man.nsupdate.html revision e4adb07cc1f8253b3c39aeeeb3ea03dc5b7011cc
31cee6f634ce07aa2c3514a506f93830f91f14a5Lennart Poettering - Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
31cee6f634ce07aa2c3514a506f93830f91f14a5Lennart Poettering - Copyright (C) 2000-2003 Internet Software Consortium.
31cee6f634ce07aa2c3514a506f93830f91f14a5Lennart Poettering - Permission to use, copy, modify, and/or distribute this software for any
31cee6f634ce07aa2c3514a506f93830f91f14a5Lennart Poettering - purpose with or without fee is hereby granted, provided that the above
31cee6f634ce07aa2c3514a506f93830f91f14a5Lennart Poettering - copyright notice and this permission notice appear in all copies.
31cee6f634ce07aa2c3514a506f93830f91f14a5Lennart Poettering - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
9fa2f41077b2d76685058836f602f38715b5eef3Kay Sievers - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
9fa2f41077b2d76685058836f602f38715b5eef3Kay Sievers - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
31cee6f634ce07aa2c3514a506f93830f91f14a5Lennart Poettering - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
31cee6f634ce07aa2c3514a506f93830f91f14a5Lennart Poettering - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
9fa2f41077b2d76685058836f602f38715b5eef3Kay Sievers - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
31cee6f634ce07aa2c3514a506f93830f91f14a5Lennart Poettering - PERFORMANCE OF THIS SOFTWARE.
31cee6f634ce07aa2c3514a506f93830f91f14a5Lennart Poettering<!-- $Id: man.nsupdate.html,v 1.71 2009/10/27 01:14:46 tbox Exp $ -->
31cee6f634ce07aa2c3514a506f93830f91f14a5Lennart Poettering<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
31cee6f634ce07aa2c3514a506f93830f91f14a5Lennart Poettering<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
31cee6f634ce07aa2c3514a506f93830f91f14a5Lennart Poettering<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
31cee6f634ce07aa2c3514a506f93830f91f14a5Lennart Poettering<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
31cee6f634ce07aa2c3514a506f93830f91f14a5Lennart Poettering<link rel="prev" href="man.named.html" title="named">
31cee6f634ce07aa2c3514a506f93830f91f14a5Lennart Poettering<link rel="next" href="man.rndc.html" title="rndc">
5430f7f2bc7330f3088b894166bf3524a067e3d8Lennart Poettering<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
31cee6f634ce07aa2c3514a506f93830f91f14a5Lennart Poettering<table width="100%" summary="Navigation header">
673eab9bf0d2d79a72f3d7c430807b8786de7ee3Lennart Poettering<tr><th colspan="3" align="center"><span class="application">nsupdate</span></th></tr>
f28cbd0382ca53baa99803bbc907a469fbf68128Kay Sievers<a accesskey="p" href="man.named.html">Prev</a>�</td>
673eab9bf0d2d79a72f3d7c430807b8786de7ee3Lennart Poettering<th width="60%" align="center">Manual pages</th>
31cee6f634ce07aa2c3514a506f93830f91f14a5Lennart Poettering<td width="20%" align="right">�<a accesskey="n" href="man.rndc.html">Next</a>
713bc0cfa477ca1df8769041cb3dbc83c10eace2Kay Sievers<a name="man.nsupdate"></a><div class="titlepage"></div>
713bc0cfa477ca1df8769041cb3dbc83c10eace2Kay Sievers<p><span class="application">nsupdate</span> — Dynamic DNS update utility</p>
f28cbd0382ca53baa99803bbc907a469fbf68128Kay Sievers<div class="cmdsynopsis"><p><code class="command">nsupdate</code> [<code class="option">-d</code>] [<code class="option">-D</code>] [[<code class="option">-g</code>] | [<code class="option">-o</code>] | [<code class="option">-l</code>] | [<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></code>] | [<code class="option">-k <em class="replaceable"><code>keyfile</code></em></code>]] [<code class="option">-t <em class="replaceable"><code>timeout</code></em></code>] [<code class="option">-u <em class="replaceable"><code>udptimeout</code></em></code>] [<code class="option">-r <em class="replaceable"><code>udpretries</code></em></code>] [<code class="option">-R <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-v</code>] [filename]</p></div>
713bc0cfa477ca1df8769041cb3dbc83c10eace2Kay Sievers<p><span><strong class="command">nsupdate</strong></span>
713bc0cfa477ca1df8769041cb3dbc83c10eace2Kay Sievers is used to submit Dynamic DNS Update requests as defined in RFC 2136
713bc0cfa477ca1df8769041cb3dbc83c10eace2Kay Sievers to a name server.
