/contrib/bind9/doc/arm/Bv9ARM.ch03.html

https://bitbucket.org/freebsd/freebsd-head/ · HTML · 957 lines · 937 code · 3 blank · 17 comment · 0 complexity · 56fd8847e44f89610f3762515d6c063e MD5 · raw file 

    

  1. <!--
    2. 

  2.  - Copyright (C) 2004-2012 Internet Systems Consortium, Inc. ("ISC")
    3. 

  3.  - Copyright (C) 2000-2003 Internet Software Consortium.
    4. 

  4.  - 
    5. 

  5.  - Permission to use, copy, modify, and/or distribute this software for any
    6. 

  6.  - purpose with or without fee is hereby granted, provided that the above
    7. 

  7.  - copyright notice and this permission notice appear in all copies.
    8. 

  8.  - 
    9. 

  9.  - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
    10. 

  10.  - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
    11. 

  11.  - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
    12. 

  12.  - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
    13. 

  13.  - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
    14. 

  14.  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
    15. 

  15.  - PERFORMANCE OF THIS SOFTWARE.
    16. 

  16. -->
    17. 

  17. <!-- $Id$ -->
    18. 

  18. <html>
    19. 

  19. <head>
    20. 

  20. <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
    21. 

  21. <title>Chapter 3. Name Server Configuration</title>
    22. 

  22. <meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
    23. 

  23. <link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
    24. 

  24. <link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
    25. 

  25. <link rel="prev" href="Bv9ARM.ch02.html" title="Chapter 2. BIND Resource Requirements">
    26. 

  26. <link rel="next" href="Bv9ARM.ch04.html" title="Chapter 4. Advanced DNS Features">
    27. 

  27. </head>
    28. 

  28. <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
    29. 

  29. <div class="navheader">
    30. 

  30. <table width="100%" summary="Navigation header">
    31. 

  31. <tr><th colspan="3" align="center">Chapter 3. Name Server Configuration</th></tr>
    32. 

  32. <tr>
    33. 

  33. <td width="20%" align="left">
    34. 

  34. <a accesskey="p" href="Bv9ARM.ch02.html">Prev</a> </td>
    35. 

  35. <th width="60%" align="center"> </th>
    36. 

  36. <td width="20%" align="right"> <a accesskey="n" href="Bv9ARM.ch04.html">Next</a>
    37. 

  37. </td>
    38. 

  38. </tr>
    39. 

  39. </table>
    40. 

  40. <hr>
    41. 

  41. </div>
    42. 

  42. <div class="chapter" lang="en">
    43. 

  43. <div class="titlepage"><div><div><h2 class="title">
    44. 

  44. <a name="Bv9ARM.ch03"></a>Chapter 3. Name Server Configuration</h2></div></div></div>
    45. 

  45. <div class="toc">
    46. 

  46. <p><b>Table of Contents</b></p>
    47. 

  47. <dl>
    48. 

  48. <dt><span class="sect1"><a href="Bv9ARM.ch03.html#sample_configuration">Sample Configurations</a></span></dt>
    49. 

  49. <dd><dl>
    50. 

  50. <dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2567771">A Caching-only Name Server</a></span></dt>
    51. 

  51. <dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2567992">An Authoritative-only Name Server</a></span></dt>
    52. 

  52. </dl></dd>
    53. 

  53. <dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568014">Load Balancing</a></span></dt>
    54. 

  54. <dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568369">Name Server Operations</a></span></dt>
    55. 

  55. <dd><dl>
    56. 

  56. <dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568374">Tools for Use With the Name Server Daemon</a></span></dt>
    57. 

  57. <dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2570421">Signals</a></span></dt>
    58. 

  58. </dl></dd>
    59. 

  59. </dl>
    60. 

  60. </div>
    61. 

  61. <p>
    62. 

  62.       In this chapter we provide some suggested configurations along
    63. 

  63.       with guidelines for their use.  We suggest reasonable values for
    64. 

  64.       certain option settings.
    65. 

  65.     </p>
    66. 

  66. <div class="sect1" lang="en">
    67. 

  67. <div class="titlepage"><div><div><h2 class="title" style="clear: both">
    68. 

  68. <a name="sample_configuration"></a>Sample Configurations</h2></div></div></div>
    69. 

  69. <div class="sect2" lang="en">
    70. 

  70. <div class="titlepage"><div><div><h3 class="title">
    71. 

  71. <a name="id2567771"></a>A Caching-only Name Server</h3></div></div></div>
    72. 

  72. <p>
    73. 

  73.           The following sample configuration is appropriate for a caching-only
    74. 

  74.           name server for use by clients internal to a corporation.  All
    75. 

  75.           queries
    76. 

  76.           from outside clients are refused using the <span><strong class="command">allow-query</strong></span>
    77. 

  77.           option.  Alternatively, the same effect could be achieved using
    78. 

  78.           suitable
    79. 

  79.           firewall rules.
    80. 

  80.         </p>
    81. 

  81. <pre class="programlisting">
    82. 

  82. // Two corporate subnets we wish to allow queries from.
    83. 

  83. acl corpnets { 192.168.4.0/24; 192.168.7.0/24; };
    84. 

  84. options {
    85. 

  85.      // Working directory
    86. 

  86.      directory "/etc/namedb";
    87. 

  87. 

  88.      allow-query { corpnets; };
    89. 

  89. };
    90. 

  90. // Provide a reverse mapping for the loopback
    91. 

  91. // address 127.0.0.1
    92. 

  92. zone "0.0.127.in-addr.arpa" {
    93. 

  93.      type master;
    94. 

  94.      file "localhost.rev";
    95. 

  95.      notify no;
    96. 

  96. };
    97. 

  97. </pre>
    98. 

  98. </div>
    99. 

  99. <div class="sect2" lang="en">
    100. 

  100. <div class="titlepage"><div><div><h3 class="title">
    101. 

  101. <a name="id2567992"></a>An Authoritative-only Name Server</h3></div></div></div>
    102. 

  102. <p>
    103. 

  103.           This sample configuration is for an authoritative-only server
    104. 

  104.           that is the master server for "<code class="filename">example.com</code>"
    105. 

  105.           and a slave for the subdomain "<code class="filename">eng.example.com</code>".
    106. 

  106.         </p>
    107. 

  107. <pre class="programlisting">
    108. 

  108. options {
    109. 

  109.      // Working directory
    110. 

  110.      directory "/etc/namedb";
    111. 

  111.      // Do not allow access to cache
    112. 

  112.      allow-query-cache { none; };
    113. 

  113.      // This is the default
    114. 

  114.      allow-query { any; };
    115. 

  115.      // Do not provide recursive service
    116. 

  116.      recursion no;
    117. 

  117. };
    118. 

  118. 

  119. // Provide a reverse mapping for the loopback
    120. 

  120. // address 127.0.0.1
    121. 

