Bv9ARM.ch03.html revision 5347c0fcb04eaea19d9f39795646239f487c6207
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen - Copyright (C) 2000-2015 Internet Systems Consortium, Inc. ("ISC")
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen - This Source Code Form is subject to the terms of the Mozilla Public
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen - License, v. 2.0. If a copy of the MPL was not distributed with this
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen - file, You can obtain one at http://mozilla.org/MPL/2.0/.
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<title>Chapter�3.�Name Server Configuration</title>
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<link rel="prev" href="Bv9ARM.ch02.html" title="Chapter�2.�BIND Resource Requirements">
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<link rel="next" href="Bv9ARM.ch04.html" title="Chapter�4.�Advanced DNS Features">
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<table width="100%" summary="Navigation header">
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<tr><th colspan="3" align="center">Chapter�3.�Name Server Configuration</th></tr>
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<a accesskey="p" href="Bv9ARM.ch02.html">Prev</a>�</td>
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch04.html">Next</a>
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<div class="titlepage"><div><div><h1 class="title">
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<a name="Bv9ARM.ch03"></a>Chapter�3.�Name Server Configuration</h1></div></div></div>
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<dt><span class="section"><a href="Bv9ARM.ch03.html#sample_configuration">Sample Configurations</a></span></dt>
dc259399a453b68811a9c62fcf739b8e77e3fbe8Tycho Andersen<dt><span class="section"><a href="Bv9ARM.ch03.html#cache_only_sample">A Caching-only Name Server</a></span></dt>
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<dt><span class="section"><a href="Bv9ARM.ch03.html#auth_only_sample">An Authoritative-only Name Server</a></span></dt>
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<dt><span class="section"><a href="Bv9ARM.ch03.html#load_balancing">Load Balancing</a></span></dt>
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<dt><span class="section"><a href="Bv9ARM.ch03.html#ns_operations">Name Server Operations</a></span></dt>
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<dt><span class="section"><a href="Bv9ARM.ch03.html#tools">Tools for Use With the Name Server Daemon</a></span></dt>
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<dt><span class="section"><a href="Bv9ARM.ch03.html#signals">Signals</a></span></dt>
73d467522b29983a4c0e1d806a460432870ac5ffTycho Andersen In this chapter we provide some suggested configurations along
2fdca63d45448ffaa602e696865e456744fc0752Adrian Reber with guidelines for their use. We suggest reasonable values for
2fdca63d45448ffaa602e696865e456744fc0752Adrian Reber certain option settings.
73d467522b29983a4c0e1d806a460432870ac5ffTycho Andersen<div class="titlepage"><div><div><h2 class="title" style="clear: both">
73d467522b29983a4c0e1d806a460432870ac5ffTycho Andersen<a name="sample_configuration"></a>Sample Configurations</h2></div></div></div>
73d467522b29983a4c0e1d806a460432870ac5ffTycho Andersen<div class="titlepage"><div><div><h3 class="title">
9d928ec50fd75f7f392c7978395ec755650587f3Tycho Andersen<a name="cache_only_sample"></a>A Caching-only Name Server</h3></div></div></div>
73d467522b29983a4c0e1d806a460432870ac5ffTycho Andersen The following sample configuration is appropriate for a caching-only
73d467522b29983a4c0e1d806a460432870ac5ffTycho Andersen name server for use by clients internal to a corporation. All
73d467522b29983a4c0e1d806a460432870ac5ffTycho Andersen from outside clients are refused using the <span class="command"><strong>allow-query</strong></span>
73d467522b29983a4c0e1d806a460432870ac5ffTycho Andersen option. Alternatively, the same effect could be achieved using
73d467522b29983a4c0e1d806a460432870ac5ffTycho Andersen firewall rules.
73d467522b29983a4c0e1d806a460432870ac5ffTycho Andersen// Two corporate subnets we wish to allow queries from.
