503 lines
26 KiB
HTML
503 lines
26 KiB
HTML
<!--
|
||
- Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||
- Copyright (C) 2000-2003 Internet Software Consortium.
|
||
-
|
||
- Permission to use, copy, modify, and distribute this software for any
|
||
- purpose with or without fee is hereby granted, provided that the above
|
||
- copyright notice and this permission notice appear in all copies.
|
||
-
|
||
- THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
|
||
- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||
- AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||
- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||
- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
|
||
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||
- PERFORMANCE OF THIS SOFTWARE.
|
||
-->
|
||
<!-- $Id: Bv9ARM.ch03.html,v 1.26.2.13 2005/10/13 02:23:41 marka Exp $ -->
|
||
<html>
|
||
<head>
|
||
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
||
<title>Chapter 3. Nameserver Configuration</title>
|
||
<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
|
||
<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
|
||
<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
|
||
<link rel="prev" href="Bv9ARM.ch02.html" title="Chapter 2. BIND Resource Requirements">
|
||
<link rel="next" href="Bv9ARM.ch04.html" title="Chapter 4. Advanced Concepts">
|
||
</head>
|
||
<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
|
||
<div class="navheader">
|
||
<table width="100%" summary="Navigation header">
|
||
<tr><th colspan="3" align="center">Chapter 3. Nameserver Configuration</th></tr>
|
||
<tr>
|
||
<td width="20%" align="left">
|
||
<a accesskey="p" href="Bv9ARM.ch02.html">Prev</a> </td>
|
||
<th width="60%" align="center"> </th>
|
||
<td width="20%" align="right"> <a accesskey="n" href="Bv9ARM.ch04.html">Next</a>
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
<hr>
|
||
</div>
|
||
<div class="chapter" lang="en">
|
||
<div class="titlepage"><div><div><h2 class="title">
|
||
<a name="Bv9ARM.ch03"></a>Chapter 3. Nameserver Configuration</h2></div></div></div>
|
||
<div class="toc">
|
||
<p><b>Table of Contents</b></p>
|
||
<dl>
|
||
<dt><span class="sect1"><a href="Bv9ARM.ch03.html#sample_configuration">Sample Configurations</a></span></dt>
|
||
<dd><dl>
|
||
<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2547389">A Caching-only Nameserver</a></span></dt>
|
||
<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2547402">An Authoritative-only Nameserver</a></span></dt>
|
||
</dl></dd>
|
||
<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2547425">Load Balancing</a></span></dt>
|
||
<dt><span class="sect1"><a href="Bv9ARM.ch03.html#notify">Notify</a></span></dt>
|
||
<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2547747">Nameserver Operations</a></span></dt>
|
||
<dd><dl>
|
||
<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2547752">Tools for Use With the Nameserver Daemon</a></span></dt>
|
||
<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2550667">Signals</a></span></dt>
|
||
</dl></dd>
|
||
</dl>
|
||
</div>
|
||
<p>In this section we provide some suggested configurations along
|
||
with guidelines for their use. We also address the topic of reasonable
|
||
option setting.</p>
|
||
<div class="sect1" lang="en">
|
||
<div class="titlepage"><div><div><h2 class="title" style="clear: both">
|
||
<a name="sample_configuration"></a>Sample Configurations</h2></div></div></div>
|
||
<div class="sect2" lang="en">
|
||
<div class="titlepage"><div><div><h3 class="title">
|
||
<a name="id2547389"></a>A Caching-only Nameserver</h3></div></div></div>
|
||
<p>The following sample configuration is appropriate for a caching-only
|
||
name server for use by clients internal to a corporation. All queries
|
||
from outside clients are refused.</p>
|
||
<pre class="programlisting">
|
||
// Two corporate subnets we wish to allow queries from.
