2005-07-19 06:12:24 +00:00
|
|
|
|
<!--
|
2014-01-11 01:05:06 +00:00
|
|
|
|
- Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC")
|
2005-07-19 06:12:24 +00:00
|
|
|
|
- Copyright (C) 2000-2003 Internet Software Consortium.
|
|
|
|
|
|
-
|
2009-07-11 01:12:47 +00:00
|
|
|
|
- Permission to use, copy, modify, and/or distribute this software for any
|
2005-07-19 06:12:24 +00:00
|
|
|
|
- purpose with or without fee is hereby granted, provided that the above
|
|
|
|
|
|
- copyright notice and this permission notice appear in all copies.
|
|
|
|
|
|
-
|
|
|
|
|
|
- THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
|
|
|
|
|
|
- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
|
|
|
|
|
- AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
|
|
|
|
|
|
- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
|
|
|
|
|
- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
|
|
|
|
|
|
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
|
|
|
|
|
- PERFORMANCE OF THIS SOFTWARE.
|
|
|
|
|
|
-->
|
2012-03-07 01:41:11 +00:00
|
|
|
|
<!-- $Id$ -->
|
2005-07-19 06:12:24 +00:00
|
|
|
|
<html>
|
|
|
|
|
|
<head>
|
|
|
|
|
|
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
|
|
|
|
|
<title>rndc</title>
|
2006-12-12 01:45:21 +00:00
|
|
|
|
<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
|
2005-07-19 06:12:24 +00:00
|
|
|
|
<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
|
|
|
|
|
|
<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
|
2008-06-18 01:12:17 +00:00
|
|
|
|
<link rel="prev" href="man.nsupdate.html" title="nsupdate">
|
2005-07-19 06:12:24 +00:00
|
|
|
|
<link rel="next" href="man.rndc.conf.html" title="rndc.conf">
|
|
|
|
|
|
</head>
|
|
|
|
|
|
<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
|
|
|
|
|
|
<div class="navheader">
|
|
|
|
|
|
<table width="100%" summary="Navigation header">
|
|
|
|
|
|
<tr><th colspan="3" align="center"><span class="application">rndc</span></th></tr>
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td width="20%" align="left">
|
2008-06-18 01:12:17 +00:00
|
|
|
|
<a accesskey="p" href="man.nsupdate.html">Prev</a><EFBFBD></td>
|
2005-07-19 06:12:24 +00:00
|
|
|
|
<th width="60%" align="center">Manual pages</th>
|
|
|
|
|
|
<td width="20%" align="right"><EFBFBD><a accesskey="n" href="man.rndc.conf.html">Next</a>
|
|
|
|
|
|
</td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
</table>
|
|
|
|
|
|
<hr>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
<div class="refentry" lang="en">
|
|
|
|
|
|
<a name="man.rndc"></a><div class="titlepage"></div>
|
|
|
|
|
|
<div class="refnamediv">
|
|
|
|
|
|
<h2>Name</h2>
|
|
|
|
|
|
<p><span class="application">rndc</span> — name server control utility</p>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
<div class="refsynopsisdiv">
|
|
|
|
|
|
<h2>Synopsis</h2>
|
2014-03-06 01:05:38 +00:00
|
|
|
|
<div class="cmdsynopsis"><p><code class="command">rndc</code> [<code class="option">-b <em class="replaceable"><code>source-address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key-file</code></em></code>] [<code class="option">-s <em class="replaceable"><code>server</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-q</code>] [<code class="option">-V</code>] [<code class="option">-y <em class="replaceable"><code>key_id</code></em></code>] {command}</p></div>
|
2005-07-19 06:12:24 +00:00
|
|
|
|
</div>
|
|
|
|
|
|
<div class="refsect1" lang="en">
|
2014-03-11 01:05:19 +00:00
|
|
|
|
<a name="id2654379"></a><h2>DESCRIPTION</h2>
|
2005-07-19 06:12:24 +00:00
|
|
|
|
<p><span><strong class="command">rndc</strong></span>
|
|
|
|
|
|
controls the operation of a name
|
|
|
|
|
|
server. It supersedes the <span><strong class="command">ndc</strong></span> utility
|
|
|
|
|
|
that was provided in old BIND releases. If
|
|
|
|
|
|
<span><strong class="command">rndc</strong></span> is invoked with no command line
|
|
|
|
|
|
options or arguments, it prints a short summary of the
|
|
|
|
|
|
supported commands and the available options and their
|
|
|
|
|
|
arguments.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<p><span><strong class="command">rndc</strong></span>
|
2013-03-14 01:04:33 +00:00
|
|
|
|
communicates with the name server over a TCP connection, sending
|
|
|
|
|
|
commands authenticated with digital signatures. In the current
|
|
|
|
|
|
versions of
|
2007-05-31 23:28:55 +00:00
|
|
|
|
<span><strong class="command">rndc</strong></span> and <span><strong class="command">named</strong></span>,
|
2013-03-14 01:04:33 +00:00
|
|
|
|
the only supported authentication algorithms are HMAC-MD5
|
|
|
|
|
|
(for compatibility), HMAC-SHA1, HMAC-SHA224, HMAC-SHA256
|
|
|
|
|
|
(default), HMAC-SHA384 and HMAC-SHA512.
