Table of Contents
CPU requirements for BIND 9 range from i486-class machines for serving of static zones without caching, to enterprise-class machines if you intend to process many dynamic updates and DNSSEC @@ -74,7 +74,7 @@ signed zones, serving many thousands of queries per second.
The memory of the server has to be large enough to fit the cache and zones loaded off disk. The max-cache-size option can be used to limit the amount of memory used by the cache, @@ -89,7 +89,7 @@ be set higher than this stable size.
For nameserver intensive environments, there are two alternative configurations that may be used. The first is where clients and any second-level internal nameservers query a main nameserver, which @@ -103,7 +103,7 @@ as none of the nameservers share their cached data.
ISC BIND 9 compiles and runs on the following operating systems:
The following sample configuration is appropriate for a caching-only name server for use by clients internal to a corporation. All queries from outside clients are refused.
@@ -91,7 +91,7 @@ zone "0.0.127.in-addr.arpa" {This sample configuration is for an authoritative-only server
that is the master server for "example.com"
and a slave for the subdomain "eng.example.com".
Primitive load balancing can be achieved in DNS using multiple A records for one name.
For example, if you have three WWW servers with network addresses diff --git a/doc/arm/Bv9ARM.ch04.html b/doc/arm/Bv9ARM.ch04.html index c03588df00..577d2778a3 100644 --- a/doc/arm/Bv9ARM.ch04.html +++ b/doc/arm/Bv9ARM.ch04.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - +
@@ -51,18 +51,18 @@-y command line options.
A shared secret is generated to be shared between host1 and host2. An arbitrary key name is chosen: "host1-host2.". The key name must be the same on both hosts.
@@ -436,7 +436,7 @@ sign request messages to host1.BIND allows IP addresses and ranges to be specified in ACL definitions and allow-{ query | transfer | update } directives. @@ -454,7 +454,7 @@ allow-update { key host1-host2. ;};
The processing of TSIG signed messages can result in several errors. If a signed message is sent to a non-TSIG aware server, a FORMERR will be returned, since the server will not @@ -476,7 +476,7 @@ allow-update { key host1-host2. ;};
TKEY is a mechanism for automatically generating a shared secret between two hosts. There are several "modes" of TKEY that specify how the key is @@ -502,7 +502,7 @@ allow-update { key host1-host2. ;};
BIND 9 partially supports DNSSEC SIG(0) transaction signatures as specified in RFC 2535. SIG(0) uses public/private keys to authenticate messages. Access control is performed in the @@ -541,7 +541,7 @@ allow-update { key host1-host2. ;}; zone key of another zone above this one in the DNS tree.
The dnssec-keygen program is used to generate keys.
A secure zone must contain one or more zone keys. The diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html index b4e75d7ff0..66e27100af 100644 --- a/doc/arm/Bv9ARM.ch06.html +++ b/doc/arm/Bv9ARM.ch06.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - +
@@ -63,25 +63,25 @@ Usage This is the grammar of the lwres
statement in the named.conf file:
lwres { @@ -976,7 +976,7 @@ statement in thenamed.conffile:The lwres statement configures the name server to also act as a lightweight resolver server, see the section called “Running a Resolver Daemon”. There may be be multiple @@ -1004,7 +1004,7 @@ exact match lookup before search path elements are appended.
This is the grammar of the options statement in the
named.conffile:options { @@ -1102,7 +1102,7 @@ statement in thenamed.conffile:The options statement sets up global options to be used by BIND. This statement may appear only once in a configuration file. If more than one occurrence is found, @@ -1453,7 +1453,7 @@ The use of this option for any other purpose is discouraged.
The forwarding facility can be used to create a large site-wide cache on a few servers, reducing traffic over links to external nameservers. It can also be used to allow queries by servers that @@ -1530,7 +1530,7 @@ from these addresses will not be responded to. The default is +Interfaces
The interfaces and ports that the server will answer queries from may be specified using the listen-on option. listen-on takes an optional port, and an
address_match_list. @@ -1572,7 +1572,7 @@ the server will not listen on any IPv6 address.If the server doesn't know the answer to a question, it will query other nameservers. query-source specifies the address and port used for such queries. For queries sent over @@ -1718,7 +1718,7 @@ but applies to notify messages sent to IPv6 addresses.
The server's usage of many system resources can be limited. Scaled values are allowed when specifying resource limits. For example, 1G can be used instead of @@ -1795,7 +1795,7 @@ records are purged from the cache only when their TTLs expire.
The server will remove expired resource records @@ -2251,7 +2251,7 @@ supported.
trusted-keys {
string number number number string ;
[ string number number number string ; [...]]
@@ -2260,7 +2260,7 @@ supported.
The trusted-keys statement defines DNSSEC
security roots. DNSSEC is described in the section called “DNSSEC”. A security root is defined when the public key for a non-authoritative
@@ -2276,7 +2276,7 @@ key data.
view view_name [class] {
match-clients { address_match_list } ;
match-destinations { address_match_list } ;
@@ -2289,7 +2289,7 @@ key data.
