Bv9ARM.ch04.html revision 0d00a726fe3c0423fab1d6876e89b69a4afe44e2
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence - Copyright (C) 2000-2003 Internet Software Consortium.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence - Permission to use, copy, modify, and/or distribute this software for any
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence - purpose with or without fee is hereby granted, provided that the above
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence - copyright notice and this permission notice appear in all copies.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence - PERFORMANCE OF THIS SOFTWARE.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<title>Chapter�4.�Advanced DNS Features</title>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
899f7f9af527d3dfe8345dcc8210d7c23fc950afDavid Lawrence<link rel="prev" href="Bv9ARM.ch03.html" title="Chapter�3.�Name Server Configuration">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<link rel="next" href="Bv9ARM.ch05.html" title="Chapter�5.�The BIND 9 Lightweight Resolver">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<table width="100%" summary="Navigation header">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<tr><th colspan="3" align="center">Chapter�4.�Advanced DNS Features</th></tr>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<a accesskey="p" href="Bv9ARM.ch03.html">Prev</a>�</td>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch05.html">Next</a>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<div class="titlepage"><div><div><h2 class="title">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<a name="Bv9ARM.ch04"></a>Chapter�4.�Advanced DNS Features</h2></div></div></div>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect1"><a href="Bv9ARM.ch04.html#notify">Notify</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect1"><a href="Bv9ARM.ch04.html#dynamic_update">Dynamic Update</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#journal">The journal file</a></span></dt></dl></dd>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect1"><a href="Bv9ARM.ch04.html#incremental_zone_transfers">Incremental Zone Transfers (IXFR)</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2569920">Split DNS</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2569938">Example split DNS setup</a></span></dt></dl></dd>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect1"><a href="Bv9ARM.ch04.html#tsig">TSIG</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2570439">Generate Shared Keys for Each Pair of Hosts</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2570581">Copying the Shared Secret to Both Machines</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2570592">Informing the Servers of the Key's Existence</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2570628">Instructing the Server to Use the Key</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2570685">TSIG Key Based Access Control</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2570734">Errors</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2570748">TKEY</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2570797">SIG(0)</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect1"><a href="Bv9ARM.ch04.html#DNSSEC">DNSSEC</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2570934">Generating Keys</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571218">Signing the Zone</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571299">Configuring Servers</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect1"><a href="Bv9ARM.ch04.html#dnssec.dynamic.zones">DNSSEC, Dynamic Zones, and Automatic Signing</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2612321">Converting from insecure to secure</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2612358">Dynamic DNS update method</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563720">Fully automatic zone signing</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563899">Private-type records</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563937">DNSKEY rollovers</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563949">Dynamic DNS update method</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2563982">Automatic key rollovers</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2564009">NSEC3PARAM rollovers via UPDATE</a></span></dt>
d409ceeda41a256e8114423674d844d5f5035ee8Bob Halley<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2564019">Converting from NSEC to NSEC3</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2573654">Converting from NSEC3 to NSEC</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2573667">Converting from secure to insecure</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2573704">Periodic re-signing</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2573714">NSEC3 and OPTOUT</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect1"><a href="Bv9ARM.ch04.html#rfc5011.support">Dynamic Trust Anchor Management</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2573810">Validating Resolver</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2573832">Authoritative Server</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect1"><a href="Bv9ARM.ch04.html#pkcs11">PKCS#11 (Cryptoki) support</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2611815">Prerequisites</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2611825">Native PKCS#11</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2612517">OpenSSL-based PKCS#11</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2639697">PKCS#11 Tools</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2639733">Using the HSM</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2640019">Specifying the engine on the command line</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2640067">Running named with automatic zone re-signing</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect1"><a href="Bv9ARM.ch04.html#dlz-info">DLZ (Dynamically Loadable Zones)</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2640200">Configuring DLZ</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2612080">Sample DLZ Driver</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571523">IPv6 Support in <acronym class="acronym">BIND</acronym> 9</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571789">Address Lookups Using AAAA Records</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571811">Address to Name Lookups Using Nibble Format</a></span></dt>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<div class="titlepage"><div><div><h2 class="title" style="clear: both">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<a name="notify"></a>Notify</h2></div></div></div>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <acronym class="acronym">DNS</acronym> NOTIFY is a mechanism that allows master
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence servers to notify their slave servers of changes to a zone's data. In
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence response to a <span><strong class="command">NOTIFY</strong></span> from a master server, the
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence slave will check to see that its version of the zone is the
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence current version and, if not, initiate a zone transfer.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence For more information about <acronym class="acronym">DNS</acronym>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <span><strong class="command">NOTIFY</strong></span>, see the description of the
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <span><strong class="command">notify</strong></span> option in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a> and
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence the description of the zone option <span><strong class="command">also-notify</strong></span> in
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>. The <span><strong class="command">NOTIFY</strong></span>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence protocol is specified in RFC 1996.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence As a slave zone can also be a master to other slaves, <span><strong class="command">named</strong></span>,
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence by default, sends <span><strong class="command">NOTIFY</strong></span> messages for every zone
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence it loads. Specifying <span><strong class="command">notify master-only;</strong></span> will
