Bv9ARM.ch04.html revision 617639b7cc40ba9eb6fde2d98099726d50da812e
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - Copyright (C) 2000-2018 Internet Systems Consortium, Inc. ("ISC")
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - This Source Code Form is subject to the terms of the Mozilla Public
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - License, v. 2.0. If a copy of the MPL was not distributed with this
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - file, You can obtain one at http://mozilla.org/MPL/2.0/.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<link rel="prev" href="Bv9ARM.ch03.html" title="Chapter�3.�Name Server Configuration">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<link rel="next" href="Bv9ARM.ch05.html" title="Chapter�5.�The BIND 9 Lightweight Resolver">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<tr><th colspan="3" align="center">Chapter�4.�Advanced DNS Features</th></tr>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<a accesskey="p" href="Bv9ARM.ch03.html">Prev</a>�</td>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch05.html">Next</a>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<a name="Bv9ARM.ch04"></a>Chapter�4.�Advanced DNS Features</h1></div></div></div>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#notify">Notify</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#dynamic_update">Dynamic Update</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dd><dl><dt><span class="section"><a href="Bv9ARM.ch04.html#journal">The journal file</a></span></dt></dl></dd>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#incremental_zone_transfers">Incremental Zone Transfers (IXFR)</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#split_dns">Split DNS</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dd><dl><dt><span class="section"><a href="Bv9ARM.ch04.html#split_dns_sample">Example split DNS setup</a></span></dt></dl></dd>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#tsig">TSIG</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.6.5">Generating a Shared Key</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.6.6">Loading A New Key</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.6.7">Instructing the Server to Use a Key</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.6.8">TSIG-Based Access Control</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.6.9">Errors</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#tkey">TKEY</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#sig0">SIG(0)</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#DNSSEC">DNSSEC</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#dnssec_keys">Generating Keys</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#dnssec_signing">Signing the Zone</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#dnssec_config">Configuring Servers</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#dnssec.dynamic.zones">DNSSEC, Dynamic Zones, and Automatic Signing</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.10.2">Converting from insecure to secure</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.10.7">Dynamic DNS update method</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.10.15">Fully automatic zone signing</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.10.24">Private-type records</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.10.31">DNSKEY rollovers</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.10.33">Dynamic DNS update method</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.10.38">Automatic key rollovers</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.10.40">NSEC3PARAM rollovers via UPDATE</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.10.42">Converting from NSEC to NSEC3</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.10.44">Converting from NSEC3 to NSEC</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.10.46">Converting from secure to insecure</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.10.50">Periodic re-signing</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.10.52">NSEC3 and OPTOUT</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#rfc5011.support">Dynamic Trust Anchor Management</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.11.3">Validating Resolver</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.11.4">Authoritative Server</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#pkcs11">PKCS#11 (Cryptoki) support</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.12.6">Prerequisites</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.12.7">Native PKCS#11</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.12.8">OpenSSL-based PKCS#11</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.12.9">PKCS#11 Tools</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.12.10">Using the HSM</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.12.11">Specifying the engine on the command line</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.12.12">Running named with automatic zone re-signing</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#dlz-info">DLZ (Dynamically Loadable Zones)</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.13.6">Configuring DLZ</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.13.7">Sample DLZ Driver</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#dyndb-info">DynDB (Dynamic Database)</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.14.5">Configuring DynDB</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.14.6">Sample DynDB Module</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#catz-info">Catalog Zones</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.15.4">Principle of Operation</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.15.5">Configuring Catalog Zones</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.15.6">Catalog Zone format</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#ipv6">IPv6 Support in <acronym class="acronym">BIND</acronym> 9</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.16.6">Address Lookups Using AAAA Records</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<dt><span class="section"><a href="Bv9ARM.ch04.html#id-1.5.16.7">Address to Name Lookups Using Nibble Format</a></span></dt>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<div class="titlepage"><div><div><h2 class="title" style="clear: both">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <acronym class="acronym">DNS</acronym> NOTIFY is a mechanism that allows master
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync servers to notify their slave servers of changes to a zone's data. In
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync response to a <span class="command"><strong>NOTIFY</strong></span> from a master server, the
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync slave will check to see that its version of the zone is the
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync current version and, if not, initiate a zone transfer.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync For more information about <acronym class="acronym">DNS</acronym>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="command"><strong>NOTIFY</strong></span>, see the description of the
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="command"><strong>notify</strong></span> option in <a class="xref" href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a> and
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync the description of the zone option <span class="command"><strong>also-notify</strong></span> in
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <a class="xref" href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>. The <span class="command"><strong>NOTIFY</strong></span>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync protocol is specified in RFC 1996.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync As a slave zone can also be a master to other slaves, <span class="command"><strong>named</strong></span>,
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync by default, sends <span class="command"><strong>NOTIFY</strong></span> messages for every zone
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync it loads. Specifying <span class="command"><strong>notify master-only;</strong></span> will
