2
0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-28 04:58:04 +00:00
bind/doc/arm/Bv9ARM.ch03.html

1573 lines
22 KiB
HTML
Raw Normal View History

<HTML
><HEAD
><TITLE
2001-11-08 21:22:49 +00:00
>Name Server Configuration</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.61
2001-02-15 00:12:20 +00:00
"><LINK
REL="HOME"
2001-02-15 00:12:20 +00:00
TITLE="BIND 9 Administrator Reference Manual"
HREF="Bv9ARM.html"><LINK
REL="PREVIOUS"
TITLE="BIND Resource Requirements"
HREF="Bv9ARM.ch02.html"><LINK
REL="NEXT"
2001-11-08 21:22:49 +00:00
TITLE="Advanced DNS Features"
HREF="Bv9ARM.ch04.html"></HEAD
><BODY
2001-02-15 00:12:20 +00:00
CLASS="chapter"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><DIV
CLASS="NAVHEADER"
><TABLE
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="3"
ALIGN="center"
2001-02-15 00:12:20 +00:00
>BIND 9 Administrator Reference Manual</TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="bottom"
><A
HREF="Bv9ARM.ch02.html"
>Prev</A
></TD
><TD
WIDTH="80%"
ALIGN="center"
VALIGN="bottom"
></TD
><TD
WIDTH="10%"
ALIGN="right"
VALIGN="bottom"
><A
HREF="Bv9ARM.ch04.html"
>Next</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="chapter"
><H1
><A
NAME="ch03"
2001-11-08 21:22:49 +00:00
>Chapter 3. Name Server Configuration</A
></H1
><DIV
CLASS="TOC"
><DL
><DT
><B
>Table of Contents</B
></DT
><DT
>3.1. <A
HREF="Bv9ARM.ch03.html#sample_configuration"
>Sample Configurations</A
></DT
><DT
>3.2. <A
2001-11-08 21:22:49 +00:00
HREF="Bv9ARM.ch03.html#AEN266"
>Load Balancing</A
></DT
><DT
>3.3. <A
2001-11-08 21:22:49 +00:00
HREF="Bv9ARM.ch03.html#AEN343"
>Name Server Operations</A
></DT
></DL
></DIV
><P
>In this section we provide some suggested configurations along
with guidelines for their use. We also address the topic of reasonable
option setting.</P
><DIV
CLASS="sect1"
><H1
CLASS="sect1"
><A
NAME="sample_configuration"
>3.1. Sample Configurations</A
></H1
><DIV
CLASS="sect2"
><H2
CLASS="sect2"
><A
2001-11-08 21:22:49 +00:00
NAME="AEN255"
>3.1.1. A Caching-only Name Server</A
></H2
><P
>The following sample configuration is appropriate for a caching-only
name server for use by clients internal to a corporation. All queries
2001-11-08 21:22:49 +00:00
from outside clients are refused using the <B
CLASS="command"
>allow-query</B
>
option. Alternatively, the same effect could be achieved using suitable
firewall rules.</P
><PRE
CLASS="programlisting"
>&#13;// Two corporate subnets we wish to allow queries from.
