diff --git a/doc/arm/Bv9ARM.ch04.html b/doc/arm/Bv9ARM.ch04.html index d978d74b1b..82b343dc54 100644 --- a/doc/arm/Bv9ARM.ch04.html +++ b/doc/arm/Bv9ARM.ch04.html @@ -91,18 +91,18 @@
PKCS#11 (Cryptoki) support
-
Prerequisites
-
Native PKCS#11
-
OpenSSL-based PKCS#11
-
PKCS#11 Tools
-
Using the HSM
-
Specifying the engine on the command line
-
Running named with automatic zone re-signing
+
Prerequisites
+
Native PKCS#11
+
OpenSSL-based PKCS#11
+
PKCS#11 Tools
+
Using the HSM
+
Specifying the engine on the command line
+
Running named with automatic zone re-signing
DLZ (Dynamically Loadable Zones)
-
Configuring DLZ
-
Sample DLZ Driver
+
Configuring DLZ
+
Sample DLZ Driver
IPv6 Support in BIND 9
@@ -1431,8 +1431,9 @@ $ dnssec-signzone -S -K keys example.net< been tested with Debian Linux, Solaris x86 and Windows Server 2003; the Thales nShield, tested with Debian Linux; and the Sun SCA 6000 cryptographic acceleration board, tested with Solaris x86. In - addition, BIND can be used with SoftHSM, a software-based HSM - simulator produced by the OpenDNSSEC project. + addition, BIND can be used with all current versions of SoftHSM, + a software-based HSM simulator library produced by the OpenDNSSEC + project.

PKCS#11 makes use of a "provider library": a dynamically loadable @@ -1452,7 +1453,7 @@ $ dnssec-signzone -S -K keys example.net<

-Prerequisites

+Prerequisites

See the documentation provided by your HSM vendor for information about installing, initializing, testing and @@ -1461,18 +1462,18 @@ $ dnssec-signzone -S -K keys example.net<

-Native PKCS#11

+Native PKCS#11

Native PKCS#11 mode will only work with an HSM capable of carrying out every cryptographic operation BIND 9 may need. The HSM's provider library must have a complete implementation of the PKCS#11 API, so that all these functions are accessible. As of - this writing, only the Thales nShield HSM and the latest development - version of SoftHSM can be used in this fashion. For other HSMs, - including the AEP Keyper, Sun SCA 6000 and older versions of SoftHSM, - use OpenSSL-based PKCS#11. (Note: As more HSMs become capable of - supporting native PKCS#11, it is expected that OpenSSL-based - PKCS#11 will eventually be deprecated.) + this writing, only the Thales nShield HSM and SoftHSMv2 can be used + in this fashion. For other HSMs, including the AEP Keyper, Sun SCA + 6000 and older versions of SoftHSM, use OpenSSL-based PKCS#11. + (Note: Eventually, when more HSMs become capable of supporting + native PKCS#11, it is expected that OpenSSL-based PKCS#11 will + be deprecated.)

To build BIND with native PKCS#11, configure as follows: @@ -1492,10 +1493,47 @@ $ ./configure --enable-native-pkcs11 \ dnssec-* tools, or the -m in the pkcs11-* tools.)

+
+

+Building SoftHSMv2

+

+ SoftHSMv2, the latest development version of SoftHSM, is available + from + + https://github.com/opendnssec/SoftHSMv2 + . + It is a software library developed by the OpenDNSSEC project + ( + http://www.opendnssec.org + ) + which provides a PKCS#11 interface to a virtual HSM, implemented in + the form of a SQLite3 database on the local filesystem. It provides + less security than a true HSM, but it allows you to experiment with + native PKCS#11 when an HSM is not available. SoftHSMv2 can be + configured to use either OpenSSL or the Botan library to perform + cryptographic functions, but when using it for native PKCS#11 in + BIND, OpenSSL is required. +

+

+ By default, the SoftHSMv2 configuration file is + prefix/etc/softhsm2.conf (where + prefix is configured at compile time). + This location can be overridden by the SOFTHSM2_CONF environment + variable. The SoftHSMv2 cryptographic store must be installed and + initialized before using it with BIND. +

+
+$  cd SoftHSMv2 
+$  configure --with-crypto-backend=openssl --prefix=/opt/pkcs11/usr --enable-gost 
+$  make 
+$  make install 
+$  /opt/pkcs11/usr/bin/softhsm-util --init-token 0 --slot 0 --label softhsmv2 
+
+

-OpenSSL-based PKCS#11

+OpenSSL-based PKCS#11

OpenSSL-based PKCS#11 mode uses a modified version of the OpenSSL library; stock OpenSSL does not fully support PKCS#11. @@ -1512,23 +1550,23 @@ $ ./configure --enable-native-pkcs11 \

  • - Use 'crypto-accelerator' with HSMs that have hardware - cryptographic acceleration features, such as the SCA 6000 - board. This causes OpenSSL to run all supported - cryptographic operations in the HSM. -

    • + Use 'crypto-accelerator' with HSMs that have hardware + cryptographic acceleration features, such as the SCA 6000 + board. This causes OpenSSL to run all supported + cryptographic operations in the HSM. +

  • - Use 'sign-only' with HSMs that are designed to - function primarily as secure key storage devices, but lack - hardware acceleration. These devices are highly secure, but - are not necessarily any faster at cryptography than the - system CPU — often, they are slower. It is therefore - most efficient to use them only for those cryptographic - functions that require access to the secured private key, - such as zone signing, and to use the system CPU for all - other computationally-intensive operations. The AEP Keyper - is an example of such a device. -

    • + Use 'sign-only' with HSMs that are designed to + function primarily as secure key storage devices, but lack + hardware acceleration. These devices are highly secure, but + are not necessarily any faster at cryptography than the + system CPU — often, they are slower. It is therefore + most efficient to use them only for those cryptographic + functions that require access to the secured private key, + such as zone signing, and to use the system CPU for all + other computationally-intensive operations. The AEP Keyper + is an example of such a device. +

The modified OpenSSL code is included in the BIND 9 release, @@ -1540,8 +1578,8 @@ $ ./configure --enable-native-pkcs11 \

Note

- The latest OpenSSL versions as of this writing (January 2014) - are 0.9.8y, 1.0.0l, and 1.0.1f. + The latest OpenSSL versions as of this writing (January 2015) + are 0.9.8zc, 1.0.0o, and 1.0.1j. ISC will provide updated patches as new versions of OpenSSL are released. The version number in the following examples is expected to change. @@ -1553,130 +1591,132 @@ $ ./configure --enable-native-pkcs11 \

-Patching OpenSSL

+Patching OpenSSL
-$ wget http://www.openssl.org/source/openssl-0.9.8y.tar.gz
+$ wget http://www.openssl.org/source/openssl-0.9.8zc.tar.gz

Extract the tarball:

-$ tar zxf openssl-0.9.8y.tar.gz
+$ tar zxf openssl-0.9.8zc.tar.gz

Apply the patch from the BIND 9 release:

-$ patch -p1 -d openssl-0.9.8y \
-              < bind9/bin/pkcs11/openssl-0.9.8y-patch
+$ patch -p1 -d openssl-0.9.8zc \
+	      < bind9/bin/pkcs11/openssl-0.9.8zc-patch

Note

- Note that the patch file may not be compatible with the - "patch" utility on all operating systems. You may need to - install GNU patch. + Note that the patch file may not be compatible with the + "patch" utility on all operating systems. You may need to + install GNU patch.