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync cause <span class="command"><strong>named</strong></span> to only send <span class="command"><strong>NOTIFY</strong></span> for master
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync zones that it loads.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<div class="titlepage"><div><div><h2 class="title" style="clear: both">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<a name="dynamic_update"></a>Dynamic Update</h2></div></div></div>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Dynamic Update is a method for adding, replacing or deleting
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync records in a master server by sending it a special form of DNS
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync messages. The format and meaning of these messages is specified
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync in RFC 2136.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Dynamic update is enabled by including an
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="command"><strong>allow-update</strong></span> or an <span class="command"><strong>update-policy</strong></span>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync clause in the <span class="command"><strong>zone</strong></span> statement.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync If the zone's <span class="command"><strong>update-policy</strong></span> is set to
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <strong class="userinput"><code>local</code></strong>, updates to the zone
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync will be permitted for the key <code class="varname">local-ddns</code>,
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync which will be generated by <span class="command"><strong>named</strong></span> at startup.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync See <a class="xref" href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called “Dynamic Update Policies”</a> for more details.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Dynamic updates using Kerberos signed requests can be made
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="command"><strong>tkey-gssapi-keytab</strong></span> option, or alternatively
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync by setting both the <span class="command"><strong>tkey-gssapi-credential</strong></span>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync and <span class="command"><strong>tkey-domain</strong></span> options. Once enabled,
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Kerberos signed requests will be matched against the update
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync policies for the zone, using the Kerberos principal as the
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync signer for the request.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Updating of secure zones (zones using DNSSEC) follows RFC
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync 3007: RRSIG, NSEC and NSEC3 records affected by updates are
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync automatically regenerated by the server using an online
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync zone key. Update authorization is based on transaction
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync signatures and an explicit server policy.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<a name="journal"></a>The journal file</h3></div></div></div>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync All changes made to a zone using dynamic update are stored
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync in the zone's journal file. This file is automatically created
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync by the server when the first dynamic update takes place.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync The name of the journal file is formed by appending the extension
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <code class="filename">.jnl</code> to the name of the
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync corresponding zone
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync file unless specifically overridden. The journal file is in a
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync binary format and should not be edited manually.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync The server will also occasionally write ("dump")
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync the complete contents of the updated zone to its zone file.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync This is not done immediately after
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync each dynamic update, because that would be too slow when a large
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync zone is updated frequently. Instead, the dump is delayed by
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync up to 15 minutes, allowing additional updates to take place.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync During the dump process, transient files will be created
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync with the extensions <code class="filename">.jnw</code> and
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <code class="filename">.jbk</code>; under ordinary circumstances, these
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync will be removed when the dump is complete, and can be safely
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync When a server is restarted after a shutdown or crash, it will replay
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync the journal file to incorporate into the zone any updates that
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync place after the last zone dump.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Changes that result from incoming incremental zone transfers are
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync journalled in a similar way.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync The zone files of dynamic zones cannot normally be edited by
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync hand because they are not guaranteed to contain the most recent
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync dynamic changes — those are only in the journal file.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync The only way to ensure that the zone file of a dynamic zone
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync is up to date is to run <span class="command"><strong>rndc stop</strong></span>.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync If you have to make changes to a dynamic zone
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync manually, the following procedure will work:
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Disable dynamic updates to the zone using
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="command"><strong>rndc freeze <em class="replaceable"><code>zone</code></em></strong></span>.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync This will update the zone's master file with the changes
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync stored in its <code class="filename">.jnl</code> file.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Edit the zone file. Run
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="command"><strong>rndc thaw <em class="replaceable"><code>zone</code></em></strong></span>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync to reload the changed zone and re-enable dynamic updates.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="command"><strong>rndc sync <em class="replaceable"><code>zone</code></em></strong></span>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync will update the zone file with changes from the journal file
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync without stopping dynamic updates; this may be useful for viewing
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync the current zone state. To remove the <code class="filename">.jnl</code>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync file after updating the zone file, use
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="command"><strong>rndc sync -clean</strong></span>.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<div class="titlepage"><div><div><h2 class="title" style="clear: both">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<a name="incremental_zone_transfers"></a>Incremental Zone Transfers (IXFR)</h2></div></div></div>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync The incremental zone transfer (IXFR) protocol is a way for