|
||
acl "corpnets" { 192.168.4.0/24; 192.168.7.0/24; };
|
||
options {
|
||
directory "/etc/namedb"; // Working directory
|
||
pid-file "named.pid"; // Put pid file in working dir
|
||
allow-query { "corpnets"; };
|
||
};
|
||
// Root server hints
|
||
zone "." { type hint; file "root.hint"; };
|
||
// Provide a reverse mapping for the loopback address 127.0.0.1
|
||
zone "0.0.127.in-addr.arpa" {
|
||
type master;
|
||
file "localhost.rev";
|
||
notify no;
|
||
};
|
||
</pre>
|
||
</div>
|
||
<div class="sect2" lang="en">
|
||
<div class="titlepage"><div><div><h3 class="title">
|
||
<a name="id2547402"></a>An Authoritative-only Nameserver</h3></div></div></div>
|
||
<p>This sample configuration is for an authoritative-only server
|
||
that is the master server for "<code class="filename">example.com</code>"
|
||
and a slave for the subdomain "<code class="filename">eng.example.com</code>".</p>
|
||
<pre class="programlisting">
|
||
options {
|
||
directory "/etc/namedb"; // Working directory
|
||
pid-file "named.pid"; // Put pid file in working dir
|
||
allow-query { any; }; // This is the default
|
||
recursion no; // Do not provide recursive service
|
||
};
|
||
// Root server hints
|
||
zone "." { type hint; file "root.hint"; };
|
||
|
||
// Provide a reverse mapping for the loopback address 127.0.0.1
|
||
zone "0.0.127.in-addr.arpa" {
|
||
type master;
|
||
file "localhost.rev";
|
||
notify no;
|
||
};
|
||
// We are the master server for example.com
|
||
zone "example.com" {
|
||
type master;
|
||
file "example.com.db";
|
||
// IP addresses of slave servers allowed to transfer example.com
|
||
allow-transfer {
|
||
192.168.4.14;
|
||
192.168.5.53;
|
||
};
|
||
};
|
||
// We are a slave server for eng.example.com
|
||
zone "eng.example.com" {
|
||
type slave;
|
||
file "eng.example.com.bk";
|
||
// IP address of eng.example.com master server
|
||
masters { 192.168.4.12; };
|
||
};
|
||
</pre>
|
||
</div>
|
||
</div>
|
||
<div class="sect1" lang="en">
|
||
<div class="titlepage"><div><div><h2 class="title" style="clear: both">
|
||
<a name="id2547425"></a>Load Balancing</h2></div></div></div>
|
||
<p>Primitive load balancing can be achieved in <span class="acronym">DNS</span> using multiple
|
||
A records for one name.</p>
|
||
<p>For example, if you have three WWW servers with network addresses
|
||
of 10.0.0.1, 10.0.0.2 and 10.0.0.3, a set of records such as the
|
||
following means that clients will connect to each machine one third
|
||
of the time:</p>
|
||
<div class="informaltable"><table border="1">
|
||
<colgroup>
|
||
<col>
|
||
<col>
|
||
<col>
|
||
<col>
|
||
<col>
|
||
</colgroup>
|
||
<tbody>
|
||
<tr>
|
||
<td><p>Name</p></td>
|
||
<td><p>TTL</p></td>
|
||
<td><p>CLASS</p></td>
|
||
<td><p>TYPE</p></td>
|
||
<td><p>Resource Record (RR) Data</p></td>
|
||
</tr>
|
||
<tr>
|
||
<td><p><code class="literal">www</code></p></td>
|
||
<td><p><code class="literal">600</code></p></td>
|
||
<td><p><code class="literal">IN</code></p></td>
|
||
<td><p><code class="literal">A</code></p></td>
|
||
<td><p><code class="literal">10.0.0.1</code></p></td>
|
||
</tr>
|
||
<tr>
|
||
<td><p></p></td>
|
||
<td><p><code class="literal">600</code></p></td>
|
||
<td><p><code class="literal">IN</code></p></td>
|
||
<td><p><code class="literal">A</code></p></td>
|
||
<td><p><code class="literal">10.0.0.2</code></p></td>
|
||
</tr>
|
||
<tr>
|
||
<td><p></p></td>
|
||
<td><p><code class="literal">600</code></p></td>
|
||
<td><p><code class="literal">IN</code></p></td>
|
||
<td><p><code class="literal">A</code></p></td>
|
||
<td><p><code class="literal">10.0.0.3</code></p></td>
|
||
</tr>
|
||
</tbody>
|
||
</table></div>
|
||
<p>When a resolver queries for these records, <span class="acronym">BIND</span> will rotate
|
||
them and respond to the query with the records in a different
|
||
order. In the example above, clients will randomly receive
|
||
records in the order 1, 2, 3; 2, 3, 1; and 3, 1, 2. Most clients
|
||
will use the first record returned and discard the rest.</p>
|
||
<p>For more detail on ordering responses, check the
|
||
<span><strong class="command">rrset-order</strong></span> substatement in the
|
||
<span><strong class="command">options</strong></span> statement, see
|
||
<a href="Bv9ARM.ch06.html#rrset_ordering">RRset Ordering</a>.