  121. zone "0.0.127.in-addr.arpa" {
    122. 

  122.      type master;
    123. 

  123.      file "localhost.rev";
    124. 

  124.      notify no;
    125. 

  125. };
    126. 

  126. // We are the master server for example.com
    127. 

  127. zone "example.com" {
    128. 

  128.      type master;
    129. 

  129.      file "example.com.db";
    130. 

  130.      // IP addresses of slave servers allowed to
    131. 

  131.      // transfer example.com
    132. 

  132.      allow-transfer {
    133. 

  133.           192.168.4.14;
    134. 

  134.           192.168.5.53;
    135. 

  135.      };
    136. 

  136. };
    137. 

  137. // We are a slave server for eng.example.com
    138. 

  138. zone "eng.example.com" {
    139. 

  139.      type slave;
    140. 

  140.      file "eng.example.com.bk";
    141. 

  141.      // IP address of eng.example.com master server
    142. 

  142.      masters { 192.168.4.12; };
    143. 

  143. };
    144. 

  144. </pre>
    145. 

  145. </div>
    146. 

  146. </div>
    147. 

  147. <div class="sect1" lang="en">
    148. 

  148. <div class="titlepage"><div><div><h2 class="title" style="clear: both">
    149. 

  149. <a name="id2568014"></a>Load Balancing</h2></div></div></div>
    150. 

  150. <p>
    151. 

  151.         A primitive form of load balancing can be achieved in
    152. 

  152.         the <acronym class="acronym">DNS</acronym> by using multiple records
    153. 

  153.         (such as multiple A records) for one name.
    154. 

  154.       </p>
    155. 

  155. <p>
    156. 

  156.         For example, if you have three WWW servers with network addresses
    157. 

  157.         of 10.0.0.1, 10.0.0.2 and 10.0.0.3, a set of records such as the
    158. 

  158.         following means that clients will connect to each machine one third
    159. 

  159.         of the time:
    160. 

  160.       </p>
    161. 

  161. <div class="informaltable"><table border="1">
    162. 

  162. <colgroup>
    163. 

  163. <col>
    164. 

  164. <col>
    165. 

  165. <col>
    166. 

  166. <col>
    167. 

  167. <col>
    168. 

  168. </colgroup>
    169. 

  169. <tbody>
    170. 

  170. <tr>
    171. 

  171. <td>
    172. 

  172.                 <p>
    173. 

  173.                   Name
    174. 

  174.                 </p>
    175. 

  175.               </td>
    176. 

  176. <td>
    177. 

  177.                 <p>
    178. 

  178.                   TTL
    179. 

  179.                 </p>
    180. 

  180.               </td>
    181. 

  181. <td>
    182. 

  182.                 <p>
    183. 

  183.                   CLASS
    184. 

  184.                 </p>
    185. 

  185.               </td>
    186. 

  186. <td>
    187. 

  187.                 <p>
    188. 

  188.                   TYPE
    189. 

  189.                 </p>
    190. 

  190.               </td>
    191. 

  191. <td>
    192. 

  192.                 <p>
    193. 

  193.                   Resource Record (RR) Data
    194. 

  194.                 </p>
    195. 

  195.               </td>
    196. 

  196. </tr>
    197. 

  197. <tr>
    198. 

  198. <td>
    199. 

  199.                 <p>
    200. 

  200.                   <code class="literal">www</code>
    201. 

  201.                 </p>
    202. 

  202.               </td>
    203. 

  203. <td>
    204. 

  204.                 <p>
    205. 

  205.                   <code class="literal">600</code>
    206. 

  206.                 </p>
    207. 

  207.               </td>
    208. 

  208. <td>
    209. 

  209.                 <p>
    210. 

  210.                   <code class="literal">IN</code>
    211. 

  211.                 </p>
    212. 

  212.               </td>
    213. 

  213. <td>
    214. 

  214.                 <p>
    215. 

  215.                   <code class="literal">A</code>
    216. 

  216.                 </p>
    217. 

  217.               </td>
    218. 

  218. <td>
    219. 

  219.                 <p>
    220. 

  220.                   <code class="literal">10.0.0.1</code>
    221. 

  221.                 </p>
    222. 

  222.               </td>
    223. 

  223. </tr>
    224. 

  224. <tr>
    225. 

  225. <td>
    226. 

  226.                 <p></p>
    227. 

  227.               </td>
    228. 

  228. <td>
    229. 

  229.                 <p>
    230. 

  230.                   <code class="literal">600</code>
    231. 

  231.                 </p>
    232. 

  232.               </td>
    233. 

  233. <td>
    234. 

  234.                 <p>
    235. 

  235.                   <code class="literal">IN</code>
    236. 

  236.                 </p>
    237. 

  237.               </td>
    238. 

  238. <td>
    239. 

  239.                 <p>
    240. 

  240.                   <code class="literal">A</code>
    241. 

  241.                 </p>
    242. 

  242.               </td>
    243. 

  243. <td>
    244. 

  244.                 <p>
    245. 

  245.                   <code class="literal">10.0.0.2</code>
    246. 

  246.                 </p>
    247. 

  247.               </td>
    248. 

  248. </tr>
    249. 

  249. <tr>
    250. 

  250. <td>
    251. 

  251.                 <p></p>
    252. 

  252.               </td>
    253. 

  253. <td>
    254. 

  254.                 <p>
    255. 

  255.                   <code class="literal">600</code>
    256. 

  256.                 </p>
    257. 

  257.               </td>
    258. 

  258. <td>
    259. 

  259.                 <p>
    260. 

  260.                   <code class="literal">IN</code>
    261. 

  261.                 </p>
    262. 

  262.               </td>
    263. 

  263. <td>
    264. 

  264.                 <p>
    265. 

  265.                   <code class="literal">A</code>
    266. 

  266.                 </p>
    267. 

  267.               </td>
    268. 

  268. <td>
    269. 

  269.                 <p>
    270. 

  270.                   <code class="literal">10.0.0.3</code>
    271. 

  271.                 </p>
    272. 

  272.               </td>
    273. 

  273. </tr>
    274. 

  274. </tbody>
    275. 

  275. </table></div>
    276. 

  276. <p>
    277. 

  277.         When a resolver queries for these records, <acronym class="acronym">BIND</acronym> will rotate
    278. 

  278.         them and respond to the query with the records in a different
    279. 

  279.         order.  In the example above, clients will randomly receive
    280. 

  280.         records in the order 1, 2, 3; 2, 3, 1; and 3, 1, 2. Most clients
    281. 

  281.         will use the first record returned and discard the rest.
    282. 

  282.       </p>
    283. 

  283. <p>
    284. 

  284.         For more detail on ordering responses, check the
    285. 

  285.         <span><strong class="command">rrset-order</strong></span> sub-statement in the
    286. 

  286.         <span><strong class="command">options</strong></span> statement, see
    287. 

