man.nsupdate.html revision 0a7ed88633a680bb881868b75ded4d09a7bbbc50
25cc5fbba63f84b47e389af749f55abbbde71c8cChristian Maeder - Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
25cc5fbba63f84b47e389af749f55abbbde71c8cChristian Maeder - Copyright (C) 2000-2003 Internet Software Consortium.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder - Permission to use, copy, modify, and/or distribute this software for any
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder - purpose with or without fee is hereby granted, provided that the above
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder - copyright notice and this permission notice appear in all copies.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
d03ce8efc673309b40746bf5f66299cc3cefa3b0Klaus Luettich - PERFORMANCE OF THIS SOFTWARE.
afa6ceaf4359ae437aaa6830949583143ace2752Christian Maeder<!-- $Id: man.nsupdate.html,v 1.53 2009/07/19 04:27:55 tbox Exp $ -->
760ae19a92dde8249679a674f93f58d26a7c5f6bChristian Maeder<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
88c800932dd7053322501ea2039d9f234be6866cKlaus Luettich<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
c0c2380bced8159ff0297ece14eba948bd236471Christian Maeder<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
c0c2380bced8159ff0297ece14eba948bd236471Christian Maeder<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
c0c2380bced8159ff0297ece14eba948bd236471Christian Maeder<link rel="prev" href="man.named.html" title="named">
c0c2380bced8159ff0297ece14eba948bd236471Christian Maeder<link rel="next" href="man.rndc.html" title="rndc">
8410667510a76409aca9bb24ff0eda0420088274Christian Maeder<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
404166b9366552e9ec5abb87a37c76ec8a815fb7Klaus Luettich<table width="100%" summary="Navigation header">
404166b9366552e9ec5abb87a37c76ec8a815fb7Klaus Luettich<tr><th colspan="3" align="center"><span class="application">nsupdate</span></th></tr>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<a accesskey="p" href="man.named.html">Prev</a>�</td>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<th width="60%" align="center">Manual pages</th>
d67a33b40578beef2e255a274f89bb9c34aaf056Christian Maeder<td width="20%" align="right">�<a accesskey="n" href="man.rndc.html">Next</a>
5d44c8cecd07b47ce537c7e14bf7b41a39f08507Christian Maeder<a name="man.nsupdate"></a><div class="titlepage"></div>
c6fcd42c6d6d9dae8c7835c24fcb7ce8531a9050Christian Maeder<p><span class="application">nsupdate</span> — Dynamic DNS update utility</p>
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder<div class="cmdsynopsis"><p><code class="command">nsupdate</code> [<code class="option">-d</code>] [<code class="option">-D</code>] [[<code class="option">-g</code>] | [<code class="option">-o</code>] | [<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></code>] | [<code class="option">-k <em class="replaceable"><code>keyfile</code></em></code>]] [<code class="option">-t <em class="replaceable"><code>timeout</code></em></code>] [<code class="option">-u <em class="replaceable"><code>udptimeout</code></em></code>] [<code class="option">-r <em class="replaceable"><code>udpretries</code></em></code>] [<code class="option">-R <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-v</code>] [filename]</p></div>
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder<a name="id2613514"></a><h2>DESCRIPTION</h2>
f4505a64a089693012a3f5c3b1f12a82cd7a2a5aKlaus Luettich<p><span><strong class="command">nsupdate</strong></span>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder is used to submit Dynamic DNS Update requests as defined in RFC2136
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder to a name server.
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder This allows resource records to be added or removed from a zone
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder without manually editing the zone file.
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder A single update request can contain requests to add or remove more than
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder resource record.
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder Zones that are under dynamic control via
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder <span><strong class="command">nsupdate</strong></span>
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder or a DHCP server should not be edited by hand.
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder Manual edits could
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder conflict with dynamic updates and cause data to be lost.
c0c2380bced8159ff0297ece14eba948bd236471Christian Maeder The resource records that are dynamically added or removed with
5d44c8cecd07b47ce537c7e14bf7b41a39f08507Christian Maeder <span><strong class="command">nsupdate</strong></span>
c0c2380bced8159ff0297ece14eba948bd236471Christian Maeder have to be in the same zone.
c0c2380bced8159ff0297ece14eba948bd236471Christian Maeder Requests are sent to the zone's master server.
c0c2380bced8159ff0297ece14eba948bd236471Christian Maeder This is identified by the MNAME field of the zone's SOA record.
