diff options
Diffstat (limited to 'contrib/bind9/doc/arm/Bv9ARM.ch03.html')
| -rw-r--r-- | contrib/bind9/doc/arm/Bv9ARM.ch03.html | 808 |
1 files changed, 0 insertions, 808 deletions
diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch03.html b/contrib/bind9/doc/arm/Bv9ARM.ch03.html deleted file mode 100644 index 18f2711..0000000 --- a/contrib/bind9/doc/arm/Bv9ARM.ch03.html +++ /dev/null @@ -1,808 +0,0 @@ -<!-- - - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") - - Copyright (C) 2000-2003 Internet Software Consortium. - - - - Permission to use, copy, modify, and distribute this software for any - - purpose with or without fee is hereby granted, provided that the above - - copyright notice and this permission notice appear in all copies. - - - - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH - - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY - - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, - - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM - - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE - - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - - PERFORMANCE OF THIS SOFTWARE. ---> -<!-- $Id: Bv9ARM.ch03.html,v 1.35.18.31 2007/10/31 01:35:57 marka Exp $ --> -<html> -<head> -<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> -<title>Chapter 3. Name Server Configuration</title> -<meta name="generator" content="DocBook XSL Stylesheets V1.71.1"> -<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual"> -<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual"> -<link rel="prev" href="Bv9ARM.ch02.html" title="Chapter 2. BIND Resource Requirements"> -<link rel="next" href="Bv9ARM.ch04.html" title="Chapter 4. Advanced DNS Features"> -</head> -<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"> -<div class="navheader"> -<table width="100%" summary="Navigation header"> -<tr><th colspan="3" align="center">Chapter 3. Name Server Configuration</th></tr> -<tr> -<td width="20%" align="left"> -<a accesskey="p" href="Bv9ARM.ch02.html">Prev</a> </td> -<th width="60%" align="center"> </th> -<td width="20%" align="right"> <a accesskey="n" href="Bv9ARM.ch04.html">Next</a> -</td> -</tr> -</table> -<hr> -</div> -<div class="chapter" lang="en"> -<div class="titlepage"><div><div><h2 class="title"> -<a name="Bv9ARM.ch03"></a>Chapter 3. Name Server Configuration</h2></div></div></div> -<div class="toc"> -<p><b>Table of Contents</b></p> -<dl> -<dt><span class="sect1"><a href="Bv9ARM.ch03.html#sample_configuration">Sample Configurations</a></span></dt> -<dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568004">A Caching-only Name Server</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568020">An Authoritative-only Name Server</a></span></dt> -</dl></dd> -<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568042">Load Balancing</a></span></dt> -<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568465">Name Server Operations</a></span></dt> -<dd><dl> -<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568470">Tools for Use With the Name Server Daemon</a></span></dt> -<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2570184">Signals</a></span></dt> -</dl></dd> -</dl> -</div> -<p> - In this section we provide some suggested configurations along - with guidelines for their use. We suggest reasonable values for - certain option settings. - </p> -<div class="sect1" lang="en"> -<div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="sample_configuration"></a>Sample Configurations</h2></div></div></div> -<div class="sect2" lang="en"> -<div class="titlepage"><div><div><h3 class="title"> -<a name="id2568004"></a>A Caching-only Name Server</h3></div></div></div> -<p> - The following sample configuration is appropriate for a caching-only - name server for use by clients internal to a corporation. All - queries - from outside clients are refused using the <span><strong class="command">allow-query</strong></span> - option. Alternatively, the same effect could be achieved using - suitable - firewall rules. - </p> -<pre class="programlisting"> -// Two corporate subnets we wish to allow queries from. -acl corpnets { 192.168.4.0/24; 192.168.7.0/24; }; -options { - directory "/etc/namedb"; // Working directory - allow-query { corpnets; }; -}; -// Provide a reverse mapping for the loopback address 127.0.0.1 -zone "0.0.127.in-addr.arpa" { - type master; - file "localhost.rev"; - notify no; -}; -</pre> -</div> -<div class="sect2" lang="en"> -<div class="titlepage"><div><div><h3 class="title"> -<a name="id2568020"></a>An Authoritative-only Name Server</h3></div></div></div> -<p> - This sample configuration is for an authoritative-only server - that is the master server for "<code class="filename">example.com</code>" - and a slave for the subdomain "<code class="filename">eng.example.com</code>". - </p> -<pre class="programlisting"> -options { - directory "/etc/namedb"; // Working directory - allow-query-cache { none; }; // Do not allow access to cache - allow-query { any; }; // This is the default - recursion no; // Do not provide recursive service -}; - -// Provide a reverse mapping for the loopback address 127.0.0.1 -zone "0.0.127.in-addr.arpa" { - type master; - file "localhost.rev"; - notify no; -}; -// We are the master server for example.com -zone "example.com" { - type master; - file "example.com.db"; - // IP addresses of slave servers allowed to transfer example.com - allow-transfer { - 192.168.4.14; - 192.168.5.53; - }; -}; -// We are a slave server for eng.example.com -zone "eng.example.com" { - type slave; - file "eng.example.com.bk"; - // IP address of eng.example.com master server - masters { 192.168.4.12; }; -}; -</pre> -</div> -</div> -<div class="sect1" lang="en"> -<div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2568042"></a>Load Balancing</h2></div></div></div> -<p> - A primitive form of load balancing can be achieved in - the <acronym class="acronym">DNS</acronym> by using multiple records - (such as multiple A records) for one name. - </p> -<p> - For example, if you have three WWW servers with network addresses - of 10.0.0.1, 10.0.0.2 and 10.0.0.3, a set of records such as the - following means that clients will connect to each machine one third - of the time: - </p> -<div class="informaltable"><table border="1"> -<colgroup> -<col> -<col> -<col> -<col> -<col> -</colgroup> -<tbody> -<tr> -<td> - <p> - Name - </p> - </td> -<td> - <p> - TTL - </p> - </td> -<td> - <p> - CLASS - </p> - </td> -<td> - <p> - TYPE - </p> - </td> -<td> - <p> - Resource Record (RR) Data - </p> - </td> -</tr> -<tr> -<td> - <p> - <code class="literal">www</code> - </p> - </td> -<td> - <p> - <code class="literal">600</code> - </p> - </td> -<td> - <p> - <code class="literal">IN</code> - </p> - </td> -<td> - <p> - <code class="literal">A</code> - </p> - </td> -<td> - <p> - <code class="literal">10.0.0.1</code> - </p> - </td> -</tr> -<tr> -<td> - <p></p> - </td> -<td> - <p> - <code class="literal">600</code> - </p> - </td> -<td> - <p> - <code class="literal">IN</code> - </p> - </td> -<td> - <p> - <code class="literal">A</code> - </p> - </td> -<td> - <p> - <code class="literal">10.0.0.2</code> - </p> - </td> -</tr> -<tr> -<td> - <p></p> - </td> -<td> - <p> - <code class="literal">600</code> - </p> - </td> -<td> - <p> - <code class="literal">IN</code> - </p> - </td> -<td> - <p> - <code class="literal">A</code> - </p> - </td> -<td> - <p> - <code class="literal">10.0.0.3</code> - </p> - </td> -</tr> -</tbody> -</table></div> -<p> - When a resolver queries for these records, <acronym class="acronym">BIND</acronym> will rotate - them and respond to the query with the records in a different - order. In the example above, clients will randomly receive - records in the order 1, 2, 3; 2, 3, 1; and 3, 1, 2. Most clients - will use the first record returned and discard the rest. - </p> -<p> - For more detail on ordering responses, check the - <span><strong class="command">rrset-order</strong></span> substatement in the - <span><strong class="command">options</strong></span> statement, see - <a href="Bv9ARM.ch06.html#rrset_ordering">RRset Ordering</a>. - </p> -</div> -<div class="sect1" lang="en"> -<div class="titlepage"><div><div><h2 class="title" style="clear: both"> -<a name="id2568465"></a>Name Server Operations</h2></div></div></div> -<div class="sect2" lang="en"> -<div class="titlepage"><div><div><h3 class="title"> -<a name="id2568470"></a>Tools for Use With the Name Server Daemon</h3></div></div></div> -<p> - This section describes several indispensable diagnostic, - administrative and monitoring tools available to the system - administrator for controlling and debugging the name server - daemon. - </p> -<div class="sect3" lang="en"> -<div class="titlepage"><div><div><h4 