- When building OpenSSL, place it in a non-standard - location so that it does not interfere with OpenSSL libraries - elsewhere on the system. In the following examples, we choose - to install into "/opt/pkcs11/usr". We will use this location - when we configure BIND 9. + When building OpenSSL, place it in a non-standard + location so that it does not interfere with OpenSSL libraries + elsewhere on the system. In the following examples, we choose + to install into "/opt/pkcs11/usr". We will use this location + when we configure BIND 9.

- Later, when building BIND 9, the location of the custom-built - OpenSSL library will need to be specified via configure. + Later, when building BIND 9, the location of the custom-built + OpenSSL library will need to be specified via configure.

-Building OpenSSL for the AEP Keyper on Linux

+Building OpenSSL for the AEP Keyper on Linux

- The AEP Keyper is a highly secure key storage device, - but does not provide hardware cryptographic acceleration. It - can carry out cryptographic operations, but it is probably - slower than your system's CPU. Therefore, we choose the - 'sign-only' flavor when building OpenSSL. + The AEP Keyper is a highly secure key storage device, + but does not provide hardware cryptographic acceleration. It + can carry out cryptographic operations, but it is probably + slower than your system's CPU. Therefore, we choose the + 'sign-only' flavor when building OpenSSL.

- The Keyper-specific PKCS#11 provider library is - delivered with the Keyper software. In this example, we place - it /opt/pkcs11/usr/lib: + The Keyper-specific PKCS#11 provider library is + delivered with the Keyper software. In this example, we place + it /opt/pkcs11/usr/lib: 

 $ cp pkcs11.GCC4.0.2.so.4.05 /opt/pkcs11/usr/lib/libpkcs11.so

- This library is only available for Linux as a 32-bit - binary. If we are compiling on a 64-bit Linux system, it is - necessary to force a 32-bit build, by specifying -m32 in the - build options. + This library is only available for Linux as a 32-bit + binary. If we are compiling on a 64-bit Linux system, it is + necessary to force a 32-bit build, by specifying -m32 in the + build options.

- Finally, the Keyper library requires threads, so we - must specify -pthread. + Finally, the Keyper library requires threads, so we + must specify -pthread. 

-$ cd openssl-0.9.8y
+$ cd openssl-0.9.8zc
 $ ./Configure linux-generic32 -m32 -pthread \
-            --pk11-libname=/opt/pkcs11/usr/lib/libpkcs11.so \
-            --pk11-flavor=sign-only \
-            --prefix=/opt/pkcs11/usr
+	    --pk11-libname=/opt/pkcs11/usr/lib/libpkcs11.so \
+	    --pk11-flavor=sign-only \
+	    --prefix=/opt/pkcs11/usr

- After configuring, run "make" - and "make test". If "make - test" fails with "pthread_atfork() not found", you forgot to - add the -pthread above. + After configuring, run "make" + and "make test". If "make + test" fails with "pthread_atfork() not found", you forgot to + add the -pthread above.

-Building OpenSSL for the SCA 6000 on Solaris

+Building OpenSSL for the SCA 6000 on Solaris

- The SCA-6000 PKCS#11 provider is installed as a system - library, libpkcs11. It is a true crypto accelerator, up to 4 - times faster than any CPU, so the flavor shall be - 'crypto-accelerator'. + The SCA-6000 PKCS#11 provider is installed as a system + library, libpkcs11. It is a true crypto accelerator, up to 4 + times faster than any CPU, so the flavor shall be + 'crypto-accelerator'.

- In this example, we are building on Solaris x86 on an - AMD64 system. + In this example, we are building on Solaris x86 on an + AMD64 system. 

-$ cd openssl-0.9.8y
+$ cd openssl-0.9.8zc
 $ ./Configure solaris64-x86_64-cc \
-            --pk11-libname=/usr/lib/64/libpkcs11.so \
-            --pk11-flavor=crypto-accelerator \
-            --prefix=/opt/pkcs11/usr
+	    --pk11-libname=/usr/lib/64/libpkcs11.so \
+	    --pk11-flavor=crypto-accelerator \
+	    --prefix=/opt/pkcs11/usr

- (For a 32-bit build, use "solaris-x86-cc" and /usr/lib/libpkcs11.so.) + (For a 32-bit build, use "solaris-x86-cc" and /usr/lib/libpkcs11.so.)

- After configuring, run - make and - make test. + After configuring, run + make and + make test.

-Building OpenSSL for SoftHSM

+Building OpenSSL for SoftHSM

- SoftHSM is a software library provided by the OpenDNSSEC - project (http://www.opendnssec.org) which provides a PKCS#11 - interface to a virtual HSM, implemented in the form of encrypted - data on the local filesystem. SoftHSM can be configured to use - either OpenSSL or the Botan library for encryption, and SQLite3 - for data storage. Though less secure than a true HSM, it can - provide more secure key storage than traditional key files, - and can allow you to experiment with PKCS#11 when an HSM is - not available. + SoftHSM (version 1) is a software library developed by the + OpenDNSSEC project + ( + http://www.opendnssec.org + ) + which provides a + PKCS#11 interface to a virtual HSM, implemented in the form of + a SQLite3 database on the local filesystem. SoftHSM uses + the Botan library to perform cryptographic functions. Though + less secure than a true HSM, it can allow you to experiment + with PKCS#11 when an HSM is not available.

- The SoftHSM cryptographic store must be installed and - initialized before using it with OpenSSL, and the SOFTHSM_CONF - environment variable must always point to the SoftHSM configuration - file: + The SoftHSM cryptographic store must be installed and + initialized before using it with OpenSSL, and the SOFTHSM_CONF + environment variable must always point to the SoftHSM configuration + file: 

-$  cd softhsm-1.3.0 
+$  cd softhsm-1.3.7 
 $  configure --prefix=/opt/pkcs11/usr 
 $  make 
 $  make install 
@@ -1685,21 +1725,21 @@ $  echo "0:/opt/pkcs11/softhsm.db" > $SOFTHSM
 $  /opt/pkcs11/usr/bin/softhsm --init-token 0 --slot 0 --label softhsm

- SoftHSM can perform all cryptographic operations, but - since it only uses your system CPU, there is no advantage to using - it for anything but signing. Therefore, we choose the 'sign-only' - flavor when building OpenSSL. + SoftHSM can perform all cryptographic operations, but + since it only uses your system CPU, there is no advantage to using + it for anything but signing. Therefore, we choose the 'sign-only' + flavor when building OpenSSL. 