713bc0cfa477ca1df8769041cb3dbc83c10eace2Kay Sievers This allows resource records to be added or removed from a zone
713bc0cfa477ca1df8769041cb3dbc83c10eace2Kay Sievers without manually editing the zone file.
713bc0cfa477ca1df8769041cb3dbc83c10eace2Kay Sievers A single update request can contain requests to add or remove more than
713bc0cfa477ca1df8769041cb3dbc83c10eace2Kay Sievers resource record.
713bc0cfa477ca1df8769041cb3dbc83c10eace2Kay Sievers Zones that are under dynamic control via
713bc0cfa477ca1df8769041cb3dbc83c10eace2Kay Sievers <span><strong class="command">nsupdate</strong></span>
713bc0cfa477ca1df8769041cb3dbc83c10eace2Kay Sievers or a DHCP server should not be edited by hand.
713bc0cfa477ca1df8769041cb3dbc83c10eace2Kay Sievers Manual edits could
713bc0cfa477ca1df8769041cb3dbc83c10eace2Kay Sievers conflict with dynamic updates and cause data to be lost.
713bc0cfa477ca1df8769041cb3dbc83c10eace2Kay Sievers The resource records that are dynamically added or removed with
713bc0cfa477ca1df8769041cb3dbc83c10eace2Kay Sievers <span><strong class="command">nsupdate</strong></span>
713bc0cfa477ca1df8769041cb3dbc83c10eace2Kay Sievers have to be in the same zone.
713bc0cfa477ca1df8769041cb3dbc83c10eace2Kay Sievers Requests are sent to the zone's master server.
713bc0cfa477ca1df8769041cb3dbc83c10eace2Kay Sievers This is identified by the MNAME field of the zone's SOA record.
f28cbd0382ca53baa99803bbc907a469fbf68128Kay Sievers option makes
f28cbd0382ca53baa99803bbc907a469fbf68128Kay Sievers <span><strong class="command">nsupdate</strong></span>
77b6e19458f37cfde127ec6aa9494c0ac45ad890Lennart Poettering operate in debug mode.
77b6e19458f37cfde127ec6aa9494c0ac45ad890Lennart Poettering This provides tracing information about the update requests that are
77b6e19458f37cfde127ec6aa9494c0ac45ad890Lennart Poettering made and the replies received from the name server.
77b6e19458f37cfde127ec6aa9494c0ac45ad890Lennart Poettering The <code class="option">-D</code> option makes <span><strong class="command">nsupdate</strong></span>
77b6e19458f37cfde127ec6aa9494c0ac45ad890Lennart Poettering report additional debugging information to <code class="option">-d</code>.
e30431623a7d871da123cc37055ac49abf2c20eaTom Gundersen The <code class="option">-L</code> option with an integer argument of zero or
f4f8f7b546508e1e7c94b072df685ac1342e8d7eMichael Biebl higher sets the logging debug level. If zero, logging is disabled.
3ede835a0486f2ecc025dede0b33e9a1edc06d30Lennart Poettering Transaction signatures can be used to authenticate the Dynamic
19d5d4cb6a89c844e298eb65bce6ba0fa9d58b91Zbigniew Jędrzejewski-Szmek DNS updates. These use the TSIG resource record type described
fb0951b02ebf51a93acf12721d8857d31ce57ba3Lennart Poettering in RFC 2845 or the SIG(0) record described in RFC 2535 and
3ede835a0486f2ecc025dede0b33e9a1edc06d30Lennart Poettering RFC 2931 or GSS-TSIG as described in RFC 3645. TSIG relies on
19d5d4cb6a89c844e298eb65bce6ba0fa9d58b91Zbigniew Jędrzejewski-Szmek a shared secret that should only be known to
3ede835a0486f2ecc025dede0b33e9a1edc06d30Lennart Poettering <span><strong class="command">nsupdate</strong></span> and the name server. Currently,
7b17a7d72f5ba5ad838b19803534c56a46f3bce9Lennart Poettering the only supported encryption algorithm for TSIG is HMAC-MD5,
7b17a7d72f5ba5ad838b19803534c56a46f3bce9Lennart Poettering which is defined in RFC 2104. Once other algorithms are
7b17a7d72f5ba5ad838b19803534c56a46f3bce9Lennart Poettering defined for TSIG, applications will need to ensure they select
2cc86f094a8c316f7feb0336df3827a3264b116dZbigniew Jędrzejewski-Szmek the appropriate algorithm as well as the key when authenticating
2cc86f094a8c316f7feb0336df3827a3264b116dZbigniew Jędrzejewski-Szmek each other. For instance, suitable <span class="type">key</span> and
2cc86f094a8c316f7feb0336df3827a3264b116dZbigniew Jędrzejewski-Szmek <span class="type">server</span> statements would be added to
2cc86f094a8c316f7feb0336df3827a3264b116dZbigniew Jędrzejewski-Szmek <code class="filename">/etc/named.conf</code> so that the name server
2cc86f094a8c316f7feb0336df3827a3264b116dZbigniew Jędrzejewski-Szmek can associate the appropriate secret key and algorithm with
c3d2d86d4f40593a361e33b101f5384a8ea2cdb7Tom Gundersen the IP address of the client application that will be using
c3d2d86d4f40593a361e33b101f5384a8ea2cdb7Tom Gundersen TSIG authentication. SIG(0) uses public key cryptography.