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder <span><strong class="command">nsupdate</strong></span>
c0c2380bced8159ff0297ece14eba948bd236471Christian Maeder operate in debug mode.
549b97cfbe3a6687db74440a550b68b2fc19a272Christian Maeder This provides tracing information about the update requests that are
549b97cfbe3a6687db74440a550b68b2fc19a272Christian Maeder made and the replies received from the name server.
c0c2380bced8159ff0297ece14eba948bd236471Christian Maeder The <code class="option">-D</code> option makes <span><strong class="command">nsupdate</strong></span>
f4505a64a089693012a3f5c3b1f12a82cd7a2a5aKlaus Luettich report additional debugging information to <code class="option">-d</code>.
f4505a64a089693012a3f5c3b1f12a82cd7a2a5aKlaus Luettich The <code class="option">-L</code> option with an integer argument of zero or
f4505a64a089693012a3f5c3b1f12a82cd7a2a5aKlaus Luettich higher sets the logging debug level. If zero, logging is disabled.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder Transaction signatures can be used to authenticate the Dynamic
c0c2380bced8159ff0297ece14eba948bd236471Christian Maeder DNS updates. These use the TSIG resource record type described
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder in RFC2845 or the SIG(0) record described in RFC3535 and
77a65251ee036c6aaf09c2775315a4ee24259fbdJorina Freya Gerken RFC2931 or GSS-TSIG as described in RFC3645. TSIG relies on
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder a shared secret that should only be known to
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder <span><strong class="command">nsupdate</strong></span> and the name server. Currently,
afa6ceaf4359ae437aaa6830949583143ace2752Christian Maeder the only supported encryption algorithm for TSIG is HMAC-MD5,
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder which is defined in RFC 2104. Once other algorithms are
97812b7ce9860bf514a8822a63503451795dbc65Klaus Luettich defined for TSIG, applications will need to ensure they select
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder the appropriate algorithm as well as the key when authenticating
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder each other. For instance, suitable <span class="type">key</span> and
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder <span class="type">server</span> statements would be added to
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder <code class="filename">/etc/named.conf</code> so that the name server
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder can associate the appropriate secret key and algorithm with
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder the IP address of the client application that will be using
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder TSIG authentication. SIG(0) uses public key cryptography.
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder To use a SIG(0) key, the public key must be stored in a KEY
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder record in a zone served by the name server.
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder <span><strong class="command">nsupdate</strong></span> does not read
08e5741dd8b6bf9b7419e89298e384e18bc57f64Christian Maeder <code class="filename">/etc/named.conf</code>.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder GSS-TSIG uses Kerberos credentials.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<p><span><strong class="command">nsupdate</strong></span>
9df11f85fd7f8c4745d64464876e84ec4e263692Christian Maeder uses the <code class="option">-y</code> or <code class="option">-k</code> option
8b0f493ae42bad8b94918cc0957f1af57096cda4Felix Reckers to provide the shared secret needed to generate a TSIG record
9df11f85fd7f8c4745d64464876e84ec4e263692Christian Maeder for authenticating Dynamic DNS update requests, default type
5b818f10e11fc79def1fdd5c8a080d64a6438d87Christian Maeder HMAC-MD5. These options are mutually exclusive.
5d4038657f6a63e131f5804af2f7957b69e15a43Klaus Luettich When the <code class="option">-y</code> option is used, a signature is
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder generated from
c432483b64662e8db604a58758cd18ea7fa65659Christian Maeder [<span class="optional"><em class="parameter"><code>hmac:</code></em></span>]<em class="parameter"><code>keyname:secret.</code></em>
857992065be4ed40a72c6296b6c0aec62ab4c5b9Christian Maeder <em class="parameter"><code>keyname</code></em> is the name of the key, and
857992065be4ed40a72c6296b6c0aec62ab4c5b9Christian Maeder <em class="parameter"><code>secret</code></em> is the base64 encoded shared secret.