2001-11-08 21:22:49 +00:00
acl corpnets { 192.168.4.0/24; 192.168.7.0/24; };
options {
2001-05-15 22:48:58 +00:00
directory "/etc/namedb"; // Working directory
2001-11-08 21:22:49 +00:00
allow-query { corpnets; };
};
// Provide a reverse mapping for the loopback address 127.0.0.1
zone "0.0.127.in-addr.arpa" {
type master;
file "localhost.rev";
notify no;
};
</PRE
></DIV
><DIV
CLASS="sect2"
><H2
CLASS="sect2"
><A
2001-11-08 21:22:49 +00:00
NAME="AEN260"
>3.1.2. An Authoritative-only Name Server</A
></H2
><P
>This sample configuration is for an authoritative-only server
that is the master server for "<TT
CLASS="filename"
>example.com</TT
>"
and a slave for the subdomain "<TT
CLASS="filename"
>eng.example.com</TT
>".</P
><PRE
CLASS="programlisting"
>&#13;options {
2001-05-15 22:48:58 +00:00
directory "/etc/namedb"; // Working directory
allow-query { any; }; // This is the default
recursion no; // Do not provide recursive service
};
// Provide a reverse mapping for the loopback address 127.0.0.1
zone "0.0.127.in-addr.arpa" {
type master;
file "localhost.rev";
notify no;
};
// We are the master server for example.com
zone "example.com" {
type master;
file "example.com.db";
// IP addresses of slave servers allowed to transfer example.com
allow-transfer {
192.168.4.14;
192.168.5.53;
};
};
// We are a slave server for eng.example.com
zone "eng.example.com" {
type slave;
file "eng.example.com.bk";
// IP address of eng.example.com master server
masters { 192.168.4.12; };
};
</PRE
></DIV
></DIV
><DIV
CLASS="sect1"
><H1
CLASS="sect1"
><A
2001-11-08 21:22:49 +00:00
NAME="AEN266"
>3.2. Load Balancing</A
></H1
><P
2001-11-08 21:22:49 +00:00
>A primitive form of load balancing can be achieved in
the <SPAN
CLASS="acronym"
>DNS</SPAN
2001-11-08 21:22:49 +00:00
> by using multiple A records for one name.</P
><P
>For example, if you have three WWW servers with network addresses
of 10.0.0.1, 10.0.0.2 and 10.0.0.3, a set of records such as the
following means that clients will connect to each machine one third
of the time:</P
><DIV
CLASS="informaltable"
2001-02-15 00:12:20 +00:00
><A
2001-11-08 21:22:49 +00:00
NAME="AEN271"
2001-02-15 00:12:20 +00:00
></A
><P
></P
><TABLE
2000-11-30 23:30:36 +00:00
CELLPADDING="3"
BORDER="1"
CLASS="CALSTABLE"
2001-02-15 00:12:20 +00:00
><TBODY
><TR
><TD
WIDTH="84"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
>Name</P
></TD
><TD
WIDTH="48"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
>TTL</P
></TD
><TD
WIDTH="72"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
>CLASS</P
></TD
><TD
WIDTH="72"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
>TYPE</P
></TD
><TD
WIDTH="195"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
>Resource Record (RR) Data</P
></TD
></TR
><TR
><TD
WIDTH="84"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
><TT
CLASS="literal"
>www</TT
></P
></TD
><TD
WIDTH="48"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
><TT
CLASS="literal"
>600</TT
></P
></TD
><TD
WIDTH="72"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
><TT
CLASS="literal"
>IN</TT
></P
></TD
><TD
WIDTH="72"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
><TT
CLASS="literal"
>A</TT
></P
></TD
><TD
WIDTH="195"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
><TT
CLASS="literal"
>10.0.0.1</TT
></P
></TD
></TR
><TR
><TD
WIDTH="84"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
></P
></TD
><TD
WIDTH="48"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
><TT
CLASS="literal"
>600</TT
></P
></TD
><TD
WIDTH="72"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
><TT
CLASS="literal"
>IN</TT
></P
></TD
><TD
WIDTH="72"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
><TT
CLASS="literal"
>A</TT
></P
></TD
><TD
WIDTH="195"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
><TT
CLASS="literal"
>10.0.0.2</TT
></P
></TD
></TR
><TR
><TD
WIDTH="84"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
></P
></TD
><TD
WIDTH="48"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
><TT
CLASS="literal"
>600</TT
></P
></TD
><TD
WIDTH="72"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
><TT
CLASS="literal"
>IN</TT
></P
></TD
><TD
WIDTH="72"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
><TT
CLASS="literal"
>A</TT
></P
></TD
><TD
WIDTH="195"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
><TT
CLASS="literal"
>10.0.0.3</TT
></P
></TD
></TR
2001-02-15 00:12:20 +00:00
></TBODY
></TABLE
><P
></P
></DIV
><P
>When a resolver queries for these records, <SPAN
CLASS="acronym"
>BIND</SPAN
> will rotate
them and respond to the query with the records in a different
order. In the example above, clients will randomly receive
records in the order 1, 2, 3; 2, 3, 1; and 3, 1, 2. Most clients
will use the first record returned and discard the rest.</P
><P
>For more detail on ordering responses, check the
<B
CLASS="command"
>rrset-order</B
> substatement in the
<B
CLASS="command"
>options</B
> statement, see
<A
HREF="Bv9ARM.ch06.html#rrset_ordering"
><I
>RRset Ordering</I
></A
>.
