nsupdate.html revision d4ef65050feac78554addf6e16a06c6e2e0bd331
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt<!--
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews - Copyright (C) 2001 Internet Software Consortium.
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt -
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt - Permission to use, copy, modify, and distribute this software for any
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt - purpose with or without fee is hereby granted, provided that the above
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt - copyright notice and this permission notice appear in all copies.
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt -
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt - THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt - DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt - IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt - INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt - FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt - NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt - WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt-->
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt<!-- $Id: nsupdate.html,v 1.3 2001/04/10 21:50:49 bwelling Exp $ -->
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt<HTML
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><HEAD
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><TITLE
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>nsupdate</TITLE
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><META
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntNAME="GENERATOR"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCONTENT="Modular DocBook HTML Stylesheet Version 1.61
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt"></HEAD
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><BODY
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="REFENTRY"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntBGCOLOR="#FFFFFF"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntTEXT="#000000"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntLINK="#0000FF"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntVLINK="#840084"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntALINK="#0000FF"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><H1
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><A
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntNAME="AEN1"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>nsupdate</A
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt></H1
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><DIV
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="REFNAMEDIV"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><A
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntNAME="AEN8"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt></A
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><H2
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>Name</H2
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>nsupdate&nbsp;--&nbsp;Dynamic DNS update utility</DIV
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><DIV
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="REFSYNOPSISDIV"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><A
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntNAME="AEN11"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt></A
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><H2
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>Synopsis</H2
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><P
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><B
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="COMMAND"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>nsupdate</B
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt> [<TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="OPTION"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>-d</TT
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews>] [<TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="OPTION"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>-y <TT
86f221492f6f6b71c1114e3edba7373aa93d906bMark AndrewsCLASS="REPLACEABLE"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><I
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>keyname:secret</I
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt></TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt></TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt> | <TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="OPTION"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>-k <TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="REPLACEABLE"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><I
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>keyfile</I
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt></TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt></TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>] [<TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="OPTION"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>-v</TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>] [filename]</P
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt></DIV
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews><DIV
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="REFSECT1"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><A
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntNAME="AEN26"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt></A
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><H2
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>DESCRIPTION</H2
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews><P
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><B
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="COMMAND"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>nsupdate</B
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntis used to submit Dynamic DNS Update requests as defined in RFC2136
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntto a name server.
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntThis allows resource records to be added or removed from a zone
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntwithout manually editing the zone file.
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntA single update request can contain requests to add or remove more than one
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntresource record.</P
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><P
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>Zones that are under dynamic control via
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt<B
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="COMMAND"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>nsupdate</B
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews>
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntor a DHCP server should not be edited by hand.
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntManual edits could
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntconflict with dynamic updates and cause data to be lost.</P
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><P
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>The resource records that are dynamically added or removed with
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt<B
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="COMMAND"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>nsupdate</B
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunthave to be in the same zone.
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntRequests are sent to the zone's master server.
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntThis is identified by the MNAME field of the zone's SOA record.</P
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><P
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>The
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt<TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="OPTION"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>-d</TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntoption makes
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt<B
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="COMMAND"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>nsupdate</B
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntoperate in debug mode.
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntThis provides tracing information about the update requests that are
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntmade and the replies received from the name server.</P
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><P
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>Transaction signatures can be used to authenticate the Dynamic DNS
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntupdates.
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntThese use the TSIG resource record type described in RFC2845.
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntThe signatures rely on a shared secret that should only be known to
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt<B
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="COMMAND"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>nsupdate</B
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrewsand the name server.
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCurrently, the only supported encryption algorithm for TSIG is
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntHMAC-MD5, which is defined in RFC 2104.
86f221492f6f6b71c1114e3edba7373aa93d906bMark AndrewsOnce other algorithms are defined for TSIG, applications will need to
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrewsensure they select the appropriate algorithm as well as the key when
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrewsauthenticating each other.
