, suitable <span class="type">key</span> and
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <span class="type">server</span> statements would be added to
ec7751119a08c6a7250f3187beed69a8b836d349Tinderbox User <code class="filename">/etc/named.conf</code> so that the name server
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews can associate the appropriate secret key and algorithm with
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews the IP address of the client application that will be using
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews TSIG authentication. You can use <span><strong class="command">ddns-confgen</strong></span>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews to generate suitable configuration fragments.
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater <span><strong class="command">nsupdate</strong></span>
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson uses the <code class="option">-y</code> or <code class="option">-k</code> options
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater to provide the TSIG shared secret. These options are mutually exclusive.
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater SIG(0) uses public key cryptography.
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson To use a SIG(0) key, the public key must be stored in a KEY
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater record in a zone served by the name server.
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater GSS-TSIG uses Kerberos credentials. Standard GSS-TSIG mode
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews is switched on with the <code class="option">-g</code> flag. A
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews non-standards-compliant variant of GSS-TSIG used by Windows
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews 2000 can be switched on with the <code class="option">-o</code> flag.
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont Debug mode. This provides tracing information about the
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User update requests that are made and the replies received
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User from the name server.
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User Extra debug mode.
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews<dt><span class="term">-k <em class="replaceable"><code>keyfile</code></em></span></dt>
24bf1e02f03577db0feb50b80238c4150c96d05dAutomatic Updater The file containing the TSIG authentication key.
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews Keyfiles may be in two formats: a single file containing
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews a <code class="filename">named.conf</code>-format <span><strong class="command">key</strong></span>
2ba8f584b97cbab864570e38fd26b8cb90961428Tinderbox User statement, which may be generated automatically by
a308b69ac66fadf66863484f301314d6e6a3f1d2Automatic Updater <span><strong class="command">ddns-confgen</strong></span>, or a pair of files whose names are
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews of the format <code class="filename">K{name}.+157.+{random}.key</code> and
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <code class="filename">K{name}.+157.+{random}.private</code>, which can be
551271d8198ae06e37edf5da519d8ee153eeac0fTinderbox User generated by <span><strong class="command">dnssec-keygen</strong></span>.
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews The <code class="option">-k</code> may also be used to specify a SIG(0) key used
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews to authenticate Dynamic DNS update requests. In this case, the key
b871c7156eb037d41f53828c6fcb9cc876128962Mark Andrews specified is not an HMAC-MD5 key.
551271d8198ae06e37edf5da519d8ee153eeac0fTinderbox User Local-host only mode. This sets the server address to
b871c7156eb037d41f53828c6fcb9cc876128962Mark Andrews localhost (disabling the <span><strong class="command">server</strong></span> so that the server
df4ebd8217d02dafc12145b55c4d93d0255d1ec7Tinderbox User address cannot be overridden). Connections to the local server will
cdfc81e048bd34c1d628380247bda6b80a89e20eAutomatic Updater use a TSIG key found in <code class="filename">/var/run/named/session.key</code>,
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater which is automatically generated by <span><strong class="command">named</strong></span> if any
fe80a4909bf62b602feaf246866e9d29f7654194Automatic Updater local master zone has set <span><strong class="command">update-policy</strong></span> to
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater <span><strong class="command">local</strong></span>. The location of this key file can be
fa0326cc2cf428f67575b6ba3b97b528a31b0010Tinderbox User overridden with the <code class="option">-k</code> option.
fa0326cc2cf428f67575b6ba3b97b528a31b0010Tinderbox User<dt><span class="term">-L <em class="replaceable"><code>level</code></em></span></dt>
fe80a4909bf62b602feaf246866e9d29f7654194Automatic Updater Set the logging debug level. If zero, logging is disabled.
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater<dt><span class="term">-p <em class="replaceable"><code>port</code></em></span></dt>
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater Set the port to use for connections to a name server. The
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews default is 53.
dd65eb1efb40b1c47d57963192bfc54873b219beAutomatic Updater Print the list of private BIND-specific resource record
133e6d43fa82e80d3798be4de00f4540f485ec6cAutomatic Updater types whose format is understood
133e6d43fa82e80d3798be4de00f4540f485ec6cAutomatic Updater by <span><strong class="command">nsupdate</strong></span>. See also
133e6d43fa82e80d3798be4de00f4540f485ec6cAutomatic Updater the <code class="option">-T</code> option.