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence cause <span><strong class="command">named</strong></span> to only send <span><strong class="command">NOTIFY</strong></span> for master
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence zones that it loads.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<div class="titlepage"><div><div><h2 class="title" style="clear: both">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<a name="dynamic_update"></a>Dynamic Update</h2></div></div></div>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Dynamic Update is a method for adding, replacing or deleting
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence records in a master server by sending it a special form of DNS
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence messages. The format and meaning of these messages is specified
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Dynamic update is enabled by including an
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <span><strong class="command">allow-update</strong></span> or an <span><strong class="command">update-policy</strong></span>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence clause in the <span><strong class="command">zone</strong></span> statement.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence If the zone's <span><strong class="command">update-policy</strong></span> is set to
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <strong class="userinput"><code>local</code></strong>, updates to the zone
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence will be permitted for the key <code class="varname">local-ddns</code>,
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence which will be generated by <span><strong class="command">named</strong></span> at startup.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence See <a href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called “Dynamic Update Policies”</a> for more details.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Dynamic updates using Kerberos signed requests can be made
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence using the TKEY/GSS protocol by setting either the
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <span><strong class="command">tkey-gssapi-keytab</strong></span> option, or alternatively
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence by setting both the <span><strong class="command">tkey-gssapi-credential</strong></span>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence and <span><strong class="command">tkey-domain</strong></span> options. Once enabled,
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Kerberos signed requests will be matched against the update
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence policies for the zone, using the Kerberos principal as the
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence signer for the request.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Updating of secure zones (zones using DNSSEC) follows RFC
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence 3007: RRSIG, NSEC and NSEC3 records affected by updates are
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence automatically regenerated by the server using an online
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence zone key. Update authorization is based on transaction
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence signatures and an explicit server policy.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<div class="titlepage"><div><div><h3 class="title">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<a name="journal"></a>The journal file</h3></div></div></div>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence All changes made to a zone using dynamic update are stored
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence in the zone's journal file. This file is automatically created
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence by the server when the first dynamic update takes place.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence The name of the journal file is formed by appending the extension
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <code class="filename">.jnl</code> to the name of the
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence corresponding zone
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence file unless specifically overridden. The journal file is in a
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence binary format and should not be edited manually.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence The server will also occasionally write ("dump")
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence the complete contents of the updated zone to its zone file.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence This is not done immediately after
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence each dynamic update, because that would be too slow when a large
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence zone is updated frequently. Instead, the dump is delayed by
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence up to 15 minutes, allowing additional updates to take place.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence During the dump process, transient files will be created
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence with the extensions <code class="filename">.jnw</code> and
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <code class="filename">.jbk</code>; under ordinary circumstances, these
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence will be removed when the dump is complete, and can be safely
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence When a server is restarted after a shutdown or crash, it will replay
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence the journal file to incorporate into the zone any updates that
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence place after the last zone dump.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Changes that result from incoming incremental zone transfers are
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence journalled in a similar way.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence The zone files of dynamic zones cannot normally be edited by
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence hand because they are not guaranteed to contain the most recent
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence dynamic changes — those are only in the journal file.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence The only way to ensure that the zone file of a dynamic zone
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence is up to date is to run <span><strong class="command">rndc stop</strong></span>.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence If you have to make changes to a dynamic zone
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence manually, the following procedure will work:
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Disable dynamic updates to the zone using
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <span><strong class="command">rndc freeze <em class="replaceable"><code>zone</code></em></strong></span>.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence This will update the zone's master file with the changes
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence stored in its <code class="filename">.jnl</code> file.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Edit the zone file. Run
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <span><strong class="command">rndc thaw <em class="replaceable"><code>zone</code></em></strong></span>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence to reload the changed zone and re-enable dynamic updates.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <span><strong class="command">rndc sync <em class="replaceable"><code>zone</code></em></strong></span>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence will update the zone file with changes from the journal file
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence without stopping dynamic updates; this may be useful for viewing
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence the current zone state. To remove the <code class="filename">.jnl</code>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence file after updating the zone file, use
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <span><strong class="command">rndc sync -clean</strong></span>.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<div class="titlepage"><div><div><h2 class="title" style="clear: both">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<a name="incremental_zone_transfers"></a>Incremental Zone Transfers (IXFR)</h2></div></div></div>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence The incremental zone transfer (IXFR) protocol is a way for
