Bv9ARM.ch03.html 30.4 KB
Newer Older
1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
Rob Austein's avatar
regen  
Rob Austein committed
2
<!--
Tinderbox User's avatar
Tinderbox User committed
3
 - Copyright (C) 2000-2020 Internet Systems Consortium, Inc. ("ISC")
Rob Austein's avatar
regen  
Rob Austein committed
4
 - 
Tinderbox User's avatar
Tinderbox User committed
5 6 7
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
 - file, You can obtain one at http://mozilla.org/MPL/2.0/.
Rob Austein's avatar
regen  
Rob Austein committed
8
-->
9
<html lang="en">
Rob Austein's avatar
regen  
Rob Austein committed
10 11 12
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Chapter3.Name Server Configuration</title>
Tinderbox User's avatar
Tinderbox User committed
13
<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
Evan Hunt's avatar
Evan Hunt committed
14
<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
Rob Austein's avatar
regen  
Rob Austein committed
15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32
<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
<link rel="prev" href="Bv9ARM.ch02.html" title="Chapter2.BIND Resource Requirements">
<link rel="next" href="Bv9ARM.ch04.html" title="Chapter4.Advanced DNS Features">
</head>
<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
<div class="navheader">
<table width="100%" summary="Navigation header">
<tr><th colspan="3" align="center">Chapter3.Name Server Configuration</th></tr>
<tr>
<td width="20%" align="left">
<a accesskey="p" href="Bv9ARM.ch02.html">Prev</a></td>
<th width="60%" align="center"></th>
<td width="20%" align="right"><a accesskey="n" href="Bv9ARM.ch04.html">Next</a>
</td>
</tr>
</table>
<hr>
</div>
Tinderbox User's avatar
Tinderbox User committed
33 34 35
<div class="chapter">
<div class="titlepage"><div><div><h1 class="title">
<a name="Bv9ARM.ch03"></a>Chapter3.Name Server Configuration</h1></div></div></div>
Rob Austein's avatar
regen  
Rob Austein committed
36 37
<div class="toc">
<p><b>Table of Contents</b></p>
Tinderbox User's avatar
Tinderbox User committed
38
<dl class="toc">
Evan Hunt's avatar
Evan Hunt committed
39
<dt><span class="section"><a href="Bv9ARM.ch03.html#sample_configuration">Sample Configurations</a></span></dt>
Rob Austein's avatar
regen  
Rob Austein committed
40
<dd><dl>
Tinderbox User's avatar
Tinderbox User committed
41 42
<dt><span class="section"><a href="Bv9ARM.ch03.html#cache_only_sample">A Caching-only Name Server</a></span></dt>
<dt><span class="section"><a href="Bv9ARM.ch03.html#auth_only_sample">An Authoritative-only Name Server</a></span></dt>
Rob Austein's avatar
regen  
Rob Austein committed
43
</dl></dd>
Tinderbox User's avatar
Tinderbox User committed
44 45
<dt><span class="section"><a href="Bv9ARM.ch03.html#load_balancing">Load Balancing</a></span></dt>
<dt><span class="section"><a href="Bv9ARM.ch03.html#ns_operations">Name Server Operations</a></span></dt>
Rob Austein's avatar
regen  
Rob Austein committed
46
<dd><dl>
Tinderbox User's avatar
Tinderbox User committed
47 48
<dt><span class="section"><a href="Bv9ARM.ch03.html#tools">Tools for Use With the Name Server Daemon</a></span></dt>
<dt><span class="section"><a href="Bv9ARM.ch03.html#signals">Signals</a></span></dt>
Rob Austein's avatar
regen  
Rob Austein committed
49 50 51
</dl></dd>
</dl>
</div>
Tinderbox User's avatar
Tinderbox User committed
52 53

    <p>
Automatic Updater's avatar
regen  
Automatic Updater committed
54
      In this chapter we provide some suggested configurations along
Mark Andrews's avatar
gregen  
Mark Andrews committed
55 56
      with guidelines for their use.  We suggest reasonable values for
      certain option settings.
Rob Austein's avatar
regen  
Rob Austein committed
57
    </p>
Tinderbox User's avatar
Tinderbox User committed
58 59

    <div class="section">
Rob Austein's avatar
regen  
Rob Austein committed
60 61
<div class="titlepage"><div><div><h2 class="title" style="clear: both">
<a name="sample_configuration"></a>Sample Configurations</h2></div></div></div>
Tinderbox User's avatar
Tinderbox User committed
62 63

      <div class="section">
Rob Austein's avatar
regen  
Rob Austein committed
64
<div class="titlepage"><div><div><h3 class="title">
Tinderbox User's avatar
Tinderbox User committed
65
<a name="cache_only_sample"></a>A Caching-only Name Server</h3></div></div></div>
Tinderbox User's avatar
Tinderbox User committed
66 67

        <p>
Rob Austein's avatar
regen  
Rob Austein committed
68 69 70
          The following sample configuration is appropriate for a caching-only
          name server for use by clients internal to a corporation.  All
          queries
Evan Hunt's avatar
Evan Hunt committed
71
          from outside clients are refused using the <span class="command"><strong>allow-query</strong></span>
Rob Austein's avatar
regen  
Rob Austein committed
72 73 74 75
          option.  Alternatively, the same effect could be achieved using
          suitable
          firewall rules.
        </p>
Tinderbox User's avatar
Tinderbox User committed
76