  287.         <a href="Bv9ARM.ch06.html#rrset_ordering">RRset Ordering</a>.
    288. 

  288.       </p>
    289. 

  289. </div>
    290. 

  290. <div class="sect1" lang="en">
    291. 

  291. <div class="titlepage"><div><div><h2 class="title" style="clear: both">
    292. 

  292. <a name="id2568369"></a>Name Server Operations</h2></div></div></div>
    293. 

  293. <div class="sect2" lang="en">
    294. 

  294. <div class="titlepage"><div><div><h3 class="title">
    295. 

  295. <a name="id2568374"></a>Tools for Use With the Name Server Daemon</h3></div></div></div>
    296. 

  296. <p>
    297. 

  297.           This section describes several indispensable diagnostic,
    298. 

  298.           administrative and monitoring tools available to the system
    299. 

  299.           administrator for controlling and debugging the name server
    300. 

  300.           daemon.
    301. 

  301.         </p>
    302. 

  302. <div class="sect3" lang="en">
    303. 

  303. <div class="titlepage"><div><div><h4 class="title">
    304. 

  304. <a name="diagnostic_tools"></a>Diagnostic Tools</h4></div></div></div>
    305. 

  305. <p>
    306. 

  306.             The <span><strong class="command">dig</strong></span>, <span><strong class="command">host</strong></span>, and
    307. 

  307.             <span><strong class="command">nslookup</strong></span> programs are all command
    308. 

  308.             line tools
    309. 

  309.             for manually querying name servers.  They differ in style and
    310. 

  310.             output format.
    311. 

  311.           </p>
    312. 

  312. <div class="variablelist"><dl>
    313. 

  313. <dt><span class="term"><a name="dig"></a><span><strong class="command">dig</strong></span></span></dt>
    314. 

  314. <dd>
    315. 

  315. <p>
    316. 

  316.                   The domain information groper (<span><strong class="command">dig</strong></span>)
    317. 

  317.                   is the most versatile and complete of these lookup tools.
    318. 

  318.                   It has two modes: simple interactive
    319. 

  319.                   mode for a single query, and batch mode which executes a
    320. 

  320.                   query for
    321. 

  321.                   each in a list of several query lines. All query options are
    322. 

  322.                   accessible
    323. 

  323.                   from the command line.
    324. 

  324.                 </p>
    325. 

  325. <div class="cmdsynopsis"><p><code class="command">dig</code>  [@<em class="replaceable"><code>server</code></em>]  <em class="replaceable"><code>domain</code></em>  [<em class="replaceable"><code>query-type</code></em>] [<em class="replaceable"><code>query-class</code></em>] [+<em class="replaceable"><code>query-option</code></em>] [-<em class="replaceable"><code>dig-option</code></em>] [%<em class="replaceable"><code>comment</code></em>]</p></div>
    326. 

  326. <p>
    327. 

  327.                   The usual simple use of <span><strong class="command">dig</strong></span> will take the form
    328. 

  328.                 </p>
    329. 

  329. <p>
    330. 

  330.                   <span><strong class="command">dig @server domain query-type query-class</strong></span>
    331. 

  331.                 </p>
    332. 

  332. <p>
    333. 

  333.                   For more information and a list of available commands and
    334. 

  334.                   options, see the <span><strong class="command">dig</strong></span> man
    335. 

  335.                   page.
    336. 

  336.                 </p>
    337. 

  337. </dd>
    338. 

  338. <dt><span class="term"><span><strong class="command">host</strong></span></span></dt>
    339. 

  339. <dd>
    340. 

  340. <p>
    341. 

  341.                   The <span><strong class="command">host</strong></span> utility emphasizes
    342. 

  342.                   simplicity
    343. 

  343.                   and ease of use.  By default, it converts
    344. 

  344.                   between host names and Internet addresses, but its
    345. 

  345.                   functionality
    346. 

  346.                   can be extended with the use of options.
    347. 

  347.                 </p>
    348. 

  348. <div class="cmdsynopsis"><p><code class="command">host</code>  [-aCdlnrsTwv] [-c <em class="replaceable"><code>class</code></em>] [-N <em class="replaceable"><code>ndots</code></em>] [-t <em class="replaceable"><code>type</code></em>] [-W <em class="replaceable"><code>timeout</code></em>] [-R <em class="replaceable"><code>retries</code></em>] [-m <em class="replaceable"><code>flag</code></em>] [-4] [-6]  <em class="replaceable"><code>hostname</code></em>  [<em class="replaceable"><code>server</code></em>]</p></div>
    349. 

  349. <p>
    350. 

  350.                   For more information and a list of available commands and
    351. 

  351.                   options, see the <span><strong class="command">host</strong></span> man
    352. 

  352.                   page.
    353. 

  353.                 </p>
    354. 

  354. </dd>
    355. 

  355. <dt><span class="term"><span><strong class="command">nslookup</strong></span></span></dt>
    356. 

  356. <dd>
    357. 

  357. <p><span><strong class="command">nslookup</strong></span>
    358. 

  358.                   has two modes: interactive and
    359. 

  359.                   non-interactive. Interactive mode allows the user to
    360. 

  360.                   query name servers for information about various
    361. 

  361.                   hosts and domains or to print a list of hosts in a
    362. 

  362.                   domain. Non-interactive mode is used to print just
    363. 

  363.                   the name and requested information for a host or
    364. 

  364.                   domain.
    365. 

  365.                 </p>
    366. 

  366. <div class="cmdsynopsis"><p><code class="command">nslookup</code>  [-option...] [[<em class="replaceable"><code>host-to-find</code></em>] |  [- [server]]]</p></div>
    367. 

  367. <p>
    368. 

  368.                   Interactive mode is entered when no arguments are given (the
    369. 

  369.                   default name server will be used) or when the first argument
    370. 

  370.                   is a
    371. 

  371.                   hyphen (`-') and the second argument is the host name or
    372. 

  372.                   Internet address
    373. 

  373.                   of a name server.
    374. 

  374.                 </p>
    375. 

  375. <p>
    376. 

  376.                   Non-interactive mode is used when the name or Internet
    377. 

  377.                   address
    378. 

  378.                   of the host to be looked up is given as the first argument.
    379. 

  379.                   The
    380. 

  380.                   optional second argument specifies the host name or address
    381. 

  381.                   of a name server.
    382. 

  382.                 </p>
    383. 

  383. <p>
    384. 

  384.                   Due to its arcane user interface and frequently inconsistent
    385. 

  385.                   behavior, we do not recommend the use of <span><strong class="command">nslookup</strong></span>.
    386. 

  386.                   Use <span><strong class="command">dig</strong></span> instead.
    387. 

  387.                 </p>
    388. 

  388. </dd>
    389. 

  389. </dl></div>
    390. 

  390. </div>
    391. 

  391. <div class="sect3" lang="en">
    392. 

  392. <div class="titlepage"><div><div><h4 class="title">
    393. 