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersenacl corpnets { 192.168.4.0/24; 192.168.7.0/24; };
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen // Working directory
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen allow-query { corpnets; };
2fdca63d45448ffaa602e696865e456744fc0752Adrian Reber// Provide a reverse mapping for the loopback
2fdca63d45448ffaa602e696865e456744fc0752Adrian Reber// address 127.0.0.1
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen<div class="titlepage"><div><div><h3 class="title">
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen<a name="auth_only_sample"></a>An Authoritative-only Name Server</h3></div></div></div>
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen This sample configuration is for an authoritative-only server
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen that is the master server for "<code class="filename">example.com</code>"
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen and a slave for the subdomain "<code class="filename">eng.example.com</code>".
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen // Working directory
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen // Do not allow access to cache
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen allow-query-cache { none; };
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen // This is the default
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen allow-query { any; };
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen // Do not provide recursive service
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen recursion no;
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen// Provide a reverse mapping for the loopback
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen// address 127.0.0.1
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen// We are the master server for example.com
9451eeffb0688b801034d963c455c8b31ccbf28cTycho Andersen // IP addresses of slave servers allowed to
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen allow-transfer {
c6c37c20326c7fcd8a2f072263188cc84c403955Tycho Andersen 192.168.4.14;
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen 192.168.5.53;
a17fa3c081a2a2e2ec692ed8decaf54470d05dceNiklas Eiling// We are a slave server for eng.example.com
e9195050b4abd0bc4c207457cb2f1f161b583fc8Tycho Andersen // IP address of eng.example.com master server
e9195050b4abd0bc4c207457cb2f1f161b583fc8Tycho Andersen masters { 192.168.4.12; };
e9195050b4abd0bc4c207457cb2f1f161b583fc8Tycho Andersen<div class="titlepage"><div><div><h2 class="title" style="clear: both">
e9195050b4abd0bc4c207457cb2f1f161b583fc8Tycho Andersen<a name="load_balancing"></a>Load Balancing</h2></div></div></div>
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen A primitive form of load balancing can be achieved in
c6c37c20326c7fcd8a2f072263188cc84c403955Tycho Andersen the <acronym class="acronym">DNS</acronym> by using multiple records
9179d21a5df6d41770df2aa67653722596ab079eTycho Andersen (such as multiple A records) for one name.
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen For example, if you have three WWW servers with network addresses
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen of 10.0.0.1, 10.0.0.2 and 10.0.0.3, a set of records such as the
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen following means that clients will connect to each machine one third
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen Resource Record (RR) Data
dc259399a453b68811a9c62fcf739b8e77e3fbe8Tycho Andersen When a resolver queries for these records, <acronym class="acronym">BIND</acronym> will rotate
dc259399a453b68811a9c62fcf739b8e77e3fbe8Tycho Andersen them and respond to the query with the records in a different
dc259399a453b68811a9c62fcf739b8e77e3fbe8Tycho Andersen order. In the example above, clients will randomly receive
dc259399a453b68811a9c62fcf739b8e77e3fbe8Tycho Andersen records in the order 1, 2, 3; 2, 3, 1; and 3, 1, 2. Most clients
dc259399a453b68811a9c62fcf739b8e77e3fbe8Tycho Andersen will use the first record returned and discard the rest.
2fdca63d45448ffaa602e696865e456744fc0752Adrian Reber For more detail on ordering responses, check the
2fdca63d45448ffaa602e696865e456744fc0752Adrian Reber <span class="command"><strong>rrset-order</strong></span> sub-statement in the
dc259399a453b68811a9c62fcf739b8e77e3fbe8Tycho Andersen <span class="command"><strong>options</strong></span> statement, see
dc259399a453b68811a9c62fcf739b8e77e3fbe8Tycho Andersen <a class="xref" href="Bv9ARM.ch06.html#rrset_ordering" title="RRset Ordering">RRset Ordering</a>.
