man.nsupdate.html revision bcf15a19ae0efa72a22cdfb50666a3c6ce39eb9f
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington - Copyright (C) 2004-2012 Internet Systems Consortium, Inc. ("ISC")
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington - Copyright (C) 2000-2003 Internet Software Consortium.
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington - Permission to use, copy, modify, and/or distribute this software for any
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington - purpose with or without fee is hereby granted, provided that the above
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington - copyright notice and this permission notice appear in all copies.
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
4b1177ebeacde81ebd28ae1c759bdbd7845517aaPeter Major - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
4772e4d950d9b6cbe4ec83fc246707aa041fe2edKohei Tamura - PERFORMANCE OF THIS SOFTWARE.
af38905e8a5231702db169603d942d5d2e0c4332David Luna<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
af38905e8a5231702db169603d942d5d2e0c4332David Luna<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
af38905e8a5231702db169603d942d5d2e0c4332David Luna<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
8d75f7fba11e555d87ff0f6f2a7504681c482e0bNeil Madden<link rel="prev" href="man.named-journalprint.html" title="named-journalprint">
8d75f7fba11e555d87ff0f6f2a7504681c482e0bNeil Madden<link rel="next" href="man.rndc.html" title="rndc">
af38905e8a5231702db169603d942d5d2e0c4332David Luna<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
2cea600e37e6258f33806dad6e4ffc8230bed58fPhill Cunnington<table width="100%" summary="Navigation header">
af38905e8a5231702db169603d942d5d2e0c4332David Luna<tr><th colspan="3" align="center"><span class="application">nsupdate</span></th></tr>
a716317fdea138d875a5bfa4a0afce170759f203Neil Madden<a accesskey="p" href="man.named-journalprint.html">Prev</a>�</td>
c4e6ca0941fb9b26059729d0184c5c710ab8810bJames Phillpotts<th width="60%" align="center">Manual pages</th>
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts<td width="20%" align="right">�<a accesskey="n" href="man.rndc.html">Next</a>
c4e6ca0941fb9b26059729d0184c5c710ab8810bJames Phillpotts<a name="man.nsupdate"></a><div class="titlepage"></div>
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington<p><span class="application">nsupdate</span> — Dynamic DNS update utility</p>
8d75f7fba11e555d87ff0f6f2a7504681c482e0bNeil Madden<div class="cmdsynopsis"><p><code class="command">nsupdate</code> [<code class="option">-d</code>] [<code class="option">-D</code>] [[<code class="option">-g</code>] | [<code class="option">-o</code>] | [<code class="option">-l</code>] | [<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></code>] | [<code class="option">-k <em class="replaceable"><code>keyfile</code></em></code>]] [<code class="option">-t <em class="replaceable"><code>timeout</code></em></code>] [<code class="option">-u <em class="replaceable"><code>udptimeout</code></em></code>] [<code class="option">-r <em class="replaceable"><code>udpretries</code></em></code>] [<code class="option">-R <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-v</code>] [<code class="option">-T</code>] [<code class="option">-P</code>] [filename]</p></div>
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts<a name="id2642797"></a><h2>DESCRIPTION</h2>
af38905e8a5231702db169603d942d5d2e0c4332David Luna<p><span><strong class="command">nsupdate</strong></span>
af38905e8a5231702db169603d942d5d2e0c4332David Luna is used to submit Dynamic DNS Update requests as defined in RFC 2136
af38905e8a5231702db169603d942d5d2e0c4332David Luna to a name server.
4b1177ebeacde81ebd28ae1c759bdbd7845517aaPeter Major This allows resource records to be added or removed from a zone
891ec421a09f30c851276b030d40ac5f187b21e3Kajetan Hemzaczek without manually editing the zone file.
af38905e8a5231702db169603d942d5d2e0c4332David Luna A single update request can contain requests to add or remove more than
8d75f7fba11e555d87ff0f6f2a7504681c482e0bNeil Madden resource record.