  393. <a name="admin_tools"></a>Administrative Tools</h4></div></div></div>
    394. 

  394. <p>
    395. 

  395.             Administrative tools play an integral part in the management
    396. 

  396.             of a server.
    397. 

  397.           </p>
    398. 

  398. <div class="variablelist"><dl>
    399. 

  399. <dt>
    400. 

  400. <a name="named-checkconf"></a><span class="term"><span><strong class="command">named-checkconf</strong></span></span>
    401. 

  401. </dt>
    402. 

  402. <dd>
    403. 

  403. <p>
    404. 

  404.                   The <span><strong class="command">named-checkconf</strong></span> program
    405. 

  405.                   checks the syntax of a <code class="filename">named.conf</code> file.
    406. 

  406.                 </p>
    407. 

  407. <div class="cmdsynopsis"><p><code class="command">named-checkconf</code>  [-jvz] [-t <em class="replaceable"><code>directory</code></em>] [<em class="replaceable"><code>filename</code></em>]</p></div>
    408. 

  408. </dd>
    409. 

  409. <dt>
    410. 

  410. <a name="named-checkzone"></a><span class="term"><span><strong class="command">named-checkzone</strong></span></span>
    411. 

  411. </dt>
    412. 

  412. <dd>
    413. 

  413. <p>
    414. 

  414.                   The <span><strong class="command">named-checkzone</strong></span> program
    415. 

  415.                   checks a master file for
    416. 

  416.                   syntax and consistency.
    417. 

  417.                 </p>
    418. 

  418. <div class="cmdsynopsis"><p><code class="command">named-checkzone</code>  [-djqvD] [-c <em class="replaceable"><code>class</code></em>] [-o <em class="replaceable"><code>output</code></em>] [-t <em class="replaceable"><code>directory</code></em>] [-w <em class="replaceable"><code>directory</code></em>] [-k <em class="replaceable"><code>(ignore|warn|fail)</code></em>] [-n <em class="replaceable"><code>(ignore|warn|fail)</code></em>] [-W <em class="replaceable"><code>(ignore|warn)</code></em>]  <em class="replaceable"><code>zone</code></em>  [<em class="replaceable"><code>filename</code></em>]</p></div>
    419. 

  419. </dd>
    420. 

  420. <dt>
    421. 

  421. <a name="named-compilezone"></a><span class="term"><span><strong class="command">named-compilezone</strong></span></span>
    422. 

  422. </dt>
    423. 

  423. <dd><p>
    424. 

  424.                   Similar to <span><strong class="command">named-checkzone,</strong></span> but
    425. 

  425.                   it always dumps the zone content to a specified file
    426. 

  426.                   (typically in a different format).
    427. 

  427.                 </p></dd>
    428. 

  428. <dt>
    429. 

  429. <a name="rndc"></a><span class="term"><span><strong class="command">rndc</strong></span></span>
    430. 

  430. </dt>
    431. 

  431. <dd>
    432. 

  432. <p>
    433. 

  433.                   The remote name daemon control
    434. 

  434.                   (<span><strong class="command">rndc</strong></span>) program allows the
    435. 

  435.                   system
    436. 

  436.                   administrator to control the operation of a name server.
    437. 

  437.                   Since <acronym class="acronym">BIND</acronym> 9.2, <span><strong class="command">rndc</strong></span>
    438. 

  438.                   supports all the commands of the BIND 8 <span><strong class="command">ndc</strong></span>
    439. 

  439.                   utility except <span><strong class="command">ndc start</strong></span> and
    440. 

  440.                   <span><strong class="command">ndc restart</strong></span>, which were also
    441. 

  441.                   not supported in <span><strong class="command">ndc</strong></span>'s
    442. 

  442.                   channel mode.
    443. 

  443.                   If you run <span><strong class="command">rndc</strong></span> without any
    444. 

  444.                   options
    445. 

  445.                   it will display a usage message as follows:
    446. 

  446.                 </p>
    447. 

  447. <div class="cmdsynopsis"><p><code class="command">rndc</code>  [-c <em class="replaceable"><code>config</code></em>] [-s <em class="replaceable"><code>server</code></em>] [-p <em class="replaceable"><code>port</code></em>] [-y <em class="replaceable"><code>key</code></em>]  <em class="replaceable"><code>command</code></em>  [<em class="replaceable"><code>command</code></em>...]</p></div>
    448. 

  448. <p>The <span><strong class="command">command</strong></span>
    449. 

  449.                   is one of the following:
    450. 

  450.                 </p>
    451. 

  451. <div class="variablelist"><dl>
    452. 

  452. <dt><span class="term"><strong class="userinput"><code>reload</code></strong></span></dt>
    453. 

  453. <dd><p>
    454. 

  454.                         Reload configuration file and zones.
    455. 

  455.                       </p></dd>
    456. 

  456. <dt><span class="term"><strong class="userinput"><code>reload <em class="replaceable"><code>zone</code></em>
    457. 

  457.                         [<span class="optional"><em class="replaceable"><code>class</code></em>
    458. 

  458.            [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
    459. 

  459. <dd><p>
    460. 

  460.                         Reload the given zone.
    461. 

  461.                       </p></dd>
    462. 

  462. <dt><span class="term"><strong class="userinput"><code>refresh <em class="replaceable"><code>zone</code></em>
    463. 

  463.                         [<span class="optional"><em class="replaceable"><code>class</code></em>
    464. 

  464.            [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
    465. 

  465. <dd><p>
    466. 

  466.                         Schedule zone maintenance for the given zone.
    467. 

  467.                       </p></dd>
    468. 

  468. <dt><span class="term"><strong class="userinput"><code>retransfer <em class="replaceable"><code>zone</code></em>
    469. 

    470. 

  470.                         [<span class="optional"><em class="replaceable"><code>class</code></em>
    471. 

  471.            [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
    472. 

  472. <dd><p>
    473. 

  473.                         Retransfer the given zone from the master.
    474. 

  474.                       </p></dd>
    475. 

  475. <dt><span class="term"><strong class="userinput"><code>sign <em class="replaceable"><code>zone</code></em>
    476. 

  476.                         [<span class="optional"><em class="replaceable"><code>class</code></em>
    477. 

  477.            [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
    478. 

  478. <dd>
    479. 

  479. <p>
    480. 

  480.                         Fetch all DNSSEC keys for the given zone
    481. 

  481.                         from the key directory (see
    482. 

  482.                         <span><strong class="command">key-directory</strong></span> in
    483. 

  483.                         <a href="Bv9ARM.ch06.html#options" title="options Statement Definition and
    484. 

  484.           Usage">the section called &#8220;<span><strong class="command">options</strong></span> Statement Definition and
    485. 

  485.           Usage&#8221;</a>).  If they are within
    486. 

  486.                         their publication period, merge them into the
    487. 

  487.                         zone's DNSKEY RRset.  If the DNSKEY RRset
    488. 