|
|
|
|
|
|
They use a shared secret on each end of the connection.
|
2005-07-19 06:12:24 +00:00
|
|
|
|
This provides TSIG-style authentication for the command
|
|
|
|
|
|
request and the name server's response. All commands sent
|
|
|
|
|
|
over the channel must be signed by a key_id known to the
|
|
|
|
|
|
server.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<p><span><strong class="command">rndc</strong></span>
|
|
|
|
|
|
reads a configuration file to
|
|
|
|
|
|
determine how to contact the name server and decide what
|
|
|
|
|
|
algorithm and key it should use.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
<div class="refsect1" lang="en">
|
2014-03-11 01:05:19 +00:00
|
|
|
|
<a name="id2654429"></a><h2>OPTIONS</h2>
|
2005-07-19 06:12:24 +00:00
|
|
|
|
<div class="variablelist"><dl>
|
|
|
|
|
|
<dt><span class="term">-b <em class="replaceable"><code>source-address</code></em></span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Use <em class="replaceable"><code>source-address</code></em>
|
|
|
|
|
|
as the source address for the connection to the server.
|
|
|
|
|
|
Multiple instances are permitted to allow setting of both
|
|
|
|
|
|
the IPv4 and IPv6 source addresses.
|
|
|
|
|
|
</p></dd>
|
|
|
|
|
|
<dt><span class="term">-c <em class="replaceable"><code>config-file</code></em></span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Use <em class="replaceable"><code>config-file</code></em>
|
|
|
|
|
|
as the configuration file instead of the default,
|
|
|
|
|
|
<code class="filename">/etc/rndc.conf</code>.
|
|
|
|
|
|
</p></dd>
|
|
|
|
|
|
<dt><span class="term">-k <em class="replaceable"><code>key-file</code></em></span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Use <em class="replaceable"><code>key-file</code></em>
|
|
|
|
|
|
as the key file instead of the default,
|
|
|
|
|
|
<code class="filename">/etc/rndc.key</code>. The key in
|
|
|
|
|
|
<code class="filename">/etc/rndc.key</code> will be used to
|
|
|
|
|
|
authenticate
|
|
|
|
|
|
commands sent to the server if the <em class="replaceable"><code>config-file</code></em>
|
|
|
|
|
|
does not exist.
|
|
|
|
|
|
</p></dd>
|
|
|
|
|
|
<dt><span class="term">-s <em class="replaceable"><code>server</code></em></span></dt>
|
|
|
|
|
|
<dd><p><em class="replaceable"><code>server</code></em> is
|
2007-06-20 02:27:33 +00:00
|
|
|
|
the name or address of the server which matches a
|
2005-07-19 06:12:24 +00:00
|
|
|
|
server statement in the configuration file for
|
2007-06-20 02:27:33 +00:00
|
|
|
|
<span><strong class="command">rndc</strong></span>. If no server is supplied on the
|
2005-07-19 06:12:24 +00:00
|
|
|
|
command line, the host named by the default-server clause
|
2007-06-20 02:27:33 +00:00
|
|
|
|
in the options statement of the <span><strong class="command">rndc</strong></span>
|
2013-03-14 01:04:33 +00:00
|
|
|
|
configuration file will be used.
|
2005-07-19 06:12:24 +00:00
|
|
|
|
</p></dd>
|
|
|
|
|
|
<dt><span class="term">-p <em class="replaceable"><code>port</code></em></span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Send commands to TCP port
|
|
|
|
|
|
<em class="replaceable"><code>port</code></em>
|
|
|
|
|
|
instead
|
|
|
|
|
|
of BIND 9's default control channel port, 953.
