409N/A<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"

290N/A "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"

290N/A [<!ENTITY mdash "&#8212;">]>

290N/A

290N/A<refentry id="man.rndc.conf">

290N/A <refentryinfo>

290N/A <date>June 30, 2000</date>

290N/A </refentryinfo>

290N/A

290N/A <refmeta>

290N/A <refentrytitle><filename>rndc.conf</filename></refentrytitle>

290N/A <manvolnum>5</manvolnum>

290N/A <refmiscinfo>BIND9</refmiscinfo>

290N/A </refmeta>

290N/A

290N/A <refnamediv>

290N/A <refname><filename>rndc.conf</filename></refname>

290N/A <refpurpose>rndc configuration file</refpurpose>

290N/A </refnamediv>

290N/A

290N/A <docinfo>

290N/A <copyright>

290N/A <year>2004</year>

290N/A <year>2005</year>

290N/A <year>2007</year>

290N/A <holder>Internet Systems Consortium, Inc. ("ISC")</holder>

290N/A </copyright>

290N/A <copyright>

290N/A <year>2000</year>

290N/A <year>2001</year>

290N/A <holder>Internet Software Consortium.</holder>

290N/A </copyright>

290N/A </docinfo>

290N/A

290N/A <refsynopsisdiv>

290N/A <cmdsynopsis>

290N/A <command>rndc.conf</command>

290N/A </cmdsynopsis>

290N/A </refsynopsisdiv>

290N/A

539N/A <refsect1>

712N/A <title>DESCRIPTION</title>

712N/A <para><filename>rndc.conf</filename> is the configuration file

712N/A for <command>rndc</command>, the BIND 9 name server control

712N/A utility. This file has a similar structure and syntax to

712N/A <filename>named.conf</filename>. Statements are enclosed

712N/A in braces and terminated with a semi-colon. Clauses in

712N/A the statements are also semi-colon terminated. The usual

712N/A comment styles are supported:

712N/A </para>

712N/A <para>

712N/A C style: /* */

712N/A </para>

550N/A <para>

290N/A C++ style: // to end of line

712N/A </para>

290N/A <para>

290N/A Unix style: # to end of line

290N/A </para>

290N/A <para><filename>rndc.conf</filename> is much simpler than

290N/A <filename>named.conf</filename>. The file uses three

290N/A statements: an options statement, a server statement

290N/A and a key statement.

290N/A </para>

290N/A <para>

290N/A The <option>options</option> statement contains five clauses.

290N/A The <option>default-server</option> clause is followed by the

290N/A name or address of a name server. This host will be used when

290N/A no name server is given as an argument to

290N/A <command>rndc</command>. The <option>default-key</option>

290N/A clause is followed by the name of a key which is identified by

290N/A a <option>key</option> statement. If no

290N/A <option>keyid</option> is provided on the rndc command line,

290N/A and no <option>key</option> clause is found in a matching

290N/A <option>server</option> statement, this default key will be

290N/A used to authenticate the server's commands and responses. The

290N/A <option>default-port</option> clause is followed by the port

290N/A to connect to on the remote name server. If no

290N/A <option>port</option> option is provided on the rndc command

290N/A line, and no <option>port</option> clause is found in a

290N/A matching <option>server</option> statement, this default port

290N/A will be used to connect.

290N/A The <option>default-source-address</option> and

290N/A <option>default-source-address-v6</option> clauses which

290N/A can be used to set the IPv4 and IPv6 source addresses

290N/A respectively.

290N/A </para>

290N/A <para>

290N/A After the <option>server</option> keyword, the server

290N/A statement includes a string which is the hostname or address

290N/A for a name server. The statement has three possible clauses:

290N/A <option>key</option>, <option>port</option> and

290N/A <option>addresses</option>. The key name must match the

290N/A name of a key statement in the file. The port number

290N/A specifies the port to connect to. If an <option>addresses</option>

291N/A clause is supplied these addresses will be used instead of

290N/A the server name. Each address can take a optional port.

290N/A If an <option>source-address</option> or <option>source-address-v6</option>

290N/A of supplied then these will be used to specify the IPv4 and IPv6

290N/A source addresses respectively.

290N/A </para>

290N/A <para>

290N/A The <option>key</option> statement begins with an identifying

290N/A string, the name of the key. The statement has two clauses.

290N/A <option>algorithm</option> identifies the encryption algorithm

290N/A for <command>rndc</command> to use; currently only HMAC-MD5

290N/A is

290N/A supported. This is followed by a secret clause which contains

290N/A the base-64 encoding of the algorithm's encryption key. The

290N/A base-64 string is enclosed in double quotes.

