src - FreeBSD source tree

diff options


context:
space:
mode:

author	Doug Barton <dougb@FreeBSD.org>	2007-06-02 23:21:47 +0000
committer	Doug Barton <dougb@FreeBSD.org>	2007-06-02 23:21:47 +0000
commit	141cfa50294bfad08bb6c6419f1dc4fc3165c6ab (patch)
tree	6e65ba28d6d850f4d5c07cd37f26842e97b4aecf /contrib/bind9/bin/rndc/rndc.conf.html
parent	fa5fb0343e2347012cf980b8273e2cba6c36de4a (diff)

Vendor import of BIND 9.4.1

Notes

Notes: svn path=/vendor/bind9/dist/; revision=170222

Diffstat (limited to 'contrib/bind9/bin/rndc/rndc.conf.html')

-rw-r--r--

contrib/bind9/bin/rndc/rndc.conf.html

252

1 files changed, 145 insertions, 107 deletions

diff --git a/contrib/bind9/bin/rndc/rndc.conf.html b/contrib/bind9/bin/rndc/rndc.conf.html
index fefe616d8dc2..8e510bd6e27f 100644
--- a/contrib/bind9/bin/rndc/rndc.conf.html
+++ b/contrib/bind9/bin/rndc/rndc.conf.html

@@ -1,5 +1,5 @@

<!--

- Permission to use, copy, modify, and distribute this software for any

@@ -14,15 +14,15 @@

- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR

- PERFORMANCE OF THIS SOFTWARE.

-->

-

+

<html>

<head>

-<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">

+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">

</head>

-<a name="id2482688"></a><div class="titlepage"></div>

+<a name="man.rndc.conf"></a><div class="titlepage"></div>

<p><code class="filename">rndc.conf</code> — rndc configuration file</p>

@@ -32,147 +32,185 @@

</div>

-<a name="id2549398"></a><h2>DESCRIPTION</h2>

-<p>

- <code class="filename">rndc.conf</code> is the configuration file

- for <span><strong class="command">rndc</strong></span>, the BIND 9 name server control

- utility. This file has a similar structure and syntax to

- <code class="filename">named.conf</code>. Statements are enclosed

- in braces and terminated with a semi-colon. Clauses in

- the statements are also semi-colon terminated. The usual

- comment styles are supported:

- </p>

-<p>

- C style: /* */

- </p>

-<p>

- C++ style: // to end of line

- </p>

-<p>

- Unix style: # to end of line

- </p>

-<p>

- <code class="filename">rndc.conf</code> is much simpler than

- <code class="filename">named.conf</code>. The file uses three

- statements: an options statement, a server statement

- and a key statement.

- </p>

-<p>

- The <code class="option">options</code> statement contains three clauses.

- The <code class="option">default-server</code> clause is followed by the

- name or address of a name server. This host will be used when

- no name server is given as an argument to

- <span><strong class="command">rndc</strong></span>. The <code class="option">default-key</code>

- clause is followed by the name of a key which is identified by

- a <code class="option">key</code> statement. If no

- <code class="option">keyid</code> is provided on the rndc command line,

- and no <code class="option">key</code> clause is found in a matching

- <code class="option">server</code> statement, this default key will be

- used to authenticate the server's commands and responses. The

- <code class="option">default-port</code> clause is followed by the port

- to connect to on the remote name server. If no

- <code class="option">port</code> option is provided on the rndc command

- line, and no <code class="option">port</code> clause is found in a

- matching <code class="option">server</code> statement, this default port

- will be used to connect.

- </p>

-<p>

- After the <code class="option">server</code> keyword, the server statement

- includes a string which is the hostname or address for a name

- server. The statement has two possible clauses:

- <code class="option">key</code> and <code class="option">port</code>. The key name must

- match the name of a key statement in the file. The port number

- specifies the port to connect to.

- </p>

-<p>

- The <code class="option">key</code> statement begins with an identifying

- string, the name of the key. The statement has two clauses.

- <code class="option">algorithm</code> identifies the encryption algorithm

- for <span><strong class="command">rndc</strong></span> to use; currently only HMAC-MD5 is

- supported. This is followed by a secret clause which contains

- the base-64 encoding of the algorithm's encryption key. The

- base-64 string is enclosed in double quotes.