|
|
|
|
|
|
</p></dd>
|
2014-03-05 01:06:28 +00:00
|
|
|
|
<dt><span class="term">-q</span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Quiet mode: Message text returned by the server
|
|
|
|
|
|
will not be printed except when there is an error.
|
|
|
|
|
|
</p></dd>
|
2005-07-19 06:12:24 +00:00
|
|
|
|
<dt><span class="term">-V</span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Enable verbose logging.
|
|
|
|
|
|
</p></dd>
|
2007-05-31 23:28:55 +00:00
|
|
|
|
<dt><span class="term">-y <em class="replaceable"><code>key_id</code></em></span></dt>
|
2005-07-19 06:12:24 +00:00
|
|
|
|
<dd><p>
|
2007-05-31 23:28:55 +00:00
|
|
|
|
Use the key <em class="replaceable"><code>key_id</code></em>
|
2005-07-19 06:12:24 +00:00
|
|
|
|
from the configuration file.
|
2007-05-31 23:28:55 +00:00
|
|
|
|
<em class="replaceable"><code>key_id</code></em>
|
2005-07-19 06:12:24 +00:00
|
|
|
|
must be
|
|
|
|
|
|
known by named with the same algorithm and secret string
|
|
|
|
|
|
in order for control message validation to succeed.
|
2007-05-31 23:28:55 +00:00
|
|
|
|
If no <em class="replaceable"><code>key_id</code></em>
|
2005-07-19 06:12:24 +00:00
|
|
|
|
is specified, <span><strong class="command">rndc</strong></span> will first look
|
|
|
|
|
|
for a key clause in the server statement of the server
|
|
|
|
|
|
being used, or if no server statement is present for that
|
|
|
|
|
|
host, then the default-key clause of the options statement.
|
|
|
|
|
|
Note that the configuration file contains shared secrets
|
|
|
|
|
|
which are used to send authenticated control commands
|
|
|
|
|
|
to name servers. It should therefore not have general read
|
|
|
|
|
|
or write access.
|
|
|
|
|
|
</p></dd>
|
|
|
|
|
|
</dl></div>
|
2013-06-12 01:04:55 +00:00
|
|
|
|
</div>
|
|
|
|
|
|
<div class="refsect1" lang="en">
|
2014-03-11 01:05:19 +00:00
|
|
|
|
<a name="id2654720"></a><h2>COMMANDS</h2>
|
2005-07-19 06:12:24 +00:00
|
|
|
|
<p>
|
2013-06-12 01:04:55 +00:00
|
|
|
|
A list of commands supported by <span><strong class="command">rndc</strong></span> can
|
|
|
|
|
|
be seen by running <span><strong class="command">rndc</strong></span> without arguments.
|
2005-07-19 06:12:24 +00:00
|
|
|
|
</p>
|
2013-06-12 01:04:55 +00:00
|
|
|
|
<p>
|
|
|
|
|
|
Currently supported commands are:
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<div class="variablelist"><dl>
|
|
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>reload</code></strong></span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Reload configuration file and zones.
|
|
|
|
|
|
</p></dd>
|
|
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>reload <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Reload the given zone.
|
|
|
|
|
|
</p></dd>
|
|
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>refresh <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Schedule zone maintenance for the given zone.
|
|
|
|
|
|
</p></dd>
|
|
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>retransfer <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
|
2013-12-05 01:04:59 +00:00
|
|
|
|
<dd>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Retransfer the given slave zone from the master server.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
If the zone is configured to use
|
|
|
|
|
|
<span><strong class="command">inline-signing</strong></span>, the signed
|
|
|
|
|
|
version of the zone is discarded; after the
|
|
|
|
|
|
retransfer of the unsigned version is complete, the
|
|
|
|
|
|
signed version will be regenerated with all new
|
|
|
|
|
|
signatures.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</dd>
|
2013-06-12 01:04:55 +00:00
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>sign <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
|
|
|
|
|
|
<dd>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Fetch all DNSSEC keys for the given zone
|
|
|
|
|
|
from the key directory (see the
|
|
|
|
|
|
<span><strong class="command">key-directory</strong></span> option in
|
|
|
|
|
|
the BIND 9 Administrator Reference Manual). If they are within
|
|
|
|
|
|
their publication period, merge them into the
|
|
|
|
|
|
zone's DNSKEY RRset. If the DNSKEY RRset
|
|
|
|
|
|
is changed, then the zone is automatically
|
|
|
|
|
|
re-signed with the new key set.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
This command requires that the
|
|
|
|
|
|
<span><strong class="command">auto-dnssec</strong></span> zone option be set
|
|
|
|
|
|
to <code class="literal">allow</code> or
|
|
|
|
|
|
<code class="literal">maintain</code>,
|
|
|
|
|
|
and also requires the zone to be configured to
|
|
|
|
|
|
allow dynamic DNS.