class="title"> -<a name="diagnostic_tools"></a>Diagnostic Tools</h4></div></div></div> -<p> - The <span><strong class="command">dig</strong></span>, <span><strong class="command">host</strong></span>, and - <span><strong class="command">nslookup</strong></span> programs are all command - line tools - for manually querying name servers. They differ in style and - output format. - </p> -<div class="variablelist"><dl> -<dt><span class="term"><a name="dig"></a><span><strong class="command">dig</strong></span></span></dt> -<dd> -<p> - The domain information groper (<span><strong class="command">dig</strong></span>) - is the most versatile and complete of these lookup tools. - It has two modes: simple interactive - mode for a single query, and batch mode which executes a - query for - each in a list of several query lines. All query options are - accessible - from the command line. - </p> -<div class="cmdsynopsis"><p><code class="command">dig</code> [@<em class="replaceable"><code>server</code></em>] <em class="replaceable"><code>domain</code></em> [<em class="replaceable"><code>query-type</code></em>] [<em class="replaceable"><code>query-class</code></em>] [+<em class="replaceable"><code>query-option</code></em>] [-<em class="replaceable"><code>dig-option</code></em>] [%<em class="replaceable"><code>comment</code></em>]</p></div> -<p> - The usual simple use of dig will take the form - </p> -<p> - <span><strong class="command">dig @server domain query-type query-class</strong></span> - </p> -<p> - For more information and a list of available commands and - options, see the <span><strong class="command">dig</strong></span> man - page. - </p> -</dd> -<dt><span class="term"><span><strong class="command">host</strong></span></span></dt> -<dd> -<p> - The <span><strong class="command">host</strong></span> utility emphasizes - simplicity - and ease of use. By default, it converts - between host names and Internet addresses, but its - functionality - can be extended with the use of options. - </p> -<div class="cmdsynopsis"><p><code class="command">host</code> [-aCdlnrsTwv] [-c <em class="replaceable"><code>class</code></em>] [-N <em class="replaceable"><code>ndots</code></em>] [-t <em class="replaceable"><code>type</code></em>] [-W <em class="replaceable"><code>timeout</code></em>] [-R <em class="replaceable"><code>retries</code></em>] [-m <em class="replaceable"><code>flag</code></em>] [-4] [-6] <em class="replaceable"><code>hostname</code></em> [<em class="replaceable"><code>server</code></em>]</p></div> -<p> - For more information and a list of available commands and - options, see the <span><strong class="command">host</strong></span> man - page. - </p> -</dd> -<dt><span class="term"><span><strong class="command">nslookup</strong></span></span></dt> -<dd> -<p><span><strong class="command">nslookup</strong></span> - has two modes: interactive and - non-interactive. Interactive mode allows the user to - query name servers for information about various - hosts and domains or to print a list of hosts in a - domain. Non-interactive mode is used to print just - the name and requested information for a host or - domain. - </p> -<div class="cmdsynopsis"><p><code class="command">nslookup</code> [-option...] [[<em class="replaceable"><code>host-to-find</code></em>] | [- [server]]]</p></div> -<p> - Interactive mode is entered when no arguments are given (the - default name server will be used) or when the first argument - is a - hyphen (`-') and the second argument is the host name or - Internet address - of a name server. - </p> -<p> - Non-interactive mode is used when the name or Internet - address - of the host to be looked up is given as the first argument. - The - optional second argument specifies the host name or address - of a name server. - </p> -<p> - Due to its arcane user interface and frequently inconsistent - behavior, we do not recommend the use of <span><strong class="command">nslookup</strong></span>. - Use <span><strong class="command">dig</strong></span> instead. - </p> -</dd> -</dl></div> -</div> -<div class="sect3" lang="en"> -<div class="titlepage"><div><div><h4 class="title"> -<a name="admin_tools"></a>Administrative Tools</h4></div></div></div> -<p> - Administrative tools play an integral part in the management - of a server. - </p> -<div class="variablelist"><dl> -<dt> -<a name="named-checkconf"></a><span