- + +
- + +
namename is the domain name that is to be looked up. It can also be a dotted-decimal IPv4 address or a colon-delimited IPv6 address, in which case host will by default perform a reverse lookup for that address. -serverserver is an optional argument which is either the name or IP address of the name server that /etc/resolv.conf.
The The -a-a (all) option is equivalent to setting the --v-v option and asking host to make a query of type ANY.
When the When the -C-C option is used, host will attempt to display the SOA records for zone -namename from all the listed authoritative name servers for that zone. The list of name servers is defined by the NS records that are found for the zone.
The The -c-c option instructs to make a DNS query of class -classclass. This can be used to lookup Hesiod or Chaosnet class resource records. The default class is IN (Internet).
host when the --d or -d or -v-v option is used. The two options are equivalent. They have been provided for backwards -compatibility. In previous versions, the -d-d option -switched on debugging traces and -v-v enabled verbose output.
List mode is selected by the List mode is selected by the -l-l option. This makes host perform a zone transfer for zone -namename. Transfer the zone printing out the NS, PTR -and address records (A/AAAA). If combined with -a-a all records will be printed.
The The -i-i option specifies that reverse lookups of IPv6 addresses should use the IP6.INT domain as defined in RFC1886. The default is to use IP6.ARPA.
The The -N-N option sets the number of dots that have to be -in namename for it to be considered absolute. The default value is that defined using the ndots statement in .
The number of UDP retries for a lookup can be changed with the --R option. -R option. numbernumber indicates how many times host will repeat a query that does not get answered. The default number of retries is 1. If -numbernumber is negative or zero, the number of retries will default to 1.
Non-recursive queries can be made via the Non-recursive queries can be made via the -r-r option. Setting this option clears the host makes. This should mean that the name server receiving the query will not -attempt to resolve namename. The --r-r option enables hosthost uses UDP when making queries. The --T-T option makes it use a TCP connection when querying the name server. TCP will be automatically selected for queries that require it, such as zone transfer (AXFR) requests.
The The -4-4 option forces host to only -use IPv4 query transport. The -6-6 option forces host to only use IPv6 query transport.
The The -t-t option is used to select the query type. -typetype can be any recognised query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc. When no query type is specified, host automatically selects an appropriate query type. By default it looks for A records, but if the --C-C option was given, queries will be made for SOA -records, and if namename is a dotted-decimal IPv4 address or colon-delimited IPv6 address,
The time to wait for a reply can be controlled through the --W and -W and -w-w options. The --W-W option makes host wait for -wait seconds. If wait seconds. If waitwait is less than one, the wait interval is set to one second. When the --w-w option is used, host - + +
nslookup -query=hinfo -timeout=10
server server domaindomainlserver lserver domaindomainChange the default server to Change the default server to domain; domain; lserverlserver uses the initial
-server to look up information about domain, while domain, while serverserver uses
the current default server. If an authoritative answer can't be
found, the names of servers that might have the answer are
returned.
rootrootnot implemented
fingerfingernot implemented
lslsnot implemented
viewviewnot implemented
helphelpnot implemented
??not implemented
exitexitExits the program.
set set keyword[=value]]allallclass=class=valuevalueININthe Internet class
CHCHthe Chaos class
HSHSthe Hesiod class
ANYANY[no]debug]debug[no]d2]d2domain=domain=namenameSets the search list to Sets the search list to namename.
[no]search]searchport=port=valuevalueChange the default TCP/UDP name server port to Change the default TCP/UDP name server port to valuevalue.