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntFor instance suitable
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt<SPAN
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="TYPE"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>key</SPAN
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrewsand
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt<SPAN
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="TYPE"
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews>server</SPAN
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews>
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntstatements would be added to
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt<TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="FILENAME"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>/etc/named.conf</TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrewsso that the name server can associate the appropriate secret key
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntand algorithm with the IP address of the
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntclient application that will be using TSIG authentication.
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews<B
86f221492f6f6b71c1114e3edba7373aa93d906bMark AndrewsCLASS="COMMAND"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>nsupdate</B
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntdoes not read
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt<TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="FILENAME"
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews>/etc/named.conf</TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>.</P
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><P
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews><B
86f221492f6f6b71c1114e3edba7373aa93d906bMark AndrewsCLASS="COMMAND"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>nsupdate</B
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntuses the
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt<TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="OPTION"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>-y</TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntor
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt<TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="OPTION"
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews>-k</TT
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews>
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrewsoption to provide the shared secret needed to generate a TSIG record
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrewsfor authenticating Dynamic DNS update requests.
86f221492f6f6b71c1114e3edba7373aa93d906bMark AndrewsThese options are mutually exclusive.
86f221492f6f6b71c1114e3edba7373aa93d906bMark AndrewsWith the
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews<TT
86f221492f6f6b71c1114e3edba7373aa93d906bMark AndrewsCLASS="OPTION"
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews>-k</TT
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews>
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrewsoption,
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt<B
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="COMMAND"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>nsupdate</B
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntreads the shared secret from the file
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt<TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="PARAMETER"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><I
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>keyfile</I
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt></TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>,
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntwhose name is of the form
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt<TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="FILENAME"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>K{name}.+157.+{random}.private</TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>.
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntFor historical
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntreasons, the file
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt<TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="FILENAME"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>K{name}.+157.+{random}.key</TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntmust also be present. When the
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt<TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="OPTION"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>-y</TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntoption is used, a signature is generated from
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt<TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="PARAMETER"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><I
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>keyname:secret.</I
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt></TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt<TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="PARAMETER"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><I
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>keyname</I
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt></TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntis the name of the key,
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntand
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt<TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="PARAMETER"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><I
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews>secret</I
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt></TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntis the base64 encoded shared secret.
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntUse of the
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt<TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="OPTION"
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews>-y</TT
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews>
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntoption is discouraged because the shared secret is supplied as a command
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntline argument in clear text.
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntThis may be visible in the output from
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews<SPAN
86f221492f6f6b71c1114e3edba7373aa93d906bMark AndrewsCLASS="CITEREFENTRY"
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews><SPAN
86f221492f6f6b71c1114e3edba7373aa93d906bMark AndrewsCLASS="REFENTRYTITLE"
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews>ps</SPAN
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews>(1)</SPAN
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews>
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntor in a history file maintained by the user's shell.</P
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><P
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>By default
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt<B
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="COMMAND"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>nsupdate</B
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews>
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntuses UDP to send update requests to the name server.
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntThe
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews<TT
86f221492f6f6b71c1114e3edba7373aa93d906bMark AndrewsCLASS="OPTION"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>-v</TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntoption makes
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews<B
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="COMMAND"
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews>nsupdate</B
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews>
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrewsuse a TCP connection.
86f221492f6f6b71c1114e3edba7373aa93d906bMark AndrewsThis may be preferable when a batch of update requests is made.</P
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews></DIV
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews><DIV
86f221492f6f6b71c1114e3edba7373aa93d906bMark AndrewsCLASS="REFSECT1"
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews><A
86f221492f6f6b71c1114e3edba7373aa93d906bMark AndrewsNAME="AEN65"
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews></A
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews><H2
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews>INPUT FORMAT</H2
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><P
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><B
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="COMMAND"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>nsupdate</B
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntreads input from
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews<TT
86f221492f6f6b71c1114e3edba7373aa93d906bMark AndrewsCLASS="PARAMETER"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><I
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>filename</I
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews></TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntor standard input.