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson<dt><span class="term">-r <em class="replaceable"><code>udpretries</code></em></span></dt>
5f7586ddbd3edd11272cdd30ed613d936129328bTinderbox User The number of UDP retries. The default is 3. If zero, only
5f7586ddbd3edd11272cdd30ed613d936129328bTinderbox User one update request will be made.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<dt><span class="term">-R <em class="replaceable"><code>randomdev</code></em></span></dt>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User Where to obtain randomness. If the operating system
c7ef13f6c9ef4436bc804b150e0a93307b11fa27Tinderbox User does not provide a <code class="filename">/dev/random</code> or
c7ef13f6c9ef4436bc804b150e0a93307b11fa27Tinderbox User equivalent device, the default source of randomness is keyboard
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User input. <code class="filename">randomdev</code> specifies the name of
f132a836c4e386b1af045dd8fe7106ae61b90bffAutomatic Updater a character device or file containing random data to be used
d642d3857129678797a01adee14fbd70335b05a9Mark Andrews instead of the default. The special value
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews <code class="filename">keyboard</code> indicates that keyboard input
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews should be used. This option may be specified multiple times.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<dt><span class="term">-t <em class="replaceable"><code>timeout</code></em></span></dt>
269519eeb959d905ed125f96426e01d725c3b597Tinderbox User The maximum time an update request can take before it is
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater aborted. The default is 300 seconds. Zero can be used to
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater disable the timeout.
6a9d2121152c94cb9e35832126c3f2e4d18d81edTinderbox User Print the list of IANA standard resource record types
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews whose format is understood by <span><strong class="command">nsupdate</strong></span>.
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews <span><strong class="command">nsupdate</strong></span> will exit after the lists are
bc0a53583d92309bebcf93c408e2f3247ebd3d3cAutomatic Updater printed. The <code class="option">-T</code> option can be combined
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater with the <code class="option">-P</code> option.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Other types can be entered using "TYPEXXXXX" where "XXXXX" is the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater decimal value of the type with no leading zeros. The rdata,
7f79131f9a8e804b93c57f3c679065cce878b726Automatic Updater if present, will be parsed using the UNKNOWN rdata format,
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater (<backslash> <hash> <space> <length>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <space> <hexstring>).
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term">-u <em class="replaceable"><code>udptimeout</code></em></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The UDP retry interval. The default is 3 seconds. If zero,
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater the interval will be computed from the timeout interval and
7f94d9a8162c9a96b56e66176702b66e79d8e1a2Automatic Updater number of UDP retries.
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews Use TCP even for small update requests.
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews By default, <span><strong class="command">nsupdate</strong></span>
6a9d2121152c94cb9e35832126c3f2e4d18d81edTinderbox User uses UDP to send update requests to the name server unless they are too
6a9d2121152c94cb9e35832126c3f2e4d18d81edTinderbox User large to fit in a UDP request in which case TCP will be used.
7262eb86f2b465822206122921e2f357218f0cfdAutomatic Updater TCP may be preferable when a batch of update requests is made.
bbb069be941f649228760edcc241122933c066d2Automatic Updater Print the version number and exit.
4cda4fd158d6ded5586bacea8c388445d99611eaAutomatic Updater<dt><span class="term">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></span></dt>
80faf1588895fd26490f82f95a7a1b771df1c324Automatic Updater Literal TSIG authentication key.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <em class="parameter"><code>keyname</code></em> is the name of the key, and
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <em class="parameter"><code>secret</code></em> is the base64 encoded shared secret.
6a9d2121152c94cb9e35832126c3f2e4d18d81edTinderbox User <em class="parameter"><code>hmac</code></em> is the name of the key algorithm;
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews valid choices are <code class="literal">hmac-md5</code>,
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <code class="literal">hmac-sha1</code>, <code class="literal">hmac-sha224</code>,
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews <code class="literal">hmac-sha256</code>, <code class="literal">hmac-sha384</code>, or
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <code class="literal">hmac-sha512</code>. If <em class="parameter"><code>hmac</code></em>
551271d8198ae06e37edf5da519d8ee153eeac0fTinderbox User is not specified, the default is <code class="literal">hmac-md5</code>.
bbc0e1c4f47f101c4a64db3469352c49a49e734fTinderbox User NOTE: Use of the <code class="option">-y</code> option is discouraged because the
f751b1576ee6fef4023bf7101d10167e4fe520f3Tinderbox User shared secret is supplied as a command line argument in clear text.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater This may be visible in the output from
a792d42c3cdd6cd4608b936c0a06437b8c2d99ccTinderbox User <span class="citerefentry"><span class="refentrytitle">ps</span>(1)</span>
da59e63e7af147a8bcef985b98b04443e04c3a0eTinderbox User or in a history file maintained by the user's shell.
dc5552b4df5e3821783821c8d4e734c1608c446eTinderbox User<p><span><strong class="command">nsupdate</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater reads input from
cf7e98f59148b559946a7f1ca728471374f1eef3Automatic Updater <em class="parameter"><code>filename</code></em>
c3fd32ed29e9e419bb56583f4272a506773b1ea0Automatic Updater or standard input.