querytype=querytype=valuevaluetype=type=valuevalue[no]recurse]recurseretry=retry=numbernumbertimeout=timeout=numbernumber[no]vc]vc- + +
Selects the cryptographic algorithm. The value of - algorithmalgorithm must be one of RSAMD5 (RSA) or RSASHA1, DSA, DH (Diffie Hellman), or HMAC-MD5. These values are case insensitive. @@ -207,11 +183,9 @@ CLASS="OPTION"
Specifies the owner type of the key. The value of - nametypenametype must either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with a host (KEY)), USER (for a key associated with a user(KEY)) or OTHER (DNSKEY). These values are @@ -243,11 +215,9 @@ CLASS="OPTION"
Indicates the use of the key. Indicates the use of the key. typetype must be one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH refers to the ability to authenticate @@ -384,11 +342,9 @@ CLASS="OPTION"
EXAMPLE
To generate a 768-bit DSA key for the domain - example.comexample.com, the following command would be issued:
dnssec-keygen -a DSA -b 768 -n ZONE example.comdnssec-keygen -a DSA -b 768 -n ZONE example.com
The command would print a string of the form:
Kexample.com.+003+26160Kexample.com.+003+26160
- + +
keyset files in - directorydirectory as the directory
start-timestart-time is specified, the current time minus 1 hour (to allow for clock skew) is used.
Specify the date and time when the generated RRSIG records - expire. As with start-timestart-time, an absolute time is indicated in YYYYMMDDHHMMSS notation. A time relative to the start time is indicated with +N, which is N seconds from the start time. A time relative to the current time is - indicated with now+N. If no end-timeend-time is specified, 30 days from the start time is used as a default.
When a previously signed zone is passed as input, records - may be resigned. The intervalinterval option specifies the cycle interval as an offset from the current time (in seconds). If a RRSIG record expires after the @@ -380,12 +340,12 @@ CLASS="OPTION" >
The default cycle interval is one quarter of the difference between the signature end and start times. So if neither - end-time or end-time or start-timestart-time are specified,
The following command signs the The following command signs the example.comexample.com zone with the DSA key generated in the keyset files associated with child zones, they must be in the current directory. - example.comexample.com, the following command would be issued:
dnssec-signzone -o example.com db.example.com Kexample.com.+003+26160dnssec-signzone -o example.com db.example.com Kexample.com.+003+26160
- + +
Use Use config-fileconfig-file as the configuration file instead of the default,
Set the daemon's debug level to Set the daemon's debug level to debug-leveldebug-level. Debugging traces from
Create Create #cpus#cpus worker threads to take advantage of multiple CPUs. If not specified,
Listen for lightweight resolver queries on port - portport. If not specified, the default is port 921.
Send DNS lookups to port Send DNS lookups to port portport. If not specified, the default is port 53. This provides a way of testing the lightweight resolver daemon with a @@ -370,22 +334,18 @@ CLASS="NOTE" >
chroot() to chroot() to directorydirectory after
processing the command line arguments, but before
reading the configuration file.
@@ -410,14 +370,14 @@ ALIGN="CENTER"
ALIGN="LEFT"
>
This option should be used in conjunction with the - -u-u option, as chrooting a process running as root doesn't enhance security on most - systems; the way chroot()chroot() is defined allows a process with root privileges to escape a chroot jail. @@ -428,22 +388,18 @@ CLASS="FUNCTION" >
setuid() to setuid() to useruser after completing
privileged operations, such as creating sockets that
listen on privileged ports.
diff --git a/bin/named/named.conf.html b/bin/named/named.conf.html
index e1b42c5e86..db4cb82add 100644
--- a/bin/named/named.conf.html
+++ b/bin/named/named.conf.html
@@ -14,16 +14,16 @@
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
+
acl acl string { string { address_match_elementaddress_match_element; ... };
key key domain_namedomain_name {
- algorithm stringstring;
- secret stringstring;
};
masters masters stringstring [ port port integerinteger ] {
- ( masters | masters | ipv4_addressipv4_address [port port integerinteger] |
- ipv6_addressipv6_address [port port integerinteger] ) [ key key stringstring ]; ...
};
server ( server ( ipv4_address | ipv4_address | ipv6_addressipv6_address ) {
- bogus booleanboolean;
- edns booleanboolean;
- provide-ixfr booleanboolean;
- request-ixfr booleanboolean;
- keys server_keyserver_key;
- transfers integerinteger;
transfer-format ( many-answers | one-answer );
- transfer-source ( ipv4_addressipv4_address | * )
[ port ( port ( integerinteger | * ) ];
- transfer-source-v6 ( ipv6_addressipv6_address | * )
[ port ( port ( integerinteger | * ) ];
- support-ixfr booleanboolean; // obsolete
};
trusted-keys {
- domain_name domain_name flags flags protocol protocol algorithm algorithm keykey; ...