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntEach command is supplied on exactly one line of input.
86f221492f6f6b71c1114e3edba7373aa93d906bMark AndrewsSome commands are for administrative purposes.
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntThe others are either update instructions or prerequisite checks on the
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrewscontents of the zone.
86f221492f6f6b71c1114e3edba7373aa93d906bMark AndrewsThese checks set conditions that some name or set of
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntresource records (RRset) either exists or is absent from the zone.
86f221492f6f6b71c1114e3edba7373aa93d906bMark AndrewsThese conditions must be met if the entire update request is to succeed.
86f221492f6f6b71c1114e3edba7373aa93d906bMark AndrewsUpdates will be rejected if the tests for the prerequisite conditions fail.</P
86f221492f6f6b71c1114e3edba7373aa93d906bMark Andrews><P
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>Every update request consists of zero or more prerequisites
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntand zero or more updates.
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntThis allows a suitably authenticated update request to proceed if some
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntspecified resource records are present or missing from the zone.
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntA blank input line causes the accumulated commands to be sent as one Dynamic
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntDNS update request to the name server.</P
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><P
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>The command formats and their meaning are as follows:
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt<P
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt></P
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><DIV
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="VARIABLELIST"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><DL
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><DT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><P
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><B
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="COMMAND"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>server</B
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt> {servername} [port]</P
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt></DT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><DD
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><P
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>Sends all dynamic update requests to the name server
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt<TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="PARAMETER"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><I
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>servername</I
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt></TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>.
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntWhen no server statement is provided,
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt<B
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="COMMAND"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>nsupdate</B
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntwill send updates to the master server of the correct zone.
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntThe MNAME field of that zone's SOA record will identify the master
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntserver for that zone.
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt<TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="PARAMETER"
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt><I
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>port</I
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt></TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt>
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Huntis the port number on
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan Hunt<TT
f6096b958c8b58c4709860d7c4dcdde5deeacb7aEvan HuntCLASS="PARAMETER"
><I
>servername</I
></TT
>
where the dynamic update requests get sent.
If no port number is specified, the default DNS port number of 53 is
used.</P
></DD
><DT
><P
><B
CLASS="COMMAND"
>local</B
> {address} [port]</P
></DT
><DD
><P
>Sends all dynamic update requests using the local
<TT
CLASS="PARAMETER"
><I
>address</I
></TT
>.
When no local statement is provided,
<B
CLASS="COMMAND"
>nsupdate</B
>
will send updates using an address and port choosen by the system.
<TT
CLASS="PARAMETER"
><I
>port</I
></TT
>
can additionally be used to make requests come from a specific port.
If no port number is specified, the system will assign one.&#13;</P
></DD
><DT
><P
><B
CLASS="COMMAND"
>zone</B
> {zonename}</P
></DT
><DD
><P
>Specifies that all updates are to be made to the zone
<TT
CLASS="PARAMETER"
><I
>zonename</I
></TT
>.
If no
<TT
CLASS="PARAMETER"
><I
>zone</I
></TT
>
statement is provided,
<B
CLASS="COMMAND"
>nsupdate</B
>
will attempt determine the correct zone to update based on the rest of the input.</P
></DD
><DT
><P
><B
CLASS="COMMAND"
>prereq nxdomain</B
> {domain-name}</P
></DT
><DD
><P
>Requires that no resource record of any type exists with name
<TT
CLASS="PARAMETER"
><I
>domain-name</I
></TT
>.</P
></DD
><DT
><P
><B
CLASS="COMMAND"
>prereq yxdomain</B
> {domain-name}</P
></DT
><DD
><P
>Requires that
<TT
CLASS="PARAMETER"
><I
>domain-name</I
></TT
>
exists (has as at least one resource record, of any type).</P
></DD
><DT
><P
><B
CLASS="COMMAND"
>prereq nxrrset</B
> {domain-name} [class] {type}</P
></DT
><DD
><P
>Requires that no resource record exists of the specified
<TT
CLASS="PARAMETER"
><I
>type</I
></TT
>,
<TT
CLASS="PARAMETER"
><I
>class</I
></TT
>
and
<TT
CLASS="PARAMETER"
><I
>domain-name</I
></TT
>.