|
|
|
|
|
|
(See "Dynamic Update Policies" in the Administrator
|
|
|
|
|
|
Reference Manual for more details.)
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</dd>
|
|
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>loadkeys <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
|
|
|
|
|
|
<dd>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Fetch all DNSSEC keys for the given zone
|
|
|
|
|
|
from the key directory. If they are within
|
|
|
|
|
|
their publication period, merge them into the
|
|
|
|
|
|
zone's DNSKEY RRset. Unlike <span><strong class="command">rndc
|
|
|
|
|
|
sign</strong></span>, however, the zone is not
|
|
|
|
|
|
immediately re-signed by the new keys, but is
|
|
|
|
|
|
allowed to incrementally re-sign over time.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
This command requires that the
|
|
|
|
|
|
<span><strong class="command">auto-dnssec</strong></span> zone option
|
|
|
|
|
|
be set to <code class="literal">maintain</code>,
|
|
|
|
|
|
and also requires the zone to be configured to
|
|
|
|
|
|
allow dynamic DNS.
|
|
|
|
|
|
(See "Dynamic Update Policies" in the Administrator
|
|
|
|
|
|
Reference Manual for more details.)
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</dd>
|
|
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>freeze [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Suspend updates to a dynamic zone. If no zone is
|
|
|
|
|
|
specified, then all zones are suspended. This allows
|
|
|
|
|
|
manual edits to be made to a zone normally updated by
|
|
|
|
|
|
dynamic update. It also causes changes in the
|
|
|
|
|
|
journal file to be synced into the master file.
|
|
|
|
|
|
All dynamic update attempts will be refused while
|
|
|
|
|
|
the zone is frozen.
|
|
|
|
|
|
</p></dd>
|
|
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>thaw [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Enable updates to a frozen dynamic zone. If no
|
|
|
|
|
|
zone is specified, then all frozen zones are
|
|
|
|
|
|
enabled. This causes the server to reload the zone
|
|
|
|
|
|
from disk, and re-enables dynamic updates after the
|
|
|
|
|
|
load has completed. After a zone is thawed,
|
|
|
|
|
|
dynamic updates will no longer be refused. If
|
|
|
|
|
|
the zone has changed and the
|
|
|
|
|
|
<span><strong class="command">ixfr-from-differences</strong></span> option is
|
|
|
|
|
|
in use, then the journal file will be updated to
|
|
|
|
|
|
reflect changes in the zone. Otherwise, if the
|
|
|
|
|
|
zone has changed, any existing journal file will be
|
|
|
|
|
|
removed.
|
|
|
|
|
|
</p></dd>
|
2014-02-08 01:05:40 +00:00
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>scan</code></strong></span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Scan the list of available network interfaces
|
|
|
|
|
|
for changes, without performing a full
|
|
|
|
|
|
<span><strong class="command">reconfig</strong></span> or waiting for the
|
|
|
|
|
|
<span><strong class="command">interface-interval</strong></span> timer.
|
|
|
|
|
|
</p></dd>
|
2013-06-12 01:04:55 +00:00
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>sync [<span class="optional">-clean</span>] [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Sync changes in the journal file for a dynamic zone
|
|
|
|
|
|
to the master file. If the "-clean" option is
|
|
|
|
|
|
specified, the journal file is also removed. If
|
|
|
|
|
|
no zone is specified, then all zones are synced.
|
|
|
|
|
|
</p></dd>
|
|
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>notify <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Resend NOTIFY messages for the zone.
|
|
|
|
|
|
</p></dd>
|
|
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>reconfig</code></strong></span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Reload the configuration file and load new zones,
|
|
|
|
|
|
but do not reload existing zone files even if they
|
|
|
|
|
|
have changed.
