From 82ab1fe0151a9b93853f17298130d2b94de85dc6 Mon Sep 17 00:00:00 2001
From: Mark Andrews
-
zone.
This will also remove the zone's .jnl file
and update the master file. Edit the zone file. Run
- rndc unfreeze zone
+ rndc thaw zone
to reload the changed zone and re-enable dynamic updates.
-y command line options.
A shared secret is generated to be shared between host1 and host2. An arbitrary key name is chosen: "host1-host2.". The key name must be the same on both hosts.
The following command will generate a 128-bit (16 byte) HMAC-MD5 key as described above. Longer keys are better, but shorter keys are easier to read. Note that the maximum key length is 512 bits; @@ -395,7 +395,7 @@ be used as the shared secret.
The shared secret is simply a random sequence of bits, encoded in base-64. Most ASCII strings are valid base-64 strings (assuming the length is a multiple of 4 and only valid characters are used), @@ -406,13 +406,13 @@ a similar program to generate base-64 encoded data.
This is beyond the scope of DNS. A secure transport mechanism should be used. This could be secure FTP, ssh, telephone, etc.
Imagine host1 and host 2 are
both servers. The following is added to each server's named.conf file:
@@ -433,7 +433,7 @@ response is signed by the same key.Since keys are shared between two hosts only, the server must be told when keys are to be used. The following is added to the
named.conffile for host1, if the IP address of host2 is @@ -456,7 +456,7 @@ sign request messages to host1.BIND allows IP addresses and ranges to be specified in ACL definitions and allow-{ query | transfer | update } directives. @@ -474,7 +474,7 @@ allow-update { key host1-host2. ;};
The processing of TSIG signed messages can result in several errors. If a signed message is sent to a non-TSIG aware server, a FORMERR (format error) will be returned, since @@ -497,7 +497,7 @@ allow-update { key host1-host2. ;};
TKEY is a mechanism for automatically generating a shared secret between two hosts. There are several "modes" of TKEY that specify how the key is @@ -524,7 +524,7 @@ allow-update { key host1-host2. ;};
BIND 9 partially supports DNSSEC SIG(0) transaction signatures as specified in RFC 2535 and RFC2931. SIG(0) uses public/private keys to authenticate messages. Access control @@ -567,7 +567,7 @@ allow-update { key host1-host2. ;}; zone key of another zone above this one in the DNS tree.
The dnssec-keygen program is used to generate keys.
A secure zone must contain one or more zone keys. The @@ -600,7 +600,7 @@ allow-update { key host1-host2. ;};
The dnssec-signzone program is used to sign a zone.
Any
keysetfiles corresponding @@ -627,7 +627,7 @@ allow-update { key host1-host2. ;};To enable named to respond appropriately to DNS requests from DNSSEC aware clients, @@ -713,7 +713,7 @@ options {
BIND 9 fully supports all currently defined forms of IPv6 name to address and address to name lookups. It will also use IPv6 addresses to make queries when running on an IPv6 capable diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html index 03525b721a..1474685df1 100644 --- a/doc/arm/Bv9ARM.ch06.html +++ b/doc/arm/Bv9ARM.ch06.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - +
@@ -63,27 +63,27 @@ Usage
This is the grammar of the lwres
statement in the named.conf file:
lwres { @@ -1032,7 +1032,7 @@ statement in thenamed.conffile:The lwres statement configures the name server to also act as a lightweight resolver server. (See the section called “Running a Resolver Daemon”.) There may be be multiple @@ -1060,20 +1060,20 @@ exact match lookup before search path elements are appended.
mastersname[portip_port] { (masters_list|ip_addr[portip_port] [keykey] ) ; [...] } ;masters lists allow for a common set of masters to be easily used by multiple stub and slave zones.
This is the grammar of the options statement in the
named.conffile:options { @@ -1702,7 +1702,7 @@ IN-ADDR.ARPA, IP6.ARPA, IP6.INT).The forwarding facility can be used to create a large site-wide cache on a few servers, reducing traffic over links to external name servers. It can also be used to allow queries by servers that @@ -1734,7 +1734,7 @@ Statement Grammar”
Dual-stack servers are used as servers of last resort to work around problems in reachability due the lack of support for either IPv4 or IPv6 on the host machine.
@@ -1815,7 +1815,7 @@ from these addresses will not be responded to. The default is +InterfacesThe interfaces and ports that the server will answer queries
from may be specified using the listen-on option. listen-on takes
an optional port, and an address_match_list.
