man.rndc.conf.html revision f6e04b59238a309b1be2d5415c195325edec8aa6
18c2aff776a775d34a4c9893a4c72e0434d68e36artem - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
18c2aff776a775d34a4c9893a4c72e0434d68e36artem - Copyright (C) 2000-2003 Internet Software Consortium.
18c2aff776a775d34a4c9893a4c72e0434d68e36artem - Permission to use, copy, modify, and/or distribute this software for any
18c2aff776a775d34a4c9893a4c72e0434d68e36artem - purpose with or without fee is hereby granted, provided that the above
18c2aff776a775d34a4c9893a4c72e0434d68e36artem - copyright notice and this permission notice appear in all copies.
18c2aff776a775d34a4c9893a4c72e0434d68e36artem - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
18c2aff776a775d34a4c9893a4c72e0434d68e36artem - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
18c2aff776a775d34a4c9893a4c72e0434d68e36artem - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
18c2aff776a775d34a4c9893a4c72e0434d68e36artem - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
18c2aff776a775d34a4c9893a4c72e0434d68e36artem - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
18c2aff776a775d34a4c9893a4c72e0434d68e36artem - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
18c2aff776a775d34a4c9893a4c72e0434d68e36artem - PERFORMANCE OF THIS SOFTWARE.
18c2aff776a775d34a4c9893a4c72e0434d68e36artem<!-- $Id$ -->
18c2aff776a775d34a4c9893a4c72e0434d68e36artem<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
d2ec54f7875f7e05edd56195adbeb593c947763fphitran<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
18c2aff776a775d34a4c9893a4c72e0434d68e36artem<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
18c2aff776a775d34a4c9893a4c72e0434d68e36artem<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
d2ec54f7875f7e05edd56195adbeb593c947763fphitran<link rel="next" href="man.rndc-confgen.html" title="rndc-confgen">
18c2aff776a775d34a4c9893a4c72e0434d68e36artem<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
d2ec54f7875f7e05edd56195adbeb593c947763fphitran<tr><th colspan="3" align="center"><code class="filename">rndc.conf</code></th></tr>
d2ec54f7875f7e05edd56195adbeb593c947763fphitran<td width="20%" align="right">�<a accesskey="n" href="man.rndc-confgen.html">Next</a>
18c2aff776a775d34a4c9893a4c72e0434d68e36artem<a name="man.rndc.conf"></a><div class="titlepage"></div>
18c2aff776a775d34a4c9893a4c72e0434d68e36artem<p><code class="filename">rndc.conf</code> — rndc configuration file</p>
18c2aff776a775d34a4c9893a4c72e0434d68e36artem<div class="cmdsynopsis"><p><code class="command">rndc.conf</code> </p></div>
18c2aff776a775d34a4c9893a4c72e0434d68e36artem<p><code class="filename">rndc.conf</code> is the configuration file
18c2aff776a775d34a4c9893a4c72e0434d68e36artem for <span><strong class="command">rndc</strong></span>, the BIND 9 name server control
d2ec54f7875f7e05edd56195adbeb593c947763fphitran utility. This file has a similar structure and syntax to
b6805bf78d2bbbeeaea8909a05623587b42d58b3Gordon Ross <code class="filename">named.conf</code>. Statements are enclosed
18c2aff776a775d34a4c9893a4c72e0434d68e36artem in braces and terminated with a semi-colon. Clauses in
18c2aff776a775d34a4c9893a4c72e0434d68e36artem the statements are also semi-colon terminated. The usual
18c2aff776a775d34a4c9893a4c72e0434d68e36artem comment styles are supported:
18c2aff776a775d34a4c9893a4c72e0434d68e36artem C style: /* */
d2ec54f7875f7e05edd56195adbeb593c947763fphitran C++ style: // to end of line
18c2aff776a775d34a4c9893a4c72e0434d68e36artem Unix style: # to end of line
18c2aff776a775d34a4c9893a4c72e0434d68e36artem<p><code class="filename">rndc.conf</code> is much simpler than
18c2aff776a775d34a4c9893a4c72e0434d68e36artem <code class="filename">named.conf</code>. The file uses three
18c2aff776a775d34a4c9893a4c72e0434d68e36artem statements: an options statement, a server statement
18c2aff776a775d34a4c9893a4c72e0434d68e36artem and a key statement.
d2ec54f7875f7e05edd56195adbeb593c947763fphitran The <code class="option">options</code> statement contains five clauses.
d2ec54f7875f7e05edd56195adbeb593c947763fphitran The <code class="option">default-server</code> clause is followed by the
18c2aff776a775d34a4c9893a4c72e0434d68e36artem name or address of a name server. This host will be used when
18c2aff776a775d34a4c9893a4c72e0434d68e36artem no name server is given as an argument to
d2ec54f7875f7e05edd56195adbeb593c947763fphitran <span><strong class="command">rndc</strong></span>. The <code class="option">default-key</code>
d2ec54f7875f7e05edd56195adbeb593c947763fphitran clause is followed by the name of a key which is identified by
d2ec54f7875f7e05edd56195adbeb593c947763fphitran <code class="option">keyid</code> is provided on the rndc command line,
d2ec54f7875f7e05edd56195adbeb593c947763fphitran and no <code class="option">key</code> clause is found in a matching
d2ec54f7875f7e05edd56195adbeb593c947763fphitran <code class="option">server</code> statement, this default key will be
d2ec54f7875f7e05edd56195adbeb593c947763fphitran used to authenticate the server's commands and responses. The
d2ec54f7875f7e05edd56195adbeb593c947763fphitran <code class="option">default-port</code> clause is followed by the port
18c2aff776a775d34a4c9893a4c72e0434d68e36artem to connect to on the remote name server. If no
18c2aff776a775d34a4c9893a4c72e0434d68e36artem <code class="option">port</code> option is provided on the rndc command
18c2aff776a775d34a4c9893a4c72e0434d68e36artem line, and no <code class="option">port</code> clause is found in a
d2ec54f7875f7e05edd56195adbeb593c947763fphitran matching <code class="option">server</code> statement, this default port
18c2aff776a775d34a4c9893a4c72e0434d68e36artem will be used to connect.