-$ cd openssl-0.9.8y
+$ cd openssl-0.9.8zc
 $ ./Configure linux-x86_64 -pthread \
-            --pk11-libname=/opt/pkcs11/usr/lib/libsofthsm.so \
-            --pk11-flavor=sign-only \
-            --prefix=/opt/pkcs11/usr
+	    --pk11-libname=/opt/pkcs11/usr/lib/libsofthsm.so \
+	    --pk11-flavor=sign-only \
+	    --prefix=/opt/pkcs11/usr

- After configuring, run "make" - and "make test". + After configuring, run "make" + and "make test".

@@ -1710,11 +1750,11 @@ $ ./Configure linux-x86_64 -pthread \ selected: 

-        (pkcs11) PKCS #11 engine support (sign only)
+	(pkcs11) PKCS #11 engine support (sign only)

Or:

-        (pkcs11) PKCS #11 engine support (crypto accelerator)
+	(pkcs11) PKCS #11 engine support (crypto accelerator)

Next, run @@ -1730,54 +1770,54 @@ $ ./Configure linux-x86_64 -pthread \

-Configuring BIND 9 for Linux with the AEP Keyper

+Configuring BIND 9 for Linux with the AEP Keyper

- To link with the PKCS#11 provider, threads must be - enabled in the BIND 9 build. + To link with the PKCS#11 provider, threads must be + enabled in the BIND 9 build.

- The PKCS#11 library for the AEP Keyper is currently - only available as a 32-bit binary. If we are building on a - 64-bit host, we must force a 32-bit build by adding "-m32" to - the CC options on the "configure" command line. + The PKCS#11 library for the AEP Keyper is currently + only available as a 32-bit binary. If we are building on a + 64-bit host, we must force a 32-bit build by adding "-m32" to + the CC options on the "configure" command line. 

 $ cd ../bind9
 $ ./configure CC="gcc -m32" --enable-threads \
-           --with-openssl=/opt/pkcs11/usr \
-           --with-pkcs11=/opt/pkcs11/usr/lib/libpkcs11.so
+	   --with-openssl=/opt/pkcs11/usr \
+	   --with-pkcs11=/opt/pkcs11/usr/lib/libpkcs11.so

-Configuring BIND 9 for Solaris with the SCA 6000

+Configuring BIND 9 for Solaris with the SCA 6000

- To link with the PKCS#11 provider, threads must be - enabled in the BIND 9 build. + To link with the PKCS#11 provider, threads must be + enabled in the BIND 9 build. 

 $ cd ../bind9
 $ ./configure CC="cc -xarch=amd64" --enable-threads \
-            --with-openssl=/opt/pkcs11/usr \
-            --with-pkcs11=/usr/lib/64/libpkcs11.so
+	    --with-openssl=/opt/pkcs11/usr \
+	    --with-pkcs11=/usr/lib/64/libpkcs11.so

(For a 32-bit build, omit CC="cc -xarch=amd64".)

- If configure complains about OpenSSL not working, you - may have a 32/64-bit architecture mismatch. Or, you may have - incorrectly specified the path to OpenSSL (it should be the - same as the --prefix argument to the OpenSSL - Configure). + If configure complains about OpenSSL not working, you + may have a 32/64-bit architecture mismatch. Or, you may have + incorrectly specified the path to OpenSSL (it should be the + same as the --prefix argument to the OpenSSL + Configure).

-Configuring BIND 9 for SoftHSM

+Configuring BIND 9 for SoftHSM
 $ cd ../bind9
 $ ./configure --enable-threads \
-           --with-openssl=/opt/pkcs11/usr \
-           --with-pkcs11=/opt/pkcs11/usr/lib/libsofthsm.so
+	   --with-openssl=/opt/pkcs11/usr \
+	   --with-pkcs11=/opt/pkcs11/usr/lib/libsofthsm.so

@@ -1793,7 +1833,7 @@ $ ./configure --enable-threads \

-PKCS#11 Tools

+PKCS#11 Tools

BIND 9 includes a minimal set of tools to operate the HSM, including @@ -1816,7 +1856,7 @@ $ ./configure --enable-threads \

-Using the HSM

+Using the HSM

For OpenSSL-based PKCS#11, we must first set up the runtime environment so the OpenSSL and PKCS#11 libraries can be loaded: @@ -1937,7 +1977,7 @@ example.net.signed

-Specifying the engine on the command line

+Specifying the engine on the command line

When using OpenSSL-based PKCS#11, the "engine" to be used by OpenSSL can be specified in named and all of @@ -1969,7 +2009,7 @@ $ dnssec-signzone -E '' -S example.net

-Running named with automatic zone re-signing

+Running named with automatic zone re-signing

If you want named to dynamically re-sign zones using HSM keys, and/or to to sign new records inserted via nsupdate, @@ -1985,13 +2025,13 @@ $ dnssec-signzone -E '' -S example.net

Sample openssl.cnf:

-        openssl_conf = openssl_def
-        [ openssl_def ]
-        engines = engine_section
-        [ engine_section ]
-        pkcs11 = pkcs11_section
-        [ pkcs11_section ]
-        PIN = <PLACE PIN HERE>
+	openssl_conf = openssl_def
+	[ openssl_def ]
+	engines = engine_section
+	[ engine_section ]
+	pkcs11 = pkcs11_section
+	[ pkcs11_section ]
+	PIN = <PLACE PIN HERE>

This will also allow the dnssec-* tools to access the HSM @@ -2002,16 +2042,16 @@ $ dnssec-signzone -E '' -S example.net In native PKCS#11 mode, the PIN can be provided in a file specified as an attribute of the key's label. For example, if a key had the label - pkcs11:object=local-zsk;pin-source=/etc/hsmpin", + pkcs11:object=local-zsk;pin-source=/etc/hsmpin, then the PIN would be read from the file /etc/hsmpin.

Warning

- Placing the HSM's PIN in a text file in this manner may reduce the - security advantage of using an HSM. Be sure this is what you want to - do before configuring the system in this way. + Placing the HSM's PIN in a text file in this manner may reduce the + security advantage of using an HSM. Be sure this is what you want to + do before configuring the system in this way.

@@ -2056,7 +2096,7 @@ $ dnssec-signzone -E '' -S example.net

-Configuring DLZ

+Configuring DLZ

A DLZ database is configured with a dlz statement in named.conf: @@ -2105,7 +2145,7 @@ $ dnssec-signzone -E '' -S example.net

-Sample DLZ Driver

+Sample DLZ Driver

For guidance in implementation of DLZ modules, the directory contrib/dlz/example contains a basic diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html index 4cdb0687de..f074b4e80b 100644 --- a/doc/arm/Bv9ARM.ch09.html +++ b/doc/arm/Bv9ARM.ch09.html @@ -420,6 +420,10 @@ initial packet sizes used in BIND 9.10 and higher when contacting authoritative servers for the first time.

