2N/A - Copyright (C) 2000, 2001 Internet Software Consortium. 2N/A - Permission to use, copy, modify, and distribute this software for any 2N/A - purpose with or without fee is hereby granted, provided that the above 2N/A - copyright notice and this permission notice appear in all copies. 2N/A - THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM 2N/A - DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL 2N/A - IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL 2N/A - INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, 2N/A - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING 2N/A - FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, 2N/A - NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION 2N/A - WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 2N/ACONTENT="Modular DocBook HTML Stylesheet Version 1.61 2N/A>nsupdate -- Dynamic DNS update utility</
DIV 2N/ACLASS="REFSYNOPSISDIV" 2N/Ais used to submit Dynamic DNS Update requests as defined in RFC2136
2N/AThis allows resource records to be added or removed from a zone
2N/Awithout manually editing the zone file.
2N/AA single update request can contain requests to add or remove more than one
2N/A>Zones that are under dynamic control via
2N/Aor a DHCP server should not be edited by hand.
2N/Aconflict with dynamic updates and cause data to be lost.</
P 2N/A>The resource records that are dynamically added or removed with
2N/Ahave to be in the same zone.
2N/ARequests are sent to the zone's master server.
2N/AThis is identified by the MNAME field of the zone's SOA record.</
P 2N/Aoperate in debug mode.
2N/AThis provides tracing information about the update requests that are
2N/Amade and the replies received from the name server.</
P 2N/A>Transaction signatures can be used to authenticate the Dynamic DNS
2N/AThese use the TSIG resource record type described in RFC2845.
2N/AThe signatures rely on a shared secret that should only be known to
2N/ACurrently, the only supported encryption algorithm for TSIG is
2N/AHMAC-MD5, which is defined in RFC 2104.
2N/AOnce other algorithms are defined for TSIG, applications will need to
2N/Aensure they select the appropriate algorithm as well as the key when
2N/Aauthenticating each other.
2N/AFor instance suitable
2N/Astatements would be added to
2N/Aso that the name server can associate the appropriate secret key
2N/Aand algorithm with the IP address of the
2N/Aclient application that will be using TSIG authentication.
2N/Aoption to provide the shared secret needed to generate a TSIG record
2N/Afor authenticating Dynamic DNS update requests.
2N/AThese options are mutually exclusive.
2N/Areads the shared secret from the file
2N/Awhose name is of the form
2N/A>K{name}.+157.+{random}.private</
TT 2N/A>K{name}.+157.+{random}.key</
TT 2N/Amust also be present. When the
2N/Aoption is used, a signature is generated from
2N/Ais the name of the key,
2N/Ais the base64 encoded shared secret.
2N/Aoption is discouraged because the shared secret is supplied as a command
2N/Aline argument in clear text.
2N/AThis may be visible in the output from
2N/ACLASS="REFENTRYTITLE" 2N/Aor in a history file maintained by the user's shell.</
P 2N/Auses UDP to send update requests to the name server.
2N/Ause a TCP connection.
2N/AThis may be preferable when a batch of update requests is made.</
P 2N/AEach command is supplied on exactly one line of input.
2N/ASome commands are for administrative purposes.
2N/AThe others are either update instructions or prerequisite checks on the
2N/Acontents of the zone.
2N/AThese checks set conditions that some name or set of
2N/Aresource records (RRset) either exists or is absent from the zone.
2N/AThese conditions must be met if the entire update request is to succeed.
2N/AUpdates will be rejected if the tests for the prerequisite conditions fail.</
P 2N/A>Every update request consists of zero or more prerequisites
2N/Aand zero or more updates.
2N/AThis allows a suitably authenticated update request to proceed if some
2N/Aspecified resource records are present or missing from the zone.
2N/AA blank input line causes the accumulated commands to be sent as one Dynamic
2N/ADNS update request to the name server.</
P 2N/A>The command formats and their meaning are as follows:
2N/A> {servername} [port]</
P 2N/A>Sends all dynamic update requests to the name server
2N/AWhen no server statement is provided,
2N/Awill send updates to the master server of the correct zone.