|
|
|
|
|
|
This is faster than a full <span><strong class="command">reload</strong></span> when there
|
|
|
|
|
|
is a large number of zones because it avoids the need
|
|
|
|
|
|
to examine the
|
|
|
|
|
|
modification times of the zones files.
|
|
|
|
|
|
</p></dd>
|
|
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>zonestatus [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Displays the current status of the given zone,
|
|
|
|
|
|
including the master file name and any include
|
|
|
|
|
|
files from which it was loaded, when it was most
|
|
|
|
|
|
recently loaded, the current serial number, the
|
|
|
|
|
|
number of nodes, whether the zone supports
|
|
|
|
|
|
dynamic updates, whether the zone is DNSSEC
|
|
|
|
|
|
signed, whether it uses automatic DNSSEC key
|
|
|
|
|
|
management or inline signing, and the scheduled
|
|
|
|
|
|
refresh or expiry times for the zone.
|
|
|
|
|
|
</p></dd>
|
|
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>stats</code></strong></span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Write server statistics to the statistics file.
|
|
|
|
|
|
</p></dd>
|
|
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>querylog</code></strong> [<span class="optional">on|off</span>] </span></dt>
|
|
|
|
|
|
<dd>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Enable or disable query logging. (For backward
|
|
|
|
|
|
compatibility, this command can also be used without
|
|
|
|
|
|
an argument to toggle query logging on and off.)
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Query logging can also be enabled
|
|
|
|
|
|
by explicitly directing the <span><strong class="command">queries</strong></span>
|
|
|
|
|
|
<span><strong class="command">category</strong></span> to a
|
|
|
|
|
|
<span><strong class="command">channel</strong></span> in the
|
|
|
|
|
|
<span><strong class="command">logging</strong></span> section of
|
|
|
|
|
|
<code class="filename">named.conf</code> or by specifying
|
|
|
|
|
|
<span><strong class="command">querylog yes;</strong></span> in the
|
|
|
|
|
|
<span><strong class="command">options</strong></span> section of
|
|
|
|
|
|
<code class="filename">named.conf</code>.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</dd>
|
|
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>dumpdb [<span class="optional">-all|-cache|-zone</span>] [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>]</code></strong></span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Dump the server's caches (default) and/or zones to
|
|
|
|
|
|
the
|
|
|
|
|
|
dump file for the specified views. If no view is
|
|
|
|
|
|
specified, all
|
|
|
|
|
|
views are dumped.
|
|
|
|
|
|
</p></dd>
|
|
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>secroots [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>]</code></strong></span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Dump the server's security roots to the secroots
|
|
|
|
|
|
file for the specified views. If no view is
|
|
|
|
|
|
specified, security roots for all
|
|
|
|
|
|
views are dumped.
|
|
|
|
|
|
</p></dd>
|
|
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>stop [<span class="optional">-p</span>]</code></strong></span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Stop the server, making sure any recent changes
|
|
|
|
|
|
made through dynamic update or IXFR are first saved to
|
|
|
|
|
|
the master files of the updated zones.
|
|
|
|
|
|
If <code class="option">-p</code> is specified <span><strong class="command">named</strong></span>'s process id is returned.
|
|
|
|
|
|
This allows an external process to determine when <span><strong class="command">named</strong></span>
|
|
|
|
|
|
had completed stopping.
|
|
|
|
|
|
</p></dd>
|
|
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>halt [<span class="optional">-p</span>]</code></strong></span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Stop the server immediately. Recent changes
|
|
|
|
|
|
made through dynamic update or IXFR are not saved to
|
|
|
|
|
|
the master files, but will be rolled forward from the
|
|
|
|
|
|
journal files when the server is restarted.
|
|
|
|
|
|
If <code class="option">-p</code> is specified <span><strong class="command">named</strong></span>'s process id is returned.
|
|
|
|
|
|
This allows an external process to determine when <span><strong class="command">named</strong></span>
|
|
|
|
|
|
had completed halting.
|
|
|
|
|
|
</p></dd>
|
|
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>trace</code></strong></span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Increment the servers debugging level by one.
|
|
|
|
|
|
</p></dd>
|
|
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>trace <em class="replaceable"><code>level</code></em></code></strong></span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Sets the server's debugging level to an explicit
|
|
|
|
|
|
value.
