man.rndc.conf.html revision a87790b9d8e062fac1b2dfb8903e77bfe92a3891
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC")
32098293b78922a5fbd10906afa28624820d3756Tinderbox User - Copyright (C) 2000-2003 Internet Software Consortium.
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User - Permission to use, copy, modify, and/or distribute this software for any
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User - purpose with or without fee is hereby granted, provided that the above
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User - copyright notice and this permission notice appear in all copies.
d6fa26d0adaec6c910115be34fe7a5a5f402c14fMark Andrews - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - PERFORMANCE OF THIS SOFTWARE.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="prev" href="man.rndc.html" title="rndc">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="next" href="man.rndc-confgen.html" title="rndc-confgen">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<tr><th colspan="3" align="center"><code class="filename">rndc.conf</code></th></tr>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<a accesskey="p" href="man.rndc.html">Prev</a>�</td>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<th width="60%" align="center">Manual pages</th>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<td width="20%" align="right">�<a accesskey="n" href="man.rndc-confgen.html">Next</a>
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User<a name="man.rndc.conf"></a><div class="titlepage"></div>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<p><code class="filename">rndc.conf</code> — rndc configuration file</p>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<div class="cmdsynopsis"><p><code class="command">rndc.conf</code> </p></div>
f9ce6280cec79deb16ff6d9807aa493ff23e10d9Tinderbox User<p><code class="filename">rndc.conf</code> is the configuration file
164ade1482251e1da962b42e5bf0d3aa02a11e03Tinderbox User for <span><strong class="command">rndc</strong></span>, the BIND 9 name server control
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User utility. This file has a similar structure and syntax to
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <code class="filename">named.conf</code>. Statements are enclosed
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt in braces and terminated with a semi-colon. Clauses in
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt the statements are also semi-colon terminated. The usual
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User comment styles are supported:
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User C style: /* */
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User C++ style: // to end of line
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Unix style: # to end of line
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<p><code class="filename">rndc.conf</code> is much simpler than
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <code class="filename">named.conf</code>. The file uses three
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User statements: an options statement, a server statement
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt and a key statement.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The <code class="option">options</code> statement contains five clauses.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User The <code class="option">default-server</code> clause is followed by the
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User name or address of a name server. This host will be used when
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User no name server is given as an argument to
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <span><strong class="command">rndc</strong></span>. The <code class="option">default-key</code>
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User clause is followed by the name of a key which is identified by
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User a <code class="option">key</code> statement. If no
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User <code class="option">keyid</code> is provided on the rndc command line,
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User and no <code class="option">key</code> clause is found in a matching
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User <code class="option">server</code> statement, this default key will be
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User used to authenticate the server's commands and responses. The
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User <code class="option">default-port</code> clause is followed by the port
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User to connect to on the remote name server. If no
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User <code class="option">port</code> option is provided on the rndc command
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User line, and no <code class="option">port</code> clause is found in a
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User matching <code class="option">server</code> statement, this default port
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User will be used to connect.
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User The <code class="option">default-source-address</code> and
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User <code class="option">default-source-address-v6</code> clauses which
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User can be used to set the IPv4 and IPv6 source addresses
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User respectively.
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User After the <code class="option">server</code> keyword, the server
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User statement includes a string which is the hostname or address
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User for a name server. The statement has three possible clauses:
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User <code class="option">key</code>, <code class="option">port</code> and
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User <code class="option">addresses</code>. The key name must match the
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User name of a key statement in the file. The port number
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User specifies the port to connect to. If an <code class="option">addresses</code>
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User clause is supplied these addresses will be used instead of
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User the server name. Each address can take an optional port.
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User If an <code class="option">source-address</code> or <code class="option">source-address-v6</code>
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User of supplied then these will be used to specify the IPv4 and IPv6
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User source addresses respectively.
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User The <code class="option">key</code> statement begins with an identifying
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User string, the name of the key. The statement has two clauses.
