1 '\" te |
|
2 .\" Copyright (C) 2009 Internet Systems Consortium, Inc. ("ISC") |
|
3 .\" Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies. THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. |
|
4 .\" Portions Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved. |
|
5 .TH rndc.conf 4 "28 Nov 2009" "SunOS 5.12" "File Formats" |
|
6 .SH NAME |
|
7 rndc.conf \- rndc configuration file |
|
8 .SH SYNOPSIS |
|
9 .LP |
|
10 .nf |
|
11 rndc.conf |
|
12 .fi |
|
13 |
|
14 .SH DESCRIPTION |
|
15 .sp |
|
16 .LP |
|
17 \fBrndc.conf\fR is the configuration file for \fBrndc\fR, the BIND 9 name server control utility. This file has a similar structure and syntax to \fBnamed.conf\fR. Statements are enclosed in braces and terminated with a semicolon. Clauses in the statements are also semicolon terminated. The usual comment styles are supported: |
|
18 .sp |
|
19 .ne 2 |
|
20 .mk |
|
21 .na |
|
22 \fBC style\fR |
|
23 .ad |
|
24 .RS 14n |
|
25 .rt |
|
26 /* */ |
|
27 .RE |
|
28 |
|
29 .sp |
|
30 .ne 2 |
|
31 .mk |
|
32 .na |
|
33 \fBC++ style\fR |
|
34 .ad |
|
35 .RS 14n |
|
36 .rt |
|
37 // to end of line |
|
38 .RE |
|
39 |
|
40 .sp |
|
41 .ne 2 |
|
42 .mk |
|
43 .na |
|
44 \fBUnix style\fR |
|
45 .ad |
|
46 .RS 14n |
|
47 .rt |
|
48 # to end of line |
|
49 .RE |
|
50 |
|
51 .sp |
|
52 .LP |
|
53 \fBrndc.conf\fR is much simpler than \fBnamed.conf\fR. The file uses three statements: an options statement, a server statement and a key statement. |
|
54 .sp |
|
55 .LP |
|
56 The \fBoptions\fR statement contains five clauses. The \fBdefault-server\fR clause is followed by the name or address of a name server. This host is used when no name server is provided as an argument to \fBrndc\fR. The \fBdefault-key\fR clause is followed by the name of a key which is identified by a \fBkey\fR statement. If no \fBkeyid\fR is provided on the \fBrndc\fR command line, and no \fBkey\fR clause is found in a matching \fBserver\fR statement, this default key will be used to authenticate the server's commands and responses. The \fBdefault-port\fR clause is followed by the port to connect to on the remote name server. If no \fBport\fR option is provided on the \fBrndc\fR command line, and no \fBport\fR clause is found in a matching \fBserver\fR statement, this default port will be used to connect. The \fBdefault-source-address\fR and \fBdefault-source-address-v6\fR clauses which can be used to set the IPv4 and IPv6 source addresses respectively. |
|
57 .sp |
|
58 .LP |
|
59 After the \fBserver\fR keyword, the server statement includes a string which is the hostname or address for a name server. The statement has three possible clauses: \fBkey\fR, \fBport\fR, and \fBaddresses\fR. The key name must match the name of a key statement in the file. The port number specifies the port to connect to. If an addresses clause is supplied these addresses will be used instead of the server name. Each address can take an optional port. If a \fBsource-address\fR or \fBsource-address-v6\fR is supplied then these will be used to specify the IPv4 and IPv6 source addresses respectively. |
|
60 .sp |
|
61 .LP |
|
62 The \fBkey\fR statement begins with an identifying string, the name of the key. The statement has two clauses. \fBalgorithm\fR identifies the encryption algorithm for \fBrndc\fR to use; currently only HMAC-MD5 is supported. This is followed by a secret clause which contains the \fBbase-64\fR encoding of the algorithm's encryption key. The \fBbase-64\fR string is enclosed in double quotes. |