2N/AThe MNAME field of that zone's SOA record will identify the master
2N/Aserver for that zone.
2N/Ais the port number on
2N/Awhere the dynamic update requests get sent.
2N/AIf no port number is specified, the default DNS port number of 53 is
2N/A> {address} [port]</
P 2N/A>Sends all dynamic update requests using the local
2N/AWhen no local statement is provided,
2N/Awill send updates using an address and port choosen by the system.
2N/Acan additionally be used to make requests come from a specific port.
2N/AIf no port number is specified, the system will assign one. </
P 2N/A>Specifies that all updates are to be made to the zone
2N/Astatement is provided,
2N/Awill attempt determine the correct zone to update based on the rest of the input.</
P 2N/A>Requires that no resource record of any type exists with name
2N/Aexists (has as at least one resource record, of any type).</
P 2N/A> {domain-name} [class] {type}</
P 2N/A>Requires that no resource record exists of the specified
2N/Ais omitted, IN (internet) is assumed.
2N/A> {domain-name} [class] {type}</
P 2N/A>This requires that a resource record of the specified
2N/Ais omitted, IN (internet) is assumed.</
P 2N/A> {domain-name} [class] {type} {data...}</
P 2N/Afrom each set of prerequisites of this form
2N/Aare combined to form a set of RRs. This set of RRs must
2N/Aexactly match the set of RRs existing in the zone at the
2N/Aare written in the standard text representation of the resource record's
2N/A> {domain-name} [class] [type [data...]]</
P 2N/A>Deletes any resource records named
2N/Ais provided, only matching resource records will be removed.
2N/AThe internet class is assumed if
2N/A> {domain-name} {ttl} [class] {type} {data...}</
P 2N/A>Adds a new resource record with the specified
2N/A>The examples below show how
2N/Acould be used to insert and delete resource records from the
2N/ANotice that the input in each example contains a trailing blank line so that
2N/Aa group of commands are sent as one dynamic update request to the
2N/Amaster name server for
2N/ACLASS="PROGRAMLISTING" 2N/Ait IP address 172.16.1.1 is added.
2N/AThe newly-added record has a 1 day TTL (86400 seconds)
2N/ACLASS="PROGRAMLISTING" 2N/A>The prerequisite condition gets the name server to check that there
2N/Aare no resource records of any type for
2N/AIf there are, the update request fails.
2N/AIf this name does not exist, a CNAME for it is added.
2N/AThis ensures that when the CNAME is added, it cannot conflict with the
2N/Along-standing rule in RFC1034 that a name must not exist as any other
2N/Arecord type if it exists as a CNAME.
2N/A(The rule has been updated for DNSSEC in RFC2535 to allow CNAMEs to have
2N/ASIG, KEY and NXT records.)</
P 2N/A>used to identify default name server</
P 2N/A>K{name}.+157.+{random}.key</
TT 2N/A>base-64 encoding of HMAC-MD5 key created by
2N/ACLASS="REFENTRYTITLE" 2N/A>K{name}.+157.+{random}.private</
TT 2N/A>base-64 encoding of HMAC-MD5 key created by
2N/ACLASS="REFENTRYTITLE" 2N/ACLASS="REFENTRYTITLE" 2N/ACLASS="REFENTRYTITLE" 2N/ACLASS="REFENTRYTITLE" 2N/ACLASS="REFENTRYTITLE" 2N/ACLASS="REFENTRYTITLE" 2N/ACLASS="REFENTRYTITLE" 2N/ACLASS="REFENTRYTITLE" 2N/ACLASS="REFENTRYTITLE" 2N/A>The TSIG key is redundantly stored in two separate files.
2N/AThis is a consequence of nsupdate using the DST library
2N/Afor its cryptographic operations, and may change in future