0N/A - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC") 0N/A - Copyright (C) 2000-2003 Internet Software Consortium. 0N/A - Permission to use, copy, modify, and/or distribute this software for any 0N/A - purpose with or without fee is hereby granted, provided that the above 0N/A - copyright notice and this permission notice appear in all copies. 0N/A - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH 0N/A - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY 0N/A - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, 0N/A - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM 0N/A - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE 0N/A - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 0N/A - PERFORMANCE OF THIS SOFTWARE. 0N/A<
meta http-
equiv="Content-Type" content="text/html; charset=ISO-8859-1">
0N/A<
meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
0N/A<
link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
2086N/A<
body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
0N/A<
div class="navheader">
1280N/A<
table width="100%" summary="Navigation header">
2086N/A<
tr><
th colspan="3" align="center"><
code class="filename">
rndc.conf</
code></
th></
tr>
0N/A<
td width="20%" align="left">
0N/A<
th width="60%" align="center">Manual pages</
th>
0N/A<
div class="refentry" lang="en">
0N/A<
p><
code class="filename">
rndc.conf</
code> — rndc configuration file</
p>
1182N/A<
div class="refsynopsisdiv">
1191N/A<
div class="cmdsynopsis"><
p><
code class="command">
rndc.conf</
code> </
p></
div>
0N/A<
div class="refsect1" lang="en">
3182N/A<
a name="id2661553"></
a><
h2>DESCRIPTION</
h2>
0N/A<
p><
code class="filename">
rndc.conf</
code> is the configuration file
0N/A for <
span><
strong class="command">rndc</
strong></
span>, the BIND 9 name server control
1191N/A utility. This file has a similar structure and syntax to
0N/A in braces and terminated with a semi-colon. Clauses in
0N/A the statements are also semi-colon terminated. The usual
1191N/A comment styles are supported:
0N/A C++ style: // to end of line
2350N/A Unix style: # to end of line
2350N/A statements: an options statement, a server statement
2350N/A The <
code class="option">options</
code> statement contains five clauses.
2350N/A The <
code class="option">default-server</
code> clause is followed by the
1191N/A name or address of a name server. This host will be used when
2350N/A no name server is given as an argument to
3853N/A <
span><
strong class="command">rndc</
strong></
span>. The <
code class="option">default-key</
code>
3853N/A clause is followed by the name of a key which is identified by
3823N/A a <
code class="option">key</
code> statement. If no
3823N/A <
code class="option">keyid</
code> is provided on the rndc command line,
3823N/A and no <
code class="option">key</
code> clause is found in a matching
3823N/A <
code class="option">server</
code> statement, this default key will be
3823N/A used to authenticate the server's commands and responses. The
4068N/A <
code class="option">default-port</
code> clause is followed by the port
4068N/A to connect to on the remote name server. If no
4068N/A <
code class="option">port</
code> option is provided on the rndc command
3823N/A line, and no <
code class="option">port</
code> clause is found in a
3823N/A matching <
code class="option">server</
code> statement, this default port
4068N/A The <
code class="option">default-source-address</
code> and
4068N/A <
code class="option">default-source-address-v6</
code> clauses which
3823N/A can be used to set the IPv4 and IPv6 source addresses
3823N/A After the <
code class="option">server</
code> keyword, the server
1191N/A statement includes a string which is the hostname or address
0N/A for a name server. The statement has three possible clauses:
0N/A <
code class="option">key</
code>, <
code class="option">port</
code> and
0N/A <
code class="option">addresses</
code>. The key name must match the
3988N/A name of a key statement in the file. The port number
0N/A specifies the port to connect to. If an <
code class="option">addresses</
code>
0N/A clause is supplied these addresses will be used instead of
0N/A the server name. Each address can take an optional port.
0N/A If an <
code class="option">source-address</
code> or <
code class="option">source-address-v6</
code>
3325N/A of supplied then these will be used to specify the IPv4 and IPv6
2923N/A source addresses respectively.
3182N/A The <
code class="option">key</
code> statement begins with an identifying
3182N/A string, the name of the key. The statement has two clauses.
4697N/A <
code class="option">algorithm</
code> identifies the authentication algorithm
4697N/A for <
span><
strong class="command">rndc</
strong></
span> to use; currently only HMAC-MD5
863N/A (for compatibility), HMAC-SHA1, HMAC-SHA224, HMAC-SHA256
2350N/A (default), HMAC-SHA384 and HMAC-SHA512 are
2350N/A supported. This is followed by a secret clause which contains
2350N/A the base-64 encoding of the algorithm's authentication key. The
2350N/A base-64 string is enclosed in double quotes.