This substatement is not supported in
<SPAN
CLASS="acronym"
>BIND</SPAN
> 9, and only the ordering scheme described above is
available.</P
></DIV
><DIV
CLASS="sect1"
><H1
CLASS="sect1"
><A
2001-11-08 21:22:49 +00:00
NAME="AEN343"
>3.3. Name Server Operations</A
></H1
><DIV
CLASS="sect2"
><H2
CLASS="sect2"
><A
2001-11-08 21:22:49 +00:00
NAME="AEN345"
>3.3.1. Tools for Use With the Name Server Daemon</A
></H2
><P
>There are several indispensable diagnostic, administrative
and monitoring tools available to the system administrator for controlling
2001-11-08 21:22:49 +00:00
and debugging the name server daemon. We describe several in this
section </P
><DIV
CLASS="sect3"
><H3
CLASS="sect3"
><A
2001-01-05 17:27:02 +00:00
NAME="diagnostic_tools"
2001-11-08 21:22:49 +00:00
>3.3.1.1. Diagnostic Tools</A
></H3
><P
2001-11-08 21:22:49 +00:00
>The <B
CLASS="command"
>dig</B
>, <B
CLASS="command"
>host</B
>, and
<B
CLASS="command"
>nslookup</B
> programs are all command line tools
for manually querying name servers. They differ in style and
output format.
</P
><P
></P
2001-02-15 00:12:20 +00:00
><DIV
CLASS="variablelist"
><DL
><DT
><B
CLASS="command"
>dig</B
></DT
><DD
><P
>The domain information groper (<B
CLASS="command"
>dig</B
2001-11-08 21:22:49 +00:00
>)
is the most versatile and complete of these lookup tools.
It has two modes: simple interactive
mode for a single query, and batch mode which executes a query for
each in a list of several query lines. All query options are accessible
from the command line.</P
><P
><B
CLASS="command"
>dig</B
> [@<TT
CLASS="replaceable"
><I
>server</I
></TT
>] <TT
CLASS="replaceable"
><I
>domain</I
></TT
> [<TT
CLASS="replaceable"
><I
>query-type</I
></TT
>] [<TT
CLASS="replaceable"
><I
>query-class</I
></TT
>] [+<TT
CLASS="replaceable"
><I
>query-option</I
></TT
>] [-<TT
CLASS="replaceable"
><I
>dig-option</I
></TT
>] [%<TT
CLASS="replaceable"
><I
>comment</I
></TT
>]</P
><P
>The usual simple use of dig will take the form</P
><P
><B
CLASS="command"
>dig @server domain query-type query-class</B
></P
><P
>For more information and a list of available commands and
options, see the <B
CLASS="command"
>dig</B
> man page.</P
></DD
><DT
><B
CLASS="command"
>host</B
></DT
><DD
><P
>The <B
CLASS="command"
>host</B
2001-11-08 21:22:49 +00:00
> utility emphasizes simplicity
and ease of use. By default, it converts
between host names and Internet addresses, but its functionality
can be extended with the use of options.</P
><P
><B
CLASS="command"
>host</B
> [-aCdlrTwv] [-c <TT
CLASS="replaceable"
><I
>class</I
></TT
>] [-N <TT
CLASS="replaceable"
><I
>ndots</I
></TT
>] [-t <TT
CLASS="replaceable"
><I
>type</I
></TT
>] [-W <TT
CLASS="replaceable"
><I
>timeout</I
></TT
>] [-R <TT
CLASS="replaceable"
><I
>retries</I
></TT
>] <TT
CLASS="replaceable"
><I
>hostname</I
></TT
> [<TT
CLASS="replaceable"
><I
>server</I
></TT
>]</P
><P
>For more information and a list of available commands and
options, see the <B
CLASS="command"
>host</B
> man page.</P
></DD
><DT
><B
CLASS="command"
>nslookup</B
></DT
><DD
><P
><B
CLASS="command"
>nslookup</B
> has two modes: interactive
2001-11-08 21:22:49 +00:00
and non-interactive. Interactive mode allows the user to query name servers
for information about various hosts and domains or to print a list
of hosts in a domain. Non-interactive mode is used to print just
the name and requested information for a host or domain.</P
><P
><B
CLASS="command"
>nslookup</B
> [-option...] [<TT
CLASS="replaceable"
><I
>host-to-find</I
></TT
> | - [server]]</P
><P
>Interactive mode is entered when no arguments are given (the
2001-11-08 21:22:49 +00:00
default name server will be used) or when the first argument is a
hyphen (`-') and the second argument is the host name or Internet address
2001-11-08 21:22:49 +00:00
of a name server.</P
><P
>Non-interactive mode is used when the name or Internet address
of the host to be looked up is given as the first argument. The
2001-11-08 21:22:49 +00:00
optional second argument specifies the host name or address of a name server.</P
><P
>Due to its arcane user interface and frequently inconsistent
behavior, we do not recommend the use of <B
CLASS="command"
>nslookup</B
>.