36d2096cf43340701150778d5547ec4f5a127338Tycho Andersen<div class="titlepage"><div><div><h2 class="title" style="clear: both">
36d2096cf43340701150778d5547ec4f5a127338Tycho Andersen<a name="ns_operations"></a>Name Server Operations</h2></div></div></div>
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen<div class="titlepage"><div><div><h3 class="title">
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen<a name="tools"></a>Tools for Use With the Name Server Daemon</h3></div></div></div>
9d928ec50fd75f7f392c7978395ec755650587f3Tycho Andersen This section describes several indispensable diagnostic,
aef3d51e61d8e65f31201e4a60eb4102ce5b4385Tycho Andersen administrative and monitoring tools available to the system
9d928ec50fd75f7f392c7978395ec755650587f3Tycho Andersen administrator for controlling and debugging the name server
74eb576cef2f775ed77d2a7909057b1a09540065Niklas Eiling<div class="titlepage"><div><div><h4 class="title">
74eb576cef2f775ed77d2a7909057b1a09540065Niklas Eiling<a name="diagnostic_tools"></a>Diagnostic Tools</h4></div></div></div>
74eb576cef2f775ed77d2a7909057b1a09540065Niklas Eiling The <span class="command"><strong>dig</strong></span>, <span class="command"><strong>host</strong></span>, and
9d928ec50fd75f7f392c7978395ec755650587f3Tycho Andersen <span class="command"><strong>nslookup</strong></span> programs are all command
aef3d51e61d8e65f31201e4a60eb4102ce5b4385Tycho Andersen for manually querying name servers. They differ in style and
c6c37c20326c7fcd8a2f072263188cc84c403955Tycho Andersen output format.
c6c37c20326c7fcd8a2f072263188cc84c403955Tycho Andersen<div class="variablelist"><dl class="variablelist">
aef3d51e61d8e65f31201e4a60eb4102ce5b4385Tycho Andersen<dt><span class="term"><a name="dig"></a><span class="command"><strong>dig</strong></span></span></dt>
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen The domain information groper (<span class="command"><strong>dig</strong></span>)
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen is the most versatile and complete of these lookup tools.
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen It has two modes: simple interactive
13389b2963692a51162c703d8a64a79542b18949Tycho Andersen mode for a single query, and batch mode which executes a
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen each in a list of several query lines. All query options are
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen from the command line.
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<div class="cmdsynopsis"><p><code class="command">dig</code> [@<em class="replaceable"><code>server</code></em>] <em class="replaceable"><code>domain</code></em> [<em class="replaceable"><code>query-type</code></em>] [<em class="replaceable"><code>query-class</code></em>] [+<em class="replaceable"><code>query-option</code></em>] [-<em class="replaceable"><code>dig-option</code></em>] [%<em class="replaceable"><code>comment</code></em>]</p></div>
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen The usual simple use of <span class="command"><strong>dig</strong></span> will take the form
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen <span class="command"><strong>dig @server domain query-type query-class</strong></span>
97e4f1a91f39fa3b4012eedf8f4e56f419dd2ccaTycho Andersen For more information and a list of available commands and
97e4f1a91f39fa3b4012eedf8f4e56f419dd2ccaTycho Andersen options, see the <span class="command"><strong>dig</strong></span> man
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen<dt><span class="term"><span class="command"><strong>host</strong></span></span></dt>
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen The <span class="command"><strong>host</strong></span> utility emphasizes
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen and ease of use. By default, it converts
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen between host names and Internet addresses, but its
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen functionality
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen can be extended with the use of options.