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync slave servers to transfer only changed data, instead of having to
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync transfer the entire zone. The IXFR protocol is specified in RFC
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync 1995. See <a class="xref" href="Bv9ARM.ch11.html#proposed_standards" title="Proposed Standards">Proposed Standards</a>.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync When acting as a master, <acronym class="acronym">BIND</acronym> 9
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync supports IXFR for those zones
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync where the necessary change history information is available. These
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync include master zones maintained by dynamic update and slave zones
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync whose data was obtained by IXFR. For manually maintained master
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync zones, and for slave zones obtained by performing a full zone
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync transfer (AXFR), IXFR is supported only if the option
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="command"><strong>ixfr-from-differences</strong></span> is set
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync to <strong class="userinput"><code>yes</code></strong>.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync When acting as a slave, <acronym class="acronym">BIND</acronym> 9 will
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync attempt to use IXFR unless
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync it is explicitly disabled. For more information about disabling
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync IXFR, see the description of the <span class="command"><strong>request-ixfr</strong></span> clause
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync of the <span class="command"><strong>server</strong></span> statement.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<div class="titlepage"><div><div><h2 class="title" style="clear: both">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<a name="split_dns"></a>Split DNS</h2></div></div></div>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Setting up different views, or visibility, of the DNS space to
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync internal and external resolvers is usually referred to as a
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="emphasis"><em>Split DNS</em></span> setup. There are several
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync reasons an organization would want to set up its DNS this way.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync One common reason for setting up a DNS system this way is
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync to hide "internal" DNS information from "external" clients on the
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Internet. There is some debate as to whether or not this is actually
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Internal DNS information leaks out in many ways (via email headers,
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync for example) and most savvy "attackers" can find the information
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync they need using other means.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync However, since listing addresses of internal servers that
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync external clients cannot possibly reach can result in
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync connection delays and other annoyances, an organization may
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync choose to use a Split DNS to present a consistent view of itself
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync to the outside world.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Another common reason for setting up a Split DNS system is
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync to allow internal networks that are behind filters or in RFC 1918
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync space (reserved IP space, as documented in RFC 1918) to resolve DNS
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync on the Internet. Split DNS can also be used to allow mail from outside
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync back in to the internal network.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<a name="split_dns_sample"></a>Example split DNS setup</h3></div></div></div>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Let's say a company named <span class="emphasis"><em>Example, Inc.</em></span>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync has several corporate sites that have an internal network with
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Internet Protocol (IP) space and an external demilitarized zone (DMZ),
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync or "outside" section of a network, that is available to the public.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="emphasis"><em>Example, Inc.</em></span> wants its internal clients
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync to be able to resolve external hostnames and to exchange mail with
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync people on the outside. The company also wants its internal resolvers
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync to have access to certain internal-only zones that are not available
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync at all outside of the internal network.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync In order to accomplish this, the company will set up two sets
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync of name servers. One set will be on the inside network (in the
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync IP space) and the other set will be on bastion hosts, which are
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync hosts that can talk to both sides of its network, in the DMZ.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync The internal servers will be configured to forward all queries,
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync except queries for <code class="filename">site1.internal</code>, <code class="filename">site2.internal</code>, <code class="filename">site1.example.com</code>,
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync and <code class="filename">site2.example.com</code>, to the servers
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync DMZ. These internal servers will have complete sets of information
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync for <code class="filename">site1.example.com</code>, <code class="filename">site2.example.com</code>, <code class="filename">site1.internal</code>,
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync To protect the <code class="filename">site1.internal</code> and <code class="filename">site2.internal</code> domains,
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync the internal name servers must be configured to disallow all queries
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync to these domains from any external hosts, including the bastion
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync The external servers, which are on the bastion hosts, will
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync be configured to serve the "public" version of the <code class="filename">site1</code> and <code class="filename">site2.example.com</code> zones.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync This could include things such as the host records for public servers
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync (<code class="filename">www.example.com</code> and <code class="filename">ftp.example.com</code>),
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync and mail exchange (MX) records (<code class="filename">a.mx.example.com</code> and <code class="filename">b.mx.example.com</code>).