4b1177ebeacde81ebd28ae1c759bdbd7845517aaPeter Major Zones that are under dynamic control via
4b1177ebeacde81ebd28ae1c759bdbd7845517aaPeter Major <span><strong class="command">nsupdate</strong></span>
af38905e8a5231702db169603d942d5d2e0c4332David Luna or a DHCP server should not be edited by hand.
a716317fdea138d875a5bfa4a0afce170759f203Neil Madden Manual edits could
af38905e8a5231702db169603d942d5d2e0c4332David Luna conflict with dynamic updates and cause data to be lost.
af38905e8a5231702db169603d942d5d2e0c4332David Luna The resource records that are dynamically added or removed with
4ccae7e16b9ab014016a21612e4b9a62739f73d6tom.rumsey@forgerock.com <span><strong class="command">nsupdate</strong></span>
af38905e8a5231702db169603d942d5d2e0c4332David Luna have to be in the same zone.
af38905e8a5231702db169603d942d5d2e0c4332David Luna Requests are sent to the zone's master server.
fde1057bd7d85a23fbbcc4cac1475339c2d3ea78sachiko This is identified by the MNAME field of the zone's SOA record.
af38905e8a5231702db169603d942d5d2e0c4332David Luna option makes
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <span><strong class="command">nsupdate</strong></span>
8d75f7fba11e555d87ff0f6f2a7504681c482e0bNeil Madden operate in debug mode.
8d75f7fba11e555d87ff0f6f2a7504681c482e0bNeil Madden This provides tracing information about the update requests that are
8d75f7fba11e555d87ff0f6f2a7504681c482e0bNeil Madden made and the replies received from the name server.
8d75f7fba11e555d87ff0f6f2a7504681c482e0bNeil Madden The <code class="option">-D</code> option makes <span><strong class="command">nsupdate</strong></span>
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington report additional debugging information to <code class="option">-d</code>.
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington The <code class="option">-L</code> option with an integer argument of zero or
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington higher sets the logging debug level. If zero, logging is disabled.
c4e6ca0941fb9b26059729d0184c5c710ab8810bJames Phillpotts Transaction signatures can be used to authenticate the Dynamic
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts DNS updates. These use the TSIG resource record type described
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts in RFC 2845 or the SIG(0) record described in RFC 2535 and
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts RFC 2931 or GSS-TSIG as described in RFC 3645. TSIG relies on
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts a shared secret that should only be known to
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts <span><strong class="command">nsupdate</strong></span> and the name server. Currently,
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts the only supported encryption algorithm for TSIG is HMAC-MD5,
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington which is defined in RFC 2104. Once other algorithms are
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington defined for TSIG, applications will need to ensure they select
2a078b3a4ba77260d6dc865a094b344102d74f10Phill Cunnington the appropriate algorithm as well as the key when authenticating
7ea5bf6f5453920e7b69ca8c2e0890834a03867dPhill Cunnington each other. For instance, suitable <span class="type">key</span> and
af38905e8a5231702db169603d942d5d2e0c4332David Luna <span class="type">server</span> statements would be added to
af38905e8a5231702db169603d942d5d2e0c4332David Luna <code class="filename">/etc/named.conf</code> so that the name server
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts can associate the appropriate secret key and algorithm with
af38905e8a5231702db169603d942d5d2e0c4332David Luna the IP address of the client application that will be using
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington TSIG authentication. SIG(0) uses public key cryptography.
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington To use a SIG(0) key, the public key must be stored in a KEY
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington record in a zone served by the name server.
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <span><strong class="command">nsupdate</strong></span> does not read
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <code class="filename">/etc/named.conf</code>.
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts GSS-TSIG uses Kerberos credentials. Standard GSS-TSIG mode
4ccae7e16b9ab014016a21612e4b9a62739f73d6tom.rumsey@forgerock.com is switched on with the <code class="option">-g</code> flag. A
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington non-standards-compliant variant of GSS-TSIG used by Windows
7ea5bf6f5453920e7b69ca8c2e0890834a03867dPhill Cunnington 2000 can be switched on with the <code class="option">-o</code> flag.
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts<p><span><strong class="command">nsupdate</strong></span>
af38905e8a5231702db169603d942d5d2e0c4332David Luna uses the <code class="option">-y</code> or <code class="option">-k</code> option
af38905e8a5231702db169603d942d5d2e0c4332David Luna to provide the shared secret needed to generate a TSIG record
af38905e8a5231702db169603d942d5d2e0c4332David Luna for authenticating Dynamic DNS update requests, default type
4ccae7e16b9ab014016a21612e4b9a62739f73d6tom.rumsey@forgerock.com HMAC-MD5. These options are mutually exclusive.