a9da3307db733eb1739ba859952610bba3d894abnp The <code class="option">default-source-address</code> and
a9da3307db733eb1739ba859952610bba3d894abnp <code class="option">default-source-address-v6</code> clauses which
a9da3307db733eb1739ba859952610bba3d894abnp can be used to set the IPv4 and IPv6 source addresses
a9da3307db733eb1739ba859952610bba3d894abnp respectively.
18c2aff776a775d34a4c9893a4c72e0434d68e36artem After the <code class="option">server</code> keyword, the server
18c2aff776a775d34a4c9893a4c72e0434d68e36artem statement includes a string which is the hostname or address
18c2aff776a775d34a4c9893a4c72e0434d68e36artem for a name server. The statement has three possible clauses:
18c2aff776a775d34a4c9893a4c72e0434d68e36artem <code class="option">key</code>, <code class="option">port</code> and
18c2aff776a775d34a4c9893a4c72e0434d68e36artem <code class="option">addresses</code>. The key name must match the
18c2aff776a775d34a4c9893a4c72e0434d68e36artem name of a key statement in the file. The port number
18c2aff776a775d34a4c9893a4c72e0434d68e36artem specifies the port to connect to. If an <code class="option">addresses</code>
18c2aff776a775d34a4c9893a4c72e0434d68e36artem clause is supplied these addresses will be used instead of
18c2aff776a775d34a4c9893a4c72e0434d68e36artem the server name. Each address can take an optional port.
18c2aff776a775d34a4c9893a4c72e0434d68e36artem If an <code class="option">source-address</code> or <code class="option">source-address-v6</code>
18c2aff776a775d34a4c9893a4c72e0434d68e36artem of supplied then these will be used to specify the IPv4 and IPv6
18c2aff776a775d34a4c9893a4c72e0434d68e36artem source addresses respectively.
18c2aff776a775d34a4c9893a4c72e0434d68e36artem The <code class="option">key</code> statement begins with an identifying
18c2aff776a775d34a4c9893a4c72e0434d68e36artem string, the name of the key. The statement has two clauses.
18c2aff776a775d34a4c9893a4c72e0434d68e36artem <code class="option">algorithm</code> identifies the authentication algorithm
18c2aff776a775d34a4c9893a4c72e0434d68e36artem for <span><strong class="command">rndc</strong></span> to use; currently only HMAC-MD5
18c2aff776a775d34a4c9893a4c72e0434d68e36artem (for compatibility), HMAC-SHA1, HMAC-SHA224, HMAC-SHA256
18c2aff776a775d34a4c9893a4c72e0434d68e36artem (default), HMAC-SHA384 and HMAC-SHA512 are
18c2aff776a775d34a4c9893a4c72e0434d68e36artem supported. This is followed by a secret clause which contains
18c2aff776a775d34a4c9893a4c72e0434d68e36artem the base-64 encoding of the algorithm's authentication key. The
18c2aff776a775d34a4c9893a4c72e0434d68e36artem base-64 string is enclosed in double quotes.
18c2aff776a775d34a4c9893a4c72e0434d68e36artem There are two common ways to generate the base-64 string for the
18c2aff776a775d34a4c9893a4c72e0434d68e36artem secret. The BIND 9 program <span><strong class="command">rndc-confgen</strong></span>
18c2aff776a775d34a4c9893a4c72e0434d68e36artem be used to generate a random key, or the
18c2aff776a775d34a4c9893a4c72e0434d68e36artem <span><strong class="command">mmencode</strong></span> program, also known as
18c2aff776a775d34a4c9893a4c72e0434d68e36artem <span><strong class="command">mimencode</strong></span>, can be used to generate a
18c2aff776a775d34a4c9893a4c72e0434d68e36artem string from known input. <span><strong class="command">mmencode</strong></span> does
18c2aff776a775d34a4c9893a4c72e0434d68e36artem ship with BIND 9 but is available on many systems. See the
18c2aff776a775d34a4c9893a4c72e0434d68e36artem EXAMPLE section for sample command lines for each.
18c2aff776a775d34a4c9893a4c72e0434d68e36artem default-server localhost;
18c2aff776a775d34a4c9893a4c72e0434d68e36artem default-key samplekey;
18c2aff776a775d34a4c9893a4c72e0434d68e36artem server localhost {
18c2aff776a775d34a4c9893a4c72e0434d68e36artem key samplekey;
18c2aff776a775d34a4c9893a4c72e0434d68e36artem server testserver {
18c2aff776a775d34a4c9893a4c72e0434d68e36artem key testkey;
18c2aff776a775d34a4c9893a4c72e0434d68e36artem addresses { localhost port 5353; };
18c2aff776a775d34a4c9893a4c72e0434d68e36artem key samplekey {
d2ec54f7875f7e05edd56195adbeb593c947763fphitran algorithm hmac-sha256;
d2ec54f7875f7e05edd56195adbeb593c947763fphitran secret "6FMfj43Osz4lyb24OIe2iGEz9lf1llJO+lz";