Rob Austein's avatar
regen  
Rob Austein committed
77 78
<pre class="programlisting">
// Two corporate subnets we wish to allow queries from.
Andreas Gustafsson's avatar
Andreas Gustafsson committed
79
acl corpnets { 192.168.4.0/24; 192.168.7.0/24; };
80
options {
Automatic Updater's avatar
regen  
Automatic Updater committed
81 82 83
     // Working directory
     directory "/etc/namedb";

Andreas Gustafsson's avatar
Andreas Gustafsson committed
84
     allow-query { corpnets; };
85
};
Automatic Updater's avatar
regen  
Automatic Updater committed
86 87
// Provide a reverse mapping for the loopback
// address 127.0.0.1
88 89 90 91 92
zone "0.0.127.in-addr.arpa" {
     type master;
     file "localhost.rev";
     notify no;
};
Rob Austein's avatar
regen  
Rob Austein committed
93
</pre>
Tinderbox User's avatar
Tinderbox User committed
94 95 96 97

      </div>

      <div class="section">
Rob Austein's avatar
regen  
Rob Austein committed
98
<div class="titlepage"><div><div><h3 class="title">
Tinderbox User's avatar
Tinderbox User committed
99
<a name="auth_only_sample"></a>An Authoritative-only Name Server</h3></div></div></div>
Tinderbox User's avatar
Tinderbox User committed
100 101

        <p>
Rob Austein's avatar
regen  
Rob Austein committed
102 103 104 105
          This sample configuration is for an authoritative-only server
          that is the master server for "<code class="filename">example.com</code>"
          and a slave for the subdomain "<code class="filename">eng.example.com</code>".
        </p>
Tinderbox User's avatar
Tinderbox User committed
106

Rob Austein's avatar
regen  
Rob Austein committed
107 108
<pre class="programlisting">
options {
Automatic Updater's avatar
regen  
Automatic Updater committed
109 110 111 112 113 114 115 116
     // Working directory
     directory "/etc/namedb";
     // Do not allow access to cache
     allow-query-cache { none; };
     // This is the default
     allow-query { any; };
     // Do not provide recursive service
     recursion no;
117 118
};

Automatic Updater's avatar
regen  
Automatic Updater committed
119 120
// Provide a reverse mapping for the loopback
// address 127.0.0.1
121 122 123 124 125 126 127 128 129
zone "0.0.127.in-addr.arpa" {
     type master;
     file "localhost.rev";
     notify no;
};
// We are the master server for example.com
zone "example.com" {
     type master;
     file "example.com.db";
Automatic Updater's avatar
regen  
Automatic Updater committed
130 131
     // IP addresses of slave servers allowed to
     // transfer example.com
132 133 134 135 136 137 138 139 140 141 142 143
     allow-transfer {
          192.168.4.14;
          192.168.5.53;
     };
};
// We are a slave server for eng.example.com
zone "eng.example.com" {
     type slave;
     file "eng.example.com.bk";
     // IP address of eng.example.com master server
     masters { 192.168.4.12; };
};
Rob Austein's avatar
regen  
Rob Austein committed
144
</pre>
Tinderbox User's avatar
Tinderbox User committed
145 146 147 148 149

      </div>
    </div>

    <div class="section">
Rob Austein's avatar
regen  
Rob Austein committed
150
<div class="titlepage"><div><div><h2 class="title" style="clear: both">
Tinderbox User's avatar
Tinderbox User committed
151
<a name="load_balancing"></a>Load Balancing</h2></div></div></div>
Tinderbox User's avatar
Tinderbox User committed
152 153 154 155

      

      <p>
Rob Austein's avatar
regen  
Rob Austein committed
156
        A primitive form of load balancing can be achieved in
Mark Andrews's avatar
regen  
Mark Andrews committed
157 158
        the <acronym class="acronym">DNS</acronym> by using multiple records
        (such as multiple A records) for one name.
Rob Austein's avatar
regen  
Rob Austein committed
159
      </p>
Tinderbox User's avatar
Tinderbox User committed
160 161

      <p>
Rob Austein's avatar
regen  
Rob Austein committed
162 163 164 165 166
        For example, if you have three WWW servers with network addresses
        of 10.0.0.1, 10.0.0.2 and 10.0.0.3, a set of records such as the
        following means that clients will connect to each machine one third
        of the time:
      </p>
Tinderbox User's avatar
Tinderbox User committed
167 168 169