class="term"><span><strong class="command">named-checkconf</strong></span></span> -</dt> -<dd> -<p> - The <span><strong class="command">named-checkconf</strong></span> program - checks the syntax of a <code class="filename">named.conf</code> file. - </p> -<div class="cmdsynopsis"><p><code class="command">named-checkconf</code> [-jvz] [-t <em class="replaceable"><code>directory</code></em>] [<em class="replaceable"><code>filename</code></em>]</p></div> -</dd> -<dt> -<a name="named-checkzone"></a><span class="term"><span><strong class="command">named-checkzone</strong></span></span> -</dt> -<dd> -<p> - The <span><strong class="command">named-checkzone</strong></span> program - checks a master file for - syntax and consistency. - </p> -<div class="cmdsynopsis"><p><code class="command">named-checkzone</code> [-djqvD] [-c <em class="replaceable"><code>class</code></em>] [-o <em class="replaceable"><code>output</code></em>] [-t <em class="replaceable"><code>directory</code></em>] [-w <em class="replaceable"><code>directory</code></em>] [-k <em class="replaceable"><code>(ignore|warn|fail)</code></em>] [-n <em class="replaceable"><code>(ignore|warn|fail)</code></em>] [-W <em class="replaceable"><code>(ignore|warn)</code></em>] <em class="replaceable"><code>zone</code></em> [<em class="replaceable"><code>filename</code></em>]</p></div> -</dd> -<dt> -<a name="named-compilezone"></a><span class="term"><span><strong class="command">named-compilezone</strong></span></span> -</dt> -<dd><p> - Similar to <span><strong class="command">named-checkzone,</strong></span> but - it always dumps the zone content to a specified file - (typically in a different format). - </p></dd> -<dt> -<a name="rndc"></a><span class="term"><span><strong class="command">rndc</strong></span></span> -</dt> -<dd> -<p> - The remote name daemon control - (<span><strong class="command">rndc</strong></span>) program allows the - system - administrator to control the operation of a name server. - Since <acronym class="acronym">BIND</acronym> 9.2, <span><strong class="command">rndc</strong></span> - supports all the commands of the BIND 8 <span><strong class="command">ndc</strong></span> - utility except <span><strong class="command">ndc start</strong></span> and - <span><strong class="command">ndc restart</strong></span>, which were also - not supported in <span><strong class="command">ndc</strong></span>'s - channel mode. - If you run <span><strong class="command">rndc</strong></span> without any - options - it will display a usage message as follows: - </p> -<div class="cmdsynopsis"><p><code class="command">rndc</code> [-c <em class="replaceable"><code>config</code></em>] [-s <em class="replaceable"><code>server</code></em>] [-p <em class="replaceable"><code>port</code></em>] [-y <em class="replaceable"><code>key</code></em>] <em class="replaceable"><code>command</code></em> [<em class="replaceable"><code>command</code></em>...]</p></div> -<p>The <span><strong class="command">command</strong></span> - is one of the following: - </p> -<div class="variablelist"><dl> -<dt><span class="term"><strong class="userinput"><code>reload</code></strong></span></dt> -<dd><p> - Reload configuration file and zones. - </p></dd> -<dt><span class="term"><strong class="userinput"><code>reload <em class="replaceable"><code>zone</code></em> - [<span class="optional"><em class="replaceable"><code>class</code></em> - [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt> -<dd><p> - Reload the given zone. - </p></dd> -<dt><span class="term"><strong class="userinput"><code>refresh <em class="replaceable"><code>zone</code></em> - [<span class="optional"><em class="replaceable"><code>class</code></em> - [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt> -<dd><p> - Schedule zone maintenance for the given zone. - </p></dd> -<dt><span class="term"><strong class="userinput"><code>retransfer <em class="replaceable"><code>zone</code></em> - - [<span class="optional"><em class="replaceable"><code>class</code></em> - [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt> -<dd><p> - Retransfer the given zone from the master. - </p></dd> -<dt><span class="term"><strong class="userinput"><code>freeze - [<span class="optional"><em class="replaceable"><code>zone</code></em> - [<span class="optional"><em class="replaceable"><code>class</code></em> - [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt> -<dd><p> - Suspend