Use <B
CLASS="command"
>dig</B
> instead.</P
></DD
2001-01-05 17:27:02 +00:00
></DL
></DIV
2001-02-15 00:12:20 +00:00
></DIV
2001-01-05 17:27:02 +00:00
><DIV
CLASS="sect3"
><H3
CLASS="sect3"
><A
NAME="admin_tools"
2001-11-08 21:22:49 +00:00
>3.3.1.2. Administrative Tools</A
2001-01-05 17:27:02 +00:00
></H3
><P
>Administrative tools play an integral part in the management
of a server.</P
><P
></P
2001-02-15 00:12:20 +00:00
><DIV
CLASS="variablelist"
2001-01-05 17:27:02 +00:00
><DL
><DT
><A
2001-02-01 21:54:27 +00:00
NAME="named-checkconf"
2000-12-15 00:39:56 +00:00
><B
CLASS="command"
2001-02-01 21:54:27 +00:00
>named-checkconf</B
2000-12-15 00:39:56 +00:00
></A
></DT
><DD
><P
2001-01-05 17:27:02 +00:00
>The <B
CLASS="command"
2001-02-01 21:54:27 +00:00
>named-checkconf</B
2001-01-05 17:27:02 +00:00
> program
2001-05-15 22:48:58 +00:00
checks the syntax of a <TT
2000-12-15 00:39:56 +00:00
CLASS="filename"
>named.conf</TT
2001-01-05 17:27:02 +00:00
> file.</P
2000-12-15 00:39:56 +00:00
><P
><B
CLASS="command"
2001-02-01 21:54:27 +00:00
>named-checkconf</B
> [-t <TT
CLASS="replaceable"
><I
>directory</I
></TT
>] [<TT
2000-12-15 00:39:56 +00:00
CLASS="replaceable"
><I
>filename</I
></TT
>]</P
></DD
><DT
><A
2001-02-01 21:54:27 +00:00
NAME="named-checkzone"
2000-12-15 00:39:56 +00:00
><B
CLASS="command"
2001-02-01 21:54:27 +00:00
>named-checkzone</B
2000-12-15 00:39:56 +00:00
></A
></DT
><DD
><P
2001-01-05 17:27:02 +00:00
>The <B
CLASS="command"
2001-02-01 21:54:27 +00:00
>named-checkzone</B
2001-01-05 17:27:02 +00:00
> program checks a master file for
2001-05-15 22:48:58 +00:00
syntax and consistency.</P
2000-12-15 00:39:56 +00:00
><P
><B
CLASS="command"
2001-10-15 21:58:27 +00:00
>named-checkzone</B
2000-12-15 00:39:56 +00:00
> [-dq] [-c <TT
CLASS="replaceable"
><I
>class</I
></TT
>] <TT
CLASS="replaceable"
><I
>zone</I
></TT
> [<TT
CLASS="replaceable"
><I
>filename</I
></TT
>]</P
></DD
><DT
><A
NAME="rndc"
><B
CLASS="command"
>rndc</B
></A
></DT
><DD
><P
>The remote name daemon control
(<B
CLASS="command"
>rndc</B
>) program allows the system
2001-11-08 21:22:49 +00:00
administrator to control the operation of a name server.