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync In addition, the public <code class="filename">site1</code> and <code class="filename">site2.example.com</code> zones
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync should have special MX records that contain wildcard (`*') records
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync pointing to the bastion hosts. This is needed because external mail
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync servers do not have any other way of looking up how to deliver mail
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync to those internal hosts. With the wildcard records, the mail will
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync be delivered to the bastion host, which can then forward it on to
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync internal hosts.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Here's an example of a wildcard MX record:
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <pre class="programlisting">* IN MX 10 external1.example.com.</pre>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Now that they accept mail on behalf of anything in the internal
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync network, the bastion hosts will need to know how to deliver mail
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync to internal hosts. In order for this to work properly, the resolvers
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync the bastion hosts will need to be configured to point to the internal
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync name servers for DNS resolution.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Queries for internal hostnames will be answered by the internal
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync servers, and queries for external hostnames will be forwarded back
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync out to the DNS servers on the bastion hosts.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync In order for all this to work properly, internal clients will
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync need to be configured to query <span class="emphasis"><em>only</em></span> the internal
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync name servers for DNS queries. This could also be enforced via
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync filtering on the network.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync If everything has been set properly, <span class="emphasis"><em>Example, Inc.</em></span>'s
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync internal clients will now be able to:
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Look up any hostnames in the <code class="literal">site1</code>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <code class="literal">site2.example.com</code> zones.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Look up any hostnames in the <code class="literal">site1.internal</code> and
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <code class="literal">site2.internal</code> domains.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Look up any hostnames on the Internet.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Exchange mail with both internal and external people.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Hosts on the Internet will be able to:
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Look up any hostnames in the <code class="literal">site1</code>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <code class="literal">site2.example.com</code> zones.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Exchange mail with anyone in the <code class="literal">site1</code> and
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <code class="literal">site2.example.com</code> zones.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Here is an example configuration for the setup we just
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync described above. Note that this is only configuration information;
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync for information on how to configure your zone files, see <a class="xref" href="Bv9ARM.ch03.html#sample_configuration" title="Sample Configurations">the section called “Sample Configurations”</a>.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Internal DNS server config:
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsyncacl externals { <code class="varname">bastion-ips-go-here</code>; };
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync forward only;
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync // forward to external servers
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync forwarders {
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync // sample allow-transfer (no one)
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync allow-transfer { none; };
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync // restrict query access
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync allow-query { internals; externals; };
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync // restrict recursion
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync allow-recursion { internals; };
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync// sample master zone
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync type master;
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync // do normal iterative resolution (do not forward)
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync forwarders { };
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync allow-query { internals; externals; };
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync allow-transfer { internals; };
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync// sample slave zone
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync type slave;
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync masters { 172.16.72.3; };
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync forwarders { };
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync allow-query { internals; externals; };
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync allow-transfer { internals; };
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync type master;
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync forwarders { };
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync allow-query { internals; };
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync allow-transfer { internals; }
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync type slave;
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync masters { 172.16.72.3; };
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync forwarders { };
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync allow-query { internals };
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync allow-transfer { internals; }
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync External (bastion host) DNS server config:
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsyncacl externals { bastion-ips-go-here; };
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync // sample allow-transfer (no one)
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync allow-transfer { none; };
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync // default query access
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync allow-query { any; };
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync // restrict cache access
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync allow-query-cache { internals; externals; };