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence slave servers to transfer only changed data, instead of having to
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence transfer the entire zone. The IXFR protocol is specified in RFC
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence 1995. See <a href="Bv9ARM.ch11.html#proposed_standards">Proposed Standards</a>.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence When acting as a master, <acronym class="acronym">BIND</acronym> 9
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence supports IXFR for those zones
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence where the necessary change history information is available. These
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence include master zones maintained by dynamic update and slave zones
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence whose data was obtained by IXFR. For manually maintained master
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence zones, and for slave zones obtained by performing a full zone
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence transfer (AXFR), IXFR is supported only if the option
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <span><strong class="command">ixfr-from-differences</strong></span> is set
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence to <strong class="userinput"><code>yes</code></strong>.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence When acting as a slave, <acronym class="acronym">BIND</acronym> 9 will
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence attempt to use IXFR unless
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence it is explicitly disabled. For more information about disabling
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence IXFR, see the description of the <span><strong class="command">request-ixfr</strong></span> clause
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence of the <span><strong class="command">server</strong></span> statement.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<div class="titlepage"><div><div><h2 class="title" style="clear: both">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<a name="id2569920"></a>Split DNS</h2></div></div></div>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Setting up different views, or visibility, of the DNS space to
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence internal and external resolvers is usually referred to as a
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <span class="emphasis"><em>Split DNS</em></span> setup. There are several
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence reasons an organization would want to set up its DNS this way.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence One common reason for setting up a DNS system this way is
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence to hide "internal" DNS information from "external" clients on the
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Internet. There is some debate as to whether or not this is actually
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Internal DNS information leaks out in many ways (via email headers,
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence for example) and most savvy "attackers" can find the information
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence they need using other means.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence However, since listing addresses of internal servers that
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence external clients cannot possibly reach can result in
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence connection delays and other annoyances, an organization may
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence choose to use a Split DNS to present a consistent view of itself
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence to the outside world.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Another common reason for setting up a Split DNS system is
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence to allow internal networks that are behind filters or in RFC 1918
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence space (reserved IP space, as documented in RFC 1918) to resolve DNS
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence on the Internet. Split DNS can also be used to allow mail from outside
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence back in to the internal network.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<div class="titlepage"><div><div><h3 class="title">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<a name="id2569938"></a>Example split DNS setup</h3></div></div></div>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Let's say a company named <span class="emphasis"><em>Example, Inc.</em></span>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence has several corporate sites that have an internal network with
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Internet Protocol (IP) space and an external demilitarized zone (DMZ),
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence or "outside" section of a network, that is available to the public.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <span class="emphasis"><em>Example, Inc.</em></span> wants its internal clients
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence to be able to resolve external hostnames and to exchange mail with
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence people on the outside. The company also wants its internal resolvers
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence to have access to certain internal-only zones that are not available
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence at all outside of the internal network.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence In order to accomplish this, the company will set up two sets
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence of name servers. One set will be on the inside network (in the
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence IP space) and the other set will be on bastion hosts, which are
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence hosts that can talk to both sides of its network, in the DMZ.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence The internal servers will be configured to forward all queries,
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence except queries for <code class="filename">site1.internal</code>, <code class="filename">site2.internal</code>, <code class="filename">site1.example.com</code>,
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence and <code class="filename">site2.example.com</code>, to the servers
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence DMZ. These internal servers will have complete sets of information
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence for <code class="filename">site1.example.com</code>, <code class="filename">site2.example.com</code>, <code class="filename">site1.internal</code>,
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence and <code class="filename">site2.internal</code>.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence To protect the <code class="filename">site1.internal</code> and <code class="filename">site2.internal</code> domains,
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence the internal name servers must be configured to disallow all queries
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence to these domains from any external hosts, including the bastion
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence The external servers, which are on the bastion hosts, will
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence be configured to serve the "public" version of the <code class="filename">site1</code> and <code class="filename">site2.example.com</code> zones.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence This could include things such as the host records for public servers
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence (<code class="filename">www.example.com</code> and <code class="filename">ftp.example.com</code>),
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence and mail exchange (MX) records (<code class="filename">a.mx.example.com</code> and <code class="filename">b.mx.example.com</code>).