If
<TT
CLASS="PARAMETER"
><I
>class</I
></TT
>
is omitted, IN (internet) is assumed.
&#13;</P
></DD
><DT
><P
><B
CLASS="COMMAND"
>prereq yxrrset</B
> {domain-name} [class] {type}</P
></DT
><DD
><P
>This requires that a resource record of the specified
<TT
CLASS="PARAMETER"
><I
>type</I
></TT
>,
<TT
CLASS="PARAMETER"
><I
>class</I
></TT
>
and
<TT
CLASS="PARAMETER"
><I
>domain-name</I
></TT
>
must exist.
If
<TT
CLASS="PARAMETER"
><I
>class</I
></TT
>
is omitted, IN (internet) is assumed.</P
></DD
><DT
><P
><B
CLASS="COMMAND"
>prereq yxrrset</B
> {domain-name} [class] {type} {data...}</P
></DT
><DD
><P
>The
<TT
CLASS="PARAMETER"
><I
>data</I
></TT
>
from each set of prerequisites of this form
sharing a common
<TT
CLASS="PARAMETER"
><I
>type</I
></TT
>,
<TT
CLASS="PARAMETER"
><I
>class</I
></TT
>,
and
<TT
CLASS="PARAMETER"
><I
>domain-name</I
></TT
>
are combined to form a set of RRs. This set of RRs must
exactly match the set of RRs existing in the zone at the
given
<TT
CLASS="PARAMETER"
><I
>type</I
></TT
>,
<TT
CLASS="PARAMETER"
><I
>class</I
></TT
>,
and
<TT
CLASS="PARAMETER"
><I
>domain-name</I
></TT
>.
The
<TT
CLASS="PARAMETER"
><I
>data</I
></TT
>
are written in the standard text representation of the resource record's
RDATA.</P
></DD
><DT
><P
><B
CLASS="COMMAND"
>update delete</B
> {domain-name} [ttl] [class] [type [data...]]</P
></DT
><DD
><P
>Deletes any resource records named
<TT
CLASS="PARAMETER"
><I
>domain-name</I
></TT
>.
If
<TT
CLASS="PARAMETER"
><I
>type</I
></TT
>
and
<TT
CLASS="PARAMETER"
><I
>data</I
></TT
>
is provided, only matching resource records will be removed.
The internet class is assumed if
<TT
CLASS="PARAMETER"
><I
>class</I
></TT
>
is not supplied. The
<TT
CLASS="PARAMETER"
><I
>ttl</I
></TT
>
is ignored, and is only allowed for compatibility.</P
></DD
><DT
><P
><B
CLASS="COMMAND"
>update add</B
> {domain-name} {ttl} [class] {type} {data...}</P
></DT
><DD
><P
>Adds a new resource record with the specified
<TT
CLASS="PARAMETER"
><I
>ttl</I
></TT
>,
<TT
CLASS="PARAMETER"
><I
>class</I
></TT
>
and
<TT
CLASS="PARAMETER"
><I
>data</I
></TT
>.</P
></DD
></DL
></DIV
>&#13;</P
><P
>Lines beginning with a semicolon are comments, and are ignored.</P
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN197"
></A
><H2
>EXAMPLES</H2
><P
>The examples below show how
<B
CLASS="COMMAND"
>nsupdate</B
>
could be used to insert and delete resource records from the
<SPAN
CLASS="TYPE"
>example.com</SPAN
>
zone.
Notice that the input in each example contains a trailing blank line so that
a group of commands are sent as one dynamic update request to the
master name server for
<SPAN
CLASS="TYPE"
>example.com</SPAN
>.
