man.rndc.conf.html revision 0ce865f8b2e652d6fe0c029e3538f4cc7e009fe1
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - Copyright (C) 2000-2016 Internet Systems Consortium, Inc. ("ISC")
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - This Source Code Form is subject to the terms of the Mozilla Public
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - License, v. 2.0. If a copy of the MPL was not distributed with this
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync - file, You can obtain one at http://mozilla.org/MPL/2.0/.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<link rel="next" href="man.rndc-confgen.html" title="rndc-confgen">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<tr><th colspan="3" align="center"><code class="filename">rndc.conf</code></th></tr>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<a accesskey="p" href="man.rndc.html">Prev</a>�</td>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<td width="20%" align="right">�<a accesskey="n" href="man.rndc-confgen.html">Next</a>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<a name="man.rndc.conf"></a><div class="titlepage"></div>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync — rndc configuration file
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <p><code class="filename">rndc.conf</code> is the configuration file
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync for <span class="command"><strong>rndc</strong></span>, the BIND 9 name server control
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync utility. This file has a similar structure and syntax to
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <code class="filename">named.conf</code>. Statements are enclosed
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync in braces and terminated with a semi-colon. Clauses in
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync the statements are also semi-colon terminated. The usual
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync comment styles are supported:
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync C style: /* */
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync C++ style: // to end of line
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Unix style: # to end of line
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <p><code class="filename">rndc.conf</code> is much simpler than
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <code class="filename">named.conf</code>. The file uses three
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync statements: an options statement, a server statement
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync and a key statement.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync The <code class="option">options</code> statement contains five clauses.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync The <code class="option">default-server</code> clause is followed by the
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync name or address of a name server. This host will be used when
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync no name server is given as an argument to
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="command"><strong>rndc</strong></span>. The <code class="option">default-key</code>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync clause is followed by the name of a key which is identified by
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <code class="option">keyid</code> is provided on the rndc command line,
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync and no <code class="option">key</code> clause is found in a matching
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <code class="option">server</code> statement, this default key will be
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync used to authenticate the server's commands and responses. The
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <code class="option">default-port</code> clause is followed by the port
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync to connect to on the remote name server. If no
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <code class="option">port</code> option is provided on the rndc command
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync line, and no <code class="option">port</code> clause is found in a
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync matching <code class="option">server</code> statement, this default port
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync will be used to connect.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync The <code class="option">default-source-address</code> and
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <code class="option">default-source-address-v6</code> clauses which
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync can be used to set the IPv4 and IPv6 source addresses
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync respectively.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync After the <code class="option">server</code> keyword, the server
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync statement includes a string which is the hostname or address
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync for a name server. The statement has three possible clauses:
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <code class="option">key</code>, <code class="option">port</code> and
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <code class="option">addresses</code>. The key name must match the
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync name of a key statement in the file. The port number
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync specifies the port to connect to. If an <code class="option">addresses</code>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync clause is supplied these addresses will be used instead of
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync the server name. Each address can take an optional port.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync If an <code class="option">source-address</code> or <code class="option">source-address-v6</code>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync of supplied then these will be used to specify the IPv4 and IPv6
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync source addresses respectively.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync The <code class="option">key</code> statement begins with an identifying
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync string, the name of the key. The statement has two clauses.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <code class="option">algorithm</code> identifies the authentication algorithm
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync for <span class="command"><strong>rndc</strong></span> to use; currently only HMAC-MD5
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync (for compatibility), HMAC-SHA1, HMAC-SHA224, HMAC-SHA256
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync (default), HMAC-SHA384 and HMAC-SHA512 are
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync supported. This is followed by a secret clause which contains
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync the base-64 encoding of the algorithm's authentication key. The
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync base-64 string is enclosed in double quotes.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync There are two common ways to generate the base-64 string for the
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync secret. The BIND 9 program <span class="command"><strong>rndc-confgen</strong></span>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync be used to generate a random key, or the
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="command"><strong>mmencode</strong></span> program, also known as
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <span class="command"><strong>mimencode</strong></span>, can be used to generate a
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync string from known input. <span class="command"><strong>mmencode</strong></span> does
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync ship with BIND 9 but is available on many systems. See the
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync EXAMPLE section for sample command lines for each.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync default-server localhost;
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync default-key samplekey;
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync server localhost {
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync key samplekey;
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync server testserver {
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync key testkey;
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync addresses { localhost port 5353; };
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync key samplekey {
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync algorithm hmac-sha256;
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync secret "6FMfj43Osz4lyb24OIe2iGEz9lf1llJO+lz";
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync key testkey {
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync algorithm hmac-sha256;
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync secret "R3HI8P6BKw9ZwXwN3VZKuQ==";
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync In the above example, <span class="command"><strong>rndc</strong></span> will by
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync default use
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync the server at localhost (127.0.0.1) and the key called samplekey.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Commands to the localhost server will use the samplekey key, which
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync must also be defined in the server's configuration file with the
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync same name and secret. The key statement indicates that samplekey
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync uses the HMAC-SHA256 algorithm and its secret clause contains the
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync base-64 encoding of the HMAC-SHA256 secret enclosed in double quotes.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync If <span class="command"><strong>rndc -s testserver</strong></span> is used then <span class="command"><strong>rndc</strong></span> will
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync connect to server on localhost port 5353 using the key testkey.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync To generate a random secret with <span class="command"><strong>rndc-confgen</strong></span>:
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <p><strong class="userinput"><code>rndc-confgen</code></strong>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync A complete <code class="filename">rndc.conf</code> file, including
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync randomly generated key, will be written to the standard
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync output. Commented-out <code class="option">key</code> and
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <code class="option">controls</code> statements for
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <code class="filename">named.conf</code> are also printed.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync To generate a base-64 secret with <span class="command"><strong>mmencode</strong></span>:
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <p><strong class="userinput"><code>echo "known plaintext for a secret" | mmencode</code></strong>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<a name="id-1.14.28.9"></a><h2>NAME SERVER CONFIGURATION</h2>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync The name server must be configured to accept rndc connections and
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync to recognize the key specified in the <code class="filename">rndc.conf</code>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync file, using the controls statement in <code class="filename">named.conf</code>.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync See the sections on the <code class="option">controls</code> statement in the
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync BIND 9 Administrator Reference Manual for details.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<a accesskey="p" href="man.rndc.html">Prev</a>�</td>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<td width="40%" align="right">�<a accesskey="n" href="man.rndc-confgen.html">Next</a>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<td width="40%" align="right" valign="top">�<span class="application">rndc-confgen</span>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.1rc1</p>