man.rndc.conf.html revision 8168c2873909444bdf62325b29fe118a879b22fc
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
f0aad5341752aefe5059832f6cf3abc3283c6e16Tinderbox User - Copyright (C) 2000-2003 Internet Software Consortium.
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User - Permission to use, copy, modify, and/or distribute this software for any
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User - purpose with or without fee is hereby granted, provided that the above
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User - copyright notice and this permission notice appear in all copies.
d6fa26d0adaec6c910115be34fe7a5a5f402c14fMark Andrews - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - PERFORMANCE OF THIS SOFTWARE.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<!-- $Id$ -->
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="prev" href="man.rndc.html" title="rndc">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="next" href="man.rndc-confgen.html" title="rndc-confgen">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<tr><th colspan="3" align="center"><code class="filename">rndc.conf</code></th></tr>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<a accesskey="p" href="man.rndc.html">Prev</a>�</td>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<th width="60%" align="center">Manual pages</th>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="20%" align="right">�<a accesskey="n" href="man.rndc-confgen.html">Next</a>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="man.rndc.conf"></a><div class="titlepage"></div>
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User<p><code class="filename">rndc.conf</code> — rndc configuration file</p>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="cmdsynopsis"><p><code class="command">rndc.conf</code> </p></div>
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews<p><code class="filename">rndc.conf</code> is the configuration file
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for <span><strong class="command">rndc</strong></span>, the BIND 9 name server control
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein utility. This file has a similar structure and syntax to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="filename">named.conf</code>. Statements are enclosed
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in braces and terminated with a semi-colon. Clauses in
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews the statements are also semi-colon terminated. The usual
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein comment styles are supported:
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User C style: /* */
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User C++ style: // to end of line
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Unix style: # to end of line
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews<p><code class="filename">rndc.conf</code> is much simpler than
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews <code class="filename">named.conf</code>. The file uses three
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews statements: an options statement, a server statement
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and a key statement.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User The <code class="option">options</code> statement contains five clauses.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The <code class="option">default-server</code> clause is followed by the
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User name or address of a name server. This host will be used when
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User no name server is given as an argument to
9c6a5d1f22f972232d7a9fd5c5fa64f10bacbdffAutomatic Updater <span><strong class="command">rndc</strong></span>. The <code class="option">default-key</code>
9c6a5d1f22f972232d7a9fd5c5fa64f10bacbdffAutomatic Updater clause is followed by the name of a key which is identified by
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews a <code class="option">key</code> statement. If no
9c6a5d1f22f972232d7a9fd5c5fa64f10bacbdffAutomatic Updater <code class="option">keyid</code> is provided on the rndc command line,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and no <code class="option">key</code> clause is found in a matching
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="option">server</code> statement, this default key will be
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews used to authenticate the server's commands and responses. The
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="option">default-port</code> clause is followed by the port
9c6a5d1f22f972232d7a9fd5c5fa64f10bacbdffAutomatic Updater to connect to on the remote name server. If no
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="option">port</code> option is provided on the rndc command
9c6a5d1f22f972232d7a9fd5c5fa64f10bacbdffAutomatic Updater line, and no <code class="option">port</code> clause is found in a
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews matching <code class="option">server</code> statement, this default port
9c6a5d1f22f972232d7a9fd5c5fa64f10bacbdffAutomatic Updater will be used to connect.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The <code class="option">default-source-address</code> and
9c6a5d1f22f972232d7a9fd5c5fa64f10bacbdffAutomatic Updater <code class="option">default-source-address-v6</code> clauses which
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein can be used to set the IPv4 and IPv6 source addresses
bea931e17b7567f09107f93ab7e25c7f00abeb9cMark Andrews After the <code class="option">server</code> keyword, the server
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews statement includes a string which is the hostname or address
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for a name server. The statement has three possible clauses:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="option">key</code>, <code class="option">port</code> and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="option">addresses</code>. The key name must match the
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User name of a key statement in the file. The port number
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User specifies the port to connect to. If an <code class="option">addresses</code>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein clause is supplied these addresses will be used instead of
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User the server name. Each address can take an optional port.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User If an <code class="option">source-address</code> or <code class="option">source-address-v6</code>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of supplied then these will be used to specify the IPv4 and IPv6