|
||
This substatement is not supported in
|
||
<span class="acronym">BIND</span> 9, and only the ordering scheme described above is
|
||
available.</p>
|
||
</div>
|
||
<div class="sect1" lang="en">
|
||
<div class="titlepage"><div><div><h2 class="title" style="clear: both">
|
||
<a name="notify"></a>Notify</h2></div></div></div>
|
||
<p><span class="acronym">DNS</span> Notify is a mechanism that allows master nameservers to
|
||
notify their slave servers of changes to a zone's data. In
|
||
response to a <span><strong class="command">NOTIFY</strong></span> from a master server, the
|
||
slave will check to see that its version of the zone is the
|
||
current version and, if not, initiate a transfer.</p>
|
||
<p><span class="acronym">DNS</span>
|
||
Notify is fully documented in RFC 1996. See also the description
|
||
of the zone option <span><strong class="command">also-notify</strong></span>, see
|
||
<a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>. For more information about
|
||
<span><strong class="command">notify</strong></span>, see <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.</p>
|
||
</div>
|
||
<div class="sect1" lang="en">
|
||
<div class="titlepage"><div><div><h2 class="title" style="clear: both">
|
||
<a name="id2547747"></a>Nameserver Operations</h2></div></div></div>
|
||
<div class="sect2" lang="en">
|
||
<div class="titlepage"><div><div><h3 class="title">
|
||
<a name="id2547752"></a>Tools for Use With the Nameserver Daemon</h3></div></div></div>
|
||
<p>There are several indispensable diagnostic, administrative
|
||
and monitoring tools available to the system administrator for controlling
|
||
and debugging the nameserver daemon. We describe several in this
|
||
section </p>
|
||
<div class="sect3" lang="en">
|
||
<div class="titlepage"><div><div><h4 class="title">
|
||
<a name="diagnostic_tools"></a>Diagnostic Tools</h4></div></div></div>
|
||
<div class="variablelist"><dl>
|
||
<dt><span class="term"><a name="dig"></a><span><strong class="command">dig</strong></span></span></dt>
|
||
<dd>
|
||
<p>The domain information groper (<span><strong class="command">dig</strong></span>) is
|
||
a command line tool that can be used to gather information from
|
||
the Domain Name System servers. Dig has two modes: simple interactive
|
||
mode for a single query, and batch mode which executes a query for
|
||
each in a list of several query lines. All query options are accessible
|
||
from the command line.</p>
|
||
<div class="cmdsynopsis"><p><code class="command">dig</code> [@<em class="replaceable"><code>server</code></em>] <em class="replaceable"><code>domain</code></em> [<em class="replaceable"><code>query-type</code></em>] [<em class="replaceable"><code>query-class</code></em>] [+<em class="replaceable"><code>query-option</code></em>] [-<em class="replaceable"><code>dig-option</code></em>] [%<em class="replaceable"><code>comment</code></em>]</p></div>
|
||
<p>The usual simple use of dig will take the form</p>
|
||
<p><span><strong class="command">dig @server domain query-type query-class</strong></span></p>
|
||
<p>For more information and a list of available commands and
|
||
options, see the <span><strong class="command">dig</strong></span> man page.</p>
|
||
</dd>
|
||
<dt><span class="term"><span><strong class="command">host</strong></span></span></dt>
|
||
<dd>
|
||
<p>The <span><strong class="command">host</strong></span> utility
|
||
provides a simple <span class="acronym">DNS</span> lookup using a command-line interface for
|
||
looking up Internet hostnames. By default, the utility converts
|
||
between host names and Internet addresses, but its functionality
|
||
can be extended with the use of options.</p>
|
||