updates to a dynamic zone. If no zone is - specified, - then all zones are suspended. This allows manual - edits to be made to a zone normally updated by dynamic - update. It - also causes changes in the journal file to be synced - into the master - and the journal file to be removed. All dynamic - update attempts will - be refused while the zone is frozen. - </p></dd> -<dt><span class="term"><strong class="userinput"><code>thaw - [<span class="optional"><em class="replaceable"><code>zone</code></em> - [<span class="optional"><em class="replaceable"><code>class</code></em> - [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt> -<dd><p> - Enable updates to a frozen dynamic zone. If no zone - is - specified, then all frozen zones are enabled. This - causes - the server to reload the zone from disk, and - re-enables dynamic updates - after the load has completed. After a zone is thawed, - dynamic updates - will no longer be refused. - </p></dd> -<dt><span class="term"><strong class="userinput"><code>notify <em class="replaceable"><code>zone</code></em> - [<span class="optional"><em class="replaceable"><code>class</code></em> - [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt> -<dd><p> - Resend NOTIFY messages for the zone. - </p></dd> -<dt><span class="term"><strong class="userinput"><code>reconfig</code></strong></span></dt> -<dd><p> - Reload the configuration file and load new zones, - but do not reload existing zone files even if they - have changed. - This is faster than a full <span><strong class="command">reload</strong></span> when there - is a large number of zones because it avoids the need - to examine the - modification times of the zones files. - </p></dd> -<dt><span class="term"><strong class="userinput"><code>stats</code></strong></span></dt> -<dd><p> - Write server statistics to the statistics file. - </p></dd> -<dt><span class="term"><strong class="userinput"><code>querylog</code></strong></span></dt> -<dd><p> - Toggle query logging. Query logging can also be enabled - by explicitly directing the <span><strong class="command">queries</strong></span> - <span><strong class="command">category</strong></span> to a - <span><strong class="command">channel</strong></span> in the - <span><strong class="command">logging</strong></span> section of - <code class="filename">named.conf</code> or by specifying - <span><strong class="command">querylog yes;</strong></span> in the - <span><strong class="command">options</strong></span> section of - <code class="filename">named.conf</code>. - </p></dd> -<dt><span class="term"><strong class="userinput"><code>dumpdb - [<span class="optional">-all|-cache|-zone</span>] - [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>]</code></strong></span></dt> -<dd><p> - Dump the server's caches (default) and/or zones to - the - dump file for the specified views. If no view is - specified, all - views are dumped. - </p></dd> -<dt><span class="term"><strong class="userinput"><code>stop [<span class="optional">-p</span>]</code></strong></span></dt> -<dd><p> - Stop the server, making sure any recent changes - made through dynamic update or IXFR are first saved to - the master files of the updated zones. - If -p is specified named's process id is returned. - This allows an external process to determine when named - had completed stopping. - </p></dd> -<dt><span class="term"><strong class="userinput"><code>halt [<span class="optional">-p</span>]</code></strong></span></dt> -<dd><p> - Stop the server immediately. Recent changes - made through dynamic update or IXFR are not saved to - the master files, but will be rolled forward from the - journal files when the server is restarted. - If -p is specified named's process id is returned. - This allows an external process to determine when named - had completed halting. - </p></dd> -<dt><span class="term"><strong class="userinput"><code>trace</code></strong></span></dt> -<dd><p> - Increment the servers debugging level by one. - </p></dd> -<dt><span class="term"><strong class="userinput"><code>trace <em class="replaceable"><code>level</code></em></code></strong></span></dt> -<dd><p> - Sets the server's debugging level to an explicit - value. - </p></dd> -<dt><span class="term"><strong class="userinput"><code>notrace</code></strong></span></dt> -<dd><p> - Sets the