@@ -1865,7 +1865,7 @@ the server will not listen on any IPv6 address.
If the server doesn't know the answer to a question, it will query other name servers. query-source specifies the address and port used for such queries. For queries sent over @@ -2056,7 +2056,7 @@ but applies to notify messages sent to IPv6 addresses.
avoid-v4-udp-ports and avoid-v6-udp-ports specify a list of IPv4 and IPv6 UDP ports that will not be used as system @@ -2167,7 +2167,7 @@ silently raised.
The server will remove expired resource records @@ -2662,7 +2662,7 @@ For more details, see the description of
trusted-keys {
string number number number string ;
[ string number number number string ; [...]]
@@ -2671,7 +2671,7 @@ For more details, see the description of
The trusted-keys statement defines
@@ -2714,7 +2714,7 @@ For more details, see the description of
The view statement is a powerful new feature
of BIND 9 that lets a name server answer a DNS query differently
depending on who is asking. It is particularly useful for implementing
@@ -2916,10 +2916,10 @@ zone zone_name [
@@ -3032,7 +3032,7 @@ from forwarders.
The zone's name may optionally be followed by a class. If
a class is not specified, class IN (for Internet),
is assumed. This is correct for the vast majority of cases.
@@ -3047,7 +3047,7 @@ in the mid-1970s. Zone data for it can be specified with the
+Zone Options
- allow-notify
See the description of
@@ -3295,7 +3295,7 @@ name, the rules are checked for each existing record type.
@@ -3305,7 +3305,7 @@ Since the publication of RFC 1034, several new RRs have been identified
and implemented in the DNS. These are also included.
A domain name identifies a node. Each node has a set of
resource information, which may be empty. The set of resource
information associated with a particular name is composed of
@@ -3654,7 +3654,7 @@ each of a different class.
As described above, domain servers store information as a
series of resource records, each of which contains a particular
piece of information about a given domain name (which is usually,
diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html
index 6edfa748cc..ccf9ee111f 100644
--- a/doc/arm/Bv9ARM.ch09.html
+++ b/doc/arm/Bv9ARM.ch09.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -51,7 +51,7 @@
@@ -261,17 +261,17 @@ the number of the RFC). RFCs are also available via the Web at
Standards
-[RFC974] Mail Routing and the Domain System. January 1986.
+[RFC974] Mail Routing and the Domain System. January 1986.
@@ -279,22 +279,22 @@ Specification. November 1987.
Proposed Standards
-[RFC2181] Clarifications to the DNS Specification. July 1997.
+[RFC2181] Clarifications to the DNS Specification. July 1997.
-[RFC2308] Negative Caching of DNS Queries. March 1998.
+[RFC2308] Negative Caching of DNS Queries. March 1998.
-[RFC1995] Incremental Zone Transfer in DNS. August 1996.
+[RFC1995] Incremental Zone Transfer in DNS. August 1996.
-[RFC1996] A Mechanism for Prompt Notification of Zone Changes. August 1996.
+[RFC1996] A Mechanism for Prompt Notification of Zone Changes. August 1996.
-[RFC2136] Dynamic Updates in the Domain Name System. April 1997.
+[RFC2136] Dynamic Updates in the Domain Name System. April 1997.
-[RFC2845] Secret Key Transaction Authentication for DNS (TSIG). May 2000.
+[RFC2845] Secret Key Transaction Authentication for DNS (TSIG). May 2000.
@@ -305,85 +305,85 @@ Specification. November 1987.
RFCs are undergoing major revision by the IETF.
-[RFC1886] DNS Extensions to support IP version 6. December 1995.
+[RFC1886] DNS Extensions to support IP version 6. December 1995.
-[RFC2065] Domain Name System Security Extensions. January 1997.
+[RFC2065] Domain Name System Security Extensions. January 1997.
-[RFC2137] Secure Domain Name System Dynamic Update. April 1997.
+[RFC2137] Secure Domain Name System Dynamic Update. April 1997.
Other Important RFCs About DNS Implementation
-[RFC1535] A Security Problem and Proposed Correction With Widely Deployed DNS Software.. October 1993.
+[RFC1535] A Security Problem and Proposed Correction With Widely Deployed DNS Software.. October 1993.
Resource Record Types
-[RFC1706] DNS NSAP Resource Records. October 1994.
+[RFC1706] DNS NSAP Resource Records. October 1994.
-[RFC2168] Resolution of Uniform Resource Identifiers using
+[RFC2168] Resolution of Uniform Resource Identifiers using
the Domain Name System. June 1997.