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync // restrict recursion
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync allow-recursion { internals; externals; };
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync// sample slave zone
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync type master;
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync allow-transfer { internals; externals; };
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync type slave;
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync masters { another_bastion_host_maybe; };
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync allow-transfer { internals; externals; }
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync In the <code class="filename">resolv.conf</code> (or equivalent) on
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync the bastion host(s):
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsyncnameserver 172.16.72.2
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsyncnameserver 172.16.72.3
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsyncnameserver 172.16.72.4
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<div class="titlepage"><div><div><h2 class="title" style="clear: both">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync TSIG (Transaction SIGnatures) is a mechanism for authenticating DNS
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync messages, originally specified in RFC 2845. It allows DNS messages
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync to be cryptographically signed using a shared secret. TSIG can
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync be used in any DNS transaction, as a way to restrict access to
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync certain server functions (e.g., recursive queries) to authorized
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync clients when IP-based access control is insufficient or needs to
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync be overridden, or as a way to ensure message authenticity when it
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync is critical to the integrity of the server, such as with dynamic
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync UPDATE messages or zone transfers from a master to a slave server.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync This is a guide to setting up TSIG in <acronym class="acronym">BIND</acronym>.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync It describes the configuration syntax and the process of creating
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="command"><strong>named</strong></span> supports TSIG for server-to-server
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync communication, and some of the tools included with
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <acronym class="acronym">BIND</acronym> support it for sending messages to
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="command"><strong>named</strong></span>:
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <a class="xref" href="man.nsupdate.html" title="nsupdate"><span class="refentrytitle"><span class="application">nsupdate</span></span>(1)</a> supports TSIG via the
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <code class="option">-k</code>, <code class="option">-l</code> and
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <code class="option">-y</code> command line options, or via
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync the <span class="command"><strong>key</strong></span> command when running
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync interactively.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <a class="xref" href="man.dig.html" title="dig"><span class="refentrytitle">dig</span>(1)</a> supports TSIG via the
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <code class="option">-k</code> and <code class="option">-y</code> command
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync line options.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<a name="id-1.5.6.5"></a>Generating a Shared Key</h3></div></div></div>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync TSIG keys can be generated using the <span class="command"><strong>tsig-keygen</strong></span>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync command; the output of the command is a <span class="command"><strong>key</strong></span> directive
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync suitable for inclusion in <code class="filename">named.conf</code>. The
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync key name, algorithm and size can be specified by command line parameters;
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync the defaults are "tsig-key", HMAC-SHA256, and 256 bits, respectively.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Any string which is a valid DNS name can be used as a key name.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync For example, a key to be shared between servers called
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="emphasis"><em>host1</em></span> and <span class="emphasis"><em>host2</em></span> could
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync be called "host1-host2.", and this key could be generated using:
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync $ tsig-keygen host1-host2. > host1-host2.key
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync This key may then be copied to both hosts. The key name and secret
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync must be identical on both hosts.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync (Note: copying a shared secret from one server to another is beyond
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync the scope of the DNS. A secure transport mechanism should be used:
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync secure FTP, SSL, ssh, telephone, encrypted email, etc.)
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="command"><strong>tsig-keygen</strong></span> can also be run as
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="command"><strong>ddns-confgen</strong></span>, in which case its output includes
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync additional configuration text for setting up dynamic DNS in
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="command"><strong>named</strong></span>. See <a class="xref" href="man.ddns-confgen.html" title="ddns-confgen"><span class="refentrytitle"><span class="application">ddns-confgen</span></span>(8)</a>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync for details.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<a name="id-1.5.6.6"></a>Loading A New Key</h3></div></div></div>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync For a key shared between servers called
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="emphasis"><em>host1</em></span> and <span class="emphasis"><em>host2</em></span>,
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync the following could be added to each server's
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsynckey "host1-host2." {
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync algorithm hmac-sha256;
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync secret "DAopyf1mhCbFVZw7pgmNPBoLUq8wEUT7UuPoLENP2HY=";
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync (This is the same key generated above using
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="command"><strong>tsig-keygen</strong></span>.)
