man.nsupdate.html revision 0da02c26a6631c25f075a8e4ac6de9e58f49a0c2
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose - Copyright (C) 2000-2016 Internet Systems Consortium, Inc. ("ISC")
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose - This Source Code Form is subject to the terms of the Mozilla Public
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose - License, v. 2.0. If a copy of the MPL was not distributed with this
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose - file, You can obtain one at http://mozilla.org/MPL/2.0/.
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose<link rel="prev" href="man.named-rrchecker.html" title="named-rrchecker">
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose<link rel="next" href="man.rndc.html" title="rndc">
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose<tr><th colspan="3" align="center"><span class="application">nsupdate</span></th></tr>
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose<a accesskey="p" href="man.named-rrchecker.html">Prev</a>�</td>
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose<td width="20%" align="right">�<a accesskey="n" href="man.rndc.html">Next</a>
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose<a name="man.nsupdate"></a><div class="titlepage"></div>
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose — Dynamic DNS update utility
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose [<code class="option">-L <em class="replaceable"><code>level</code></em></code>]
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose | [<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></code>]
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose | [<code class="option">-k <em class="replaceable"><code>keyfile</code></em></code>]
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose [<code class="option">-t <em class="replaceable"><code>timeout</code></em></code>]
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose [<code class="option">-u <em class="replaceable"><code>udptimeout</code></em></code>]
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose [<code class="option">-r <em class="replaceable"><code>udpretries</code></em></code>]
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose [<code class="option">-R <em class="replaceable"><code>randomdev</code></em></code>]
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose <p><span class="command"><strong>nsupdate</strong></span>
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose is used to submit Dynamic DNS Update requests as defined in RFC 2136
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose to a name server.
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose This allows resource records to be added or removed from a zone
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose without manually editing the zone file.
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose A single update request can contain requests to add or remove more than
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose resource record.
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose Zones that are under dynamic control via
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose <span class="command"><strong>nsupdate</strong></span>
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose or a DHCP server should not be edited by hand.
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose Manual edits could
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose conflict with dynamic updates and cause data to be lost.
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose The resource records that are dynamically added or removed with
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose <span class="command"><strong>nsupdate</strong></span>
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose have to be in the same zone.
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose Requests are sent to the zone's master server.
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose This is identified by the MNAME field of the zone's SOA record.
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose Transaction signatures can be used to authenticate the Dynamic
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose DNS updates. These use the TSIG resource record type described
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose in RFC 2845 or the SIG(0) record described in RFC 2535 and
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose RFC 2931 or GSS-TSIG as described in RFC 3645.
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose TSIG relies on
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose a shared secret that should only be known to
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose <span class="command"><strong>nsupdate</strong></span> and the name server.
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose For instance, suitable <span class="type">key</span> and
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose <span class="type">server</span> statements would be added to
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose <code class="filename">/etc/named.conf</code> so that the name server
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose can associate the appropriate secret key and algorithm with
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose the IP address of the client application that will be using
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose TSIG authentication. You can use <span class="command"><strong>ddns-confgen</strong></span>
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose to generate suitable configuration fragments.
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose <span class="command"><strong>nsupdate</strong></span>
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose uses the <code class="option">-y</code> or <code class="option">-k</code> options
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose to provide the TSIG shared secret. These options are mutually exclusive.
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose SIG(0) uses public key cryptography.
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose To use a SIG(0) key, the public key must be stored in a KEY
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose record in a zone served by the name server.
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose GSS-TSIG uses Kerberos credentials. Standard GSS-TSIG mode
cd5033e86bb4065d75188e2b6ef287a4421344c8Sumit Bose is switched on with the <code class="option">-g</code> flag. A
cd5033e86bb4065d75188e2b6ef287a4421344c8Sumit Bose non-standards-compliant variant of GSS-TSIG used by Windows
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose 2000 can be switched on with the <code class="option">-o</code> flag.
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose <div class="variablelist"><dl class="variablelist">
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose Debug mode. This provides tracing information about the
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose update requests that are made and the replies received
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose from the name server.
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose Extra debug mode.
