rndc.docbook revision 561a29af8c54a216e7d30b5b4f6e0d21661654ec
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
c92c50783e4e93699f2a42643b8f200b9b719c87Automatic Updater "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
75c0816e8295e180f4bc7f10db3d0d880383bc1cMark Andrews [<!ENTITY mdash "—">]>
4a14ce5ba00ab7bc55c99ffdcf59c7a4ab902721Automatic Updater - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - Copyright (C) 2000, 2001 Internet Software Consortium.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - Permission to use, copy, modify, and distribute this software for any
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - purpose with or without fee is hereby granted, provided that the above
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - copyright notice and this permission notice appear in all copies.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
ea94d370123a5892f6c47a97f21d1b28d44bb168Tinderbox User - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - PERFORMANCE OF THIS SOFTWARE.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<!-- $Id: rndc.docbook,v 1.17 2007/05/09 01:32:09 marka Exp $ -->
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <refentryinfo>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </refentryinfo>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <refentrytitle><application>rndc</application></refentrytitle>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <refnamediv>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <refname><application>rndc</application></refname>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <refpurpose>name server control utility</refpurpose>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </refnamediv>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </copyright>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </copyright>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <refsynopsisdiv>
ea94d370123a5892f6c47a97f21d1b28d44bb168Tinderbox User <cmdsynopsis>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <arg><option>-b <replaceable class="parameter">source-address</replaceable></option></arg>
ea94d370123a5892f6c47a97f21d1b28d44bb168Tinderbox User <arg><option>-c <replaceable class="parameter">config-file</replaceable></option></arg>
ea94d370123a5892f6c47a97f21d1b28d44bb168Tinderbox User <arg><option>-k <replaceable class="parameter">key-file</replaceable></option></arg>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <arg><option>-s <replaceable class="parameter">server</replaceable></option></arg>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <arg><option>-p <replaceable class="parameter">port</replaceable></option></arg>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <arg><option>-y <replaceable class="parameter">key_id</replaceable></option></arg>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </cmdsynopsis>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </refsynopsisdiv>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein controls the operation of a name
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein server. It supersedes the <command>ndc</command> utility
ea94d370123a5892f6c47a97f21d1b28d44bb168Tinderbox User that was provided in old BIND releases. If
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <command>rndc</command> is invoked with no command line
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein options or arguments, it prints a short summary of the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein supported commands and the available options and their
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein communicates with the name server
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein over a TCP connection, sending commands authenticated with
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein digital signatures. In the current versions of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <command>rndc</command> and <command>named</command> named
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the only supported authentication algorithm is HMAC-MD5,
727f5b8846457a33d06f515a10a7e1aa849ddf18Andreas Gustafsson which uses a shared secret on each end of the connection.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce This provides TSIG-style authentication for the command
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater request and the name server's response. All commands sent
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater over the channel must be signed by a key_id known to the
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater reads a configuration file to
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater determine how to contact the name server and decide what
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce algorithm and key it should use.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <variablelist>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
ea94d370123a5892f6c47a97f21d1b28d44bb168Tinderbox User <term>-b <replaceable class="parameter">source-address</replaceable></term>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Use <replaceable class="parameter">source-address</replaceable>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein as the source address for the connection to the server.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Multiple instances are permitted to allow setting of both
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the IPv4 and IPv6 source addresses.
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater </varlistentry>
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater <varlistentry>
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater <term>-c <replaceable class="parameter">config-file</replaceable></term>
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater Use <replaceable class="parameter">config-file</replaceable>
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce as the configuration file instead of the default,
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce </varlistentry>
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce <varlistentry>
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce <term>-k <replaceable class="parameter">key-file</replaceable></term>
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce Use <replaceable class="parameter">key-file</replaceable>
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce as the key file instead of the default,
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater <filename>/etc/rndc.key</filename> will be used to
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce commands sent to the server if the <replaceable class="parameter">config-file</replaceable>
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce does not exist.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce </varlistentry>
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce <varlistentry>
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce <term>-s <replaceable class="parameter">server</replaceable></term>
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce <para><replaceable class="parameter">server</replaceable> is
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce the name or address of the server which matches a
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce server statement in the configuration file for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <command>rndc</command>. If no server is supplied on
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein command line, the host named by the default-server clause
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in the option statement of the configuration file will be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
1224c3b69b3d18f7127aa042644936af25a2d679Mark Andrews <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <term>-p <replaceable class="parameter">port</replaceable></term>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Send commands to TCP port
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <replaceable class="parameter">port</replaceable>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of BIND 9's default control channel port, 953.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Enable verbose logging.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <term>-y <replaceable class="parameter">keyid</replaceable></term>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Use the key <replaceable class="parameter">keyid</replaceable>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein from the configuration file.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <replaceable class="parameter">keyid</replaceable>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein known by named with the same algorithm and secret string
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in order for control message validation to succeed.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein If no <replaceable class="parameter">keyid</replaceable>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is specified, <command>rndc</command> will first look
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for a key clause in the server statement of the server
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein being used, or if no server statement is present for that
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein host, then the default-key clause of the options statement.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Note that the configuration file contains shared secrets
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein which are used to send authenticated control commands
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to name servers. It should therefore not have general read
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein or write access.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </variablelist>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein For the complete set of commands supported by <command>rndc</command>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein see the BIND 9 Administrator Reference Manual or run
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <command>rndc</command> without arguments to see its help
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein does not yet support all the commands of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein There is currently no way to provide the shared secret for a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <option>key_id</option> without using the configuration file.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Several error messages could be clearer.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <refentrytitle>rndc.conf</refentrytitle><manvolnum>5</manvolnum>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </citerefentry>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <citerefentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <refentrytitle>named</refentrytitle><manvolnum>8</manvolnum>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </citerefentry>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <citerefentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <refentrytitle>named.conf</refentrytitle><manvolnum>5</manvolnum>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </citerefentry>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <citerefentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <refentrytitle>ndc</refentrytitle><manvolnum>8</manvolnum>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </citerefentry>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <citetitle>BIND 9 Administrator Reference Manual</citetitle>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <para><corpauthor>Internet Systems Consortium</corpauthor>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - Local variables:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - mode: sgml