+

  • + Built-in "empty" zones did not correctly inherit the + "allow-transfer" ACL from the options or view. [RT #38310] +

    • diff --git a/doc/arm/Bv9ARM.html b/doc/arm/Bv9ARM.html index c2bd8ba066..cce11a244f 100644 --- a/doc/arm/Bv9ARM.html +++ b/doc/arm/Bv9ARM.html @@ -135,18 +135,18 @@
    PKCS#11 (Cryptoki) support
    -
    Prerequisites
    -
    Native PKCS#11
    -
    OpenSSL-based PKCS#11
    -
    PKCS#11 Tools
    -
    Using the HSM
    -
    Specifying the engine on the command line
    -
    Running named with automatic zone re-signing
    +
    Prerequisites
    +
    Native PKCS#11
    +
    OpenSSL-based PKCS#11
    +
    PKCS#11 Tools
    +
    Using the HSM
    +
    Specifying the engine on the command line
    +
    Running named with automatic zone re-signing
    DLZ (Dynamically Loadable Zones)
    -
    Configuring DLZ
    -
    Sample DLZ Driver
    +
    Configuring DLZ
    +
    Sample DLZ Driver
    IPv6 Support in BIND 9
    @@ -268,13 +268,13 @@
    BIND 9 DNS Library Support
    -
    Prerequisite
    -
    Compilation
    -
    Installation
    -
    Known Defects/Restrictions
    -
    The dns.conf File
    -
    Sample Applications
    -
    Library References
    +
    Prerequisite
    +
    Compilation
    +
    Installation
    +
    Known Defects/Restrictions
    +
    The dns.conf File
    +
    Sample Applications
    +
    Library References
    I. Manual pages
    diff --git a/doc/arm/man.arpaname.html b/doc/arm/man.arpaname.html index 14259e5671..12a654a1d8 100644 --- a/doc/arm/man.arpaname.html +++ b/doc/arm/man.arpaname.html @@ -50,20 +50,20 @@

    arpaname {ipaddress ...}

    -

    DESCRIPTION

    +

    DESCRIPTION

    arpaname translates IP addresses (IPv4 and IPv6) to the corresponding IN-ADDR.ARPA or IP6.ARPA names.

    -

    SEE ALSO

    +

    SEE ALSO

    BIND 9 Administrator Reference Manual.

    -

    AUTHOR

    +

    AUTHOR

    Internet Systems Consortium

    diff --git a/doc/arm/man.ddns-confgen.html b/doc/arm/man.ddns-confgen.html index 7708ba157e..034d54c116 100644 --- a/doc/arm/man.ddns-confgen.html +++ b/doc/arm/man.ddns-confgen.html @@ -51,7 +51,7 @@

    ddns-confgen [-a algorithm] [-h] [-k keyname] [-q] [-r randomfile] [ -s name | -z zone ]

    -

    DESCRIPTION

    +

    DESCRIPTION

    tsig-keygen and ddns-confgen are invocation methods for a utility that generates keys for use @@ -87,7 +87,7 @@

    -

    OPTIONS

    +

    OPTIONS

    -a algorithm

    @@ -159,7 +159,7 @@

    -

    SEE ALSO

    +

    SEE ALSO

    nsupdate(1), named.conf(5), named(8), @@ -167,7 +167,7 @@

    -

    AUTHOR

    +

    AUTHOR

    Internet Systems Consortium

    diff --git a/doc/arm/man.delv.html b/doc/arm/man.delv.html index 58f5d4957c..7942d370c4 100644 --- a/doc/arm/man.delv.html +++ b/doc/arm/man.delv.html @@ -53,7 +53,7 @@

    delv [queryopt...] [query...]

    -

    DESCRIPTION

    +

    DESCRIPTION

    delv (Domain Entity Lookup & Validation) is a tool for sending DNS queries and validating the results, using the the same internal @@ -96,7 +96,7 @@

    -

    SIMPLE USAGE

    +

    SIMPLE USAGE

    A typical invocation of delv looks like:

    @@ -151,7 +151,7 @@

    -

    OPTIONS

    +

    OPTIONS

    -a anchor-file
    @@ -285,7 +285,7 @@
    -

    QUERY OPTIONS

    +

    QUERY OPTIONS

    delv provides a number of query options which affect the way results are displayed, and in some cases the way lookups are performed. @@ -471,12 +471,12 @@

    -

    FILES

    +

    FILES

    /etc/bind.keys

    /etc/resolv.conf

    -

    SEE ALSO

    +

    SEE ALSO

    dig(1), named(8), RFC4034, diff --git a/doc/arm/man.dig.html b/doc/arm/man.dig.html index b15ddd6b75..8c32b57a05 100644 --- a/doc/arm/man.dig.html +++ b/doc/arm/man.dig.html @@ -52,7 +52,7 @@

    dig [global-queryopt...] [query...]

    -

    DESCRIPTION

    +

    DESCRIPTION

    dig (domain information groper) is a flexible tool for interrogating DNS name servers. It performs DNS lookups and @@ -99,7 +99,7 @@

    -

    SIMPLE USAGE

    +

    SIMPLE USAGE

    A typical invocation of dig looks like:

    @@ -152,7 +152,7 @@

    -

    OPTIONS

    +

    OPTIONS

    The -b option sets the source IP address of the query to address. This must be a valid @@ -260,7 +260,7 @@

    -

    QUERY OPTIONS

    +

    QUERY OPTIONS

    dig provides a number of query options which affect the way in which lookups are made and the results displayed. Some of @@ -688,7 +688,7 @@

    -

    MULTIPLE QUERIES

    +

    MULTIPLE QUERIES

    The BIND 9 implementation of dig supports @@ -734,7 +734,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr

    -

    IDN SUPPORT

    +

    IDN SUPPORT

    If dig has been built with IDN (internationalized domain name) support, it can accept and display non-ASCII domain names. @@ -748,14 +748,14 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr

    -

    FILES

    +

    FILES

    /etc/resolv.conf

    ${HOME}/.digrc

    -

    SEE ALSO

    +

    SEE ALSO

    host(1), named(8), dnssec-keygen(8), @@ -763,7 +763,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr

    -

    BUGS

    +

    BUGS

    There are probably too many query options.

    diff --git a/doc/arm/man.dnssec-checkds.html b/doc/arm/man.dnssec-checkds.html index 4778c778a8..dc9aa3a070 100644 --- a/doc/arm/man.dnssec-checkds.html +++ b/doc/arm/man.dnssec-checkds.html @@ -51,7 +51,7 @@

    dnssec-dsfromkey [-l domain] [-f file] [-d dig path] [-D dsfromkey path] {zone}

    -

    DESCRIPTION

    +

    DESCRIPTION

    dnssec-checkds verifies the correctness of Delegation Signer (DS) or DNSSEC Lookaside Validation (DLV) resource records for keys in a specified @@ -59,7 +59,7 @@