0N/A There are two common ways to generate the base-64 string for the
0N/A secret. The BIND 9 program <
span><
strong class="command">rndc-confgen</
strong></
span>
0N/A be used to generate a random key, or the
0N/A <
span><
strong class="command">mmencode</
strong></
span> program, also known as
863N/A <
span><
strong class="command">mimencode</
strong></
span>, can be used to generate a
1191N/A string from known input. <
span><
strong class="command">mmencode</
strong></
span> does
3823N/A ship with BIND 9 but is available on many systems. See the
0N/A EXAMPLE section for sample command lines for each.
3988N/A<
div class="refsect1" lang="en">
3823N/A<
a name="id2662202"></
a><
h2>EXAMPLE</
h2>
535N/A<
pre class="programlisting">
4068N/A<
pre class="programlisting">
1191N/A<
pre class="programlisting">
0N/A addresses { localhost port 5353; };
0N/A<
pre class="programlisting">
0N/A algorithm hmac-sha256;
0N/A secret "6FMfj43Osz4lyb24OIe2iGEz9lf1llJO+lz";
0N/A<
pre class="programlisting">
0N/A algorithm hmac-sha256;
3853N/A secret "R3HI8P6BKw9ZwXwN3VZKuQ==";
4068N/A In the above example, <
span><
strong class="command">rndc</
strong></
span> will by
4068N/A the server at localhost (127.0.0.1) and the key called samplekey.
0N/A Commands to the localhost server will use the samplekey key, which
0N/A must also be defined in the server's configuration file with the
0N/A same name and secret. The key statement indicates that samplekey
4184N/A uses the HMAC-SHA256 algorithm and its secret clause contains the
0N/A base-64 encoding of the HMAC-SHA256 secret enclosed in double quotes.
0N/A If <
span><
strong class="command">rndc -s testserver</
strong></
span> is used then <
span><
strong class="command">rndc</
strong></
span> will
0N/A connect to server on localhost port 5353 using the key testkey.
3823N/A To generate a random secret with <
span><
strong class="command">rndc-confgen</
strong></
span>:
0N/A<
p><
strong class="userinput"><
code>rndc-confgen</
code></
strong>
0N/A A complete <
code class="filename">
rndc.conf</
code> file, including
0N/A randomly generated key, will be written to the standard
0N/A output. Commented-out <
code class="option">key</
code> and
0N/A <
code class="option">controls</
code> statements for
4658N/A To generate a base-64 secret with <
span><
strong class="command">mmencode</
strong></
span>:
0N/A<
p><
strong class="userinput"><
code>echo "known plaintext for a secret" | mmencode</
code></
strong>
0N/A<
div class="refsect1" lang="en">
0N/A<
a name="id2662324"></
a><
h2>NAME SERVER CONFIGURATION</
h2>
0N/A The name server must be configured to accept rndc connections and
0N/A to recognize the key specified in the <
code class="filename">
rndc.conf</
code>
0N/A file, using the controls statement in <
code class="filename">
named.conf</
code>.
0N/A See the sections on the <
code class="option">controls</
code> statement in the
0N/A BIND 9 Administrator Reference Manual for details.
0N/A<
div class="refsect1" lang="en">
0N/A<
a name="id2662349"></
a><
h2>SEE ALSO</
h2>
0N/A<
p><
span class="citerefentry"><
span class="refentrytitle">rndc</
span>(8)</
span>,
0N/A <
span class="citerefentry"><
span class="refentrytitle">rndc-confgen</
span>(8)</
span>,
0N/A <
span class="citerefentry"><
span class="refentrytitle">mmencode</
span>(1)</
span>,
0N/A <
em class="citetitle">BIND 9 Administrator Reference Manual</
em>.
0N/A<
div class="refsect1" lang="en">
0N/A<
a name="id2662388"></
a><
h2>AUTHOR</
h2>
0N/A<
p><
span class="corpauthor">Internet Systems Consortium</
span>
0N/A<
div class="navfooter">
0N/A<
table width="100%" summary="Navigation footer">
0N/A<
td width="40%" align="left">
0N/A<
td width="40%" align="left" valign="top">
2857N/A<
span class="application">rndc</
span>�</
td>
2857N/A<
td width="40%" align="right" valign="top">�<
span class="application">rndc-confgen</
span>
2857N/A<
p style="text-align: center;">BIND 9.11.0pre-alpha</
p>