      <div class="informaltable">
        <table border="1">
Rob Austein's avatar
regen  
Rob Austein committed
170
<colgroup>
Evan Hunt's avatar
Evan Hunt committed
171 172 173 174 175
<col width="0.875in" class="1">
<col width="0.500in" class="2">
<col width="0.750in" class="3">
<col width="0.750in" class="4">
<col width="2.028in" class="5">
Rob Austein's avatar
regen  
Rob Austein committed
176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282
</colgroup>
<tbody>
<tr>
<td>
                <p>
                  Name
                </p>
              </td>
<td>
                <p>
                  TTL
                </p>
              </td>
<td>
                <p>
                  CLASS
                </p>
              </td>
<td>
                <p>
                  TYPE
                </p>
              </td>
<td>
                <p>
                  Resource Record (RR) Data
                </p>
              </td>
</tr>
<tr>
<td>
                <p>
                  <code class="literal">www</code>
                </p>
              </td>
<td>
                <p>
                  <code class="literal">600</code>
                </p>
              </td>
<td>
                <p>
                  <code class="literal">IN</code>
                </p>
              </td>
<td>
                <p>
                  <code class="literal">A</code>
                </p>
              </td>
<td>
                <p>
                  <code class="literal">10.0.0.1</code>
                </p>
              </td>
</tr>
<tr>
<td>
                <p></p>
              </td>
<td>
                <p>
                  <code class="literal">600</code>
                </p>
              </td>
<td>
                <p>
                  <code class="literal">IN</code>
                </p>
              </td>
<td>
                <p>
                  <code class="literal">A</code>
                </p>
              </td>
<td>
                <p>
                  <code class="literal">10.0.0.2</code>
                </p>
              </td>
</tr>
<tr>
<td>
                <p></p>
              </td>
<td>
                <p>
                  <code class="literal">600</code>
                </p>
              </td>
<td>
                <p>
                  <code class="literal">IN</code>
                </p>
              </td>
<td>
                <p>
                  <code class="literal">A</code>
                </p>
              </td>
<td>
                <p>
                  <code class="literal">10.0.0.3</code>
                </p>
              </td>
</tr>
</tbody>
Tinderbox User's avatar
Tinderbox User committed
283 284 285
</table>
      </div>
      <p>
Mark Andrews's avatar
regen  
Mark Andrews committed
286
        When a resolver queries for these records, <acronym class="acronym">BIND</acronym> will rotate
Rob Austein's avatar
regen  
Rob Austein committed
287 288 289 290 291
        them and respond to the query with the records in a different
        order.  In the example above, clients will randomly receive
        records in the order 1, 2, 3; 2, 3, 1; and 3, 1, 2. Most clients
        will use the first record returned and discard the rest.
      </p>
Tinderbox User's avatar
Tinderbox User committed
292
      <p>
Rob Austein's avatar
regen  
Rob Austein committed
293
        For more detail on ordering responses, check the
Evan Hunt's avatar
Evan Hunt committed
294 295 296
        <span class="command"><strong>rrset-order</strong></span> sub-statement in the
        <span class="command"><strong>options</strong></span> statement, see
        <a class="xref" href="Bv9ARM.ch06.html#rrset_ordering" title="RRset Ordering">RRset Ordering</a>.
Rob Austein's avatar
regen  
Rob Austein committed
297
      </p>
Tinderbox User's avatar
Tinderbox User committed
298 299 300 301

    </div>

    <div class="section">
Rob Austein's avatar
regen  
Rob Austein committed
302
<div class="titlepage"><div><div><h2 class="title" style="clear: both">
Tinderbox User's avatar
Tinderbox User committed
303
<a name="ns_operations"></a>Name Server Operations</h2></div></div></div>
Tinderbox User's avatar
Tinderbox User committed
304 305

      <div class="section">
Rob Austein's avatar
regen  
Rob Austein committed
306
<div class="titlepage"><div><div><h3 class="title">
Tinderbox User's avatar
Tinderbox User committed
307
<a name="tools"></a>Tools for Use With the Name Server Daemon</h3></div></div></div>
Tinderbox User's avatar
Tinderbox User committed
308
        <p>
Mark Andrews's avatar
gregen  
Mark Andrews committed
309 310 311 312
          This section describes several indispensable diagnostic,
          administrative and monitoring tools available to the system
          administrator for controlling and debugging the name server
          daemon.
Rob Austein's avatar
regen  
Rob Austein committed
313
        </p>
Tinderbox User's avatar
Tinderbox User committed
314
        <div class="section">
Rob Austein's avatar
regen  
Rob Austein committed
315 316
<div class="titlepage"><div><div><h4 class="title">
<a name="diagnostic_tools"></a>Diagnostic Tools</h4></div></div></div>
Tinderbox User's avatar
Tinderbox User committed
317
          <p>
Evan Hunt's avatar
Evan Hunt committed
318 319
            The <span class="command"><strong>dig</strong></span>, <span class="command"><strong>host</strong></span>, and
            <span class="command"><strong>nslookup</strong></span> programs are all command
Rob Austein's avatar
regen  
Rob Austein committed
320 321 322 323
            line tools
            for manually querying name servers.  They differ in style and
            output format.
          </p>
Tinderbox User's avatar
Tinderbox User committed
324 325