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence In addition, the public <code class="filename">site1</code> and <code class="filename">site2.example.com</code> zones
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence should have special MX records that contain wildcard (`*') records
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence pointing to the bastion hosts. This is needed because external mail
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence servers do not have any other way of looking up how to deliver mail
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence to those internal hosts. With the wildcard records, the mail will
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence be delivered to the bastion host, which can then forward it on to
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence internal hosts.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Here's an example of a wildcard MX record:
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<pre class="programlisting">* IN MX 10 external1.example.com.</pre>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Now that they accept mail on behalf of anything in the internal
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence network, the bastion hosts will need to know how to deliver mail
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence to internal hosts. In order for this to work properly, the resolvers
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence the bastion hosts will need to be configured to point to the internal
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence name servers for DNS resolution.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Queries for internal hostnames will be answered by the internal
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence servers, and queries for external hostnames will be forwarded back
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence out to the DNS servers on the bastion hosts.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence In order for all this to work properly, internal clients will
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence need to be configured to query <span class="emphasis"><em>only</em></span> the internal
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence name servers for DNS queries. This could also be enforced via
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence filtering on the network.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence If everything has been set properly, <span class="emphasis"><em>Example, Inc.</em></span>'s
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence internal clients will now be able to:
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Look up any hostnames in the <code class="literal">site1</code>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <code class="literal">site2.example.com</code> zones.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Look up any hostnames in the <code class="literal">site1.internal</code> and
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <code class="literal">site2.internal</code> domains.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<li>Look up any hostnames on the Internet.</li>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<li>Exchange mail with both internal and external people.</li>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Hosts on the Internet will be able to:
00a1623a59b1540c28781e8ccd8341c8114dbc75David Lawrence Look up any hostnames in the <code class="literal">site1</code>
00a1623a59b1540c28781e8ccd8341c8114dbc75David Lawrence <code class="literal">site2.example.com</code> zones.
00a1623a59b1540c28781e8ccd8341c8114dbc75David Lawrence Exchange mail with anyone in the <code class="literal">site1</code> and
00a1623a59b1540c28781e8ccd8341c8114dbc75David Lawrence <code class="literal">site2.example.com</code> zones.
00a1623a59b1540c28781e8ccd8341c8114dbc75David Lawrence Here is an example configuration for the setup we just
00a1623a59b1540c28781e8ccd8341c8114dbc75David Lawrence described above. Note that this is only configuration information;
00a1623a59b1540c28781e8ccd8341c8114dbc75David Lawrence for information on how to configure your zone files, see <a href="Bv9ARM.ch03.html#sample_configuration" title="Sample Configurations">the section called “Sample Configurations”</a>.