8659594bb40eb5f3da5439692f0908300947191eSonja Gröning Use of the <code class="option">-y</code> option is discouraged because the
8c692d0cc44e7df93f58a3eed0d9774ba5908339Jorina Freya Gerken shared secret is supplied as a command line argument in clear text.
eeb419aa20c97b4af973e97ee6ae77a8eed29e15Till Mossakowski This may be visible in the output from
8b0f493ae42bad8b94918cc0957f1af57096cda4Felix Reckers <span class="citerefentry"><span class="refentrytitle">ps</span>(1)</span>
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder or in a history file maintained by the user's shell.
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder <code class="option">-k</code> option, <span><strong class="command">nsupdate</strong></span> reads
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder the shared secret from the file <em class="parameter"><code>keyfile</code></em>.
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder Keyfiles may be in two formats: a single file containing
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder a <code class="filename">named.conf</code>-format <span><strong class="command">key</strong></span>
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder statement, which may be generated automatically by
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder <span><strong class="command">ddns-confgen</strong></span>, or a pair of files whose names are
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder of the format <code class="filename">K{name}.+157.+{random}.key</code> and
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder <code class="filename">K{name}.+157.+{random}.private</code>, which can be
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder generated by <span><strong class="command">dnssec-keygen</strong></span>.
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder The <code class="option">-k</code> may also be used to specify a SIG(0) key used
afa6ceaf4359ae437aaa6830949583143ace2752Christian Maeder to authenticate Dynamic DNS update requests. In this case, the key
afa6ceaf4359ae437aaa6830949583143ace2752Christian Maeder specified is not an HMAC-MD5 key.
afa6ceaf4359ae437aaa6830949583143ace2752Christian Maeder <span><strong class="command">nsupdate</strong></span> can be run in a local-host only mode
afa6ceaf4359ae437aaa6830949583143ace2752Christian Maeder using the <code class="option">-l</code> flag. This sets the server address to
afa6ceaf4359ae437aaa6830949583143ace2752Christian Maeder localhost (disabling the <span><strong class="command">server</strong></span> so that the server
afa6ceaf4359ae437aaa6830949583143ace2752Christian Maeder address cannot be overridden). Connections to the local server will
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder use a TSIG key found in <code class="filename">/var/run/named/ddns.key</code>,
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder which is automatically generated by <span><strong class="command">named</strong></span> if any
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder local master zone has set <span><strong class="command">update-policy</strong></span> to
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder <span><strong class="command">local</strong></span>. The location of this key file can be
8b0f493ae42bad8b94918cc0957f1af57096cda4Felix Reckers overridden with the <code class="option">-k</code> option.
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder By default, <span><strong class="command">nsupdate</strong></span>
a02a4eb2a2029d27a11fff2ebcc6c460574a74fcKlaus Luettich uses UDP to send update requests to the name server unless they are too
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder large to fit in a UDP request in which case TCP will be used.
c72c1e75a969ff4c336e77481c2a8e42603f13eeChristian Maeder <span><strong class="command">nsupdate</strong></span>
c72c1e75a969ff4c336e77481c2a8e42603f13eeChristian Maeder use a TCP connection.
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder This may be preferable when a batch of update requests is made.
c0c2380bced8159ff0297ece14eba948bd236471Christian Maeder The <code class="option">-p</code> sets the default port number to use for
7ea1b24778bb8f58c650f5ae659da720b9f9e109Klaus Luettich connections to a name server. The default is 53.
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder The <code class="option">-t</code> option sets the maximum time an update request
dbe752ee940baae7f9f231f29c62284bb0f90a25Christian Maeder take before it is aborted. The default is 300 seconds. Zero can be
53818ced114da21321063fff307aa41c1ab31dd3Achim Mahnke to disable the timeout.
53818ced114da21321063fff307aa41c1ab31dd3Achim Mahnke The <code class="option">-u</code> option sets the UDP retry interval. The default
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder 3 seconds. If zero, the interval will be computed from the timeout
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder and number of UDP retries.
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder The <code class="option">-r</code> option sets the number of UDP retries. The
fdb2d618144159395f7bf8ce3327b3c112a17dd3Till Mossakowski 3. If zero, only one update request will be made.