- </p>

-<p>

- There are two common ways to generate the base-64 string for the

- secret. The BIND 9 program <span><strong class="command">rndc-confgen</strong></span> can

- be used to generate a random key, or the

- <span><strong class="command">mmencode</strong></span> program, also known as

- <span><strong class="command">mimencode</strong></span>, can be used to generate a base-64

- string from known input. <span><strong class="command">mmencode</strong></span> does not

- ship with BIND 9 but is available on many systems. See the

- EXAMPLE section for sample command lines for each.

+<a name="id2543352"></a><h2>DESCRIPTION</h2>

+<p><code class="filename">rndc.conf</code> is the configuration file

+ for <span><strong class="command">rndc</strong></span>, the BIND 9 name server control

+ utility. This file has a similar structure and syntax to

+ <code class="filename">named.conf</code>. Statements are enclosed

+ in braces and terminated with a semi-colon. Clauses in

+ the statements are also semi-colon terminated. The usual

+ comment styles are supported:

+ </p>

+<p>

+ C style: /* */

+ </p>

+<p>

+ C++ style: // to end of line

+ </p>

+<p>

+ Unix style: # to end of line

+ </p>

+<p><code class="filename">rndc.conf</code> is much simpler than

+ <code class="filename">named.conf</code>. The file uses three

+ statements: an options statement, a server statement

+ and a key statement.

+ </p>

+<p>

+ The <code class="option">options</code> statement contains five clauses.

+ The <code class="option">default-server</code> clause is followed by the

+ name or address of a name server. This host will be used when

+ no name server is given as an argument to

+ <span><strong class="command">rndc</strong></span>. The <code class="option">default-key</code>

+ clause is followed by the name of a key which is identified by

+ a <code class="option">key</code> statement. If no

+ <code class="option">keyid</code> is provided on the rndc command line,

+ and no <code class="option">key</code> clause is found in a matching

+ <code class="option">server</code> statement, this default key will be

+ used to authenticate the server's commands and responses. The

+ <code class="option">default-port</code> clause is followed by the port

+ to connect to on the remote name server. If no

+ <code class="option">port</code> option is provided on the rndc command

+ line, and no <code class="option">port</code> clause is found in a

+ matching <code class="option">server</code> statement, this default port

+ will be used to connect.

+ The <code class="option">default-source-address</code> and

+ <code class="option">default-source-address-v6</code> clauses which

+ can be used to set the IPv4 and IPv6 source addresses

+ respectively.

+ </p>

+<p>

+ After the <code class="option">server</code> keyword, the server

+ statement includes a string which is the hostname or address

+ for a name server. The statement has three possible clauses:

+ <code class="option">key</code>, <code class="option">port</code> and

+ <code class="option">addresses</code>. The key name must match the

+ name of a key statement in the file. The port number

+ specifies the port to connect to. If an <code class="option">addresses</code>

+ clause is supplied these addresses will be used instead of

+ the server name. Each address can take a optional port.

+ If an <code class="option">source-address</code> or <code class="option">source-address-v6</code>

+ of supplied then these will be used to specify the IPv4 and IPv6

+ source addresses respectively.

+ </p>

+<p>

+ The <code class="option">key</code> statement begins with an identifying

+ string, the name of the key. The statement has two clauses.

+ <code class="option">algorithm</code> identifies the encryption algorithm

+ for <span><strong class="command">rndc</strong></span> to use; currently only HMAC-MD5

+ is

+ supported. This is followed by a secret clause which contains

+ the base-64 encoding of the algorithm's encryption key. The

+ base-64 string is enclosed in double quotes.

+ </p>

+<p>

+ There are two common ways to generate the base-64 string for the

+ secret. The BIND 9 program <span><strong class="command">rndc-confgen</strong></span>

+ can

+ be used to generate a random key, or the

+ <span><strong class="command">mmencode</strong></span> program, also known as

+ <span><strong class="command">mimencode</strong></span>, can be used to generate a

+ base-64

+ string from known input. <span><strong class="command">mmencode</strong></span> does

+ not

+ ship with BIND 9 but is available on many systems. See the

+ EXAMPLE section for sample command lines for each.