};
controls {
- inet ( ipv4_address | ipv4_address | ipv6_addressipv6_address | * )
[ port ( port ( integerinteger | * ) ]
- allow { address_match_elementaddress_match_element; ... }
[ keys { keys { stringstring; ... } ];
- unix unsupportedunsupported; // not implemented
};
logging {
- channel stringstring {
- file log_filelog_file;
- syslog optional_facilityoptional_facility;
null;
stderr;
- severity log_severitylog_severity;
- print-time booleanboolean;
- print-severity booleanboolean;
- print-category booleanboolean;
};
- category string { string { stringstring; ... };
};
options {
- avoid-v4-udp-ports { portport; ... };
- avoid-v6-udp-ports { portport; ... };
- blackhole { address_match_elementaddress_match_element; ... };
- coresize sizesize;
- datasize sizesize;
- directory quoted_stringquoted_string;
- dump-file quoted_stringquoted_string;
- files sizesize;
- heartbeat-interval integerinteger;
- host-statistics booleanboolean; // not implemented
- hostname ( quoted_stringquoted_string | none );
- interface-interval integerinteger;
listen-on [ port port integerinteger ] { ] { address_match_elementaddress_match_element; ... };
listen-on-v6 [ port port integerinteger ] { ] { address_match_elementaddress_match_element; ... };
- match-mapped-addresses booleanboolean;
- memstatistics-file quoted_stringquoted_string;
- pid-file ( quoted_stringquoted_string | none );
- port integerinteger;
- querylog booleanboolean;
- recursing-file quoted_stringquoted_string;
- random-device quoted_stringquoted_string;
- recursive-clients integerinteger;
- serial-query-rate integerinteger;
- server-id ( quoted_stringquoted_string | none |;
- stacksize sizesize;
- statistics-file quoted_stringquoted_string;
- statistics-interval integerinteger; // not yet implemented
- tcp-clients integerinteger;
- tcp-listen-queue integerinteger;
- tkey-dhkey quoted_string quoted_string integerinteger;
- tkey-gssapi-credential quoted_stringquoted_string;
- tkey-domain quoted_stringquoted_string;
- transfers-per-ns integerinteger;
- transfers-in integerinteger;
- transfers-out integerinteger;
- use-ixfr booleanboolean;
- version ( quoted_stringquoted_string | none );
- allow-recursion { address_match_elementaddress_match_element; ... };
- sortlist { address_match_elementaddress_match_element; ... };
- topology { address_match_elementaddress_match_element; ... }; // not implemented
- auth-nxdomain booleanboolean; // default changed
- minimal-responses booleanboolean;
- recursion booleanboolean;
rrset-order {
[ class class stringstring ] [ type type stringstring ]
[ name name quoted_stringquoted_string ] ] string string stringstring; ...
};
- provide-ixfr booleanboolean;
- request-ixfr booleanboolean;
- rfc2308-type1 booleanboolean; // not yet implemented
- additional-from-auth booleanboolean;
- additional-from-cache booleanboolean;
- query-source querysource4querysource4;
- query-source-v6 querysource6querysource6;
- cleaning-interval integerinteger;
- min-roots integerinteger; // not implemented
- lame-ttl integerinteger;
- max-ncache-ttl integerinteger;
- max-cache-ttl integerinteger;
transfer-format ( many-answers | one-answer );
- max-cache-size size_no_defaultsize_no_default;
check-names ( master | slave | response )
( fail | warn | ignore );
- cache-file quoted_stringquoted_string;
- suppress-initial-notify booleanboolean; // not yet implemented
- preferred-glue stringstring;
dual-stack-servers [ port port integerinteger ] {
- ( quoted_stringquoted_string [port port integerinteger] |
- ipv4_addressipv4_address [port port integerinteger] |
- ipv6_addressipv6_address [port port integerinteger] ); ...
