man.rndc.html revision db6353c9b89628e16f6e729ce57baabad3460c49
99bbb58ce7c172798fecb21d2d12756c159cff14Tinderbox User - Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt - Copyright (C) 2000-2003 Internet Software Consortium.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews - Permission to use, copy, modify, and/or distribute this software for any
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews - purpose with or without fee is hereby granted, provided that the above
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt - copyright notice and this permission notice appear in all copies.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt - PERFORMANCE OF THIS SOFTWARE.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt<!-- $Id: man.rndc.html,v 1.197 2011/04/30 01:14:42 tbox Exp $ -->
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt<link rel="prev" href="man.nsupdate.html" title="nsupdate">
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt<link rel="next" href="man.rndc.conf.html" title="rndc.conf">
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt<tr><th colspan="3" align="center"><span class="application">rndc</span></th></tr>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt<a accesskey="p" href="man.nsupdate.html">Prev</a>�</td>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt<td width="20%" align="right">�<a accesskey="n" href="man.rndc.conf.html">Next</a>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt<a name="man.rndc"></a><div class="titlepage"></div>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt<p><span class="application">rndc</span> — name server control utility</p>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt<div class="cmdsynopsis"><p><code class="command">rndc</code> [<code class="option">-b <em class="replaceable"><code>source-address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key-file</code></em></code>] [<code class="option">-s <em class="replaceable"><code>server</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-V</code>] [<code class="option">-y <em class="replaceable"><code>key_id</code></em></code>] {command}</p></div>
acbb301e648b82fcc38b876a44403cf0fe539cc9Evan Hunt<p><span><strong class="command">rndc</strong></span>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt controls the operation of a name
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt server. It supersedes the <span><strong class="command">ndc</strong></span> utility
699f790c49d03a9ef3c3234a72d272bb469203e8Evan Hunt that was provided in old BIND releases. If
699f790c49d03a9ef3c3234a72d272bb469203e8Evan Hunt <span><strong class="command">rndc</strong></span> is invoked with no command line
699f790c49d03a9ef3c3234a72d272bb469203e8Evan Hunt options or arguments, it prints a short summary of the
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt supported commands and the available options and their
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt<p><span><strong class="command">rndc</strong></span>
699f790c49d03a9ef3c3234a72d272bb469203e8Evan Hunt communicates with the name server
699f790c49d03a9ef3c3234a72d272bb469203e8Evan Hunt over a TCP connection, sending commands authenticated with
699f790c49d03a9ef3c3234a72d272bb469203e8Evan Hunt digital signatures. In the current versions of
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt <span><strong class="command">rndc</strong></span> and <span><strong class="command">named</strong></span>,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt the only supported authentication algorithm is HMAC-MD5,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt which uses a shared secret on each end of the connection.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt This provides TSIG-style authentication for the command
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt request and the name server's response. All commands sent
699f790c49d03a9ef3c3234a72d272bb469203e8Evan Hunt over the channel must be signed by a key_id known to the
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt<p><span><strong class="command">rndc</strong></span>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt reads a configuration file to
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt determine how to contact the name server and decide what
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt algorithm and key it should use.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt<dt><span class="term">-b <em class="replaceable"><code>source-address</code></em></span></dt>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt Use <em class="replaceable"><code>source-address</code></em>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt as the source address for the connection to the server.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt Multiple instances are permitted to allow setting of both
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt the IPv4 and IPv6 source addresses.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt<dt><span class="term">-c <em class="replaceable"><code>config-file</code></em></span></dt>
acbb301e648b82fcc38b876a44403cf0fe539cc9Evan Hunt Use <em class="replaceable"><code>config-file</code></em>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt as the configuration file instead of the default,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt<dt><span class="term">-k <em class="replaceable"><code>key-file</code></em></span></dt>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt Use <em class="replaceable"><code>key-file</code></em>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt as the key file instead of the default,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt <code class="filename">/etc/rndc.key</code>. The key in
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt <code class="filename">/etc/rndc.key</code> will be used to
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt authenticate
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt commands sent to the server if the <em class="replaceable"><code>config-file</code></em>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt does not exist.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt<dt><span class="term">-s <em class="replaceable"><code>server</code></em></span></dt>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt<dd><p><em class="replaceable"><code>server</code></em> is
acbb301e648b82fcc38b876a44403cf0fe539cc9Evan Hunt the name or address of the server which matches a
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt server statement in the configuration file for
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt <span><strong class="command">rndc</strong></span>. If no server is supplied on the
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt command line, the host named by the default-server clause
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt in the options statement of the <span><strong class="command">rndc</strong></span>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt configuration file will be used.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt<dt><span class="term">-p <em class="replaceable"><code>port</code></em></span></dt>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt Send commands to TCP port
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt of BIND 9's default control channel port, 953.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt Enable verbose logging.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt<dt><span class="term">-y <em class="replaceable"><code>key_id</code></em></span></dt>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt Use the key <em class="replaceable"><code>key_id</code></em>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt from the configuration file.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt known by named with the same algorithm and secret string
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt in order for control message validation to succeed.
acbb301e648b82fcc38b876a44403cf0fe539cc9Evan Hunt If no <em class="replaceable"><code>key_id</code></em>
acbb301e648b82fcc38b876a44403cf0fe539cc9Evan Hunt is specified, <span><strong class="command">rndc</strong></span> will first look
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt for a key clause in the server statement of the server
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt being used, or if no server statement is present for that
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt host, then the default-key clause of the options statement.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt Note that the configuration file contains shared secrets
acbb301e648b82fcc38b876a44403cf0fe539cc9Evan Hunt which are used to send authenticated control commands
acbb301e648b82fcc38b876a44403cf0fe539cc9Evan Hunt to name servers. It should therefore not have general read
acbb301e648b82fcc38b876a44403cf0fe539cc9Evan Hunt or write access.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt For the complete set of commands supported by <span><strong class="command">rndc</strong></span>,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt see the BIND 9 Administrator Reference Manual or run
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt <span><strong class="command">rndc</strong></span> without arguments to see its help
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt<p><span><strong class="command">rndc</strong></span>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt does not yet support all the commands of
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt the BIND 8 <span><strong class="command">ndc</strong></span> utility.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt There is currently no way to provide the shared secret for a
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt <code class="option">key_id</code> without using the configuration file.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt Several error messages could be clearer.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt<p><span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt <span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt <span class="citerefentry"><span class="refentrytitle">ndc</span>(8)</span>,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt<p><span class="corpauthor">Internet Systems Consortium</span>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt<a accesskey="p" href="man.nsupdate.html">Prev</a>�</td>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
acbb301e648b82fcc38b876a44403cf0fe539cc9Evan Hunt<td width="40%" align="right">�<a accesskey="n" href="man.rndc.conf.html">Next</a>