  488.                         is changed, then the zone is automatically
    489. 

  489.                         re-signed with the new key set.
    490. 

  490.                       </p>
    491. 

  491. <p>
    492. 

  492.                         This command requires that the
    493. 

  493.                         <span><strong class="command">auto-dnssec</strong></span> zone option be set
    494. 

  494.                         to <code class="literal">allow</code> or
    495. 

  495.                         <code class="literal">maintain</code>,
    496. 

  496.                         and also requires the zone to be configured to
    497. 

  497.                         allow dynamic DNS.
    498. 

  498.                         See <a href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called &#8220;Dynamic Update Policies&#8221;</a> for
    499. 

  499.                         more details.
    500. 

  500.                       </p>
    501. 

  501. </dd>
    502. 

  502. <dt><span class="term"><strong class="userinput"><code>loadkeys <em class="replaceable"><code>zone</code></em>
    503. 

  503.                         [<span class="optional"><em class="replaceable"><code>class</code></em>
    504. 

  504.            [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
    505. 

  505. <dd>
    506. 

  506. <p>
    507. 

  507.                         Fetch all DNSSEC keys for the given zone
    508. 

  508.                         from the key directory (see
    509. 

  509.                         <span><strong class="command">key-directory</strong></span> in
    510. 

  510.                         <a href="Bv9ARM.ch06.html#options" title="options Statement Definition and
    511. 

  511.           Usage">the section called &#8220;<span><strong class="command">options</strong></span> Statement Definition and
    512. 

  512.           Usage&#8221;</a>).  If they are within
    513. 

  513.                         their publication period, merge them into the
    514. 

  514.                         zone's DNSKEY RRset.  Unlike <span><strong class="command">rndc
    515. 

  515.                         sign</strong></span>, however, the zone is not
    516. 

  516.                         immediately re-signed by the new keys, but is
    517. 

  517.                         allowed to incrementally re-sign over time.
    518. 

  518.                       </p>
    519. 

  519. <p>
    520. 

  520.                         This command requires that the
    521. 

  521.                         <span><strong class="command">auto-dnssec</strong></span> zone option
    522. 

  522.                         be set to <code class="literal">maintain</code>,
    523. 

  523.                         and also requires the zone to be configured to
    524. 

  524.                         allow dynamic DNS.
    525. 

  525.                         See <a href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called &#8220;Dynamic Update Policies&#8221;</a> for
    526. 

  526.                         more details.
    527. 

  527.                       </p>
    528. 

  528. </dd>
    529. 

  529. <dt><span class="term"><strong class="userinput"><code>freeze
    530. 

  530.                         [<span class="optional"><em class="replaceable"><code>zone</code></em>
    531. 

  531.        [<span class="optional"><em class="replaceable"><code>class</code></em>
    532. 

  532.            [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
    533. 

  533. <dd><p>
    534. 

  534.                         Suspend updates to a dynamic zone.  If no zone is
    535. 

  535.                         specified,
    536. 

  536.                         then all zones are suspended.  This allows manual
    537. 

  537.                         edits to be made to a zone normally updated by dynamic
    538. 

  538.                         update.  It
    539. 

  539.                         also causes changes in the journal file to be synced
    540. 

  540.                         into the master
    541. 

  541.                         and the journal file to be removed.  All dynamic
    542. 

  542.                         update attempts will
    543. 

  543.                         be refused while the zone is frozen.
    544. 

  544.                       </p></dd>
    545. 

  545. <dt><span class="term"><strong class="userinput"><code>thaw
    546. 

  546.                         [<span class="optional"><em class="replaceable"><code>zone</code></em>
    547. 

  547.        [<span class="optional"><em class="replaceable"><code>class</code></em>
    548. 

  548.            [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
    549. 

  549. <dd><p>
    550. 

  550.                         Enable updates to a frozen dynamic zone.  If no zone
    551. 

  551.                         is
    552. 

  552.                         specified, then all frozen zones are enabled.  This
    553. 

  553.                         causes
    554. 

  554.                         the server to reload the zone from disk, and
    555. 

  555.                         re-enables dynamic updates
    556. 

  556.                         after the load has completed.  After a zone is thawed,
    557. 

  557.                         dynamic updates
    558. 

  558.                         will no longer be refused.
    559. 

  559.                       </p></dd>
    560. 

  560. <dt><span class="term"><strong class="userinput"><code>notify <em class="replaceable"><code>zone</code></em>
    561. 

  561.                         [<span class="optional"><em class="replaceable"><code>class</code></em>
    562. 

  562.            [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
    563. 

  563. <dd><p>
    564. 

  564.                         Resend NOTIFY messages for the zone.
    565. 

  565.                       </p></dd>
    566. 

  566. <dt><span class="term"><strong class="userinput"><code>reconfig</code></strong></span></dt>
    567. 

  567. <dd><p>
    568. 

  568.                         Reload the configuration file and load new zones,
    569. 

  569.                         but do not reload existing zone files even if they
    570. 

  570.                         have changed.
    571. 

  571.                         This is faster than a full <span><strong class="command">reload</strong></span> when there
    572. 

  572.                         is a large number of zones because it avoids the need
    573. 

  573.                         to examine the
    574. 

  574.                         modification times of the zones files.
    575. 

  575.                       </p></dd>
    576. 

  576. <dt><span class="term"><strong class="userinput"><code>stats</code></strong></span></dt>
    577. 

  577. <dd><p>
    578. 

  578.                         Write server statistics to the statistics file.
    579. 

  579.                       </p></dd>
    580. 

  580. <dt><span class="term"><strong class="userinput"><code>querylog</code></strong></span></dt>
    581. 

  581. <dd><p>
    582. 

  582.                         Toggle query logging. Query logging can also be enabled
    583. 

  583.                         by explicitly directing the <span><strong class="command">queries</strong></span>
    584. 

  584.                         <span><strong class="command">category</strong></span> to a
    585. 

  585.                         <span><strong class="command">channel</strong></span> in the
    586. 

  586.                         <span><strong class="command">logging</strong></span> section of
    587. 

  587.                         <code class="filename">named.conf</code> or by specifying
    588. 

  588.                         <span><strong class="command">querylog yes;</strong></span> in the
    589. 

  589.                         <span><strong class="command">options</strong></span> section of
    590. 

  590.                         <code class="filename">named.conf</code>.
    591. 

  591.                       </p></dd>
    592. 

  592. <dt><span class="term"><strong class="userinput"><code>dumpdb
    593. 

  593.                         [<span class="optional">-all|-cache|-zone</span>]
    594. 

  594.                         [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>]</code></strong></span></dt>
    595. 

  595. <dd><p>
    596. 

  596.                         Dump the server's caches (default) and/or zones to
    597. 

  597.                         the
    598. 

  598.                         dump file for the specified views.  If no view is
    599. 

  599.                         specified, all
    600. 