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose<dt><span class="term">-k <em class="replaceable"><code>keyfile</code></em></span></dt>
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose The file containing the TSIG authentication key.
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose Keyfiles may be in two formats: a single file containing
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose a <code class="filename">named.conf</code>-format <span class="command"><strong>key</strong></span>
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose statement, which may be generated automatically by
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose <span class="command"><strong>ddns-confgen</strong></span>, or a pair of files whose names are
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose of the format <code class="filename">K{name}.+157.+{random}.key</code> and
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose <code class="filename">K{name}.+157.+{random}.private</code>, which can be
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose generated by <span class="command"><strong>dnssec-keygen</strong></span>.
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose The <code class="option">-k</code> may also be used to specify a SIG(0) key used
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose to authenticate Dynamic DNS update requests. In this case, the key
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose specified is not an HMAC-MD5 key.
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose Local-host only mode. This sets the server address to
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose localhost (disabling the <span class="command"><strong>server</strong></span> so that the server
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose address cannot be overridden). Connections to the local server will
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose use a TSIG key found in <code class="filename">/var/run/named/session.key</code>,
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose which is automatically generated by <span class="command"><strong>named</strong></span> if any
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose local master zone has set <span class="command"><strong>update-policy</strong></span> to
2ef62c64e7f07c8aced3f72850008ecb72860162Sumit Bose <span class="command"><strong>local</strong></span>. The location of this key file can be
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose overridden with the <code class="option">-k</code> option.
fe2ab0d67fe8c66fb6352e9d8f845bb46d1848cbSumit Bose<dt><span class="term">-L <em class="replaceable"><code>level</code></em></span></dt>
fe2ab0d67fe8c66fb6352e9d8f845bb46d1848cbSumit Bose Set the logging debug level. If zero, logging is disabled.
fe2ab0d67fe8c66fb6352e9d8f845bb46d1848cbSumit Bose<dt><span class="term">-p <em class="replaceable"><code>port</code></em></span></dt>
fe2ab0d67fe8c66fb6352e9d8f845bb46d1848cbSumit Bose Set the port to use for connections to a name server. The
fe2ab0d67fe8c66fb6352e9d8f845bb46d1848cbSumit Bose default is 53.
fe2ab0d67fe8c66fb6352e9d8f845bb46d1848cbSumit Bose Print the list of private BIND-specific resource record
fe2ab0d67fe8c66fb6352e9d8f845bb46d1848cbSumit Bose types whose format is understood
fe2ab0d67fe8c66fb6352e9d8f845bb46d1848cbSumit Bose by <span class="command"><strong>nsupdate</strong></span>. See also
fe2ab0d67fe8c66fb6352e9d8f845bb46d1848cbSumit Bose<dt><span class="term">-r <em class="replaceable"><code>udpretries</code></em></span></dt>
fe2ab0d67fe8c66fb6352e9d8f845bb46d1848cbSumit Bose The number of UDP retries. The default is 3. If zero, only
fe2ab0d67fe8c66fb6352e9d8f845bb46d1848cbSumit Bose one update request will be made.
fe2ab0d67fe8c66fb6352e9d8f845bb46d1848cbSumit Bose<dt><span class="term">-R <em class="replaceable"><code>randomdev</code></em></span></dt>
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose Where to obtain randomness. If the operating system
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose does not provide a <code class="filename">/dev/random</code> or
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose equivalent device, the default source of randomness is keyboard
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose input. <code class="filename">randomdev</code> specifies the name of
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose a character device or file containing random data to be used
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose instead of the default. The special value
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose <code class="filename">keyboard</code> indicates that keyboard input
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose should be used. This option may be specified multiple times.
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose<dt><span class="term">-t <em class="replaceable"><code>timeout</code></em></span></dt>
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose The maximum time an update request can take before it is
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose aborted. The default is 300 seconds. Zero can be used to
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose disable the timeout.
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose Print the list of IANA standard resource record types
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose whose format is understood by <span class="command"><strong>nsupdate</strong></span>.