The view statement is a powerful new feature
of BIND 9 that lets a name server answer a DNS query differently
depending on who is asking. It is particularly useful for implementing
@@ -2404,10 +2404,10 @@ Statement Grammar
A domain name identifies a node. Each node has a set of
resource information, which may be empty. The set of resource
information associated with a particular name is composed of
@@ -3034,7 +3034,7 @@ used as "pointers" to other data in the DNS.
RRs are represented in binary form in the packets of the DNS
protocol, and are usually represented in highly encoded form when
stored in a nameserver or resolver. In the examples provided in
@@ -3124,7 +3124,7 @@ each of a different class.
As described above, domain servers store information as a
series of resource records, each of which contains a particular
piece of information about a given domain name (which is usually,
diff --git a/doc/arm/Bv9ARM.ch07.html b/doc/arm/Bv9ARM.ch07.html
index 0ed9bdf01b..221bcb278e 100644
--- a/doc/arm/Bv9ARM.ch07.html
+++ b/doc/arm/Bv9ARM.ch07.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -46,11 +46,11 @@
Table of Contents
- Access Control Lists
-- chroot and setuid (for
+
- chroot and setuid (for
UNIX servers)
- Dynamic Update Security
@@ -100,7 +100,7 @@ see the AUSCERT advisory at
On UNIX servers, it is possible to run BIND in a chrooted environment
(chroot()) by specifying the "-t"
@@ -115,7 +115,7 @@ user 202:
/usr/local/bin/named -u 202 -t /var/named
In order for a chroot() environment to
work properly in a particular directory
(for example, /var/named),
@@ -140,7 +140,7 @@ to set up things like
Prior to running the named daemon, use
the touch utility (to change file access and
modification times) or the chown utility (to
diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html
index 48f32176e1..d4a1836016 100644
--- a/doc/arm/Bv9ARM.ch09.html
+++ b/doc/arm/Bv9ARM.ch09.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -47,13 +47,13 @@
Historical DNS Information
General DNS Reference Information
+General DNS Reference Information
Bibliography (and Suggested Reading)
The [hesiod] class is an information service
developed by MIT's Project Athena. It is used to share information
about various systems databases, such as users, groups, printers
@@ -131,7 +131,7 @@ hesiod.
The chaos class is used to specify zone
data for the MIT-developed CHAOSnet, a LAN protocol created in the
mid-1970s.
@@ -140,7 +140,7 @@ mid-1970s.
@@ -320,7 +320,7 @@ the number of the RFC). RFCs are also available via the Web at
Standards
[RFC974] Mail Routing and the Domain System. January 1986.
@@ -421,11 +421,11 @@ after which they are deleted unless updated by their authors.
DNS and BIND. Copyright © 1998 Sebastopol, CA: O'Reilly and Associates.
diff --git a/doc/arm/Bv9ARM.html b/doc/arm/Bv9ARM.html
index c4d02fa39f..20ef641394 100644
--- a/doc/arm/Bv9ARM.html
+++ b/doc/arm/Bv9ARM.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -67,19 +67,19 @@
2. BIND Resource Requirements
3. Nameserver Configuration
- Sample Configurations
- Load Balancing
+- Load Balancing
- Notify
- Nameserver Operations
@@ -95,18 +95,18 @@
- Split DNS
- TSIG
- TKEY
-- SIG(0)
+- TKEY
+- SIG(0)
- DNSSEC
-- Generating Keys
+- Generating Keys
- Creating a Keyset
- Signing the Child's Keyset
- Signing the Zone
@@ -143,25 +143,25 @@ Usage
- key Statement Definition and Usage
- logging Statement Grammar
- logging Statement Definition and Usage
-- lwres Statement Grammar
-- lwres Statement Definition and Usage
-- options Statement Grammar
-- options Statement Definition and Usage
+- lwres Statement Grammar
+- lwres Statement Definition and Usage
+- options Statement Grammar
+- options Statement Definition and Usage
- server Statement Grammar
- server Statement Definition and Usage
-- trusted-keys Statement Grammar
-- trusted-keys Statement Definition
+
- trusted-keys Statement Grammar
+- trusted-keys Statement Definition
and Usage
-- view Statement Grammar
-- view Statement Definition and Usage
+- view Statement Grammar
+- view Statement Definition and Usage
- zone
Statement Grammar
-- zone Statement Definition and Usage
+- zone Statement Definition and Usage
- Zone File
+- Zone File
- Types of Resource Records and When to Use Them
-- Discussion of MX Records
+- Discussion of MX Records
- Setting TTLs
- Inverse Mapping in IPv4
- Other Zone File Directives
@@ -171,11 +171,11 @@ Statement Grammar
- 7. BIND 9 Security Considerations
- Historical DNS Information
- General DNS Reference Information
+- General DNS Reference Information
- Bibliography (and Suggested Reading)