-[RFC1876] A Means for Expressing Location Information in the Domain
+[RFC1876] A Means for Expressing Location Information in the Domain
Name System. January 1996.
-[RFC2052] A DNS RR for Specifying the Location of
+[RFC2052] A DNS RR for Specifying the Location of
Services.. October 1996.
DNS and the Internet
-[RFC1101] DNS Encoding of Network Names and Other Types. April 1989.
+[RFC1101] DNS Encoding of Network Names and Other Types. April 1989.
-[RFC1123] Requirements for Internet Hosts - Application and Support. October 1989.
+[RFC1123] Requirements for Internet Hosts - Application and Support. October 1989.
DNS Operations
-[RFC1537] Common DNS Data File Configuration Errors. October 1993.
+[RFC1537] Common DNS Data File Configuration Errors. October 1993.
-[RFC1912] Common DNS Operational and Configuration Errors. February 1996.
+[RFC1912] Common DNS Operational and Configuration Errors. February 1996.
@@ -394,28 +394,28 @@ Conformant Global Address Mapping. January 1998
DNS-related, are not concerned with implementing software.
-[RFC1464] Using the Domain Name System To Store Arbitrary String Attributes. May 1993.
+[RFC1464] Using the Domain Name System To Store Arbitrary String Attributes. May 1993.
-[RFC1713] Tools for DNS Debugging. November 1994.
+[RFC1713] Tools for DNS Debugging. November 1994.
-[RFC1794] DNS Support for Load Balancing. April 1995.
+[RFC1794] DNS Support for Load Balancing. April 1995.
-[RFC2240] A Legal Basis for Domain Name Allocation. November 1997.
+[RFC2240] A Legal Basis for Domain Name Allocation. November 1997.
-[RFC2345] Domain Names and Company Name Retrieval. May 1998.
+[RFC2345] Domain Names and Company Name Retrieval. May 1998.
-[RFC2352] A Convention For Using Legal Names as Domain Names. May 1998.
+[RFC2352] A Convention For Using Legal Names as Domain Names. May 1998.
Obsolete and Unimplemented Experimental RRs
@@ -435,13 +435,13 @@ after which they are deleted unless updated by their authors.
-DNS and BIND. Copyright © 1998 Sebastopol, CA: O'Reilly and Associates.
+DNS and BIND. Copyright © 1998 Sebastopol, CA: O'Reilly and Associates.
diff --git a/doc/arm/Bv9ARM.html b/doc/arm/Bv9ARM.html
index dc212621e0..6c62d12533 100644
--- a/doc/arm/Bv9ARM.html
+++ b/doc/arm/Bv9ARM.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -95,22 +95,22 @@
Split DNS
TSIG
-- Generate Shared Keys for Each Pair of Hosts
-- Copying the Shared Secret to Both Machines
-- Informing the Servers of the Key's Existence
-- Instructing the Server to Use the Key
-- TSIG Key Based Access Control
-- Errors
+- Generate Shared Keys for Each Pair of Hosts
+- Copying the Shared Secret to Both Machines
+- Informing the Servers of the Key's Existence
+- Instructing the Server to Use the Key
+- TSIG Key Based Access Control
+- Errors
-TKEY
-SIG(0)
+TKEY
+SIG(0)
DNSSEC
-IPv6 Support in BIND 9
+IPv6 Support in BIND 9
- Address Lookups Using AAAA Records
- Address to Name Lookups Using Nibble Format
@@ -141,27 +141,27 @@ Usage
- key Statement Definition and Usage
- logging Statement Grammar
- logging Statement Definition and Usage
-- lwres Statement Grammar
-- lwres Statement Definition and Usage
-- masters Statement Grammar
-- masters Statement Definition and Usage
-- options Statement Grammar
+- lwres Statement Grammar
+- lwres Statement Definition and Usage
+- masters Statement Grammar
+- masters Statement Definition and Usage
+- options Statement Grammar
- options Statement Definition and Usage
- server Statement Grammar
- server Statement Definition and Usage
-- trusted-keys Statement Grammar
-- trusted-keys Statement Definition
+
- trusted-keys Statement Grammar
+- trusted-keys Statement Definition
and Usage
- view Statement Grammar
-- view Statement Definition and Usage
+- view Statement Definition and Usage
- zone
Statement Grammar
-- zone Statement Definition and Usage
+- zone Statement Definition and Usage
-Zone File
+Zone File