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose <span class="command"><strong>nsupdate</strong></span> will exit after the lists are
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose printed. The <code class="option">-T</code> option can be combined
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose Other types can be entered using "TYPEXXXXX" where "XXXXX" is the
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose decimal value of the type with no leading zeros. The rdata,
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose if present, will be parsed using the UNKNOWN rdata format,
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose (<backslash> <hash> <space> <length>
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose <space> <hexstring>).
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose<dt><span class="term">-u <em class="replaceable"><code>udptimeout</code></em></span></dt>
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose The UDP retry interval. The default is 3 seconds. If zero,
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose the interval will be computed from the timeout interval and
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose number of UDP retries.
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose Use TCP even for small update requests.
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose By default, <span class="command"><strong>nsupdate</strong></span>
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose uses UDP to send update requests to the name server unless they are too
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose large to fit in a UDP request in which case TCP will be used.
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose TCP may be preferable when a batch of update requests is made.
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose Print the version number and exit.
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose<dt><span class="term">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></span></dt>
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose Literal TSIG authentication key.
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose <em class="parameter"><code>keyname</code></em> is the name of the key, and
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose <em class="parameter"><code>secret</code></em> is the base64 encoded shared secret.
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose <em class="parameter"><code>hmac</code></em> is the name of the key algorithm;
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose valid choices are <code class="literal">hmac-md5</code>,
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose <code class="literal">hmac-sha1</code>, <code class="literal">hmac-sha224</code>,
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose <code class="literal">hmac-sha256</code>, <code class="literal">hmac-sha384</code>, or
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose <code class="literal">hmac-sha512</code>. If <em class="parameter"><code>hmac</code></em>
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose is not specified, the default is <code class="literal">hmac-md5</code>
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose or if MD5 was disabled <code class="literal">hmac-sha256</code>.
04d138472cc086fb7961f0d378852b09961b1a33Lukas Slebodnik NOTE: Use of the <code class="option">-y</code> option is discouraged because the
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose shared secret is supplied as a command line argument in clear text.
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose This may be visible in the output from
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose or in a history file maintained by the user's shell.
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose <p><span class="command"><strong>nsupdate</strong></span>
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose reads input from
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose or standard input.
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose Each command is supplied on exactly one line of input.
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose Some commands are for administrative purposes.
04d138472cc086fb7961f0d378852b09961b1a33Lukas Slebodnik The others are either update instructions or prerequisite checks on the
04d138472cc086fb7961f0d378852b09961b1a33Lukas Slebodnik contents of the zone.
04d138472cc086fb7961f0d378852b09961b1a33Lukas Slebodnik These checks set conditions that some name or set of
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose resource records (RRset) either exists or is absent from the zone.
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose These conditions must be met if the entire update request is to succeed.
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose Updates will be rejected if the tests for the prerequisite conditions
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose Every update request consists of zero or more prerequisites
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose and zero or more updates.
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose This allows a suitably authenticated update request to proceed if some
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose specified resource records are present or missing from the zone.
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose A blank input line (or the <span class="command"><strong>send</strong></span> command)
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose accumulated commands to be sent as one Dynamic DNS update request to the
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose name server.
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose The command formats and their meaning are as follows:
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose<div class="variablelist"><dl class="variablelist">
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose <span class="command"><strong>server</strong></span>
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose {servername}
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose Sends all dynamic update requests to the name server
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose <em class="parameter"><code>servername</code></em>.
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose When no server statement is provided,
2fe140d3a41e1ac66400069d35adc9379348c1e5Sumit Bose <span class="command"><strong>nsupdate</strong></span>
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose will send updates to the master server of the correct zone.
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose The MNAME field of that zone's SOA record will identify the
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose server for that zone.
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose is the port number on
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <em class="parameter"><code>servername</code></em>
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose where the dynamic update requests get sent.
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose If no port number is specified, the default DNS port number of
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <span class="command"><strong>local</strong></span>
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose Sends all dynamic update requests using the local
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose When no local statement is provided,
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <span class="command"><strong>nsupdate</strong></span>
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose will send updates using an address and port chosen by the
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose can additionally be used to make requests come from a specific
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose If no port number is specified, the system will assign one.