server's debugging level to 0. - </p></dd> -<dt><span class="term"><strong class="userinput"><code>flush</code></strong></span></dt> -<dd><p> - Flushes the server's cache. - </p></dd> -<dt><span class="term"><strong class="userinput"><code>flushname</code></strong> <em class="replaceable"><code>name</code></em></span></dt> -<dd><p> - Flushes the given name from the server's cache. - </p></dd> -<dt><span class="term"><strong class="userinput"><code>status</code></strong></span></dt> -<dd><p> - Display status of the server. - Note that the number of zones includes the internal <span><strong class="command">bind/CH</strong></span> zone - and the default <span><strong class="command">./IN</strong></span> - hint zone if there is not an - explicit root zone configured. - </p></dd> -<dt><span class="term"><strong class="userinput"><code>recursing</code></strong></span></dt> -<dd><p> - Dump the list of queries named is currently recursing - on. - </p></dd> -</dl></div> -<p> - A configuration file is required, since all - communication with the server is authenticated with - digital signatures that rely on a shared secret, and - there is no way to provide that secret other than with a - configuration file. The default location for the - <span><strong class="command">rndc</strong></span> configuration file is - <code class="filename">/etc/rndc.conf</code>, but an - alternate - location can be specified with the <code class="option">-c</code> - option. If the configuration file is not found, - <span><strong class="command">rndc</strong></span> will also look in - <code class="filename">/etc/rndc.key</code> (or whatever - <code class="varname">sysconfdir</code> was defined when - the <acronym class="acronym">BIND</acronym> build was - configured). - The <code class="filename">rndc.key</code> file is - generated by - running <span><strong class="command">rndc-confgen -a</strong></span> as - described in - <a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage" title="controls Statement Definition and - Usage">the section called “<span><strong class="command">controls</strong></span> Statement Definition and - Usage”</a>. - </p> -<p> - The format of the configuration file is similar to - that of <code class="filename">named.conf</code>, but - limited to - only four statements, the <span><strong class="command">options</strong></span>, - <span><strong class="command">key</strong></span>, <span><strong class="command">server</strong></span> and - <span><strong class="command">include</strong></span> - statements. These statements are what associate the - secret keys to the servers with which they are meant to - be shared. The order of statements is not - significant. - </p> -<p> - The <span><strong class="command">options</strong></span> statement has - three clauses: - <span><strong class="command">default-server</strong></span>, <span><strong class="command">default-key</strong></span>, - and <span><strong class="command">default-port</strong></span>. - <span><strong class="command">default-server</strong></span> takes a - host name or address argument and represents the server - that will - be contacted if no <code class="option">-s</code> - option is provided on the command line. - <span><strong class="command">default-key</strong></span> takes - the name of a key as its argument, as defined by a <span><strong class="command">key</strong></span> statement. - <span><strong class="command">default-port</strong></span> specifies the - port to which - <span><strong class="command">rndc</strong></span> should connect if no - port is given on the command line or in a - <span><strong class="command">server</strong></span> statement. - </p> -<p> - The <span><strong class="command">key</strong></span> statement defines a - key to be used - by <span><strong class="command">rndc</strong></span> when authenticating - with - <span><strong class="command">named</strong></span>. Its syntax is - identical to the - <span><strong class="command">key</strong></span> statement in named.conf. - The keyword <strong class="userinput"><code>key</code></strong> is - followed by a key name, which must be a valid - domain name, though it need not actually be hierarchical; - thus, - a string like "<strong class="userinput"><code>rndc_key</code></strong>" is a valid - name. - The <span><strong class="command">key</strong></span> statement