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein source addresses respectively.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The <code class="option">key</code> statement begins with an identifying
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt string, the name of the key. The statement has two clauses.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <code class="option">algorithm</code> identifies the authentication algorithm
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for <span><strong class="command">rndc</strong></span> to use; currently only HMAC-MD5
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (for compatibility), HMAC-SHA1, HMAC-SHA224, HMAC-SHA256
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (default), HMAC-SHA384 and HMAC-SHA512 are
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein supported. This is followed by a secret clause which contains
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the base-64 encoding of the algorithm's authentication key. The
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein base-64 string is enclosed in double quotes.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein There are two common ways to generate the base-64 string for the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein secret. The BIND 9 program <span><strong class="command">rndc-confgen</strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein be used to generate a random key, or the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span><strong class="command">mmencode</strong></span> program, also known as
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span><strong class="command">mimencode</strong></span>, can be used to generate a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein string from known input. <span><strong class="command">mmencode</strong></span> does
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ship with BIND 9 but is available on many systems. See the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein EXAMPLE section for sample command lines for each.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein default-server localhost;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein default-key samplekey;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein server localhost {
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein key samplekey;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein server testserver {
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein key testkey;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein addresses { localhost port 5353; };
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein key samplekey {
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein algorithm hmac-sha256;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein secret "6FMfj43Osz4lyb24OIe2iGEz9lf1llJO+lz";
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein key testkey {
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews algorithm hmac-sha256;
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User secret "R3HI8P6BKw9ZwXwN3VZKuQ==";
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein In the above example, <span><strong class="command">rndc</strong></span> will by
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the server at localhost (127.0.0.1) and the key called samplekey.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Commands to the localhost server will use the samplekey key, which
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein must also be defined in the server's configuration file with the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein same name and secret. The key statement indicates that samplekey
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein uses the HMAC-SHA256 algorithm and its secret clause contains the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein base-64 encoding of the HMAC-SHA256 secret enclosed in double quotes.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein If <span><strong class="command">rndc -s testserver</strong></span> is used then <span><strong class="command">rndc</strong></span> will
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein connect to server on localhost port 5353 using the key testkey.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein To generate a random secret with <span><strong class="command">rndc-confgen</strong></span>:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<p><strong class="userinput"><code>rndc-confgen</code></strong>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein A complete <code class="filename">rndc.conf</code> file, including
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein randomly generated key, will be written to the standard
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein output. Commented-out <code class="option">key</code> and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="option">controls</code> statements for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="filename">named.conf</code> are also printed.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein To generate a base-64 secret with <span><strong class="command">mmencode</strong></span>:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<p><strong class="userinput"><code>echo "known plaintext for a secret" | mmencode</code></strong>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="id2662444"></a><h2>NAME SERVER CONFIGURATION</h2>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The name server must be configured to accept rndc connections and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to recognize the key specified in the <code class="filename">rndc.conf</code>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein file, using the controls statement in <code class="filename">named.conf</code>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein See the sections on the <code class="option">controls</code> statement in the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein BIND 9 Administrator Reference Manual for details.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<p><span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="citerefentry"><span class="refentrytitle">mmencode</span>(1)</span>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<p><span class="corpauthor">Internet Systems Consortium</span>
bea931e17b7567f09107f93ab7e25c7f00abeb9cMark Andrews<table width="100%" summary="Navigation footer">
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews<a accesskey="p" href="man.rndc.html">Prev</a>�</td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<td width="40%" align="right">�<a accesskey="n" href="man.rndc-confgen.html">Next</a>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="40%" align="right" valign="top">�<span class="application">rndc-confgen</span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<p style="text-align: center;">BIND 9.11.0pre-alpha</p>