}
- edns-udp-size integerinteger;
root-delegation-only [ exclude { exclude { quoted_stringquoted_string; ... } ];
- disable-algorithms string { string { stringstring; ... };
- dnssec-enable booleanboolean;
- dnssec-lookaside string trust-anchor string trust-anchor stringstring;
- dnssec-must-be-secure string string booleanboolean;
- dialup dialuptypedialuptype;
- ixfr-from-differences ixfrdiffixfrdiff;
- allow-query { address_match_elementaddress_match_element; ... };
- allow-transfer { address_match_elementaddress_match_element; ... };
- allow-update-forwarding { address_match_elementaddress_match_element; ... };
- notify notifytypenotifytype;
- notify-source ( ipv4_addressipv4_address | * ) [ port ( port ( integerinteger | * ) ];
- notify-source-v6 ( ipv6_addressipv6_address | * ) [ port ( port ( integerinteger | * ) ];
also-notify [ port port integerinteger ] { ( ] { ( ipv4_address | ipv4_address | ipv6_addressipv6_address )
[ port port integerinteger ]; ... };
- allow-notify { address_match_elementaddress_match_element; ... };
forward ( first | only );
forwarders [ port port integerinteger ] {
- ( ipv4_address | ipv4_address | ipv6_addressipv6_address ) [ port port integerinteger ]; ...
};
- max-journal-size size_no_defaultsize_no_default;
- max-transfer-time-in integerinteger;
- max-transfer-time-out integerinteger;
- max-transfer-idle-in integerinteger;
- max-transfer-idle-out integerinteger;
- max-retry-time integerinteger;
- min-retry-time integerinteger;
- max-refresh-time integerinteger;
- min-refresh-time integerinteger;
- multi-master booleanboolean;
- sig-validity-interval integerinteger;
- transfer-source ( ipv4_addressipv4_address | * )
[ port ( port ( integerinteger | * ) ];
- transfer-source-v6 ( ipv6_addressipv6_address | * )
[ port ( port ( integerinteger | * ) ];
- alt-transfer-source ( ipv4_addressipv4_address | * )
[ port ( port ( integerinteger | * ) ];
- alt-transfer-source-v6 ( ipv6_addressipv6_address | * )
[ port ( port ( integerinteger | * ) ];
- use-alt-transfer-source booleanboolean;
- zone-statistics booleanboolean;
- key-directory quoted_stringquoted_string;
- allow-v6-synthesis { address_match_elementaddress_match_element; ... }; // obsolete
- deallocate-on-exit booleanboolean; // obsolete
- fake-iquery booleanboolean; // obsolete
- fetch-glue booleanboolean; // obsolete
- has-old-clients booleanboolean; // obsolete
- maintain-ixfr-base booleanboolean; // obsolete
- max-ixfr-log-size sizesize; // obsolete
- multiple-cnames booleanboolean; // obsolete
- named-xfer quoted_stringquoted_string; // obsolete
- serial-queries integerinteger; // obsolete
- treat-cr-as-space booleanboolean; // obsolete
- use-id-pool booleanboolean; // obsolete
};
view view string string optional_classoptional_class {
- match-clients { address_match_elementaddress_match_element; ... };
- match-destinations { address_match_elementaddress_match_element; ... };
- match-recursive-only booleanboolean;
- key stringstring {
- algorithm stringstring;
- secret stringstring;
};
- zone string string optional_classoptional_class {
...
};
- server ( ipv4_address | ipv4_address | ipv6_addressipv6_address ) {
...
};
trusted-keys {
- string string integer integer integer integer integer integer quoted_stringquoted_string; ...
};
- allow-recursion { address_match_elementaddress_match_element; ... };
- sortlist { address_match_elementaddress_match_element; ... };
- topology { address_match_elementaddress_match_element; ... }; // not implemented
- auth-nxdomain booleanboolean; // default changed
- minimal-responses booleanboolean;
- recursion booleanboolean;
rrset-order {
[ class class stringstring ] [ type type stringstring ]
[ name name quoted_stringquoted_string ] ] string string stringstring; ...