has two - clauses: - <span><strong class="command">algorithm</strong></span> and <span><strong class="command">secret</strong></span>. - While the configuration parser will accept any string as the - argument - to algorithm, currently only the string "<strong class="userinput"><code>hmac-md5</code></strong>" - has any meaning. The secret is a base-64 encoded string - as specified in RFC 3548. - </p> -<p> - The <span><strong class="command">server</strong></span> statement - associates a key - defined using the <span><strong class="command">key</strong></span> - statement with a server. - The keyword <strong class="userinput"><code>server</code></strong> is followed by a - host name or address. The <span><strong class="command">server</strong></span> statement - has two clauses: <span><strong class="command">key</strong></span> and <span><strong class="command">port</strong></span>. - The <span><strong class="command">key</strong></span> clause specifies the - name of the key - to be used when communicating with this server, and the - <span><strong class="command">port</strong></span> clause can be used to - specify the port <span><strong class="command">rndc</strong></span> should - connect - to on the server. - </p> -<p> - A sample minimal configuration file is as follows: - </p> -<pre class="programlisting"> -key rndc_key { - algorithm "hmac-md5"; - secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K"; -}; -options { - default-server 127.0.0.1; - default-key rndc_key; -}; -</pre> -<p> - This file, if installed as <code class="filename">/etc/rndc.conf</code>, - would allow the command: - </p> -<p> - <code class="prompt">$ </code><strong class="userinput"><code>rndc reload</code></strong> - </p> -<p> - to connect to 127.0.0.1 port 953 and cause the name server - to reload, if a name server on the local machine were - running with - following controls statements: - </p> -<pre class="programlisting"> -controls { - inet 127.0.0.1 allow { localhost; } keys { rndc_key; }; -}; -</pre> -<p> - and it had an identical key statement for - <code class="literal">rndc_key</code>. - </p> -<p> - Running the <span><strong class="command">rndc-confgen</strong></span> - program will - conveniently create a <code class="filename">rndc.conf</code> - file for you, and also display the - corresponding <span><strong class="command">controls</strong></span> - statement that you need to - add to <code class="filename">named.conf</code>. - Alternatively, - you can run <span><strong class="command">rndc-confgen -a</strong></span> - to set up - a <code class="filename">rndc.key</code> file and not - modify - <code class="filename">named.conf</code> at all. - </p> -</dd> -</dl></div> -</div> -</div> -<div class="sect2" lang="en"> -<div class="titlepage"><div><div><h3 class="title"> -<a name="id2570184"></a>Signals</h3></div></div></div> -<p> - Certain UNIX signals cause the name server to take specific - actions, as described in the following table. These signals can - be sent using the <span><strong class="command">kill</strong></span> command. - </p> -<div class="informaltable"><table border="1"> -<colgroup> -<col> -<col> -</colgroup> -<tbody> -<tr> -<td> - <p><span><strong class="command">SIGHUP</strong></span></p> - </td> -<td> - <p> - Causes the server to read <code class="filename">named.conf</code> and - reload the database. - </p> - </td> -</tr> -<tr> -<td> - <p><span><strong class="command">SIGTERM</strong></span></p> - </td> -<td> - <p> - Causes the server to clean up and exit. - </p> - </td> -</tr> -<tr> -<td> - <p><span><strong class="command">SIGINT</strong></span></p> - </td> -<td> - <p> - Causes the server to clean up and exit. - </p> - </td> -</tr> -</tbody> -</table></div> -</div> -</div> -</div> -<div class="navfooter"> -<hr> -<table width="100%" summary="Navigation footer"> -<tr> -<td width="40%" align="left"> -<a accesskey="p" href="Bv9ARM.ch02.html">Prev</a> </td> -<td width="20%" align="center"> </td> -<td width="40%" align="right"> <a accesskey="n" href="Bv9ARM.ch04.html">Next</a> -</td> -</tr> -<tr> -<td width="40%" align="left" valign="top">Chapter 2. <acronym class="acronym">BIND</acronym> Resource Requirements </td> -<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td> -<td width="40%" align="right" valign="top"> Chapter 4. Advanced DNS Features</td> -</tr> -</table> -</div> -</body> -</html> |