<div class="cmdsynopsis"><p><code class="command">host</code> [-aCdlrTwv] [-c <em class="replaceable"><code>class</code></em>] [-N <em class="replaceable"><code>ndots</code></em>] [-t <em class="replaceable"><code>type</code></em>] [-W <em class="replaceable"><code>timeout</code></em>] [-R <em class="replaceable"><code>retries</code></em>] <em class="replaceable"><code>hostname</code></em> [<em class="replaceable"><code>server</code></em>]</p></div>
|
||
<p>For more information and a list of available commands and
|
||
options, see the <span><strong class="command">host</strong></span> man page.</p>
|
||
</dd>
|
||
<dt><span class="term"><span><strong class="command">nslookup</strong></span></span></dt>
|
||
<dd>
|
||
<p><span><strong class="command">nslookup</strong></span> is a program used to query Internet
|
||
domain nameservers. <span><strong class="command">nslookup</strong></span> has two modes: interactive
|
||
and non-interactive. Interactive mode allows the user to query nameservers
|
||
for information about various hosts and domains or to print a list
|
||
of hosts in a domain. Non-interactive mode is used to print just
|
||
the name and requested information for a host or domain.</p>
|
||
<div class="cmdsynopsis"><p><code class="command">nslookup</code> [-option...] [[<em class="replaceable"><code>host-to-find</code></em>] | [- [server]]]</p></div>
|
||
<p>Interactive mode is entered when no arguments are given (the
|
||
default nameserver will be used) or when the first argument is a
|
||
hyphen (`-') and the second argument is the host name or Internet address
|
||
of a nameserver.</p>
|
||
<p>Non-interactive mode is used when the name or Internet address
|
||
of the host to be looked up is given as the first argument. The
|
||
optional second argument specifies the host name or address of a nameserver.</p>
|
||
<p>Due to its arcane user interface and frequently inconsistent
|
||
behavior, we do not recommend the use of <span><strong class="command">nslookup</strong></span>.
|
||
Use <span><strong class="command">dig</strong></span> instead.</p>
|
||
</dd>
|
||
</dl></div>
|
||
</div>
|
||
<div class="sect3" lang="en">
|
||
<div class="titlepage"><div><div><h4 class="title">
|
||
<a name="admin_tools"></a>Administrative Tools</h4></div></div></div>
|
||
<p>Administrative tools play an integral part in the management
|
||
of a server.</p>
|
||
<div class="variablelist"><dl>
|
||
<dt>
|
||
<a name="named-checkconf"></a><span class="term"><span><strong class="command">named-checkconf</strong></span></span>
|
||
</dt>
|
||
<dd>
|
||
<p>The <span><strong class="command">named-checkconf</strong></span> program
|
||
checks the syntax of a <code class="filename">named.conf</code> file.</p>
|
||
<div class="cmdsynopsis"><p><code class="command">named-checkconf</code> [-t <em class="replaceable"><code>directory</code></em>] [<em class="replaceable"><code>filename</code></em>]</p></div>
|
||
</dd>
|
||
<dt>
|
||
<a name="named-checkzone"></a><span class="term"><span><strong class="command">named-checkzone</strong></span></span>
|
||
</dt>
|
||
<dd>
|
||
<p>The <span><strong class="command">named-checkzone</strong></span> program checks a master file for
|
||
syntax and consistency.</p>
|
||
<div class="cmdsynopsis"><p><code class="command">named-checkzone</code> [-dq] [-c <em class="replaceable"><code>class</code></em>] <em class="replaceable"><code>zone</code></em> [<em class="replaceable"><code>filename</code></em>]</p></div>
|
||
</dd>
|
||
<dt>
|
||
<a name="rndc"></a><span class="term"><span><strong class="command">rndc</strong></span></span>
|
||
</dt>
|
||
<dd>
|
||
<p>The remote name daemon control
|
||
(<span><strong class="command">rndc</strong></span>) program allows the system
|
||
administrator to control the operation of a nameserver.