};
- provide-ixfr booleanboolean;
- request-ixfr booleanboolean;
- rfc2308-type1 booleanboolean; // not yet implemented
- additional-from-auth booleanboolean;
- additional-from-cache booleanboolean;
- query-source querysource4querysource4;
- query-source-v6 querysource6querysource6;
- cleaning-interval integerinteger;
- min-roots integerinteger; // not implemented
- lame-ttl integerinteger;
- max-ncache-ttl integerinteger;
- max-cache-ttl integerinteger;
transfer-format ( many-answers | one-answer );
- max-cache-size size_no_defaultsize_no_default;
check-names ( master | slave | response )
( fail | warn | ignore );
- cache-file quoted_stringquoted_string;
- suppress-initial-notify booleanboolean; // not yet implemented
- preferred-glue stringstring;
dual-stack-servers [ port port integerinteger ] {
- ( quoted_stringquoted_string [port port integerinteger] |
- ipv4_addressipv4_address [port port integerinteger] |
- ipv6_addressipv6_address [port port integerinteger] ); ...
};
- edns-udp-size integerinteger;
root-delegation-only [ exclude { exclude { quoted_stringquoted_string; ... } ];
- disable-algorithms string { string { stringstring; ... };
- dnssec-enable booleanboolean;
- dnssec-lookaside string trust-anchor string trust-anchor stringstring;
- dnssec-must-be-secure string string booleanboolean;
- dialup dialuptypedialuptype;
- ixfr-from-differences ixfrdiffixfrdiff;
- allow-query { address_match_elementaddress_match_element; ... };
- allow-transfer { address_match_elementaddress_match_element; ... };
- allow-update-forwarding { address_match_elementaddress_match_element; ... };
- notify notifytypenotifytype;
- notify-source ( ipv4_addressipv4_address | * ) [ port ( port ( integerinteger | * ) ];
- notify-source-v6 ( ipv6_addressipv6_address | * ) [ port ( port ( integerinteger | * ) ];
also-notify [ port port integerinteger ] { ( ] { ( ipv4_address | ipv4_address | ipv6_addressipv6_address )
[ port port integerinteger ]; ... };
- allow-notify { address_match_elementaddress_match_element; ... };
forward ( first | only );
forwarders [ port port integerinteger ] {
- ( ipv4_address | ipv4_address | ipv6_addressipv6_address ) [ port port integerinteger ]; ...
};
- max-journal-size size_no_defaultsize_no_default;
- max-transfer-time-in integerinteger;
- max-transfer-time-out integerinteger;
- max-transfer-idle-in integerinteger;
- max-transfer-idle-out integerinteger;
- max-retry-time integerinteger;
- min-retry-time integerinteger;
- max-refresh-time integerinteger;
- min-refresh-time integerinteger;
- multi-master booleanboolean;
- sig-validity-interval integerinteger;
- transfer-source ( ipv4_addressipv4_address | * )
[ port ( port ( integerinteger | * ) ];
- transfer-source-v6 ( ipv6_addressipv6_address | * )
[ port ( port ( integerinteger | * ) ];
- alt-transfer-source ( ipv4_addressipv4_address | * )
[ port ( port ( integerinteger | * ) ];
- alt-transfer-source-v6 ( ipv6_addressipv6_address | * )
[ port ( port ( integerinteger | * ) ];
- use-alt-transfer-source booleanboolean;
- zone-statistics booleanboolean;
- key-directory quoted_stringquoted_string;
- allow-v6-synthesis { address_match_elementaddress_match_element; ... }; // obsolete
- fetch-glue booleanboolean; // obsolete
- maintain-ixfr-base booleanboolean; // obsolete
- max-ixfr-log-size sizesize; // obsolete
};
zone zone string string optional_classoptional_class {
type ( master | slave | stub | hint |
forward | delegation-only );
- file quoted_stringquoted_string;
masters [ port port integerinteger ] {
- ( mastersmasters |
- ipv4_addressipv4_address [port port integerinteger] |
- ipv6_addressipv6_address [ port port integerinteger ] ) [ key key stringstring ]; ...