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson Each command is supplied on exactly one line of input.
c3fd32ed29e9e419bb56583f4272a506773b1ea0Automatic Updater Some commands are for administrative purposes.
cd6e9010079a4e58f7e30063df3dec0ff154ad59Tinderbox User The others are either update instructions or prerequisite checks on the
a382ca49c874d38ad3ac8995b49f9f27128e4ca9Automatic Updater contents of the zone.
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User These checks set conditions that some name or set of
bbc0e1c4f47f101c4a64db3469352c49a49e734fTinderbox User resource records (RRset) either exists or is absent from the zone.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User These conditions must be met if the entire update request is to succeed.
e20309353e6246485c521278131d3fced73d7957Tinderbox User Updates will be rejected if the tests for the prerequisite conditions
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews Every update request consists of zero or more prerequisites
9174e44c14b1cb91a651fa1dc29470438c246ab9Automatic Updater and zero or more updates.
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson This allows a suitably authenticated update request to proceed if some
e2caa7536302de34de6cc04025abcd53dc3a499aAutomatic Updater specified resource records are present or missing from the zone.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User A blank input line (or the <span><strong class="command">send</strong></span> command)
0b57424d28c9a67018107133f9fbc0a7dcf057e2Mark Andrews accumulated commands to be sent as one Dynamic DNS update request to the
0b57424d28c9a67018107133f9fbc0a7dcf057e2Mark Andrews name server.
e31cfd80616deb9781902306b34a69aa7309b6cbTinderbox User The command formats and their meaning are as follows:
7d12a6b412fe47e6d6582923fd6954ab8cd0baebAutomatic Updater <span><strong class="command">server</strong></span>
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews {servername}
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews Sends all dynamic update requests to the name server
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews <em class="parameter"><code>servername</code></em>.
3351ccbd5c1961404044f8273d54dad405f53960Mark Andrews When no server statement is provided,
7d12a6b412fe47e6d6582923fd6954ab8cd0baebAutomatic Updater <span><strong class="command">nsupdate</strong></span>
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews will send updates to the master server of the correct zone.
0b57424d28c9a67018107133f9fbc0a7dcf057e2Mark Andrews The MNAME field of that zone's SOA record will identify the
0b57424d28c9a67018107133f9fbc0a7dcf057e2Mark Andrews server for that zone.
e8fc8c884b44371784805e1e0d3100da403dd3f1Automatic Updater <em class="parameter"><code>port</code></em>
e8fc8c884b44371784805e1e0d3100da403dd3f1Automatic Updater is the port number on
e8fc8c884b44371784805e1e0d3100da403dd3f1Automatic Updater <em class="parameter"><code>servername</code></em>
e8fc8c884b44371784805e1e0d3100da403dd3f1Automatic Updater where the dynamic update requests get sent.
e8fc8c884b44371784805e1e0d3100da403dd3f1Automatic Updater If no port number is specified, the default DNS port number of
7d12a6b412fe47e6d6582923fd6954ab8cd0baebAutomatic Updater <span><strong class="command">local</strong></span>
01a5c5503482fb3ba52088bf0178a7213273bf96Mark Andrews Sends all dynamic update requests using the local
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User <em class="parameter"><code>address</code></em>.
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews When no local statement is provided,
dc435f1033bcba88b748074987db6cfd34c057a4Tinderbox User <span><strong class="command">nsupdate</strong></span>
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews will send updates using an address and port chosen by the
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater can additionally be used to make requests come from a specific
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User If no port number is specified, the system will assign one.
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User <span><strong class="command">zone</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Specifies that all updates are to be made to the zone
7f79131f9a8e804b93c57f3c679065cce878b726Automatic Updater <em class="parameter"><code>zonename</code></em>.