|
||
If you run <span><strong class="command">rndc</strong></span> without any options
|
||
it will display a usage message as follows:</p>
|
||
<div class="cmdsynopsis"><p><code class="command">rndc</code> [-c <em class="replaceable"><code>config</code></em>] [-s <em class="replaceable"><code>server</code></em>] [-p <em class="replaceable"><code>port</code></em>] [-y <em class="replaceable"><code>key</code></em>] <em class="replaceable"><code>command</code></em> [<em class="replaceable"><code>command</code></em>...]</p></div>
|
||
<p><span><strong class="command">command</strong></span> is one of the following:</p>
|
||
<div class="variablelist"><dl>
|
||
<dt><span class="term"><strong class="userinput"><code>reload</code></strong></span></dt>
|
||
<dd><p>Reload configuration file and zones.</p></dd>
|
||
<dt><span class="term"><strong class="userinput"><code>reload <em class="replaceable"><code>zone</code></em>
|
||
[<span class="optional"><em class="replaceable"><code>class</code></em>
|
||
[<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
|
||
<dd><p>Reload the given zone.</p></dd>
|
||
<dt><span class="term"><strong class="userinput"><code>refresh <em class="replaceable"><code>zone</code></em>
|
||
[<span class="optional"><em class="replaceable"><code>class</code></em>
|
||
[<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
|
||
<dd><p>Schedule zone maintenance for the given zone.</p></dd>
|
||
<dt><span class="term"><strong class="userinput"><code>reconfig</code></strong></span></dt>
|
||
<dd><p>Reload the configuration file and load new zones,
|
||
but do not reload existing zone files even if they have changed.
|
||
This is faster than a full <span><strong class="command">reload</strong></span> when there
|
||
is a large number of zones because it avoids the need to examine the
|
||
modification times of the zones files.
|
||
</p></dd>
|
||
<dt><span class="term"><strong class="userinput"><code>stats</code></strong></span></dt>
|
||
<dd><p>Write server statistics to the statistics file.</p></dd>
|
||
<dt><span class="term"><strong class="userinput"><code>querylog</code></strong></span></dt>
|
||
<dd><p>Toggle query logging. Query logging can also be enabled
|
||
by explicitly directing the <span><strong class="command">queries</strong></span>
|
||
<span><strong class="command">category</strong></span> to a <span><strong class="command">channel</strong></span> in the
|
||
<span><strong class="command">logging</strong></span> section of
|
||
<code class="filename">named.conf</code>.</p></dd>
|
||
<dt><span class="term"><strong class="userinput"><code>dumpdb</code></strong></span></dt>
|
||
<dd><p>Dump the server's caches to the dump file. </p></dd>
|
||
<dt><span class="term"><strong class="userinput"><code>stop</code></strong></span></dt>
|
||
<dd><p>Stop the server,
|
||
making sure any recent changes
|
||
made through dynamic update or IXFR are first saved to the master files
|
||
of the updated zones.</p></dd>
|
||
<dt><span class="term"><strong class="userinput"><code>halt</code></strong></span></dt>
|
||
<dd><p>Stop the server immediately. Recent changes
|
||
made through dynamic update or IXFR are not saved to the master files,
|
||
but will be rolled forward from the journal files when the server
|
||
is restarted.</p></dd>
|
||
<dt><span class="term"><strong class="userinput"><code>trace</code></strong></span></dt>
|
||
<dd><p>Increment the servers debugging level by one. </p></dd>
|
||
<dt><span class="term"><strong class="userinput"><code>trace <em class="replaceable"><code>level</code></em></code></strong></span></dt>
|
||
<dd><p>Sets the server's debugging level to an explicit
|
||
value.</p></dd>
|
||
<dt><span class="term"><strong class="userinput"><code>notrace</code></strong></span></dt>
|
||
<dd><p>Sets the server's debugging level to 0.</p></dd>
|
||
<dt><span class="term"><strong class="userinput"><code>flush</code></strong></span></dt>
|
||
<dd><p>Flushes the server's cache.</p></dd>
|
||
<dt><span class="term"><strong class="userinput"><code>status</code></strong></span></dt>
|
||
<dd><p>Display status of the server.