8b0f493ae42bad8b94918cc0957f1af57096cda4Felix Reckers The <code class="option">-R <em class="replaceable"><code>randomdev</code></em></code> option
b49276c9f50038e0bd499ad49f7bd6444566a834Christian Maeder specifies a source of randomness. If the operating system
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder does not provide a <code class="filename">/dev/random</code> or
ed9207cf24e96b0d6f59985822054ae28cb69b2eChristian Maeder equivalent device, the default source of randomness is keyboard
b49276c9f50038e0bd499ad49f7bd6444566a834Christian Maeder input. <code class="filename">randomdev</code> specifies the name of
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder a character device or file containing random data to be used
ac0bbbcb2774629bb87986e69cf53d3402c5f575Christian Maeder instead of the default. The special value
33d042fe6a9eb27a4c48f840b80838f3e7d98e34Christian Maeder <code class="filename">keyboard</code> indicates that keyboard input
b10267ae0a6523b73113fc2dee9ea628266fce60Christian Maeder should be used. This option may be specified multiple times.
05a8b581f98b928baca6dab60cd20277659ac760Christian Maeder<a name="id2614044"></a><h2>INPUT FORMAT</h2>
ed9207cf24e96b0d6f59985822054ae28cb69b2eChristian Maeder<p><span><strong class="command">nsupdate</strong></span>
fa21fba9ceb1ddf7b3efd54731a12ed8750191d8Christian Maeder reads input from
b49276c9f50038e0bd499ad49f7bd6444566a834Christian Maeder <em class="parameter"><code>filename</code></em>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder or standard input.
b49276c9f50038e0bd499ad49f7bd6444566a834Christian Maeder Each command is supplied on exactly one line of input.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder Some commands are for administrative purposes.
b905126bab9454b89041f92b3c50bb9efc85e427Klaus Luettich The others are either update instructions or prerequisite checks on the
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder contents of the zone.
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder These checks set conditions that some name or set of
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder resource records (RRset) either exists or is absent from the zone.
5c69cef4668bbd959d721668313a779126014d1eKlaus Luettich These conditions must be met if the entire update request is to succeed.
b905126bab9454b89041f92b3c50bb9efc85e427Klaus Luettich Updates will be rejected if the tests for the prerequisite conditions
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder Every update request consists of zero or more prerequisites
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder and zero or more updates.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder This allows a suitably authenticated update request to proceed if some
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder specified resource records are present or missing from the zone.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder A blank input line (or the <span><strong class="command">send</strong></span> command)
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder accumulated commands to be sent as one Dynamic DNS update request to the
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder The command formats and their meaning are as follows:
b905126bab9454b89041f92b3c50bb9efc85e427Klaus Luettich <span><strong class="command">server</strong></span>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder Sends all dynamic update requests to the name server
dbe752ee940baae7f9f231f29c62284bb0f90a25Christian Maeder <em class="parameter"><code>servername</code></em>.
dbe752ee940baae7f9f231f29c62284bb0f90a25Christian Maeder When no server statement is provided,
ef67402074be14deb95e4ff564737d5593144130Klaus Luettich <span><strong class="command">nsupdate</strong></span>
ef67402074be14deb95e4ff564737d5593144130Klaus Luettich will send updates to the master server of the correct zone.
dbe752ee940baae7f9f231f29c62284bb0f90a25Christian Maeder The MNAME field of that zone's SOA record will identify the
5958fabb264ec3f5b2125ac5602121bd34814a79Klaus Luettich server for that zone.
e7e1ab2ac3f1fded8611bb92ae00e8f3b8c693fbKlaus Luettich is the port number on
ef67402074be14deb95e4ff564737d5593144130Klaus Luettich <em class="parameter"><code>servername</code></em>
1323eba62fc519b068f5aaec4f9d2be05ffabea9Klaus Luettich where the dynamic update requests get sent.
a80c28bb8b7a23ccdf7e08d0fe216fc19cc97273Klaus Luettich If no port number is specified, the default DNS port number of
d579f5b263e6c73d466c265f2fbfd45b0e69ca64Klaus Luettich <span><strong class="command">local</strong></span>
ac0bbbcb2774629bb87986e69cf53d3402c5f575Christian Maeder Sends all dynamic update requests using the local
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder <em class="parameter"><code>address</code></em>.