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen<div class="cmdsynopsis"><p><code class="command">host</code> [-aCdlnrsTwv] [-c <em class="replaceable"><code>class</code></em>] [-N <em class="replaceable"><code>ndots</code></em>] [-t <em class="replaceable"><code>type</code></em>] [-W <em class="replaceable"><code>timeout</code></em>] [-R <em class="replaceable"><code>retries</code></em>] [-m <em class="replaceable"><code>flag</code></em>] [-4] [-6] <em class="replaceable"><code>hostname</code></em> [<em class="replaceable"><code>server</code></em>]</p></div>
4b54788e85a4e2f423133354f8141ed02f795d71Tycho Andersen For more information and a list of available commands and
13389b2963692a51162c703d8a64a79542b18949Tycho Andersen options, see the <span class="command"><strong>host</strong></span> man
13389b2963692a51162c703d8a64a79542b18949Tycho Andersen<dt><span class="term"><span class="command"><strong>nslookup</strong></span></span></dt>
13389b2963692a51162c703d8a64a79542b18949Tycho Andersen<p><span class="command"><strong>nslookup</strong></span>
13389b2963692a51162c703d8a64a79542b18949Tycho Andersen has two modes: interactive and
13389b2963692a51162c703d8a64a79542b18949Tycho Andersen non-interactive. Interactive mode allows the user to
13389b2963692a51162c703d8a64a79542b18949Tycho Andersen query name servers for information about various
13389b2963692a51162c703d8a64a79542b18949Tycho Andersen hosts and domains or to print a list of hosts in a
13389b2963692a51162c703d8a64a79542b18949Tycho Andersen domain. Non-interactive mode is used to print just
13389b2963692a51162c703d8a64a79542b18949Tycho Andersen the name and requested information for a host or
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<div class="cmdsynopsis"><p><code class="command">nslookup</code> [-option...] [[<em class="replaceable"><code>host-to-find</code></em>] | [- [server]]]</p></div>
fa07124900989e1a2e617659093da293b583470fTycho Andersen Interactive mode is entered when no arguments are given (the
fa07124900989e1a2e617659093da293b583470fTycho Andersen default name server will be used) or when the first argument
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen hyphen (`-') and the second argument is the host name or
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen Internet address
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen of a name server.
65b20221372dec91b687091ac390fbbd789e84f6Tycho Andersen Non-interactive mode is used when the name or Internet
65b20221372dec91b687091ac390fbbd789e84f6Tycho Andersen of the host to be looked up is given as the first argument.
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen optional second argument specifies the host name or address
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen of a name server.
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen Due to its arcane user interface and frequently inconsistent
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen behavior, we do not recommend the use of <span class="command"><strong>nslookup</strong></span>.
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen Use <span class="command"><strong>dig</strong></span> instead.
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<div class="titlepage"><div><div><h4 class="title">
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<a name="admin_tools"></a>Administrative Tools</h4></div></div></div>
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen Administrative tools play an integral part in the management
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<div class="variablelist"><dl class="variablelist">
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<a name="named-checkconf"></a><span class="term"><span class="command"><strong>named-checkconf</strong></span></span>
a17fa3c081a2a2e2ec692ed8decaf54470d05dceNiklas Eiling The <span class="command"><strong>named-checkconf</strong></span> program
72a30576da6f59f7d6ef9452bae78ec1ec4feea0Niklas Eiling checks the syntax of a <code class="filename">named.conf</code> file.
72a30576da6f59f7d6ef9452bae78ec1ec4feea0Niklas Eiling<div class="cmdsynopsis"><p><code class="command">named-checkconf</code> [-jvz] [-t <em class="replaceable"><code>directory</code></em>] [<em class="replaceable"><code>filename</code></em>]</p></div>
72a30576da6f59f7d6ef9452bae78ec1ec4feea0Niklas Eiling<a name="named-checkzone"></a><span class="term"><span class="command"><strong>named-checkzone</strong></span></span>
cf4b07a5af0d27fb55f0084172d10e725f11e0bdTycho Andersen The <span class="command"><strong>named-checkzone</strong></span> program
cf4b07a5af0d27fb55f0084172d10e725f11e0bdTycho Andersen checks a master file for
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen syntax and consistency.