<PRE
CLASS="PROGRAMLISTING"
># nsupdate
&#62; update delete oldhost.example.com A
&#62; update add newhost.example.com 86400 A 172.16.1.1
&#62;</PRE
></P
><P
>Any A records for
<SPAN
CLASS="TYPE"
>oldhost.example.com</SPAN
>
are deleted.
and an A record for
<SPAN
CLASS="TYPE"
>newhost.example.com</SPAN
>
it IP address 172.16.1.1 is added.
The newly-added record has a 1 day TTL (86400 seconds)
<PRE
CLASS="PROGRAMLISTING"
># nsupdate
&#62; prereq nxdomain nickname.example.com
&#62; update add nickname.example.com CNAME somehost.example.com
&#62;</PRE
></P
><P
>The prerequisite condition gets the name server to check that there
are no resource records of any type for
<SPAN
CLASS="TYPE"
>nickname.example.com</SPAN
>.
If there are, the update request fails.
If this name does not exist, a CNAME for it is added.
This ensures that when the CNAME is added, it cannot conflict with the
long-standing rule in RFC1034 that a name must not exist as any other
record type if it exists as a CNAME.
(The rule has been updated for DNSSEC in RFC2535 to allow CNAMEs to have
SIG, KEY and NXT records.)</P
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN210"
></A
><H2
>FILES</H2
><P
></P
><DIV
CLASS="VARIABLELIST"
><DL
><DT
><TT
CLASS="CONSTANT"
>/etc/resolv.conf</TT
></DT
><DD
><P
>used to identify default name server</P
></DD
><DT
><TT
CLASS="CONSTANT"
>K{name}.+157.+{random}.key</TT
></DT
><DD
><P
>base-64 encoding of HMAC-MD5 key created by
<SPAN
CLASS="CITEREFENTRY"
><SPAN
CLASS="REFENTRYTITLE"
>dnssec-keygen</SPAN
>(8)</SPAN
>.</P
></DD
><DT
><TT
CLASS="CONSTANT"
>K{name}.+157.+{random}.private</TT
></DT
><DD
><P
>base-64 encoding of HMAC-MD5 key created by
<SPAN
CLASS="CITEREFENTRY"
><SPAN
CLASS="REFENTRYTITLE"
>dnssec-keygen</SPAN
>(8)</SPAN
>.</P
></DD
></DL
></DIV
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN234"
></A
><H2
>SEE ALSO</H2
><P
><SPAN
CLASS="CITEREFENTRY"
><SPAN
CLASS="REFENTRYTITLE"
>RFC2136</SPAN
></SPAN
>,
<SPAN
CLASS="CITEREFENTRY"
><SPAN
CLASS="REFENTRYTITLE"
>RFC2137</SPAN
></SPAN
>,
<SPAN
CLASS="CITEREFENTRY"
><SPAN
CLASS="REFENTRYTITLE"
>RFC2104</SPAN
></SPAN
>,
<SPAN
CLASS="CITEREFENTRY"
><SPAN
CLASS="REFENTRYTITLE"
>RFC2845</SPAN
></SPAN
>,
<SPAN
CLASS="CITEREFENTRY"
><SPAN
CLASS="REFENTRYTITLE"
>RFC1034</SPAN
></SPAN
>,
<SPAN
CLASS="CITEREFENTRY"
><SPAN
CLASS="REFENTRYTITLE"
>RFC2535</SPAN
></SPAN
>,
<SPAN
CLASS="CITEREFENTRY"
><SPAN
CLASS="REFENTRYTITLE"
>named</SPAN
>(8)</SPAN
>,
<SPAN
CLASS="CITEREFENTRY"
><SPAN
CLASS="REFENTRYTITLE"
>dnssec-keygen</SPAN
>(8)</SPAN
>.&#13;</P
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN255"
></A
><H2
>BUGS</H2
><P
>The TSIG key is redundantly stored in two separate files.
This is a consequence of nsupdate using the DST library
for its cryptographic operations, and may change in future
releases.</P
></DIV
></BODY
></HTML
>