          <div class="variablelist"><dl class="variablelist">
Evan Hunt's avatar
Evan Hunt committed
326
<dt><span class="term"><a name="dig"></a><span class="command"><strong>dig</strong></span></span></dt>
Rob Austein's avatar
regen  
Rob Austein committed
327
<dd>
Tinderbox User's avatar
Tinderbox User committed
328
                <p>
Tinderbox User's avatar
Tinderbox User committed
329
                  <span class="command"><strong>dig</strong></span>
Rob Austein's avatar
regen  
Rob Austein committed
330 331 332 333 334 335 336 337
                  is the most versatile and complete of these lookup tools.
                  It has two modes: simple interactive
                  mode for a single query, and batch mode which executes a
                  query for
                  each in a list of several query lines. All query options are
                  accessible
                  from the command line.
                </p>
Tinderbox User's avatar
Tinderbox User committed
338 339 340 341 342 343 344 345 346 347 348
                <div class="cmdsynopsis"><p>
                  <code class="command">dig</code> 
                   [@<em class="replaceable"><code>server</code></em>]
                    <em class="replaceable"><code>domain</code></em> 
                   [<em class="replaceable"><code>query-type</code></em>]
                   [<em class="replaceable"><code>query-class</code></em>]
                   [+<em class="replaceable"><code>query-option</code></em>]
                   [-<em class="replaceable"><code>dig-option</code></em>]
                   [%<em class="replaceable"><code>comment</code></em>]
                </p></div>
                <p>
Evan Hunt's avatar
Evan Hunt committed
349
                  The usual simple use of <span class="command"><strong>dig</strong></span> will take the form
Rob Austein's avatar
regen  
Rob Austein committed
350
                </p>
Tinderbox User's avatar
Tinderbox User committed
351
                <p class="simpara">
Evan Hunt's avatar
Evan Hunt committed
352
                  <span class="command"><strong>dig @server domain query-type query-class</strong></span>
Rob Austein's avatar
regen  
Rob Austein committed
353
                </p>
Tinderbox User's avatar
Tinderbox User committed
354
                <p>
Rob Austein's avatar
regen  
Rob Austein committed
355
                  For more information and a list of available commands and
Evan Hunt's avatar
Evan Hunt committed
356
                  options, see the <span class="command"><strong>dig</strong></span> man
Rob Austein's avatar
regen  
Rob Austein committed
357 358
                  page.
                </p>
Tinderbox User's avatar
Tinderbox User committed
359
              </dd>
Evan Hunt's avatar
Evan Hunt committed
360
<dt><span class="term"><span class="command"><strong>host</strong></span></span></dt>
Rob Austein's avatar
regen  
Rob Austein committed
361
<dd>
Tinderbox User's avatar
Tinderbox User committed
362
                <p>
Evan Hunt's avatar
Evan Hunt committed
363
                  The <span class="command"><strong>host</strong></span> utility emphasizes
Rob Austein's avatar
regen  
Rob Austein committed
364 365 366 367 368 369
                  simplicity
                  and ease of use.  By default, it converts
                  between host names and Internet addresses, but its
                  functionality
                  can be extended with the use of options.
                </p>
Tinderbox User's avatar
Tinderbox User committed
370 371 372 373 374 375 376 377 378 379 380 381 382 383 384
                <div class="cmdsynopsis"><p>
                  <code class="command">host</code> 
                   [-aCdlnrsTwv]
                   [-c <em class="replaceable"><code>class</code></em>]
                   [-N <em class="replaceable"><code>ndots</code></em>]
                   [-t <em class="replaceable"><code>type</code></em>]
                   [-W <em class="replaceable"><code>timeout</code></em>]
                   [-R <em class="replaceable"><code>retries</code></em>]
                   [-m <em class="replaceable"><code>flag</code></em>]
                   [-4]
                   [-6]
                    <em class="replaceable"><code>hostname</code></em> 
                   [<em class="replaceable"><code>server</code></em>]
                </p></div>
                <p>
Rob Austein's avatar
regen  
Rob Austein committed
385
                  For more information and a list of available commands and
Evan Hunt's avatar
Evan Hunt committed
386
                  options, see the <span class="command"><strong>host</strong></span> man
Rob Austein's avatar
regen  
Rob Austein committed
387 388
                  page.
                </p>
Tinderbox User's avatar
Tinderbox User committed
389
              </dd>
Evan Hunt's avatar
Evan Hunt committed
390
<dt><span class="term"><span class="command"><strong>nslookup</strong></span></span></dt>
Rob Austein's avatar
regen  
Rob Austein committed
391
<dd>
Tinderbox User's avatar
Tinderbox User committed
392
                <p><span class="command"><strong>nslookup</strong></span>
Mark Andrews's avatar
gregen  
Mark Andrews committed
393
                  has two modes: interactive and
Rob Austein's avatar
regen  
Rob Austein committed
394 395 396 397 398 399 400
                  non-interactive. Interactive mode allows the user to
                  query name servers for information about various
                  hosts and domains or to print a list of hosts in a
                  domain. Non-interactive mode is used to print just
                  the name and requested information for a host or
                  domain.
                </p>
Tinderbox User's avatar
Tinderbox User committed
401 402 403 404 405 406 407 408 409
                <div class="cmdsynopsis"><p>
                  <code class="command">nslookup</code> 
                   [-option...]
                   [
                    [<em class="replaceable"><code>host-to-find</code></em>]
                     |  [- [server]]
                  ]
                </p></div>
                <p>
Rob Austein's avatar
regen  
Rob Austein committed
410 411 412 413 414 415 416
                  Interactive mode is entered when no arguments are given (the
                  default name server will be used) or when the first argument
                  is a
                  hyphen (`-') and the second argument is the host name or
                  Internet address
                  of a name server.
                </p>
Tinderbox User's avatar
Tinderbox User committed
417
                <p>
Rob Austein's avatar
regen  
Rob Austein committed
418 419 420 421 422 423 424
                  Non-interactive mode is used when the name or Internet
                  address
                  of the host to be looked up is given as the first argument.
                  The
                  optional second argument specifies the host name or address
                  of a name server.
                </p>
Tinderbox User's avatar
Tinderbox User committed
425
                <p>
Rob Austein's avatar
regen  
Rob Austein committed
426
                  Due to its arcane user interface and frequently inconsistent
Evan Hunt's avatar
Evan Hunt committed
427 428
                  behavior, we do not recommend the use of <span class="command"><strong>nslookup</strong></span>.
                  Use <span class="command"><strong>dig</strong></span> instead.
Rob Austein's avatar
regen  
Rob Austein committed
429
                </p>
Tinderbox User's avatar
Tinderbox User committed
430
              </dd>
Rob Austein's avatar
regen  
Rob Austein committed
431
</dl></div>
Tinderbox User's avatar
Tinderbox User committed
432 433 434
        </div>