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Since this text contains a secret, it
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync is recommended that either <code class="filename">named.conf</code> not be
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync world-readable, or that the <span class="command"><strong>key</strong></span> directive
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync be stored in a file which is not world-readable, and which is
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync included in <code class="filename">named.conf</code> via the
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="command"><strong>include</strong></span> directive.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Once a key has been added to <code class="filename">named.conf</code> and the
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync server has been restarted or reconfigured, the server can recognize
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync the key. If the server receives a message signed by the
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync key, it will be able to verify the signature. If the signature
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync is valid, the response will be signed using the same key.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync TSIG keys that are known to a server can be listed using the
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync command <span class="command"><strong>rndc tsig-list</strong></span>.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<a name="id-1.5.6.7"></a>Instructing the Server to Use a Key</h3></div></div></div>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync A server sending a request to another server must be told whether
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync to use a key, and if so, which key to use.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync For example, a key may be specified for each server in the
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="command"><strong>masters</strong></span> statement in the definition of a
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync slave zone; in this case, all SOA QUERY messages, NOTIFY
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync messages, and zone transfer requests (AXFR or IXFR) will be
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync signed using the specified key. Keys may also be specified
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync in the <span class="command"><strong>also-notify</strong></span> statement of a master
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync or slave zone, causing NOTIFY messages to be signed using
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync the specified key.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Keys can also be specified in a <span class="command"><strong>server</strong></span>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync directive. Adding the following on <span class="emphasis"><em>host1</em></span>,
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync if the IP address of <span class="emphasis"><em>host2</em></span> is 10.1.2.3, would
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync cause <span class="emphasis"><em>all</em></span> requests from <span class="emphasis"><em>host1</em></span>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync to <span class="emphasis"><em>host2</em></span>, including normal DNS queries, to be
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync signed using the <span class="command"><strong>host1-host2.</strong></span> key:
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsyncserver 10.1.2.3 {
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync keys { host1-host2. ;};
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Multiple keys may be present in the <span class="command"><strong>keys</strong></span>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync statement, but only the first one is used. As this directive does
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync not contain secrets, it can be used in a world-readable file.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Requests sent by <span class="emphasis"><em>host2</em></span> to <span class="emphasis"><em>host1</em></span>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync would <span class="emphasis"><em>not</em></span> be signed, unless a similar
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="command"><strong>server</strong></span> directive were in <span class="emphasis"><em>host2</em></span>'s
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync configuration file.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Whenever any server sends a TSIG-signed DNS request, it will expect
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync the response to be signed with the same key. If a response is not
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync signed, or if the signature is not valid, the response will be
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<a name="id-1.5.6.8"></a>TSIG-Based Access Control</h3></div></div></div>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync TSIG keys may be specified in ACL definitions and ACL directives
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync such as <span class="command"><strong>allow-query</strong></span>, <span class="command"><strong>allow-transfer</strong></span>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync and <span class="command"><strong>allow-update</strong></span>.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync The above key would be denoted in an ACL element as
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="command"><strong>key host1-host2.</strong></span>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync An example of an <span class="command"><strong>allow-update</strong></span> directive using
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync a TSIG key:
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsyncallow-update { !{ !localnets; any; }; key host1-host2. ;};
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync This allows dynamic updates to succeed only if the UPDATE
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync request comes from an address in <span class="command"><strong>localnets</strong></span>,
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="emphasis"><em>and</em></span> if it is signed using the
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="command"><strong>host1-host2.</strong></span> key.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync See <a class="xref" href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called “Dynamic Update Policies”</a> for a discussion of
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync the more flexible <span class="command"><strong>update-policy</strong></span> statement.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<a name="id-1.5.6.9"></a>Errors</h3></div></div></div>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Processing of TSIG-signed messages can result in several errors:
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync If a TSIG-aware server receives a message signed by an
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync unknown key, the response will be unsigned, with the TSIG
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync extended error code set to BADKEY.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync If a TSIG-aware server receives a message from a known key
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync but with an invalid signature, the response will be unsigned,
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync with the TSIG extended error code set to BADSIG.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync If a TSIG-aware server receives a message with a time
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync outside of the allowed range, the response will be signed, with
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync the TSIG extended error code set to BADTIME, and the time values
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync will be adjusted so that the response can be successfully
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync In all of the above cases, the server will return a response code
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync of NOTAUTH (not authenticated).
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<div class="titlepage"><div><div><h2 class="title" style="clear: both">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync TKEY (Transaction KEY) is a mechanism for automatically negotiating
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync a shared secret between two hosts, originally specified in RFC 2930.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync There are several TKEY "modes" that specify how a key is to be
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync generated or assigned. <acronym class="acronym">BIND</acronym> 9 implements only
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync one of these modes: Diffie-Hellman key exchange. Both hosts are
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync required to have a KEY record with algorithm DH (though this
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync record is not required to be present in a zone).