  600.                         views are dumped.
    601. 

  601.                       </p></dd>
    602. 

  602. <dt><span class="term"><strong class="userinput"><code>secroots
    603. 

  603.                         [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>]</code></strong></span></dt>
    604. 

  604. <dd><p>
    605. 

  605.                         Dump the server's security roots to the secroots
    606. 

  606.                         file for the specified views.  If no view is
    607. 

  607.                         specified, security roots for all
    608. 

  608.                         views are dumped.
    609. 

  609.                       </p></dd>
    610. 

  610. <dt><span class="term"><strong class="userinput"><code>stop [<span class="optional">-p</span>]</code></strong></span></dt>
    611. 

  611. <dd><p>
    612. 

  612.                         Stop the server, making sure any recent changes
    613. 

  613.                         made through dynamic update or IXFR are first saved to
    614. 

  614.                         the master files of the updated zones.
    615. 

  615.                         If <code class="option">-p</code> is specified <span><strong class="command">named</strong></span>'s process id is returned.
    616. 

  616.                         This allows an external process to determine when <span><strong class="command">named</strong></span>
    617. 

  617.                         had completed stopping.
    618. 

  618.                       </p></dd>
    619. 

  619. <dt><span class="term"><strong class="userinput"><code>halt [<span class="optional">-p</span>]</code></strong></span></dt>
    620. 

  620. <dd><p>
    621. 

  621.                         Stop the server immediately.  Recent changes
    622. 

  622.                         made through dynamic update or IXFR are not saved to
    623. 

  623.                         the master files, but will be rolled forward from the
    624. 

  624.                         journal files when the server is restarted.
    625. 

  625.                         If <code class="option">-p</code> is specified <span><strong class="command">named</strong></span>'s process id is returned.
    626. 

  626.                         This allows an external process to determine when <span><strong class="command">named</strong></span>
    627. 

  627.                         had completed halting.
    628. 

  628.                       </p></dd>
    629. 

  629. <dt><span class="term"><strong class="userinput"><code>trace</code></strong></span></dt>
    630. 

  630. <dd><p>
    631. 

  631.                         Increment the servers debugging level by one.
    632. 

  632.                       </p></dd>
    633. 

  633. <dt><span class="term"><strong class="userinput"><code>trace <em class="replaceable"><code>level</code></em></code></strong></span></dt>
    634. 

  634. <dd><p>
    635. 

  635.                         Sets the server's debugging level to an explicit
    636. 

  636.                         value.
    637. 

  637.                       </p></dd>
    638. 

  638. <dt><span class="term"><strong class="userinput"><code>notrace</code></strong></span></dt>
    639. 

  639. <dd><p>
    640. 

  640.                         Sets the server's debugging level to 0.
    641. 

  641.                       </p></dd>
    642. 

  642. <dt><span class="term"><strong class="userinput"><code>flush</code></strong></span></dt>
    643. 

  643. <dd><p>
    644. 

  644.                         Flushes the server's cache.
    645. 

  645.                       </p></dd>
    646. 

  646. <dt><span class="term"><strong class="userinput"><code>flushname</code></strong> <em class="replaceable"><code>name</code></em></span></dt>
    647. 

  647. <dd><p>
    648. 

  648.                         Flushes the given name from the server's cache.
    649. 

  649.                       </p></dd>
    650. 

  650. <dt><span class="term"><strong class="userinput"><code>status</code></strong></span></dt>
    651. 

  651. <dd><p>
    652. 

  652.                         Display status of the server.
    653. 

  653.                         Note that the number of zones includes the internal <span><strong class="command">bind/CH</strong></span> zone
    654. 

  654.                         and the default <span><strong class="command">./IN</strong></span>
    655. 

  655.                         hint zone if there is not an
    656. 

  656.                         explicit root zone configured.
    657. 

  657.                       </p></dd>
    658. 

  658. <dt><span class="term"><strong class="userinput"><code>recursing</code></strong></span></dt>
    659. 

  659. <dd><p>
    660. 

  660.                         Dump the list of queries <span><strong class="command">named</strong></span> is currently recursing
    661. 

  661.                         on.
    662. 

  662.                       </p></dd>
    663. 

  663. <dt><span class="term"><strong class="userinput"><code>validation
    664. 

  664.                         [<span class="optional">on|off</span>]
    665. 

  665.                         [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>]
    666. 

  666.                     </code></strong></span></dt>
    667. 

  667. <dd><p>
    668. 

  668.                         Enable or disable DNSSEC validation.
    669. 

  669.                         Note <span><strong class="command">dnssec-enable</strong></span> also needs to be
    670. 

  670.                         set to <strong class="userinput"><code>yes</code></strong> to be effective.
    671. 

  671.                         It defaults to enabled.
    672. 

  672.                       </p></dd>
    673. 

  673. <dt><span class="term"><strong class="userinput"><code>tsig-list</code></strong></span></dt>
    674. 

  674. <dd><p>
    675. 

  675.                         List the names of all TSIG keys currently configured
    676. 

  676.                         for use by <span><strong class="command">named</strong></span> in each view.  The
    677. 

  677.                         list both statically configured keys and dynamic
    678. 

  678.                         TKEY-negotiated keys.
    679. 

  679.                       </p></dd>
    680. 

  680. <dt><span class="term"><strong class="userinput"><code>tsig-delete</code></strong>
    681. 

  681.                      <em class="replaceable"><code>keyname</code></em>
    682. 

  682.                      [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span></dt>
    683. 

  683. <dd><p>
    684. 

  684.                         Delete a given TKEY-negotated key from the server.
    685. 

  685.                         (This does not apply to statically configured TSIG
    686. 

  686.                         keys.)
    687. 

  687.                       </p></dd>
    688. 

  688. <dt><span class="term"><strong class="userinput"><code>addzone
    689. 

  689.                         <em class="replaceable"><code>zone</code></em>
    690. 

  690.                         [<span class="optional"><em class="replaceable"><code>class</code></em>
    691. 

  691.                         [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]
    692. 

  692.                         <em class="replaceable"><code>configuration</code></em>
    693. 

  693.                     </code></strong></span></dt>
    694. 

  694. <dd>
    695. 

  695. <p>
    696. 

  696.                         Add a zone while the server is running.  This
    697. 

  697.                         command requires the
    698. 

  698.                         <span><strong class="command">allow-new-zones</strong></span> option to be set
    699. 

  699.                         to <strong class="userinput"><code>yes</code></strong>.  The
    700. 

  700.                         <em class="replaceable"><code>configuration</code></em> string
    701. 

  701.                         specified on the command line is the zone
    702. 

  702.                         configuration text that would ordinarily be
    703. 

  703.                         placed in <code class="filename">named.conf</code>.
    704. 

  704.                       </p>
    705. 

  705. <p>
    706. 

  706.                         The configuration is saved in a file called
    707. 

  707.                        <code class="filename"><em class="replaceable"><code>hash</code></em>.nzf</code>,
    708. 