291N/A </para>

290N/A <para>

290N/A There are two common ways to generate the base-64 string for the

290N/A secret. The BIND 9 program <command>rndc-confgen</command>

290N/A can

290N/A be used to generate a random key, or the

290N/A <command>mmencode</command> program, also known as

290N/A <command>mimencode</command>, can be used to generate a

290N/A base-64

290N/A string from known input. <command>mmencode</command> does

290N/A not

290N/A ship with BIND 9 but is available on many systems. See the

290N/A EXAMPLE section for sample command lines for each.

290N/A </para>

784N/A </refsect1>

290N/A

290N/A <refsect1>

290N/A <title>EXAMPLE</title>

290N/A

290N/A <para><programlisting>

290N/A options {

1162N/A default-server localhost;

564N/A default-key samplekey;

564N/A };

564N/A</programlisting>

564N/A </para>

564N/A <para><programlisting>

564N/A server localhost {

564N/A key samplekey;

564N/A };

290N/A</programlisting>

290N/A </para>

290N/A <para><programlisting>

1229N/A server testserver {

1229N/A key testkey;

1229N/A addresses { localhost port 5353; };

1229N/A };

290N/A</programlisting>

290N/A </para>

290N/A <para><programlisting>

290N/A key samplekey {

290N/A algorithm hmac-md5;

290N/A secret "6FMfj43Osz4lyb24OIe2iGEz9lf1llJO+lz";

290N/A };

290N/A</programlisting>

784N/A </para>

290N/A <para><programlisting>

290N/A key testkey {

290N/A algorithm hmac-md5;

290N/A secret "R3HI8P6BKw9ZwXwN3VZKuQ==";

290N/A };

290N/A </programlisting>

1162N/A </para>

564N/A

564N/A <para>

564N/A In the above example, <command>rndc</command> will by

564N/A default use

564N/A the server at localhost (127.0.0.1) and the key called samplekey.

564N/A Commands to the localhost server will use the samplekey key, which

564N/A must also be defined in the server's configuration file with the

290N/A same name and secret. The key statement indicates that samplekey

290N/A uses the HMAC-MD5 algorithm and its secret clause contains the

290N/A base-64 encoding of the HMAC-MD5 secret enclosed in double quotes.

1229N/A </para>

1229N/A <para>

1229N/A If <command>rndc -s testserver</command> is used then <command>rndc</command> will

1229N/A connect to server on localhost port 5353 using the key testkey.

290N/A </para>

290N/A <para>

290N/A To generate a random secret with <command>rndc-confgen</command>:

290N/A </para>

290N/A <para><userinput>rndc-confgen</userinput>

290N/A </para>

290N/A <para>

290N/A A complete <filename>rndc.conf</filename> file, including

290N/A the

290N/A randomly generated key, will be written to the standard

481N/A output. Commented-out <option>key</option> and

481N/A <option>controls</option> statements for

481N/A <filename>named.conf</filename> are also printed.

290N/A </para>

290N/A <para>

290N/A To generate a base-64 secret with <command>mmencode</command>:

290N/A </para>

290N/A <para><userinput>echo "known plaintext for a secret" | mmencode</userinput>

290N/A </para>

290N/A </refsect1>

290N/A

290N/A <refsect1>

290N/A <title>NAME SERVER CONFIGURATION</title>

290N/A <para>

290N/A The name server must be configured to accept rndc connections and

to recognize the key specified in the <filename>rndc.conf</filename>

file, using the controls statement in <filename>named.conf</filename>.

See the sections on the <option>controls</option> statement in the

BIND 9 Administrator Reference Manual for details.

</para>

</refsect1>

<refsect1>

<title>SEE ALSO</title>

<para><citerefentry>

<refentrytitle>rndc</refentrytitle><manvolnum>8</manvolnum>

</citerefentry>,

<citerefentry>

<refentrytitle>rndc-confgen</refentrytitle><manvolnum>8</manvolnum>

</citerefentry>,

<citerefentry>

<refentrytitle>mmencode</refentrytitle><manvolnum>1</manvolnum>

</citerefentry>,

<citetitle>BIND 9 Administrator Reference Manual</citetitle>.

</para>

</refsect1>

<refsect1>

<title>AUTHOR</title>

<para><corpauthor>Internet Systems Consortium</corpauthor>

</para>

</refsect1>

</refentry><!--