    -

    OPTIONS

    +

    OPTIONS

    -f file

    @@ -88,14 +88,14 @@

    -

    SEE ALSO

    +

    SEE ALSO

    dnssec-dsfromkey(8), dnssec-keygen(8), dnssec-signzone(8),

    -

    AUTHOR

    +

    AUTHOR

    Internet Systems Consortium

    diff --git a/doc/arm/man.dnssec-coverage.html b/doc/arm/man.dnssec-coverage.html index d7434373b6..51f856c7e9 100644 --- a/doc/arm/man.dnssec-coverage.html +++ b/doc/arm/man.dnssec-coverage.html @@ -50,7 +50,7 @@

    dnssec-coverage [-K directory] [-l length] [-f file] [-d DNSKEY TTL] [-m max TTL] [-r interval] [-c compilezone path] [-k] [-z] [zone]

    -

    DESCRIPTION

    +

    DESCRIPTION

    dnssec-coverage verifies that the DNSSEC keys for a given zone or a set of zones have timing metadata set properly to ensure no future lapses in DNSSEC @@ -78,7 +78,7 @@

    -

    OPTIONS

    +

    OPTIONS

    -K directory

    @@ -192,7 +192,7 @@

    -

    SEE ALSO

    +

    SEE ALSO

    dnssec-checkds(8), dnssec-dsfromkey(8), @@ -201,7 +201,7 @@

    -

    AUTHOR

    +

    AUTHOR

    Internet Systems Consortium

    diff --git a/doc/arm/man.dnssec-dsfromkey.html b/doc/arm/man.dnssec-dsfromkey.html index 8f317dc641..57b50c53c9 100644 --- a/doc/arm/man.dnssec-dsfromkey.html +++ b/doc/arm/man.dnssec-dsfromkey.html @@ -52,14 +52,14 @@

    dnssec-dsfromkey [-h] [-V]

    -

    DESCRIPTION

    +

    DESCRIPTION

    dnssec-dsfromkey outputs the Delegation Signer (DS) resource record (RR), as defined in RFC 3658 and RFC 4509, for the given key(s).

    -

    OPTIONS

    +

    OPTIONS

    -1

    @@ -144,7 +144,7 @@

    -

    EXAMPLE

    +

    EXAMPLE

    To build the SHA-256 DS RR from the Kexample.com.+003+26160 @@ -159,7 +159,7 @@

    -

    FILES

    +

    FILES

    The keyfile can be designed by the key identification Knnnn.+aaa+iiiii or the full file name @@ -173,13 +173,13 @@

    -

    CAVEAT

    +

    CAVEAT

    A keyfile error can give a "file not found" even if the file exists.

    -

    SEE ALSO

    +

    SEE ALSO

    dnssec-keygen(8), dnssec-signzone(8), BIND 9 Administrator Reference Manual, @@ -189,7 +189,7 @@

    -

    AUTHOR

    +

    AUTHOR

    Internet Systems Consortium

    diff --git a/doc/arm/man.dnssec-importkey.html b/doc/arm/man.dnssec-importkey.html index 3c6b6b1115..7b7ffdb52d 100644 --- a/doc/arm/man.dnssec-importkey.html +++ b/doc/arm/man.dnssec-importkey.html @@ -51,7 +51,7 @@

    dnssec-importkey {-f filename} [-K directory] [-L ttl] [-P date/offset] [-D date/offset] [-h] [-v level] [-V] [dnsname]

    -

    DESCRIPTION

    +

    DESCRIPTION

    dnssec-importkey reads a public DNSKEY record and generates a pair of .key/.private files. The DNSKEY record may be read from an @@ -71,7 +71,7 @@

    -

    OPTIONS

    +

    OPTIONS

    -f filename
    @@ -114,7 +114,7 @@
    -

    TIMING OPTIONS

    +

    TIMING OPTIONS

    Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '-', it is interpreted as @@ -142,7 +142,7 @@

    -

    FILES

    +

    FILES

    A keyfile can be designed by the key identification Knnnn.+aaa+iiiii or the full file name @@ -151,7 +151,7 @@

    -

    SEE ALSO

    +

    SEE ALSO

    dnssec-keygen(8), dnssec-signzone(8), BIND 9 Administrator Reference Manual, @@ -159,7 +159,7 @@

    -

    AUTHOR

    +

    AUTHOR

    Internet Systems Consortium

    diff --git a/doc/arm/man.dnssec-keyfromlabel.html b/doc/arm/man.dnssec-keyfromlabel.html index b4d606d4fa..c6272c0686 100644 --- a/doc/arm/man.dnssec-keyfromlabel.html +++ b/doc/arm/man.dnssec-keyfromlabel.html @@ -50,7 +50,7 @@

    dnssec-keyfromlabel {-l label} [-3] [-a algorithm] [-A date/offset] [-c class] [-D date/offset] [-E engine] [-f flag] [-G] [-I date/offset] [-i interval] [-k] [-K directory] [-L ttl] [-n nametype] [-P date/offset] [-p protocol] [-R date/offset] [-S key] [-t type] [-v level] [-V] [-y] {name}

    -

    DESCRIPTION

    +

    DESCRIPTION

    dnssec-keyfromlabel generates a key pair of files that referencing a key object stored in a cryptographic hardware service module (HSM). The private key @@ -66,7 +66,7 @@

    -

    OPTIONS

    +

    OPTIONS

    -a algorithm
    @@ -243,7 +243,7 @@
    -

    TIMING OPTIONS

    +

    TIMING OPTIONS

    Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '-', it is interpreted as @@ -315,7 +315,7 @@

    -

    GENERATED KEY FILES

    +

    GENERATED KEY FILES

    When dnssec-keyfromlabel completes successfully, @@ -354,7 +354,7 @@

    -

    SEE ALSO

    +

    SEE ALSO

    dnssec-keygen(8), dnssec-signzone(8), BIND 9 Administrator Reference Manual, @@ -363,7 +363,7 @@

    -

    AUTHOR

    +

    AUTHOR

    Internet Systems Consortium

    diff --git a/doc/arm/man.dnssec-keygen.html b/doc/arm/man.dnssec-keygen.html index 6b4bcf1d74..330a4448e0 100644 --- a/doc/arm/man.dnssec-keygen.html +++ b/doc/arm/man.dnssec-keygen.html @@ -50,7 +50,7 @@

    dnssec-keygen [-a algorithm] [-b keysize] [-n nametype] [-3] [-A date/offset] [-C] [-c class] [-D date/offset] [-E engine] [-f flag] [-G] [-g generator] [-h] [-I date/offset] [-i interval] [-K directory] [-L ttl] [-k] [-P date/offset] [-p protocol] [-q] [-R date/offset] [-r randomdev] [-S key] [-s strength] [-t type] [-v level] [-V] [-z] {name}