};
- database stringstring;
- delegation-only booleanboolean;
check-names ( fail | warn | ignore );
- dialup dialuptypedialuptype;
- ixfr-from-differences booleanboolean;
- allow-query { address_match_elementaddress_match_element; ... };
- allow-transfer { address_match_elementaddress_match_element; ... };
- allow-update { address_match_elementaddress_match_element; ... };
- allow-update-forwarding { address_match_elementaddress_match_element; ... };
update-policy {
- ( grant | deny ) stringstring
- ( name | subdomain | wildcard | self ) stringstring
- rrtypelistrrtypelist; ...
};
- notify notifytypenotifytype;
- notify-source ( ipv4_addressipv4_address | * ) [ port ( port ( integerinteger | * ) ];
- notify-source-v6 ( ipv6_addressipv6_address | * ) [ port ( port ( integerinteger | * ) ];
also-notify [ port port integerinteger ] { ( ] { ( ipv4_address | ipv4_address | ipv6_addressipv6_address )
[ port port integerinteger ]; ... };
- allow-notify { address_match_elementaddress_match_element; ... };
forward ( first | only );
forwarders [ port port integerinteger ] {
- ( ipv4_address | ipv4_address | ipv6_addressipv6_address ) [ port port integerinteger ]; ...
};
- max-journal-size size_no_defaultsize_no_default;
- max-transfer-time-in integerinteger;
- max-transfer-time-out integerinteger;
- max-transfer-idle-in integerinteger;
- max-transfer-idle-out integerinteger;
- max-retry-time integerinteger;
- min-retry-time integerinteger;
- max-refresh-time integerinteger;
- min-refresh-time integerinteger;
- multi-master booleanboolean;
- sig-validity-interval integerinteger;
- transfer-source ( ipv4_addressipv4_address | * )
[ port ( port ( integerinteger | * ) ];
- transfer-source-v6 ( ipv6_addressipv6_address | * )
[ port ( port ( integerinteger | * ) ];
- alt-transfer-source ( ipv4_addressipv4_address | * )
[ port ( port ( integerinteger | * ) ];
- alt-transfer-source-v6 ( ipv6_addressipv6_address | * )
[ port ( port ( integerinteger | * ) ];
- use-alt-transfer-source booleanboolean;
- zone-statistics booleanboolean;
- key-directory quoted_stringquoted_string;
- ixfr-base quoted_stringquoted_string; // obsolete
- ixfr-tmp-file quoted_stringquoted_string; // obsolete
- maintain-ixfr-base booleanboolean; // obsolete
- max-ixfr-log-size sizesize; // obsolete
- pubkey integer integer integer integer integer integer quoted_stringquoted_string; // obsolete
};
Use IPv4 only even if the host machine is capable of IPv6. - -4 and -4 and -6-6 are mutually exclusive.
Use IPv6 only even if the host machine is capable of IPv4. - -4 and -4 and -6-6 are mutually exclusive.
Use Use config-fileconfig-file as the configuration file instead of the default, directorydirectory option in the configuration - file, config-fileconfig-file should be an absolute pathname.
Set the daemon's debug level to Set the daemon's debug level to debug-leveldebug-level. Debugging traces from
Create Create #cpus#cpus worker threads to take advantage of multiple CPUs. If not specified,
Listen for queries on port Listen for queries on port portport. If not specified, the default is port 53.
chroot() to chroot() to directorydirectory after
processing the command line arguments, but before
reading the configuration file.
@@ -390,14 +354,14 @@ ALIGN="CENTER"
ALIGN="LEFT"
>
This option should be used in conjunction with the - -u-u option, as chrooting a process running as root doesn't enhance security on most - systems; the way chroot()chroot() is defined allows a process with root privileges to escape a chroot jail. @@ -408,22 +372,18 @@ CLASS="FUNCTION" >
setuid() to setuid() to useruser after completing
privileged operations, such as creating sockets that
listen on privileged ports.
