2362N/A - Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC") 0N/A - Copyright (C) 2001-2003 Internet Software Consortium. 0N/A - Permission to use, copy, modify, and distribute this software for any 0N/A - purpose with or without fee is hereby granted, provided that the above 2362N/A - copyright notice and this permission notice appear in all copies. 2362N/A - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH 0N/A - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY 0N/A - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, 0N/A - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM 0N/A - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE 0N/A - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 0N/A - PERFORMANCE OF THIS SOFTWARE. 0N/ACONTENT="Modular DocBook HTML Stylesheet Version 1.73 0N/A>nsupdate -- Dynamic DNS update utility</
DIV 0N/ACLASS="REFSYNOPSISDIV" 28N/Ais used to submit Dynamic DNS Update requests as defined in RFC2136
0N/AThis allows resource records to be added or removed from a zone
0N/Awithout manually editing the zone file.
0N/AA single update request can contain requests to add or remove more than one
0N/A>Zones that are under dynamic control via
0N/Aor a DHCP server should not be edited by hand.
0N/Aconflict with dynamic updates and cause data to be lost.</
P 0N/A>The resource records that are dynamically added or removed with
0N/Ahave to be in the same zone.
0N/ARequests are sent to the zone's master server.
0N/AThis is identified by the MNAME field of the zone's SOA record.</
P 0N/Aoperate in debug mode.
0N/AThis provides tracing information about the update requests that are
0N/Amade and the replies received from the name server.</
P 0N/A>Transaction signatures can be used to authenticate the Dynamic DNS
0N/AThese use the TSIG resource record type described in RFC2845 or the
0N/ASIG(0) record described in RFC3535 and RFC2931.
0N/ATSIG relies on a shared secret that should only be known to
0N/A> and the name server.
0N/ACurrently, the only supported encryption algorithm for TSIG is
0N/AHMAC-MD5, which is defined in RFC 2104.
0N/AOnce other algorithms are defined for TSIG, applications will need to
0N/Aensure they select the appropriate algorithm as well as the key when
0N/Aauthenticating each other.
0N/AFor instance suitable
0N/Astatements would be added to
0N/Aso that the name server can associate the appropriate secret key
0N/Aand algorithm with the IP address of the
0N/Aclient application that will be using TSIG authentication.
0N/ASIG(0) uses public key cryptography. To use a SIG(0) key, the public
0N/Akey must be stored in a KEY record in a zone served by the name server.
0N/Aoption (with an HMAC-MD5 key) to provide the shared secret needed to generate
0N/Aa TSIG record for authenticating Dynamic DNS update requests.
0N/AThese options are mutually exclusive.
0N/Areads the shared secret from the file
0N/Awhose name is of the form
0N/A>K{name}.+157.+{random}.private</
TT 0N/A>K{name}.+157.+{random}.key</
TT 0N/Amust also be present. When the
0N/Aoption is used, a signature is generated from
0N/Ais the name of the key,
0N/Ais the base64 encoded shared secret.
0N/Aoption is discouraged because the shared secret is supplied as a command
0N/Aline argument in clear text.
0N/AThis may be visible in the output from
0N/ACLASS="REFENTRYTITLE" 0N/Aor in a history file maintained by the user's shell.</
P 0N/A> may also be used to specify a SIG(0) key used
0N/Ato authenticate Dynamic DNS update requests. In this case, the key
0N/Aspecified is not an HMAC-MD5 key.</
P 0N/Auses UDP to send update requests to the name server unless they are too
0N/Alarge to fit in a UDP request in which case TCP will be used.
0N/Ause a TCP connection.
0N/AThis may be preferable when a batch of update requests is made.</
P 0N/A> option sets the maximum time a update request can
0N/Atake before it is aborted. The default is 300 seconds. Zero can be used
0N/Ato disable the timeout.</
P 0N/A> option sets the UDP retry interval. The default is
0N/A3 seconds. If zero the interval will be computed from the timeout interval
0N/Aand number of UDP retries.</
P 0N/A> option sets the number of UDP retries. The default is
0N/A3. If zero only one update request will be made.</
P 0N/AEach command is supplied on exactly one line of input.
0N/ASome commands are for administrative purposes.
0N/AThe others are either update instructions or prerequisite checks on the
0N/Acontents of the zone.
0N/AThese checks set conditions that some name or set of
0N/Aresource records (RRset) either exists or is absent from the zone.
0N/AThese conditions must be met if the entire update request is to succeed.
0N/AUpdates will be rejected if the tests for the prerequisite conditions fail.</
P 0N/A>Every update request consists of zero or more prerequisites
0N/Aand zero or more updates.
0N/AThis allows a suitably authenticated update request to proceed if some
0N/Aspecified resource records are present or missing from the zone.