    -

    DESCRIPTION

    +

    DESCRIPTION

    dnssec-keygen generates keys for DNSSEC (Secure DNS), as defined in RFC 2535 and RFC 4034. It can also generate keys for use with @@ -64,7 +64,7 @@

    -

    OPTIONS

    +

    OPTIONS

    -a algorithm
    @@ -285,7 +285,7 @@
    -

    TIMING OPTIONS

    +

    TIMING OPTIONS

    Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '-', it is interpreted as @@ -359,7 +359,7 @@

    -

    GENERATED KEYS

    +

    GENERATED KEYS

    When dnssec-keygen completes successfully, @@ -405,7 +405,7 @@

    -

    EXAMPLE

    +

    EXAMPLE

    To generate a 768-bit DSA key for the domain example.com, the following command would be @@ -426,7 +426,7 @@

    -

    SEE ALSO

    +

    SEE ALSO

    dnssec-signzone(8), BIND 9 Administrator Reference Manual, RFC 2539, @@ -435,7 +435,7 @@

    -

    AUTHOR

    +

    AUTHOR

    Internet Systems Consortium

    diff --git a/doc/arm/man.dnssec-revoke.html b/doc/arm/man.dnssec-revoke.html index fa1853d76d..5ca84dfe59 100644 --- a/doc/arm/man.dnssec-revoke.html +++ b/doc/arm/man.dnssec-revoke.html @@ -50,7 +50,7 @@

    dnssec-revoke [-hr] [-v level] [-V] [-K directory] [-E engine] [-f] [-R] {keyfile}

    -

    DESCRIPTION

    +

    DESCRIPTION

    dnssec-revoke reads a DNSSEC key file, sets the REVOKED bit on the key as defined in RFC 5011, and creates a new pair of key files containing the @@ -58,7 +58,7 @@

    -

    OPTIONS

    +

    OPTIONS

    -h

    @@ -109,14 +109,14 @@

    -

    SEE ALSO

    +

    SEE ALSO

    dnssec-keygen(8), BIND 9 Administrator Reference Manual, RFC 5011.

    -

    AUTHOR

    +

    AUTHOR

    Internet Systems Consortium

    diff --git a/doc/arm/man.dnssec-settime.html b/doc/arm/man.dnssec-settime.html index 4a3b9bfd3b..7a7e2f5f36 100644 --- a/doc/arm/man.dnssec-settime.html +++ b/doc/arm/man.dnssec-settime.html @@ -50,7 +50,7 @@

    dnssec-settime [-f] [-K directory] [-L ttl] [-P date/offset] [-A date/offset] [-R date/offset] [-I date/offset] [-D date/offset] [-h] [-V] [-v level] [-E engine] {keyfile}

    -

    DESCRIPTION

    +

    DESCRIPTION

    dnssec-settime reads a DNSSEC private key file and sets the key timing metadata as specified by the -P, -A, @@ -76,7 +76,7 @@

    -

    OPTIONS

    +

    OPTIONS

    -f

    @@ -131,7 +131,7 @@

    -

    TIMING OPTIONS

    +

    TIMING OPTIONS

    Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '-', it is interpreted as @@ -210,7 +210,7 @@

    -

    PRINTING OPTIONS

    +

    PRINTING OPTIONS

    dnssec-settime can also be used to print the timing metadata associated with a key. @@ -236,7 +236,7 @@

    -

    SEE ALSO

    +

    SEE ALSO

    dnssec-keygen(8), dnssec-signzone(8), BIND 9 Administrator Reference Manual, @@ -244,7 +244,7 @@

    -

    AUTHOR

    +

    AUTHOR

    Internet Systems Consortium

    diff --git a/doc/arm/man.dnssec-signzone.html b/doc/arm/man.dnssec-signzone.html index 0ec695ee72..0bf4a08575 100644 --- a/doc/arm/man.dnssec-signzone.html +++ b/doc/arm/man.dnssec-signzone.html @@ -50,7 +50,7 @@

    dnssec-signzone [-a] [-c class] [-d directory] [-D] [-E engine] [-e end-time] [-f output-file] [-g] [-h] [-K directory] [-k key] [-L serial] [-l domain] [-M domain] [-i interval] [-I input-format] [-j jitter] [-N soa-serial-format] [-o origin] [-O output-format] [-P] [-p] [-Q] [-R] [-r randomdev] [-S] [-s start-time] [-T ttl] [-t] [-u] [-v level] [-V] [-X extended end-time] [-x] [-z] [-3 salt] [-H iterations] [-A] {zonefile} [key...]

    -

    DESCRIPTION

    +

    DESCRIPTION

    dnssec-signzone signs a zone. It generates NSEC and RRSIG records and produces a signed version of the @@ -61,7 +61,7 @@

    -

    OPTIONS

    +

    OPTIONS

    -a

    @@ -512,7 +512,7 @@

    -

    EXAMPLE

    +

    EXAMPLE

    The following command signs the example.com zone with the DSA key generated by dnssec-keygen @@ -542,14 +542,14 @@ db.example.com.signed %

    -

    SEE ALSO

    +

    SEE ALSO

    dnssec-keygen(8), BIND 9 Administrator Reference Manual, RFC 4033, RFC 4641.

    -

    AUTHOR

    +

    AUTHOR

    Internet Systems Consortium

    diff --git a/doc/arm/man.dnssec-verify.html b/doc/arm/man.dnssec-verify.html index 51452acbfc..2ee7718e8f 100644 --- a/doc/arm/man.dnssec-verify.html +++ b/doc/arm/man.dnssec-verify.html @@ -50,7 +50,7 @@

    dnssec-verify [-c class] [-E engine] [-I input-format] [-o origin] [-v level] [-V] [-x] [-z] {zonefile}

    -

    DESCRIPTION

    +

    DESCRIPTION

    dnssec-verify verifies that a zone is fully signed for each algorithm found in the DNSKEY RRset for the zone, and that the NSEC / NSEC3 @@ -58,7 +58,7 @@

    -

    OPTIONS

    +

    OPTIONS

    -c class

    @@ -138,7 +138,7 @@

    -

    SEE ALSO

    +

    SEE ALSO

    dnssec-signzone(8), BIND 9 Administrator Reference Manual, @@ -146,7 +146,7 @@

    -

    AUTHOR

    +

    AUTHOR

    Internet Systems Consortium

    diff --git a/doc/arm/man.genrandom.html b/doc/arm/man.genrandom.html index 815dbf1277..bdb0e66a21 100644 --- a/doc/arm/man.genrandom.html +++ b/doc/arm/man.genrandom.html @@ -50,7 +50,7 @@

    genrandom [-n number] {size} {filename}

    -

    DESCRIPTION

    +

    DESCRIPTION

    genrandom generates a file or a set of files containing a specified quantity @@ -59,7 +59,7 @@

    -

    ARGUMENTS

    +

    ARGUMENTS

    -n number

    @@ -77,14 +77,14 @@

    -

    SEE ALSO

    +

    SEE ALSO

    rand(3), arc4random(3)