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington When the <code class="option">-y</code> option is used, a signature is
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington generated from
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington [<span class="optional"><em class="parameter"><code>hmac:</code></em></span>]<em class="parameter"><code>keyname:secret.</code></em>
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <em class="parameter"><code>keyname</code></em> is the name of the key, and
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <em class="parameter"><code>secret</code></em> is the base64 encoded shared secret.
af38905e8a5231702db169603d942d5d2e0c4332David Luna Use of the <code class="option">-y</code> option is discouraged because the
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington shared secret is supplied as a command line argument in clear text.
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington This may be visible in the output from
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <span class="citerefentry"><span class="refentrytitle">ps</span>(1)</span>
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington or in a history file maintained by the user's shell.
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <code class="option">-k</code> option, <span><strong class="command">nsupdate</strong></span> reads
d073f81ace75b12b4e03e6a47cc1f302768e76c2Kohei Tamura the shared secret from the file <em class="parameter"><code>keyfile</code></em>.
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington Keyfiles may be in two formats: a single file containing
fde1057bd7d85a23fbbcc4cac1475339c2d3ea78sachiko a <code class="filename">named.conf</code>-format <span><strong class="command">key</strong></span>
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington statement, which may be generated automatically by
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <span><strong class="command">ddns-confgen</strong></span>, or a pair of files whose names are
8b50bfd37c2effc28b20794adb6dbf7263ca9423Jaco Jooste of the format <code class="filename">K{name}.+157.+{random}.key</code> and
8b50bfd37c2effc28b20794adb6dbf7263ca9423Jaco Jooste <code class="filename">K{name}.+157.+{random}.private</code>, which can be
8b50bfd37c2effc28b20794adb6dbf7263ca9423Jaco Jooste generated by <span><strong class="command">dnssec-keygen</strong></span>.
8b50bfd37c2effc28b20794adb6dbf7263ca9423Jaco Jooste The <code class="option">-k</code> may also be used to specify a SIG(0) key used
8b50bfd37c2effc28b20794adb6dbf7263ca9423Jaco Jooste to authenticate Dynamic DNS update requests. In this case, the key
8b50bfd37c2effc28b20794adb6dbf7263ca9423Jaco Jooste specified is not an HMAC-MD5 key.
8b50bfd37c2effc28b20794adb6dbf7263ca9423Jaco Jooste <span><strong class="command">nsupdate</strong></span> can be run in a local-host only mode
8b50bfd37c2effc28b20794adb6dbf7263ca9423Jaco Jooste using the <code class="option">-l</code> flag. This sets the server address to
8b50bfd37c2effc28b20794adb6dbf7263ca9423Jaco Jooste localhost (disabling the <span><strong class="command">server</strong></span> so that the server
8b50bfd37c2effc28b20794adb6dbf7263ca9423Jaco Jooste address cannot be overridden). Connections to the local server will
8b50bfd37c2effc28b20794adb6dbf7263ca9423Jaco Jooste use a TSIG key found in <code class="filename">/var/run/named/session.key</code>,
8b50bfd37c2effc28b20794adb6dbf7263ca9423Jaco Jooste which is automatically generated by <span><strong class="command">named</strong></span> if any
8b50bfd37c2effc28b20794adb6dbf7263ca9423Jaco Jooste local master zone has set <span><strong class="command">update-policy</strong></span> to
fde1057bd7d85a23fbbcc4cac1475339c2d3ea78sachiko <span><strong class="command">local</strong></span>. The location of this key file can be
8b50bfd37c2effc28b20794adb6dbf7263ca9423Jaco Jooste overridden with the <code class="option">-k</code> option.
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington By default, <span><strong class="command">nsupdate</strong></span>
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington uses UDP to send update requests to the name server unless they are too
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington large to fit in a UDP request in which case TCP will be used.
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <span><strong class="command">nsupdate</strong></span>
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington use a TCP connection.
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington This may be preferable when a batch of update requests is made.
fde1057bd7d85a23fbbcc4cac1475339c2d3ea78sachiko The <code class="option">-p</code> sets the default port number to use for
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington connections to a name server. The default is 53.