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<div class="cmdsynopsis"><p><code class="command">named-checkzone</code> [-djqvD] [-c <em class="replaceable"><code>class</code></em>] [-o <em class="replaceable"><code>output</code></em>] [-t <em class="replaceable"><code>directory</code></em>] [-w <em class="replaceable"><code>directory</code></em>] [-k <em class="replaceable"><code>(ignore|warn|fail)</code></em>] [-n <em class="replaceable"><code>(ignore|warn|fail)</code></em>] [-W <em class="replaceable"><code>(ignore|warn)</code></em>] <em class="replaceable"><code>zone</code></em> [<em class="replaceable"><code>filename</code></em>]</p></div>
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<a name="named-compilezone"></a><span class="term"><span class="command"><strong>named-compilezone</strong></span></span>
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen Similar to <span class="command"><strong>named-checkzone,</strong></span> but
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen it always dumps the zone content to a specified file
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen (typically in a different format).
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen<a name="rndc"></a><span class="term"><span class="command"><strong>rndc</strong></span></span>
606cd0e7d053a69166af998a2c636844e7fdb502Christian Brauner The remote name daemon control
606cd0e7d053a69166af998a2c636844e7fdb502Christian Brauner (<span class="command"><strong>rndc</strong></span>) program allows the
606cd0e7d053a69166af998a2c636844e7fdb502Christian Brauner administrator to control the operation of a name server.
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen Since <acronym class="acronym">BIND</acronym> 9.2, <span class="command"><strong>rndc</strong></span>
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen supports all the commands of the BIND 8 <span class="command"><strong>ndc</strong></span>
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen utility except <span class="command"><strong>ndc start</strong></span> and
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen <span class="command"><strong>ndc restart</strong></span>, which were also
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen not supported in <span class="command"><strong>ndc</strong></span>'s
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen channel mode.
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen If you run <span class="command"><strong>rndc</strong></span> without any
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen it will display a usage message as follows:
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen<div class="cmdsynopsis"><p><code class="command">rndc</code> [-c <em class="replaceable"><code>config</code></em>] [-s <em class="replaceable"><code>server</code></em>] [-p <em class="replaceable"><code>port</code></em>] [-y <em class="replaceable"><code>key</code></em>] <em class="replaceable"><code>command</code></em> [<em class="replaceable"><code>command</code></em>...]</p></div>
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen<p>See <a class="xref" href="man.rndc.html" title="rndc"><span class="refentrytitle"><span class="application">rndc</span></span>(8)</a> for details of
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen the available <span class="command"><strong>rndc</strong></span> commands.
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen <span class="command"><strong>rndc</strong></span> requires a configuration file,
755fa45300ba1dc5da63a1b88cec3e205172f078Tycho Andersen communication with the server is authenticated with
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen digital signatures that rely on a shared secret, and
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen there is no way to provide that secret other than with a
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen configuration file. The default location for the
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen <span class="command"><strong>rndc</strong></span> configuration file is
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen <code class="filename">/etc/rndc.conf</code>, but an
755fa45300ba1dc5da63a1b88cec3e205172f078Tycho Andersen location can be specified with the <code class="option">-c</code>
d9b32b0900cb7053d788b1b501653c7bcf5149c4Serge Hallyn option. If the configuration file is not found,
d9b32b0900cb7053d788b1b501653c7bcf5149c4Serge Hallyn <span class="command"><strong>rndc</strong></span> will also look in
d9b32b0900cb7053d788b1b501653c7bcf5149c4Serge Hallyn <code class="filename">/etc/rndc.key</code> (or whatever
755fa45300ba1dc5da63a1b88cec3e205172f078Tycho Andersen <code class="varname">sysconfdir</code> was defined when
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen the <acronym class="acronym">BIND</acronym> build was
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen The <code class="filename">rndc.key</code> file is
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen running <span class="command"><strong>rndc-confgen -a</strong></span> as
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen <a class="xref" href="Bv9ARM.ch06.html#controls_statement_definition_and_usage" title="controls Statement Definition and Usage">the section called “<span class="command"><strong>controls</strong></span> Statement Definition and
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen Usage”</a>.