</p>

</div>

-<a name="id2549601"></a><h2>EXAMPLE</h2>

+<a name="id2543500"></a><h2>EXAMPLE</h2>

- options {

+ options {

default-server localhost;

default-key samplekey;

};

+</pre>

+<p>

+ </p>

+<pre class="programlisting">

server localhost {

key samplekey;

};

+</pre>

+<p>

+ </p>

+<pre class="programlisting">

+ server testserver {

+ key testkey;

+ addresses { localhost port 5353; };

+ };

+</pre>

+<p>

+ </p>

+<pre class="programlisting">

key samplekey {

algorithm hmac-md5;

- secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K";

+ secret "6FMfj43Osz4lyb24OIe2iGEz9lf1llJO+lz";

};

+</pre>

+<p>

+ </p>

+<pre class="programlisting">

+ key testkey {

+ algorithm hmac-md5;

+ secret "R3HI8P6BKw9ZwXwN3VZKuQ==";

+ }

</pre>

<p>

- In the above example, <span><strong class="command">rndc</strong></span> will by default use

- the server at localhost (127.0.0.1) and the key called samplekey.

- Commands to the localhost server will use the samplekey key, which

- must also be defined in the server's configuration file with the

- same name and secret. The key statement indicates that samplekey

- uses the HMAC-MD5 algorithm and its secret clause contains the

- base-64 encoding of the HMAC-MD5 secret enclosed in double quotes.

</p>

<p>

- To generate a random secret with <span><strong class="command">rndc-confgen</strong></span>:

+ In the above example, <span><strong class="command">rndc</strong></span> will by

+ default use

+ the server at localhost (127.0.0.1) and the key called samplekey.

+ Commands to the localhost server will use the samplekey key, which

+ must also be defined in the server's configuration file with the

+ same name and secret. The key statement indicates that samplekey

+ uses the HMAC-MD5 algorithm and its secret clause contains the

+ base-64 encoding of the HMAC-MD5 secret enclosed in double quotes.

</p>

<p>

- <strong class="userinput"><code>rndc-confgen</code></strong>

+ If <span><strong class="command">rndc -s testserver</strong></span> is used then <span><strong class="command">rndc</strong></span> will

+ connect to server on localhost port 5353 using the key testkey.

</p>

<p>

- A complete <code class="filename">rndc.conf</code> file, including the

- randomly generated key, will be written to the standard

- output. Commented out <code class="option">key</code> and

- <code class="option">controls</code> statements for

- <code class="filename">named.conf</code> are also printed.

+ To generate a random secret with <span><strong class="command">rndc-confgen</strong></span>:

+ </p>

+<p><strong class="userinput"><code>rndc-confgen</code></strong>

</p>

<p>

- To generate a base-64 secret with <span><strong class="command">mmencode</strong></span>:

+ A complete <code class="filename">rndc.conf</code> file, including

+ the

+ randomly generated key, will be written to the standard

+ output. Commented out <code class="option">key</code> and

+ <code class="option">controls</code> statements for

+ <code class="filename">named.conf</code> are also printed.

</p>

<p>

- <strong class="userinput"><code>echo "known plaintext for a secret" | mmencode</code></strong>

+ To generate a base-64 secret with <span><strong class="command">mmencode</strong></span>:

+ </p>

+<p><strong class="userinput"><code>echo "known plaintext for a secret" | mmencode</code></strong>

</p>

</div>

-<a name="id2549730"></a><h2>NAME SERVER CONFIGURATION</h2>

+<a name="id2543592"></a><h2>NAME SERVER CONFIGURATION</h2>

<p>

- The name server must be configured to accept rndc connections and

- to recognize the key specified in the <code class="filename">rndc.conf</code>

- file, using the controls statement in <code class="filename">named.conf</code>.

- See the sections on the <code class="option">controls</code> statement in the

- BIND 9 Administrator Reference Manual for details.

+ The name server must be configured to accept rndc connections and

+ to recognize the key specified in the <code class="filename">rndc.conf</code>

+ file, using the controls statement in <code class="filename">named.conf</code>.

+ See the sections on the <code class="option">controls</code> statement in the

+ BIND 9 Administrator Reference Manual for details.

</p>

</div>

-<a name="id2549750"></a><h2>SEE ALSO</h2>

-<p>

- <span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,

+<a name="id2543613"></a><h2>SEE ALSO</h2>

+<p><span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,

<span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>,

<span class="citerefentry"><span class="refentrytitle">mmencode</span>(1)</span>,

<em class="citetitle">BIND 9 Administrator Reference Manual</em>.

</p>

</div>

-<a name="id2549793"></a><h2>AUTHOR</h2>

-<p>

- <span class="corpauthor">Internet Systems Consortium</span>

+<a name="id2543652"></a><h2>AUTHOR</h2>

+<p><span class="corpauthor">Internet Systems Consortium</span>

</p>

</div>

</div></body>