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson <em class="parameter"><code>zone</code></em>
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater statement is provided,
efb0e886f18894a1d2489f1ad74ad14b579e11c7Mark Andrews <span><strong class="command">nsupdate</strong></span>
efb0e886f18894a1d2489f1ad74ad14b579e11c7Mark Andrews will attempt determine the correct zone to update based on the
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User rest of the input.
e20309353e6246485c521278131d3fced73d7957Tinderbox User <span><strong class="command">class</strong></span>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Specify the default class.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User If no <em class="parameter"><code>class</code></em> is specified, the
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater default class is
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews <span><strong class="command">ttl</strong></span>
d6317350b1180aa4517f2e8a92fa8fbcbf904ad8Automatic Updater Specify the default time to live for records to be added.
bc0a4c01beede169df81a3ee5b614ed9e82339dbAutomatic Updater The value <em class="parameter"><code>none</code></em> will clear the default
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <span><strong class="command">key</strong></span>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington [hmac:] {keyname}
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Specifies that all updates are to be TSIG-signed using the
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <em class="parameter"><code>keyname</code></em> <em class="parameter"><code>secret</code></em> pair.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington If <em class="parameter"><code>hmac</code></em> is specified, then it sets the
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington signing algorithm in use; the default is
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <code class="literal">hmac-md5</code>. The <span><strong class="command">key</strong></span>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington command overrides any key specified on the command line via
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <code class="option">-y</code> or <code class="option">-k</code>.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <span><strong class="command">gsstsig</strong></span>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Use GSS-TSIG to sign the updated. This is equivalent to
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington specifying <code class="option">-g</code> on the commandline.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <span><strong class="command">oldgsstsig</strong></span>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Use the Windows 2000 version of GSS-TSIG to sign the updated.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington This is equivalent to specifying <code class="option">-o</code> on the
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <span><strong class="command">realm</strong></span>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington {[<span class="optional">realm_name</span>]}
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington When using GSS-TSIG use <em class="parameter"><code>realm_name</code></em> rather
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington than the default realm in <code class="filename">krb5.conf</code>. If no
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington realm is specified the saved realm is cleared.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <span><strong class="command">check-names</strong></span>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington {[<span class="optional">yes_or_no</span>]}
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Turn on or off check-names processing on records to
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington be added. Check-names has no effect on prerequisites
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington or records to be deleted. By default check-names
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington processing is on. If check-names processing fails
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington the record will not be added to the UPDATE message.
22d32791e5daa0bc80335a0f10ab2de95f41ccdbTinderbox User <span><strong class="command">[<span class="optional">prereq</span>] nxdomain</strong></span>
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater Requires that no resource record of any type exists with name
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater <em class="parameter"><code>domain-name</code></em>.
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater <span><strong class="command">[<span class="optional">prereq</span>] yxdomain</strong></span>
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater <em class="parameter"><code>domain-name</code></em>
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater exists (has as at least one resource record, of any type).
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User <span><strong class="command">[<span class="optional">prereq</span>] nxrrset</strong></span>
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User {domain-name}
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User Requires that no resource record exists of the specified
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User <em class="parameter"><code>type</code></em>,
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User <em class="parameter"><code>class</code></em>
02b47c5d62e1e827743684c28a08e871da454a2dMark Andrews <em class="parameter"><code>domain-name</code></em>.
da59e63e7af147a8bcef985b98b04443e04c3a0eTinderbox User <em class="parameter"><code>class</code></em>
099b86fb8136a7dff81df85cf395978c16eb254cAutomatic Updater is omitted, IN (internet) is assumed.
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User <span><strong class="command">[<span class="optional">prereq</span>] yxrrset</strong></span>
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User {domain-name}
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater This requires that a resource record of the specified
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <em class="parameter"><code>type</code></em>,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <em class="parameter"><code>class</code></em>
e01f44b37ba11c9d34f4a8394f950efae5c07f33Automatic Updater <em class="parameter"><code>domain-name</code></em>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <em class="parameter"><code>class</code></em>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater is omitted, IN (internet) is assumed.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">[<span class="optional">prereq</span>] yxrrset</strong></span>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <em class="parameter"><code>data</code></em>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington from each set of prerequisites of this form
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington sharing a common
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <em class="parameter"><code>type</code></em>,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <em class="parameter"><code>class</code></em>,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <em class="parameter"><code>domain-name</code></em>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington are combined to form a set of RRs. This set of RRs must
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington exactly match the set of RRs existing in the zone at the
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <em class="parameter"><code>type</code></em>,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <em class="parameter"><code>class</code></em>,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <em class="parameter"><code>domain-name</code></em>.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington are written in the standard text representation of the resource
a26b22914b7bf25f065afb8cdef983766dcd672bAutomatic Updater <span><strong class="command">[<span class="optional">update</span>] del[<span class="optional">ete</span>]</strong></span>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [type [data...]]