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen The format of the configuration file is similar to
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen that of <code class="filename">named.conf</code>, but
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen only four statements, the <span class="command"><strong>options</strong></span>,
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen <span class="command"><strong>key</strong></span>, <span class="command"><strong>server</strong></span> and
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen <span class="command"><strong>include</strong></span>
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen statements. These statements are what associate the
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen secret keys to the servers with which they are meant to
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen be shared. The order of statements is not
606cd0e7d053a69166af998a2c636844e7fdb502Christian Brauner The <span class="command"><strong>options</strong></span> statement has
606cd0e7d053a69166af998a2c636844e7fdb502Christian Brauner three clauses:
606cd0e7d053a69166af998a2c636844e7fdb502Christian Brauner <span class="command"><strong>default-server</strong></span>, <span class="command"><strong>default-key</strong></span>,
606cd0e7d053a69166af998a2c636844e7fdb502Christian Brauner and <span class="command"><strong>default-port</strong></span>.
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen <span class="command"><strong>default-server</strong></span> takes a
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen host name or address argument and represents the server
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen be contacted if no <code class="option">-s</code>
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen option is provided on the command line.
606cd0e7d053a69166af998a2c636844e7fdb502Christian Brauner <span class="command"><strong>default-key</strong></span> takes
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen the name of a key as its argument, as defined by a <span class="command"><strong>key</strong></span> statement.
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen <span class="command"><strong>default-port</strong></span> specifies the
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen <span class="command"><strong>rndc</strong></span> should connect if no
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen port is given on the command line or in a
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen <span class="command"><strong>server</strong></span> statement.
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen The <span class="command"><strong>key</strong></span> statement defines a
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen key to be used
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen by <span class="command"><strong>rndc</strong></span> when authenticating
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen <span class="command"><strong>named</strong></span>. Its syntax is
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen identical to the
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen <span class="command"><strong>key</strong></span> statement in <code class="filename">named.conf</code>.
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen The keyword <strong class="userinput"><code>key</code></strong> is
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen followed by a key name, which must be a valid
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen domain name, though it need not actually be hierarchical;
606cd0e7d053a69166af998a2c636844e7fdb502Christian Brauner a string like "<strong class="userinput"><code>rndc_key</code></strong>" is a valid
606cd0e7d053a69166af998a2c636844e7fdb502Christian Brauner The <span class="command"><strong>key</strong></span> statement has two
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen <span class="command"><strong>algorithm</strong></span> and <span class="command"><strong>secret</strong></span>.
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen While the configuration parser will accept any string as the
3158ab5b9e16bb26267378bd54e113495631f8f2Tycho Andersen to algorithm, currently only the strings
606cd0e7d053a69166af998a2c636844e7fdb502Christian Brauner "<strong class="userinput"><code>hmac-md5</code></strong>",
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen "<strong class="userinput"><code>hmac-sha1</code></strong>",
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen "<strong class="userinput"><code>hmac-sha224</code></strong>",
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen "<strong class="userinput"><code>hmac-sha256</code></strong>",
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen "<strong class="userinput"><code>hmac-sha384</code></strong>"
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen and "<strong class="userinput"><code>hmac-sha512</code></strong>"
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen have any meaning. The secret is a base-64 encoded string
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen as specified in RFC 3548.
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen The <span class="command"><strong>server</strong></span> statement
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen associates a key
2fdca63d45448ffaa602e696865e456744fc0752Adrian Reber defined using the <span class="command"><strong>key</strong></span>
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen statement with a server.