|
|
|
|
|
|
</p></dd>
|
|
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>notrace</code></strong></span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Sets the server's debugging level to 0.
|
|
|
|
|
|
</p></dd>
|
|
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>flush</code></strong></span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Flushes the server's cache.
|
|
|
|
|
|
</p></dd>
|
|
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>flushname</code></strong> <em class="replaceable"><code>name</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>] </span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Flushes the given name from the server's DNS cache
|
|
|
|
|
|
and, if applicable, from the server's nameserver address
|
|
|
|
|
|
database or bad-server cache.
|
|
|
|
|
|
</p></dd>
|
2013-06-27 01:04:50 +00:00
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>flushtree</code></strong> [<span class="optional">-all</span>] <em class="replaceable"><code>name</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>] </span></dt>
|
2013-06-12 01:04:55 +00:00
|
|
|
|
<dd><p>
|
|
|
|
|
|
Flushes the given name, and all of its subdomains,
|
2013-07-01 17:56:30 +00:00
|
|
|
|
from the server's DNS cache, the address database,
|
|
|
|
|
|
and the bad server cache.
|
2013-06-12 01:04:55 +00:00
|
|
|
|
</p></dd>
|
|
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>status</code></strong></span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Display status of the server.
|
|
|
|
|
|
Note that the number of zones includes the internal <span><strong class="command">bind/CH</strong></span> zone
|
|
|
|
|
|
and the default <span><strong class="command">./IN</strong></span>
|
|
|
|
|
|
hint zone if there is not an
|
|
|
|
|
|
explicit root zone configured.
|
|
|
|
|
|
</p></dd>
|
|
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>recursing</code></strong></span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Dump the list of queries <span><strong class="command">named</strong></span> is currently recursing
|
|
|
|
|
|
on.
|
|
|
|
|
|
</p></dd>
|
|
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>validation ( on | off | check ) [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>] </code></strong></span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Enable, disable, or check the current status of
|
|
|
|
|
|
DNSSEC validation.
|
|
|
|
|
|
Note <span><strong class="command">dnssec-enable</strong></span> also needs to be
|
|
|
|
|
|
set to <strong class="userinput"><code>yes</code></strong> or
|
|
|
|
|
|
<strong class="userinput"><code>auto</code></strong> to be effective.
|
|
|
|
|
|
It defaults to enabled.
|
|
|
|
|
|
</p></dd>
|
|
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>tsig-list</code></strong></span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
List the names of all TSIG keys currently configured
|
|
|
|
|
|
for use by <span><strong class="command">named</strong></span> in each view. The
|
|
|
|
|
|
list both statically configured keys and dynamic
|
|
|
|
|
|
TKEY-negotiated keys.
|
|
|
|
|
|
</p></dd>
|
|
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>tsig-delete</code></strong> <em class="replaceable"><code>keyname</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span></dt>
|
|
|
|
|
|
<dd><p>
|
|
|
|
|
|
Delete a given TKEY-negotiated key from the server.
|
|
|
|
|
|
(This does not apply to statically configured TSIG
|
|
|
|
|
|
keys.)
|
|
|
|
|
|
</p></dd>
|
|
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>addzone <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] <em class="replaceable"><code>configuration</code></em> </code></strong></span></dt>
|
|
|
|
|
|
<dd>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Add a zone while the server is running. This
|
|
|
|
|
|
command requires the
|
|
|
|
|
|
<span><strong class="command">allow-new-zones</strong></span> option to be set
|
|
|
|
|
|
to <strong class="userinput"><code>yes</code></strong>. The
|
|
|
|
|
|
<em class="replaceable"><code>configuration</code></em> string
|
|
|
|
|
|
specified on the command line is the zone
|
|
|
|
|
|
configuration text that would ordinarily be
|
|
|
|
|
|
placed in <code class="filename">named.conf</code>.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
The configuration is saved in a file called
|
|
|
|
|
|
<code class="filename"><em class="replaceable"><code>hash</code></em>.nzf</code>,
|
|
|
|
|
|
where <em class="replaceable"><code>hash</code></em> is a
|
|
|
|
|
|
cryptographic hash generated from the name of
|
|
|
|
|
|
the view. When <span><strong class="command">named</strong></span> is
|
|
|
|
|
|
restarted, the file will be loaded into the view
|
|
|
|
|
|
configuration, so that zones that were added
|
|
|
|
|
|
can persist after a restart.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
This sample <span><strong class="command">addzone</strong></span> command
|
|
|
|
|
|
would add the zone <code class="literal">example.com</code>
|
|
|
|
|
|
to the default view:
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
<code class="prompt">$ </code><strong class="userinput"><code>rndc addzone example.com '{ type master; file "example.com.db"; };'</code></strong>
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
(Note the brackets and semi-colon around the zone
|
|
|
|
|
|
configuration text.)