If you run <B
CLASS="command"
>rndc</B
> without any options
it will display a usage message as follows:</P
><P
><B
CLASS="command"
>rndc</B
> [-c <TT
CLASS="replaceable"
><I
>config</I
></TT
>] [-s <TT
CLASS="replaceable"
><I
>server</I
></TT
>] [-p <TT
CLASS="replaceable"
><I
>port</I
></TT
>] [-y <TT
CLASS="replaceable"
><I
>key</I
></TT
>] <TT
CLASS="replaceable"
><I
>command</I
></TT
> [<TT
CLASS="replaceable"
><I
>command</I
></TT
>...]</P
><P
><B
CLASS="command"
>command</B
2000-11-30 23:30:36 +00:00
> is one of the following:</P
><P
></P
2001-04-12 00:53:44 +00:00
><DIV
CLASS="variablelist"
><DL
><DT
><TT
CLASS="userinput"
><B
2000-11-30 23:30:36 +00:00
>reload</B
></TT
2001-04-12 00:53:44 +00:00
></DT
><DD
><P
2000-11-30 23:30:36 +00:00
>Reload configuration file and zones.</P
2001-04-12 00:53:44 +00:00
></DD
><DT
><TT
CLASS="userinput"
><B
2000-11-30 23:30:36 +00:00
>reload <TT
CLASS="replaceable"
><I
>zone</I
></TT
2001-04-12 00:53:44 +00:00
>
[<SPAN
2000-11-30 23:30:36 +00:00
CLASS="optional"
><TT
2000-11-30 23:30:36 +00:00
CLASS="replaceable"
><I
>class</I
></TT
2001-04-12 00:53:44 +00:00
>
2001-05-15 22:48:58 +00:00
[<SPAN
2000-11-30 23:30:36 +00:00
CLASS="optional"
><TT
CLASS="replaceable"
><I
>view</I
></TT
></SPAN
>]</SPAN
>]</B
></TT
2001-04-12 00:53:44 +00:00
></DT
><DD
><P
2000-11-30 23:30:36 +00:00
>Reload the given zone.</P
2001-04-12 00:53:44 +00:00
></DD
><DT
><TT
CLASS="userinput"
><B
2000-11-30 23:30:36 +00:00
>refresh <TT
CLASS="replaceable"
><I
>zone</I
></TT
2001-04-12 00:53:44 +00:00
>
[<SPAN
2000-11-30 23:30:36 +00:00
CLASS="optional"
><TT
CLASS="replaceable"
><I
>class</I
></TT
2001-04-12 00:53:44 +00:00
>
[<SPAN
2000-11-30 23:30:36 +00:00
CLASS="optional"
><TT
CLASS="replaceable"
><I
>view</I
></TT
></SPAN
>]</SPAN
>]</B
></TT
2001-04-12 00:53:44 +00:00
></DT
><DD
><P
2000-11-30 23:30:36 +00:00
>Schedule zone maintenance for the given zone.</P
2001-04-12 00:53:44 +00:00
></DD
><DT
><TT
CLASS="userinput"
><B
2001-09-19 22:17:51 +00:00
>retransfer <TT
CLASS="replaceable"
><I
>zone</I
></TT
>
[<SPAN
CLASS="optional"
><TT
CLASS="replaceable"
><I
>class</I
></TT
>
[<SPAN
CLASS="optional"
><TT
CLASS="replaceable"
><I
>view</I
></TT
></SPAN
>]</SPAN
>]</B
></TT
></DT
><DD
><P
>Retransfer the given zone from the master.</P
></DD
><DT
><TT
CLASS="userinput"
><B
2001-05-07 23:34:24 +00:00
>reconfig</B
></TT
></DT
><DD
><P
>Reload the configuration file and load new zones,
but do not reload existing zone files even if they have changed.
This is faster than a full <B
CLASS="command"
>reload</B
> when there
is a large number of zones because it avoids the need to examine the
modification times of the zones files.