@@ -440,14 +400,14 @@ CLASS="COMMAND"
>named uses the kernel's
capability mechanism to drop all root privileges
- except the ability to bind()bind() to a
privileged port and set process resource limits.
- Unfortunately, this means that the -u-u
option only works when is run
on kernel 2.2.18 or later, or kernel 2.3.99-pre3 or
later, since previous kernels did not allow privileges
- to be retained after setuid()setuid().
Load data from Load data from cache-filecache-file into the cache of the default view.
- + +The --d-d option makes nsupdate uses the --y-y or --k-k option (with an HMAC-MD5 key) to provide the shared secret needed to generate a TSIG record for authenticating Dynamic DNS update requests. These options are mutually exclusive. With the --k-k option, nsupdate reads the shared secret from the file -keyfilekeyfile, whose name is of the form K{name}.+157.+{random}.key must also be present. When the --y-y option is used, a signature is generated from -keyname:secret.keyname:secret. -keynamekeyname is the name of the key, and -secretsecret is the base64 encoded shared secret. Use of the --y-y option is discouraged because the shared secret is supplied as a command line argument in clear text. @@ -288,9 +270,9 @@ CLASS="REFENTRYTITLE" > or in a history file maintained by the user's shell.
The The -k-k may also be used to specify a SIG(0) key used to authenticate Dynamic DNS update requests. In this case, the key specified is not an HMAC-MD5 key.
-v-v option makesThe The -t-t option sets the maximum time a update request can take before it is aborted. The default is 300 seconds. Zero can be used to disable the timeout.
The The -u-u option sets the UDP retry interval. The default is 3 seconds. If zero the interval will be computed from the timeout interval and number of UDP retries.
The The -r-r option sets the number of UDP retries. The default is 3. If zero only one update request will be made.
Sends all dynamic update requests to the name server
-servernameservername.
When no server statement is provided,
portport
is the port number on
-servernameservername
where the dynamic update requests get sent.
If no port number is specified, the default DNS port number of 53 is
@@ -432,11 +406,9 @@ CLASS="COMMAND"
> Sends all dynamic update requests using the local
-addressaddress.
When no local statement is provided,
@@ -445,11 +417,9 @@ CLASS="COMMAND"
>nsupdate
Specifies that all updates are to be made to the zone
-zonenamezonename.
If no
-zonezone
statement is provided,
Specify the default class.
-If no classclass is specified the default class is
-ININ. Specifies that all updates are to be TSIG signed using the
-keyname keyname keysecretkeysecret pair.
The key command
overrides any key specified on the command line via
--y or -y or -k-k. Requires that no resource record of any type exists with name
-domain-namedomain-name. Requires that
-domain-namedomain-name
exists (has as at least one resource record, of any type). Requires that no resource record exists of the specified
-typetype,
-classclass
and
-domain-namedomain-name.
If
-classclass
is omitted, IN (internet) is assumed. This requires that a resource record of the specified
-typetype,
-classclass
and
-domain-namedomain-name
must exist.
If
-classclass
is omitted, IN (internet) is assumed. The
-datadata
from each set of prerequisites of this form
sharing a common
-typetype,
-classclass,
and
-domain-namedomain-name
are combined to form a set of RRs. This set of RRs must
exactly match the set of RRs existing in the zone at the
given
-typetype,
-classclass,
and
-domain-namedomain-name.
The
-datadata
are written in the standard text representation of the resource record's
RDATA. Deletes any resource records named
-domain-namedomain-name.
If
-typetype
and
-datadata
is provided, only matching resource records will be removed.
The internet class is assumed if
-classclass
is not supplied. The
-ttlttl
is ignored, and is only allowed for compatibility. Adds a new resource record with the specified
-ttlttl,
-classclass
and
-datadata. used to identify default name server .