|
||
Note the number of zones includes the internal <span><strong class="command">bind/CH</strong></span> zone
|
||
and the default <span><strong class="command">./IN</strong></span> hint zone if there is not a
|
||
explicit root zone configured.</p></dd>
|
||
</dl></div>
|
||
<p>In <span class="acronym">BIND</span> 9.2, <span><strong class="command">rndc</strong></span>
|
||
supports all the commands of the BIND 8 <span><strong class="command">ndc</strong></span>
|
||
utility except <span><strong class="command">ndc start</strong></span>, which was also
|
||
not supported in <span><strong class="command">ndc</strong></span>'s channel mode.</p>
|
||
<p>A configuration file is required, since all
|
||
communication with the server is authenticated with
|
||
digital signatures that rely on a shared secret, and
|
||
there is no way to provide that secret other than with a
|
||
configuration file. The default location for the
|
||
<span><strong class="command">rndc</strong></span> configuration file is
|
||
<code class="filename">/etc/rndc.conf</code>, but an alternate
|
||
location can be specified with the <code class="option">-c</code>
|
||
option. If the configuration file is not found,
|
||
<span><strong class="command">rndc</strong></span> will also look in
|
||
<code class="filename">/etc/rndc.key</code> (or whatever
|
||
<code class="varname">sysconfdir</code> was defined when
|
||
the <span class="acronym">BIND</span> build was configured).
|
||
The <code class="filename">rndc.key</code> file is generated by
|
||
running <span><strong class="command">rndc-confgen -a</strong></span> as described in
|
||
<a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage" title="controls Statement Definition and Usage">the section called “<span><strong class="command">controls</strong></span> Statement Definition and Usage”</a>.</p>
|
||
<p>The format of the configuration file is similar to
|
||
that of <code class="filename">named.conf</code>, but limited to
|
||
only four statements, the <span><strong class="command">options</strong></span>,
|
||
<span><strong class="command">key</strong></span>, <span><strong class="command">server</strong></span> and
|
||
<span><strong class="command">include</strong></span>
|
||
statements. These statements are what associate the
|
||
secret keys to the servers with which they are meant to
|
||
be shared. The order of statements is not
|
||
significant.</p>
|
||
<p>The <span><strong class="command">options</strong></span> statement has three clauses:
|
||
<span><strong class="command">default-server</strong></span>, <span><strong class="command">default-key</strong></span>,
|
||
and <span><strong class="command">default-port</strong></span>.
|
||
<span><strong class="command">default-server</strong></span> takes a
|
||
host name or address argument and represents the server that will
|
||
be contacted if no <code class="option">-s</code>
|
||
option is provided on the command line.
|
||
<span><strong class="command">default-key</strong></span> takes
|
||
the name of key as its argument, as defined by a <span><strong class="command">key</strong></span> statement.
|
||
<span><strong class="command">default-port</strong></span> specifies the port to which
|
||
<span><strong class="command">rndc</strong></span> should connect if no
|
||
port is given on the command line or in a
|
||
<span><strong class="command">server</strong></span> statement.</p>
|
||
<p>The <span><strong class="command">key</strong></span> statement names a key with its
|
||
string argument. The string is required by the server to be a valid
|
||
domain name, though it need not actually be hierarchical; thus,
|
||
a string like "<strong class="userinput"><code>rndc_key</code></strong>" is a valid name.
|
||
The <span><strong class="command">key</strong></span> statement has two clauses:
|
||
<span><strong class="command">algorithm</strong></span> and <span><strong class="command">secret</strong></span>.
|
||
While the configuration parser will accept any string as the argument
|
||
to algorithm, currently only the string "<strong class="userinput"><code>hmac-md5</code></strong>"
|
||
has any meaning. The secret is a base-64 encoded string.</p>
|
||
<p>The <span><strong class="command">server</strong></span> statement uses the key clause
|
||
to associate a <span><strong class="command">key</strong></span>-defined key with a server.