404166b9366552e9ec5abb87a37c76ec8a815fb7Klaus Luettich When no local statement is provided,
404166b9366552e9ec5abb87a37c76ec8a815fb7Klaus Luettich <span><strong class="command">nsupdate</strong></span>
4e7050bcbcf0f372a5bad32ecd0282bccabf0983Klaus Luettich will send updates using an address and port chosen by the
ac0bbbcb2774629bb87986e69cf53d3402c5f575Christian Maeder can additionally be used to make requests come from a specific
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder If no port number is specified, the system will assign one.
e593b89bfd4952698dc37feced21cefe869d87a2Christian Maeder <span><strong class="command">zone</strong></span>
ac0bbbcb2774629bb87986e69cf53d3402c5f575Christian Maeder Specifies that all updates are to be made to the zone
ac0bbbcb2774629bb87986e69cf53d3402c5f575Christian Maeder <em class="parameter"><code>zonename</code></em>.
9c3edf2b283c09d33b2820696886d1ed32fcadc8Christian Maeder <em class="parameter"><code>zone</code></em>
ac0bbbcb2774629bb87986e69cf53d3402c5f575Christian Maeder statement is provided,
9c3edf2b283c09d33b2820696886d1ed32fcadc8Christian Maeder <span><strong class="command">nsupdate</strong></span>
9c3edf2b283c09d33b2820696886d1ed32fcadc8Christian Maeder will attempt determine the correct zone to update based on the
9c3edf2b283c09d33b2820696886d1ed32fcadc8Christian Maeder rest of the input.
94d3aa05411444596b44ede4531f05dd7ac20fdfChristian Maeder <span><strong class="command">class</strong></span>
ac0bbbcb2774629bb87986e69cf53d3402c5f575Christian Maeder Specify the default class.
8410667510a76409aca9bb24ff0eda0420088274Christian Maeder If no <em class="parameter"><code>class</code></em> is specified, the
ddc9315cc0b1f5dd3d8f99a77f1c75064db33b48Christian Maeder default class is
ddc9315cc0b1f5dd3d8f99a77f1c75064db33b48Christian Maeder <em class="parameter"><code>IN</code></em>.
5d522dff4d0fabf57dd476d4c3de15d354a89f62Christian Maeder <span><strong class="command">ttl</strong></span>
ac43fa22d2d3f91a17674ac164cba3cf39a17795Klaus Luettich Specify the default time to live for records to be added.
ac43fa22d2d3f91a17674ac164cba3cf39a17795Klaus Luettich The value <em class="parameter"><code>none</code></em> will clear the default
42aacf1f63419cbab63a88725e6a0b2c8776f101Christian Maeder <span><strong class="command">key</strong></span>
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder Specifies that all updates are to be TSIG-signed using the
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder <em class="parameter"><code>keyname</code></em> <em class="parameter"><code>keysecret</code></em> pair.
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder The <span><strong class="command">key</strong></span> command
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder overrides any key specified on the command line via
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder <code class="option">-y</code> or <code class="option">-k</code>.
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder <span><strong class="command">prereq nxdomain</strong></span>
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder {domain-name}
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder Requires that no resource record of any type exists with name
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder <em class="parameter"><code>domain-name</code></em>.
8b0f493ae42bad8b94918cc0957f1af57096cda4Felix Reckers <span><strong class="command">prereq yxdomain</strong></span>
afa6ceaf4359ae437aaa6830949583143ace2752Christian Maeder {domain-name}
afa6ceaf4359ae437aaa6830949583143ace2752Christian Maeder Requires that
c0c2380bced8159ff0297ece14eba948bd236471Christian Maeder <em class="parameter"><code>domain-name</code></em>
8b0f493ae42bad8b94918cc0957f1af57096cda4Felix Reckers exists (has as at least one resource record, of any type).
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder <span><strong class="command">prereq nxrrset</strong></span>
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder {domain-name}
8b0f493ae42bad8b94918cc0957f1af57096cda4Felix Reckers Requires that no resource record exists of the specified
4d5652abf9ed9c5714723ff7fdb80a54f7350fb2Christian Maeder <em class="parameter"><code>type</code></em>,
4d5652abf9ed9c5714723ff7fdb80a54f7350fb2Christian Maeder <em class="parameter"><code>class</code></em>
4d5652abf9ed9c5714723ff7fdb80a54f7350fb2Christian Maeder <em class="parameter"><code>domain-name</code></em>.