00a1623a59b1540c28781e8ccd8341c8114dbc75David Lawrence Internal DNS server config:
00a1623a59b1540c28781e8ccd8341c8114dbc75David Lawrenceacl internals { 172.16.72.0/24; 192.168.1.0/24; };
00a1623a59b1540c28781e8ccd8341c8114dbc75David Lawrenceacl externals { <code class="varname">bastion-ips-go-here</code>; };
00a1623a59b1540c28781e8ccd8341c8114dbc75David Lawrence forward only;
00a1623a59b1540c28781e8ccd8341c8114dbc75David Lawrence // forward to external servers
00a1623a59b1540c28781e8ccd8341c8114dbc75David Lawrence <code class="varname">bastion-ips-go-here</code>;
00a1623a59b1540c28781e8ccd8341c8114dbc75David Lawrence // sample allow-transfer (no one)
00a1623a59b1540c28781e8ccd8341c8114dbc75David Lawrence allow-transfer { none; };
00a1623a59b1540c28781e8ccd8341c8114dbc75David Lawrence // restrict query access
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence allow-query { internals; externals; };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence // restrict recursion
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence allow-recursion { internals; };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence// sample master zone
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence // do normal iterative resolution (do not forward)
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence forwarders { };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence allow-query { internals; externals; };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence allow-transfer { internals; };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence// sample slave zone
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence masters { 172.16.72.3; };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence forwarders { };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence allow-query { internals; externals; };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence allow-transfer { internals; };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence forwarders { };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence allow-query { internals; };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence allow-transfer { internals; }
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence masters { 172.16.72.3; };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence forwarders { };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence allow-query { internals };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence allow-transfer { internals; }
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence External (bastion host) DNS server config:
fc80027fb54b501cdd88461bf879d078259e0226David Lawrenceacl internals { 172.16.72.0/24; 192.168.1.0/24; };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrenceacl externals { bastion-ips-go-here; };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence // sample allow-transfer (no one)
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence allow-transfer { none; };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence // default query access
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence allow-query { any; };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence // restrict cache access
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence allow-query-cache { internals; externals; };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence // restrict recursion
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence allow-recursion { internals; externals; };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence// sample slave zone
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence allow-transfer { internals; externals; };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence masters { another_bastion_host_maybe; };
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence allow-transfer { internals; externals; }
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence In the <code class="filename">resolv.conf</code> (or equivalent) on
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence the bastion host(s):
fc80027fb54b501cdd88461bf879d078259e0226David Lawrencenameserver 172.16.72.2
fc80027fb54b501cdd88461bf879d078259e0226David Lawrencenameserver 172.16.72.3
fc80027fb54b501cdd88461bf879d078259e0226David Lawrencenameserver 172.16.72.4
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<div class="titlepage"><div><div><h2 class="title" style="clear: both">
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence<a name="tsig"></a>TSIG</h2></div></div></div>
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence This is a short guide to setting up Transaction SIGnatures
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence (TSIG) based transaction security in <acronym class="acronym">BIND</acronym>. It describes changes
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence to the configuration file as well as what changes are required for
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence different features, including the process of creating transaction
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence keys and using transaction signatures with <acronym class="acronym">BIND</acronym>.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence <acronym class="acronym">BIND</acronym> primarily supports TSIG for server
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence to server communication.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence This includes zone transfer, notify, and recursive query messages.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence Resolvers based on newer versions of <acronym class="acronym">BIND</acronym> 8 have limited support
A shared secret is generated to be shared between <span class="emphasis"><em>host1</em></span> and <span class="emphasis"><em>host2</em></span>.
<strong class="userinput"><code>dnssec-keygen -a hmac-sha256 -b 128 -n HOST host1-host2.</code></strong>
Imagine <span class="emphasis"><em>host1</em></span> and <span class="emphasis"><em>host 2</em></span>
both servers. The following is added to each server's <code class="filename">named.conf</code> file:
be told when keys are to be used. The following is added to the <code class="filename">named.conf</code> file
for <span class="emphasis"><em>host1</em></span>, if the IP address of <span class="emphasis"><em>host2</em></span> is
to that address, the message will be signed with the specified key. <span class="emphasis"><em>host1</em></span> will
configuration file (with <span class="emphasis"><em>host1</em></span>'s address) for <span class="emphasis"><em>host2</em></span> to
See <a href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called “Dynamic Update Policies”</a> for a discussion of
that the tools shipped with BIND 9.2.x and earlier are not compatible
<strong class="userinput"><code>dnssec-keygen -a RSASHA1 -b 768 -n ZONE child.example.</code></strong>
<strong class="userinput"><code>yes</code></strong> or <strong class="userinput"><code>auto</code></strong>.