0N/AA blank input line (or the <
B 0N/A> command) causes the
0N/Aaccumulated commands to be sent as one Dynamic DNS update request to the
0N/A>The command formats and their meaning are as follows:
0N/A> {servername} [port]</
P 0N/A>Sends all dynamic update requests to the name server
0N/AWhen no server statement is provided,
0N/Awill send updates to the master server of the correct zone.
0N/AThe MNAME field of that zone's SOA record will identify the master
0N/Aserver for that zone.
0N/Ais the port number on
0N/Awhere the dynamic update requests get sent.
0N/AIf no port number is specified, the default DNS port number of 53 is
0N/A> {address} [port]</
P 0N/A>Sends all dynamic update requests using the local
0N/AWhen no local statement is provided,
0N/Awill send updates using an address and port chosen by the system.
6278N/Acan additionally be used to make requests come from a specific port.
0N/AIf no port number is specified, the system will assign one. </
P 0N/A>Specifies that all updates are to be made to the zone
0N/Astatement is provided,
0N/Awill attempt determine the correct zone to update based on the rest of the input.</
P 0N/A>Specify the default class.
0N/A> is specified the default class is
0N/A>Specifies that all updates are to be TSIG signed using the
0N/Aoverrides any key specified on the command line via
0N/A>Requires that no resource record of any type exists with name
0N/Aexists (has as at least one resource record, of any type).</
P 0N/A> {domain-name} [class] {type}</
P 0N/A>Requires that no resource record exists of the specified
0N/Ais omitted, IN (internet) is assumed.</
P 0N/A> {domain-name} [class] {type}</
P 0N/A>This requires that a resource record of the specified
0N/Ais omitted, IN (internet) is assumed.</
P 0N/A> {domain-name} [class] {type} {data...}</
P 0N/Afrom each set of prerequisites of this form
0N/Aare combined to form a set of RRs. This set of RRs must
0N/Aexactly match the set of RRs existing in the zone at the
0N/Aare written in the standard text representation of the resource record's
0N/A> {domain-name} [ttl] [class] [type [data...]]</
P 0N/A>Deletes any resource records named
0N/Ais provided, only matching resource records will be removed.
0N/AThe internet class is assumed if
28N/Ais not supplied. The
0N/Ais ignored, and is only allowed for compatibility.</
P 0N/A> {domain-name} {ttl} [class] {type} {data...}</
P 28N/A>Adds a new resource record with the specified
0N/A>Displays the current message, containing all of the prerequisites and
0N/Aupdates specified since the last send.</
P 0N/A>Sends the current message. This is equivalent to entering a blank line.</
P 0N/A>Displays the answer.</
P 0N/A>Lines beginning with a semicolon are comments and are ignored.</
P 0N/A>The examples below show how
0N/Acould be used to insert and delete resource records from the
0N/ANotice that the input in each example contains a trailing blank line so that
28N/Aa group of commands are sent as one dynamic update request to the
0N/Amaster name server for
0N/ACLASS="PROGRAMLISTING" 0N/Ait IP address 172.16.1.1 is added.
0N/AThe newly-added record has a 1 day TTL (86400 seconds)
0N/ACLASS="PROGRAMLISTING" 0N/A>The prerequisite condition gets the name server to check that there
0N/Aare no resource records of any type for
0N/AIf there are, the update request fails.
0N/AIf this name does not exist, a CNAME for it is added.
0N/AThis ensures that when the CNAME is added, it cannot conflict with the
0N/Along-standing rule in RFC1034 that a name must not exist as any other
0N/Arecord type if it exists as a CNAME.
0N/A(The rule has been updated for DNSSEC in RFC2535 to allow CNAMEs to have
0N/ARRSIG, DNSKEY and NSEC records.)</
P 0N/A>used to identify default name server</
P 0N/A>K{name}.+157.+{random}.key</
TT 0N/A>base-64 encoding of HMAC-MD5 key created by
0N/ACLASS="REFENTRYTITLE" 0N/A>K{name}.+157.+{random}.private</
TT 0N/A>base-64 encoding of HMAC-MD5 key created by
28N/ACLASS="REFENTRYTITLE" 0N/ACLASS="REFENTRYTITLE" 0N/ACLASS="REFENTRYTITLE" 28N/ACLASS="CITEREFENTRY" 0N/ACLASS="REFENTRYTITLE" 0N/ACLASS="REFENTRYTITLE" 0N/ACLASS="REFENTRYTITLE" 0N/ACLASS="REFENTRYTITLE" 0N/ACLASS="REFENTRYTITLE" 0N/ACLASS="REFENTRYTITLE" 0N/A>The TSIG key is redundantly stored in two separate files.
0N/AThis is a consequence of nsupdate using the DST library
0N/Afor its cryptographic operations, and may change in future