8ba5ced736c4e4ca36e3f5fd36614c2682bdc9baTycho Andersen The keyword <strong class="userinput"><code>server</code></strong> is followed by a
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen host name or address. The <span class="command"><strong>server</strong></span> statement
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen has two clauses: <span class="command"><strong>key</strong></span> and <span class="command"><strong>port</strong></span>.
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen The <span class="command"><strong>key</strong></span> clause specifies the
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen name of the key
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen to be used when communicating with this server, and the
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen <span class="command"><strong>port</strong></span> clause can be used to
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen specify the port <span class="command"><strong>rndc</strong></span> should
65b20221372dec91b687091ac390fbbd789e84f6Tycho Andersen to on the server.
65b20221372dec91b687091ac390fbbd789e84f6Tycho Andersen A sample minimal configuration file is as follows:
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersenkey rndc_key {
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen algorithm "hmac-sha256";
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K";
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen default-server 127.0.0.1;
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen default-key rndc_key;
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen This file, if installed as <code class="filename">/etc/rndc.conf</code>,
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen would allow the command:
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen <code class="prompt">$ </code><strong class="userinput"><code>rndc reload</code></strong>
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen to connect to 127.0.0.1 port 953 and cause the name server
65b20221372dec91b687091ac390fbbd789e84f6Tycho Andersen to reload, if a name server on the local machine were
65b20221372dec91b687091ac390fbbd789e84f6Tycho Andersen following controls statements:
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen inet 127.0.0.1
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen allow { localhost; } keys { rndc_key; };
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen and it had an identical key statement for
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen Running the <span class="command"><strong>rndc-confgen</strong></span>
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen conveniently create a <code class="filename">rndc.conf</code>
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen file for you, and also display the
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen corresponding <span class="command"><strong>controls</strong></span>
aef3d51e61d8e65f31201e4a60eb4102ce5b4385Tycho Andersen statement that you need to
aef3d51e61d8e65f31201e4a60eb4102ce5b4385Tycho Andersen add to <code class="filename">named.conf</code>.
3e4b0221c4a5f4e815fe2fed6ccef90d8df507f0Adrian Reber Alternatively,
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen you can run <span class="command"><strong>rndc-confgen -a</strong></span>
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen a <code class="filename">rndc.key</code> file and not
3d9a5c85fd79e5d564c024063f9396b92989961aTycho Andersen <code class="filename">named.conf</code> at all.
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<div class="titlepage"><div><div><h3 class="title">
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<a name="signals"></a>Signals</h3></div></div></div>
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen Certain UNIX signals cause the name server to take specific
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen actions, as described in the following table. These signals can
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen be sent using the <span class="command"><strong>kill</strong></span> command.
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen <p><span class="command"><strong>SIGHUP</strong></span></p>
3d9a5c85fd79e5d564c024063f9396b92989961aTycho Andersen Causes the server to read <code class="filename">named.conf</code> and
3d9a5c85fd79e5d564c024063f9396b92989961aTycho Andersen reload the database.
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen <p><span class="command"><strong>SIGTERM</strong></span></p>
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen Causes the server to clean up and exit.
3d9a5c85fd79e5d564c024063f9396b92989961aTycho Andersen <p><span class="command"><strong>SIGINT</strong></span></p>
3d9a5c85fd79e5d564c024063f9396b92989961aTycho Andersen Causes the server to clean up and exit.
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<table width="100%" summary="Navigation footer">
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<a accesskey="p" href="Bv9ARM.ch02.html">Prev</a>�</td>
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<td width="40%" align="right">�<a accesskey="n" href="Bv9ARM.ch04.html">Next</a>
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<td width="40%" align="left" valign="top">Chapter�2.�<acronym class="acronym">BIND</acronym> Resource Requirements�</td>
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<td width="40%" align="right" valign="top">�Chapter�4.�Advanced DNS Features</td>
e29fe1dd21a58d1deddb3ca3bf3eaf260c525b10Tycho Andersen<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.0b2</p>