        <div class="section">
Rob Austein's avatar
regen  
Rob Austein committed
435 436
<div class="titlepage"><div><div><h4 class="title">
<a name="admin_tools"></a>Administrative Tools</h4></div></div></div>
Tinderbox User's avatar
Tinderbox User committed
437
          <p>
Rob Austein's avatar
regen  
Rob Austein committed
438 439 440
            Administrative tools play an integral part in the management
            of a server.
          </p>
Tinderbox User's avatar
Tinderbox User committed
441
          <div class="variablelist"><dl class="variablelist">
Rob Austein's avatar
regen  
Rob Austein committed
442
<dt>
Evan Hunt's avatar
Evan Hunt committed
443
<a name="named-checkconf"></a><span class="term"><span class="command"><strong>named-checkconf</strong></span></span>
Rob Austein's avatar
regen  
Rob Austein committed
444 445
</dt>
<dd>
Tinderbox User's avatar
Tinderbox User committed
446
                <p>
Evan Hunt's avatar
Evan Hunt committed
447
                  The <span class="command"><strong>named-checkconf</strong></span> program
Rob Austein's avatar
regen  
Rob Austein committed
448 449
                  checks the syntax of a <code class="filename">named.conf</code> file.
                </p>
Tinderbox User's avatar
Tinderbox User committed
450 451 452 453 454 455 456
                <div class="cmdsynopsis"><p>
                  <code class="command">named-checkconf</code> 
                   [-jvz]
                   [-t <em class="replaceable"><code>directory</code></em>]
                   [<em class="replaceable"><code>filename</code></em>]
                </p></div>
              </dd>
Rob Austein's avatar
regen  
Rob Austein committed
457
<dt>
Evan Hunt's avatar
Evan Hunt committed
458
<a name="named-checkzone"></a><span class="term"><span class="command"><strong>named-checkzone</strong></span></span>
Rob Austein's avatar
regen  
Rob Austein committed
459 460
</dt>
<dd>
Tinderbox User's avatar
Tinderbox User committed
461
                <p>
Evan Hunt's avatar
Evan Hunt committed
462
                  The <span class="command"><strong>named-checkzone</strong></span> program
Rob Austein's avatar
regen  
Rob Austein committed
463 464 465
                  checks a master file for
                  syntax and consistency.
                </p>
Tinderbox User's avatar
Tinderbox User committed
466 467 468 469 470 471 472 473 474 475 476 477 478 479
                <div class="cmdsynopsis"><p>
                  <code class="command">named-checkzone</code> 
                   [-djqvD]
                   [-c <em class="replaceable"><code>class</code></em>]
                   [-o <em class="replaceable"><code>output</code></em>]
                   [-t <em class="replaceable"><code>directory</code></em>]
                   [-w <em class="replaceable"><code>directory</code></em>]
                   [-k <em class="replaceable"><code>(ignore|warn|fail)</code></em>]
                   [-n <em class="replaceable"><code>(ignore|warn|fail)</code></em>]
                   [-W <em class="replaceable"><code>(ignore|warn)</code></em>]
                    <em class="replaceable"><code>zone</code></em> 
                   [<em class="replaceable"><code>filename</code></em>]
                </p></div>
              </dd>
Rob Austein's avatar
regen  
Rob Austein committed
480
<dt>
Evan Hunt's avatar
Evan Hunt committed
481
<a name="named-compilezone"></a><span class="term"><span class="command"><strong>named-compilezone</strong></span></span>
482
</dt>
Tinderbox User's avatar
Tinderbox User committed
483 484
<dd>
                <p>
Evan Hunt's avatar
Evan Hunt committed
485
                  Similar to <span class="command"><strong>named-checkzone,</strong></span> but
Mark Andrews's avatar
gregen  
Mark Andrews committed
486 487
                  it always dumps the zone content to a specified file
                  (typically in a different format).
Tinderbox User's avatar
Tinderbox User committed
488 489
                </p>
              </dd>
490
<dt>
Evan Hunt's avatar
Evan Hunt committed
491
<a name="rndc"></a><span class="term"><span class="command"><strong>rndc</strong></span></span>
Rob Austein's avatar
regen  
Rob Austein committed
492 493
</dt>
<dd>
Tinderbox User's avatar
Tinderbox User committed
494
                <p>
Rob Austein's avatar
regen  
Rob Austein committed
495
                  The remote name daemon control
Evan Hunt's avatar
Evan Hunt committed
496
                  (<span class="command"><strong>rndc</strong></span>) program allows the
Rob Austein's avatar
regen  
Rob Austein committed
497 498
                  system
                  administrator to control the operation of a name server.
Evan Hunt's avatar
Evan Hunt committed
499 500 501 502 503
                  Since <acronym class="acronym">BIND</acronym> 9.2, <span class="command"><strong>rndc</strong></span>
                  supports all the commands of the BIND 8 <span class="command"><strong>ndc</strong></span>
                  utility except <span class="command"><strong>ndc start</strong></span> and
                  <span class="command"><strong>ndc restart</strong></span>, which were also
                  not supported in <span class="command"><strong>ndc</strong></span>'s
Mark Andrews's avatar
regen  
Mark Andrews committed
504
                  channel mode.
Evan Hunt's avatar
Evan Hunt committed
505
                  If you run <span class="command"><strong>rndc</strong></span> without any
Rob Austein's avatar
regen  
Rob Austein committed
506 507 508
                  options
                  it will display a usage message as follows:
                </p>
Tinderbox User's avatar
Tinderbox User committed
509 510 511 512 513 514 515 516 517 518 519
                <div class="cmdsynopsis"><p>
                  <code class="command">rndc</code> 
                   [-c <em class="replaceable"><code>config</code></em>]
                   [-s <em class="replaceable"><code>server</code></em>]
                   [-p <em class="replaceable"><code>port</code></em>]
                   [-y <em class="replaceable"><code>key</code></em>]
                    <em class="replaceable"><code>command</code></em> 
                   [<em class="replaceable"><code>command</code></em>...]
                </p></div>