|
||
The argument to the <span><strong class="command">server</strong></span> statement is a
|
||
host name or address (addresses must be double quoted). The argument
|
||
to the key clause is the name of the key as defined by the <span><strong class="command">key</strong></span> statement.
|
||
The <span><strong class="command">port</strong></span> clause can be used to
|
||
specify the port to which <span><strong class="command">rndc</strong></span> should connect
|
||
on the given server.</p>
|
||
<p>A sample minimal configuration file is as follows:</p>
|
||
<pre class="programlisting">
|
||
key rndc_key {
|
||
algorithm "hmac-md5";
|
||
secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K";
|
||
};
|
||
options {
|
||
default-server localhost;
|
||
default-key rndc_key;
|
||
};
|
||
</pre>
|
||
<p>This file, if installed as <code class="filename">/etc/rndc.conf</code>,
|
||
would allow the command:</p>
|
||
<p><code class="prompt">$ </code><strong class="userinput"><code>rndc reload</code></strong></p>
|
||
<p>to connect to 127.0.0.1 port 953 and cause the nameserver
|
||
to reload, if a nameserver on the local machine were running with
|
||
following controls statements:</p>
|
||
<pre class="programlisting">
|
||
controls {
|
||
inet 127.0.0.1 allow { localhost; } keys { rndc_key; };
|
||
};
|
||
</pre>
|
||
<p>and it had an identical key statement for
|
||
<code class="literal">rndc_key</code>.</p>
|
||
<p>Running the <span><strong class="command">rndc-confgen</strong></span> program will
|
||
conveniently create a <code class="filename">rndc.conf</code>
|
||
file for you, and also display the
|
||
corresponding <span><strong class="command">controls</strong></span> statement that you need to
|
||
add to <code class="filename">named.conf</code>. Alternatively,
|
||
you can run <span><strong class="command">rndc-confgen -a</strong></span> to set up
|
||
a <code class="filename">rndc.key</code> file and not modify
|
||
<code class="filename">named.conf</code> at all.
|
||
</p>
|
||
</dd>
|
||
</dl></div>
|
||
</div>
|
||
</div>
|
||
<div class="sect2" lang="en">
|
||
<div class="titlepage"><div><div><h3 class="title">
|
||
<a name="id2550667"></a>Signals</h3></div></div></div>
|
||
<p>Certain UNIX signals cause the name server to take specific
|
||
actions, as described in the following table. These signals can
|
||
be sent using the <span><strong class="command">kill</strong></span> command.</p>
|
||
<div class="informaltable"><table border="1">
|
||
<colgroup>
|
||
<col>
|
||
<col>
|
||
</colgroup>
|
||
<tbody>
|
||
<tr>
|
||
<td><p><span><strong class="command">SIGHUP</strong></span></p></td>
|
||
<td><p>Causes the server to read <code class="filename">named.conf</code> and
|
||
reload the database. </p></td>
|
||
</tr>
|
||
<tr>
|
||
<td><p><span><strong class="command">SIGTERM</strong></span></p></td>
|
||
<td><p>Causes the server to clean up and exit.</p></td>
|
||
</tr>
|
||
<tr>
|
||
<td>
|
||
<p><span><strong class="command">SIGINT</strong></span></p>
|
||
</td>
|
||
<td><p>Causes the server to clean up and exit.</p></td>
|
||
</tr>
|
||
</tbody>
|
||
</table></div>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
<div class="navfooter">
|
||
<hr>
|
||
<table width="100%" summary="Navigation footer">
|
||
<tr>
|
||
<td width="40%" align="left">
|
||
<a accesskey="p" href="Bv9ARM.ch02.html">Prev</a> </td>
|
||
<td width="20%" align="center"> </td>
|
||
<td width="40%" align="right"> <a accesskey="n" href="Bv9ARM.ch04.html">Next</a>
|
||
</td>
|
||
</tr>
|
||
<tr>
|
||
<td width="40%" align="left" valign="top">Chapter 2. <span class="acronym">BIND</span> Resource Requirements </td>
|
||
<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
|
||
<td width="40%" align="right" valign="top"> Chapter 4. Advanced Concepts</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
</body>
|
||
</html>
|