    -

    AUTHOR

    +

    AUTHOR

    Internet Systems Consortium

    diff --git a/doc/arm/man.host.html b/doc/arm/man.host.html index 4430fe5db0..92cfc48521 100644 --- a/doc/arm/man.host.html +++ b/doc/arm/man.host.html @@ -50,7 +50,7 @@

    host [-aCdlnrsTwv] [-c class] [-N ndots] [-R number] [-t type] [-W wait] [-m flag] [-4] [-6] [-v] [-V] {name} [server]

    -

    DESCRIPTION

    +

    DESCRIPTION

    host is a simple utility for performing DNS lookups. It is normally used to convert names to IP addresses and vice versa. @@ -214,7 +214,7 @@

    -

    IDN SUPPORT

    +

    IDN SUPPORT

    If host has been built with IDN (internationalized domain name) support, it can accept and display non-ASCII domain names. @@ -228,12 +228,12 @@

    -

    FILES

    +

    FILES

    /etc/resolv.conf

    -

    SEE ALSO

    +

    SEE ALSO

    dig(1), named(8).

    diff --git a/doc/arm/man.isc-hmac-fixup.html b/doc/arm/man.isc-hmac-fixup.html index 0ec4bec7f0..f097f9ac47 100644 --- a/doc/arm/man.isc-hmac-fixup.html +++ b/doc/arm/man.isc-hmac-fixup.html @@ -50,7 +50,7 @@

    isc-hmac-fixup {algorithm} {secret}

    -

    DESCRIPTION

    +

    DESCRIPTION

    Versions of BIND 9 up to and including BIND 9.6 had a bug causing HMAC-SHA* TSIG keys which were longer than the digest length of the @@ -76,7 +76,7 @@

    -

    SECURITY CONSIDERATIONS

    +

    SECURITY CONSIDERATIONS

    Secrets that have been converted by isc-hmac-fixup are shortened, but as this is how the HMAC protocol works in @@ -87,14 +87,14 @@

    -

    SEE ALSO

    +

    SEE ALSO

    BIND 9 Administrator Reference Manual, RFC 2104.

    -

    AUTHOR

    +

    AUTHOR

    Internet Systems Consortium

    diff --git a/doc/arm/man.named-checkconf.html b/doc/arm/man.named-checkconf.html index e503db0b75..9dd4d05726 100644 --- a/doc/arm/man.named-checkconf.html +++ b/doc/arm/man.named-checkconf.html @@ -50,7 +50,7 @@

    named-checkconf [-h] [-v] [-j] [-t directory] {filename} [-p] [-x] [-z]

    -

    DESCRIPTION

    +

    DESCRIPTION

    named-checkconf checks the syntax, but not the semantics, of a named configuration file. The file is parsed @@ -70,7 +70,7 @@

    -

    OPTIONS

    +

    OPTIONS

    -h

    @@ -119,21 +119,21 @@

    -

    RETURN VALUES

    +

    RETURN VALUES

    named-checkconf returns an exit status of 1 if errors were detected and 0 otherwise.

    -

    SEE ALSO

    +

    SEE ALSO

    named(8), named-checkzone(8), BIND 9 Administrator Reference Manual.

    -

    AUTHOR

    +

    AUTHOR

    Internet Systems Consortium

    diff --git a/doc/arm/man.named-checkzone.html b/doc/arm/man.named-checkzone.html index b774271952..58052b0050 100644 --- a/doc/arm/man.named-checkzone.html +++ b/doc/arm/man.named-checkzone.html @@ -51,7 +51,7 @@

    named-compilezone [-d] [-j] [-q] [-v] [-c class] [-C mode] [-f format] [-F format] [-J filename] [-i mode] [-k mode] [-m mode] [-n mode] [-l ttl] [-L serial] [-r mode] [-s style] [-t directory] [-T mode] [-w directory] [-D] [-W mode] {-o filename} {zonename} {filename}

    -

    DESCRIPTION

    +

    DESCRIPTION

    named-checkzone checks the syntax and integrity of a zone file. It performs the same checks as named does when loading a @@ -71,7 +71,7 @@

    -

    OPTIONS

    +

    OPTIONS

    -d

    @@ -305,14 +305,14 @@

    -

    RETURN VALUES

    +

    RETURN VALUES

    named-checkzone returns an exit status of 1 if errors were detected and 0 otherwise.

    -

    SEE ALSO

    +

    SEE ALSO

    named(8), named-checkconf(8), RFC 1035, @@ -320,7 +320,7 @@

    -

    AUTHOR

    +

    AUTHOR

    Internet Systems Consortium

    diff --git a/doc/arm/man.named-journalprint.html b/doc/arm/man.named-journalprint.html index 72c2e7923a..9cd0264331 100644 --- a/doc/arm/man.named-journalprint.html +++ b/doc/arm/man.named-journalprint.html @@ -50,7 +50,7 @@

    named-journalprint {journal}

    -

    DESCRIPTION

    +

    DESCRIPTION

    named-journalprint prints the contents of a zone journal file in a human-readable @@ -76,7 +76,7 @@

    -

    SEE ALSO

    +

    SEE ALSO

    named(8), nsupdate(8), @@ -84,7 +84,7 @@

    -

    AUTHOR

    +

    AUTHOR

    Internet Systems Consortium

    diff --git a/doc/arm/man.named-rrchecker.html b/doc/arm/man.named-rrchecker.html index f42d3ac359..67c2ffc043 100644 --- a/doc/arm/man.named-rrchecker.html +++ b/doc/arm/man.named-rrchecker.html @@ -50,7 +50,7 @@

    named-rrchecker [-h] [-o origin] [-p] [-u] [-C] [-T] [-P]

    -

    DESCRIPTION

    +

    DESCRIPTION

    named-rrchecker read a individual DNS resource record from standard input and checks if it is syntactically correct. @@ -78,7 +78,7 @@

    -

    SEE ALSO

    +

    SEE ALSO

    RFC 1034, RFC 1035, diff --git a/doc/arm/man.named.html b/doc/arm/man.named.html index e0b0ab108b..7304d6fd7f 100644 --- a/doc/arm/man.named.html +++ b/doc/arm/man.named.html @@ -50,7 +50,7 @@

    named [-4] [-6] [-c config-file] [-d debug-level] [-D string] [-E engine-name] [-f] [-g] [-L logfile] [-m flag] [-n #cpus] [-p port] [-s] [-S #max-socks] [-t directory] [-U #listeners] [-u user] [-v] [-V] [-X lock-file] [-x cache-file]

    -

    DESCRIPTION

    +

    DESCRIPTION

    named is a Domain Name System (DNS) server, part of the BIND 9 distribution from ISC. For more @@ -65,7 +65,7 @@

    -

    OPTIONS

    +

    OPTIONS

    -4

    @@ -288,7 +288,7 @@

    -

    SIGNALS

    +

    SIGNALS

    In routine operation, signals should not be used to control the nameserver; rndc should be used @@ -309,7 +309,7 @@