                <p>See <a class="xref" href="man.rndc.html" title="rndc"><span class="refentrytitle"><span class="application">rndc</span></span>(8)</a> for details of
Evan Hunt's avatar
Evan Hunt committed
520
                  the available <span class="command"><strong>rndc</strong></span> commands.
Rob Austein's avatar
regen  
Rob Austein committed
521
                </p>
Tinderbox User's avatar
Tinderbox User committed
522 523

                <p>
Evan Hunt's avatar
Evan Hunt committed
524
                  <span class="command"><strong>rndc</strong></span> requires a configuration file,
Tinderbox User's avatar
Tinderbox User committed
525
                  since all
Rob Austein's avatar
regen  
Rob Austein committed
526 527 528 529
                  communication with the server is authenticated with
                  digital signatures that rely on a shared secret, and
                  there is no way to provide that secret other than with a
                  configuration file.  The default location for the
Evan Hunt's avatar
Evan Hunt committed
530
                  <span class="command"><strong>rndc</strong></span> configuration file is
Rob Austein's avatar
regen  
Rob Austein committed
531 532 533 534
                  <code class="filename">/etc/rndc.conf</code>, but an
                  alternate
                  location can be specified with the <code class="option">-c</code>
                  option.  If the configuration file is not found,
Evan Hunt's avatar
Evan Hunt committed
535
                  <span class="command"><strong>rndc</strong></span> will also look in
Rob Austein's avatar
regen  
Rob Austein committed
536 537
                  <code class="filename">/etc/rndc.key</code> (or whatever
                  <code class="varname">sysconfdir</code> was defined when
Mark Andrews's avatar
regen  
Mark Andrews committed
538
                  the <acronym class="acronym">BIND</acronym> build was
Rob Austein's avatar
regen  
Rob Austein committed
539 540 541
                  configured).
                  The <code class="filename">rndc.key</code> file is
                  generated by
Evan Hunt's avatar
Evan Hunt committed
542
                  running <span class="command"><strong>rndc-confgen -a</strong></span> as
Rob Austein's avatar
regen  
Rob Austein committed
543
                  described in
Evan Hunt's avatar
Evan Hunt committed
544
                  <a class="xref" href="Bv9ARM.ch06.html#controls_statement_definition_and_usage" title="controls Statement Definition and Usage">the section called &#8220;<span class="command"><strong>controls</strong></span> Statement Definition and
Rob Austein's avatar
regen  
Rob Austein committed
545 546
          Usage&#8221;</a>.
                </p>
Tinderbox User's avatar
Tinderbox User committed
547 548

                <p>
Rob Austein's avatar
regen  
Rob Austein committed
549 550 551
                  The format of the configuration file is similar to
                  that of <code class="filename">named.conf</code>, but
                  limited to
Evan Hunt's avatar
Evan Hunt committed
552 553 554
                  only four statements, the <span class="command"><strong>options</strong></span>,
                  <span class="command"><strong>key</strong></span>, <span class="command"><strong>server</strong></span> and
                  <span class="command"><strong>include</strong></span>
Rob Austein's avatar
regen  
Rob Austein committed
555 556 557 558 559
                  statements.  These statements are what associate the
                  secret keys to the servers with which they are meant to
                  be shared.  The order of statements is not
                  significant.
                </p>
Tinderbox User's avatar
Tinderbox User committed
560 561

                <p>
Evan Hunt's avatar
Evan Hunt committed
562
                  The <span class="command"><strong>options</strong></span> statement has
Rob Austein's avatar
regen  
Rob Austein committed
563
                  three clauses:
Evan Hunt's avatar
Evan Hunt committed
564 565 566
                  <span class="command"><strong>default-server</strong></span>, <span class="command"><strong>default-key</strong></span>,
                  and <span class="command"><strong>default-port</strong></span>.
                  <span class="command"><strong>default-server</strong></span> takes a
Rob Austein's avatar
regen  
Rob Austein committed
567 568 569 570
                  host name or address argument  and represents the server
                  that will
                  be contacted if no <code class="option">-s</code>
                  option is provided on the command line.
Evan Hunt's avatar
Evan Hunt committed
571 572 573
                  <span class="command"><strong>default-key</strong></span> takes
                  the name of a key as its argument, as defined by a <span class="command"><strong>key</strong></span> statement.
                  <span class="command"><strong>default-port</strong></span> specifies the
Rob Austein's avatar
regen  
Rob Austein committed
574
                  port to which
Evan Hunt's avatar
Evan Hunt committed
575
                  <span class="command"><strong>rndc</strong></span> should connect if no
Rob Austein's avatar
regen  
Rob Austein committed
576
                  port is given on the command line or in a
Evan Hunt's avatar
Evan Hunt committed
577
                  <span class="command"><strong>server</strong></span> statement.
Rob Austein's avatar
regen  
Rob Austein committed
578
                </p>
Tinderbox User's avatar
Tinderbox User committed
579 580