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</dd>
|
|
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>delzone [<span class="optional">-clean</span>] <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] </code></strong></span></dt>
|
|
|
|
|
|
<dd>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Delete a zone while the server is running.
|
|
|
|
|
|
Only zones that were originally added via
|
|
|
|
|
|
<span><strong class="command">rndc addzone</strong></span> can be deleted
|
|
|
|
|
|
in this manner.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
If the <code class="option">-clean</code> is specified,
|
|
|
|
|
|
the zone's master file (and journal file, if any)
|
|
|
|
|
|
will be deleted along with the zone. Without the
|
|
|
|
|
|
<code class="option">-clean</code> option, zone files must
|
|
|
|
|
|
be cleaned up by hand. (If the zone is of
|
|
|
|
|
|
type "slave" or "stub", the files needing to
|
|
|
|
|
|
be cleaned up will be reported in the output
|
|
|
|
|
|
of the <span><strong class="command">rndc delzone</strong></span> command.)
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</dd>
|
|
|
|
|
|
<dt><span class="term"><strong class="userinput"><code>signing [<span class="optional">( -list | -clear <em class="replaceable"><code>keyid/algorithm</code></em> | -clear <code class="literal">all</code> | -nsec3param ( <em class="replaceable"><code>parameters</code></em> | <code class="literal">none</code> ) ) </span>] <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] </code></strong></span></dt>
|
|
|
|
|
|
<dd>
|
|
|
|
|
|
<p>
|
2014-03-02 01:05:20 +00:00
|
|
|
|
List, edit, or remove the DNSSEC signing state records
|
|
|
|
|
|
for the specified zone. The status of ongoing DNSSEC
|
2013-06-12 01:04:55 +00:00
|
|
|
|
operations (such as signing or generating
|
|
|
|
|
|
NSEC3 chains) is stored in the zone in the form
|
|
|
|
|
|
of DNS resource records of type
|
|
|
|
|
|
<span><strong class="command">sig-signing-type</strong></span>.
|
|
|
|
|
|
<span><strong class="command">rndc signing -list</strong></span> converts
|
|
|
|
|
|
these records into a human-readable form,
|
|
|
|
|
|
indicating which keys are currently signing
|
|
|
|
|
|
or have finished signing the zone, and which NSEC3
|
|
|
|
|
|
chains are being created or removed.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
<span><strong class="command">rndc signing -clear</strong></span> can remove
|
|
|
|
|
|
a single key (specified in the same format that
|
|
|
|
|
|
<span><strong class="command">rndc signing -list</strong></span> uses to
|
|
|
|
|
|
display it), or all keys. In either case, only
|
|
|
|
|
|
completed keys are removed; any record indicating
|
|
|
|
|
|
that a key has not yet finished signing the zone
|
|
|
|
|
|
will be retained.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
<span><strong class="command">rndc signing -nsec3param</strong></span> sets
|
|
|
|
|
|
the NSEC3 parameters for a zone. This is the
|
|
|
|
|
|
only supported mechanism for using NSEC3 with
|
|
|
|
|
|
<span><strong class="command">inline-signing</strong></span> zones.
|
|
|
|
|
|
Parameters are specified in the same format as
|
|
|
|
|
|
an NSEC3PARAM resource record: hash algorithm,
|
|
|
|
|
|
flags, iterations, and salt, in that order.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Currently, the only defined value for hash algorithm
|
|
|
|
|
|
is <code class="literal">1</code>, representing SHA-1.