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose <span class="command"><strong>zone</strong></span>
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose Specifies that all updates are to be made to the zone
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose <em class="parameter"><code>zonename</code></em>.
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose statement is provided,
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose <span class="command"><strong>nsupdate</strong></span>
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose will attempt determine the correct zone to update based on the
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose rest of the input.
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose <span class="command"><strong>class</strong></span>
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose Specify the default class.
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose If no <em class="parameter"><code>class</code></em> is specified, the
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose default class is
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <span class="command"><strong>ttl</strong></span>
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose Specify the default time to live for records to be added.
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose The value <em class="parameter"><code>none</code></em> will clear the default
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <span class="command"><strong>key</strong></span>
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose [hmac:] {keyname}
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose Specifies that all updates are to be TSIG-signed using the
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <em class="parameter"><code>keyname</code></em> <em class="parameter"><code>secret</code></em> pair.
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose If <em class="parameter"><code>hmac</code></em> is specified, then it sets the
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose signing algorithm in use; the default is
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <code class="literal">hmac-md5</code> or if MD5 was disabled
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <code class="literal">hmac-sha256</code>. The <span class="command"><strong>key</strong></span>
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose command overrides any key specified on the command line via
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <code class="option">-y</code> or <code class="option">-k</code>.
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <span class="command"><strong>gsstsig</strong></span>
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose Use GSS-TSIG to sign the updated. This is equivalent to
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose specifying <code class="option">-g</code> on the command line.
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <span class="command"><strong>oldgsstsig</strong></span>
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose Use the Windows 2000 version of GSS-TSIG to sign the updated.
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose This is equivalent to specifying <code class="option">-o</code> on the
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose command line.
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <span class="command"><strong>realm</strong></span>
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose When using GSS-TSIG use <em class="parameter"><code>realm_name</code></em> rather
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose than the default realm in <code class="filename">krb5.conf</code>. If no
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose realm is specified the saved realm is cleared.
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <span class="command"><strong>check-names</strong></span>
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose Turn on or off check-names processing on records to
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose be added. Check-names has no effect on prerequisites
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose or records to be deleted. By default check-names
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose processing is on. If check-names processing fails
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose the record will not be added to the UPDATE message.
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <span class="command"><strong>[<span class="optional">prereq</span>] nxdomain</strong></span>
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose {domain-name}
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose Requires that no resource record of any type exists with name
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <em class="parameter"><code>domain-name</code></em>.
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <span class="command"><strong>[<span class="optional">prereq</span>] yxdomain</strong></span>
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose {domain-name}
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose Requires that
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <em class="parameter"><code>domain-name</code></em>
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose exists (has as at least one resource record, of any type).
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <span class="command"><strong>[<span class="optional">prereq</span>] nxrrset</strong></span>
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose {domain-name}
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose Requires that no resource record exists of the specified
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose <em class="parameter"><code>domain-name</code></em>.
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose is omitted, IN (internet) is assumed.
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <span class="command"><strong>[<span class="optional">prereq</span>] yxrrset</strong></span>
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose {domain-name}
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose This requires that a resource record of the specified
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <em class="parameter"><code>domain-name</code></em>
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose is omitted, IN (internet) is assumed.
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <span class="command"><strong>[<span class="optional">prereq</span>] yxrrset</strong></span>
b52b26176c92f3b06dba5598428c70c0cde13fd1Sumit Bose {domain-name}
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose from each set of prerequisites of this form
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose sharing a common
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <em class="parameter"><code>domain-name</code></em>
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose are combined to form a set of RRs. This set of RRs must
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose exactly match the set of RRs existing in the zone at the
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <em class="parameter"><code>domain-name</code></em>.
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose are written in the standard text representation of the resource
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <span class="command"><strong>[<span class="optional">update</span>] del[<span class="optional">ete</span>]</strong></span>
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose {domain-name}
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose [type [data...]]
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose Deletes any resource records named
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <em class="parameter"><code>domain-name</code></em>.
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose is provided, only matching resource records will be removed.
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose The internet class is assumed if
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose is not supplied. The
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose is ignored, and is only allowed for compatibility.