    -

    CONFIGURATION

    +

    CONFIGURATION

    The named configuration file is too complex to describe in detail here. A complete description is provided @@ -326,7 +326,7 @@

    -

    FILES

    +

    FILES

    /etc/named.conf

    @@ -339,7 +339,7 @@

    -

    SEE ALSO

    +

    SEE ALSO

    RFC 1033, RFC 1034, RFC 1035, @@ -352,7 +352,7 @@

    -

    AUTHOR

    +

    AUTHOR

    Internet Systems Consortium

    diff --git a/doc/arm/man.nsec3hash.html b/doc/arm/man.nsec3hash.html index 17a7206a4c..063df70f77 100644 --- a/doc/arm/man.nsec3hash.html +++ b/doc/arm/man.nsec3hash.html @@ -48,7 +48,7 @@

    nsec3hash {salt} {algorithm} {iterations} {domain}

    -

    DESCRIPTION

    +

    DESCRIPTION

    nsec3hash generates an NSEC3 hash based on a set of NSEC3 parameters. This can be used to check the validity @@ -56,7 +56,7 @@

    -

    ARGUMENTS

    +

    ARGUMENTS

    salt

    @@ -80,14 +80,14 @@

    -

    SEE ALSO

    +

    SEE ALSO

    BIND 9 Administrator Reference Manual, RFC 5155.

    -

    AUTHOR

    +

    AUTHOR

    Internet Systems Consortium

    diff --git a/doc/arm/man.nsupdate.html b/doc/arm/man.nsupdate.html index cb466af8f9..60bcaed6b1 100644 --- a/doc/arm/man.nsupdate.html +++ b/doc/arm/man.nsupdate.html @@ -50,7 +50,7 @@

    nsupdate [-d] [-D] [[-g] | [-o] | [-l] | [-y [hmac:]keyname:secret] | [-k keyfile]] [-t timeout] [-u udptimeout] [-r udpretries] [-R randomdev] [-v] [-T] [-P] [-V] [filename]

    -

    DESCRIPTION

    +

    DESCRIPTION

    nsupdate is used to submit Dynamic DNS Update requests as defined in RFC 2136 to a name server. @@ -236,7 +236,7 @@

    -

    INPUT FORMAT

    +

    INPUT FORMAT

    nsupdate reads input from filename @@ -549,7 +549,7 @@

    -

    EXAMPLES

    +

    EXAMPLES

    The examples below show how nsupdate @@ -603,7 +603,7 @@

    -

    FILES

    +

    FILES

    /etc/resolv.conf

    @@ -626,7 +626,7 @@

    -

    SEE ALSO

    +

    SEE ALSO

    RFC 2136, RFC 3007, @@ -641,7 +641,7 @@

    -

    BUGS

    +

    BUGS

    The TSIG key is redundantly stored in two separate files. This is a consequence of nsupdate using the DST library diff --git a/doc/arm/man.rndc-confgen.html b/doc/arm/man.rndc-confgen.html index 0ff735b323..729e217841 100644 --- a/doc/arm/man.rndc-confgen.html +++ b/doc/arm/man.rndc-confgen.html @@ -50,7 +50,7 @@

    rndc-confgen [-a] [-A algorithm] [-b keysize] [-c keyfile] [-h] [-k keyname] [-p port] [-r randomfile] [-s address] [-t chrootdir] [-u user]

    -

    DESCRIPTION

    +

    DESCRIPTION

    rndc-confgen generates configuration files for rndc. It can be used as a @@ -66,7 +66,7 @@

    -

    OPTIONS

    +

    OPTIONS

    -a
    @@ -180,7 +180,7 @@
    -

    EXAMPLES

    +

    EXAMPLES

    To allow rndc to be used with no manual configuration, run @@ -197,7 +197,7 @@

    -

    SEE ALSO

    +

    SEE ALSO

    rndc(8), rndc.conf(5), named(8), @@ -205,7 +205,7 @@

    -

    AUTHOR

    +

    AUTHOR

    Internet Systems Consortium

    diff --git a/doc/arm/man.rndc.conf.html b/doc/arm/man.rndc.conf.html index 391e4106d1..f69f6764b4 100644 --- a/doc/arm/man.rndc.conf.html +++ b/doc/arm/man.rndc.conf.html @@ -50,7 +50,7 @@

    rndc.conf

    -

    DESCRIPTION

    +

    DESCRIPTION

    rndc.conf is the configuration file for rndc, the BIND 9 name server control utility. This file has a similar structure and syntax to @@ -136,7 +136,7 @@

    -

    EXAMPLE

    +

    EXAMPLE

           options {
         default-server  localhost;
@@ -210,7 +210,7 @@
    -

    NAME SERVER CONFIGURATION

    +

    NAME SERVER CONFIGURATION

    The name server must be configured to accept rndc connections and to recognize the key specified in the rndc.conf @@ -220,7 +220,7 @@

    -

    SEE ALSO

    +

    SEE ALSO

    rndc(8), rndc-confgen(8), mmencode(1), @@ -228,7 +228,7 @@

    -

    AUTHOR

    +

    AUTHOR

    Internet Systems Consortium

    diff --git a/doc/arm/man.rndc.html b/doc/arm/man.rndc.html index 3c9b1ebce1..73099b2cc2 100644 --- a/doc/arm/man.rndc.html +++ b/doc/arm/man.rndc.html @@ -50,7 +50,7 @@

    rndc [-b source-address] [-c config-file] [-k key-file] [-s server] [-p port] [-q] [-V] [-y key_id] {command}

    -

    DESCRIPTION

    +

    DESCRIPTION

    rndc controls the operation of a name server. It supersedes the ndc utility @@ -81,7 +81,7 @@

    -

    OPTIONS

    +

    OPTIONS

    -b source-address

    @@ -152,7 +152,7 @@

    -

    COMMANDS

    +

    COMMANDS

    A list of commands supported by rndc can be seen by running rndc without arguments. @@ -620,7 +620,7 @@

    -

    LIMITATIONS

    +

    LIMITATIONS

    There is currently no way to provide the shared secret for a key_id without using the configuration file. @@ -630,7 +630,7 @@

    -

    SEE ALSO

    +

    SEE ALSO

    rndc.conf(5), rndc-confgen(8), named(8), @@ -640,7 +640,7 @@

    -

    AUTHOR

    +

    AUTHOR

    Internet Systems Consortium

    diff --git a/doc/arm/notes.html b/doc/arm/notes.html index 5b480846b2..0dbbc1fc2d 100644 --- a/doc/arm/notes.html +++ b/doc/arm/notes.html @@ -381,6 +381,10 @@ initial packet sizes used in BIND 9.10 and higher when contacting authoritative servers for the first time.

    +

  • + Built-in "empty" zones did not correctly inherit the + "allow-transfer" ACL from the options or view. [RT #38310] +