2cc86f094a8c316f7feb0336df3827a3264b116dZbigniew Jędrzejewski-Szmek To use a SIG(0) key, the public key must be stored in a KEY
46ba8aae2b82bc5c87ba347e6bf914ecd5e9d51eLennart Poettering record in a zone served by the name server.
3ede835a0486f2ecc025dede0b33e9a1edc06d30Lennart Poettering <span><strong class="command">nsupdate</strong></span> does not read
2cc86f094a8c316f7feb0336df3827a3264b116dZbigniew Jędrzejewski-Szmek <code class="filename">/etc/named.conf</code>.
3ede835a0486f2ecc025dede0b33e9a1edc06d30Lennart Poettering GSS-TSIG uses Kerberos credentials. Standard GSS-TSIG mode
3ede835a0486f2ecc025dede0b33e9a1edc06d30Lennart Poettering is switched on with the <code class="option">-g</code> flag. A
3ede835a0486f2ecc025dede0b33e9a1edc06d30Lennart Poettering non-standards-compliant variant of GSS-TSIG used by Windows
3ede835a0486f2ecc025dede0b33e9a1edc06d30Lennart Poettering 2000 can be switched on with the <code class="option">-o</code> flag.
b62cfcea00862ccbf0e5e297f8a339f70987edefMichael Biebl<p><span><strong class="command">nsupdate</strong></span>
19d5d4cb6a89c844e298eb65bce6ba0fa9d58b91Zbigniew Jędrzejewski-Szmek uses the <code class="option">-y</code> or <code class="option">-k</code> option
19d5d4cb6a89c844e298eb65bce6ba0fa9d58b91Zbigniew Jędrzejewski-Szmek to provide the shared secret needed to generate a TSIG record
9015fa646e04fc3cb180bea24c33d34edbb48ed7Zbigniew Jędrzejewski-Szmek for authenticating Dynamic DNS update requests, default type
80cb917e6248c15fd4a95d29954b3fd1e3d66b06Zbigniew Jędrzejewski-Szmek HMAC-MD5. These options are mutually exclusive.
fff2e5b58bab7a5ffbb7593742d462197b06728cLennart Poettering When the <code class="option">-y</code> option is used, a signature is
fff2e5b58bab7a5ffbb7593742d462197b06728cLennart Poettering [<span class="optional"><em class="parameter"><code>hmac:</code></em></span>]<em class="parameter"><code>keyname:secret.</code></em>
bf9e477c92506884977d6c8d761969e105528f3eKay Sievers <em class="parameter"><code>keyname</code></em> is the name of the key, and
fff2e5b58bab7a5ffbb7593742d462197b06728cLennart Poettering <em class="parameter"><code>secret</code></em> is the base64 encoded shared secret.
6705c2df468a6afb4f8f834822780add123065e2Lennart Poettering Use of the <code class="option">-y</code> option is discouraged because the
49f43d5f91a99b23f745726aa351d8f159774357Ville Skyttä shared secret is supplied as a command line argument in clear text.
6705c2df468a6afb4f8f834822780add123065e2Lennart Poettering This may be visible in the output from
6705c2df468a6afb4f8f834822780add123065e2Lennart Poettering <span class="citerefentry"><span class="refentrytitle">ps</span>(1)</span>
6705c2df468a6afb4f8f834822780add123065e2Lennart Poettering or in a history file maintained by the user's shell.
9015fa646e04fc3cb180bea24c33d34edbb48ed7Zbigniew Jędrzejewski-Szmek <code class="option">-k</code> option, <span><strong class="command">nsupdate</strong></span> reads
9015fa646e04fc3cb180bea24c33d34edbb48ed7Zbigniew Jędrzejewski-Szmek the shared secret from the file <em class="parameter"><code>keyfile</code></em>.