4d5652abf9ed9c5714723ff7fdb80a54f7350fb2Christian Maeder <em class="parameter"><code>class</code></em>
4d5652abf9ed9c5714723ff7fdb80a54f7350fb2Christian Maeder is omitted, IN (internet) is assumed.
4d5652abf9ed9c5714723ff7fdb80a54f7350fb2Christian Maeder <span><strong class="command">prereq yxrrset</strong></span>
4d5652abf9ed9c5714723ff7fdb80a54f7350fb2Christian Maeder {domain-name}
4d5652abf9ed9c5714723ff7fdb80a54f7350fb2Christian Maeder This requires that a resource record of the specified
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder <em class="parameter"><code>type</code></em>,
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder <em class="parameter"><code>class</code></em>
a80c28bb8b7a23ccdf7e08d0fe216fc19cc97273Klaus Luettich <em class="parameter"><code>domain-name</code></em>
a80c28bb8b7a23ccdf7e08d0fe216fc19cc97273Klaus Luettich <em class="parameter"><code>class</code></em>
26f228bf3a3fea810223396e5794c217a79a8d5bChristian Maeder is omitted, IN (internet) is assumed.
b9625461755578f3eed04676d42a63fd2caebd0cChristian Maeder <span><strong class="command">prereq yxrrset</strong></span>
b9625461755578f3eed04676d42a63fd2caebd0cChristian Maeder {domain-name}
d67a33b40578beef2e255a274f89bb9c34aaf056Christian Maeder <em class="parameter"><code>data</code></em>
23ab8855c58adfbd03a0730584b917b24c603901Christian Maeder from each set of prerequisites of this form
26f228bf3a3fea810223396e5794c217a79a8d5bChristian Maeder sharing a common
26f228bf3a3fea810223396e5794c217a79a8d5bChristian Maeder <em class="parameter"><code>type</code></em>,
26f228bf3a3fea810223396e5794c217a79a8d5bChristian Maeder <em class="parameter"><code>class</code></em>,
ba904a15082557e939db689fcfba0c68c9a4f740Christian Maeder <em class="parameter"><code>domain-name</code></em>
ba904a15082557e939db689fcfba0c68c9a4f740Christian Maeder are combined to form a set of RRs. This set of RRs must
6ae5607d2def114f998fd49bac4eef12a2620fafChristian Maeder exactly match the set of RRs existing in the zone at the
6ae5607d2def114f998fd49bac4eef12a2620fafChristian Maeder <em class="parameter"><code>type</code></em>,
08e5741dd8b6bf9b7419e89298e384e18bc57f64Christian Maeder <em class="parameter"><code>class</code></em>,
08e5741dd8b6bf9b7419e89298e384e18bc57f64Christian Maeder <em class="parameter"><code>domain-name</code></em>.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder <em class="parameter"><code>data</code></em>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder are written in the standard text representation of the resource
b9625461755578f3eed04676d42a63fd2caebd0cChristian Maeder <span><strong class="command">update delete</strong></span>
08e5741dd8b6bf9b7419e89298e384e18bc57f64Christian Maeder {domain-name}
b9625461755578f3eed04676d42a63fd2caebd0cChristian Maeder [type [data...]]
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder Deletes any resource records named
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder <em class="parameter"><code>domain-name</code></em>.
340706b6c0c6e3dbacdd7003e20e9cab7f9aa765Christian Maeder <em class="parameter"><code>data</code></em>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder is provided, only matching resource records will be removed.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder The internet class is assumed if
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder <em class="parameter"><code>class</code></em>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder is not supplied. The
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder <em class="parameter"><code>ttl</code></em>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder is ignored, and is only allowed for compatibility.