  708.                         where <em class="replaceable"><code>hash</code></em> is a
    709. 

  709.                         cryptographic hash generated from the name of
    710. 

  710.                         the view.  When <span><strong class="command">named</strong></span> is
    711. 

  711.                         restarted, the file will be loaded into the view
    712. 

  712.                         configuration, so that zones that were added
    713. 

  713.                         can persist after a restart.
    714. 

  714.                       </p>
    715. 

  715. <p>
    716. 

  716.                         This sample <span><strong class="command">addzone</strong></span> command
    717. 

  717.                         would add the zone <code class="literal">example.com</code>
    718. 

  718.                         to the default view:
    719. 

  719.                       </p>
    720. 

  720. <p>
    721. 

  721. <code class="prompt">$ </code><strong class="userinput"><code>rndc addzone example.com '{ type master; file "example.com.db"; };'</code></strong>
    722. 

  722.                       </p>
    723. 

  723. <p>
    724. 

  724.                         (Note the brackets and semi-colon around the zone
    725. 

  725.                         configuration text.)
    726. 

  726.                       </p>
    727. 

  727. </dd>
    728. 

  728. <dt><span class="term"><strong class="userinput"><code>delzone
    729. 

  729.                         <em class="replaceable"><code>zone</code></em>
    730. 

  730.                         [<span class="optional"><em class="replaceable"><code>class</code></em>
    731. 

  731.                         [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]
    732. 

  732.                     </code></strong></span></dt>
    733. 

  733. <dd><p>
    734. 

  734.                         Delete a zone while the server is running.
    735. 

  735.                         Only zones that were originally added via
    736. 

  736.                         <span><strong class="command">rndc addzone</strong></span> can be deleted
    737. 

  737.                         in this matter.
    738. 

  738.                       </p></dd>
    739. 

  739. </dl></div>
    740. 

  740. <p>
    741. 

  741.                   A configuration file is required, since all
    742. 

  742.                   communication with the server is authenticated with
    743. 

  743.                   digital signatures that rely on a shared secret, and
    744. 

  744.                   there is no way to provide that secret other than with a
    745. 

  745.                   configuration file.  The default location for the
    746. 

  746.                   <span><strong class="command">rndc</strong></span> configuration file is
    747. 

  747.                   <code class="filename">/etc/rndc.conf</code>, but an
    748. 

  748.                   alternate
    749. 

  749.                   location can be specified with the <code class="option">-c</code>
    750. 

  750.                   option.  If the configuration file is not found,
    751. 

  751.                   <span><strong class="command">rndc</strong></span> will also look in
    752. 

  752.                   <code class="filename">/etc/rndc.key</code> (or whatever
    753. 

  753.                   <code class="varname">sysconfdir</code> was defined when
    754. 

  754.                   the <acronym class="acronym">BIND</acronym> build was
    755. 

  755.                   configured).
    756. 

  756.                   The <code class="filename">rndc.key</code> file is
    757. 

  757.                   generated by
    758. 

  758.                   running <span><strong class="command">rndc-confgen -a</strong></span> as
    759. 

  759.                   described in
    760. 

  760.                   <a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage" title="controls Statement Definition and
    761. 

  761.           Usage">the section called &#8220;<span><strong class="command">controls</strong></span> Statement Definition and
    762. 

  762.           Usage&#8221;</a>.
    763. 

  763.                 </p>
    764. 

  764. <p>
    765. 

  765.                   The format of the configuration file is similar to
    766. 

  766.                   that of <code class="filename">named.conf</code>, but
    767. 

  767.                   limited to
    768. 

  768.                   only four statements, the <span><strong class="command">options</strong></span>,
    769. 

  769.                   <span><strong class="command">key</strong></span>, <span><strong class="command">server</strong></span> and
    770. 

  770.                   <span><strong class="command">include</strong></span>
    771. 

  771.                   statements.  These statements are what associate the
    772. 

  772.                   secret keys to the servers with which they are meant to
    773. 

  773.                   be shared.  The order of statements is not
    774. 

  774.                   significant.
    775. 

  775.                 </p>
    776. 

  776. <p>
    777. 

  777.                   The <span><strong class="command">options</strong></span> statement has
    778. 

  778.                   three clauses:
    779. 

  779.                   <span><strong class="command">default-server</strong></span>, <span><strong class="command">default-key</strong></span>,
    780. 

  780.                   and <span><strong class="command">default-port</strong></span>.
    781. 

  781.                   <span><strong class="command">default-server</strong></span> takes a
    782. 

  782.                   host name or address argument  and represents the server
    783. 

  783.                   that will
    784. 

  784.                   be contacted if no <code class="option">-s</code>
    785. 

  785.                   option is provided on the command line.
    786. 

  786.                   <span><strong class="command">default-key</strong></span> takes
    787. 

  787.                   the name of a key as its argument, as defined by a <span><strong class="command">key</strong></span> statement.
    788. 

  788.                   <span><strong class="command">default-port</strong></span> specifies the
    789. 

  789.                   port to which
    790. 

  790.                   <span><strong class="command">rndc</strong></span> should connect if no
    791. 

  791.                   port is given on the command line or in a
    792. 

  792.                   <span><strong class="command">server</strong></span> statement.
    793. 

  793.                 </p>
    794. 

  794. <p>
    795. 

  795.                   The <span><strong class="command">key</strong></span> statement defines a
    796. 

  796.                   key to be used
    797. 

  797.                   by <span><strong class="command">rndc</strong></span> when authenticating
    798. 

  798.                   with
    799. 

  799.                   <span><strong class="command">named</strong></span>.  Its syntax is
    800. 

  800.                   identical to the
    801. 

  801.                   <span><strong class="command">key</strong></span> statement in <code class="filename">named.conf</code>.
    802. 

  802.                   The keyword <strong class="userinput"><code>key</code></strong> is
    803. 

  803.                   followed by a key name, which must be a valid
    804. 

  804.                   domain name, though it need not actually be hierarchical;
    805. 

  805.                   thus,
    806. 

  806.                   a string like "<strong class="userinput"><code>rndc_key</code></strong>" is a valid
    807. 

  807.                   name.
    808. 

  808.                   The <span><strong class="command">key</strong></span> statement has two
    809. 

  809.                   clauses:
    810. 

  810.                   <span><strong class="command">algorithm</strong></span> and <span><strong class="command">secret</strong></span>.
    811. 

  811.                   While the configuration parser will accept any string as the
    812. 

  812.                   argument
    813. 

  813.                   to algorithm, currently only the string "<strong class="userinput"><code>hmac-md5</code></strong>"
    814. 

  814.                   has any meaning.  The secret is a base-64 encoded string
    815. 

  815.                   as specified in RFC 3548.
    816. 

  816.                 </p>
    817. 

  817. <p>
    818. 