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington The <code class="option">-t</code> option sets the maximum time an update request
c475f480562ac15b83510df11cf52fc4fe5a2294Phill Cunnington take before it is aborted. The default is 300 seconds. Zero can be
c475f480562ac15b83510df11cf52fc4fe5a2294Phill Cunnington to disable the timeout.
c475f480562ac15b83510df11cf52fc4fe5a2294Phill Cunnington The <code class="option">-u</code> option sets the UDP retry interval. The default
d073f81ace75b12b4e03e6a47cc1f302768e76c2Kohei Tamura 3 seconds. If zero, the interval will be computed from the timeout
fde1057bd7d85a23fbbcc4cac1475339c2d3ea78sachiko and number of UDP retries.
c475f480562ac15b83510df11cf52fc4fe5a2294Phill Cunnington The <code class="option">-r</code> option sets the number of UDP retries. The
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington 3. If zero, only one update request will be made.
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington The <code class="option">-R <em class="replaceable"><code>randomdev</code></em></code> option
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington specifies a source of randomness. If the operating system
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington does not provide a <code class="filename">/dev/random</code> or
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington equivalent device, the default source of randomness is keyboard
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington input. <code class="filename">randomdev</code> specifies the name of
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington a character device or file containing random data to be used
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington instead of the default. The special value
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <code class="filename">keyboard</code> indicates that keyboard input
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington should be used. This option may be specified multiple times.
bc1297c160473cdce30cff6d7ceb56024fc3fcfdJames Phillpotts Other types can be entered using "TYPEXXXXX" where "XXXXX" is the
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington decimal value of the type with no leading zeros. The rdata,
bc1297c160473cdce30cff6d7ceb56024fc3fcfdJames Phillpotts if present, will be parsed using the UNKNOWN rdata format,
bc1297c160473cdce30cff6d7ceb56024fc3fcfdJames Phillpotts (<backslash> <hash> <space> <length>
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <space> <hexstring>).
fde1057bd7d85a23fbbcc4cac1475339c2d3ea78sachiko The <code class="option">-T</code> and <code class="option">-P</code> options print out
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington lists of non-meta types for which the type-specific presentation
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington formats are known. <code class="option">-T</code> prints out the list of
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington IANA-assigned types. <code class="option">-P</code> prints out the list of
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts private types specific to <span><strong class="command">named</strong></span>. These options
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts may be combined. <span><strong class="command">nsupdate</strong></span> will exit after the
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts lists are printed.
9a78cf0b18d446d577c829d946694e85c75bd851Kohei Tamura<p><span><strong class="command">nsupdate</strong></span>
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts reads input from
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts <em class="parameter"><code>filename</code></em>
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts or standard input.
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts Each command is supplied on exactly one line of input.
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts Some commands are for administrative purposes.
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts The others are either update instructions or prerequisite checks on the
9a78cf0b18d446d577c829d946694e85c75bd851Kohei Tamura contents of the zone.
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts These checks set conditions that some name or set of
9a78cf0b18d446d577c829d946694e85c75bd851Kohei Tamura resource records (RRset) either exists or is absent from the zone.
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington These conditions must be met if the entire update request is to succeed.
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington Updates will be rejected if the tests for the prerequisite conditions
c4e6ca0941fb9b26059729d0184c5c710ab8810bJames Phillpotts Every update request consists of zero or more prerequisites
c4e6ca0941fb9b26059729d0184c5c710ab8810bJames Phillpotts and zero or more updates.
c4e6ca0941fb9b26059729d0184c5c710ab8810bJames Phillpotts This allows a suitably authenticated update request to proceed if some
c4e6ca0941fb9b26059729d0184c5c710ab8810bJames Phillpotts specified resource records are present or missing from the zone.
bc1297c160473cdce30cff6d7ceb56024fc3fcfdJames Phillpotts A blank input line (or the <span><strong class="command">send</strong></span> command)
bc1297c160473cdce30cff6d7ceb56024fc3fcfdJames Phillpotts accumulated commands to be sent as one Dynamic DNS update request to the
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington The command formats and their meaning are as follows:
bc1297c160473cdce30cff6d7ceb56024fc3fcfdJames Phillpotts <span><strong class="command">server</strong></span>
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington Sends all dynamic update requests to the name server
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <em class="parameter"><code>servername</code></em>.
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington When no server statement is provided,
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <span><strong class="command">nsupdate</strong></span>
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington will send updates to the master server of the correct zone.