470ca7a2797069ae4b27c34c1b71419f67be1f84Christian Maeder <span><strong class="command">update add</strong></span>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder {domain-name}
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder Adds a new resource record with the specified
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder <em class="parameter"><code>ttl</code></em>,
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder <em class="parameter"><code>class</code></em>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder <em class="parameter"><code>data</code></em>.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder <span><strong class="command">show</strong></span>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder Displays the current message, containing all of the
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder prerequisites and
8b4c68db8b465107cabef8b9cd5b6bc216e1b156Till Mossakowski updates specified since the last send.
c72c1e75a969ff4c336e77481c2a8e42603f13eeChristian Maeder <span><strong class="command">send</strong></span>
23ab8855c58adfbd03a0730584b917b24c603901Christian Maeder Sends the current message. This is equivalent to entering a
8b4c68db8b465107cabef8b9cd5b6bc216e1b156Till Mossakowski <span><strong class="command">answer</strong></span>
b49276c9f50038e0bd499ad49f7bd6444566a834Christian Maeder Displays the answer.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder <span><strong class="command">debug</strong></span>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder Turn on debugging.
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder Lines beginning with a semicolon are comments and are ignored.
5d4038657f6a63e131f5804af2f7957b69e15a43Klaus Luettich The examples below show how
8b0f493ae42bad8b94918cc0957f1af57096cda4Felix Reckers <span><strong class="command">nsupdate</strong></span>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder could be used to insert and delete resource records from the
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder Notice that the input in each example contains a trailing blank line so
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder a group of commands are sent as one dynamic update request to the
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder master name server for
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder> update delete oldhost.example.com A
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder> update add newhost.example.com 86400 A 172.16.1.1
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder Any A records for
c72c1e75a969ff4c336e77481c2a8e42603f13eeChristian Maeder <span class="type">oldhost.example.com</span>
c72c1e75a969ff4c336e77481c2a8e42603f13eeChristian Maeder And an A record for
b49276c9f50038e0bd499ad49f7bd6444566a834Christian Maeder <span class="type">newhost.example.com</span>
d67a33b40578beef2e255a274f89bb9c34aaf056Christian Maeder with IP address 172.16.1.1 is added.
d67a33b40578beef2e255a274f89bb9c34aaf056Christian Maeder The newly-added record has a 1 day TTL (86400 seconds).
ac0bbbcb2774629bb87986e69cf53d3402c5f575Christian Maeder> prereq nxdomain nickname.example.com
8b0f493ae42bad8b94918cc0957f1af57096cda4Felix Reckers> update add nickname.example.com 86400 CNAME somehost.example.com
c72c1e75a969ff4c336e77481c2a8e42603f13eeChristian Maeder The prerequisite condition gets the name server to check that there
c72c1e75a969ff4c336e77481c2a8e42603f13eeChristian Maeder are no resource records of any type for
c72c1e75a969ff4c336e77481c2a8e42603f13eeChristian Maeder <span class="type">nickname.example.com</span>.
c72c1e75a969ff4c336e77481c2a8e42603f13eeChristian Maeder If there are, the update request fails.
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder If this name does not exist, a CNAME for it is added.
6e049108aa87dc46bcff96fae50a4625df1d9648Klaus Luettich This ensures that when the CNAME is added, it cannot conflict with the
f4505a64a089693012a3f5c3b1f12a82cd7a2a5aKlaus Luettich long-standing rule in RFC1034 that a name must not exist as any other
6e049108aa87dc46bcff96fae50a4625df1d9648Klaus Luettich record type if it exists as a CNAME.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder (The rule has been updated for DNSSEC in RFC2535 to allow CNAMEs to have
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder RRSIG, DNSKEY and NSEC records.)
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<dt><span class="term"><code class="constant">/etc/resolv.conf</code></span></dt>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder used to identify default name server
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder<dt><span class="term"><code class="constant">/var/run/named/ddns.key</code></span></dt>
1a6464613c59e35072b90ca296ae402cbe956144Christian Maeder sets the default TSIG key for use in local-only mode
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder<dt><span class="term"><code class="constant">K{name}.+157.+{random}.key</code></span></dt>
438f9bd974c8e668203e636b0f2bc80c589af043Klaus Luettich base-64 encoding of HMAC-MD5 key created by
438f9bd974c8e668203e636b0f2bc80c589af043Klaus Luettich <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>.
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder<dt><span class="term"><code class="constant">K{name}.+157.+{random}.private</code></span></dt>