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews Deletes any resource records named
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <em class="parameter"><code>domain-name</code></em>.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <em class="parameter"><code>type</code></em>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <em class="parameter"><code>data</code></em>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington is provided, only matching resource records will be removed.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington The internet class is assumed if
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <em class="parameter"><code>class</code></em>
b7aab05edae933e169d5f83c653935b17c7f0a8bMark Andrews is not supplied. The
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <em class="parameter"><code>ttl</code></em>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington is ignored, and is only allowed for compatibility.
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews <span><strong class="command">[<span class="optional">update</span>] add</strong></span>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington {domain-name}
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Adds a new resource record with the specified
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <em class="parameter"><code>ttl</code></em>,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <em class="parameter"><code>class</code></em>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <em class="parameter"><code>data</code></em>.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <span><strong class="command">show</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Displays the current message, containing all of the
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User prerequisites and
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater updates specified since the last send.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">send</strong></span>
42bee07ebb8152a6ec2f87f4790d87368c24704cAutomatic Updater Sends the current message. This is equivalent to entering a
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <span><strong class="command">answer</strong></span>
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews Displays the answer.
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews <span><strong class="command">debug</strong></span>
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews Turn on debugging.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <span><strong class="command">version</strong></span>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Print version number.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <span><strong class="command">help</strong></span>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Print a list of commands.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Lines beginning with a semicolon are comments and are ignored.
da59e63e7af147a8bcef985b98b04443e04c3a0eTinderbox User The examples below show how
22d32791e5daa0bc80335a0f10ab2de95f41ccdbTinderbox User <span><strong class="command">nsupdate</strong></span>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User could be used to insert and delete resource records from the
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Notice that the input in each example contains a trailing blank line so
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User a group of commands are sent as one dynamic update request to the
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User master name server for
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User> update delete oldhost.example.com A
532d27b39244fadfcf8d8b4593f4c65434c9c664Automatic Updater> update add newhost.example.com 86400 A 172.16.1.1
91faa748a27dee38f6caea461d3e87f15b93abeaTinderbox User Any A records for
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews are deleted.
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews And an A record for
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews with IP address 172.16.1.1 is added.
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews The newly-added record has a 1 day TTL (86400 seconds).
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews> prereq nxdomain nickname.example.com
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews> update add nickname.example.com 86400 CNAME somehost.example.com
93089a352d6903b0d7845a039de4ec2df9a0e35aTinderbox User The prerequisite condition gets the name server to check that there
665ba746c0585088d0c314dcfc4671aa2c7b2dc1Automatic Updater are no resource records of any type for
9c446b72069d0ab9f710502f4d7048e50875fccbAutomatic Updater <span class="type">nickname.example.com</span>.
665ba746c0585088d0c314dcfc4671aa2c7b2dc1Automatic Updater If there are, the update request fails.
93089a352d6903b0d7845a039de4ec2df9a0e35aTinderbox User If this name does not exist, a CNAME for it is added.
93089a352d6903b0d7845a039de4ec2df9a0e35aTinderbox User This ensures that when the CNAME is added, it cannot conflict with the
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User long-standing rule in RFC 1034 that a name must not exist as any other
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater record type if it exists as a CNAME.
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater (The rule has been updated for DNSSEC in RFC 2535 to allow CNAMEs to have
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater RRSIG, DNSKEY and NSEC records.)
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater<dt><span class="term"><code class="constant">/etc/resolv.conf</code></span></dt>
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater used to identify default name server
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater<dt><span class="term"><code class="constant">/var/run/named/session.key</code></span></dt>
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater sets the default TSIG key for use in local-only mode
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater<dt><span class="term"><code class="constant">K{name}.+157.+{random}.key</code></span></dt>
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater base-64 encoding of HMAC-MD5 key created by
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>.
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater<dt><span class="term"><code class="constant">K{name}.+157.+{random}.private</code></span></dt>
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater base-64 encoding of HMAC-MD5 key created by
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>.
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater <span class="citerefentry"><span class="refentrytitle">ddns-confgen</span>(8)</span>,
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>.
bbc0e1c4f47f101c4a64db3469352c49a49e734fTinderbox User The TSIG key is redundantly stored in two separate files.
fe84edc17e0d582cf7b4270f8df9d4742a107b1cAutomatic Updater This is a consequence of nsupdate using the DST library
a382ca49c874d38ad3ac8995b49f9f27128e4ca9Automatic Updater for its cryptographic operations, and may change in future