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync The TKEY process is initiated by a client or server by sending
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync a query of type TKEY to a TKEY-aware server. The query must include
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync an appropriate KEY record in the additional section, and
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync must be signed using either TSIG or SIG(0) with a previously
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync established key. The server's response, if successful, will
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync contain a TKEY record in its answer section. After this transaction,
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync both participants will have enough information to calculate a
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync shared secret using Diffie-Hellman key exchange. The shared secret
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync can then be used by to sign subsequent transactions between the
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync two servers.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync TSIG keys known by the server, including TKEY-negotiated keys, can
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync be listed using <span class="command"><strong>rndc tsig-list</strong></span>.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync TKEY-negotiated keys can be deleted from a server using
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="command"><strong>rndc tsig-delete</strong></span>. This can also be done via
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync the TKEY protocol itself, by sending an authenticated TKEY query
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync specifying the "key deletion" mode.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<div class="titlepage"><div><div><h2 class="title" style="clear: both">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <acronym class="acronym">BIND</acronym> partially supports DNSSEC SIG(0)
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync transaction signatures as specified in RFC 2535 and RFC 2931.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync SIG(0) uses public/private keys to authenticate messages. Access control
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync is performed in the same manner as TSIG keys; privileges can be
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync granted or denied in ACL directives based on the key name.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync When a SIG(0) signed message is received, it will only be
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync verified if the key is known and trusted by the server. The
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync server will not attempt to recursively fetch or validate the
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync SIG(0) signing of multiple-message TCP streams is not supported.
that the tools shipped with BIND 9.2.x and earlier are not compatible
<strong class="userinput"><code>dnssec-keygen -a RSASHA1 -b 768 -n ZONE child.example.</code></strong>
<strong class="userinput"><code>yes</code></strong> or <strong class="userinput"><code>auto</code></strong>.
example.com. 257 3 5 "AwEAAaxPMcR2x0HbQV4WeZB6oEDX+r0QM6
<a name="dnssec.dynamic.zones"></a>DNSSEC, Dynamic Zones, and Automatic Signing</h2></div></div></div>
zone example.net {
> update add example.net DNSKEY 256 3 7 AwEAAZn17pUF0KpbPA2c7Gz76Vb18v0teKT3EyAGfBfL8eQ8al35zz3Y I1m/SAQBxIqMfLtIwqWPdgthsu36azGQAX8=
> update add example.net DNSKEY 257 3 7 AwEAAd/7odU/64o2LGsifbLtQmtO8dFDtTAZXSX2+X3e/UNlq9IHq3Y0 XtC0Iuawl/qkaKVxXe2lo8Ct+dM6UehyCqk=
> update add example.net DNSKEY 256 3 7 AwEAAZn17pUF0KpbPA2c7Gz76Vb18v0teKT3EyAGfBfL8eQ8al35zz3Y I1m/SAQBxIqMfLtIwqWPdgthsu36azGQAX8=
> update add example.net DNSKEY 257 3 7 AwEAAd/7odU/64o2LGsifbLtQmtO8dFDtTAZXSX2+X3e/UNlq9IHq3Y0 XtC0Iuawl/qkaKVxXe2lo8Ct+dM6UehyCqk=
> update add example.net NSEC3PARAM 1 1 100 1234567890
(See <a class="xref" href="man.dnssec-keygen.html" title="dnssec-keygen"><span class="refentrytitle"><span class="application">dnssec-keygen</span></span>(8)</a> and
<a class="xref" href="man.dnssec-settime.html" title="dnssec-settime"><span class="refentrytitle"><span class="application">dnssec-settime</span></span>(8)</a> for more information.)
<span class="command"><strong>rndc sign</strong></span> or <span class="command"><strong>rndc loadkeys</strong></span>
<span class="command"><strong>dnssec-keygen</strong></span> or <span class="command"><strong>dnssec-settime</strong></span>),
<p>In any secure zone which supports dynamic updates, <span class="command"><strong>named</strong></span>
<a class="xref" href="Bv9ARM.ch06.html#managed-keys" title="managed-keys Statement Definition and Usage">the section called “<span class="command"><strong>managed-keys</strong></span> Statement Definition
$ <strong class="userinput"><code>dnssec-keygen -K keys -f KSK -P now -A now+2y example.net</code></strong>
and the <span class="command"><strong>dnssec-*</strong></span> and <span class="command"><strong>pkcs11-*</strong></span>
<span class="command"><strong>dnssec-*</strong></span> tools, or the <code class="option">-m</code> in
$ <strong class="userinput"><code> configure --with-crypto-backend=openssl --prefix=/opt/pkcs11/usr --enable-gost </code></strong>
$ <strong class="userinput"><code> /opt/pkcs11/usr/bin/softhsm-util --init-token 0 --slot 0 --label softhsmv2 </code></strong>
$ <strong class="userinput"><code>wget <a class="link" href="" target="_top">http://www.openssl.org/source/openssl-0.9.8zc.tar.gz</a></code></strong>
$ <strong class="userinput"><code>cp pkcs11.GCC4.0.2.so.4.05 /opt/pkcs11/usr/lib/libpkcs11.so</code></strong>
and "<span class="command"><strong>make test</strong></span>". If "<span class="command"><strong>make
$ <strong class="userinput"><code> echo "0:/opt/pkcs11/softhsm.db" > $SOFTHSM_CONF </code></strong>
$ <strong class="userinput"><code> /opt/pkcs11/usr/bin/softhsm --init-token 0 --slot 0 --label softhsm </code></strong>
<span class="quote">“<span class="quote"><code class="literal">[ available ]</code></span>”</span>.