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <span class="command"><strong>[<span class="optional">update</span>] add</strong></span>
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose {domain-name}
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose Adds a new resource record with the specified
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <span class="command"><strong>show</strong></span>
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose Displays the current message, containing all of the
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose prerequisites and
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose updates specified since the last send.
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <span class="command"><strong>send</strong></span>
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose Sends the current message. This is equivalent to entering a
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <span class="command"><strong>answer</strong></span>
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose Displays the answer.
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <span class="command"><strong>debug</strong></span>
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose Turn on debugging.
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose <span class="command"><strong>version</strong></span>
ca49ae1eee321751681e99f3ebe2547211db3bf6Sumit Bose Print version number.
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose <span class="command"><strong>help</strong></span>
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose Print a list of commands.
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose Lines beginning with a semicolon are comments and are ignored.
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose The examples below show how
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose <span class="command"><strong>nsupdate</strong></span>
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose could be used to insert and delete resource records from the
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose Notice that the input in each example contains a trailing blank line so
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose a group of commands are sent as one dynamic update request to the
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose master name server for
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose> update delete oldhost.example.com A
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose> update add newhost.example.com 86400 A 172.16.1.1
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose Any A records for
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose are deleted.
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose And an A record for
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose with IP address 172.16.1.1 is added.
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose The newly-added record has a 1 day TTL (86400 seconds).
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose> prereq nxdomain nickname.example.com
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose> update add nickname.example.com 86400 CNAME somehost.example.com
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose The prerequisite condition gets the name server to check that there
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose are no resource records of any type for
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose If there are, the update request fails.
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose If this name does not exist, a CNAME for it is added.
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose This ensures that when the CNAME is added, it cannot conflict with the
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose long-standing rule in RFC 1034 that a name must not exist as any other
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose record type if it exists as a CNAME.
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose (The rule has been updated for DNSSEC in RFC 2535 to allow CNAMEs to have
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose RRSIG, DNSKEY and NSEC records.)
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose <div class="variablelist"><dl class="variablelist">
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose<dt><span class="term"><code class="constant">/etc/resolv.conf</code></span></dt>
ab355eced46b5f488ed62a79a7f2e5ac2b6a574cSumit Bose used to identify default name server
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose<dt><span class="term"><code class="constant">/var/run/named/session.key</code></span></dt>
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose sets the default TSIG key for use in local-only mode
ab355eced46b5f488ed62a79a7f2e5ac2b6a574cSumit Bose<dt><span class="term"><code class="constant">K{name}.+157.+{random}.key</code></span></dt>
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose base-64 encoding of HMAC-MD5 key created by
145578006684481434ced78461ab8d1c3570f478Sumit Bose <span class="refentrytitle">dnssec-keygen</span>(8)
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose<dt><span class="term"><code class="constant">K{name}.+157.+{random}.private</code></span></dt>
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose base-64 encoding of HMAC-MD5 key created by
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose <span class="refentrytitle">dnssec-keygen</span>(8)
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose <span class="refentrytitle">ddns-confgen</span>(8)
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose <span class="refentrytitle">dnssec-keygen</span>(8)
ab355eced46b5f488ed62a79a7f2e5ac2b6a574cSumit Bose The TSIG key is redundantly stored in two separate files.
ab355eced46b5f488ed62a79a7f2e5ac2b6a574cSumit Bose This is a consequence of nsupdate using the DST library
ab355eced46b5f488ed62a79a7f2e5ac2b6a574cSumit Bose for its cryptographic operations, and may change in future
ab355eced46b5f488ed62a79a7f2e5ac2b6a574cSumit Bose<a accesskey="p" href="man.named-rrchecker.html">Prev</a>�</td>
ab355eced46b5f488ed62a79a7f2e5ac2b6a574cSumit Bose<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
ab355eced46b5f488ed62a79a7f2e5ac2b6a574cSumit Bose<td width="40%" align="right">�<a accesskey="n" href="man.rndc.html">Next</a>
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose<span class="application">named-rrchecker</span>�</td>
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose<td width="40%" align="right" valign="top">�<span class="application">rndc</span>
9da27cbc7532f775afc411d809735760dd5294a7Sumit Bose<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.1b1</p>