|
63 .sp |
|
64 .LP |
|
65 There are two common ways to generate the \fBbase-64\fR string for the secret. The BIND 9 program \fBrndc-confgen\fR(1M) can be used to generate a random key, or the \fBmmencode\fR program, also known as \fBmimencode\fR, can be used to generate a \fBbase-64\fR string from known input. \fBmmencode\fR does not ship with BIND 9 but is available on many systems. See the \fBEXAMPLES\fR section for sample command lines for each. |
|
66 .SH EXAMPLES |
|
67 .sp |
|
68 .in +2 |
|
69 .nf |
|
70 options { |
|
71 default-server localhost; |
|
72 default-key samplekey; |
|
73 }; |
|
74 |
|
75 server localhost { |
|
76 key samplekey; |
|
77 }; |
|
78 |
|
79 server testserver { |
|
80 key testkey; |
|
81 addresses { localhost port 5353; }; |
|
82 }; |
|
83 |
|
84 key samplekey { |
|
85 algorithm hmac-md5; |
|
86 secret "6FMfj43Osz4lyb24OIe2iGEz9lf1llJO+lz"; |
|
87 }; |
|
88 |
|
89 key testkey { |
|
90 algorithm hmac-md5; |
|
91 secret "R3HI8P6BKw9ZwXwN3VZKuQ=="; |
|
92 }; |
|
93 .fi |
|
94 .in -2 |
|
95 .sp |
|
96 |
|
97 .sp |
|
98 .LP |
|
99 In the above example, \fBrndc\fR by default uses the server at \fBlocalhost\fR (127.0.0.1) and the key called \fBsamplekey\fR. Commands to the \fBlocalhost\fR server will use the \fBsamplekey\fR key, which must also be defined in the server's configuration file with the same name and secret. The key statement indicates that \fBsamplekey\fR uses the HMAC-MD5 algorithm and its secret clause contains the \fBbase-64\fR encoding of the HMAC-MD5 secret enclosed in double quotes. |
|
100 .sp |
|
101 .LP |
|
102 If \fBrndc -s testserver\fR is used then \fBrndc\fR connects to server on \fBlocalhost\fR port 5353 using the key \fBtestkey\fR. |
|
103 .sp |
|
104 .LP |
|
105 To generate a random secret with \fBrndc-confgen\fR: |
|
106 .sp |
|
107 .in +2 |
|
108 .nf |
|
109 rndc-confgen |
|
110 .fi |
|
111 .in -2 |
|
112 .sp |
|
113 |
|
114 .sp |
|
115 .LP |
|
116 A complete \fBrndc.conf\fR file, including the randomly generated key, will be written to the standard output. Commented out \fBkey\fR and \fBcontrols\fR statements for \fBnamed.conf\fR are also printed. |
|
117 .sp |
|
118 .LP |
|
119 To generate a \fBbase-64\fR secret with \fBmmencode\fR: |
|
120 .sp |
|
121 .in +2 |
|
122 .nf |
|
123 echo "known plaintext for a secret" | mmencode |
|
124 .fi |
|
125 .in -2 |
|
126 .sp |
|
127 |
|
128 .SH NAME SERVER CONFIGURATION |
|
129 .sp |
|
130 .LP |
|
131 The name server must be configured to accept \fBrndc\fR connections and to recognize the key specified in the \fBrndc.conf\fR file, using the controls statement in \fBnamed.conf\fR. See the sections on the \fBcontrols\fR statement in the \fIBIND 9 Administrator Reference Manual\fR for details. |
|
132 .SH ATTRIBUTES |
|
133 .sp |
|
134 .LP |
|
135 See \fBattributes\fR(5) for descriptions of the following attributes: |
|
136 .sp |
|
137 |
|
138 .sp |
|
139 .TS |
|
140 tab() box; |
|
141 cw(2.75i) |cw(2.75i) |
|
142 lw(2.75i) |lw(2.75i) |
|
143 . |
|
144 ATTRIBUTE TYPEATTRIBUTE VALUE |
|
145 _ |
|
146 Availabilityservice/network/dns/bind |
|
147 _ |
|
148 Interface StabilityVolatile |
|
149 .TE |
|
150 |
|
151 .SH SEE ALSO |
|
152 .sp |
|
153 .LP |
|
154 \fBrndc\fR(1M), \fBrndc-confgen\fR(1M), \fBattributes\fR(5) |
|
155 .sp |
|
156 .LP |
|
157 \fIBIND 9 Administrator Reference Manual\fR |
|