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington The MNAME field of that zone's SOA record will identify the
c4e6ca0941fb9b26059729d0184c5c710ab8810bJames Phillpotts server for that zone.
c4e6ca0941fb9b26059729d0184c5c710ab8810bJames Phillpotts <em class="parameter"><code>port</code></em>
c4e6ca0941fb9b26059729d0184c5c710ab8810bJames Phillpotts is the port number on
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts <em class="parameter"><code>servername</code></em>
c4e6ca0941fb9b26059729d0184c5c710ab8810bJames Phillpotts where the dynamic update requests get sent.
6d9cceb82dc699b66fa8921d947a003c38081958Phill Cunnington If no port number is specified, the default DNS port number of
c4e6ca0941fb9b26059729d0184c5c710ab8810bJames Phillpotts <span><strong class="command">local</strong></span>
c4e6ca0941fb9b26059729d0184c5c710ab8810bJames Phillpotts Sends all dynamic update requests using the local
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <em class="parameter"><code>address</code></em>.
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington When no local statement is provided,
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <span><strong class="command">nsupdate</strong></span>
c4e6ca0941fb9b26059729d0184c5c710ab8810bJames Phillpotts will send updates using an address and port chosen by the
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <em class="parameter"><code>port</code></em>
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington can additionally be used to make requests come from a specific
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington If no port number is specified, the system will assign one.
d073f81ace75b12b4e03e6a47cc1f302768e76c2Kohei Tamura <span><strong class="command">zone</strong></span>
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington Specifies that all updates are to be made to the zone
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <em class="parameter"><code>zonename</code></em>.
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts <em class="parameter"><code>zone</code></em>
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts statement is provided,
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts <span><strong class="command">nsupdate</strong></span>
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts will attempt determine the correct zone to update based on the
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts rest of the input.
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts Specify the default class.
c4e6ca0941fb9b26059729d0184c5c710ab8810bJames Phillpotts If no <em class="parameter"><code>class</code></em> is specified, the
c4e6ca0941fb9b26059729d0184c5c710ab8810bJames Phillpotts default class is
c4e6ca0941fb9b26059729d0184c5c710ab8810bJames Phillpotts <em class="parameter"><code>IN</code></em>.
c4e6ca0941fb9b26059729d0184c5c710ab8810bJames Phillpotts <span><strong class="command">ttl</strong></span>
c4e6ca0941fb9b26059729d0184c5c710ab8810bJames Phillpotts Specify the default time to live for records to be added.
c4e6ca0941fb9b26059729d0184c5c710ab8810bJames Phillpotts The value <em class="parameter"><code>none</code></em> will clear the default
c4e6ca0941fb9b26059729d0184c5c710ab8810bJames Phillpotts <span><strong class="command">key</strong></span>
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts Specifies that all updates are to be TSIG-signed using the
09e129712bddf6a9ba4cb1b6308fd691dfed6cfcJaco Jooste <em class="parameter"><code>keyname</code></em> <em class="parameter"><code>keysecret</code></em> pair.
09e129712bddf6a9ba4cb1b6308fd691dfed6cfcJaco Jooste The <span><strong class="command">key</strong></span> command
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts overrides any key specified on the command line via
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts <code class="option">-y</code> or <code class="option">-k</code>.
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts <span><strong class="command">gsstsig</strong></span>
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts Use GSS-TSIG to sign the updated. This is equivalent to
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts specifying <code class="option">-g</code> on the commandline.
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts <span><strong class="command">oldgsstsig</strong></span>
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts Use the Windows 2000 version of GSS-TSIG to sign the updated.
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts This is equivalent to specifying <code class="option">-o</code> on the
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts <span><strong class="command">realm</strong></span>
c4e6ca0941fb9b26059729d0184c5c710ab8810bJames Phillpotts {[<span class="optional">realm_name</span>]}
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts When using GSS-TSIG use <em class="parameter"><code>realm_name</code></em> rather
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts than the default realm in <code class="filename">krb5.conf</code>. If no
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts realm is specified the saved realm is cleared.
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts <span><strong class="command">[<span class="optional">prereq</span>] nxdomain</strong></span>
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts {domain-name}
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts Requires that no resource record of any type exists with name
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts <em class="parameter"><code>domain-name</code></em>.