</P
></DD
><DT
><TT
CLASS="userinput"
><B
2000-11-30 23:30:36 +00:00
>stats</B
></TT
2001-04-12 00:53:44 +00:00
></DT
><DD
><P
2000-11-30 23:30:36 +00:00
>Write server statistics to the statistics file.</P
2001-04-12 00:53:44 +00:00
></DD
><DT
><TT
CLASS="userinput"
><B
>querylog</B
></TT
2001-04-12 00:53:44 +00:00
></DT
><DD
><P
2001-11-02 02:06:47 +00:00
>Toggle query logging. Query logging can also be enabled
by explictly directing the <B
CLASS="command"
>queries</B
>
<B
CLASS="command"
>category</B
> to a <B
CLASS="command"
>channel</B
> in the
<B
CLASS="command"
>logging</B
> section of
<TT
CLASS="filename"
>named.conf</TT
>.</P
2001-04-12 00:53:44 +00:00
></DD
><DT
><TT
CLASS="userinput"
><B
>dumpdb</B
></TT
></DT
><DD
><P
2001-04-12 00:53:44 +00:00
>Dump the server's caches to the dump file. </P
></DD
><DT
><TT
CLASS="userinput"
><B
>stop</B
></TT
2001-04-12 00:53:44 +00:00
></DT
><DD
><P
2001-04-12 00:53:44 +00:00
>Stop the server,
making sure any recent changes
made through dynamic update or IXFR are first saved to the master files
of the updated zones.</P
></DD
><DT
><TT
CLASS="userinput"
><B
2000-11-30 23:30:36 +00:00
>halt</B
></TT
2001-04-12 00:53:44 +00:00
></DT
><DD
><P
2000-11-30 23:30:36 +00:00
>Stop the server immediately. Recent changes
2001-04-12 00:53:44 +00:00
made through dynamic update or IXFR are not saved to the master files,
but will be rolled forward from the journal files when the server
is restarted.</P
></DD
><DT
><TT
CLASS="userinput"
><B
>trace</B
></TT
></DT
><DD
><P
2001-04-12 00:53:44 +00:00
>Increment the servers debugging level by one. </P
></DD
><DT
><TT
CLASS="userinput"
><B
>trace <TT
CLASS="replaceable"
><I
>level</I
></TT
></B
></TT
></DT
><DD
><P
>Sets the server's debugging level to an explicit
value.</P
></DD
><DT
><TT
CLASS="userinput"
><B
>notrace</B
></TT
></DT
><DD
><P
>Sets the server's debugging level to 0.</P
></DD
><DT
><TT
CLASS="userinput"
><B
>flush</B
></TT
></DT
><DD
><P
>Flushes the server's cache.</P
></DD
2001-05-15 17:29:59 +00:00
><DT
><TT
CLASS="userinput"
><B
>status</B
></TT
></DT
><DD
><P
>Display status of the server.</P
></DD
2001-04-12 00:53:44 +00:00
></DL
></DIV
><P
2000-11-30 23:30:36 +00:00
>In <SPAN
CLASS="acronym"
>BIND</SPAN
2001-05-15 17:29:59 +00:00
> 9.2, <B
2000-11-30 23:30:36 +00:00
CLASS="command"
>rndc</B
2001-05-15 17:29:59 +00:00
>
2001-07-30 22:55:27 +00:00
supports all the commands of the BIND 8 <B
2000-11-30 23:30:36 +00:00
CLASS="command"
>ndc</B
>
2001-07-30 22:55:27 +00:00
utility except <B
2001-05-15 17:29:59 +00:00
CLASS="command"
>ndc start</B
2001-11-08 21:22:49 +00:00
> and
<B
CLASS="command"
>ndc restart</B
>, which were also
2001-07-30 22:55:27 +00:00
not supported in <B
2001-05-15 17:29:59 +00:00
CLASS="command"
>ndc</B
>'s channel mode.</P
><P
>A configuration file is required, since all
2001-07-30 22:55:27 +00:00
communication with the server is authenticated with
digital signatures that rely on a shared secret, and
there is no way to provide that secret other than with a
configuration file. The default location for the
<B
CLASS="command"
>rndc</B
> configuration file is
2001-07-30 22:55:27 +00:00
<TT
CLASS="filename"
>/etc/rndc.conf</TT
>, but an alternate
2001-07-30 22:55:27 +00:00
location can be specified with the <TT
CLASS="option"
>-c</TT
>
2001-07-30 22:55:27 +00:00
option. If the configuration file is not found,
<B
2001-05-31 22:43:04 +00:00
CLASS="command"
>rndc</B
> will also look in
2001-07-30 22:55:27 +00:00
<TT
2001-05-31 22:43:04 +00:00
CLASS="filename"
2001-08-09 00:19:44 +00:00
>/etc/rndc.key</TT
> (or whatever
2001-07-30 22:55:27 +00:00
<TT
2001-05-31 22:43:04 +00:00
CLASS="varname"
2001-08-09 00:19:44 +00:00
>sysconfdir</TT
2001-05-31 22:43:04 +00:00
> was defined when
2001-07-30 22:55:27 +00:00
the <SPAN
2001-05-31 22:43:04 +00:00
CLASS="acronym"
>BIND</SPAN
> build was configured).