                <p>
Evan Hunt's avatar
Evan Hunt committed
581
                  The <span class="command"><strong>key</strong></span> statement defines a
Rob Austein's avatar
regen  
Rob Austein committed
582
                  key to be used
Evan Hunt's avatar
Evan Hunt committed
583
                  by <span class="command"><strong>rndc</strong></span> when authenticating
Rob Austein's avatar
regen  
Rob Austein committed
584
                  with
Evan Hunt's avatar
Evan Hunt committed
585
                  <span class="command"><strong>named</strong></span>.  Its syntax is
Rob Austein's avatar
regen  
Rob Austein committed
586
                  identical to the
Evan Hunt's avatar
Evan Hunt committed
587
                  <span class="command"><strong>key</strong></span> statement in <code class="filename">named.conf</code>.
Rob Austein's avatar
regen  
Rob Austein committed
588 589 590 591 592 593
                  The keyword <strong class="userinput"><code>key</code></strong> is
                  followed by a key name, which must be a valid
                  domain name, though it need not actually be hierarchical;
                  thus,
                  a string like "<strong class="userinput"><code>rndc_key</code></strong>" is a valid
                  name.
Evan Hunt's avatar
Evan Hunt committed
594
                  The <span class="command"><strong>key</strong></span> statement has two
Rob Austein's avatar
regen  
Rob Austein committed
595
                  clauses:
Evan Hunt's avatar
Evan Hunt committed
596
                  <span class="command"><strong>algorithm</strong></span> and <span class="command"><strong>secret</strong></span>.
Rob Austein's avatar
regen  
Rob Austein committed
597 598
                  While the configuration parser will accept any string as the
                  argument
Tinderbox User's avatar
Tinderbox User committed
599 600 601 602 603 604 605
                  to algorithm, currently only the strings
                  "<strong class="userinput"><code>hmac-md5</code></strong>",
                  "<strong class="userinput"><code>hmac-sha1</code></strong>",
                  "<strong class="userinput"><code>hmac-sha224</code></strong>",
                  "<strong class="userinput"><code>hmac-sha256</code></strong>",
                  "<strong class="userinput"><code>hmac-sha384</code></strong>"
                  and "<strong class="userinput"><code>hmac-sha512</code></strong>"
Tinderbox User's avatar
Tinderbox User committed
606
                  have any meaning.  The secret is a Base64 encoded string
Mark Andrews's avatar
gregen  
Mark Andrews committed
607
                  as specified in RFC 3548.
Rob Austein's avatar
regen  
Rob Austein committed
608
                </p>
Tinderbox User's avatar
Tinderbox User committed
609 610

                <p>
Evan Hunt's avatar
Evan Hunt committed
611
                  The <span class="command"><strong>server</strong></span> statement
Rob Austein's avatar
regen  
Rob Austein committed
612
                  associates a key
Evan Hunt's avatar
Evan Hunt committed
613
                  defined using the <span class="command"><strong>key</strong></span>
Rob Austein's avatar
regen  
Rob Austein committed
614 615
                  statement with a server.
                  The keyword <strong class="userinput"><code>server</code></strong> is followed by a
Evan Hunt's avatar
Evan Hunt committed
616 617 618
                  host name or address.  The <span class="command"><strong>server</strong></span> statement
                  has two clauses: <span class="command"><strong>key</strong></span> and <span class="command"><strong>port</strong></span>.
                  The <span class="command"><strong>key</strong></span> clause specifies the
Rob Austein's avatar
regen  
Rob Austein committed
619 620
                  name of the key
                  to be used when communicating with this server, and the
Evan Hunt's avatar
Evan Hunt committed
621 622
                  <span class="command"><strong>port</strong></span> clause can be used to
                  specify the port <span class="command"><strong>rndc</strong></span> should
Rob Austein's avatar
regen  
Rob Austein committed
623 624 625
                  connect
                  to on the server.
                </p>
Tinderbox User's avatar
Tinderbox User committed
626 627

                <p>
Rob Austein's avatar
regen  
Rob Austein committed
628 629
                  A sample minimal configuration file is as follows:
                </p>
Tinderbox User's avatar
Tinderbox User committed
630

Rob Austein's avatar
regen  
Rob Austein committed
631 632
<pre class="programlisting">
key rndc_key {
Tinderbox User's avatar
Tinderbox User committed
633
     algorithm "hmac-sha256";
Automatic Updater's avatar
regen  
Automatic Updater committed
634 635
     secret
       "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K";
636 637
};
options {
Andreas Gustafsson's avatar
Andreas Gustafsson committed
638
     default-server 127.0.0.1;
639 640
     default-key    rndc_key;
};
Rob Austein's avatar
regen  
Rob Austein committed
641
</pre>
Tinderbox User's avatar
Tinderbox User committed
642 643

                <p>
Rob Austein's avatar
regen  
Rob Austein committed
644 645 646
                  This file, if installed as <code class="filename">/etc/rndc.conf</code>,
                  would allow the command:
                </p>
Tinderbox User's avatar
Tinderbox User committed
647 648

                <p>
Rob Austein's avatar
regen  
Rob Austein committed
649 650
                  <code class="prompt">$ </code><strong class="userinput"><code>rndc reload</code></strong>
                </p>
Tinderbox User's avatar
Tinderbox User committed
651 652

                <p>
Rob Austein's avatar
regen  
Rob Austein committed
653 654 655 656 657
                  to connect to 127.0.0.1 port 953 and cause the name server
                  to reload, if a name server on the local machine were
                  running with
                  following controls statements:
                </p>
Tinderbox User's avatar
Tinderbox User committed
658