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts <span><strong class="command">[<span class="optional">prereq</span>] yxdomain</strong></span>
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts {domain-name}
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts Requires that
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts <em class="parameter"><code>domain-name</code></em>
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts exists (has as at least one resource record, of any type).
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts <span><strong class="command">[<span class="optional">prereq</span>] nxrrset</strong></span>
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts {domain-name}
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts Requires that no resource record exists of the specified
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts <em class="parameter"><code>type</code></em>,
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts <em class="parameter"><code>class</code></em>
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts <em class="parameter"><code>domain-name</code></em>.
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <em class="parameter"><code>class</code></em>
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington is omitted, IN (internet) is assumed.
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts <span><strong class="command">[<span class="optional">prereq</span>] yxrrset</strong></span>
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts {domain-name}
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts This requires that a resource record of the specified
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts <em class="parameter"><code>type</code></em>,
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts <em class="parameter"><code>class</code></em>
890e45d5d1d4e645bdc383789987be390dd622caJames Phillpotts <em class="parameter"><code>domain-name</code></em>
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington is omitted, IN (internet) is assumed.
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <span><strong class="command">[<span class="optional">prereq</span>] yxrrset</strong></span>
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington {domain-name}
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <em class="parameter"><code>data</code></em>
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington from each set of prerequisites of this form
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington sharing a common
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <em class="parameter"><code>type</code></em>,
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <em class="parameter"><code>class</code></em>,
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <em class="parameter"><code>domain-name</code></em>
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington are combined to form a set of RRs. This set of RRs must
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington exactly match the set of RRs existing in the zone at the
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <em class="parameter"><code>type</code></em>,
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <em class="parameter"><code>class</code></em>,
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <em class="parameter"><code>domain-name</code></em>.
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <em class="parameter"><code>data</code></em>
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington are written in the standard text representation of the resource
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <span><strong class="command">[<span class="optional">update</span>] del[<span class="optional">ete</span>]</strong></span>
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington {domain-name}
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington [type [data...]]
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington Deletes any resource records named
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <em class="parameter"><code>domain-name</code></em>.
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <em class="parameter"><code>type</code></em>
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <em class="parameter"><code>data</code></em>
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington is provided, only matching resource records will be removed.
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington The internet class is assumed if
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <em class="parameter"><code>class</code></em>
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington is not supplied. The
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <em class="parameter"><code>ttl</code></em>
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington is ignored, and is only allowed for compatibility.
af38905e8a5231702db169603d942d5d2e0c4332David Luna <span><strong class="command">[<span class="optional">update</span>] add</strong></span>
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington {domain-name}
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington Adds a new resource record with the specified
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <em class="parameter"><code>ttl</code></em>,
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <em class="parameter"><code>class</code></em>
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <span><strong class="command">show</strong></span>
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington Displays the current message, containing all of the
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington prerequisites and
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington updates specified since the last send.
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <span><strong class="command">send</strong></span>
d073f81ace75b12b4e03e6a47cc1f302768e76c2Kohei Tamura Sends the current message. This is equivalent to entering a
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <span><strong class="command">answer</strong></span>
09d987f2d0d15b303bba92d3762081b6f9491638Kohei Tamura Displays the answer.
09d987f2d0d15b303bba92d3762081b6f9491638Kohei Tamura <span><strong class="command">debug</strong></span>
09d987f2d0d15b303bba92d3762081b6f9491638Kohei Tamura Turn on debugging.
09d987f2d0d15b303bba92d3762081b6f9491638Kohei Tamura Lines beginning with a semicolon are comments and are ignored.
09d987f2d0d15b303bba92d3762081b6f9491638Kohei Tamura The examples below show how
09d987f2d0d15b303bba92d3762081b6f9491638Kohei Tamura <span><strong class="command">nsupdate</strong></span>
09d987f2d0d15b303bba92d3762081b6f9491638Kohei Tamura could be used to insert and delete resource records from the
09d987f2d0d15b303bba92d3762081b6f9491638Kohei Tamura Notice that the input in each example contains a trailing blank line so
09d987f2d0d15b303bba92d3762081b6f9491638Kohei Tamura a group of commands are sent as one dynamic update request to the
09d987f2d0d15b303bba92d3762081b6f9491638Kohei Tamura master name server for
09d987f2d0d15b303bba92d3762081b6f9491638Kohei Tamura> update delete oldhost.example.com A
09d987f2d0d15b303bba92d3762081b6f9491638Kohei Tamura> update add newhost.example.com 86400 A 172.16.1.1
09d987f2d0d15b303bba92d3762081b6f9491638Kohei Tamura Any A records for
09d987f2d0d15b303bba92d3762081b6f9491638Kohei Tamura are deleted.