2001-07-30 22:55:27 +00:00
The <TT
2001-05-31 22:43:04 +00:00
CLASS="filename"
2001-08-09 00:19:44 +00:00
>rndc.key</TT
2001-05-31 22:43:04 +00:00
> file is generated by
2001-08-09 00:19:44 +00:00
running <B
2001-05-31 22:43:04 +00:00
CLASS="command"
2001-08-09 00:19:44 +00:00
>rndc-confgen -a</B
2001-05-31 22:43:04 +00:00
> as described in
2001-07-30 22:55:27 +00:00
<A
2001-05-31 22:43:04 +00:00
HREF="Bv9ARM.ch06.html#controls_statement_definition_and_usage"
>Section 6.2.4</A
>.</P
><P
>The format of the configuration file is similar to
2001-07-30 22:55:27 +00:00
that of <TT
CLASS="filename"
>named.conf</TT
>, but limited to
2001-07-30 22:55:27 +00:00
only four statements, the <B
CLASS="command"
2000-11-30 23:30:36 +00:00
>options</B
>,
2001-07-30 22:55:27 +00:00
<B
CLASS="command"
2000-11-30 23:30:36 +00:00
>key</B
2001-01-24 20:50:27 +00:00
>, <B
CLASS="command"
2000-11-30 23:30:36 +00:00
>server</B
2001-01-24 20:50:27 +00:00
> and
2001-07-30 22:55:27 +00:00
<B
2001-01-24 20:50:27 +00:00
CLASS="command"
>include</B
>
2001-07-30 22:55:27 +00:00
statements. These statements are what associate the
secret keys to the servers with which they are meant to
be shared. The order of statements is not
significant.</P
><P
>The <B
CLASS="command"
2000-11-30 23:30:36 +00:00
>options</B
> statement has three clauses:
<B
CLASS="command"
>default-server</B
>, <B
CLASS="command"
>default-key</B
>,
and <B
CLASS="command"
>default-port</B
>.
<B
CLASS="command"
>default-server</B
> takes a
host name or address argument and represents the server that will
be contacted if no <TT
CLASS="option"
>-s</TT
>
option is provided on the command line.
<B
CLASS="command"
>default-key</B
> takes
2001-11-08 21:22:49 +00:00
the name of a key as its argument, as defined by a <B
CLASS="command"
2000-11-30 23:30:36 +00:00
>key</B
> statement.
<B
CLASS="command"
>default-port</B
> specifies the port to which
<B
CLASS="command"
>rndc</B
> should connect if no
port is given on the command line or in a
<B
CLASS="command"
>server</B
> statement.</P
><P
>The <B
CLASS="command"
2000-11-30 23:30:36 +00:00
>key</B
2001-11-08 21:22:49 +00:00
> statement defines an key to be used
by <B
CLASS="command"
>rndc</B
> when authenticating with
<B
CLASS="command"
>named</B
>. Its syntax is identical to the
<B
CLASS="command"
>key</B
> statement in named.conf.
The keyword <TT
CLASS="userinput"
><B
>key</B
></TT
> is
followed by a key name, which must be a valid
domain name, though it need not actually be hierarchical; thus,
a string like "<TT
CLASS="userinput"
><B
>rndc_key</B
></TT
>" is a valid name.
The <B
CLASS="command"
2000-11-30 23:30:36 +00:00
>key</B
> statement has two clauses:
<B
CLASS="command"
>algorithm</B
> and <B
CLASS="command"
>secret</B
>.
While the configuration parser will accept any string as the argument
to algorithm, currently only the string "<TT
CLASS="userinput"
><B
>hmac-md5</B
></TT
>"
2001-09-01 00:58:17 +00:00
has any meaning. The secret is a base-64 encoded string.</P
><P
>The <B
CLASS="command"
2000-11-30 23:30:36 +00:00
>server</B
2001-11-08 21:22:49 +00:00
> statement associates a key
defined using the <B
CLASS="command"
2000-11-30 23:30:36 +00:00
>key</B
2001-11-08 21:22:49 +00:00
> statement with a server.
The keyword <TT
CLASS="userinput"
><B
>server</B
></TT
> is followed by a
host name or address. The <B
CLASS="command"
2000-11-30 23:30:36 +00:00
>server</B
2001-11-08 21:22:49 +00:00
> statement
has two clauses: <B
CLASS="command"
2000-11-30 23:30:36 +00:00
>key</B
2001-11-08 21:22:49 +00:00
> and <B
CLASS="command"
>port</B
>.