Rob Austein's avatar
regen  
Rob Austein committed
659 660
<pre class="programlisting">
controls {
Automatic Updater's avatar
regen  
Automatic Updater committed
661 662
        inet 127.0.0.1
            allow { localhost; } keys { rndc_key; };
663
};
Rob Austein's avatar
regen  
Rob Austein committed
664
</pre>
Tinderbox User's avatar
Tinderbox User committed
665 666

                <p>
Rob Austein's avatar
regen  
Rob Austein committed
667 668 669
                  and it had an identical key statement for
                  <code class="literal">rndc_key</code>.
                </p>
Tinderbox User's avatar
Tinderbox User committed
670 671

                <p>
Evan Hunt's avatar
Evan Hunt committed
672
                  Running the <span class="command"><strong>rndc-confgen</strong></span>
Rob Austein's avatar
regen  
Rob Austein committed
673 674 675
                  program will
                  conveniently create a <code class="filename">rndc.conf</code>
                  file for you, and also display the
Evan Hunt's avatar
Evan Hunt committed
676
                  corresponding <span class="command"><strong>controls</strong></span>
Rob Austein's avatar
regen  
Rob Austein committed
677 678 679
                  statement that you need to
                  add to <code class="filename">named.conf</code>.
                  Alternatively,
Evan Hunt's avatar
Evan Hunt committed
680
                  you can run <span class="command"><strong>rndc-confgen -a</strong></span>
Rob Austein's avatar
regen  
Rob Austein committed
681 682 683 684 685
                  to set up
                  a <code class="filename">rndc.key</code> file and not
                  modify
                  <code class="filename">named.conf</code> at all.
                </p>
Tinderbox User's avatar
Tinderbox User committed
686 687

              </dd>
Rob Austein's avatar
regen  
Rob Austein committed
688
</dl></div>
Tinderbox User's avatar
Tinderbox User committed
689 690 691 692 693

        </div>
      </div>

      <div class="section">
Rob Austein's avatar
regen  
Rob Austein committed
694
<div class="titlepage"><div><div><h3 class="title">
Tinderbox User's avatar
Tinderbox User committed
695
<a name="signals"></a>Signals</h3></div></div></div>
Tinderbox User's avatar
Tinderbox User committed
696
        <p>
Rob Austein's avatar
regen  
Rob Austein committed
697 698
          Certain UNIX signals cause the name server to take specific
          actions, as described in the following table.  These signals can
Evan Hunt's avatar
Evan Hunt committed
699
          be sent using the <span class="command"><strong>kill</strong></span> command.
Rob Austein's avatar
regen  
Rob Austein committed
700
        </p>
Tinderbox User's avatar
Tinderbox User committed
701 702
        <div class="informaltable">
          <table border="1">
Rob Austein's avatar
regen  
Rob Austein committed
703
<colgroup>
Evan Hunt's avatar
Evan Hunt committed
704 705
<col width="1.125in" class="1">
<col width="4.000in" class="2">
Rob Austein's avatar
regen  
Rob Austein committed
706 707 708 709
</colgroup>
<tbody>
<tr>
<td>
Evan Hunt's avatar
Evan Hunt committed
710
                  <p><span class="command"><strong>SIGHUP</strong></span></p>
Rob Austein's avatar
regen  
Rob Austein committed
711 712 713 714 715 716 717 718 719 720
                </td>
<td>
                  <p>
                    Causes the server to read <code class="filename">named.conf</code> and
                    reload the database.
                  </p>
                </td>
</tr>
<tr>
<td>
Evan Hunt's avatar
Evan Hunt committed
721
                  <p><span class="command"><strong>SIGTERM</strong></span></p>
Rob Austein's avatar
regen  
Rob Austein committed
722 723 724 725 726 727 728 729 730
                </td>
<td>
                  <p>
                    Causes the server to clean up and exit.
                  </p>
                </td>
</tr>
<tr>
<td>
Evan Hunt's avatar
Evan Hunt committed
731
                  <p><span class="command"><strong>SIGINT</strong></span></p>
Rob Austein's avatar
regen  
Rob Austein committed
732 733 734 735 736 737 738 739
                </td>
<td>
                  <p>
                    Causes the server to clean up and exit.
                  </p>
                </td>
</tr>
</tbody>
Tinderbox User's avatar
Tinderbox User committed
740 741 742 743 744
</table>
        </div>
      </div>
    </div>
  </div>
Rob Austein's avatar
regen  
Rob Austein committed
745 746 747 748 749 750 751 752 753 754 755
<div class="navfooter">
<hr>
<table width="100%" summary="Navigation footer">
<tr>
<td width="40%" align="left">
<a accesskey="p" href="Bv9ARM.ch02.html">Prev</a></td>
<td width="20%" align="center"></td>
<td width="40%" align="right"><a accesskey="n" href="Bv9ARM.ch04.html">Next</a>
</td>
</tr>
<tr>
Mark Andrews's avatar
regen  
Mark Andrews committed
756
<td width="40%" align="left" valign="top">Chapter2.<acronym class="acronym">BIND</acronym> Resource Requirements</td>
Rob Austein's avatar
regen  
Rob Austein committed
757 758 759 760 761
<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
<td width="40%" align="right" valign="top">Chapter4.Advanced DNS Features</td>
</tr>
</table>
</div>
Tinderbox User's avatar
Tinderbox User committed
762
<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.21 (Extended Support Version)</p>
Rob Austein's avatar
regen  
Rob Austein committed
763 764
</body>
</html>