9015fa646e04fc3cb180bea24c33d34edbb48ed7Zbigniew Jędrzejewski-Szmek Keyfiles may be in two formats: a single file containing
a24c64f03f9c5c0304451d8542fee853187a5168Lennart Poettering a <code class="filename">named.conf</code>-format <span><strong class="command">key</strong></span>
37495eede95d3212b797c8459d7ed6258fb23c6aLennart Poettering statement, which may be generated automatically by
37495eede95d3212b797c8459d7ed6258fb23c6aLennart Poettering <span><strong class="command">ddns-confgen</strong></span>, or a pair of files whose names are
37495eede95d3212b797c8459d7ed6258fb23c6aLennart Poettering of the format <code class="filename">K{name}.+157.+{random}.key</code> and
37495eede95d3212b797c8459d7ed6258fb23c6aLennart Poettering <code class="filename">K{name}.+157.+{random}.private</code>, which can be
37495eede95d3212b797c8459d7ed6258fb23c6aLennart Poettering generated by <span><strong class="command">dnssec-keygen</strong></span>.
37495eede95d3212b797c8459d7ed6258fb23c6aLennart Poettering The <code class="option">-k</code> may also be used to specify a SIG(0) key used
37c0e8f35e92190a22b2ac0fbb23bf396121e84aKay Sievers to authenticate Dynamic DNS update requests. In this case, the key
a24c64f03f9c5c0304451d8542fee853187a5168Lennart Poettering specified is not an HMAC-MD5 key.
a24c64f03f9c5c0304451d8542fee853187a5168Lennart Poettering <span><strong class="command">nsupdate</strong></span> can be run in a local-host only mode
a24c64f03f9c5c0304451d8542fee853187a5168Lennart Poettering using the <code class="option">-l</code> flag. This sets the server address to
a24c64f03f9c5c0304451d8542fee853187a5168Lennart Poettering localhost (disabling the <span><strong class="command">server</strong></span> so that the server
a24c64f03f9c5c0304451d8542fee853187a5168Lennart Poettering address cannot be overridden). Connections to the local server will
a24c64f03f9c5c0304451d8542fee853187a5168Lennart Poettering use a TSIG key found in <code class="filename">/var/run/named/ddns.key</code>,
a24c64f03f9c5c0304451d8542fee853187a5168Lennart Poettering which is automatically generated by <span><strong class="command">named</strong></span> if any
a24c64f03f9c5c0304451d8542fee853187a5168Lennart Poettering local master zone has set <span><strong class="command">update-policy</strong></span> to
a24c64f03f9c5c0304451d8542fee853187a5168Lennart Poettering <span><strong class="command">local</strong></span>. The location of this key file can be
a24c64f03f9c5c0304451d8542fee853187a5168Lennart Poettering overridden with the <code class="option">-k</code> option.
37495eede95d3212b797c8459d7ed6258fb23c6aLennart Poettering By default, <span><strong class="command">nsupdate</strong></span>
37495eede95d3212b797c8459d7ed6258fb23c6aLennart Poettering uses UDP to send update requests to the name server unless they are too
37495eede95d3212b797c8459d7ed6258fb23c6aLennart Poettering large to fit in a UDP request in which case TCP will be used.
21bc923aa35d455cdef1607eb7022608c705c9f3Lennart Poettering <span><strong class="command">nsupdate</strong></span>
21bc923aa35d455cdef1607eb7022608c705c9f3Lennart Poettering use a TCP connection.
21bc923aa35d455cdef1607eb7022608c705c9f3Lennart Poettering This may be preferable when a batch of update requests is made.
21bc923aa35d455cdef1607eb7022608c705c9f3Lennart Poettering The <code class="option">-p</code> sets the default port number to use for
21bc923aa35d455cdef1607eb7022608c705c9f3Lennart Poettering connections to a name server. The default is 53.
21bc923aa35d455cdef1607eb7022608c705c9f3Lennart Poettering The <code class="option">-t</code> option sets the maximum time an update request
21bc923aa35d455cdef1607eb7022608c705c9f3Lennart Poettering take before it is aborted. The default is 300 seconds. Zero can be
aa1671320df5bd8aa4108c0efb34a49fdedd0e5fLennart Poettering to disable the timeout.
1b4bb4fdac4dce4e658aa3743153d77c04d1a331Zbigniew Jędrzejewski-Szmek The <code class="option">-u</code> option sets the UDP retry interval. The default
1b4bb4fdac4dce4e658aa3743153d77c04d1a331Zbigniew Jędrzejewski-Szmek 3 seconds. If zero, the interval will be computed from the timeout
<em class="parameter"><code>keyname</code></em> <em class="parameter"><code>keysecret</code></em> pair.
> update delete oldhost.example.com A
> update add newhost.example.com 86400 A 172.16.1.1
> prereq nxdomain nickname.example.com