The <B
CLASS="command"
2001-11-08 21:22:49 +00:00
>key</B
> clause specifies the name of the key
to be used when communicating with this server, and the
<B
CLASS="command"
>port</B
2001-11-08 21:22:49 +00:00
> clause can be used to
specify the port <B
CLASS="command"
>rndc</B
> should connect
2001-11-08 21:22:49 +00:00
to on the server.</P
><P
>A sample minimal configuration file is as follows:</P
><PRE
CLASS="programlisting"
>&#13;key rndc_key {
algorithm "hmac-md5";
secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K";
};
options {
2001-11-08 21:22:49 +00:00
default-server 127.0.0.1;
default-key rndc_key;
};
</PRE
><P
>This file, if installed as <TT
CLASS="filename"
>/etc/rndc.conf</TT
>,
would allow the command:</P
><P
><TT
CLASS="prompt"
>$ </TT
><TT
CLASS="userinput"
><B
>rndc reload</B
></TT
></P
><P
2001-11-08 21:22:49 +00:00
>to connect to 127.0.0.1 port 953 and cause the name server
to reload, if a name server on the local machine were running with
following controls statements:</P
><PRE
CLASS="programlisting"
>&#13;controls {
2001-08-09 00:19:44 +00:00
inet 127.0.0.1 allow { localhost; } keys { rndc_key; };
};
</PRE
><P
>and it had an identical key statement for
<TT
CLASS="literal"
>rndc_key</TT
>.</P
2001-08-09 00:19:44 +00:00
><P
>Running the <B
CLASS="command"
>rndc-confgen</B
> program will
conveniently create a <TT
CLASS="filename"
>rndc.conf</TT
>
file for you, and also display the
corresponding <B
CLASS="command"
>controls</B
> statement that you need to
add to <TT
CLASS="filename"
>named.conf</TT
>. Alternatively,
you can run <B
CLASS="command"
>rndc-confgen -a</B
> to set up
a <TT
CLASS="filename"
>rndc.key</TT
> file and not modify
<TT
CLASS="filename"
>named.conf</TT
> at all.
</P
></DD
></DL
></DIV
></DIV
2001-02-15 00:12:20 +00:00
></DIV
><DIV
CLASS="sect2"
><H2
CLASS="sect2"
><A
2001-11-08 21:22:49 +00:00
NAME="AEN655"
>3.3.2. Signals</A
></H2
><P
>Certain UNIX signals cause the name server to take specific
actions, as described in the following table. These signals can
be sent using the <B
CLASS="command"
>kill</B
> command.</P
><DIV
CLASS="informaltable"
2001-02-15 00:12:20 +00:00
><A
2001-11-08 21:22:49 +00:00
NAME="AEN659"
2001-02-15 00:12:20 +00:00
></A
><P
></P
><TABLE
2000-11-30 23:30:36 +00:00
CELLPADDING="3"
BORDER="1"
CLASS="CALSTABLE"
2001-02-15 00:12:20 +00:00
><TBODY
><TR
><TD
WIDTH="108"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
><B
CLASS="command"
>SIGHUP</B
></P
></TD
><TD
WIDTH="384"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
>Causes the server to read <TT
CLASS="filename"
>named.conf</TT
> and
reload the database. </P
></TD
></TR
><TR
><TD
WIDTH="108"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
><B
CLASS="command"
>SIGTERM</B
></P
></TD
><TD
WIDTH="384"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
>Causes the server to clean up and exit.</P
></TD
></TR
><TR
><TD
WIDTH="108"
ALIGN="LEFT"
VALIGN="MIDDLE"
>&#13;<P
><B
CLASS="command"
>SIGINT</B
></P
>
</TD
><TD
WIDTH="384"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
>Causes the server to clean up and exit.</P
></TD
></TR
2001-02-15 00:12:20 +00:00
></TBODY
></TABLE
><P
></P
></DIV
></DIV
></DIV
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="Bv9ARM.ch02.html"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="Bv9ARM.html"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="Bv9ARM.ch04.html"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><SPAN
CLASS="acronym"
>BIND</SPAN
> Resource Requirements</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
>&nbsp;</TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
2001-11-08 21:22:49 +00:00
>Advanced DNS Features</TD
></TR
></TABLE
></DIV
></BODY
></HTML
>