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User <code class="option">algorithm</code> identifies the authentication algorithm
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User for <span><strong class="command">rndc</strong></span> to use; currently only HMAC-MD5
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User (for compatibility), HMAC-SHA1, HMAC-SHA224, HMAC-SHA256
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User (default), HMAC-SHA384 and HMAC-SHA512 are
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User supported. This is followed by a secret clause which contains
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User the base-64 encoding of the algorithm's authentication key. The
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User base-64 string is enclosed in double quotes.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User There are two common ways to generate the base-64 string for the
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User secret. The BIND 9 program <span><strong class="command">rndc-confgen</strong></span>
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User be used to generate a random key, or the
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User <span><strong class="command">mmencode</strong></span> program, also known as
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User <span><strong class="command">mimencode</strong></span>, can be used to generate a
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User string from known input. <span><strong class="command">mmencode</strong></span> does
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User ship with BIND 9 but is available on many systems. See the
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User EXAMPLE section for sample command lines for each.
164ade1482251e1da962b42e5bf0d3aa02a11e03Tinderbox User default-server localhost;
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User default-key samplekey;
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User server localhost {
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt key samplekey;
164ade1482251e1da962b42e5bf0d3aa02a11e03Tinderbox User server testserver {
164ade1482251e1da962b42e5bf0d3aa02a11e03Tinderbox User addresses { localhost port 5353; };
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User key samplekey {
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt algorithm hmac-sha256;
164ade1482251e1da962b42e5bf0d3aa02a11e03Tinderbox User secret "6FMfj43Osz4lyb24OIe2iGEz9lf1llJO+lz";
3b15473cedf41d48904f5b07bdc5e87afff6b58cTinderbox User key testkey {
3b15473cedf41d48904f5b07bdc5e87afff6b58cTinderbox User algorithm hmac-sha256;
3b15473cedf41d48904f5b07bdc5e87afff6b58cTinderbox User secret "R3HI8P6BKw9ZwXwN3VZKuQ==";
99b30e26a6beb9092557cc9e5370b517309bff6eTinderbox User In the above example, <span><strong class="command">rndc</strong></span> will by
99b30e26a6beb9092557cc9e5370b517309bff6eTinderbox User the server at localhost (127.0.0.1) and the key called samplekey.
99b30e26a6beb9092557cc9e5370b517309bff6eTinderbox User Commands to the localhost server will use the samplekey key, which
99b30e26a6beb9092557cc9e5370b517309bff6eTinderbox User must also be defined in the server's configuration file with the
99b30e26a6beb9092557cc9e5370b517309bff6eTinderbox User same name and secret. The key statement indicates that samplekey
ffe29868b4bbc64953fc5d0de51f988c20158967Tinderbox User uses the HMAC-SHA256 algorithm and its secret clause contains the
ffe29868b4bbc64953fc5d0de51f988c20158967Tinderbox User base-64 encoding of the HMAC-SHA256 secret enclosed in double quotes.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt If <span><strong class="command">rndc -s testserver</strong></span> is used then <span><strong class="command">rndc</strong></span> will
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User connect to server on localhost port 5353 using the key testkey.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User To generate a random secret with <span><strong class="command">rndc-confgen</strong></span>:
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<p><strong class="userinput"><code>rndc-confgen</code></strong>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt A complete <code class="filename">rndc.conf</code> file, including
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User randomly generated key, will be written to the standard
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt output. Commented-out <code class="option">key</code> and
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <code class="option">controls</code> statements for
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <code class="filename">named.conf</code> are also printed.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User To generate a base-64 secret with <span><strong class="command">mmencode</strong></span>:
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<p><strong class="userinput"><code>echo "known plaintext for a secret" | mmencode</code></strong>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="id2660992"></a><h2>NAME SERVER CONFIGURATION</h2>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The name server must be configured to accept rndc connections and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to recognize the key specified in the <code class="filename">rndc.conf</code>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews file, using the controls statement in <code class="filename">named.conf</code>.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews See the sections on the <code class="option">controls</code> statement in the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein BIND 9 Administrator Reference Manual for details.
cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User<p><span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="citerefentry"><span class="refentrytitle">mmencode</span>(1)</span>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <em class="citetitle">BIND 9 Administrator Reference Manual</em>.