-
+
+
Specifies the key name of the rndc authentication key.
This must be a valid domain name.
- The default is rndc-keyrndc-key.
rndc-confgen -arndc-confgen -a
rndc-confgenrndc-confgen
The The optionsoptions statement contains five clauses.
- The default-serverdefault-server clause is followed by the
name or address of a name server. This host will be used when
no name server is given as an argument to
rndc. The . The default-keydefault-key
clause is followed by the name of a key which is identified by
- a keykey statement. If no
- keyidkeyid is provided on the rndc command line,
- and no keykey clause is found in a matching
- serverserver statement, this default key will be
used to authenticate the server's commands and responses. The
- default-portdefault-port clause is followed by the port
to connect to on the remote name server. If no
- portport option is provided on the rndc command
- line, and no portport clause is found in a
- matching serverserver statement, this default port
will be used to connect.
- The default-source-addressdefault-source-address and
- default-source-address-v6default-source-address-v6 clauses which
can be used to set the IPv4 and IPv6 source addresses
respectively.
After the After the serverserver keyword, the server
statement includes a string which is the hostname or address
for a name server. The statement has three possible clauses:
- key, key, portport and
- addressesaddresses. The key name must match the
name of a key statement in the file. The port number
- specifies the port to connect to. If an addressesaddresses
clause is supplied these addresses will be used instead of
the server name. Each address can take a optional port.
- If an source-address or source-address or source-address-v6source-address-v6
of supplied then these will be used to specify the IPv4 and IPv6
source addresses respectively.
The The keykey statement begins with an identifying
string, the name of the key. The statement has two clauses.
- algorithmalgorithm identifies the encryption algorithm
for :
rndc-confgenrndc-confgen
rndc.conf file, including the
randomly generated key, will be written to the standard
- output. Commented out keykey and
- controlscontrols statements for
:
echo "known plaintext for a secret" | mmencodeecho "known plaintext for a secret" | mmencode
/etc/resolv.conf/etc/resolv.confK{name}.+157.+{random}.keyK{name}.+157.+{random}.keyK{name}.+157.+{random}.privateK{name}.+157.+{random}.privaterndc-confgen
rndc.conf
Use Use source-addresssource-address as the source address for the connection to the server. Multiple instances are permitted to allow setting of both @@ -203,19 +187,15 @@ CLASS="REPLACEABLE"
Use Use config-fileconfig-file as the configuration file instead of the default,
Use Use key-filekey-file as the key file instead of the default, /etc/rndc.key will be used to authenticate - commands sent to the server if the config-fileconfig-file does not exist.
serverserver is the name or address of the server which matches a server statement in the configuration file for @@ -284,20 +254,16 @@ CLASS="COMMAND"
Send commands to TCP port - portport instead of BIND 9's default control channel port, 953.
Use the key Use the key keyidkeyid from the configuration file. - keyidkeyid must be known by named with the same algorithm and secret string in order for control message validation to succeed. - If no keyidkeyid is specified,
There is currently no way to provide the shared secret for a - key_idkey_id without using the configuration file.
The Internet Domain Name System (The Internet Domain Name System (DNSDNS) consists of the syntax to specify the names of entities in the Internet in a hierarchical manner, the rules used for delegating authority over names, and the system implementation that actually maps names to Internet - addresses. DNSDNS data is maintained in a group of distributed hierarchical databases.
The Berkeley Internet Name Domain (The Berkeley Internet Name Domain (BINDBIND) implements an domain name server for a number of operating systems. This document provides basic information about the installation and - care of the Internet Software Consortium (ISCISC) - BINDBIND version 9 software package for system administrators.
Section 1 introduces - the basic DNS and DNS and BINDBIND concepts. Section 2 - describes resource requirements for running BINDBIND in various environments. Information in in its presentation and is organized functionally, to aid in the process of installing the - BINDBIND 9 software. The task-oriented section is followed by Section 5 - describes the BINDBIND 9 lightweight resolver. The contents of Bibliography and - historic information related to BINDBIND and the Domain Name System.