<a name="id-1.5.12.8.18"></a>Configuring BIND 9 for Linux with the AEP Keyper</h4></div></div></div>
<a name="id-1.5.12.8.19"></a>Configuring BIND 9 for Solaris with the SCA 6000</h4></div></div></div>
$ <strong class="userinput"><code>export LD_LIBRARY_PATH=/opt/pkcs11/usr/lib:${LD_LIBRARY_PATH}</code></strong>
$ <strong class="userinput"><code>export KEYPER_LIBRARY_PATH=/opt/Keyper/PKCS11Provider</code></strong>
"sample-ksk" as the key-signing key for "example.net":
$ <strong class="userinput"><code>dnssec-keyfromlabel -l sample-ksk -f KSK example.net</code></strong>
<a class="xref" href="man.dnssec-keyfromlabel.html" title="dnssec-keyfromlabel"><span class="refentrytitle"><span class="application">dnssec-keyfromlabel</span></span>(8)</a> for details.)
then <span class="command"><strong>named</strong></span> must have access to the HSM PIN. In OpenSSL-based PKCS#11,
this is accomplished by placing the PIN into the openssl.cnf file
The location of the openssl.cnf file can be overridden by
Historically, DLZ drivers had to be statically linked with the <span class="command"><strong>named</strong></span>
"dlopen" driver is linked into <span class="command"><strong>named</strong></span> by default, so configure options
When the DLZ module provides data to <span class="command"><strong>named</strong></span>, it does so in text format.
The response is converted to DNS wire format by <span class="command"><strong>named</strong></span>. This
dynamically-linkable DLZ module--i.e., one which can be
"example.nil", which can answer queries and AXFR requests, and
example.nil. 1800 IN A 10.53.0.1
e.g., by providing different address records for a particular name
(see <a class="xref" href="Bv9ARM.ch04.html#dlz-info" title="DLZ (Dynamically Loadable Zones)">the section called “DLZ (Dynamically Loadable Zones)”</a>), allows zone data to be
<a class="link" href="https://fedorahosted.org/bind-dyndb-ldap/" target="_top">https://fedorahosted.org/bind-dyndb-ldap/</a>.
dyndb example "driver.so" {
"example.nil", which can answer queries and AXFR requests, and
example.nil. 86400 IN A 127.0.0.1
whether the updated RR is an address (i.e., type A or AAAA) and if
zone "catalog.example"
means <span class="command"><strong>rndc addzone</strong></span> and <span class="command"><strong>rndc delzone</strong></span>
catalog.example. IN SOA . . 2016022901 900 600 86400 1
catalog.example. IN NS nsexample.
version.catalog.example. IN TXT "1"
Global options are set at the apex of the catalog zone, e.g.:
masters.catalog.example. IN AAAA 2001:db8::1
masters.catalog.example. IN A 192.0.2.1
label.masters.catalog.example. IN A 192.0.2.2
label.masters.catalog.example. IN TXT "tsig_key_name"
label.masters.5960775ba382e7a4e09263fc06e7c00569b6a05c.zones.catalog.example. IN AAAA 2001:db8::2
see <a class="xref" href="Bv9ARM.ch11.html#ipv6addresses" title="IPv6 addresses (AAAA)">the section called “IPv6 addresses (AAAA)”</a>.
$ORIGIN example.com.
<td width="40%" align="right" valign="top">�Chapter�5.�The <acronym class="acronym">BIND</acronym> 9 Lightweight Resolver</td>
<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.3b1 (Extended Support Version)</p>