  818.                   The <span><strong class="command">server</strong></span> statement
    819. 

  819.                   associates a key
    820. 

  820.                   defined using the <span><strong class="command">key</strong></span>
    821. 

  821.                   statement with a server.
    822. 

  822.                   The keyword <strong class="userinput"><code>server</code></strong> is followed by a
    823. 

  823.                   host name or address.  The <span><strong class="command">server</strong></span> statement
    824. 

  824.                   has two clauses: <span><strong class="command">key</strong></span> and <span><strong class="command">port</strong></span>.
    825. 

  825.                   The <span><strong class="command">key</strong></span> clause specifies the
    826. 

  826.                   name of the key
    827. 

  827.                   to be used when communicating with this server, and the
    828. 

  828.                   <span><strong class="command">port</strong></span> clause can be used to
    829. 

  829.                   specify the port <span><strong class="command">rndc</strong></span> should
    830. 

  830.                   connect
    831. 

  831.                   to on the server.
    832. 

  832.                 </p>
    833. 

  833. <p>
    834. 

  834.                   A sample minimal configuration file is as follows:
    835. 

  835.                 </p>
    836. 

  836. <pre class="programlisting">
    837. 

  837. key rndc_key {
    838. 

  838.      algorithm "hmac-md5";
    839. 

  839.      secret
    840. 

  840.        "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K";
    841. 

  841. };
    842. 

  842. options {
    843. 

  843.      default-server 127.0.0.1;
    844. 

  844.      default-key    rndc_key;
    845. 

  845. };
    846. 

  846. </pre>
    847. 

  847. <p>
    848. 

  848.                   This file, if installed as <code class="filename">/etc/rndc.conf</code>,
    849. 

  849.                   would allow the command:
    850. 

  850.                 </p>
    851. 

  851. <p>
    852. 

  852.                   <code class="prompt">$ </code><strong class="userinput"><code>rndc reload</code></strong>
    853. 

  853.                 </p>
    854. 

  854. <p>
    855. 

  855.                   to connect to 127.0.0.1 port 953 and cause the name server
    856. 

  856.                   to reload, if a name server on the local machine were
    857. 

  857.                   running with
    858. 

  858.                   following controls statements:
    859. 

  859.                 </p>
    860. 

  860. <pre class="programlisting">
    861. 

  861. controls {
    862. 

  862.         inet 127.0.0.1
    863. 

  863.             allow { localhost; } keys { rndc_key; };
    864. 

  864. };
    865. 

  865. </pre>
    866. 

  866. <p>
    867. 

  867.                   and it had an identical key statement for
    868. 

  868.                   <code class="literal">rndc_key</code>.
    869. 

  869.                 </p>
    870. 

  870. <p>
    871. 

  871.                   Running the <span><strong class="command">rndc-confgen</strong></span>
    872. 

  872.                   program will
    873. 

  873.                   conveniently create a <code class="filename">rndc.conf</code>
    874. 

  874.                   file for you, and also display the
    875. 

  875.                   corresponding <span><strong class="command">controls</strong></span>
    876. 

  876.                   statement that you need to
    877. 

  877.                   add to <code class="filename">named.conf</code>.
    878. 

  878.                   Alternatively,
    879. 

  879.                   you can run <span><strong class="command">rndc-confgen -a</strong></span>
    880. 

  880.                   to set up
    881. 

  881.                   a <code class="filename">rndc.key</code> file and not
    882. 

  882.                   modify
    883. 

  883.                   <code class="filename">named.conf</code> at all.
    884. 

  884.                 </p>
    885. 

  885. </dd>
    886. 

  886. </dl></div>
    887. 

  887. </div>
    888. 

  888. </div>
    889. 

  889. <div class="sect2" lang="en">
    890. 

  890. <div class="titlepage"><div><div><h3 class="title">
    891. 

  891. <a name="id2570421"></a>Signals</h3></div></div></div>
    892. 

  892. <p>
    893. 

  893.           Certain UNIX signals cause the name server to take specific
    894. 

  894.           actions, as described in the following table.  These signals can
    895. 

  895.           be sent using the <span><strong class="command">kill</strong></span> command.
    896. 

  896.         </p>
    897. 

  897. <div class="informaltable"><table border="1">
    898. 

  898. <colgroup>
    899. 

  899. <col>
    900. 

  900. <col>
    901. 

  901. </colgroup>
    902. 

  902. <tbody>
    903. 

  903. <tr>
    904. 

  904. <td>
    905. 

  905.                   <p><span><strong class="command">SIGHUP</strong></span></p>
    906. 

  906.                 </td>
    907. 

  907. <td>
    908. 

  908.                   <p>
    909. 

  909.                     Causes the server to read <code class="filename">named.conf</code> and
    910. 

  910.                     reload the database.
    911. 

  911.                   </p>
    912. 

  912.                 </td>
    913. 

  913. </tr>
    914. 

  914. <tr>
    915. 

  915. <td>
    916. 

  916.                   <p><span><strong class="command">SIGTERM</strong></span></p>
    917. 

  917.                 </td>
    918. 

  918. <td>
    919. 

  919.                   <p>
    920. 

  920.                     Causes the server to clean up and exit.
    921. 

  921.                   </p>
    922. 

  922.                 </td>
    923. 

  923. </tr>
    924. 

  924. <tr>
    925. 

  925. <td>
    926. 

  926.                   <p><span><strong class="command">SIGINT</strong></span></p>
    927. 

  927.                 </td>
    928. 

  928. <td>
    929. 

  929.                   <p>
    930. 

  930.                     Causes the server to clean up and exit.
    931. 

  931.                   </p>
    932. 

  932.                 </td>
    933. 

  933. </tr>
    934. 

  934. </tbody>
    935. 

  935. </table></div>
    936. 

  936. </div>
    937. 

  937. </div>
    938. 

  938. </div>
    939. 

  939. <div class="navfooter">
    940. 

  940. <hr>
    941. 

  941. <table width="100%" summary="Navigation footer">
    942. 

  942. <tr>
    943. 

  943. <td width="40%" align="left">
    944. 

  944. <a accesskey="p" href="Bv9ARM.ch02.html">Prev</a> </td>
    945. 

  945. <td width="20%" align="center"> </td>
    946. 

  946. <td width="40%" align="right"> <a accesskey="n" href="Bv9ARM.ch04.html">Next</a>
    947. 

  947. </td>
    948. 

  948. </tr>
    949. 

  949. <tr>
    950. 

  950. <td width="40%" align="left" valign="top">Chapter 2. <acronym class="acronym">BIND</acronym> Resource Requirements </td>
    951. 

  951. <td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
    952. 

  952. <td width="40%" align="right" valign="top"> Chapter 4. Advanced DNS Features</td>
    953. 

  953. </tr>
    954. 

  954. </table>
    955. 

  955. </div>
    956. 

  956. </body>
    957. 

  957. </html>
    958.