example.com. 257 3 5 "AwEAAaxPMcR2x0HbQV4WeZB6oEDX+r0QM6
<a name="dnssec.dynamic.zones"></a>DNSSEC, Dynamic Zones, and Automatic Signing</h2></div></div></div>
zone example.net {
> update add example.net DNSKEY 256 3 7 AwEAAZn17pUF0KpbPA2c7Gz76Vb18v0teKT3EyAGfBfL8eQ8al35zz3Y I1m/SAQBxIqMfLtIwqWPdgthsu36azGQAX8=
> update add example.net DNSKEY 257 3 7 AwEAAd/7odU/64o2LGsifbLtQmtO8dFDtTAZXSX2+X3e/UNlq9IHq3Y0 XtC0Iuawl/qkaKVxXe2lo8Ct+dM6UehyCqk=
> update add example.net DNSKEY 256 3 7 AwEAAZn17pUF0KpbPA2c7Gz76Vb18v0teKT3EyAGfBfL8eQ8al35zz3Y I1m/SAQBxIqMfLtIwqWPdgthsu36azGQAX8=
> update add example.net DNSKEY 257 3 7 AwEAAd/7odU/64o2LGsifbLtQmtO8dFDtTAZXSX2+X3e/UNlq9IHq3Y0 XtC0Iuawl/qkaKVxXe2lo8Ct+dM6UehyCqk=
> update add example.net NSEC3PARAM 1 1 100 1234567890
(See <a href="man.dnssec-keygen.html" title="dnssec-keygen"><span class="refentrytitle"><span class="application">dnssec-keygen</span></span>(8)</a> and
<a href="man.dnssec-settime.html" title="dnssec-settime"><span class="refentrytitle"><span class="application">dnssec-settime</span></span>(8)</a> for more information.)
<span><strong class="command">rndc sign</strong></span> or <span><strong class="command">rndc loadkeys</strong></span>
<span><strong class="command">dnssec-keygen</strong></span> or <span><strong class="command">dnssec-settime</strong></span>),
and Usage">the section called “<span><strong class="command">managed-keys</strong></span> Statement Definition
$ <strong class="userinput"><code>dnssec-keygen -K keys -f KSK -P now -A now+2y example.net</code></strong>
and the <span><strong class="command">dnssec-*</strong></span> and <span><strong class="command">pkcs11-*</strong></span>
<span><strong class="command">dnssec-*</strong></span> tools, or the <code class="option">-m</code> in
$ <strong class="userinput"><code> configure --with-crypto-backend=openssl --prefix=/opt/pkcs11/usr --enable-gost </code></strong>
$ <strong class="userinput"><code> /opt/pkcs11/usr/bin/softhsm-util --init-token 0 --slot 0 --label softhsmv2 </code></strong>
$ <strong class="userinput"><code>wget <a href="" target="_top">http://www.openssl.org/source/openssl-0.9.8zc.tar.gz</a></code></strong>
$ <strong class="userinput"><code>cp pkcs11.GCC4.0.2.so.4.05 /opt/pkcs11/usr/lib/libpkcs11.so</code></strong>
and "<span><strong class="command">make test</strong></span>". If "<span><strong class="command">make
$ <strong class="userinput"><code> echo "0:/opt/pkcs11/softhsm.db" > $SOFTHSM_CONF </code></strong>
$ <strong class="userinput"><code> /opt/pkcs11/usr/bin/softhsm --init-token 0 --slot 0 --label softhsm </code></strong>
$ <strong class="userinput"><code>export LD_LIBRARY_PATH=/opt/pkcs11/usr/lib:${LD_LIBRARY_PATH}</code></strong>
$ <strong class="userinput"><code>export KEYPER_LIBRARY_PATH=/opt/Keyper/PKCS11Provider</code></strong>
"sample-ksk" as the key-signing key for "example.net":
$ <strong class="userinput"><code>dnssec-keyfromlabel -l sample-ksk -f KSK example.net</code></strong>
<a href="man.dnssec-keyfromlabel.html" title="dnssec-keyfromlabel"><span class="refentrytitle"><span class="application">dnssec-keyfromlabel</span></span>(8)</a> for details.)
this is accomplished by placing the PIN into the openssl.cnf file
The location of the openssl.cnf file can be overridden by
dynamically-linkable DLZ module--i.e., one which can be
"example.nil", which can answer queries and AXFR requests, and
example.nil. 1800 IN A 10.53.0.1
e.g., by providing different address records for a particular name
<a name="id2571523"></a>IPv6 Support in <acronym class="acronym">BIND</acronym> 9</h2></div></div></div>
see <a href="Bv9ARM.ch11.html#ipv6addresses" title="IPv6 addresses (AAAA)">the section called “IPv6 addresses (AAAA)”</a>.
$ORIGIN example.com.