09d987f2d0d15b303bba92d3762081b6f9491638Kohei Tamura And an A record for
09d987f2d0d15b303bba92d3762081b6f9491638Kohei Tamura with IP address 172.16.1.1 is added.
09d987f2d0d15b303bba92d3762081b6f9491638Kohei Tamura The newly-added record has a 1 day TTL (86400 seconds).
09d987f2d0d15b303bba92d3762081b6f9491638Kohei Tamura> prereq nxdomain nickname.example.com
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington> update add nickname.example.com 86400 CNAME somehost.example.com
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington The prerequisite condition gets the name server to check that there
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington are no resource records of any type for
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington <span class="type">nickname.example.com</span>.
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington If there are, the update request fails.
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington If this name does not exist, a CNAME for it is added.
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington This ensures that when the CNAME is added, it cannot conflict with the
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington long-standing rule in RFC 1034 that a name must not exist as any other
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington record type if it exists as a CNAME.
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington (The rule has been updated for DNSSEC in RFC 2535 to allow CNAMEs to have
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington RRSIG, DNSKEY and NSEC records.)
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington<dt><span class="term"><code class="constant">/etc/resolv.conf</code></span></dt>
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington used to identify default name server
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington<dt><span class="term"><code class="constant">/var/run/named/session.key</code></span></dt>
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington sets the default TSIG key for use in local-only mode
756d4b8bce5a58e5bd8fe686688b6c42d2e7052bPhill Cunnington<dt><span class="term"><code class="constant">K{name}.+157.+{random}.key</code></span></dt>
af38905e8a5231702db169603d942d5d2e0c4332David Luna base-64 encoding of HMAC-MD5 key created by
2cea600e37e6258f33806dad6e4ffc8230bed58fPhill Cunnington <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>.
2cea600e37e6258f33806dad6e4ffc8230bed58fPhill Cunnington<dt><span class="term"><code class="constant">K{name}.+157.+{random}.private</code></span></dt>
2cea600e37e6258f33806dad6e4ffc8230bed58fPhill Cunnington base-64 encoding of HMAC-MD5 key created by
2cea600e37e6258f33806dad6e4ffc8230bed58fPhill Cunnington <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>.
2cea600e37e6258f33806dad6e4ffc8230bed58fPhill Cunnington <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
2cea600e37e6258f33806dad6e4ffc8230bed58fPhill Cunnington <span class="citerefentry"><span class="refentrytitle">ddns-confgen</span>(8)</span>,
2cea600e37e6258f33806dad6e4ffc8230bed58fPhill Cunnington <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>.
8d75f7fba11e555d87ff0f6f2a7504681c482e0bNeil Madden The TSIG key is redundantly stored in two separate files.
8d75f7fba11e555d87ff0f6f2a7504681c482e0bNeil Madden This is a consequence of nsupdate using the DST library
8d75f7fba11e555d87ff0f6f2a7504681c482e0bNeil Madden for its cryptographic operations, and may change in future
8d75f7fba11e555d87ff0f6f2a7504681c482e0bNeil Madden<a accesskey="p" href="man.named-journalprint.html">Prev</a>�</td>
8d75f7fba11e555d87ff0f6f2a7504681c482e0bNeil Madden<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
8d75f7fba11e555d87ff0f6f2a7504681c482e0bNeil Madden<td width="40%" align="right">�<a accesskey="n" href="man.rndc.html">Next</a>
8d75f7fba11e555d87ff0f6f2a7504681c482e0bNeil Madden<span class="application">named-journalprint</span>�</td>
8d75f7fba11e555d87ff0f6f2a7504681c482e0bNeil Madden<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
8d75f7fba11e555d87ff0f6f2a7504681c482e0bNeil Madden<td width="40%" align="right" valign="top">�<span class="application">rndc</span>