|
|
|
|
|
|
The <code class="option">flags</code> may be set to
|
|
|
|
|
|
<code class="literal">0</code> or <code class="literal">1</code>,
|
|
|
|
|
|
depending on whether you wish to set the opt-out
|
|
|
|
|
|
bit in the NSEC3 chain. <code class="option">iterations</code>
|
|
|
|
|
|
defines the number of additional times to apply
|
|
|
|
|
|
the algorithm when generating an NSEC3 hash. The
|
|
|
|
|
|
<code class="option">salt</code> is a string of data expressed
|
2013-11-13 01:04:50 +00:00
|
|
|
|
in hexadecimal, or a hyphen (`-') if no salt is
|
2013-06-12 01:04:55 +00:00
|
|
|
|
to be used.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
So, for example, to create an NSEC3 chain using
|
|
|
|
|
|
the SHA-1 hash algorithm, no opt-out flag,
|
|
|
|
|
|
10 iterations, and a salt value of "FFFF", use:
|
|
|
|
|
|
<span><strong class="command">rndc signing -nsec3param 1 0 10 FFFF <em class="replaceable"><code>zone</code></em></strong></span>.
|
|
|
|
|
|
To set the opt-out flag, 15 iterations, and no
|
|
|
|
|
|
salt, use:
|
|
|
|
|
|
<span><strong class="command">rndc signing -nsec3param 1 1 15 - <em class="replaceable"><code>zone</code></em></strong></span>.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
<span><strong class="command">rndc signing -nsec3param none</strong></span>
|
|
|
|
|
|
removes an existing NSEC3 chain and replaces it
|
|
|
|
|
|
with NSEC.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</dd>
|
|
|
|
|
|
</dl></div>
|
2005-07-19 06:12:24 +00:00
|
|
|
|
</div>
|
|
|
|
|
|
<div class="refsect1" lang="en">
|
2014-03-11 01:05:19 +00:00
|
|
|
|
<a name="id2686618"></a><h2>LIMITATIONS</h2>
|
2005-07-19 06:12:24 +00:00
|
|
|
|
<p>
|
|
|
|
|
|
There is currently no way to provide the shared secret for a
|
|
|
|
|
|
<code class="option">key_id</code> without using the configuration file.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Several error messages could be clearer.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
<div class="refsect1" lang="en">
|
2014-03-11 01:05:19 +00:00
|
|
|
|
<a name="id2686636"></a><h2>SEE ALSO</h2>
|
2005-07-19 06:12:24 +00:00
|
|
|
|
<p><span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
|
2007-12-14 22:37:22 +00:00
|
|
|
|
<span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>,
|
2005-07-19 06:12:24 +00:00
|
|
|
|
<span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
|
2007-05-09 03:33:51 +00:00
|
|
|
|
<span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>,
|
2005-07-19 06:12:24 +00:00
|
|
|
|
<span class="citerefentry"><span class="refentrytitle">ndc</span>(8)</span>,
|
|
|
|
|
|
<em class="citetitle">BIND 9 Administrator Reference Manual</em>.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
<div class="refsect1" lang="en">
|
2014-03-11 01:05:19 +00:00
|
|
|
|
<a name="id2686692"></a><h2>AUTHOR</h2>
|
2005-07-19 06:12:24 +00:00
|
|
|
|
<p><span class="corpauthor">Internet Systems Consortium</span>
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
<div class="navfooter">
|
|
|
|
|
|
<hr>
|
|
|
|
|
|
<table width="100%" summary="Navigation footer">
|
|
|
|
|
|
<tr>
|
|
|
|
|
|
<td width="40%" align="left">
|
2008-06-18 01:12:17 +00:00
|
|
|
|
<a accesskey="p" href="man.nsupdate.html">Prev</a><EFBFBD></td>
|
2005-07-19 06:12:24 +00:00
|
|
|
|
<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
|
|
|
|
|
|
<td width="40%" align="right"><EFBFBD><a accesskey="n" href="man.rndc.conf.html">Next</a>
|
|
|
|
|
|
</td>
|
|
|
|
|
|
</tr>
|
|
|
|
|
|
<tr>
|
2007-01-26 23:29:04 +00:00
|
|
|
|
<td width="40%" align="left" valign="top">
|
2008-06-18 01:12:17 +00:00
|
|
|
|
<span class="application">nsupdate</span><EFBFBD></td>
|
2005-07-19 06:12:24 +00:00
|
|
|
|
<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
|
2007-01-26 23:29:04 +00:00
|
|
|
|
<td width="40%" align="right" valign="top"><EFBFBD><code class="filename">rndc.conf</code>
|
|
|
|
|
|
</td>
|
2005-07-19 06:12:24 +00:00
|
|
|
|
</tr>
|
|
|
|
|
|
</table>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
</body>
|
|
|
|
|
|
</html>
|
